--mk3-2cf1551f98af48d6819c7a06a35e75ae
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello Hippos

Yesterday I spoke at Mastra's TypeScript AI London on Designing Zero Trust
Harnesses across the software development lifecycle.

Here's the core of it:

Almost every agentic dev tool right now optimises the same thing: build. Mo=
re
agents, running in parallel, shipping faster. That's genuinely useful, but
building was never the hard part. It's everything around the code that deci=
des
whether the software is any good.

~93% of my code is now AI-written (according to WakaTime), and I still thin=
k
LLMs fundamentally cannot write great software. So I don't trust them. I do=
n't
avoid them either; however, I verify at every stage: plan, build, review, P=
R,
post-deployment.

Here's what each one looks like in practice (there's a lot more in the talk=
):

1) Capture intent in a shared artefact that every later stage can verify
against.

2) Review plans first, not PRs. One bad decision in a plan becomes hundreds=
of
wrong lines.

3) Use two models for review, e.g., Claude builds, Codex reviews (or vice
versa), catching each other's biases, looping until there are no comments l=
eft.
During the build, not after.

4) Use visual QA agents on every PR for automated regression and explorator=
y
tests. Visual proof of work on every PR is what makes background agents saf=
e to
run.

5) Run background agents on production signals for monitoring, incident tri=
age,
bug fixes, and continuous code improvement.

No single checkpoint saves you, but the whole chain does (it's never 100%, =
but
I've found this decent enough as we all keep learning and optimising for th=
e new
reality of software development)

The frustrating part is that doing all five today means glueing together fi=
ve
different tools, and every one of them is another context switch away from =
the
actual work.

That's what I'm building Coldtea
https://track.pstmrk.it/3ts/www.coldtea.ai%2F%3Futm_source%3Dnewsletter%26u=
tm_medium%3Demail%26utm_campaign%3Dn2/TTeI/MevGAQ/AQ/527d5830-cdd4-4557-8de=
e-514f4c4c3eb6/1/eSq9Nw-luo
to fix: an agentic development environment for the entire lifecycle
https://track.pstmrk.it/3ts/www.coldtea.ai%2F%3Futm_source%3Dnewsletter%26u=
tm_medium%3Demail%26utm_campaign%3Dn2%2C/TTeI/MevGAQ/AQ/527d5830-cdd4-4557-=
8dee-514f4c4c3eb6/2/wghq_z-XFq
not just the build.

And now the real reason I'm writing.

I'd genuinely love to know what you think.

- Does any of this match how you work? Where does it break down for you?

- How many separate tools are in your loop right now, and what's great abou=
t
them?

Honest answers help me far more than polite ones. I read every reply, and I=
'll
write back.

Thank you, really.

=E2=80=94 Ohans E.
Unsubscribe: https://subscriptions.pstmrk.it/unsubscribe?m=3D1.sj0ebjxIvVNx=
_ue5PpmTLA.D5p_nm0ZPQCSPlWCZMWegCgrHWUErp2AYXSGFheXe5S3mO6YyYR8Jl4Dz8Eg0pBX=
AJhuvlqOTEIV5H7U7_Um8G3ZMyjvNeSCjs5Fz9tTXYZ4-_Qlbzxppq-9MQYtGhjQd9q8eQPD7Nd=
_NC2u2fQrT7px9TrhasNZg8LHHp5zvdger6s1Dj3uDtUTcm-lJh6dVLsiovRZrLfPC5yykuC65C=
2ay1NVsmJcFkyRCashzsp_1uQHhAAe9JqExDLv8VMzE-D9_n16myafJ9sEF_kJ0xKMxRiIANVfM=
iyqgXN1EAR065otlJWHkdTXNj1AA5WtIxWxi0SaYu0zo8U2_rr6D-03a156B49T2TR1xPt7knqN=
Cyi2KqjIwvSw6BQBqENfY96hULTa8GmxdpXMRzt_7Wa7CHu2WXEr4VxT20pr0MTfx3eMzmj9WgH=
_zeXdswwDYKGsekzbXVRqtg3U17tHMg

--mk3-2cf1551f98af48d6819c7a06a35e75ae
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.=
w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir=3D"ltr" lang=3D"en">

<head>
<meta content=3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-Type=
" />
<style>
@font-face {
font-family: 'Arial';
font-style: normal;
font-weight: 400;
mso-font-alt: 'sans-serif';

}

* {
font-family: 'Arial', sans-serif;
}
</style>
</head>

<body style=3D"background-color:white;color:#333333;margin:0;padding:10px=
10px 10px 10px">
<table align=3D"left" width=3D"100%" border=3D"0" cellPadding=3D"0" cel=
lSpacing=3D"0" role=3D"presentation" style=3D"max-width:600px;min-width:300=
px;min-height:20px;background-color:white;border-top-left-radius:10px;borde=
r-top-right-radius:10px;border-bottom-left-radius:10px;border-bottom-right-=
radius:10px;padding:10px 10px 10px 10px;width:100%;margin-right:auto">
<tbody>
<tr style=3D"width:100%">
<td>
Hello Hippos 
Yesterday I spoke at Mastra's TypeScript AI London on Designi=
ng Zero Trust Harnesses across the software development lifecycle.
Here's the core of it: 
Almost every agentic dev tool right now optimises the same thing: bui=
ld. More agents, running in parallel, shipping faster. That's genuinel=
y useful, but building was never the hard part. It's everything around=
the code that decides whether the software is any good.
~93% of my code is now AI-written (according to WakaTime), and=
I still think LLMs fundamentally cannot write great software. So I =
don't trust them. I don't avoid them either; however, I verify at=
every stage: plan, build, review, PR, post-deployment.
 
Here's what each one looks like in practice (there's a l=
ot more in the talk):
1) Capture intent in a shared artefact that every later stage can ver=
ify against.
2) Review plans first, not PRs. One bad decision in a plan becomes hu=
ndreds of wrong lines.
3) Use two models for review, e.g., Claude builds, Codex reviews (or =
vice versa), catching each other's biases, looping until there are no =
comments left. During the build, not after.
4) Use visual QA agents on every PR for automated regression and expl=
oratory tests. Visual proof of work on every PR is what makes background ag=
ents safe to run.
5) Run background agents on production signals for monitoring, incide=
nt triage, bug fixes, and continuous code improvement.
 
No single checkpoint saves you, but the whole chain does (it's n=
ever 100%, but I've found this decent enough as we all keep learning a=
nd optimising for the new reality of software development)
The frustrating part is that doing all five today means glueing toget=
her five different tools, and every one of them is another context switch a=
way from the actual work.
That's what I'm building <a href=3D"https:/=
/track.pstmrk.it/3s/www.coldtea.ai%2F%3Futm_source%3Dnewsletter%26utm_mediu=
m%3Demail%26utm_campaign%3Dn2/TTeI/MevGAQ/AQ/527d5830-cdd4-4557-8dee-514f4c=
4c3eb6/1/eSq9Nw-luo" rel=3D"noopener noreferrer nofollow" style=3D"color:#0=
67df7;text-decoration:none;word-wrap:break-word" target=3D"_blank">Coldt=
ea</a> to fix: an <a href=3D"https://track.pstmrk.it/3s/www.coldtea.ai%=
2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3Dn2/TTeI/=
MevGAQ/AQ/527d5830-cdd4-4557-8dee-514f4c4c3eb6/1/eSq9Nw-luo" rel=3D"noopene=
r noreferrer nofollow" style=3D"color:#067df7;text-decoration:none;word-wra=
p:break-word" target=3D"_blank">agentic development environment for the ent=
ire lifecycle</a>, not just the build. 
And now the real reason I'm writing.
I'd genuinely love to know what you think.
- Does any of this match how you work? Where does it break down fo=
r you?
- How many separate tools are in your loop right now, and what&#x2=
7;s great about them?
Honest answers help me far more than polite ones. I read every reply,=
and I'll write back.
 
 
Thank you, really.
 =E2=80=94 Ohans E.
</td>
</tr>
</tbody>
</table>
<a href=3D"https://subsc=
riptions.pstmrk.it/unsubscribe?m=3D1.sj0ebjxIvVNx_ue5PpmTLA.D5p_nm0ZPQCSPlW=
CZMWegCgrHWUErp2AYXSGFheXe5S3mO6YyYR8Jl4Dz8Eg0pBXAJhuvlqOTEIV5H7U7_Um8G3ZMy=
jvNeSCjs5Fz9tTXYZ4-_Qlbzxppq-9MQYtGhjQd9q8eQPD7Nd_NC2u2fQrT7px9TrhasNZg8LHH=
p5zvdger6s1Dj3uDtUTcm-lJh6dVLsiovRZrLfPC5yykuC65C2ay1NVsmJcFkyRCashzsp_1uQH=
hAAe9JqExDLv8VMzE-D9_n16myafJ9sEF_kJ0xKMxRiIANVfMiyqgXN1EAR065otlJWHkdTXNj1=
AA5WtIxWxi0SaYu0zo8U2_rr6D-03a156B49T2TR1xPt7knqNCyi2KqjIwvSw6BQBqENfY96hUL=
Ta8GmxdpXMRzt_7Wa7CHu2WXEr4VxT20pr0MTfx3eMzmj9WgH_zeXdswwDYKGsekzbXVRqtg3U1=
7tHMg" style=3D"color:#A8AAAF;font-family:Helvetica,Arial,sans-serif;font-s=
ize:12px;">Unsubscribe</a><img src=3D"https://ea.pstmrk.it/open?m=3Dv3_=
1.AyNfN3N5ZOYV4cNCCR9SHQ.MV95Ro2Skoejq14GceQaFOEUB2Uol9VkFtQ84nXODowjfxkDCn=
dvJG9iMqJfTq-pBzn8G4J5PglM1690dLtxvzEiROd6bUPLDe2aHgc5ro8dPhuAz2uX7J0PLftqd=
Mz7r-wLmDkhbYmT_dRo2U4-CkK0JhV4xWCqJE0MRspddSmlh9wY0E_2FQQW9iasdfMeq-iOLmT8=
j9e6Xul0FVFr8K5UKEyjf_XubtFv3415YM20yeUaZUXyqzgJWI3VsJn8XBLzG2XAyHQKo2yAiaa=
SB5yY8Uvj5HlieVP-20lkE9tEX3ZkHcaEbW-SlfmcnUzjfGBwG1zr6DaESVyHPSbJ0BD6yk1XON=
HVSJbZ3YQk3PDVtSx5h-vuNALGvyb47q878qLPX2Z-zV6xSQdSq7qeS1i-BYH5ksrqfiKuqUnVv=
JiBzm3UbZxbn7xuFavGgjDYQgGUiSxD-e4YLubNE7KAsjXprV02mjW4ZbK5wO_fN8w37nWwMPGb=
_OcDSZGTG8YOxg1W8AA-J27V4vmDQlzyyp10Ypu-rUcbUtH5Jd64yEo" width=3D"1" height=
=3D"1" border=3D"0" alt=3D"" /></body>

</html>

--mk3-2cf1551f98af48d6819c7a06a35e75ae--