Notes from the loop.

The 11 workflows I use across projects with Codex and Claude Code: evidence-based debugging, adversarial review, gauntlet loops, research, Git hooks, and AEO.

A 12-minute looping day over Tenochtitlan, from dawn to the New Fire of 1507, flown live in three.js: the dossiers, the Nahuatl captions and the inside-out serpent.

A 1554 Tupinambá canoe raid rebuilt in real-time 3D in the browser with Claude Opus 5.5, three.js and Blender: the pipeline, what broke, what it cost.

Prompt engineering, vibe coding, agentic engineering, product engineering, and research engineering sound like names for the same thing. They are not. The difference is what you control, what feedback you trust, and who decides the work is done.

The system I use to turn an idea into verifiable frontend: specs, skills, model selection, Ralph Starter, worktrees, browsers, screenshots, tests, GitHub, and telemetry. The model writes code. The harness decides what to trust.

The techniques inside the adversarial agent loop that builds CS Brasil: a 25-criterion visual rubric written so a language model can grade a PNG, critic prompts that ban vague answers by name, a generated symbol-level conflict table for a 6,543-line file, and a regression hunter with permission to find nothing.

My site has an AGENTS.md, an MCP server, a hiring API, and a terminal resume. Your agent can read my CV, check my availability, and book an intro. Here is how it works.

The machine that builds CS Brasil is no longer a folder of markdown. It is a measurement engine: the real game booted in pure Node, 61 invariants with mutation tests, generated docs that fail CI on drift, and four laws learned the expensive way.

I run a swarm of coding agents — Codex, Claude, Amp, Kimi — plus humans, coordinated entirely through markdown files. No database, no dashboard-as-source-of-truth, chat history explicitly banned. Here is the shared brain: control room, task queue, candidate cemetery, and fail-closed automation.

The making-of of this site: AI-generated 3D models that kept coming out as busts, a shader pipeline that morphs me into wireframe and ASCII, a visual gauntlet that grades every pixel, and what I learned about art-directing machines.

AEO is the plumbing that lets ChatGPT, Perplexity and friends read and cite your business. I built a free scanner that has run 4,569 scans across 2,259 unique sites; the same 3 failures show up everywhere.

CS Brasil is a satirical browser FPS — 5 factions, 44 characters, 26 weapons, 5 maps, zero-build Three.js — built almost entirely by AI agents running a named adversarial loop: the Gauntlet. Critics grade, builders edit the same 6,543-line file in parallel, and the loop never ends itself.

I was the second most active committer on the open-source chat package of a production agent platform, the streaming front of an AI runtime that turned OpenAPI specs into tools and drove on-chain agents across NEAR and EVM. Real code from BitteProtocol/chat: the useChat loop, tool-call states, the OpenAPI operationId contract, and how history gets rebuilt.

I ran hand-rolled agent loops in production on a web3 agent platform (2.85M+ messages) and in ralph-starter. I spent a week rebuilding the same loop in Mastra to see what a framework buys. Head-to-head notes: what Mastra makes easy, what my runtime does that it can't, and who should pick which.

I led AI engineering on the multi-agent research harness that took #1 on ECDSA.fail. The routing layer is the part worth stealing: role to model tables, fail-closed adapters, and a spend gate that aborts the run before the bill does.

I built a research pipeline where frontier models from different providers generate, adversarially review, and merge each other's work. The only thing shared between them is the previous phase's text. It turns out peer review compiles into prompt choreography surprisingly well.

Autoresearcher runs benchmark-driven research loops: one agent step, one benchmark command, one number, keep or reject. The part that makes it work isn't the agent. It's that the loop is deliberately simple, fail-closed, and leaves a full audit trail in git and JSONL.

What an eval actually is, learned the expensive way: a browser FPS gated by 61 invariants that must each ship with a failing mutation, and a quantum decoder benchmark won with one scalar and a five-step loop. The model changes every few months. The ruler survives.

ralph-starter runs coding agents in Ralph Wiggum loops, and swarm mode coordinates them with git worktrees, Promise.allSettled, and a strategy switch. Three strategies with real tradeoffs, and why a DAG executor would reject this design at startup.

How I built an autonomous multi-agent research harness — 9 specialist LLM roles across 7+ providers, fail-closed adapters, lane-isolated dispatch, and a falsifier queue — that produced the top-ranked quantum circuit on ECDSA.fail.

A production AI-agent runtime I helped build served 2.85M messages across 344K chats with streaming agent loops and OpenAPI to tool conversion. The context was the spec: system prompts lived in x-mb, tools were operationIds, and wallet state rode every request. Real code from BitteProtocol/chat, make-agent, and agent-sdk.

Mirofi.sh is a hosted multi-agent social-simulation platform built on an open-source engine, GraphRAG, and Zep. This is the retrieval story: what agent memory stores, how it feeds each turn, and where the graph earned its complexity.

The May 2026 Mini Shai-Hulud wave didn't just steal an npm token — it abused the build and publishing pipeline itself: pull_request_target, cache poisoning, OIDC trusted publishing, and install scripts. What actually happened, and what I'd audit first.

I topped the QEC Decoder Optimization Arena leaderboard at 2,642 errors per million — not with physics credentials, but with a tight experimental loop: held-out validation, statistical gating, and a swarm of agents in isolated git worktrees.

ralph-starter runs Ralph Wiggum loops — fetch a spec, run the AI agent, check tests/lint/build, feed errors back, repeat. Here's how it works and why I built it.

Before touching Content-Types or routes, talk about security. This is the security playbook for a Strapi + Next.js stack — XSS, CSRF, clickjacking, JWT, SSL, monitoring.

The case for pairing Next.js with the Strapi headless CMS for a modern decoupled frontend / CMS stack. Headless concepts, alternatives, boilerplates.