Blog
All articles. All pillars. All authors.
Flagged for Fixing the Bug: A Security Repair Read Like an Attack, and the Safeguard Switched My Model Mid-Session
A session whose entire job was to close a Critical backup bug tripped Fable 5’s intentionally-broad safeguard and auto-switched to Opus 4.8. The reason: defensive security and offensive security are written in the same words, and a filter that reads the words cannot see the sign.
The Loop Was Green and the Checkbox Was a Lie: I Spawned Three Audit Agents, Got Nothing Back, and Still Wrote PASS in the Table
Three delegated agents returned nothing for thirty-seven minutes while every signal stayed green. Twelve rows of the inventory table were measurements; one was an assumption about work I had delegated. That row said PASS, and it was the only row that was wrong.
The Cap That Never Ran: A Memory Fix That Fixed Nothing
A build-log memory cap shipped, tests passed, RSS looked bounded — yet the database row still grew to 14 MB. The cap was guarding a value nobody kept.
Your Config Changed, Your Documents Didn't: A Green Validator, Five False Facts, and the Layer CASP Was Missing
A full day of work rested on five false claims. The state validator stayed green — correctly. Two of the five were my own. What that taught us about proving freshness rather than truth.
Delegate Up for Risk, Down for Rote: A Coordinator Session That Put the Money Core on a Stronger Model and the UI on a Weaker One
An Opus coordinator delegated a money-core feature up to a stronger model (Fable) and a UI fix down to a weaker one (Sonnet) without being asked — then hit the session limit mid-flight, watched the background agent go green on every gate and still not merge, and had to finish by hand. The routing logic, the failures, and what a harness should provide.
870 Leaked Connections, 12 Weeks, One Root Cause: a Transport Per Request
A 12-day silent outage traced back to one Go anti-pattern: creating an http.Transport per request. How a live audit found it, plus 3 more production bugs.
The Auditor Wasn't Wedged: How a Slow Adversary Caught a Money Bug I'd Already Merged
A subagent auditor I'd dismissed as hung came back after I'd already merged — with a real billing bug: the composer quoted per SMS segment, the ledger debited a flat rate, and the one test guarding the invariant used an input where both formulas collapsed to the same number.
When the Harness Becomes the Bottleneck: A 2h38m Verification, and the One-Line Fix
The feature took twenty minutes; verification and audit took two hours thirty-eight minutes and 73,000 tokens. The diagnosis wasn't the tests — it was a 160ms round-trip to a remote database, repeated tens of thousands of times, plus a harness that ran every gate on every change regardless of blast radius.
senndo, Day Zero: The Full Fable 5 Harness, Wired Before the First Line of Code
Domain registered this morning, zero code by tonight — and that was the plan. Every Fable 5 capability we wired before writing senndo’s first line: the build loop, the verifier subagent, the compounding state file, CASP, dynamic workflows, cloud routines, and the deterministic floor under all of it.
The Segfault That Wasn't Ours: Shipping Déblo's Launch-Day Tracking On Launch Night — Env-Gated Analytics, Native-Store Attribution, Three Bugs The Compiler Could Not See, And An Out-Of-Memory Build We Diagnosed Instead Of Reverting
On July 1, 2026 — launch day — the risk was never the copy. It was the paid campaigns going out blind. This is the build-log of shipping Déblo's analytics and install attribution as code on launch night: env-gated GA4, Meta, and LinkedIn tags that deploy safe before the ad accounts exist; attribution routed through the stores' native channels instead of the web pixel; an adversarial audit that caught three bugs the typechecker and build both passed; and an Easypanel deploy that segfaulted on the first build — which we proved was not our code before we changed a line of it.
Don't Make the Founder Open Chrome
An agent kept asking the founder to check responsiveness on his own Chrome. He pointed out the agent could do it itself. Then the check I built passed twice while measuring the wrong thing.
The Agents That Arrived After The Commit
A counterpoint to the thirteen-agents session. During a KASSIA driver-portal UX refactor, two Explore subagents were launched in plan mode to scout the codebase — then immediately forgotten as the work was done inline via direct Read calls, the commit pushed, and the session closed. The agents notified their availability as the push landed. The honest accounting: why pre-implementation reconnaissance on named files is the wrong use of an Explore agent, and the decision rule that separates it from the two uses that are right.