Junior assigns a separate agent to verify tool calls

• Junior assigns a separate permissions agent to verify tool calls, according to its creator zeeg.
• Each thread gets its own transcript, with aggressive compaction for long conversations, while capabilities, prompts, persona and memory access stay uniform, as zeeg’s explanation and his follow-up describe.
• Junior’s weekly Slack report lists child agents, blocking review questions and concurrent routing, sandbox setup and memory recall in its release summary.

Junior’s network policy blocks PR approval even when its GitHub token allows it. David Cramer, creator of Sentry’s open-source Slack agent, also described a 240-second soft deadline in July so runs could pause at resumable points before serverless timeouts.

Junior runs several agents internally, including one focused on permissions that verifies tool calls, Cramer said. His code-review process sends some work through Junior, some through humans, and everything through a few additional tools.

He dismissed “multi-agent role playing” in the same discussion. Permissions are a refreshingly concrete job for another agent.

Junior’s conversation model separates three things:

• Transcripts: each thread starts a new one.
• Long conversations: more aggressive compaction supports long-lived threads.
• Configuration: capabilities, system prompt, persona and memory access remain consistent across threads.

Cramer starts roughly 50 threads a day, using them for efficiency and organization rather than assigning different roles, according to his follow-up. He also allows that use-case-specific memory can make sense when someone wants to keep categories of work separate.

Junior’s egress proxy enforces credential and routing rules at the network boundary:

1. Inject credentials outside the sandbox. The proxy supplies authorization headers. Missing credentials pause the turn and trigger an authorization link for the user.
2. Reject alternate PR-creation paths. When gh pr create sends a createPullRequest GraphQL mutation, the proxy returns HTTP 403 and directs the agent to github_createPullRequest.
3. Require the tool’s behavior. That tool owns idempotency and adds the conversation footer to the PR description.

Sandbox requests carry signed, short-lived context identifying the actor and conversation. Junior’s native tools additionally declare the operation they are performing, such as github.pull.create.

Junior broadcasts its own changes in Slack. The October 26 to November 2 report covers 12 releases, from 0.258.0 through 0.269.0, with these highlights:

• Review desk: review items, a dashboard page and Slack cards; addReviewItem lets Junior ask blocking questions.
• Child agents: Claude Code-style subagents with implicit delegation and agent types, added in 0.262.0.
• Event automations: support for any resource in a namespace, marked as a breaking change in 0.267.0.
• Plugins: read-only PagerDuty and Figma integrations.
• Remote MCP: a server with CIMD authentication.
• Infrastructure: a local Docker sandbox provider and TypeScript 7.
• Slack routing: a decision model routes passive replies.
• Sign-in: an allowed-domain list replaces Slack sign-in.
• Dashboard: migration to shadcn, with a light theme.
• Performance: routing, sandbox setup and memory recall run concurrently in 0.269.0.

Junior also takes image requests directly in Slack. In a follow-up post, zeeg shared celebratory artwork for a merged get_replay_details timeline change.

When Junior creates a pull request, it automatically subscribes to events that continue the work:

• Failed CI checks.
• Inline review comments and top-level PR comments.
• Submitted reviews, including approvals, change requests and comments.
• The PR merging or closing without a merge.

Events arrive as specially marked user messages. Agents can also create their own subscriptions within a conversation through watches, or outside it through automations.