Writing
Writing
Field notes on shipping AI products that survive contact with real users — and real attackers.
Showing all 27 field notes.
-
A Chatbot Is Not the Surface: Testing the Path From Prompt to Consequence
Testing an AI feature means following the path from a prompt through its tools, data and consequences—not just testing the chat box.
-
Before and after AI Application Security testing: one HR chatbot
A bounded synthetic example of why model output, application enforcement, and downstream effect must be tested separately.
-
JUNIE: The Customer Proxy in Our Development Workflow
Why we are putting a customer-proxy agent inside pull requests, and why passing tests is no longer enough proof.
-
/handoff and /pickup: An Ephemeral Handover Doc Instead of Yet Another Doc To Rot
We borrowed /handoff from Matt Pocock, added /pickup, and now we have a paired Claude Code skill that gives us a deliberate, throwaway context bridge across /clear — instead of the usual cargo-cult HANDOFF.md that nobody updates and nobody trusts.
-
When Your Demo Lies to You
I shipped the ICP-1 CTO demo this week. Then I read my own logs and caught it lying. Here's what I did, and the team rule that came out of it.
-
On Intent Coherence
The dominant failure mode in modern systems isn't error — it's drift. A discipline for keeping high-volume, AI-assisted systems honest.
-
Meatbags and Machines
Is it funny first and not-funny last, or the other way around?
-
I Shipped a 7MB Hero. The Cleanup, and the Fix You Should Actually Do
Astro 5 optimises images — but only the ones in src/. Files in public/ are served byte-for-byte. Here's how I patched a 7MB AI-generated hero with cwebp in thirty seconds, and the schema change that means I'll never have to do it again.
-
jq — the data plucker for @injectionator
When an n8r probe spits out a hundred kilobytes of JSON, you don't need to read it — you need to pluck the bits that matter. A small reminder about a small tool, and how your favourite LLM can drive it for you.
-
The Difference Between Claude Code /effort medium and /effort high
A side-by-side comparison of Claude Code effort settings on the same prompts. The results were qualitatively different enough to make me reconsider using /effort medium, or at least do more testing as I go.
-
A Love Letter to AI Skeptics
You can only be a credible AI skeptic if you've used it deeply. But if you've used it deeply, you probably aren't a skeptic. That's a paradox worth sitting with.
-
Claude Code Hooks — The Complete Visual Reference
Twenty-six interception points where you can observe, modify, or block what Claude Code does. Interactive lifecycle diagram, filterable reference, and real-world examples from Coherence.
-
Token Economics Cheat-Sheet: Claude Code Cost Controls Reference
Every command, setting, and mechanism for tracking and controlling AI token usage in Claude Code. The quick-reference companion to the Token Economics series.
-
Your AI Bill Is Lying to You
Most people are burning AI tokens inefficiently — and bragging about it. Token management is a core professional skill, not an afterthought. Here's why it matters now.
-
The Practitioner's Toolkit: Managing Your AI Token Consumption
You can't manage what you can't see. The practical guide to visibility and control over AI inference costs — the specific levers, commands, and patterns that turn token spend into a managed resource.
-
Scaling the Discipline: Token Economics for Teams and Architectures
Individual token discipline is necessary but insufficient. The real cost profile is determined by architectural decisions and team culture. Here's how to scale it.
-
One Product, Four LLMs: How We're Choosing Inference Models for Injectionator
How we're choosing inference models for our AI security product — and the framework we built for making multiple model decisions.
-
Agents Are Just Distributed Systems With Delusions of Grandeur
I've been building agentic AI and winging significant portions of it. So I sat down and worked through the reading list I should have done six months ago. Here's what I found — and the structured guide I compiled from it.
-
Your AI Agent Is Mr Magoo: Why Knowledge Search Changes Everything
AI coding agents are brilliant but short-sighted — they can't see what they haven't been shown. Here's how a searchable knowledge layer transforms AI-assisted development — and the results we've seen.
-
Eleven Instruments, One Command
Coherence v1.6 ships a unified /coherence command with 11 subcommands organised into four questions about your project's health.
-
Entropy at Velocity: Keeping Your Codebase Coherent When AI Writes Most of the Code
AI-assisted development generates code faster than humans can track. Here's the four-layer system that keeps it coherent — and how we help teams implement it.
-
Your AI Can't Spell Your Company Name
How we built automated guardrails that stop Claude from writing 'View Yonder' — and taught a marketing team to use them without touching a terminal.
-
Drift vs Consistency: Two Ways Your Codebase Lies to You
One checks whether your code matches your docs. The other checks whether your content matches your standards. Here's why you need both.
-
Your LLM Security Moat (Or Someone Else's)
Injectionator Labs lets you build domain-specific AI security. Because generic protection is for generic threats.
-
The M in MVP Has Changed: Riding Jevons Paradox from Minimal to Maximal Viable Product
AI coding tools don't make software smaller—they make it bigger. The marginal cost of ambition collapsed. What's left is you, deciding how hard to press.
-
Building AI-First Teams: Lessons from the Trenches
How forward-thinking organizations are restructuring their teams to maximize AI effectiveness—and the surprising challenges they face along the way.
-
Prompt Engineering: Beyond the Basics
Move past the beginner tips and discover the advanced techniques that separate effective prompt engineers from the rest.