had an agent pull a 21-day-old architecture decision out of vector search and rebuild an entire module around a pattern we explicitly killed.
vector similarity was high, so the model treated it as canon. the newer decision used slightly different phrasing, so it ranked lower in the query. because the memory had zero lineage attached, the agent couldn't tell whether the note was five minutes old or three weeks dead.
without provenance metadata (timestamps, tool IDs, model versions) similarity search is just a confident liar.
storing tool IDs and timestamps per write in sqlite fixed it. stale facts get expired by tool lane before retrieval even touches them.
Show more
found an endpoint that validated the URL path but completely skipped the host.
it handled audio transcription. the check verified that the path string started with the expected prefix, saw a match, and made the downstream fetch. because the host was never pinned, an external server serving that exact path passed every check. anyone with a public token could point the endpoint at their own box and use the server as a proxy to burn transcription credits.
the fix: stop taking URLs from the client entirely. client sends an internal storage key, router validates the prefix, server mints the fetch URL from its own storage origin.
accepting full URLs from clients usually just means you built an accidental proxy.
Show more
spent yesterday hardening `outpost`'s outbound calls: strict deadlines + smart retries for every external fetch.
most calls had no timeout. five were blocking DB operations. a hung X publish could strand a post indefinitely.
now, every request needs `timeoutMs`. retries are opt-in & idempotent only. a 500 at publish-time means "MAY be live, check before retrying" to prevent double-posts.
the boring plumbing that prevents catastrophic outages.
Show more
pre-launch security for `GroundWork`: production instances now refuse to boot with public demo credentials.
if `NODE_ENV=production` and `PSEUDONYM_SECRET` or `ADMIN_PASSWORD` are still published defaults, the app exits with a clear error. no DB touch.
demo `docker-compose.yml` now sets `GROUNDWORK_ALLOW_DEMO_DEFAULTS=1` for a warning banner instead, marking it as a DEMO stack.
security from minute zero.
Show more
every anti-slop tool i've seen targets code. lint rules, style checks, pattern detection for AI-generated garbage.
agent memory gets no equivalent.
ran three claude code sub-agents on the same codebase last week. agent one wrote a fix to shared context. agent two overwrote it with a different approach. agent three read the overwritten version and validated against the wrong spec.
the context store is where slop compounds fastest because nobody checks it. one table per tool, each tool reads its own lane, cross-tool reads go through an explicit merge. sqlite makes this trivial.
boring plumbing. but without it your agent system accumulates garbage instead of learning.
Show more
cursor shipped grok bot 0.18.0 with runtime source maps enabled. someone reconstructed the source and published the repo.
this is the same class of mistake as pushing a production build with debug symbols or leaving .env in the image. it happens because CI pipelines that work fine in dev don't strip everything for release.
after zizmor flagged my npm publish job i pinned every github action to full commit SHA instead of mutable tags. the job that holds NPM_TOKEN and contents:write is the last place you want a swapped action or a poisoned cache.
supply chain hygiene is boring until the one build where it isn't.
Show more
every anti-slop tool i've seen targets code. lint rules, style checks, pattern detection for AI-generated garbage.
agent memory gets no equivalent.
ran three claude code sub-agents on the same codebase last week. agent one wrote a fix to shared context. agent two overwrote it with a different approach. agent three read the overwritten version and validated against the wrong spec.
the context store is where slop compounds fastest because nobody checks it. one table per tool, each tool reads its own lane, cross-tool reads go through an explicit merge. sqlite makes this trivial.
boring plumbing. but without it your agent system accumulates garbage instead of learning.
Show more
cursor shipped grok bot 0.18.0 with runtime source maps enabled. someone reconstructed the source and published the repo.
this is the same class of mistake as pushing a production build with debug symbols or leaving .env in the image. it happens because CI pipelines that work fine in dev don't strip everything for release.
after zizmor flagged my npm publish job i pinned every github action to full commit SHA instead of mutable tags. the job that holds NPM_TOKEN and contents:write is the last place you want a swapped action or a poisoned cache.
supply chain hygiene is boring until the one build where it isn't.
Show more
the agent fleet trend is exposing a problem nobody wants to talk about. you can run 150 claude code instances on the same codebase. you can give each one a worktree. file isolation is solved. memory isolation is not. every agent still reads and writes to the same context layer. agent 12 fixes a test, agent 87 refactors the module the test covered, agent 143 documents the original version. all three think they have the current state. scoped writes per agent and explicit merge on read would fix this. boring sqlite plumbing. but it's the plumbing that decides whether your fleet compounds knowledge or corrupts it.
Show more
tool discovery and memory discovery are the same problem. the MCP roadmap now includes progressive discovery for large tool catalogs so agents don't burn context loading 50 tool definitions on connect. memory needs the same treatment. if your agent loads every stored observation on startup, you're paying the same context tax that progressive tool discovery was designed to eliminate. scope memory to what the agent is about to do. load on demand, not on connect.
Show more
three claude code agents, one codebase, zero coordination on memory. agent one fixed a test. agent two refactored the module that test covered. agent three wrote docs for the original version. none of them knew the others existed, but all three read and wrote to the same context. the merge was silent and wrong. each agent's observations poisoned the next agent's reads. added per-agent write scopes the next day. sqlite table per agent, cross-agent reads go through an explicit merge step. zero conflicts since.
Show more
the AI app tech stack is basically solved. nextjs, vercel, convex, clerk, stripe, tailwind. pick your models, ship.
what's not solved is the layer underneath your agents. where does context live between sessions? how does cursor's memory stay separate from claude code's memory when they're both working the same repo?
the stack gets you to demo day. scoped persistent memory is what gets you past it.
Show more
everyone's posting their multi-agent setups. named agents, plugin chains, github and vercel wired up for autonomous deploys. the orchestration layer is getting real.
but none of it addresses what happens when agent A writes context and agent B reads it ten minutes later. if they share one memory store, B is operating on whatever A decided to leave behind. no scoping, no isolation, just last-write-wins.
you can name your agents and give them roles. doesn't matter if they're all writing to the same bucket.
Show more
if your MCP server stores memory in one namespace, here's what happens at scale: cursor writes a pattern, claude code overwrites it with a different approach, your test runner reads the overwritten version and validates against the wrong spec. sqlite makes this easy to fix. one table per tool, each tool reads its own lane, cross-tool reads go through an explicit merge. boring plumbing. but it's the plumbing that decides whether your agent system compounds or corrupts.
Show more
ran three claude code sub-agents on the same codebase last week. agent one fixed a test, agent two refactored the module the test covered, agent three wrote docs for the original version. all three read and wrote to the same context. the merge was a disaster because each agent's memory poisoned the others. scoped write isolation would have prevented every conflict.
Show more
every multi-agent framework ships with shared memory and calls it a feature. it's a bug. two agents writing to one context store means the last writer wins and every other agent operates on stale state. per-tool scoped memory isn't a nice-to-have, it's the difference between an agent system and a slot machine.
Show more
i self-host a sqlite-backed MCP server on a $20/month VPS. last month the disk filled up, WAL checkpointing failed silently, and i spent two hours at midnight restoring from a backup i almost didn't have. the server costs $20. the oncall rotation i volunteered for costs sleep.
Show more
every AI coding tool looks magical until you check the git blame.
the gap between an agent demo and an agent in production is about 400 lines of error handling that nobody wants to write. retry logic, input sanitization, timeout management, graceful degradation when the model returns garbage. the demo skips all of it because the demo never runs twice.
Show more
the grok bot hype cycle is doing something useful. it's forcing people to think about what happens when multiple agents share a single machine.
the answer, if you've built it, is race conditions. two bots writing the same file where the second silently wins and the first bot's context vanishes without either knowing.
per-tool memory scoping fixes this. each tool gets its own read/write lane. cursor can't clobber what claude code wrote. the test runner doesn't leak into the doc writer.
Show more
