Subagents are context isolation, not parallelism
Every dispatched worker pays a fixed setup cost before it does anything. Where the crossover sits, and why a ten-item batch ran faster serially.
AI-Driven Development
Shipping production software with coding agents — context, evals, guardrails, and what breaks at scale.
36 posts
A verification step that can pass while the bug is present is not a verification step
Static checks read what was written; the defect lives in what was drawn. Four artifacts that passed every gate this session and failed the moment someone looked.
Write down what you did to an external service
A create-only API cannot answer whether a thing exists. The local ledger becomes the sole source of truth, and one write's ordering decides if it works.
Three kinds of code I stopped letting an agent write
An honest negative result: three categories where generated code cost more to verify than to author, and the property they share that predicts it.
The agent said 'fixed'. The list said otherwise
A delete returned deleted:true while the item was still there. Four failures in one day shared a shape: the action reported on itself, and nothing read the state back.
A test that cannot fail is not a test. Mine passed twice.
A RED test fixture that passed because a comment explaining the omission contained the omitted string. The failure mode is generic: any test whose input mentions what it removes.
Design for the API call you cannot take back
An API with create but no delete changes where your guards live. Four checks that run before the request, and the one that only exists because a create returns 201 on the wrong target.
100 technical posts, and the gates that stopped them being slop
Publishing at volume with an AI agent is easy. Publishing at volume without shipping slop needs machinery that refuses, and refuses loudly.
Read the status code before you believe the README
Six documented endpoints, two that work. Probing an API's real surface takes a minute and changes the architecture you build on top of it.
The command that leaked a secret was not cat
I leaked an OAuth token by running a command designed to print only field names. The file was malformed, so the field name was the secret. Verb denylists cannot catch this shape.
A stale doc does more damage than a missing one
Documentation that is confidently wrong is worse than absent, because it stops the investigation. Three examples from one codebase and what made them survive so long.
Why every command runtime is capped at 200 lines
A 200-line cap on command runtimes, enforced by a hook. What it rejected, what that forced, and the one time the cap was the wrong tool.