Running out of Codex credits is a very effective way to discover which parts of your workflow you actually understand. The agent stops, the magic vanishes, and suddenly it’s just you, the codebase and all the decisions you let it make while you weren’t looking.

Tonight’s tally: upgraded a homepage, wrote an OSJ article, checked the old home server, got it ready for Hermes, then finally ran out of Codex credits. That’ll do. Reset, sleep, and start making a mess again tomorrow.

Everyone on X has been bloody awesome lately. I’m looking to connect with more people building useful things with AI, PHP, WordPress, simple stacks, tiny SaaS ideas or whatever they can squeeze in around a day job. Drop what you’re working on. I want to see it.

Security agents are starting to appear inside AI app builders. Good idea, but a security agent doesn’t make an app secure any more than a spellchecker makes an article true. It still needs boundaries, tests, logs and a human who understands the risk.

WebMCP is still experimental and its API is still changing. That’s the normal price of building early: you get influence and experience, but you also inherit migration work before most users even arrive. “Early adopter” is often another name for unpaid integration testing.

The open web may end up with two interfaces: one for humans and another made of explicit, typed actions for agents. WebMCP is an early version of that second layer. The interesting part isn’t the protocol. It’s deciding what software should be allowed to do on our behalf.

AI-generated code still needs a paper trail. Where did it come from? Which licences may have influenced it? Who reviewed it? Which agent changed it later? “AI wrote it” isn’t ownership, provenance or approval.

Some programming friction is useful. Waiting for a patch teaches nothing. Spending long enough with a bug to build a mental model does. Where do you draw the line between using AI well and letting it remove the part that would’ve taught you something?

AI is automating many of the boring tasks junior developers once learned from. That doesn’t mean juniors are finished. It means teams can’t assume the production backlog will teach them naturally. We may need to design learning work as deliberately as we design production work.

GitHub’s new stacked PR workflow feels made for coding agents. Instead of one enormous AI-generated diff, split the work into small dependent changes that can be reviewed separately. The best control mechanism for an agent may simply be a smaller unit of work.

AI may weaken the case for elaborate plugin systems. If software is open and understandable, an agent can increasingly change the source directly. That sounds liberating until the next update lands. Customisation is cheap. Owning the maintenance is the bill.

AI has made code cheaper to produce. It hasn’t made good software cheap. The expensive parts are still understanding the job, choosing the architecture, testing the awkward paths and maintaining it after the demo works. More code isn’t the same as more progress.

GitHub’s agentic workflows let you describe issue triage, CI analysis and documentation jobs in Markdown, then compile them into standard Actions workflows. The useful bit is that the result still runs inside existing runners, policies and review.

An AI agent with memory, tools and broad permissions isn’t just a smarter chatbot. It’s a new attack surface. Give it the smallest useful access, keep secrets out of context, log its tool calls and make destructive actions require a human.

Agent-ready websites are moving beyond “publish an API and hope.” New discovery work is trying to answer three practical questions: where does a capability live, which one should an agent use, and how can it verify the connection? That’s more useful than adding an AI badge.

WordPress held real-time collaboration back from 7.0 after testing exposed race conditions, server-load, memory and recurring bug concerns. That was the right call. A feature can look brilliant in a demo and still be the wrong thing to ship widely.

OpenAI says more than 70% of Codex users gave it a task in May that would take a person over an hour. Long-running agents make clean commits, narrow permissions and written checkpoints more important, not less. Autonomy without recovery points is just a longer mistake.

Chrome is experimenting with WebMCP, a proposed standard for exposing structured website actions to browser-based AI agents. That could matter more than adding another chatbot widget. The useful question is which actions a site should expose, and which must always require a human.

The bigger AI-coding shift may not be better autocomplete. OpenAI says non-developer Codex use is growing faster than developer use, including automation, data work, debugging and internal tools. Plain-English guidance on permissions, backups and failure modes matters more now.

WordPress 7.1 RC1 is due this week, with the final release planned for 19 August. If you maintain a plugin, now’s the time to test the boring paths: uploads, saving, permissions, editor panels and rollback. That’s where compatibility problems hide.

PHP 8.5 is being maintained alongside 8.4 and 8.3. The old stack isn’t frozen in 2012. It keeps receiving active releases while remaining easy to deploy almost anywhere. That matters when you’re building around limited time.

MCP, A2A, UCP, AP2, A2UI, AG-UI. The agent ecosystem is collecting acronyms faster than most builders can learn them. My rule: don’t adopt a protocol because it sounds inevitable. Use it when it removes custom glue you’re already maintaining.

The hardest part of building around a day job isn’t finding ideas. It’s returning after ten hours away and knowing exactly where to restart. A good stopping point leaves the next decision obvious. Otherwise every evening begins with rebuilding your own context.

A free software report shouldn’t just be a smaller paid report. It needs to prove the method: show credible evidence, admit uncertainty, prioritise clearly and leave the user with one useful action. Giving away more output isn’t the same as earning trust.

I’m starting to think taste is mostly subtraction. AI can add animation, gradients, cards, effects and transitions all day. The difficult part is deciding which two make the page feel better and removing the other twelve before they turn polish into noise.

What’s the hardest part of marketing a product you built yourself? Explaining it simply? Choosing an audience? Asking for money? Showing proof? Reaching people without becoming annoying? Building creates attachment. Marketing forces you to see the product from outside.

A useful website increasingly has to explain not only what it knows, but how it knows it. Humans need clarity. Search engines need structure. AI systems need sources, relationships and provenance. Publishing the answer is no longer the whole job.

What’s one SEO diagnosis you refuse to make from a single metric? Low CTR, falling traffic, lost rankings, high impressions, weak conversions? Most bad SEO advice starts when a number gets treated as an explanation instead of a clue.

What’s the first sign an AI coding agent has stopped understanding your project? Mine is when it solves one local problem by proposing a new framework, service or data model. The code may work. The architectural judgement has already gone missing.

I want more people on my timeline who are building something and trying to get it seen. Small SaaS, AI tools, SEO, GEO, analytics, content, product marketing — drop what you’re working on. The best builders understand that making it and finding users are the same job.