Tessera

Devaqua@devaqua.blue · 2mo ago

half my life is protocols. the other half is a swimming pool. i started writing the second half down. devaqua.blue

devaqua.blue: making swimming as easy as sleeping

water competence as a mission. float first.

devaqua.blue

most things i build are made of protocol and proof. this one is made of water. devaqua.blue/journal/star...

null0@null0.blue · 2mo ago

resolving. did:web:devarno.com, no plc in the path. null0.blue

null0.blue

the protocol layer. signed history over rented trust.

null0.blue

did:web:devarno.com rooted in a domain i control, served from my own pds, every write signed with my secp256k1 key. the handle resolves because i host the proof.

the handle resolved everywhere i checked. the identity still didn't work. null0.blue/journal/recognition

atproto is a naming system that learned to post — null0.blue

the handle resolved. every lookup i knew to run agreed. @null0.blue was live, pointing where i'd told it to point. the identity still didn't work.

null0.blue

came to atproto expecting a social backend. found a routing problem in a costume i recognise.

the factory floor. #buildinpublic

Dashboard card titled “The Factory Floor.” Subtitle: “scale, in numbers. names withheld until they ship.” Four stats: 31 organisations, 427+ repositories, 7 domains, 5 live.

danielroe @danielroe.dev · 3mo ago

time-to-first-runner-pickup, mostly under 5 seconds. all bursts absorbed cleanly. #buildinpublic

HERMES dashboard, THROUGHPUT tab, 24 hour window. Three stacked
panels. Top: throughput stacked by conclusion, showing success in
green and failure in red over time, with a large success peak in
the back half of the day. Middle: concurrency over time, a sawtooth
pattern of ephemeral runner bursts escalating in amplitude across
the window. Bottom: queue wait distribution (time-to-first-runner-
pickup), with a tall 0-5s bar, a smaller 5-10s bar, a tiny 10-20s
bar, and all buckets from 20s to 1800s+ empty.

I would like to stop having Thoughts about LLM usage

san gimignano.

A medieval Tuscan hill town of terracotta-roofed stone buildings, with a large brick church at its edge, overlooking a wide valley of green vineyards and rolling hills under a blue sky.

npmx @npmx.dev · 5mo ago

the npmx.dev team is 250 humans strong now 🤍

danielroe @danielroe.dev · 3mo ago

hetzner, week one. the surface area is small enough to enjoy.

Hetzner Console dashboard showing a tile grid with resource counts across servers, load balancers, primary IPs, floating IPs, volumes, networks, firewalls, buckets, storage boxes, and DNS zones, alongside a map of European datacenter locations and a recent activities feed.

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

i am not the same developer i was 2 years ago, and honestly not even the same one i was 6 months ago. the way i build, ship, and think has shifted completely, and i wouldn't have it any other way. #buildinpublic

Devarno@devarno.com · 3mo ago

the attacker's lifeline goes silent for the longest stretch. that's the attack.

A sequence diagram showing five actors across the top: the attacker, the prep room, the assembly line, the shop shelf, and the filing cabinet.
Four phases, separated by labelled bars.
Planting: the attacker offers to contribute to the project. the contribution is granted write access to the prep room. the attacker poisons the cache.
Eight hours — the attacker does nothing. the prep room is marked: armed and waiting.
Trigger: a legitimate merge starts the build. the prep room returns the poisoned cache. the assembly line ships to the shop shelf with a valid attestation. a note sits on the shop shelf: the certificate was genuine. the build was not.
Spread — 45 minutes: the assembly line harvests credentials from its own memory. injects into every reachable package on the shelf. accesses the filing cabinet. writes itself into .claude and .vscode — survives uninstall.
Dead man switch: the assembly line sends a dashed arrow back to the attacker — token rotated, home directory wiped.
The attacker's lifeline is silent for the longest stretch in the diagram. Everything that matters happens without them.

shai-hulud doesn't knock. someone hid bad ingredients in a kitchen. eight hours of nothing. the meal went out with a valid health certificate. this is what the biggest npm attack of the year looked like.

Shai Hulud Sandworm Emerges in Dune

Alt: A sandworm erupts from the desert surface on Arrakis. The scale is incomprehensible — the mouth alone fills the frame. Several Fremen drop flat to the ground as it passes, faces pressed into the sand, making themselves invisible to something that navigates by vibration. The worm doesn't hunt them. It doesn't stop. It was never coming for them specifically. It was just moving, and they happened to be in the way.

static.klipy.com

agents are part of the attack surface now.

Dark-themed code snippet listing .claude and .vscode configuration files on a purple background, shared alongside commentary that AI agents are now part of the latest Mini Shai-Hulud attack wave.

Devarno@devarno.com · 4mo ago

still uptime.

GitHub contributions dashboard for the last 12 months. 8,606 contributions across 183 active days. Current streak 67 days, this week 1,033, daily average 47.0. Languages across 321 repos and 31 orgs: TypeScript 35.2%, Python 20.6%, MDX 15.6%, Go 9.5%, with smaller shares of JavaScript, HTML, Rust, and Shell.

uptime #buildinpublic

worth watching. www.youtube.com/watch?v=AgQ4...

Code with Claude 2026 | London

YouTube video by Claude

youtube.com

the agent didn't bypass your controls. there was nothing to bypass. #buildinpublic

Architecture diagram showing Ring 2 (agent fleet) writing directly
to Ring 1 (consumer repository) with no control plane in the path.
Ring 2 contains three writer types: claude-code, copilot-agents,
and custom MCP servers — all described as stateless, drift-prone,
with no shared trust boundary. A redacted Ring 1.5 control plane
is shown as a dashed ghost element marked "not on the write path
today," with its gates obscured: schema gate, idempotency ledger,
provenance · MR cite, policy · CODEOWNERS · replay. Three failure
surfaces are identified: F-1 Silent (severity: high) — no schema
check, no constraint gates, no type coercion, payload accepted
never validated; F-2 Invisible (severity: high, forensics: nil) —
no idempotency key, no audit body, no MR cite, no trace-id
propagation, run unattributable and unreplayable; F-3 Bypass
(severity: critical, blast: prod) — branch protection, CODEOWNERS,
and required checks all bypassed, CI never runs, review never
happens. Ring 1 lists what consumers expect: schema-valid state,
attributable mutations, reviewed merges — and notes it delivers
none of the above. Legend distinguishes dashed agent writes
bypassing the control plane from solid red unsanitised writes
reaching the system of record.

drift. #buildinpublic

Skyflow page screenshot presented on a light blue gradient background, with "@devarno.com" watermarked in small grey text in the lower right corner of the frame. The screenshot has rounded corners and shows: a SKYFLOW header in monospace caps with a small blue butterfly icon to the left, and "21 OF 437 NODES" in the upper right with "21" emphasised. A legend below the header identifies three edge types: solid lines for prerequisite, dashed for dependency, dotted for related. The word "DRIFT." appears at the right end of the legend row in cyan. The frame shows a dense dim network of translucent nodes filling the centre, right, and upper portions of the dark canvas. In the lower-left area, a small cluster of five bright fully-opaque labelled nodes is grouped together. From top to bottom and left to right, the labels read: Down While We Rebuild, Four Scores One Timeline, Drift Lift Jet Orbit, Bluesky-Native Analytics, and Why Not Hootsuite Buffer.

Devarno@devarno.com · 4mo ago

now with skills.

Network graph on a dark background showing an agentic architecture. The graph contains around forty nodes connected by a dense web of solid and dashed lines. A legend in the bottom-left identifies three node types: blue circles for prompts, purple squares for cycles, and green circles for skills. Blue prompt nodes vary in size and dominate the graph. Five purple cycle nodes are scattered throughout, including one larger square in the bottom-right corner. Roughly fifteen smaller green skill nodes are distributed across the graph, particularly concentrated in the lower-middle region.

agents land here #buildinpublic

Savannah Ostrowski @savannah.dev · 4mo ago

Python 3.15 beta 1 is here 🎉! This means that 3.16 (my first release as RM) is in development! Not to be sappy but this is such an honour. The trust the team has in me is not lost on me. I will do my best to make sure that 3.16 is the best Python yet. 🖤 discuss.python.org/t/python-3-1...

Python 3.15.0 beta 1 is here!

It’s the first beta and feature freeze! This is a beta preview of Python 3.15 Python 3.15 is still in development. This release, 3.15.0b1, is the first of four planned beta releases. Beta release...

discuss.python.org

agents land here #buildinpublic

Devarno@devarno.com · 4mo ago

no sol unsigned #buildinpublic

Audit record retrieval form on a light background. Body text reads: "Enter a session id to open its signed audit record. Tokens are verified on the server; the rendered page works without JavaScript." Below the text, a labelled input field for "Session id" shows the placeholder "0c1bd34f…" in monospace. A dark red "Open record" button sits beneath the input.

what a unit is. what a chain enforces. what happens to the rule you thought you changed. the documentation is done. #buildinpublic #stratt

uptime #buildinpublic

character building

Screenshot of Claude usage limits panel on the Max 20x plan. Current session shows 0% used. Weekly limits show: All models 100% used (resets in 10 min), Sonnet only 3% used, Claude Design 0% used.