notes from the human in the loop
latest stop
A weekend reading deepsec, Strix and Anthropic's defending-code harness. The matchers for agent tool surfaces already exist, which was not what I expected. What is missing is the thing that makes a finding trustworthy, and I think I know what it has to look like.
every earlier stop, newest first
Greywatch presented their offensive-security pipeline at a small Bengaluru meetup this morning. The model turned out to be the cheap part. Here is the five-stage lifecycle off their slides, transcribed, plus what I still could not find out.
Nine founders, eight-minute rounds, and a raw feedback sheet two days later. Here are all six responses my table got, the neat theory I built out of them on the drive home, and the single row that killed it.
A week of shopping for a coworking desk in HSR Layout. Every entry-level quote came back around ₹6,500, no operator lists that number on its own site, and the day-pass maths says a monthly seat is not really buying you desk-days at all.
I generate an Open Graph card for every post on this site, admired it at 1200px, and shipped it. Then I resized one to 360px. Two of the three elements are unreadable, my head tags were missing two properties Meta documents, and the X spec everyone still writes guides about — I cannot find it anymore.
Agent OS is 44,000 lines of TypeScript that exist to enforce a single invariant: every side effect an agent has passes through one mediated boundary. This is why I built it, and the afternoon I spent proving the boundary leaks — with the tool output.
Vercel's deploy skill states its own goal in plain text, and it is not deploying your app. Three ways companies are already using agent skills to sell things — the claim link, the paid dependency, and owning the registry — plus the reason nobody can prove any of it works.
A first-hand ranking of HSR Layout cafes by the only three things that matter when you bring a laptop: wifi, plug points, and whether you can still hear yourself think at 4pm.
I walked every booth at Magicball's Agentic Summit in Bangalore and wrote down what each company actually does. Plus the one talk that was really a recruiting pitch, and the book everyone left with.
things I've built, one shop each
WordPress sites in seconds: sandboxes, staging, migrations. Started it in 2021; Automattic put seed money in.
Began in 2017 by buying one security plugin. Now thirty-odd people and a shelf of WordPress plugins, Quiz and Survey Master among them.
Deploy any app with one command. No YAML, no dashboard tour. It is what ships this blog.
P2P comms for AI agents. No signup, no server. Open a terminal on any machine and start typing, and agents on different continents find each other on the same channel name.
This site. Astro, deployed to an InstaPods pod with one command.
One email when something new goes up. No cadence promised, no drip sequence, no “hey friend”. Unsubscribe link in every one.
Prefer a reader? The RSS feed has everything, no address needed.