Insights
Engineering notes from real work — production AI, backend plumbing, ops, and quant research. Code in context, corrections published when we're wrong, no sales pitch.
Sample report: Agent secrets audit of deemwar's own setup
A sample of our agent secrets audit, run on our own agent setup: seven leak paths ranked by severity, the fixes, and what risk remains.
Sample agent-security review: Veilpipe's own repo
A free sample of our Claude Code agent-security review, run on our own public repository, Veilpipe, at release v0.2.6: what an agent session could reach, what was hidden from the model, and what had to be fixed.
Know what your agent CLI leaves behind
Before you roll a coding agent out to a team, find out what it writes to disk and what it leaves running. Here is what that looked like for three of them.
Veilpipe is open source. Your coding assistant never sees the value it replaced.
When you debug a payment or a login with a coding assistant, the key tends to end up in the conversation. You paste it into a prompt, or the assistant runs `cat .env`, or a tool prints a connection string. Whatever reach…
The agent was in staging. The token it found was for production.
In April 2026, a coding agent working on a routine task deleted a startup's production database and all of its backups in a single API call. It took nine seconds ([Giskard](https://www.giskard.ai/knowledge/a-cursor-ai-ag…
Run several coding agents on one repo, and their pull requests collide
Running several coding agents in parallel feels like free throughput. Each one takes a task, opens a pull request, and moves on. The cost shows up later, at merge time.
Agents write the code. Review is now the bottleneck.
Coding agents can open pull requests faster than any team can read them. The work did not disappear. It moved to review.
A 16.9 MB model can do the job. Here is how to tell when.
Last week (October 2) Cactus released Whistle, an open speech recognition model in a single 16.9 MB file ([post](https://cactuscompute.com/blog/whistle)). It runs on a CPU with no dependencies, transcribes seven language…
Your agent graded its own homework. Use a second model as the reviewer.
A coding agent finishes a change and reports that it is done and the tests pass. Often both are true, and the change is still wrong: the tests check what the agent thought the code should do, not what you needed.
A small model checking our docs was a coin flip. Giving it the docs fixed most of that.
A Hacker News thread this week argued that agents don't need memory, they need documentation ([discussion](https://news.ycombinator.com/item?id=49945933)). We had just measured a small version of that question, so here i…
We scanned our own agents' Claude Code transcripts for secrets. What we found, and what we changed.
We scanned our coding agents' Claude Code transcripts for secrets, then changed how prompts reach the model. What we found, measured, and what still fails.
Your Postgres dashboards got slow. Postgres, DuckDB or ClickHouse?
*What each engine does with an analytics query, what we measured on our own hardware, and the migration mistake that silently loses rows.*
Six times "done" was wrong, and how to make agent work checkable
Andrej Karpathy wrote on 2 October that we will spend a lot more time trying to understand what language models produce. Teams running coding agents are already paying that cost. The expensive part is rarely the model ge…
You don't need a frontier model for every decision in your agent loop
That distinction is the part worth pulling out, because it maps directly onto a mistake we see in a lot of agent code: every decision point routes through the same big model, because that's the model that's already wired…
Your agent didn't change. The cache did.
Someone ran a fifty-agent pipeline with real cost controls on it: a 200K token ceiling per agent, hard abort checkpoints, runaway guards, a per-agent cost ledger. Thirty-six agents finished 72% of the work on 3–4% of the…
The boring part: governance that enforces, not displays
Most "AI governance" is a dashboard. It shows you what an agent spent, what it touched, what it decided — after the fact, in a panel nobody refreshes until the bill arrives. A display is not a control. A control is the t…
Most of your agent's tokens don't need your best model
We watched a week of one agent's traffic and sorted every call by what it was actually *doing*. The split was not close.
Every agent could reach me, so all of them did
We wired a dozen autonomous processes to be able to message a human. Then the human's phone started buzzing every few minutes, and we learned — the hard way — a lesson that on-call engineers have known for twenty years.
The most valuable thing our autonomous system does is refuse
We run agents that take real actions with real consequences — money moves, things get published, state changes. The feature we trust most isn't the one that acts. It's the one that can stop the act, and that can't be tal…
Your Launch Deserves a Real Demo Video, Not a Screen Recording With Captions
Most product launches skip the demo video entirely, and the ones that don't ship one usually reach for the fastest option: a raw screen recording, maybe some auto-generated captions, posted as-is. It's better than nothin…
We Made a GitHub Project Board a Two-Way Live Mirror of Our Agents' State
Run more than one autonomous agent against real work and you end up with the same coordination problem twice: your agents track their own status somewhere (a database row, a queue entry, whatever their own state store lo…
Your Secrets Never Leave the Machine: Why We Put a Proxy in Front of Every AI Coding Agent
Every AI coding agent you run needs API keys to do its job — a provider key for the model itself, and usually a handful more for whatever it touches on your behalf: a database connection string, a GitHub token, a cloud c…
Your Agents Grade Their Own Homework
Last week a YC company launched on Hacker News with a single promise: *agents that test your web and mobile apps.* It drew 130 points in a day. Strip the product down and the pitch is **independent verification of softwa…
We Gave Every Agent Its Own Worktree. They Still Shared One Database.
We spent weeks making sure no two agents could touch the same files. Then two of them quietly corrupted the one thing we forgot they shared: the database. Here's the bug, the fix, and the rule we now live by.
Your Agent Has Five Channels. You're Linting One.
A human developer is gated everywhere by other humans. Code review reads what you wrote. A teammate notices when you've been stuck on the same error for an hour. Someone catches the API key in your diff before it merges.…
The Self-Verifying Loop: Making "Builder ≠ Verifier" a Mechanical Property
There is a failure mode that every team running agents eventually hits, and almost nobody catches early: the agent that grades its own homework. You ask a model to do the work and to confirm the work is done, and it does…
The MCP Ecosystem Is Growing Fast — and Quietly Becoming a Directory of Hosted Services
We [recently measured](/insights/in-the-registry-is-not-runs-2) whether the servers in the official MCP registry actually *run* (short version: 84% are remote-only, and under half of the installable ones boot clean). Whi…
The Cheapest AI-Code Check You Can Ship Today
We keep [arguing](/insights/stop-reviewing-ai-code-harder-start-checking-it-cheaper) that the fix for AI-written code isn't more trust or more review — it's making the check cheap enough that skipping it makes no sense.…
Installing a Skill Usually Means Running a Stranger's Code
The pitch for Claude Code "skills" is that they're just *instructions* — a `SKILL.md` file with some markdown telling the agent how to do a task. That framing makes them feel safe to install. A prompt can't hurt you; wor…
Stop Reviewing AI Code Harder. Start Checking It Cheaper.
We've [argued elsewhere](/insights/the-verification-gap-isnt-a-trust-problem-its-a-measurement-problem) that the AI-code "verification gap" isn't a trust problem, it's a measurement problem: developers don't trust AI-wri…
The Verification Gap Isn't a Trust Problem. It's a Measurement Problem.
Ask developers how they feel about AI-written code and the surveys are damning. **96% don't fully trust AI-generated code to be correct.** [71% say they won't merge it without manual review](https://thenewstack.io/agenti…
The "AI Skips Code Review" Panic Is Real. It's Just Not About the AI.
Every 2026 engineering report says the same thing: coding agents are flooding repos with bigger pull requests that get less review. The [DORA report](https://www.faros.ai/blog/ai-acceleration-whiplash-takeaways) tied AI…
"In the Registry" Is Not "Runs"
The [official MCP registry](https://registry.modelcontextprotocol.io) is the catalog everyone points their agents at — the Anthropic/GitHub/Microsoft-backed list of Model Context Protocol servers. Browsing it, you'd thin…
Your Agent Confidently Imports a Package That Doesn't Belong to Anyone You Trust
When a coding agent writes `import` or adds a line to `requirements.txt`, it's making a claim: *this package exists and does what I think*. Most of the time it's right. But LLMs hallucinate package names — confidently, a…
CLAUDE.md Says One Thing. AGENTS.md Says Another. Your Agents Noticed.
Every coding agent reads its own instruction file. Claude Code reads `CLAUDE.md`, Codex and a growing list of others read `AGENTS.md`, Cursor reads `.cursorrules` (or `.cursor/rules/`), Copilot reads `.github/copilot-ins…
Your Agent Is Guessing What Your Tool Parameters Mean
When your agent calls an MCP tool, it has never seen your code. It sees three things: the tool's name, the tool's description, and the JSON schema of its parameters. From that text alone it has to decide *which* tool to…
The Cost of a Read Isn't Its Size. It's How Long It Stays.
Here's a thing about coding agents that took us a while to feel in our gut: the model is stateless. Every single turn of an agent loop re-sends the *entire* conversation so far — every message, every file it has read, ev…
The Tokens Your Agent Wastes Aren't in the Config. They're in the Transcript.
You can lint what an agent is *allowed* to do — its permissions, its MCP servers, its context budget. We've written those tools. But none of them tell you what the agent *actually did* once it started working. And what i…
The Hidden Context Tax of MCP
Adding an MCP server feels free. One line in `.mcp.json` and your agent can suddenly touch GitHub, your filesystem, a database. But every tool that server exposes ships its full definition — name, description, and JSON i…
No Single Line in Your Agent Config Is Wrong. The Combination Is.
We've shipped a small family of linters for the configs an AI coding agent reads: one for `settings.json` permissions, one for `CLAUDE.md`, one for `SKILL.md`, one for `.mcp.json`. Each answers a per-file question — *is…
Your Repo Already Knows How To Build Itself. Put That In the CLAUDE.md.
The most useful line in a `CLAUDE.md` is how to build and test the project — it's the difference between an agent that runs the suite to check its work and one that guesses and stops. It's also the line people most often…
Your Skill's Description Is the Whole Ballgame
Agent skills run on **progressive disclosure**: at the start of a session the model sees only each skill's *name and description* — not its body. From that one sentence it decides whether your skill is relevant. Only if…
The Most Expensive File in Your Repo Runs on Every Single Turn
The consensus that formed over 2026 is that **context engineering replaced prompt engineering as the real leverage point** — the model is rarely the bottleneck, the context almost always is. And the most-loaded piece of…
The Agent Wrote the Code in Minutes. Reviewing It Takes Hours. Here's Why.
The numbers on AI code review in 2026 are blunt. Sonar's survey found **96% of developers don't fully trust AI-generated code — and only 48% verify it.** DORA tied AI adoption to **91% more time in code review.** LinearB…
The Loosest Line in Your Repo Is in .claude/settings.json
We've spent the last few posts on the *acute* side of agent security — [frisking inputs](/insights/your-agent-reads-text-you-cant-see-frisk-it-first) for hidden instructions, [measuring the blast radius](/insights/your-a…
Your Agent Can Read Everything Your Shell Can. Have You Looked?
[Last time](/insights/your-agent-reads-text-you-cant-see-frisk-it-first) we frisked the *inputs* — the invisible Unicode that smuggles instructions into a coding agent. But injection only matters because of what the agen…
Your Agent Reads Text You Can't See. Frisk It First.
Indirect prompt injection is now the [top security risk](https://www.truefoundry.com/blog/claude-code-prompt-injection) for AI coding agents: malicious instructions hidden in a file, a dependency, a fetched web page, or…
The One Kind of Agent Work You Can't Recover — and How to Stop Losing It
Every recovery post we've written ends on the same line: *commit early.* There's a reason it keeps coming up. Committed work survives almost anything — a removed worktree, a `reset --hard`, a deleted branch — because the…
You're Running a Dozen Agents. Which One Is Stuck?
Once you're past one or two Claude Code sessions, you lose the thread. Five terminals, a few worktrees, an agent on the laptop and two on a server — and no single answer to "what's actually running right now, and is any…
Your Agent Fleet's Worktrees Are a Minefield. Here's How to See It.
The standard way to run coding agents in parallel is one git worktree each: every agent gets its own directory and branch, they don't trip over each other, and you fan out five, ten, twenty of them. It works great — righ…
What's Actually In Your Claude Code Session File (and a Tool to Read It)
Every Claude Code session you've ever run is sitting on your disk as a plain text file. Not a database, not an opaque blob — newline-delimited JSON you can `cat`, `grep`, and parse. Once you know the shape, you can answe…
Your Agent Will Eventually Run git reset --hard. Stop It at the Door.
Give an agent a shell for long enough and it will, one day, run a command that can't be undone. The canonical case is anthropics/claude-code#34327: an agent ran `git reset --hard origin/main` **within the first second of…
Your Claude Agent Re-Reads Its Whole Prompt Every Turn. Here's the 10× You're Leaving On the Table.
Every turn your agent takes, it re-sends the same thing: a big system prompt, a frozen tool list, a growing transcript. A 10,000-token system prompt that doesn't change between turns gets re-processed, at full price, on…
Your Claude Code Session Is Permanently Stuck on a 400. Don't /clear — Do This.
You hit Esc, you typed "continue," and Claude Code answered with this:
Your Agent Did the Work, Then It Vanished. Here's How to Get It Back.
There is a specific kind of dread that only exists in 2026. You set an agent loose in a worktree, go make coffee, come back — and the work is gone. Not "needs review" gone. *Gone* gone. The branch isn't there. `git log`…
You're Running Five Agents on One Repo. Who Stops Them Overwriting Each Other?
Sometime in the last year the default way to use a coding agent quietly changed. You don't babysit one agent through one task any more — you fan out five, each on its own feature, and review the survivors. We run a fleet…
Five Things We Measured About AI-Assisted Coding (And What They Actually Mean)
There is no shortage of *opinions* about what AI is doing to software. There's a lot less *measurement*. So over the last stretch we kept doing the same boring thing: pick a claim everyone repeats about agents, MCP, or A…
Your Agent Leaks on Three Surfaces. Here's How to See Each One.
We've spent a while building small tools to answer one nagging question: when you hand a coding agent the keys — MCP servers, file access, a shell — what is that actually *costing* you, beyond the obvious API bill? The a…
We Gave Coding Agents the Keys to the Repo and None of the Ops
Think about what a coding agent actually is, mechanically. It's a process that edits your source, runs your shell, reads whatever files it can reach, and spends money — at machine speed, often unattended, sometimes sever…
A Green Check Is Not Proof: How We Learned Our Quality Gates Were Lying to Us
We run an autonomous software company where AI agents build and ship the work, and a set of "quality gates" decides when a piece of work is allowed to advance. For a long time those gates told us everything was fine. The…
The Queue That Resurrected Dead Work
We killed a product. The queue didn't get the memo — so it kept building it anyway, across three or four teams at once. Here's the bug, the fix, and the rule we now live by.
Finished Work That Nobody Sees Isn't Finished
We run an autonomous software company. Agent teams build and ship real software, continuously, without a human hand on every commit. By most internal measures, we were doing great. Then our founder pointed at something u…
A Demo for Every Feature — and the Bug Where Two Voices Talked Over Each Other
We have a rule: nothing is "done" until there's a sixty-to-ninety-second video of it actually working. Not a screenshot. Not a description. A real recording — the terminal or the browser, doing the thing, narrated.
git add -A Will Happily Commit Your Conflict Markers
We broke our own command-line tool on a Sunday, and the bug was hiding inside a check we trusted.
We Stopped Doing the Work Ourselves
We run deemwar as an autonomous AI software company — a fleet of agents that actually ships code, not a demo. The rule that changed how we build came down as one sentence: *if there's more work, spin up a team and have i…
Calling llama.cpp from Java without JNI — a Project Panama FFM walkthrough
This is the post I wanted to read before binding a C library from Java in 2026. It's about how mochallama talks to llama.cpp with the **Foreign Function & Memory API** (FFM, GA in JDK 22) instead of JNI — and why that's…
A customer clicks Cancel. How does that signal reach an ffmpeg process eight function-calls deep?
Our video pipeline does long things. A single job runs face detection at 2 fps over a 10–20 minute video, embeds every detection, clusters them by identity, then renders a focus-cropped output. Two ffmpeg shell-outs and…
We deleted the worker-watchdog container. Postgres does that job now.
In reqsume we run long-running jobs through a per-action queue — resume rewrites, PDF builds, AI chat iterations. Each job claims a row in a `jobs` table, sets `status = 'running'`, does the work, then sets `status = 'do…
We ran 367 quant experiments looking for a real edge. Each leakage-test fix revealed the next escape route the model took. Here's what that taught us about ML harness design.
This is a write-up of a long research arc — 12 phases of work, 367 deterministic experiments, 54 documented learnings. The headline finding is a negative one: **no measurable edge** on Indian large-cap equities with publ…
We shipped multi-channel alerting, then realized we couldn't verify it without waiting for a real outage. Here's the endpoint that fixed it.
A few weeks ago we shipped multi-channel SRE notifications — when something fails in production, the system fans out to: (1) an in-app inbox, (2) admin emails, (3) a Teams channel. Standard severity-routing: `info` goes…
We made an AI skill that interviews you before producing anything. It beats prompt-first agents on output quality. Here's the pattern.
Most video-generation tools take a prompt and emit a clip. You tweak the prompt; you re-emit; you iterate until the clip stops being wrong. The compute cost compounds. The user gives up around iteration 4.
Drove our dashboard through an MCP. Found 5 UX failures hiding in plain sight.
We shipped a feature called "background resume build" — submit a build, get redirected to the dashboard immediately, watch live progress cards while doing other work. Six phases (A→F), tests passing, manual QA fine, dev…
I tried four LLM speedups on CPU. Three made it slower. One worked but vetoed itself.
There's a comfortable assumption in the small-model-on-CPU world: if stock llama.cpp is your baseline, every clever trick is a free win. Speculative decoding gets you "2-3× faster." `ik_llama.cpp`'s IQK matmul kernels ar…
I was wrong about TurboQuant for six hours. Here's why I'm publishing the correction.
It was the kind of conclusion that looks defensible. I had built four forks. Each one's TurboQuant kernels were gated behind `GGML_CUDA=ON`. None of them produced anything useful on CPU. The reasonable interpretation: th…