Omarchy Review: Seven Weeks, Three Machines, One Verdict
Seven weeks after my first install, I'm keeping Omarchy. What worked on an RTX 3070 desktop, what broke, and what 4.5 RC changes.
Notes on production AI, security leadership, and the craft of software.
Long-form essays for founders, engineering leaders, and senior ICs building at AI-native startups. Real numbers from real engagements, opinionated on what actually works. Browse all 21 topics → Earlier writing from the original Sublime Coding blog lives in the archive.
Topic guides
Curated reading orders by subject. Start here if you want the argument for a topic compressed into 5–6 essays rather than browsed across the full index.
-
AI engineering
What production AI engineering actually looks like in 2026: the autonomy ladder for agents, the workflow shift, telemetry, and team sizing.
-
Security for startups
A guided reading order for startup security: what to read first on SOC 2 as a revenue tool, vCISO hiring, and securing AI-native products.
-
Engineering leadership
Engineering leadership at startup scale: hiring from one engineer to fifteen, rituals that work at small teams, the staff-engineer interview loop.
-
Elixir and the BEAM for AI systems
Why language choice matters for AI systems: BEAM concurrency for agents, what Go frameworks cost you, and why Elixir is the language AI writes best.
-
Omarchy
Running Omarchy with coding agents, starting on an M1 MacBook: the install, what breaks, the keyboard, and what a security lead inherits from agents.
The Decade-Old Bug Is Now a One-Week Find
AI vulnerability discovery is turning years-old bugs in PHP and Linux into week-long finds. What old code you expose, who owns it, and a checklist.
Before You Add an AI Reviewer, Add These Checks
Anthropic's AI code review works because flags and fast rollback sit under it. A small team should first add checks an agent can't talk into a pass.
php2shell: What to Do if Your Servers Run PHP
Two critical PHP flaws, php2shell, got fixed on Oct 21. A triage order for anyone with PHP on a server: inventory, patch and restart, mitigate, isolate.
eMudhra Distrust: Why Bumping castore Won't Save Req
Eight eMudhra CA keys were guessable. Browsers blocked them in hours. Req reads CAs from the OS first, so bumping castore usually does nothing. Here's the fix.
What a Fractional Chief AI Officer Does for Dev Teams
A fractional Chief AI Officer for a 5-20 engineer team owns the daily agent workflow, not a governance board. The four jobs and the first 30 days, week by week.
Anthropic Moved Its Monorepo to Scion. You Shouldn't.
Anthropic built Scion and moved its monorepo off git in five months. Here is why a small team shouldn't copy it, and where to spend the attention instead.
Claude Code and SOC 2: The Evidence Your Auditor Wants
Engineers run Claude Code and the auditor wants proof. The managed settings that work as controls, the SOC 2 criteria they support, and the evidence to give.
Scheduled Posts in Phoenix With No Database
This site has no database. Here's how a future-dated post stays invisible until its timestamp, and the three places the gate gave the wrong answer anyway.
Who Buys Anything When Robots Do the Work?
If robots do the work and nobody earns, who buys? I think the economy dies slowly and the company store fills the gap. That's where I think it goes.
Why I Doubt UBI Is Coming
Tax all US output at 100% and it comes to about $95,000 a person a year. Why I doubt UBI arrives, and think robots become the measure of wealth.
We Gated the Code and Left the Prose Wide Open
Teams built real review gates around agent-written code. The PR descriptions, design docs, and incident summaries the same agent writes pass through nothing.
All 138 posts
- October 23, 2026 Omarchy Review: Seven Weeks, Three Machines, One Verdict
- October 23, 2026 The Decade-Old Bug Is Now a One-Week Find
- October 22, 2026 Before You Add an AI Reviewer, Add These Checks
- October 21, 2026 php2shell: What to Do if Your Servers Run PHP
- October 21, 2026 eMudhra Distrust: Why Bumping castore Won't Save Req
- October 20, 2026 What a Fractional Chief AI Officer Does for Dev Teams
- October 15, 2026 Anthropic Moved Its Monorepo to Scion. You Shouldn't.
- October 15, 2026 Claude Code and SOC 2: The Evidence Your Auditor Wants
- October 13, 2026 Scheduled Posts in Phoenix With No Database
- October 11, 2026 Who Buys Anything When Robots Do the Work?
- October 11, 2026 Why I Doubt UBI Is Coming
- October 10, 2026 We Gated the Code and Left the Prose Wide Open
- October 8, 2026 Consistency Is Overrated. Persistence Isn't.
- October 6, 2026 DHH's Rust Benchmark Measured the Agent, Not Elixir
- October 6, 2026 Where AI Belongs in a One-Person Content Operation
- October 4, 2026 Linux Setup Was a Hazing Ritual. Agents Changed It.
- October 2, 2026 Narrow Front Door, Visible Back Rooms
- October 1, 2026 Adding a Newsletter to a Phoenix Site With No Database
- September 30, 2026 Your Personal Brand Is an Attack Surface
- September 29, 2026 I Built the Distribution Tools My Blog Needed
- September 29, 2026 Elixir Libraries Discord and Supabase Open-Sourced
- September 27, 2026 Would I Trust Agents to QA My Daily Driver?
- September 24, 2026 Who Actually Runs Elixir in Production, Fact-Checked
- September 24, 2026 DHH's Rails World 2026 Keynote: Pencils Down, Now What
- September 23, 2026 Omarchy on a Company Laptop: The SOC 2 Verdict
- September 21, 2026 I Graded My Blog Against a 2014 Marketing Course
- September 18, 2026 Omarchy Shortcuts on a Mac Keyboard: What Changes
- September 16, 2026 Omarchy Runs Your Coding Agent With the Safety Off
- September 15, 2026 How to Actually Make Money With AI in 2026: An Engineer Ranks 13 Side Hustles
- September 14, 2026 Cisco's Network Config Engine Is Secretly Erlang
- September 13, 2026 Model Routers Are Vendors. Review Them Like One.
- September 12, 2026 Multi-Agent AI Teams Agree Their Way Into Garbage
- September 11, 2026 I Read Omarchy's AGENTS.md So You Don't Have To
- September 10, 2026 Anthropic's Extreme Scenario Has a Precondition
- September 10, 2026 Validating LLM Tool Call Arguments With Ecto
- September 8, 2026 Agents Don't Need Prompts. They Need Managers.
- September 7, 2026 I Put Omarchy on an M1 MacBook Pro
- September 3, 2026 I Read Oban's Source Code So You Don't Have To
- September 1, 2026 Building an LLM Audit Trail That Passes SOC 2
- August 31, 2026 Throttling LLM Calls in Elixir Before You Hit 429
- August 27, 2026 Agents Are Already Writing a Language You Can't Read
- August 25, 2026 The Agent Evidence Pack for a Security Review
- August 20, 2026 Wiring LiveView Uploads to Claude Vision
- August 18, 2026 Most Security Controls Assume a Team You Don't Have
- August 17, 2026 Structured LLM Output in Elixir: Which Library, When
- August 15, 2026 What Elixir Gives a Coding Harness for Free
- August 13, 2026 Metering LLM Usage Per Customer in Phoenix
- August 12, 2026 Your Junior Dev Leans on the Agent. Good.
- August 11, 2026 The Hard Part Was Never the Code. It Was the Theory.
- August 10, 2026 Phoenix Secrets: runtime.exs, Fly.io, and LLM Keys
- August 9, 2026 The Office Mandate Is a Measurement Failure
- August 8, 2026 Every Insane Codebase Was Once Rational
- August 7, 2026 Nobody Got Replaced. Agents Got Added.
- August 7, 2026 What I Check When I Inherit a Vibe-Coded App
- August 6, 2026 Multi-Tenant AI SaaS in Phoenix: Isolation That Holds
- August 5, 2026 Schlep Blindness Is the Only Moat Agents Can’t Cross
- August 4, 2026 What Four Months of Embedded AI Engineering Ships
- August 3, 2026 Estimating Client Work When Agents Do the Building
- August 2, 2026 The Career I Built on Work Nobody Wanted
- August 1, 2026 Your Coding Agent Has No Reason to Write Good Code
- July 31, 2026 AIOS v2: The Scope Is the Filesystem
- July 30, 2026 Jose Valim Is Right: Anthropic's Incentive Problem
- July 30, 2026 Instrumenting LLM Calls in Phoenix with Telemetry
- July 29, 2026 Detection Got Cheap. Remediation Didn't.
- July 29, 2026 The One File Where Your AI Model Names Live
- July 28, 2026 What a 96% Security Benchmark Actually Measures
- July 28, 2026 10 Ecto Query Patterns for N+1 and Beyond
- July 27, 2026 Isolating Parallel Claude Code Agents in Phoenix
- July 26, 2026 What Reverse Acqui-Hires Actually Diligence
- July 25, 2026 The Four Claude Code Hooks I Run on Every Project
- July 24, 2026 Performance Reviews When Agents Do the Typing
- July 23, 2026 What Together AI's $800M Round Says About Elixir
- July 23, 2026 Why We'd Pick Elixir for an AI Startup Backend
- July 22, 2026 Shadow AI at a Startup That Can't Buy a CASB
- July 21, 2026 12 Phoenix LiveView Patterns for Production
- July 20, 2026 Testing AI Agent Outputs in Elixir with ExUnit
- July 19, 2026 The Onboarding Playbook for an Agent-Heavy Codebase
- July 18, 2026 TDD With Claude Code in Elixir: What Holds Up
- July 17, 2026 Security Engineer or vCISO? Your First Hire, by Stage
- July 16, 2026 What I Put in CLAUDE.md After 50 Commits With It
- July 15, 2026 Secrets Management for AI Agents on Small Teams
- July 14, 2026 Streaming LLM Tokens in LiveView, the 2026 Way
- July 13, 2026 Trust Is the Operating System
- July 12, 2026 The 17x Discount Hiding in Your AI Coding Bill
- July 11, 2026 A Scared Team Is Your Biggest Attack Surface
- July 10, 2026 What Cyber Insurance Underwriters Ask AI Startups
- July 9, 2026 Build an MCP Server in Phoenix With Hermes
- July 9, 2026 AIOS: An AI Operating System in Plain Markdown
- July 8, 2026 What an AI Agent Postmortem Should Contain
- July 7, 2026 Why Auto-Filled Security Questionnaires Kill AI Deals
- July 6, 2026 Building an AI Memory That Outlives Any Single Agent
- July 6, 2026 The Claude Code Plugin Stack I Actually Run
- July 6, 2026 4,154 Commits in Six Months With AI Agents
- July 4, 2026 Programming Sucks, Now With Agents
- July 3, 2026 Prompt Injection Defense for a 5-Person AI Startup
- July 2, 2026 Oban as a Durable AI Agent Runtime in Elixir
- June 30, 2026 Surviving Technical Due Diligence as an AI Founder
- June 30, 2026 Amazon Let the AI Drive. It Hit a Tree.
- June 29, 2026 Build an LLM Wiki Your Coding Agent Actually Reads
- June 29, 2026 Your CLAUDE.md Is the Onboarding Doc You Never Wrote
- June 26, 2026 AI Made Tokens Cheap. It's Making Hardware Costly.
- June 26, 2026 The Perfect Hire Is Killing Your Team
- June 25, 2026 The AI Coding Agent Bugs I Catch Every Week
- June 23, 2026 15 Elixir Libraries I Reach For in 2026
- June 21, 2026 Build an AI Agent Loop in 50 Lines of Elixir
- June 18, 2026 RAG in Phoenix: Hand-Rolled pgvector or Arcana?
- June 17, 2026 We're About to Stop Making Senior Engineers
- June 15, 2026 Nadella Is Right About AI and the Firm. Mostly.
- June 7, 2026 A Professional Owns the Whole Outcome
- June 3, 2026 Prove the Return or Don't Spend the Time
- May 31, 2026 Elixir's BEAM Is the Runtime AI Agents Want
- May 27, 2026 Elixir Is the Language AI Codes Best
- May 26, 2026 Prompt Skills, Not Claude: Four Rules from Anthropic's Engineers
- May 16, 2026 Elixir's Concurrency Model Is the One You Actually Want
- May 16, 2026 Why Every AI Agent Framework Is Written in Go (And What That Costs You)
- May 16, 2026 Ruby Isn't Dead, It Got Boring — And Boring Is Why It Ships
- May 9, 2026 How I Prompt Claude as a Staff Engineer (50 Prompts I Actually Use)
- May 7, 2026 Ruflo (formerly Claude Flow): An Honest Deep Dive on the Multi-Agent Orchestration Platform
- May 7, 2026 The Claude Code Resource Bible: 46 Tools Worth Knowing in 2026
- May 3, 2026 What 90 Days of a Fractional Security Engagement Actually Looks Like
- May 2, 2026 An AI Just Deleted a Production Database in Nine Seconds. Hire More Engineers.
- May 1, 2026 AI Won't Shrink Your Team — It'll Expose Why You Needed a Bigger One
- April 27, 2026 SOC 2 Is a Revenue Tool, Not a Security Tool
- April 20, 2026 How I'd Run Security at an AI-Native Company in 2026
- April 13, 2026 How We Cut $350K From Cloud Spend in 6 Months (And What I'd Do Differently)
- April 6, 2026 vCISO Math for AI Founders: Why 5 Hours a Month Beats a Full-Time Hire
- March 30, 2026 Migrating 225K Users from AWS Cognito to Auth0 Without Forcing a Single Logout
- March 16, 2026 AI-Assisted Engineering Isn't Faster Coding. It's a New Workflow.
- February 23, 2026 How I'd Hire a Staff Engineer at an AI Startup
- February 9, 2026 The Ruby to Elixir Migration That Cut Our Service Footprint From Ten to Six
- January 26, 2026 Your AI Product Needs a Telemetry Layer Before It Needs a Better Model
- January 12, 2026 From One Engineer to Fifteen: What Co-Founding Taught Me About Engineering Leadership
- December 29, 2025 The Pre-Series-A AI Startup Hiring Plan: Who to Hire, in What Order, and Why Most Get It Wrong
- December 22, 2025 When to Trust an Agent and When to Step In
- December 8, 2025 How I Triage a New Codebase in 90 Minutes
- November 24, 2025 My Daily Agentic AI Workflow
- November 10, 2025 The 'Smallest Possible Slice' Heuristic for Shipping Complex Features
- October 27, 2025 How to Manage a 4-Person Engineering Team Without Becoming a Manager