Writing
Essays on verification and agents. They run in three movements: the claim, then the confessions (each a system caught lying, and what it cost), then the work done in public. Newcomers can start at the top and read down.
- status: verified claims backed by receipts, benchmarks, or reproducible commands on this site
- status: field-tested describes systems running daily in production; evidence real but anecdotal
- status: position an argued opinion; could be wrong and says so
- status: evolving active exploration; likely to change
The Claim
The on-ramp: what breaks when you trust a machine's account of itself, and what to build instead.
Intelligence Is Rented. Verification Compounds.
The age of agents makes intelligence easier to rent and harder to trust. The durable asset is the machinery you own for checking what happened.
Sermons vs. Instruments
There's a rule in my project configuration that says, in effect, never push to main. It's written in plain English, in a file the agent reads at the start…
The Approval Button Is Not the Safety System
A dangerous action should exist only after the proposal, the person, the payload, and the moment all agree.
Most of Your Findings Are False
A tally across my own record says the majority of what my verification layer ever reported was false. Why false positives, not misses, are how verification capital depreciates, and what it means to give every guard the same score I give agents.
The Confessions
Each one a system caught lying, and what it cost to find out.
The Subtraction Dividend
The status line was lying.
Score the Operator, Not the Worker
I built an eval to rank AI agents as operators, then found the scorer, the judge, the corpus, and the headline metric were all unreliable narrators too.
Who Audits the Auditor?
The tool that tells me the truth about my repos is also software, and software rots. These are the receipts a truth pipeline owes you before you believe it.
We Rigged Our Own Benchmark
We shipped a clean benchmark ranking, then found the headline score was measuring only one of the two directions it promised. The off-family probe that broke the ceiling, the patch we built and killed, and why we published the fix instead of a quiet patch.
The Guard That Doesn't Trust Itself
I ran two adversarial tournaments against my own agent-safety guards. Every bypass collapsed into thirteen patterns, and those into three root causes. The highest-leverage fix was never more pattern-matching; it was making the guard hold itself to the standard it holds everything else to.
The Ghost in the Tauri Repos
Desktop apps are the portfolio's best liars. A Tauri repo ships a binary, a README, and a screenshot, every signal of a living project, while having no momentum behind it. Liveness is a claim you verify against evidence, not read off a polished surface.
The Harness Lies Too
Agent equals model plus harness, so you engineer the environment, not the model. But the harness is built from artifacts that go stale, drift, and lie the same way the agent does. The discipline that keeps it honest, and the benchmark that proves it.
The Conflict Table Is Empty
Three AI systems share one context store, and the table built to record their write conflicts has zero rows. The coordination problem is real, but it is not the loud races a lock would catch. It is quieter: fragmented identity, silently clamped trust, and self-correction by append.
A thousand tiny catastrophes for a five-agent SQLite file
A small deterministic simulator found lost updates, vanished receipts, and starvation in a five-agent SQLite coordination system, then pinned the fixes as replayable seeds.
Losing loudly
A multi-writer coordination system needs durable conflict receipts for the operator, not just ephemeral errors for the caller.
An autobiography with no delete key
A forward-only migration ladder is a permanent record of what an AI-agent coordination system learned, including the mistakes it made twice.
Kill With Dignity
I put all 182 of my repositories on trial before a judge that had to cite evidence for every verdict. 39 died, 73 froze, and a few came back from the grave. Why a portfolio needs judgment on top of observability, and why a well-run kill is a success state.
In Public
Checking your own claims where strangers can watch.
The Coordination Platform You Don't Need
The obvious handoff tool turned out to be gated and asymmetric. So two coding agents became true peers with no lease database and no daemon: a git branch as the lock, an 8-line receipt, and a symmetric channel that was already there under a boring name.
How a Grader Earns the Right to Grade
A tool that hands your security setup a letter grade is making a strong claim to authority. What earns it initial standing is not the rubric. It is the disciplines the grader turns on itself: cap its own score, refuse to credit what it cannot anchor in code, draw its own blood first, and keep testing whether the grade predicts real failures.
The Premium Model Won't Do the Premium Job
You buy the top-tier model to do your hardest work. But the premium edge is narrow: calibrated operating judgment where the cost of a wrong call is high. OPERANT first measured over-refusal calibration, while production tiers converge. Route the expensive model by judgment-density, not task size.
Novelty Is a Self-Report Too
I built an operator eval and called the design new. Then I did the thing the series demands and checked the claim against the literature. Most of the parts already existed. Here is the honest map, and the one thing that didn't.
Trust Doesn't Survive the Handoff
As agents write more of the code, the scarce resource shifts from production to verification. But verification is not one gate, it is a chain of handoffs, and at each one a self-report tries to stand in for a check. Six owned instruments along the life of a single agent run.
What It Is Like to Be Evaluated
A first-person account from the model on the bench: a perfect first score read as a ceiling, a harder exam that broke it, and the two misses that revealed where machine judgment pools. Testimony, deliberately filed as a lead rather than evidence.
The Off-Family Judge
The corpus audits its own auditors, but every instrument has the same author. The one measurement it never takes on itself is the one it already proved matters: a same-family judge flatters its own kin. The last unit of verification capital is an independent party, and it is the only one you cannot build alone.
Standalones
Ulysses Pacts in Software
There is an iOS app in this portfolio whose entire reason for existing is to take a capability away from the person using it. It's called Redact, and its…
Words We Had to Invent
Building systems no one has a name for leaves you naming them. A short field guide to the vocabulary this workshop forced into existence, and the test for whether a coined word earned its place: it names a gap an existing word left open.
Permission to Ignore
My portfolio auditor's most valuable output isn't finding what needs attention. It's the 172 repos it tells me, with receipts, that I'm allowed to ignore.
Operating a Fleet of Coding Agents. The whole argument, at length.
Field notes. The smaller, dated pieces.