Blog

Notes on AI, properly done.Copy link

Weekly essays on methodology, agents, products, and what breaks when AI meets real software. Written as the work is done.

  • Start here

    AI software, properly. Copy link

    Some context. Where this site is coming from, and why I've stopped pretending the way most companies build software is normal.

  • Harness without a spec is a loop without a target. Copy link

    Harness engineering has the loop close to solved. Plan, act, verify, repeat, with humans steering rather than typing. But almost every harness points the verify step at proxies, tests the agent wrote, lint, a second model's opinion of the diff, and a loop aimed at a proxy converges on the proxy. A guard job in my own CI sat green for five weeks while blind to the one thing it existed to check. The missing half of the discipline is the target, a spec layer the loop can verify against.

  • Your tests passed. Your suite lied. Copy link

    An unattended AI build shipped an email channel with an integration suite at twelve of twelve green, marked approved, and no API key had ever existed in the build. A human caught it by hand, days later, and a sharper reviewer would not have done better, because the lie lived in what the record could not say. The fix is evidence the record can check, not reviewers who happen to notice.

  • The frontier gap, measured. Copy link

    Qwen's model card puts a 27B you can run on a desk head-to-head with Claude Opus. I benchmarked that claim on five real tools. Three verdicts went local, two stayed frontier, and the gap is smaller than I expected.

  • You're reviewing the wrong thing. Copy link

    Two posts, a thousand-plus reactions each, spent the week fighting over whether engineers should still read AI-generated code. Both camps are reviewing the code. The review that decides whether the software is right needs to point at the chain that produced it.

  • Finish zero trust before you buy AI security. Copy link

    Agentic AI needs three layers of defence. Two are controls you have already bought. The third is design work, and the products being sold in its place do not survive a live attacker.

  • Harness Engineering Has a Hole Where the Requirements Should Be Copy link

    The 2026 harness wave has nailed the loop mechanics. OpenAI shipped a million agent-written lines, Anthropic taught agents to survive losing their own memory, and Thoughtworks mapped the discipline properly. Every one of those loops closes on tests and lint. None of them can tell you whether the software does what anyone asked for.

  • Merged is not live. Copy link

    Staging a build and releasing it on purpose is ancient, boring practice, and almost nobody runs it at the size of one person. Agents writing most of my code changed that maths. The release model I put on three live apps in a weekend, and why I left myself no way round it.

  • The knowledge library behind a digital operator Copy link

    My digital operator runs across a dozen surfaces and has to remember what it learns. Not in a chat log, not in a vector blob. Here is the library I built for it, and where I stole the shape from.

  • Someone built RCF from the docs Copy link

    Sebastian Beaton scraped nineteen methodology pages off this site and turned them into working tooling for his business, without me over his shoulder. Here is what held, what he bent on purpose, and the gap he found that I left open on purpose.

  • One graph or two: how we chose CodeNodes for RCF's spec-to-code bridge Copy link

    RCF's traceability chain was complete on the spec side and stopped dead at the code. Here is the design call I made to carry it across, and the two-graph approach I turned down to get there.

  • AI code governance starts at the requirement, not the policy. Copy link

    The audit firms are building their own AI tools this year, and most published policies sit on top of engineering that produces nothing those tools can read.

  • Context engineering. The model isn't wrong. It's weighting the wrong thing. Copy link

    The craft moved upstream, to requirements and architecture. Context engineering is the orchestration tier inside that.

  • Vibe coding belongs upstream of the PRD. Copy link

    Prototyping is a discovery move. Treat it as a delivery move and the audit trail starts at the moment an agent guessed.

  • The fate of the human engineer. Copy link

    The role was never static. AI just made the rate of change impossible to ignore.

  • Ninety-six percent don't trust AI code. Half of them check it. Copy link

    The AI trust gap is a methodology problem, and the industry keeps reaching for tooling instead.

  • How much do you trust human output? Copy link

    Every AI failure mode has a human equivalent that predates large language models by decades. The common root cause is the one nobody wants to examine.

  • Nobody owns the requirements anymore. Copy link

    Requirements used to be somebody's job. Then we hollowed the role out, and now AI is filling the gap with guesswork.

  • The last twenty percent. Copy link

    What's actually hiding in the part of the build that AI skips past, and why it still bites.