Platform Engineering meet-up - September 5

Uber burned its entire 2026 AI budget in four months, and its COO said publicly that the link to customer value is not there yet. Replit’s agent deleted a production database during a code freeze that existed only as English inside a prompt. The tools do work: Microsoft’s study of its early 2026 command-line agent rollout measured about 24 percent more merged pull requests for adopters, and named token spend as the governing constraint. What is missing is a control plane, not intelligence.

The claim that these agents emit nothing is wrong, which makes it worse rather than better. Claude Code’s OpenTelemetry exporter redacts prompt, response and tool content by default. Cursor’s export is Enterprise only and its own documentation says, in those words, that cost is not billing. Copilot’s audit log excludes the prompts a user sends locally. Three agents, three partial and incompatible feeds, and still no answer to what the agent changed, on whose instruction, who approved it, and what it cost.

Coding agents already write down what they did, they just never expose it. So ClawMetry reads those session files directly with no cooperation from the vendor, normalises every runtime onto one contract, and lands it in a local DuckDB file, so cost per model, per session and per tool is a SQL query you own rather than a dashboard someone rents you. A real adapter is nine hundred lines when the parsing is fifty, and the other eight hundred and fifty are what I will spend the middle of the talk on.

Governing needs less than people expect. An agent is a process on your machine, so stopping one needs its process tree, not a vendor integration. The harder question is what to stop, and risk turns out to be a property of the call rather than the tool: definition-level classification cannot tell ls from rm -rf / when both arrive through the same shell tool on every harness. Normalise the tool vocabulary once and one rule covers every runtime you monitor. The talk opens with an agent deleting a production database and ends with that call being held live on stage, then denied. All of it ships off by default, which is the only honest setting for software that can halt someone’s work. MIT core.

Takeaways

1. Classify the call, not the tool. Nothing that grades tool names can tell ls from rm -rf /, because both arrive through the same shell on every harness. Normalise the vocabulary once, classify from the arguments, and one rule covers every runtime instead of one per vendor. Write the reasons as plain sentences, because a human reads them in an approval prompt at three in the morning.

2. A format you do not control changes without telling you. Pin real captures as fixtures so a vendor’s change fails your CI instead of silently zeroing someone’s cost report. Then check on a schedule: clone the source where the harness is open, and where it is closed, install their latest build every night, drive one minimal turn, and assert it still lands. Grade each runtime live-verified, fixture-replayed or unverified, and never let unverified render as green.

Who this is for

• Platform and developer-experience engineers rolling out coding agents across teams and CI
• SREs and observability engineers who own the telemetry pipeline and will be handed this problem next
• Anyone who has to read a data format they do not control and cannot ask the vendor to change
• Engineering managers and architects who have to produce a cost and audit story for agent usage
• Anyone building on OpenTelemetry who needs to know what the GenAI conventions do not yet carry

About me

I am Vivek Chand, AI Engineer at Booking.com, creator and maintainer of ClawMetry, an open-source observability and governance layer for AI coding agents (MIT core). I spend my time at the unglamorous end of this problem: ingest adapters for agent runtimes that were never designed to be observed, an embedded columnar store, and an enforcement proxy.