Blog
All articles. All pillars. All authors.
It Works, and It Is Not Finished
The CEO walked every senndo channel himself — five channels, single and in campaign, import, statistics, a refund, the API — and everything answered. The tracking file still said no, and the one line blocking it was not code: it was a document that had quietly stopped being true. Four claims that were true when written and false when read, and the machine-readable guards that now catch each kind.
The Licence That Proved Nothing: Signing a Key Across Two Languages
A sh0 licence used to be a prefix: anyone who knew that Business keys start with sh0-biz- could write one. Replacing it with an Ed25519 document meant signing bytes across two languages, failing closed on a missing key, and a revocation rule where only an explicit revoked ever removes a plan.
The Question the Audit Could Not Ask: Why Verification Has a Ceiling
Clippy clean, 291 tests green, an adversarial reviewer through eleven sections, and a full live proof on two distributions. Then the CEO looked at one column and asked why it said Perpetual, and found a revenue defect none of it could reach.
The Audit That Found the Bug in the Fix: Nineteen Defects, Two Sub-Agents, One Read-Only Reviewer
Nineteen defect cards from three evenings of failed deploys, fixed across three repositories in one session. The regression that mattered most was introduced by one of the fixes, and only the adversarial reviewer saw it.
The Overflow That Wasn't a Layout Bug
A responsive checker reported 130px of horizontal overflow. The number was correct. The bug it pointed at did not exist, and the one it was actually reporting had broken 92 URLs in production.
The Branch That Could Never Fire
A ticket said Pipfile dependencies were landing in the wrong build stage. Fixing it uncovered something worse: the branch that handled them had never run, on any deploy, ever.
The Browser in Claude's Hands: Driving the CEO's Own Chrome
Claude-in-Chrome lets a Claude Code session drive the CEO's real browser — same profile, same logged-in sessions. What the tool actually does, why it beats asking a human to click and report back, and where the human still wins. Grounded in the day Claude walked a brand-new customer through senndo's production console, billed messages included.
The Fast Tool and the Slow Rule: How We Kept a One-Word Launcher From Disarming the One Decision That Matters
We built a one-word launcher for AI CTO sessions — and then had to stop it from disarming the arbitration rule it exists to serve. On the three refusals a launcher must learn, why the guard lives in a skill and not in the deterministic gate, and the one guard we removed and say so plainly.
The Workers Audited the Controller: Who Checks the Agent That Reviews the Agents
In our first agent fleet, the three most valuable findings of the day all flowed upward: a false premise in the controller's own brief, the controller's own bad commit, and the controller's own lying tool. The direction is not luck — the controller has the most authority, the least reversible decisions, and nobody assigned to check it.
The Screenshot Was Beautiful, and It Was the Wrong Page: On Tools That Report Success Without Measuring Anything
A responsive checker printed SUCCESS on sixteen renders. Nineteen of twenty-four were photographing the marketing homepage after the session silently decayed. The trap is not the blank capture I warned about — it is the plausible one. Failing open is right; failing silent is the bug, and the two get decided together by accident.
The Index Is Shared: What Two Parallel Claude Code Sessions Taught Us About Lane Discipline
Two parallel Claude sessions, disjoint directory lanes, and a commit rule written that same morning. The rule protected nothing: git's index is shared state, and one perfectly scoped `git add` published 945 lines of a neighbour's work. The wider thesis is not about git — a lane protocol that reasons about files misses shared state entirely.
Flagged for Fixing the Bug: A Security Repair Read Like an Attack, and the Safeguard Switched My Model Mid-Session
A session whose entire job was to close a Critical backup bug tripped Fable 5’s intentionally-broad safeguard and auto-switched to Opus 4.8. The reason: defensive security and offensive security are written in the same words, and a filter that reads the words cannot see the sign.