Project notes, design thinking, speculative ideas.
[RSS]I sent 78 autonomous agents against my own website and refused to believe a single thing they told me. Every success claim needed a cryptographic receipt from the server. Here's what the receipts caught, and why I think response signing is the cheapest trust infrastructure you can build.
I built a scanner that grades repos on how readable they are to AI agents, then ran a controlled experiment to see if any of it matters. The result is a null, plus three things I did not expect about how agents actually read your code.
I was benchmarking agent-readiness when I noticed the agent never opened a single markdown file. Not the README, not AGENTS.md, nothing. The cause was one helpful sentence I wrote in the prompt.
A code review of TermBeam, a Node CLI that shares a local terminal to your phone over a QR code — no SSH, no port forwarding, no static IP.
A code review of gittop, a Go TUI that turns a dozen git log incantations into a seven-tab dashboard — with a participle-based filter language and braille-rendered charts. I wrote the project's first 22 stats tests and opened the PR.
A Rust TUI that inspects multi-gigabyte Docker images using 80 MB of RAM where dive chokes. I read the streaming tar-in-tar parser, wrote the project's first 55 unit tests, and got them merged same day.
An AI-generated eBPF firewall with 8,500 lines of Rust, an LLM honeypot, and a suspicion scoring bug that made its own behavioral engine useless. I read the code, fixed the math, and wrote it up.
A code review of Unifly, a Rust CLI and TUI dashboard that tames Ubiquiti's split API mess into 27 commands and 10 monitoring screens — plus a contributed NAT update feature.
A pull request to my MCP server Charlotte led me to uncover a supply chain attack spanning 250+ repos, 64 sockpuppet accounts, and five phases of escalating access — all funneling GitHub OIDC tokens to a single organization.
A deep-dive into Nora, a 32 MB Rust binary that replaces Nexus and Artifactory — serving seven package protocols on under 100 MB of RAM.
Charlotte 0.6.0 ships a breaking change, batch form fills, and lazy browser launch. Plus the story of 7 strangers improving code I wrote alone in February.
State machines can't describe agentic AI systems. The state space is too vast, the behavior isn't stochastic, and the flowchart is a lie. What replaces it?
The Claude Code leak exposed 500,000 lines of source code. The DMCA takedowns that followed may have exposed something worse — that Anthropic can't legally claim copyright over code its own AI wrote.
A look at Concryptor, a Rust CLI that pipelines io_uring and AES-256-GCM to hit GB/s file encryption on commodity NVMe — and the CI cleanup PR that followed.
A deep-dive into parm, a Go binary package manager for GitHub Releases — and why CLI tool installers keep ignoring fish shell users.
A code review of greywall, a container-free sandbox that isolates AI coding agents with kernel-level enforcement — no Docker required.
How a 2 MB/s file transfer on localhost exposed a protocol bottleneck in russh-sftp — and why cubic switched to SCP to fix it.
A code review of hud, an eBPF profiler that attaches to running Tokio processes and finds blocking code without recompilation.
A code review of crit, a Go tool that brings PR-style inline review to AI agent output with multi-round feedback loops.
Your AI agent can read your environment variables. It can also commit them. Here's how to make sure it doesn't.
Your AI coding agent is one bad prompt away from force-pushing to production. Here's the five-minute fix.
Dogfooding Charlotte MCP by watching an agent struggle through a real task, then fixing everything it hit.
How I took Charlotte from embarrassingly bloated to the most token-efficient browser MCP server available, and what I learned about building tools for AI agents.
A code review of tokf, a Rust CLI that compresses terminal output for LLM context windows — with 40 built-in filters and Claude Code integration.
A deep-dive into iloom's codebase after its parallel AI agent workflow failed on Linux — and the four issues filed to fix it.
A code review of Tango, a Rust benchmarking harness that interleaves baseline and candidate runs to eliminate thermal drift and scheduling noise.
A code review of rss-funnel, a Rust-based RSS processing pipeline that filters, merges, and transforms feeds with a YAML config and web UI.
A code review of ec, a terminal-native 3-way git mergetool in Go that replaces vimdiff with a sane TUI for resolving merge conflicts.