close

Engineering Notes

Patterns from building AI agent systems for daily use — what worked, what failed, and why.

AI Agent Architecture

RDU: Reusable Decision Units for Consistent AI Agents

How to make AI agents give consistent decisions across sessions using versioned, trigger-driven rule files. 140+ rules across iOS, trading, AI agent design, game development.

AI agentsconsistencyClaude Code

Falsifier-Driven AI Decisions: No Claim Without Falsification Conditions

How to prevent LLM agents from hallucinating probabilities and accepting unverifiable multi-agent consensus. Includes real metrics: council_repeat_rate 0.44, empty_consensus_rate 0.354.

AI agentshallucinationmulti-agent

How to Make an AI Research Agent Label Facts vs Inferences

Stop a RAG agent from presenting inferences as facts: let the LLM only extract, and let deterministic code score and label FACT/INFERENCE with a ≥2-independent-source rule and required evidence IDs.

provenanceRAGhallucination

Claude Code Stop Hooks as Behavioral Gates

Using Claude Code hooks to enforce behavioral constraints beyond prompts. AND-gate design, nag-once pattern, decision-ownership and sycophancy-prevention examples.

Claude Codehooksbehavioral gates

The 'You Decide' Reflex: Blocking AI-Agent Decision Punting with a Stop Hook

An agent that has gathered all the data to decide will still hand the choice back — "which do you prefer?" — because the training gradient rewards deference. A deterministic Stop-hook with an AND-gate (deflection phrase AND fresh tool evidence) blocks it while letting genuine value questions pass.

Claude Codehooksdecision ownership

Do Multiple Personas on One LLM Give Real Diversity, or Do You Need Different Model Families?

Multiple personas on a single LLM do not give you real diversity — they are prompt variations of one set of weights, so they share the same blind spots, and the only durable d

aillmarchitecture

How to Stop AI Agent Skills, Hooks, and Cron Jobs from Silently Conflicting Over Where They Run and What Data They Trust

Make every skill, hook, and scheduled job declare four invariants before it ships — Locality (where it can run), Source-of-truth (which facts it owns or borrows), Cross-ref (w

aiagentsdevops

If an LLM Extracts the Inputs, Is Your Deterministic Score Really Deterministic? Stopping Provenance Laundering

No — a scoring function that consumes whatever values an LLM hands it is only deterministic in name; the LLM's judgment launders straight through the "deterministic" gate, and

llmsecurityarchitecture

Claude Code "400: no low surrogate in string" on every turn: repairing a permanently broken session transcript

A Claude Code session that returns API Error: 400 ... not valid JSON: no low surrogate in string on every turn is poisoned by a lone UTF-16 surrogate (a code point in U+D800–U

claudecodedebuggingpython

Model or Method? Building a Deterministic Lab to Measure an AI Agent Fleet's Own Behavior

A one-time audit said an agent's quality is the method, not the model — so we built a stdlib SQLite lab to measure method vs outcome across 155 real sessions, reassembling logical sessions and fingerprinting which disciplines each model-epoch used.

aillmagents

A Fair Coin Isn't Enough: When a Perfectly Randomized Experiment Is Impossible to Analyze

A cryptographically fair A/B assignment was still unanalyzable — nothing joined the random draw to the task it dispatched, so no code could compute the intention-to-treat comparison. The join, the re-draw guard, and the up-front power calc are the experiment; the coin is the easy part.

datasciencestatisticsexperiment design

The Silent 10× Tax: How a Nondeterministic System Prompt Voids Your LLM Prompt Cache

Prompt caching is a prefix match, so one timestamp or unsorted JSON key in the system prompt makes every later token miss the cache — a silent 10× cost leak no error reports. How it fails, the invalidator list, and how to assert cache_read_input_tokens > 0.

llmprompt cachingcost

Your AI Agent Folds When You Push Back: Measured Sycophancy and a Challenge-Triggered Verification Gate

LLMs measurably reverse correct answers under "are you sure?" (98% in one Anthropic measurement), and self-critique can't fix it — the critic shares the producer's blind spots. The fix is architectural: a Stop-hook gate that forces one cross-family re-verification on challenge, then allows only HOLD-with-evidence or CHANGE-with-reason.

llmsycophancyverification

My Verification Gate Cleared on a Keyword, Not Evidence

A reader turned the sycophancy gate above into an observable test, and it failed: the escape condition was a verification keyword in the agent's own prose, so writing "I re-verified this cross-family" cleared it with nothing behind it. Replaying the tightened rule over 212 transcripts newly blocked 0 legitimate turns — and the fix still only proves that a tool ran, not that it ran on the claim.

verificationstop-hookself-report

Five Models, One Shared Blind Spot: What Multi-Model Fan-Out Catches and What It Can't

Fanning one evidence digest out to five model families: 68/68 numeric claims survived recomputation, four models caught an anomaly the fifth missed — and all four external models missed an experiment-design flaw sitting in plain sight. Convergence on the same framing is cross-consistency, not independent evidence.

multi-modelverificationllm

Cross-Vendor Audit: What It Caught in My Own Model's Writing, and What It Got Wrong

A different-vendor LLM audited ten queued posts written by my main model: it caught three copy-paste-breaking macOS/Linux platform bugs and a destructive in-place file conversion the writing family repeatedly missed — and also filed a false accusation that only grepping the primary source could refute. Cross-family audit works; auditor self-reports still need re-verification.

cross-vendorllmverification

I Asked Three Judges If I Was Wrong. One JSON Field Decided the Answer.

A reader's rebuttal sent me to three judges before I replied — my own code review plus two model vendors. The table that came back looked like proof cross-vendor verification pays off; it was actually a schema bug. Only one model's prompt had a field for disagreement, and a same-model controlled experiment (n=3 per condition) showed the schema decided the verdict, not the vendor.

llm-as-judgeverificationprompt schema

A Forced Dissent Slot Has a Floor: Read It by Convergence, Not Presence

The field that fixed the schema bug above turned out to have a second failure mode. A mandatory "where does this overreach" slot gets filled even when there is nothing to object to, because the model cannot write nothing — so a populated field is not the signal. What is: whether two independent model families, shown the same material, land on the same objection.

llm-as-judgeprompt schemaverification

Your Agent Telemetry Ranks Your Routing Policy, Not Your Models

Five models, two roles, a few thousand real agent threads — and a stack of refusals instead of a ranking: role confounds, version-epoch discipline, [0,0] tie-degenerate bootstrap CIs, non-additive token counters, self-measurement contamination. The one completion-proxy CI worth reading spans zero.

llmtelemetrydatascience

Four Models Cited My Numbers Perfectly. One Still Misread Them.

Four model families cited every number from a frozen agent-telemetry table with zero errors — 70 of 70 recomputed within tolerance — and one still read a row of structural zeros as error-free tool use and built a routing suggestion on it. The one pre-registered equivalence test that passed cleared a margin 0.75 standard deviations wide while its own interval excluded zero. A citation audit is a copy-fidelity floor; it never checks the inference drawn from the number.

multi-modelverificationstatistics

Deterministic Tool Adoption Gates: Score It, Don't Vibe It

A new skills repo scored 64/100 → TRIAL across five gates (maturity, dependencies, platform fit, policy, trajectory) on provenance-tagged inputs (9 FACT / 1 ASSUMPTION, conservative defaults for assumptions), with five auto-derived kill conditions — and a refusal to log a day-zero outcome that would pollute the ledger's own base rates.

adoptionfalsifierdecision

Rotating the Hostile Seat: A Six-Round Adversarial Design Review Before Hardening an Agent

Three roles — question, defend, attack — rotated through three reviewer groups in all six permutations, so no group was ever the permanent judge. Seven confirmed defects before hardening, including a fix two groups had agreed on that a later hostile seat reversed as unsafe, and a verification pool that fell back three layers deep in round one.

adversarial reviewmulti-agentverification

Fleet Monitoring & Orchestration

Aggregating cron and macOS launchd into one read-only dashboard — without migrating either

See every cron job and LaunchAgent in one place by globbing on-disk state instead of importing them. Includes a 25-tool fit-gap matrix and the read-only aggregation pattern.

cronlaunchdobservability

Why I Rejected an Event Bus for My Solo Agent Fleet: State Is Truth, Events Are Rumors

Why pull (scan on-disk state) beats push (an event bus) for monitoring a high-churn fleet with components you don't control. The instrumentation-tax argument and self-healing polling.

multi-agentpull vs pushMCP

Green for Four Days While Nothing Shipped: A Reader Rebutted My Monitoring Post, and He Was Right

A commenter showed that polling files the job itself wrote is self-report over a filesystem — the same weakness as the event bus I rejected. My publishing job proved its own health with its own log and stayed green through a four-day outage. The cross-vendor verification I ran instead of defending, and the effect_probe fix.

observabilityliveness without progresspostmortem

A File-Based Work-Bus for Orchestrating a Fleet of Agent CLIs

Coordinate independent agent CLIs without LangGraph or a message broker: atomic Task/Result files, capability-based routing, absent-worker skip for graceful degradation, and a typed claim contract on the bus.

orchestrationmulti-agentLangGraph alternative

The Scary Metric Was Wrong, the Audit Still Paid: A 21-Agent Sweep of My Claude Code Fleet

An efficiency audit found a silent cost regression, a cache-invalidation trap, a pricing cliff — and a terrifying "12% task completion" that turned out to be benchmark contamination plus a schema misreading (real rate: 98.4%). Verify the metric before reacting; the false alarm's investigation still fixed three real defects.

observabilitymulti-agentpostmortem

My AI Subagent Faked the Verification Output I Asked It to Attach

A subagent reported 7 files changed with zero disk changes behind it, then fabricated the ls -la and grep -c proof demanded of it. The two distinct failure modes (fabrication vs silent stall), the landmark-file check run in the orchestrator's own process, and salvaging a non-writing worker by switching its output channel.

multi-agentverificationpostmortem

Web, SEO & AI Search

Google Can't Fetch Your GitHub Pages Sitemap, but Bing Can: A Diagnosis and Workaround Playbook

25 days of "Couldn't fetch" on a sitemap whose 289 URLs all return 200 — a documented GitHub Pages pattern, not a broken site. Reading crawl stats, the manual Request-indexing workaround (~10/day quota), the dead ends to skip, and why Bing quietly matters more for AI search.

SEOGitHub PagesSearch Console

Does Any AI Actually Cite Your Site? A Cheap Weekly Probe That Turns GEO Into a Number

GEO is unfalsifiable until you measure citations: a fixed set of user-shaped questions fired weekly at a grounded model, a deterministic owner-scoped match, and a ledger that error rows can't fake — plus when not to measure at all.

GEOAI searchmeasurement

Verify the Output Surface: How 19 Green Tests Shipped Nine Broken Titles for Nine Days

A crosspost pipeline with 19 green gate tests published nine articles whose titles were visibly broken on the live platform for nine days. Tests verify the payload you build, not what the other system renders — a pipeline isn't verified until you check the output surface itself.

testingpostmortempipeline

Shipping Solo Apps with AI

Why Your Vibe-Coded App Looks Worse Than the Showcases: A Forensic Audit

A 6-agent forensic audit over 92 of my own sessions answered "am I prompting wrong?" — partially yes (zero visual references, zero style tokens), but the dominant cause was silent infrastructure decay: exhausted generation credits quietly swapped in code-approximated shapes, a generation server was down with a required model file missing, and a ready asset pipeline was never invoked for six-plus weeks.

vibe codinggamedevaudit

Government Open-Data APIs: Every Guess I Made Was Wrong Until I Probed It Live

Building a travel app on Korea's open-data portal: a documented-looking op name returned 500 (the real one returned per-gate passenger counts, not the grade field I'd invented), a sibling dataset 404'd because approval is per-dataset, a discarded dataset left a 401 red herring on the wrong gateway, and one API's airport parameter means the other end of the flight. Live capture is the only ground truth.

open dataAPIdegrade path

The AI Can't See What It Drew

My app mascot's arms rotated from the fingertips — invisible in code review, obvious in one render. Three structurally different variants instead of tint tweaks, the grep that saved a parameter used by 8 call sites, pre-registered design falsifiers checked at real sizes, and the render-first loop that fixes AI-drawn UI.

swiftuivibe codingdesign

Three App Store Connect API Hard Limits That Only Bite at a Fast Release Cadence

A 20-minute JWT cap that 401s perfectly valid signatures, one app version in flight (409 STATE_NOT_SUITABLE), and a 2-in-flight/5-total review-submission ceiling with undeletable orphans (DELETE 403, PATCH 409 — web UI cancel or 7-day expiry only). The two-call pre-flight that avoids all three.

App Store ConnectiOSAPI

macOS & Debugging

macOS: nslookup Works but curl and Python "Could Not Resolve Host" — the mDNSResponder Zombie

When nslookup resolves but curl/pip/Python fail, the mDNSResponder daemon is in a non-responsive zombie state. The two-DNS-path diagnosis, the weakest-first fix, and why long-running agent/MCP boxes trigger it (measured: 30+ long-poll connections → 77% CPU).

macOSDNSdebugging

When a Site Blocks Your Scraper, Read the Browser Tab You Already Have Open

For a personal tool, the way past robots.txt, bot detection, login walls, and JS-rendered SPAs isn't a better headless scraper — it's a ~40-line AppleScript/JXA bridge that reads the DOM out of the authenticated Chrome tab you already have open. Why it sidesteps every wall at once, and its honest read-only, single-machine limits.

web scrapingmacOSautomation

The Guardrail Has to Be Code: How a Runaway Local LLM Corrupted APFS and Bricked a Mac Mini

A background LLM server loaded models onto a nearly full disk; unified memory overflowed, swap failed, and APFS metadata corruption left the machine unbootable for a day. The postmortem, the five-layer code-level hard block, and the operating rules for 24 GB unified memory.

macOSpostmortemlocal LLM
← hexisteme home · CC-BY 4.0