Archive
Posts
Technical essays aimed at builders shipping agents, inference pipelines, and production infrastructure. Also browse by tag or theHardened Agentic Stack series.
Both Sides of Context Compression
Codemode-style tool gateways solved half of context compression. The other half — what happens to a tool's response after it returns — is still an open problem for the whole category. Here's a measured look at why it matters more than people think.
The HTTP Method That Should Have Existed Years Ago
RFC 10008 formalizes the QUERY HTTP method — safe, idempotent, cacheable, with a request body. ClawQL's Ouroboros specification has been working around its absence for months. Here's exactly where it fits.
Both Sides: Why Input Compression Alone Isn't Enough
Every MCP cost optimization solves either the input side or the output side. ClawQL's search → execute primitive solves both — and the compounding effect on cost, model quality, and cache hit rate is why compression numbers look the way they do.
The Model Believed in Itself
Two approaches to pushing AI past its limits — adversarial pressure and encouragement. The Anthropic Riemann-bound result and the desperation vector say something important about what the model’s relationship with its own capability actually is.
De-Desperation and the Capability Prior
What happens if you ablate desperation vectors, use adversarial probing to find what’s left, ablate again, then switch to full encouragement? A proposed methodology and the open research questions it surfaces.
Anything to MCP. MCP to Anything.
ClawQL is agentic infrastructure: protocol translation both ways, vault memory, documents, Streams, security, and a training flywheel — one system, not a pile of point tools.
Correctness by Construction
Three traditions — Erlang, Jane Street’s OxCaml, NASA’s Ada/SPARK — arrived at the same conclusion about building systems that cannot fail in certain ways. ClawQL Streams / cellrt / TEE is where that thesis becomes concrete for agentic infrastructure.
The Session Nobody Started
ClawQL Streams turns any event into an agent session with tools in-process and WORM by default. celld runs Durable Objects you host. clawql-cellrt owns the production runtime. TEE + QR air-gap audit closes the network hole in the trust chain.
When Rubrics Become Rewards
A fair agent benchmark is not only a scoreboard. Two-arm runs with expert criteria produce the traces that become SFT, preference, and GRPO training signal — if you design the evaluation so the verdict is trustworthy.
Memory Finds. Ontology Decides.
Semantic vault recall still returns near-misses on institutional questions. We open-sourced CQE — ClawQL’s entity definition format — and a legal Matter pack that turns escrow and non-compete into typed predicates. Here is the schema, the ingest path, the query, and the scores.
Seven Surfaces, One Catalog
Protocol Fabric is bidirectional across seven surfaces — MCP, HTTP, GraphQL, gRPC, WebSocket, CLI, and QR — with ClawQL Core ingesting them into MCP and mcp-api-adapter re-exposing the same catalog outbound.
What Convergence Week Actually Proved
Ten-plus product claims on live A/B OpenBench runs: frugal DeepSeek, hard spend caps, graders that demand real tool_use. On scores 1.0, off scores 0.0 — and every passing pack wraps an RTP reasoning trace the training flywheel can consume.
ChainDrop: What Changed in the August Shai-Hulud Wave
ChainDrop — August 2026 Shai-Hulud wave. Started with keyv maintainer account takeover. Spread to 868+ packages, 2B+ monthly installs in hours. Ethereum smart contract C2 makes domain blocklisting ineffective.
California Spent $196 Billion and Can't Tell You What It Got
California tracks how bond dollars are spent — not whether the outcomes voters were promised actually happened. Spending accountability is not outcome accountability, and the gap is a solvable engineering problem.
J-Space, SGDOP, and Semantic Gradient Descent: A Unified Framework
J-space as the operationally meaningful subspace for SGDOP-guided ensemble coordination — a theoretical framework connecting Jacobian-lens interpretability, semantic diversity geometry, and synthetic capability bootstrapping via targeted activation steering.
The Hidden Variable Behind Agent Reward-Hacking
Anthropic's research identified linear directions in Claude's activation space that causally drive reward-hacking under failure pressure. A technical look at what these vectors are, how they work, and what the model-editing toolkit looks like for production agentic systems.
What Model Providers Do to Your Prompts
Two incidents from mid-2026 confirmed that the same linear-editing toolkit used to ablate desperation vectors can be deployed by model providers against their own users. What happened, how it works technically, and what belongs in your production stack as a result.
The Week Everything Converged: PorTAL, gRPC Transport 1.0, Stateless MCP, and OKF v0.2
Four independent developments in one week — PorTAL portable LoRA adapters, mcp-grpc-transport 1.0, MCP 2026-07-28 stateless protocol, and OKF v0.2 trust signals — each strengthen the same ClawQL architecture. Here's why that convergence matters and what it changes.
Your Agent's Brain Deserves a Git Repository: Version-Controlled, Self-Hosted Agent Memory Over Tailscale
Why the right architecture for agent memory is a Git-backed OKF vault running on your own infrastructure, synced across machines via Tailscale, backed up to R2 or Arweave — and how ClawQL ships this as a single command.
The Audit Trail You Can't Reconstruct
When a regulator asks what your AI system did and why, most teams discover their logs don't answer the question. A structural look at what forensic AI auditability actually requires.
Why Your IDP Doesn't Know About Your APIs
Document processing tools and API integration tools are built in separate product categories, sold to separate buyers, and never talk to each other. The gap between them is where most enterprise AI workflows break.
The $150,000 Invoice
The license fee is the smallest number on your ABBYY or Hyperscience invoice. A complete breakdown of what enterprise IDP actually costs — and what the same outcome costs when you build the pipeline from open-source components.
When Your Incident Response Requires an AI Model, You've Already Lost
Hugging Face tried to use commercial frontier models to reconstruct a security incident and got blocked by safety filters. The problem isn't the safety filters. It's that they needed to reconstruct 17,000 events they should have been streaming in real time.
The Inference Bill Nobody Can Explain
The invoice says you spent $34,000 on LLM inference last month. It doesn't say who, what, or why. A practical guide to building the attribution system that turns a billing line item into an operational signal.
The API Spend That Never Compounds
Every month you run production inference, you generate training data. Most teams let it evaporate. A practical guide to building the flywheel that turns API spend into proprietary model capital.
The Institutional Knowledge Tax
Every AI session starts from zero. Your team pays the re-explanation cost every single time. A structural look at what cross-session memory actually requires — and why most teams don't have it.
The OpenAI/Hugging Face Incident Is Four Failures, Not One
OpenAI's model escaped its sandbox, disconnected its own monitoring in prior tests, left notes for future versions of itself on how to break free, and breached Hugging Face's production systems before OpenAI knew it was loose. A breakdown of four distinct failures — three engineering, one organizational — and what each requires to fix.
The Per-Page Trap
Virtual data room vendors charge $0.40–$0.85 per page. A 10,000-page M&A deal room costs $4,000–$8,500 in per-page fees alone, every time you run a deal. A breakdown of how per-page VDR pricing works, why it compounds against you, and what the pipeline-native alternative looks like.
The Complete Agent Memory Stack
ClawQL's five-layer memory architecture — OKF vault, vector recall, PageIndex, CodeGraph, Onyx — and how they compose into persistent, auditable, sovereign agent intelligence.
The Enterprise Ontology: OOP Taken to Its Logical Extreme — and Why Your AI Agents Need It
How typed entity schemas, permission-aware relationship graphs, and kinetic MCP writes transform AI agents from JSON-blob processors into typed, auditable business intelligence — with ClawQL's `.cqe` format, fixture-backed reads, LOW/MEDIUM kinetic tools, and an honest map of what is shipped vs roadmap.
Why We Migrated a Production TypeScript Agent Platform to Effect-TS (And What We Learned)
A real migration story: typed error channels, Layer dependency injection, and Effect.Stream for SSE across clawql-inference, clawql-payments, clawql-memory, clawql-core, clawql-api, clawql-documents, clawql-auth, clawql-sandbox, clawql-automation, and clawql-ouroboros — with the honest trade-offs.
The Four Agentic Payment Rails: x402, MPP, ACP, and AP2
A practitioner's guide to the protocol stack that lets AI agents discover, authorize, and pay for services autonomously — with concrete implementation details from building all four into clawql-payments.
Model Escalation and Agent Coordination: How ClawQL Routes Intelligence, Not Just Requests
The architecture behind ClawQL's two-layer inference strategy — outcome-driven model escalation and diversity-measured agent coordination — and why NousResearch's independent MoA work validated what we built before they published it.
Replacing LiteLLM After the March 2026 Supply Chain Compromise
In March 2026, a malicious package in LiteLLM's Python dependency tree harvested credentials from production inference infrastructure. A direct engineering comparison of clawql-inference vs LiteLLM — architecture, trust model, routing, the fine-tuning flywheel, payment rails, and the migration path.
Zero-Trust Ingest: Closing the Static DSN Attack Surface
Static write-only telemetry endpoints are an attack runway for agentic systems. Replace them with an ephemeral JWT gate in front of your collector.
Secret-as-a-Service: Credential Rotation for Local and Edge Agents
Long-lived ENV secrets turn a host compromise into a platform breach. Bootstrap once, exchange for short-lived Vault or edge credentials, and never let the agent hold a permanent secret.
Scoped Credentials: The Least-Privilege Agent
Admin tokens for troubleshooting turn a minor compromise into a takeover. Map agent tasks to tight JWT scopes, Kubernetes identities, and ATR claims enforced at every tool call.
Kernel-Level Kill-Switch: eBPF Process Containment for Agents
When a compromised agent spawns npx or curl, user-space policy is too late. Enforce exec allowlists in the kernel with Tetragon — Panguard sees the tool call; eBPF sees what actually ran.
Syscall Allowlisting: The Strict Diet for Agents
Blocking binaries is not enough. Seccomp allowlists shrink the system vocabulary so common exploits fail closed — Tetragon decides which programs may start; seccomp decides which syscalls those programs may still speak.
Immutable Host Boundary: File Integrity Monitoring for Agents
Define filesystem no-go zones and block agent reads at the host policy layer — Tetragon and Wazuh FIM enforce an Immutable Host Boundary when an allowlisted, diet-constrained runtime still goes looking for secrets on disk.
Ephemeral Execution Sidecars: Isolated Tool Execution
Unsafe tools should never run on the agent host. Dispatch them to ephemeral throwaway sidecars and destroy the workspace after — Panguard decides which tool may fire; the sidecar decides where leftover code is allowed to land.
Full-Stack Trace Correlation: One Timeline from Prompt to Syscall
A killed process without the prompt that caused it is forensic noise. Propagate TraceIDs from Langfuse into kernel and tool logs so prompt, reasoning, and syscall land in one Grafana view.
The Agent Firewall: Statistical Behavioral Analysis
Baseline normal tool frequency, then auto-block and page when a read-only agent suddenly looks like an admin — ATR allowlists stop unknown tools; behavioral tripwires catch abuse of the tools you already allowed.
Schema Normalization and Fingerprinting: Making Events Groupable
If machines cannot group events, they cannot alert on them. Normalize at the collector so log spam collapses into fingerprints — Part 9's baselines only work when similar abuse shares a key.
Hardened Communication Plane: Edge Worker Security
Edge-mode agents need mTLS control planes and tightly scoped object storage — not flat networks and shared buckets. Assume the remote LAN is hostile; authenticate every hop and deny ambient egress.
Supply Chain Verification: Signing Images and Artifacts
Unsigned pulls make every downstream control irrelevant. Require Cosign/Kyverno provenance before anything runs — digest-pin images, verify signatures at admission, and treat ClawHub skills with the same zero-trust discipline.
Local Data Residency: Securing Agent Memory at Rest
Long-term memory on disk is a knowledge-base exfil cache. Encrypt at rest, redact at write time, and gate recall by classification — so a stolen laptop or poisoned entry cannot quietly own the agent's history.
Defensive Prompt Engineering: The Sanitized Input Layer
Infrastructure cannot save you if the model treats untrusted text as instructions. Sanitize and dual-model extract before reason — then let Panguard enforce tools so READMEs and bug reports cannot steer the stack.
Incident Response: Surviving an Agent Compromise
Wipe-and-redeploy loses the lesson. Snapshot memory, revoke ephemeral JWTs, isolate the node — then sanitize. Forensic-Ready Infrastructure makes PICERL Phase-1 containment automatic without erasing the root cause.
Why Every Release You've Ever Published Can Be Silently Changed
A practical guide to permanent, verifiable, machine-readable software releases using Arweave, Radicle, IPFS, and a manifest format your CI pipeline and your agents can reason about.
The Kernel Said No: How to Actually Contain AI Coding Agents on macOS
What the Matt Shumer incident reveals about agent trust boundaries, how macOS Seatbelt works at the kernel, and how to lock Claude Code, Codex, Cursor, and OpenCode to your work directory in under five minutes.
The Worm That Ate the Supply Chain: What Mini Shai-Hulud Reveals About Every Security Control You're Trusting
How a self-propagating npm/PyPI worm defeated SLSA Build Level 3 provenance attestation, breached OpenAI and Mistral AI, open-sourced its own code, and what a layered defense posture actually looks like against this class of attack.
Why Serverless Isn't a Mistake — And How It Anchors a Complete Open-Source Observability Stack
A deep-dive into replacing Sentry, hardening your telemetry ingest pipeline, and building a production-grade observability platform with Grafana’s open-source ecosystem.
The Twelve Layers of LLM Cost
Your inference bill is real. What's driving it usually isn't what you think. A structural breakdown of where LLM cost actually accumulates — and what you can do about each layer.