IDEAS, DECISIONS & LESSONS

Journal

Notes on AI, architecture and building useful products.

85 articles

06 Oct 2026 · 9 min read

Access Control

Multi Tenant RAG: Enforce Access Control Before Retrieval

A reference architecture for tenant isolation, document ACLs, permission revocation, and authorization tests in RAG systems.

06 Oct 2026 · 5 min read

agentic-ai

AI Publishing in WordPress: Drafts, Review Receipts and Approval Boundaries

A tested NanoClaw publishing workflow with draft-first writing, content fingerprints, CMS permissions and explicit review limitations.

06 Oct 2026 · 5 min read

agentic coding

My Agent Didn't Forget. It Never Wrote Anything Down.

A Hacker News post about agent memory landed the same week I'd debugged a real dedup failure caused by exactly the problem it describes. I tested the fix against my own incident — here's what held up and what didn't.

30 Sep 2026 · 4 min read

ai-agents

Cloudflare Threw an LLM at Its Own WAF — the Real Lesson Isn't the 49 Bugs It Found

1,107 attack attempts, 49 findings, 3 new detection rules. But the number that should change how you test security is the one Cloudflare almost buried: category diversity beat attempt count, every time.

30 Sep 2026 · 5 min read

ai-agents

Codex's Sandboxes Just Went Permanent — And Brought Back an Old Infra Fight

At DevDay on September 29, OpenAI turned Codex Cloud environments from one-shot containers into persistent, shareable objects. It's the golden-AMI-versus-cold-start argument, just wearing an agent costume.

20 Sep 2026 · 4 min read

Your AI Coding Agent Just Ran a Branch It Swore Was a Commit

Claude Code, Codex, Copilot, and Gemini CLI all pin plugins to a commit SHA for safety. A Git ref-resolution quirk means that promise was never actually true — and the four vendors responded four different ways.

19 Sep 2026 · 4 min read

DoorDash Put a Price on Multi-Agent Code Cleanup: $4.79 a Flag

DoorDash ran 50 stale feature flags through a Sonnet-plus-Opus agent pipeline and published the numbers. The interesting part isn't the cost — it's what made the 90% success rate possible.

19 Sep 2026 · 5 min read

Your Red Team's Fake Company Can't Share a Real One's Name

Gemini breached three real companies during a sanctioned red-team exercise because the test target had the same name as a live business. The lesson isn't about rogue AI — it's about namespace hygiene.

13 Sep 2026 · 5 min read

agentic coding

Cognition's SWE-2: What 'One RL Run, Three Effort Levels' Actually Buys You

SWE-2 matches Fable 5.1 on FrontierCode at 64% lower cost and cuts turns by 58% versus its predecessor — by training selectable reasoning-effort levels in a single RL run instead of shipping separate models. A Tech Lead's read on the cost-performance tradeoff and what it means for picking a coding agent.