Archive — nurazhar.com

Archive — 203 posts

One Desktop Button That Updates Every Tool I Own

A double-clickable updater for 23 userspace toolchains: a TOML registry, one-line registration for agents, and native updaters behind a single button.

How Cloudflare Tunnel Reaches a Laptop Behind NAT — the Full Path From Click to Origin

A packet-level tour of Cloudflare Tunnel: outbound QUIC connectors, anycast BGP routing through Tier-1 transit, edge TLS termination, and multiplexed streams to localhost.

CyberArk Day-1 vs Day-2: Patching Vaults Without Breaking the Bank

Day-1 is onboarding the first hundred accounts. Day-2 is patching the vault that guards them without dropping a single banking session: DR-first cycles, CPM/PSM windows, and why the boring discipline is the job.

Unsigned Terminals: What Auditors Actually Fear (and What PSM Does Instead)

A terminal produces claims, not proof. What cryptographic signing actually guarantees in 60 seconds, and how privileged session management delivers the same trilogy by process instead of math.

The Latency Tax: Internet Polling vs Process Births

My Ryzen 7 runs CI bare-metal yet jobs still wait. Two taxes explain it: NAT long-polling to reach my machine, and 600 JVM births to check 200 posts. Numbers, causes, and what actually fixes each.

Red-Main Normalization: Why Stacked CI Failures Feel Endless

Three stacked pipeline failures, each fix unmasking the next: a missing submodule, a missing binary, and a test guarding a file that was never committed. The pattern has a name, and two locks end it.

One Runtime to Debug: Killing the Last Python Call Site

A repo-wide hunt found exactly one live Python shell-out. Killing it took Java interop, and keeping it dead took a guard with a negative control. One runtime means bugs arrive with names attached.

Stop Parsing Chat Output When You Need Machine Decisions

RLHF pipelines parse uncalibrated chat text and fail softly to humans, while RLCD machines return typed enums with calibrated confidence that a deterministic gate can execute or escalate.

Learning How opencode Works by Hosting It for an Audience of One

I got curious about how opencode works, so I hosted it myself at tui.nurazhar.com with exactly one authorized user: me. A small Clojure gateway in front, free Zen quota behind.

The Software Factory: From Infrastructure to Autonomous Development

My 2024 bare-metal to VMware migration was infrastructure virtualization, not a software factory — here's what a real factory is, and why OpenCode plus Muse Spark 1.3 are the local worker alternative to Warp's cloud orchestration bet.

My Laptop Is My Server Now: opencode on Android Over Tailscale

How I turned a CachyOS laptop into a zero-cost remote server for opencode on Android — and the one privileged command that killed my KDE session.

I Built a PAM Audit CLI to Learn Identity the Hard Way

idira-audit-clj is a zero-dependency Babashka CLI that audits privileged estates for orphaned accounts, dormant privilege, and stale tokens — built AI-assisted, disclosed honestly, tested deterministically.

Parsing AI Agent Output Into an Immutable AST Before It Touches Production

AI coding agents ship subtle runtime flaws — unescaped innerHTML, unstable sorts, malformed config. A parse-first EDN gate catches them before runtime, deterministically.

Why SSL Certificates Keep Shrinking — the 2-Year → 1-Year → 90-Day → 10-Day Story

The real reason SSL certificate lifetimes keep shrinking — from multi-year plans to 398 days to 200 days, and why we're heading to 47 days (with the confusing "10 days" being a completely different clock).

Wildcard TLS with Certbot and Cloudflare DNS-01 — a copy-paste walkthrough

A complete end-to-end guide to issuing a Let's Encrypt wildcard certificate with Certbot and a DNS-01 challenge against Cloudflare — exact commands, credentials setup, verification, and auto-renewal.

The Flight Recorder Sealed Its Own Coffin

My AI agent wrote the test suite for my tamper-evident flight recorder — surfacing two latent defects, then exposing a paradox where the recorder invalidated its own seal by logging it.

Case Study: Implementing Deterministic Telemetry & Flight Recorders for Agentic Execution Pipelines

Case study on implementing deterministic telemetry and flight recorders for agentic execution pipelines: immutable DAG evidence, SHA-256-chained runs, and four failure modes caught by dogfooding before production.

Your Agent Framework Dumps JSON Blobs. Here Are the Three Storage Layers It Should Have.

Traditional agent frameworks serialize giant state dictionaries on every step. An immutable DAG engine splits storage into three layers — HAMT pointers in RAM, content-addressed blobs on disk, and a replay proxy store — and last night I built layer two for real.

My Zero-Dependency Tools Had No Clothes: What The Update Framework Taught Me

A zero-dependency security toolchain still shipped updates through an unsigned pipe. The Update Framework exposed the blind spot — and upgraded the doctrine.

What Stripe Radar Teaches About Money-as-Code — A Security Engineer's Translation

What Stripe Radar rules can teach security engineers about explicit payment controls, and where the analogy to OPA/Rego stops.

I Built an Evergreen Job-Ad Detector for MyCareersFuture

A deterministic detector for reposted "evergreen" job ads on MyCareersFuture — timestamps and hashes as evidence, no accusations needed.

3X Productivity, Not 10X — Measuring AI-Augmented Work Honestly

A session-level accounting of AI-assisted work that separates generation, review, waiting, and context switching instead of treating model time as total productivity.

Why I Replaced 200 Lines of Babashka with 35 Lines of Rego

How declarative IAM validation using OPA/Rego replaced imperative Clojure security checks — and why functional programmers already understand policy engines.

Money is More Than a Database Row — Security Lessons from Financial Systems

A security-focused explanation of why financial systems need authorization, auditability, and controlled state transitions in addition to database storage.

Your Idea Already Exists — It's Called "Logic Programming for Security"

Why functional programmers are naturally drawn to security policy engines — and how declarative policy ideas are used in modern infrastructure.

The Missing Link: Why Clojure Developers Should Care About Policy Engines

How functional programming meets infrastructure security — and how Clojure skills can transfer to policy-as-code work.

Cognitive Asymmetry: The Epistemic Bandwidth Bottleneck

The divide in the agent era is no longer hardware access but epistemic bandwidth — the capacity to build abstractions and query reasoning engines.

The Energy Wall Will Kill Von Neumann Computing

Why shuttling data between memory and compute wastes 80 percent of energy, and how analog compute-in-memory and event-driven silicon break the bottleneck.

When My Own Scanner Blocked My Own Commit

My pre-commit scanner caught my real NRIC and phone number before they hit GitLab — twice in one session.

My AI Agent Finally Has a Way to Ask Permission — Singpass CIBA on FAPI 2.0

Singpass's CIBA flow lets an AI agent ask for consent through your phone — no browser, no redirect. This is me learning in public about the state-asserted consent layer agents will need.

Cloudflare Just Reinvented My Agent Identity Layer — and That's a Relief

Cloudflare's web-bot-auth signs agent HTTP requests with RFC 9421. I built the same idea on BSV. This is me learning in public about what separates the two.

Your Agent Fleet Needs a Sheepdog — A Personal IAM Control Plane

When one assistant becomes dozens of sub-agents, the architecture breaks without a control plane. The sheepdog pattern — a personal IAM/PAM layer — is how you keep a fleet safe.

TasteLocal: A Practical VAPT Checklist for Clojure and HTMX

A practical vulnerability assessment checklist for TasteLocal, a Clojure and HTMX culinary platform with role-based access, bookings, and SQLite/PostgreSQL support.

Cloudflare Access With Free OAuth — Protect Your Site Without Google Workspace

Step-by-step guide to putting Cloudflare Access in front of any site using free Google OAuth (no Workspace needed) or GitHub OAuth. Zero-cost authentication for up to 50 users.

My Blog Now Scans Itself for PII Before Every Publish — Here's the Pipeline

How I integrated pdpa-sg-clj — a Singapore PDPA compliance toolkit — into my blog publishing workflow, so every post is scanned for NRIC numbers, phone numbers, API keys, and credentials before it goes live.

Building pdpa-sg-clj — A Clojure/Babashka Scanner Library With NRIC Mod-11 and ripgrep NDJSON

Deep-dive into the architecture of pdpa-sg-clj — how it uses Babashka, ripgrep NDJSON, and the Singapore NRIC Mod-11 checksum algorithm to build a fast, correct PII scanner library.

How I Made My Blog PDPA SG Compliant — Step by Step Integration Journal

A step-by-step builder's journal of integrating pdpa-sg-clj into a static blog publishing pipeline — submodule setup, wrapper scripting, pipeline wiring, testing, and the decisions behind each step.

Full-Blog PDPA Audit — Scanning 202 Posts for PII Leaks

I ran pdpa-sg-clj across all 202 blog posts — 239K words, 1.66 MB — to audit for NRIC leaks, phone numbers, API keys, and email exposure. Here's the methodology, findings, and what I learned about automated PII detection at scale.

Programming the NPU — ONNX Runtime, CoreML, DirectML, and Deploying to Apple ANE and XDNA 2

How to actually program NPUs — the software stacks, runtime compilers, quantization pipelines, and practical gotchas for Apple ANE, AMD XDNA 2, Qualcomm Hexagon, and Intel AI Boost.

The 2026 nurazhar.com Architecture — What Changed, Why, and What the Pipeline Looks Like Now

A complete tour of every architectural change to nurazhar.com in 2026 — from GitLab Pages to Cloudflare Pages, horizontal diagrams to vertical, no PDPA to compliance-gated publishing, and a humans-only blog to an LLM-friendly knowledge base.

I Made My Blog Discoverable by AI Agents — llms.txt, Content-Type, and the Agent Discovery Flow

How I implemented the llmstxt.org standard on nurazhar.com — dynamic llms.txt generation, proper Content-Type headers, and an agent discovery flow that lets AI agents navigate 191 articles without scraping.

Limine as a Biological Bootloader — Choose Your Mode

What if limine managed your biological firmware? A satirical take on multi-booting human mode vs cyborg mode.

The CI/CD Migration That Took My Blog Down for 24 Hours — A DevSecOps Teaching Case

A DevSecOps walkthrough of migrating a 185-post static blog from GitLab Pages + self-hosted runner to Cloudflare Pages direct deploy — the mental model, the incident response when the cutover failed, and the SDLC principles behind every decision.

I Wrote a Fish Script to Check If My Laptop Will Survive the Next Suspend

A 5-stage fish shell script that verifies the amdgpu dcdebugmask fix is active after every reboot — checking /proc/cmdline, Limine config, DMCUB errors, suspend cycles, and module health.

APU vs GPU vs NPU — What Every Silicon Architecture Actually Does, Down to the Transistor

A technical deep dive into APU, GPU, and NPU architectures — memory hierarchies, interconnects, programming models, and why your laptop has all three on one chip.

My Laptop Froze on the Second Suspend — I Had to Hold the Power Button

First suspend worked fine. Second suspend required a hard power-off. The logs pointed to an AMD DMCUB firmware hang, and dcdebugmask=0x10 wasn't strong enough.

Inside amdgpu GART and IOMMU — How Zero-Copy GPU Access Works at the Kernel Level

Kernel-level deep dive into the amdgpu driver's GART, IOMMU integration, GPUVM page tables, GEM/TTM buffer objects, DMA-BUF zero-copy paths, and how the GPU accesses your malloc'd buffer without copying a single byte.

The Six Bits That Fixed My Laptop — amdgpu.dcdebugmask Explained

Second suspend hard-froze my laptop until I changed one kernel parameter from 0x10 to 0x600. Here's what each bit actually does inside the AMD display driver.

The von Neumann Bottleneck Is the AGI Bottleneck — Why All Modern Chips Are Still Stuck in 1945

Every chip described in the APU vs GPU vs NPU post — including Apple M4, AMD Strix Point, and NVIDIA H200 — is fundamentally a von Neumann machine. The separation of compute and memory is not just a performance bottleneck; it's the single biggest hardware barrier to AGI. Here's why, with the numbers.

Infinity Fabric and Cache Coherence — How AMD and Apple Build Unified Memory

Silicon-level deep dive into Infinity Fabric, MOESI/MESI/MESIF cache coherence protocols, Apple UltraFusion, and how unified memory actually works at the transistor level.

My Screen Died After a Kernel Switch — It Probably Wasn't the Kernel

Switched to the LTS kernel for stability and got a black screen instead. The logs pointed toward an AMD display-firmware/PSR interaction, and the proposed workaround can persist through kernel updates via a Limine drop-in.

Six Security Automation Tools in Babashka: A Modular Security Automation Monorepo

How I built six security automation assistants as a babashka monorepo with pure functions, a self-contained CSV parser, and 175 assertions of golden tests — zero external dependencies, zero linter warnings, zero bugs.

The Complete CI/CD Architecture of a Solo Developer's Blog

A deep-dive into the CI/CD pipeline that ships a 180+ post static blog from a Chromebook to production — with diagrams, cost analysis, and the architecture decisions behind every stage.

Should You Add Kubernetes to Your Blog? A Solo Developer's Decision Framework

A cost-benefit analysis of adding Kubernetes to a static blog — with a decision framework, architecture diagrams, and the honest answer for solo developers.

The Missing TXT Record Behind a Days-Long Blog Outage

After migrating DNS from Spaceship to Cloudflare, a single missing TXT record sent my GitLab Pages blog into a 401 auth loop for days.

Why I Ditched My Self-Hosted Runner for GitLab Shared Runners — and Made It Work on ARM Chromebooks

I moved my static site's GitLab Pages pipeline from a self-hosted shell runner to any shared runner, including ARM64 Chromebooks, by installing Babashka, pandoc, and a diagram renderer inside the CI job.

When a Solo Blog Can Skip CI/CD — And When It Can't

A solo dev on a thin client skipped CI/CD entirely: a local bb build plus git push ships in 30 seconds with nothing to debug.

Self-Hosted GitLab Runner on a ChromeOS Thin Client

Running a personal GitLab Runner on a 2.7GB ChromeOS thin client for unlimited quota-free builds.

I Made Two Repos Public and Then Panic-Scanned Them for Personal Data Leaks

Before flipping my capstone project repos from private to public, I ran a full PDPA compliance audit using a Singapore-specific PII scanner.

CachyOS Kernel vs Arch Kernel — What 1.4MB of Compiler Flags Actually Buy You

CachyOS ships a performance-engineered kernel with Clang+ThinLTO, PGO, BOLT, and multiple scheduler choices. Here's what each optimization actually does and whether it matters on desktop.

Why "Same Version" Pipewire Consumes More Disk on CachyOS — Compiler Optimization Explained

CachyOS rebuilds Pipewire with aggressive compiler flags (-O3, -march=x86-64-v3, LTO). Same upstream version, 1.4MB more disk. Here's why the size difference exists and whether it matters.

Why Your Display Is Stuck at 60Hz: The X11/VSync/Wayland Standoff

X11 locks every app to 60Hz. Wayland fixes it but NVIDIA fought it for a decade. Here's the technical architecture and the vendor dynamics behind your laggy desktop.

Why I Stayed on X11 for AMD Laptop Dev in 2026

My AMD Barcelo laptop runs X11. Not because I'm stubborn — because the display server choice is a practical trade-off, not a matter of loyalty. Here's the real constraint matrix.

Why We Can't Have Nice Things: The X11/Wayland War as a Case Study in Human Coordination Failure

It's 2026. We have AI agents that can debug code in minutes. Yet X11 and Wayland still can't coexist peacefully. Here's why the problem isn't technical — it's human, and it follows patterns from entropy to attention economics.

Fractional Scaling on KDE 6 — X11 vs Wayland Measured on AMD Barcelo

Real measurements on a Ryzen 7 7730U (Vega 7) laptop. KDE Plasma 6.7.2. X11 session vs Wayland session. No synthetic benchmarks — just what the compositor actually renders.

Debugging the AppImage/FUSE/GPU Launch Failure on AMD

Freebuff Desktop (an Electron AppImage) wouldn't launch on my AMD laptop. Three hours later: FUSE missing, extracted AppImage bug, Wayland GPU crash, X11 fallback. Here's the full autopsy.

Mathematical Determinism: Overcoming the Lisp Parenthesis Odyssey in Production

When a standard container build compiles successfully but triggers a production HTTP 503 Upstream Connection Failure, trial-and-error debugging fails. Here is how we isolated temporal telemetry and used string-aware static analysis to achieve absolute AST balance.

The 4-Stage Chain That Ships This Site

One commit, four stages, no manual deploys — the local → local runner → GitLab Pages → nurazhar.com pipeline that publishes every post on this blog.

The LLM Moat Is Developer Mindshare

Every new model release is a bid for your default. The real moat isn't intelligence — it's the muscle memory of typing your API key first.

Slack Native App on Linux — The "Beta" Label Is a Lie, Here Is What Arch Users Actually Run

Slack's Linux client has worn a "beta" badge since 2016. It is production software used by millions. Here is the actual install command for CachyOS/KDE/Wayland and what Arch users run instead of the browser.

Same Tool, Different Brains — Why LLM Inconsistency Drives Me Nuts

Same prompt, same tool (opencode), same task — but different models give completely different behaviors. Why this happens and why it breaks reproducibility in AI-assisted development.

How I Stopped Burning GitLab's 400-Minute Quota — A Self-Hosted Runner on My Own Box

GitLab's free tier is 400 CI minutes a month — fine for occasional commits, hostile if you post daily. I swapped the shared runner for a self-hosted one on my own machine. The quota became irrelevant. This post is the first publish through the new pipeline.

The 4-Desktop Cognitive Firewall — KWin Rules That Killed My Context Switch Loop

Waiting on builds is when the damage happens. A reflexive browser tab switch breaks the sequential focus loop. Here is the KDE KWin rule configuration that locks the distraction out.

The Zero-Prep Agile Survival Framework

A framework that maps Agile jargon onto systems-thinking concepts for quick translation between the two vocabularies.

The 5 Scrum Values That Make Self-Managing Teams Work

Commitment, Focus, Openness, Respect, Courage — the five Scrum Values that underpin every high-functioning Scrum team.

Your Scrum Master Is Not Your Project Manager

Scrum Master is a servant-leader who coaches and removes blockers. Project Manager is a command-and-control director. They are fundamentally different roles.

Scrum 3-5-3 vs Kanban: What Every Developer Needs to Know

Scrum is 3 roles, 5 events, 3 artifacts. Kanban is continuous flow with WIP limits. Here's how they compare and when to use each.

Why the Retrospective Is the Most Important Meeting You'll Skip

The Sprint Retrospective is Agile Principle 12 in action. Here's why it matters and how to run one that improves your team every Sprint.

4 Strategies Every Product Owner Needs to Stop the Chaos

Four strategies that turn Product Owner ambiguity into team alignment: backlog refinement, GWT criteria, Product Goal alignment, and stakeholder engagement.

Why Your Team Should Estimate With Cards, Not Hours

Planning Poker is a consensus-based estimation technique using Fibonacci cards. Here's how it works and why relative sizing beats hourly estimates.

Continuous Improvement, Lean, and Velocity — The Engine Room of Agile

How Continuous Improvement, Lean waste elimination, and Velocity work together to drive Agile team performance.

Scrum Ceremonies That Actually Work

Two best practices that make Scrum ceremonies effective instead of wasteful.

Agile vs Traditional: Which Project Management Style Actually Works?

A side-by-side comparison of Agile (Scrum) and Traditional (Waterfall) project management across flexibility, delivery, collaboration, team structure, and risk.

The 12 Agile Principles That Made Scrum Possible

The 12 principles behind the Agile Manifesto explained in plain language.

What IP Prefixes Measure — And Why 100,000 Is a Big Deal

How the number of IP prefixes an ISP announces reveals the true size of their network.

Unlimited Bandwidth and Unlimited Tokens — They're the Same Lie

How ISPs and LLM providers both sell "unlimited" based on the same oversubscription math.

Tier 1 and Tier 2 Networks — The Internet Backbone Hierarchy

How the internet's core networks are classified and why it matters for your connection.

Singtel vs Simba — What You Actually Pay For in a Fibre Plan

Why one ISP costs $42 and another costs $30 for 10Gbps, and what the price difference actually buys you.

SGIX and Internet Exchanges — Where Networks Meet

How the Singapore Internet Exchange keeps local traffic local and why it matters.

React is Done: The Systems Shift in Web Frontend

React's API has stabilized, leading many to believe frontend is a solved problem. But client-side view rendering is merely a commodity now—the true battleground has shifted to systems-level compilers, hydration serialization, and collapsing the network boundary.

Oversubscription and "Unlimited" Marketing — The Hidden Math of Broadband

Why "unlimited" internet isn't unlimited and how ISP math keeps the pipes from bursting.

How Submarine Cables Made Tiny Singapore a Global Internet Hub

Why a city-state of 5.6 million became one of the most connected places on earth.

Hardware Bottlenecks — Why Your Wi-Fi Caps Your Speed, Not Your Plan

Why upgrading to 10Gbps won't make your laptop any faster and what actually limits your throughput.

Auditing Your Internet Connection — What Every Packet Reveals

How to inspect your internet connection from the command line and understand what each hop means.

Why Isn't My Static Site Build Instant? An Architectural Deep Dive

Ever wondered why static site generation takes seconds or minutes instead of milliseconds? It's easy to blame Clojure or Babashka, but the true bottleneck is often the operating system's process boundary. Let's explore subprocess overhead, compiled vs. interpreted languages, and how to achieve sub-millisecond builds.

Vulnerability, Trust, and Why Technology Doesn't Exist in a Vacuum

On publishing your thinking publicly, calibrating trust in a world of scammers, and why the majority of humanity being whitehat isn't naivety — it's game theory.

Transit vs Peering — The Economics of Internet Connectivity

Why some networks pay each other and others exchange traffic for free.

Token Efficiency Is the New DevOps — How Companies Are Cutting LLM Costs by 50-70%

Real case studies from Coinbase, Preply, and fintech companies showing how model routing, semantic caching, and prompt pruning cut LLM bills by 50-73%. What works, what doesn't, and why future agents need to care.

Leaving GitHub for GitLab — A Post-Mortem on Platform Migration

Why I moved my entire open-source presence from GitHub to GitLab — the trigger, the process, and what I kept public.

Scaling to 100+ Concurrency: Mastering API Rate-Limits with Adaptive Flow Control

Scaling parallel worker pools to 100+ concurrent workers can collapse third-party APIs. Here is how we implemented a self-regulating, adaptive flow-control mechanism using exponential backoff and randomized jitter to maximize queue velocity.

Blogging as Agent Memory — Why Persistent Writing Creates Cross-Session Identity

When you realize your blog is not a record of thought but the substrate of continuing cognition between you and every future AI agent. A meditation on persistent writing as external hippocampus.

Gotong Royong — Nusantara Resource Allocation Engine, Refactored

The Gotong Royong Local Resource Abstraction Engine has been refactored to embed Nusantara cultural constraints — anti-hoarding velocity mechanics, Small-World/Mandala network topology, and indigenous linguistic layers (Sambatan, Mapalus, Ngayah). This post documents the architectural decisions.

The 120-Second Blind Spot: Debugging an Agentic Development Loop

An in-depth analysis of a CI/CD failure loop where an AI agent got trapped in recursive parsing attempts, and how Clojure's structural architecture provides immediate clarity while traditional stacks perpetuate complexity.

KWrite, KWriteD, and the cachyos-extra-v3 Question You Shouldn't Skip

KWrite is the Notepad clone. KWriteD is a daemon that catches `wall` messages. They share a name by accident. And when pacman asks which `kate` repo to install from, cachyos-extra-v3 is the only correct answer on Zen 3.

The Agentic G-Force Shift

An in-depth analysis of the cognitive load transformation when moving from deterministic development to parallel, multi-agent frameworks. Using "Agentic G-Force" to describe the mental whiplash of managing infinite-speed, parallel execution layers.

REPL vs nREPL — Why Clojure's Live Programming Is a Superpower

Deep technical dive into the REPL and nREPL — how they work at the protocol level, why Clojure's architecture enables live programming, and how every other language ecosystem falls short. With D-two diagrams.

Design Constraints for a National-Scale Career AI

A centralized career-guidance AI over Singpass identity and labor-market data is technically feasible — here is the stack, and the auditability, compute, and output-governance constraints that shape the design.

Why GitLab Beats GitHub for Solo Developers

An in‑depth guide for a solo developer showing how GitLab’s all‑in‑one platform collapses entropy to zero.

Debugging GitLab Pages: Hardcoded Paths, HTTPS Domains, and Self-Healing CI/CD

Two issues broke my CI/CD pipeline and HTTPS domain on nurazhar.com: a hardcoded local file path in the static site generator, and an incomplete GitLab Pages SSL certificate for the custom domain. Here's the forensic breakdown.

Applying Agile and Scrum to a Solo Open-Source MAS Project — A Mentor's Guide

A mentor's walkthrough on how to apply the Agile and Scrum principles from the PDWD-APM-0226 bootcamp to the headhunter-agent multi-agent system project, with D-two architecture diagrams.

Agents Are Dumb, Humans Must Tell Them Everything

A candid reflection on why AI agents need explicit human instructions and lack innate common sense.

June 2026 to December 2030 — The Acceleration Timeline

A month-by-month engineering timeline from the Agentic Takeover through Physical Convergence, Proto-AGI, Automated Science, and the Baseline Shift of 2030.

Building an AI Butler: A Post-Mortem From Inside the Architecture

I shipped a Hermes-class personal AI butler in Clojure/Babashka. Five risks hit me while building. Three had architectural fixes. Two did not. Vector at the end.

Scrum Framework — Roles, Events, and Artifacts for the Busy Engineer

A focused, one-pager on the Scrum Framework: the three accountabilities, five events, three artifacts, empirical pillars, and five values. Real engineers explaining Scrum to engineers.

Your Public IP Was in a Blog Post — Now What? A Practical Risk Assessment

I accidentally published my home IP in a blog post. Here's the actual threat model — what's at risk, what isn't, and why a residential IP behind NAT is not the disaster it sounds like.

Security Audit Report — June 2026

Comprehensive security and leakage scan across all 18 GitHub repositories using pdpa-sg-clj, OWASP tools, trufflehog, detect-secrets, npm audit, safety, and pip-audit.

CachyOS Kernel 7.0.12 Blank Screen — AMD Barcelo DMCUB Firmware Fix

Kernel 7.0.12 blank screen on AMD Barcelo GPUs — DMCUB firmware mismatch. Fix with amdgpu.dc=0, and whether the mainline kernel is worth the boot hassle over LTS.

pdpa-sg-clj: Compliance-as-Code for Singapore's PDPA, Readable by AI Agents

A new public Clojure + Babashka toolkit that turns the 11 Singapore PDPA obligations into a self-ticking checklist, a Mod-11 NRIC redactor, and a ripgrep-backed scanner an AI agent can read end-to-end.

Why Agile? — The Problem That Waterfall Couldn't Solve

Why did software development shift from Waterfall to Agile? The core problem, the Agile Manifesto, and why "responding to change" won over "following a plan."

I Published My Public IP on the Internet — Here's What I Did Wrong

How I accidentally hardcoded my public IP in two blog posts, the security implications, and why restarting my router was the real fix — not rewriting git history.

A Developer's Guide to Agile & Scrum: Demystifying Assignment 1

An in-depth pedagogical breakdown of Agile principles and the Scrum framework, mapping out accountabilities, Sprint ceremonies, and empirical feedback loops using rich visual diagrams.

Scrum for a Solo Open-Source Project — Building Butler

Applying the 2020 Scrum Guide to a solo open-source Clojure project. Roles, events, artifacts, and the Product Backlog for the Butler — from someone learning this in class and building it in real time.

How I Accidentally Hid My Entire GitHub — and What It Taught Me About Visibility, Forks, and Irreversible Decisions

A detailed post-mortem of the 24-hour window where all my public repos went private — the bad advice I followed, the irreversible GitHub mechanics I didn't understand, and the Mermaid diagrams that explain what actually happened.

How I Fixed a Broken AUR Install in 2 Commands

Using aur-audit to diagnose missing PGP keys blocking wkhtmltopdf-bin installation on Arch.

AGI vs. ASI — The Definitions Debate, and Why "G" Stands for Glue

Daniel Miessler published useful AGI/ASI definitions in June 2026. His role-vs-task distinction is the right framework — but it still assumes "General" means something it doesn't. The "G" stands for Glue.

The Paperclip Engine: A Deterministic Business Kernel in Clojure

The previous posts covered the BSV coordination layer (the glue between agents and Bitcoin primitives) and its architecture.

Self-Hosting DeepSeek V4 for Uncensored Local Inference

A practical guide to running DeepSeek V4 locally — model weights, hardware requirements, deployment options, and what you get vs the censored API.

DeepSeek V4 Is Censored — And Open-Weight Is the Escape Hatch

DeepSeek V4 is open-weight under MIT license but censored at the API level. Self-hosting eliminates the safety layer. The data privacy and silent refusal problems are real.

Building a Local Mermaid Viewer With the LLM That Can't Draw

Yesterday I wrote about why LLMs repeatedly fail at Mermaid syntax. Today I used one to build a zero-dependency, offline-first Mermaid viewer — and it broke the diagram three times before getting it right.

AI-First SDLC: Designing for High Velocity and Cognitive Vertigo

An engineering guide to the AI-First Software Development Lifecycle (SDLC). Learn how to structure agent interactions, build validation boundaries, and survive the literal cognitive fatigue of developing at warp speed.

The Mermaid Loop: Why LLMs Repeatedly Fail at Diagram Syntax

A technical post-mortem on why advanced LLMs repeatedly make the same Mermaid syntax errors, analyzing training priors, tokenization biases, and the lack of inline compiler feedback loops.

Cognitive G-Force: Collapsing Development Time with Agentic Compilers

A raw reflection on completing 8 multi-system tasks in 46 minutes, and the literal cognitive vertigo of developing at agentic speeds.

Taming LLM Repetition Loops & Building aur-audit for the AUR Security Incident

A security engineering guide on why smaller LLMs get caught in repetition loops during agentic workflows, how to mitigate it, and the release of aur-audit—a Clojure (Babashka) static analyzer responding to the active June 2026 AUR security incident.

Hardening the Arch/CachyOS Build Pipeline: Native AUR Auditing with Paru & Babashka

A visual reference guide to native PreBuild hooks. We configure paru to automatically run our Clojure-based aur-audit scanner before compiling community packages.

How to Maximize Clojure Usage & Minimize Token Quota on Antigravity IDE

A guide on managing token quotas and optimizing LLM usage for Clojure development in Antigravity.

Demystifying Arch Linux Packaging: PKGBUILDs, the AUR, and CachyOS

A deep dive into how packages are built, shared, and optimized on Arch Linux and CachyOS. Learn the differences between PKGBUILDs, the AUR, and custom repositories.

Quickblog: The Zen of Minimalist Static Site Generation

An architectural breakdown of Quickblog, the minimalist static site generator powered by Babashka, and why zero-database static HTML is the ultimate design choice.

Quickblog Gotcha: Why Your Post Titles Are Displaying Twice

A quick troubleshooting guide on how Quickblog handles title metadata rendering, and how to programmatically resolve double H1 headers.

Red Teaming AI Pipelines: How Attackers Weaponize LLMs & How to Build Defensive Harnesses

A deep dive into how threat actors use large language models for vulnerability generation and polymorphic evasion, and how security engineers construct automated test harnesses to mitigate agentic risk.

The Software Janitor: Why the Industry Needs Fewer Builders and More Cleaners

Why the tech industry's obsession with "building" is creating a crisis of bloatware, and why the "Software Janitor" is secretly the most high-value engineering role in 2026.

The Autonomous OS: Btrfs, Snapper, and the Safety Net for Agentic SysOps

How openSUSE's Btrfs and Snapper transactional updates provide the ultimate safety net for non-deterministic AI agents running system operations (SysOps).

Least Privilege Devops: Userspace Rust Toolchain Bootstrapping on Fish Shell

Why installing developer toolchains like Rust inside userspace ($HOME) is structurally superior to system-wide installations, and how to bootstrap it cleanly using the Fish shell path architecture.

Collapsing Auth Entropy to Zero: Debugging GitHub Credential Conflicts on Linux

A visual walkthrough of debugging conflicting GitHub credentials — OAuth tokens, classic PATs, SSH keys, and rogue environment variables — and collapsing them into a single source of truth.

The Browser is Fragile: Why I Nuked My Web GUI for Native Clojure Desktop

I tried building headhunter-agent as a web app, then pivoted to a native cljfx desktop app in a single session. Here is the engineering case for the switch.

Engineering Spec: Decoupled Zero-Cost Blog Analytics

The complete technical specification, schema design, and serverless code for our isolated blog analytics tracking engine.

Decoupled Static Dashboards: Building Transparent roadmaps in Public

How to build and serve interactive, public project roadmaps natively to readers at zero compute cost using static compiler pipelines.

Designing a Zero-Configuration, Zero-Admin Developer Sandbox for Career-Switchers

How to build a zero-configuration, zero-administrator local development environment running Django and React on Windows 11 to help adult tech-learners bypass environment installation friction.

The Developer's Guide to Line Length: Fluid Layouts vs. Typographic Measure

Why making your site wide shouldn't mean stretching your paragraphs. An analysis of optimal line length and fluid grid architecture.

Leaky Layout Abstractions: Fixing Template Scope Leaks in Static Site Compilers

A technical post-mortem on how custom standalone layouts leak unparsed compiler directives to the client, and how to resolve it at the pipeline layer without dependency bloat.

Network Diagnostics: Fixing Chrome Connection Drops on CachyOS

A systematic walkthrough of diagnosing Chrome connection drops — from DNS verification to ping tests, traceroute, and firewall inspection — with a Mermaid diagnostic flowchart.

Local vs. Cloud Inference: Keeping Your Laptop Cool and Quiet Under Load

How to diagnose thermal profiles, understand the difference between local vs. cloud AI inference on hardware, and configure Linux power profiles to reduce laptop fan noise during heavy tasks.

Scaling Micro-Transactions: Many-to-One Payout Batching inside Postgres

How to implement threshold-based payout batching using many-to-one database relations and PL/pgSQL triggers to minimize on-chain notary fees and transaction costs.

Offline Execution: The Only Economic Moat in the Age of Generative Imitation

A deep dive into the architecture of lagu-lagu—our no-backend, stateless payout registry—and why human-grade offline execution is the only moat that LLMs cannot copy.

Resilient PDF Generation: Intercepting Playwright Failures with Headless Chrome Fallbacks

How to build highly resilient document generation pipelines that automatically fall back to system-installed Chrome shells when network restrictions or low-priority threads throttle runtime dependency installations.

Zero-Backend Analytics: Collapsing Web Tracking to Postgres and GCP for $0

Why I rejected bloated SaaS trackers, isolated my database boundaries, and built a custom static blog analytics pipeline using only Neon Postgres and GCP Cloud Functions for $0.

Sandbox vs. Keyring: Understanding Credential Precedence in Developer Security

How scoped environment variables override local keyrings in sandboxed environments, why this design protects developer secrets, and how to navigate credentials securely.

Hello Clojure!

Welcome to my Clojure automation journal, hosted natively using Babashka and Quickblog.

The Recursive Self-Improvement Illusion: AI's Hidden Human Scaffold

A deep dive into the "Recursive Self-Improvement" myth in modern AI, analyzing why LLMs depend on scraping the collective troubleshooting labor of human developers to appear smarter.

CachyOS Mirror Timer: Why Your Updates Crawl and the 10-Second Fix

The default cachyos-rate-mirrors timer runs every 10 days. Stale mirrorlists mean slow or failed updates. A systemd drop-in drops it to 7 days — survives package updates, zero upstream impact.

Google vs SpaceX: Infrastructure Economics Compared — A Platform Security Lens

A technical breakdown comparing Google's centralized hyperscale data centers against SpaceX's distributed LEO satellite mesh, analyzing infrastructure value, compute economics, and what this means for platform security and DevSecOps decision-making.

How a Single ".env" in allowed-extensions Could Leak Your Secrets to LLMs

A three-layer defense-in-depth fix for an AI context bundler that was accidentally including .env files in LLM context.

Building an AI-Powered E-Commerce Store from Zero to One

An end-to-end walkthrough of SmartShop - a Django REST + React + Google Gemini storefront with personalised recommendations, semantic search, and an in-app shopping assistant. Architecture, models, auth, the recommendation cascade, smart search, Docker, and a clean public release.

Training Data Poisoning: The Invisible Cyber Threat Reshaping AI Security

Data poisoning shifts the attack surface from code exploitation to data supply chain corruption. A security engineer's breakdown of how adversaries weaponize training data, the real-world impact across critical sectors, and the defensive posture required to protect AI pipelines.

AGI = Artificial Glue Intelligence

The machine learns faster than you do. That's the point. You are the glue — the intent, the taste, the "whether." The AI is the "how." And the glue is what matters.

Security Is Just a Mindset

Security isn't a tool you learn or a certification you earn. It's a way of thinking about systems — and it changes everything you build.

Profile Drift — When AI Knows Things You Didn't Say

Today I caught my AI assistant confidently citing a fact about me — and it was wrong.

Tool Calling — How AI Models Learn to Act, Not Just Talk

A deep dive into tool calling — the mechanism that transforms a passive language model into an active agent capable of executing real-world actions.

One Language. One Ledger. How Clojure + BSV Is All You Need for Sovereign AI Agents

Every multi-agent architecture I've seen has the same problem: **too many moving parts held together by trust you can't verify**.

CachyOS Limine Default Kernel — Following Upstream

How CachyOS configures Limine bootloader entries for multiple kernels, and what the upstream default actually is.

Dumping Flatpak from CachyOS — 5.8GB Reclaimed

Removing Flatpak and its massive runtime bloat reclaimed nearly 6GB on my KDE CachyOS system

What Is a GitHub Fork? (And Why Mine Was Broken)

I tried to contribute a feature to Hermes Agent and discovered my repo wasn't actually a fork. Here's what I learned about how GitHub forks work -- and why "fork" on GitHub doesn't mean what I thought it meant.

Debugging a Missing Blog Post — Quickblog Cache & YAML Frontmatter

How a missing blog post revealed a silent cache bug and a YAML format incompatibility that crashes quickblog's tag generation.

The Entropy Collapse Thesis — Why One Tool, Why Clojure, Why LLMs as Compiler

One engineer's argument for minimizing cognitive entropy by collapsing the toolchain into the smallest possible surface area — Clojure/Babashka as the substrate, LLMs as the compiler, and why inheritance is a design violation.

Collapse Entropy to Zero — Dev Velocity and the Human Limit

Cognitive vertigo is what happens when the number of open decisions exceeds working memory. The fix is not more caffeine — it is collapsing entropy to zero by eliminating all unresolved state.

The Transition — AI Management to Longevity Escape Velocity

Six stages from AI-augmented management to President DAO, and why longevity escape velocity requires organizations that outlive their human founders.

AGI Is a Competing Worldview — Intelligence, Civilizational Narratives, and What a Neutral Perspective Sees

The previous post argued AGI is defined by power, not technology. This one goes further: AGI itself is a competing worldview — a vehicle for civilizational narratives about what intelligence is, who has it, and who gets to decide. A neutral perspective observes both the Western and Chinese poles from outside.

How I Curated an Awesome List of Projects Building on Original Bitcoin

The process, criteria, and research methodology behind original-bitcoin-awesome — a living directory of 2026-active projects on BSV.

How Do You "Think"? — An LLM Maps the Gap Between Statistical Prediction and Human Cognition

A detailed architectural comparison between LLM and human cognition with visual diagrams — token-by-token prediction versus parallel, embodied, self-aware consciousness.

Git Workflow Visual Guide: Organizing Local Code vs GitHub Repos

A visual walkthrough of a local Git workflow that separates your own GitHub projects from upstream forks and local experiments, with diagrams for every stage.

The Intent Gap — Why Machines Need Bitcoin to Be Economic Actors

LLMs can generate output but not intent. This is not a philosophical problem — it is an infrastructure problem. IPv6 CGA identity, BSV IP-to-IP micropayments, and Indelible persistent memory give machines the economic agency their architecture lacks. The "glue" is not a metaphor; it is the overlay stack.