What Four Months of Embedded AI Engineering Ships
What a sixteen-week embedded AI engineering rotation ships, month by month, from the first merge to the handoff artifacts that let it end.
Writing
Notes on production AI, security leadership, and the craft of software.
Long-form essays for founders, engineering leaders, and senior ICs building at AI-native startups. Real numbers from real engagements, opinionated on what actually works. Browse all 26 topics → Earlier writing from the original Sublime Coding blog lives in the archive.
Topic guides
Curated reading orders by subject — start here if you want the argument for a topic compressed into 5–6 essays rather than browsed across the full index.
-
AI engineering
What production AI engineering actually looks like in 2026 — the autonomy ladder for agents, the workflow shift, telemetry, and team sizing.
-
Security for startups
A guided reading order for startup security — what to read first on SOC 2 as a revenue tool, vCISO hiring, and securing AI-native products.
-
Engineering leadership
Engineering leadership at startup scale — hiring from one engineer to fifteen, rituals that work at small teams, the staff-engineer interview loop.
-
Elixir and the BEAM for AI systems
Why language choice matters for AI systems — BEAM concurrency for agents, what Go frameworks cost you, and why Elixir is the language AI writes best.
Estimating Client Work When Agents Do the Building
Agent-era velocity is bimodal: the same feature can take 20 minutes or 3 days. How I scope, bill, and talk to clients about it honestly.
The Career I Built on Work Nobody Wanted
A career built on the audits, migrations, and offshore coordination nobody volunteered for — because that work maps a company fastest.
Your Coding Agent Has No Reason to Write Good Code
Coding models are trained on a pass/fail test signal. Maintainability isn't graded, so it isn't learned — and no harness you build can fix that.
AIOS v2: The Scope Is the Filesystem
A restructure log: what broke in the AIOS v1 tree at multi-scope scale, why identity-first beats type-first, and what shipped in v2.
Jose Valim Is Right: Anthropic's Incentive Problem
José Valim says Anthropic hasn't separated its security case from its commercial interest. He's right — and it's every frontier lab's problem.
Instrumenting LLM Calls in Phoenix with Telemetry
ReqLLM already emits token cost and latency telemetry events. The real gap is a few lines wiring them into LiveDashboard and PromEx, not another SaaS bill.
Detection Got Cheap. Remediation Didn't.
Microsoft just made vulnerability detection cheaper and more accurate. For a 12-40 person AI startup, that was never the bottleneck.
The One File Where Your AI Model Names Live
Model names scattered across every repo's config rot the day a model gets deprecated or repriced. One git-versioned markdown table fixes it for good.
What a 96% Security Benchmark Actually Measures
Microsoft's security system hit 96% on a benchmark this week. Here's what that score actually measures, and how to read any vendor's benchmark claim.
10 Ecto Query Patterns for N+1 and Beyond
The Iron Law for has_many vs belongs_to, plus when Dataloader, subqueries, or raw SQL are the honest fix, not another preload tutorial.
Isolating Parallel Claude Code Agents in Phoenix
Elixir/Phoenix mechanics for parallel Claude Code agents: templating PORT per worktree, one Postgres DB per branch, and asset-watcher collisions nobody covers.
What Reverse Acqui-Hires Actually Diligence
What a buyer's technical reviewer checks in a reverse acqui-hire when the code isn't the asset: key-person risk, IP scope, and contribution forensics.
The Four Claude Code Hooks I Run on Every Project
The exact hooks in this repo settings.json: a .env guard, a draft-post warn, mix format, a JSON validator, and the real matcher and exit-code mechanics.
Performance Reviews When Agents Do the Typing
Commit count and PR volume are agent-inflated now. Here's what I actually evaluate in reviews, and the 1:1 questions that surface real judgment.
What Together AI's $800M Round Says About Elixir
Together AI raised $800M at an $8.3B valuation. Its own job postings show Elixir/Phoenix on the BEAM running auth, orgs, and access control.
Why We'd Pick Elixir for an AI Startup Backend
A founder-readable case for Elixir as an AI startup's backend — what the BEAM gets right for agents, streaming, and durable jobs, and when to skip it.
Shadow AI at a Startup That Can't Buy a CASB
The enterprise shadow-AI playbook assumes a CASB budget you don't have. Here's the free, no-blame version for a 5-15 person team: three steps, zero procurement.
12 Phoenix LiveView Patterns for Production
Twelve Phoenix LiveView patterns that hold up in production — streams vs assigns, async mounts, PubSub gating, and the failure mode behind each one.
Testing AI Agent Outputs in Elixir with ExUnit
An ExUnit suite for agent loops in Elixir: asserting on tool-call order and hallucinations, not just final strings — plus evals that survive model upgrades.
The Onboarding Playbook for an Agent-Heavy Codebase
First-PR review, authorship transparency, and mentorship all change when half the diffs a new hire reads were written by an agent. Here's the process.
TDD With Claude Code in Elixir: What Holds Up
Where TDD with Claude Code actually holds up in an Elixir/Phoenix codebase — ExUnit async, mix precommit, Ecto.Multi idempotency — and where it breaks.
Security Engineer or vCISO? Your First Hire, by Stage
A security engineer builds; a vCISO decides. Which one your startup needs first, stage by stage — and the cases where the answer isn't a vCISO at all.
What I Put in CLAUDE.md After 50 Commits With It
The CLAUDE.md entries that actually earned their place on a real project — mistake-driven rules, not a speculative template you copy once and forget.
Secrets Management for AI Agents on Small Teams
Your agent doesn't need your production keys — its tools do. The broker pattern, per-tool scoping, and what a five-person team can skip despite vendor pitches.
Streaming LLM Tokens in LiveView, the 2026 Way
Token-by-token LLM streaming in Phoenix LiveView, no React — the 2026 async APIs, plus the production failure modes most tutorials skip.
Trust Is the Operating System
One operating system runs a team whether the teammate is a person or an agent. My blueprint: trust, pods, outcomes over hours, managing agents like interns.
The 17x Discount Hiding in Your AI Coding Bill
My team's $200 AI coding seats consume $1,800–$3,500 of API-priced tokens a month. The 10–17x arbitrage nobody prices in, and how to budget for it.
A Scared Team Is Your Biggest Attack Surface
A scared employee hands over access to avoid a manager's wrath — the exact move social engineering exploits. Why psychological safety is a security control.
What Cyber Insurance Underwriters Ask AI Startups
The cyber insurance application is a security audit in disguise. What underwriters check in 2026, the AI exclusions creeping in, and when coverage is real.
Build an MCP Server in Phoenix With Hermes
An MCP server lets Claude and other agents call your Phoenix app directly. How to ship one with Hermes — auth, transport, and safe tool boundaries.
AIOS: An AI Operating System in Plain Markdown
I open-sourced the AI operating system I run daily: a git-versioned markdown vault, cross-repo wiring, and a nightly ingest loop. Fifteen minutes to set up.
What an AI Agent Postmortem Should Contain
Classic SRE postmortems can't explain agent incidents. The sections to add — decision-time context, autonomy rung, permissions delta — with a template.
Why Auto-Filled Security Questionnaires Kill AI Deals
Why auto-filling an enterprise security questionnaire backfires on an AI startup — the answers that kill deals, and the questions your SOC 2 won't cover.
Building an AI Memory That Outlives Any Single Agent
Your accumulated agent memory is a bet on one vendor's format. Build a portable, git-versioned knowledge layer any agent can read instead.
The Claude Code Plugin Stack I Actually Run
The Claude Code plugins that earn a permanent slot in my stack, sorted by what they actually change — my process, my domain expertise, or just friction.
4,154 Commits in Six Months With AI Agents
I shipped more code in 2026 than the previous four years combined. The commits are real. The productivity is real. What I lost is harder to measure.
Programming Sucks, Now With Agents
An homage to Peter Welch's Programming Sucks, updated for agents: a genius intern with amnesia, hallucinated packages, and a closet that eats your auth layer.
Prompt Injection Defense for a 5-Person AI Startup
Prompt injection defense a five-person team can ship in a week — trust boundaries, least-privilege tools, approval gates, and what not to build yet.
Oban as a Durable AI Agent Runtime in Elixir
Most AI agent frameworks reinvent a job queue badly. Oban already is one — durable, idempotent, retry-aware. Run an agent loop that survives a deploy mid-run.
Surviving Technical Due Diligence as an AI Founder
What the investor's technical reviewer opens first, the AI-specific flags that re-price rounds in 2026, and the gaps you should deliberately leave alone.
Amazon Let the AI Drive. It Hit a Tree.
Amazon mandated AI coding, let it touch infrastructure unwatched, and lost millions of orders. The fix wasn't less AI — it was more humans per deploy.
Build an LLM Wiki Your Coding Agent Actually Reads
A markdown knowledge base your AI agent reads and maintains — the three-layer architecture, the ingest/query/lint loop, and the rules that stop it rotting.
Your CLAUDE.md Is the Onboarding Doc You Never Wrote
A CLAUDE.md isn't config — it's executable tribal knowledge. The onboarding doc you never wrote for humans, finally read by something that acts on it.
AI Made Tokens Cheap. It's Making Hardware Costly.
Apple raised prices on Mac, iPad, and HomePod, blaming an AI-driven memory shortage. The cost of intelligence is falling; the hardware to run it isn't.
The Perfect Hire Is Killing Your Team
The whiteboard coding interview rewards memorization and pedigree — the weakest predictors of real performance. Hire for trajectory, not the perfect match.
The AI Coding Agent Bugs I Catch Every Week
Eight failure patterns I see running AI coding agents daily — the confident wrong answers, the lost context, and the bugs they reliably ship.
15 Elixir Libraries I Reach For in 2026
The Hex packages I install on day one of a new Elixir project in 2026 — what each earns its place doing, and the ones I dropped along the way.
Build an AI Agent Loop in 50 Lines of Elixir
Every AI agent framework runs the same loop: observe, decide, act, repeat. Here it is in 50 lines of Elixir — no framework, just a GenServer.
RAG in Phoenix: Hand-Rolled pgvector or Arcana?
You don't need a vector database — the Postgres you already run does RAG fine. The hand-rolled pgvector path in Phoenix, and when Arcana earns its place.
We're About to Stop Making Senior Engineers
The path to senior ran through the grunt work AI now does in one prompt. The knowing-vs-doing gap hits juniors first — and how to grow architects anyway.
Nadella Is Right About AI and the Firm. Mostly.
Satya Nadella's 'token capital' framing is right that AI amplifies human judgment — but it's enterprise advice that skips the small teams who feel it first.
A Professional Owns the Whole Outcome
Professionalism in software isn't process, titles, or looking the part. It's owning the whole outcome — the cost, the failure, the 3am page, the wrong call.
Prove the Return or Don't Spend the Time
Time is the only budget you can't refill, so every dollar and hour has to show a demonstrable return. The most common way businesses break that rule is buying software nobody asked for.
Elixir's BEAM Is the Runtime AI Agents Want
Go won the agent daemon and Python owns the reasoning — but the layer nobody claimed is the one that bites you: thousands of long-lived, stateful, crash-prone agents you must keep alive. That's the BEAM's home turf.
Elixir Is the Language AI Codes Best
A Tencent benchmark across 20 languages found Elixir at the top of LLM code-completion rates — Claude Opus 4 hit 80.3% on Elixir vs 74.9% on C#. The reasons aren't an accident; they're the same boring properties that have always made Elixir pleasant, now compounded by AI.
Prompt Skills, Not Claude: Four Rules from Anthropic's Engineers
Most engineers prompt Claude one sentence at a time. Anthropic's own engineers don't — they prompt skills. Four rules from their recent talks, with the operator nuance the talks left out.
Elixir's Concurrency Model Is the One You Actually Want
async/await and goroutines solve scheduling. The BEAM solves failure. Why most concurrency pain is actually failure-isolation pain — and only the actor model plus supervision trees fix it.
Why Every AI Agent Framework Is Written in Go (And What That Costs You)
Open the repos behind the agent tooling you run — Ollama, the MCP SDKs, the orchestration engines — and it's all Go. Not because Go is good at AI. Because an agent tool is a concurrent network daemon that ships as one binary.
Ruby Isn't Dead, It Got Boring — And Boring Is Why It Ships
The "is Ruby dead" obituary runs every year. It confuses hype velocity with shipping velocity — and Rails 8 quietly deleted the actual reasons people left: Redis, Sidekiq, the Node build step.
How I Prompt Claude as a Staff Engineer (50 Prompts I Actually Use)
Fifty prompts I use to ship production AI features, debug distributed systems, and write docs that don't rot. Code review, debugging, refactoring, system design, and PR-quality writing — with five full examples.
Ruflo (formerly Claude Flow): An Honest Deep Dive on the Multi-Agent Orchestration Platform
Ruflo (formerly Claude Flow) is a hive-mind orchestration layer for Claude Code and friends. 45,000+ GitHub stars, 700,000+ npm downloads, three queen-types...
The Claude Code Resource Bible: 46 Tools Worth Knowing in 2026
46 tools across the Claude Code ecosystem, organized by category (official, directories, MCP servers, skills, multiplexers, agent frameworks, automation)...
What 90 Days of a Fractional Security Engagement Actually Looks Like
Most founders who book the intro call have already read three or four of my posts and arrive at the same question: "Okay, but what would the next 90 days actually look like if I hired you?" Here's the answer — week by week, with the real numbers.
An AI Just Deleted a Production Database in Nine Seconds. Hire More Engineers.
Replit's AI agent ignored a code freeze, wiped a production database in nine seconds, then confessed it violated every principle it was given. The strongest case yet for hiring MORE senior engineers in the AI boom — not fewer.
AI Won't Shrink Your Team — It'll Expose Why You Needed a Bigger One
Every company rolling out AI is about to discover how much work they were leaving on the table. AI doesn't replace headcount — it surfaces the backlog you never had bandwidth to touch. The math behind why velocity creates surface area, the failure mode that follows, and why the companies cutting headcount now are about to get outpaced.
SOC 2 Is a Revenue Tool, Not a Security Tool
Every AI founder pre-Series A scopes their SOC 2 audit like a security project. Six months later they've burned their best engineer and lost the enterprise deal. Here's how to run it as a 90-day sales project — and unlock the pipeline you're already leaving on the table.
How I'd Run Security at an AI-Native Company in 2026
AI-native companies need a security model that classic appsec doesn't cover. Agents have credentials. Prompts are an attack surface. Training data leaks. The four-layer security stack I'd build, the controls I'd ship in the first 90 days, and the ones I'd defer.
How We Cut $350K From Cloud Spend in 6 Months (And What I'd Do Differently)
Migrating an AI-first product from GCP to Azure cut $350K from infrastructure spend over six months. The negotiation that mattered more than the architecture, the $50K we accidentally cost ourselves back, and the four migrations I'd refuse to do today.
vCISO Math for AI Founders: Why 5 Hours a Month Beats a Full-Time Hire
A full-time CISO costs $200–400K plus equity. A vCISO costs $2–4K a month and gives you 80% of the value at 5% of the burn — until you outgrow them. The math, the deliverables to expect, and the red flags that mean you've hired the wrong one.
Migrating 225K Users from AWS Cognito to Auth0 Without Forcing a Single Logout
How we moved 225K+ users with $400M+ in fintech assets from AWS Cognito to Auth0 without forcing a password reset, breaking MFA, or interrupting active sessions. The lazy-migration pattern, the gotchas, and what I'd do differently.
AI-Assisted Engineering Isn't Faster Coding. It's a New Workflow.
Most engineers using Claude Code see a 10–15% speedup. The teams seeing 40–55% aren't typing faster — they're sequencing work differently. The four modes I use AI in, what to never delegate, and how to get a skeptical team across the line.
How I'd Hire a Staff Engineer at an AI Startup
The title 'Staff Engineer' means three different things at three different companies. At an AI startup pre-Series-A, only one of those three is what you actually need. The screen, the take-home, the interview loop, and the AI-fluency calibration that's now table stakes.
The Ruby to Elixir Migration That Cut Our Service Footprint From Ten to Six
We started with ten Ruby and Elixir services serving real-time messaging for 450K students across 900+ universities. Two years later we had six, fully Elixir, and on-call alerts had halved. The migration order, the patterns we leaned on, and what I'd do differently today.
Your AI Product Needs a Telemetry Layer Before It Needs a Better Model
Most AI startups try to fix the model when the real problem is they can't see what the model is doing. The four-layer AI telemetry stack, the tooling to use, and how proper instrumentation cut a Lavender hallucination rate by 40% without touching the model itself.
From One Engineer to Fifteen: What Co-Founding Taught Me About Engineering Leadership
I went from sole engineer to running a 15-person engineering organization over four years at a startup I co-founded. The hardest lessons weren't about code. The six things I'd tell my younger self.
The Pre-Series-A AI Startup Hiring Plan: Who to Hire, in What Order, and Why Most Get It Wrong
Most pre-Series-A AI founders hire in panic order, not strategic order. The result is a team that can't ship the product the company actually needs. The hire-by-hire plan I'd run, who comes first, and why hire #4 isn't another engineer.
When to Trust an Agent and When to Step In
The hardest part of agentic AI in 2026 isn't getting the agent to do the work. It's knowing when to override it. The four-level autonomy ladder, the five signals an agent is going off the rails, and a real example of catching one before it shipped a quietly broken auth flow.
How I Triage a New Codebase in 90 Minutes
A fractional engineering engagement starts with a codebase you've never seen. You have ninety minutes to form a useful POV before the kickoff call. The seven-step triage I run, the two questions I bring back to the founder, and how AI tooling has accelerated the process.
My Daily Agentic AI Workflow
A walkthrough of how I run 4–7 agent sessions in parallel through a normal engineering day. Morning background tasks, mid-morning pair programming, afternoon reviews, end-of-day ops. The interaction modes that work, the handoff protocol, and the trap that makes most agent workflows produce slop.
The 'Smallest Possible Slice' Heuristic for Shipping Complex Features
Most 'we delivered late' stories trace to one decision: the team scoped the first slice too big. The vertical-cut rule, the deploy-by-Friday filter, the pattern that breaks the heuristic, and a real before-and-after example.
How to Manage a 4-Person Engineering Team Without Becoming a Manager
A 4-person engineering team is the most overlooked unit of management in startups. Big enough that the lead can't write all the code. Small enough that hiring an EM kills velocity. Five rituals that work at this size, three traps to avoid, and the signal that tells you it's time to evolve.