WRITING

Short, dated, infrequent. Trade-offs behind a build decision, mechanics of running a small studio, the occasional reflection on a tool that changed how we work. No listicles, no SEO chasing.

Notes from the studio.

12 postsSince 2026Updated 2026

RSS

FeaturedJUN 20 20262 min read

Notes from the studio.

Why an independent product studio writes in public, what to expect here, and what we will not turn this corner of the site into.

studio
writing

Read post

MAY 21 2026

Google Made Flash 4x Faster and Changed Our Latency Budget

A feature we shelved in September because 900ms TTFT felt dead came back off the shelf eight months later when Gemini 3.5 Flash hit 210ms in production.

ai
building
devtools

1 min

MAY 12 2026

The Day SLSA Provenance Lied

A 6-minute window on May 11 broke a signal the supply-chain world had treated as clean: valid SLSA attestation on 84 malicious npm packages.

security
open-source
postmortem

1 min

MAY 08 2026

We Rebuilt Our RAG Pipeline Three Times. The Third One Used Postgres.

Two failed approaches, one production outage during a customer call, and the realization that the synchronization problem disappears when you stop adding databases.

building
ai
infra

1 min

MAY 05 2026

We Ran Four AI Agents at Once for a Week

Cursor 3 shipped the Agents Window and we immediately learned the hard way what parallel agents actually need: exclusion lists, worktrees, and honest accounting of what gets traded away.

ai
devtools
postmortem

1 min

MAY 02 2026

Pin Your AI Models Like You Pin Your Dependencies

Vendors silently roll model versions and your production output drifts. Lock the version, log the cost, ship a fallback. The playbook in TypeScript.

ai
typescript
devtools

1 min

MAY 01 2026

AWS Lambda Is Dead. The $0.20 Was Never the Price.

We migrated 47 functions off Lambda and our bill dropped 79%. Here is the math, the August 2025 INIT change nobody talked about, and why we are not coming back.

infra
economics
devtools

1 min

APR 29 2026

Giving an AI Agent Permission to Spawn Sub-Agents (Without Losing Control)

Scoped delegation with cascading revocation, depth limits, and per-agent audit trails in TypeScript. Concrete code, not just theory.

ai
typescript
security

1 min

APR 23 2026

Claude Code Felt Off for a Month. Here Is What Broke.

Three overlapping bugs caused four weeks of subtle Claude Code regressions that no standard test suite would have caught.

ai
postmortem
devtools

1 min

APR 18 2026

An AI Tool Had OAuth to Their Whole Google Workspace. Then Vercel Got Breached.

A Vercel employee clicked Allow All on an AI app's OAuth consent screen. Three weeks later, customer environment variables were on a hacker's drive with a two-million-dollar asking price.

security
devtools
ai

1 min

APR 10 2026

Why Most of Our Dead Projects Died of Overthinking

For every product we ship, we kill two. The pattern in the ones that never made it out is almost always the same: we thought too hard before building.

building
devtools

1 min

APR 08 2026

We Rewrote Our Auth Library to Run on Cloudflare Workers. Here Is What Broke.

What it actually takes to port a Node-based auth library to Web Crypto, D1, and the Workers runtime, with concrete before-and-after code.

infra
typescript
open-source

1 min