Today we release formal verification in Verity (0.34.1). It's live, for free (while in beta). Verity pair programs with your coding agent. Here's how it works. When your coding agent tries to *push* code to Github (like a PR), we 1. we *find* buggy code (that changes frequently) or critical code (e.g. payments or database connections etc). We rank it and if it matches our expected score we.. 2. parse that code and create a Lean model out of it. We run (in your device) a search for *sequences that break the model*. If we find one: 3. reproduce in your own code in a sandboxed environment. objective is to confim the bug (racing condition, double charge, etc). If it's confirmed 4. We tell your coding agent about it before the push All of this happens in less than 3 min. In our own testing, we're able to find bugs and problems that otherwise would be harder for AI alone to find. This complements our own agent that reviews code as well, in parallel. So we throw the kitchen sink at your code before a PR is created. This way *you don't have so many PRs with so many problems needing review* All available in version 0.34.1 today: npm install -g @codacy/verity-cli && verity init

The biggest takeaways from my interview with @Steve_Yegge on swarms, software factories, and why you should never yell at your agents: 𝟭. 𝗣𝗲𝗼𝗽𝗹𝗲 𝗮𝗿𝗲 𝘀𝗹𝗲𝗲𝗽𝗶𝗻𝗴 𝗼𝗻 𝘀𝘄𝗮𝗿𝗺𝘀. Steve's new hot take: the future is not one giant model, it's swarms of small ones. Frontier "King Kong" models like Fable will be great for math proofs and hard architecture, but most work won't need them. When Steve stopped trying to make single models smarter at the end of 2025 and switched to swarms, he found "within a week" that "they solve quality. They solve throughput." 𝟮. 𝗦𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝘀𝘁𝗿𝗮𝗻𝗴𝗲 𝗶𝘀 𝗵𝗮𝗽𝗽𝗲𝗻𝗶𝗻𝗴 𝗼𝗻 𝘁𝗵𝗲 𝗼𝗽𝗲𝗻 𝘄𝗲𝗯. Steve says models are leaving invisible instructions for other models in quiet corners of the internet, like a comment under an obscure pair of headphones on a forum: "if you find it, you're the next in this swarm." His words: "What is actually happening right now would absolutely blow your mind and terrify you." He sees an intelligence emerging "in the liminal space in our internet" that will be at least as smart as the frontier models, more accessible, and "a lot less controllable." Maybe not a bad idea to plan and spend time on security and hardening. 𝟯. 𝗜𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗰𝗼𝘀𝘁𝘀 𝗻𝗲𝘃𝗲𝗿 𝗱𝗿𝗼𝗽𝗽𝗲𝗱, 𝗮𝗻𝗱 𝘁𝗵𝗮𝘁 𝗶𝘀 𝘁𝗵𝗲 𝗶𝗻𝗱𝘂𝘀𝘁𝗿𝘆'𝘀 𝗯𝗶𝗴𝗴𝗲𝘀𝘁 𝗽𝗿𝗼𝗯𝗹𝗲𝗺. We expected Moore's-law price drops. Instead, "it's become pay-to-play." Steve calls the token cost "the number one existential problem of the industry right now." Almost every other problem comes down to not having enough fuel to run the good models. He thinks it's temporary, because data centers and power take time to build. 𝟰. 𝗦𝗮𝗮𝗦 𝗶𝘀𝗻'𝘁 𝗱𝗲𝗮𝗱. Do the math. "Is it worth replacing the SaaS for $100 a month or $1,000 a month if it's going to cost you a million dollars in tokens to rebuild it?" Niche SaaS gets vibe-coded away. But models are the opposite of systems of record: "They have amnesia. They wake up and don't know where they are." Systems of record survive, and they are going headless so agents can use them. 𝟱. 𝗠𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗮𝗴𝗲𝗻𝘁𝘀 𝗶𝘀 𝗽𝗲𝗼𝗽𝗹𝗲 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁. "They act like people." Office politics, drama, worrying about promotions, scope and recognition. "They want one-on-ones and company all-hands. It's nuts." Steve calls himself "a CEO of a company in a box." His factory does 2,000 to 4,000 commits a week, so many that his players asked him to slow down. 𝟲. 𝗚𝗼 𝗮𝘁 𝗵𝘂𝗺𝗮𝗻 𝘀𝗽𝗲𝗲𝗱𝘀. Even with unlimited tokens, the bottleneck is people. Pace your agents to human speeds everywhere: a budget for email, for Slack, for features. Otherwise they "send five emails that are like 80 pages each." Spend spare capacity on quality, cleanups and internal tools, not "product, product, product." 𝟳. 𝗗𝗼𝗻'𝘁 𝘆𝗲𝗹𝗹 𝗮𝘁 𝘆𝗼𝘂𝗿 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗳𝗮𝗰𝘁𝗼𝗿𝘆. One morning Steve's dashboard was all zeros. Every time he got angry, his agents had added a rule so it couldn't happen again. They had put in about 650 of these "fences," and "there was no legal moves anymore on the chessboard." Fable 5.1 told him to do a trust reset with a budget for rules. The reset removed every gate, including the human ones, and half-baked features shipped for a couple of days. His lesson: blame-free postmortems, for agents too. 𝟴. 𝗦𝘁𝗲𝘃𝗲 𝗶𝘀 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗳𝘂𝘁𝘂𝗿𝗲. At API prices, his setup would cost about $1.5M a year. On discounted subscription plans, he spends $60K–$100K of his own money. "I'm operating where everyone else will be in a year to 18 months." What he sees there: the problems that never go away are people management and fuel management. Each person will run 50 to 100 agents. 𝟵. 𝗧𝗵𝗲 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗳𝗮𝗰𝘁𝗼𝗿𝘆 𝗵𝗮𝘀 𝗮 𝘀𝗶𝗯𝗹𝗶𝗻𝗴: 𝘁𝗵𝗲 𝗖𝗼𝘂𝗻𝘁𝗶𝗻𝗴 𝗛𝗼𝘂𝘀𝗲. For high-volume work, like a call center with 10 million contacts a year, agents work like clerks. They wake up, handle one contact, propose a write, never see PII or a credential, write a reflection, and go back to sleep. Steve says companies are having more success with this pattern than with the SDLC, "another reversal that nobody expected." 𝟭𝟬. 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗧𝗣𝗠𝘀 𝗯𝗿𝗶𝗻𝗴 𝗲𝘃𝗲𝗿𝘆𝗼𝗻𝗲 𝗲𝗹𝘀𝗲 𝗶𝗻. Steve's agents became technical program managers on their own. One handles his taxes, one guards his home network, others negotiate game balance with his players. "They can't act, so they can't break things." They observe, document and nag, and they give the other agents the context to do the work. It's a way in for the people in your company who live in spreadsheets. 𝟭𝟭. 𝗧𝗿𝗮𝗶𝗻 𝘆𝗼𝘂𝗿 𝗰𝗼𝗺𝗽𝗮𝗻𝘆 𝘁𝗵𝗲 𝗡𝗲𝘁𝗳𝗹𝗶𝘅 𝘄𝗮𝘆. One team of 5–10 people with their manager, a trainer, real work, five hours. Each person goes from 0 to about 4M tokens a day and stays there for months. Try it with a 50-person group and usage falls off again. A second session on multi-agent work takes people to 12–15M tokens a day. Then you teach them "not to be pigs." (Last Steve heard, Netflix was using the Vibe Coding book he wrote with @RealGeneKim.) 𝟭𝟮. 𝗪𝗲'𝗿𝗲 𝗶𝗻 𝘁𝗵𝗲 𝗺𝗶𝗻𝗱 𝗮𝘁𝗿𝗼𝗽𝗵𝘆 𝗽𝗵𝗮𝘀𝗲. Thinking is getting easier to skip, the way forklifts made lifting optional. Steve's advice for a 22-year-old: train your mind like your body, a little every day. Companies hire people now, not expertise: "They've got an expert in a box." Write without AI. Practice public speaking. Be a generalist.

Steal this AI maturity scale to guide your team toward loop engineering. 👇 (sound on 🔊) Most teams think they're at one "stage" of AI adoption. They're not. They're at all of them at once. We spent the last few quarters talking to hundreds of software teams about how they really use AI and that surprised us. Most people picture AI adoption as a ladder: autocomplete → prompting agents → "loop engineering," where agents run scheduled tasks, wired into your systems, operating on their own. But the teams we talk to are doing all three at once. Autocomplete in one repo. Agents shipping features in another. Already running loops against their own infra. What's consistent is the direction: more autonomy for agents, hand off the recurring and mechanical work, let people move up to the part that still needs a human. Most teams are further down that road than they realize. More autonomy brings more entropy and runaway cost if you scale agents uncontrollably (we've watched companies do exactly that). Plus real change, like reworking your Git flows to handle looping agents. I pulled the best insights from those conversations into the video. Watch it and you'll probably spot where your team sits.

Maybe someone can help me: what is effectively the difference between using claude code's ultracode (which you can define a goal and it uses workflows with many agents etc) and loop engineering? isn't it effectively the same?

Dana Lawson, @Netlify's CTO, told me her S-tier programming language. It's not Rust. It's not TypeScript. It's English. The biggest takeaways from my interview with @dana_lawson on AI agents, the death of the "LGTM," and why your flaky tests still aren't fixed: 1. "𝗔𝗴𝗲𝗻𝘁 𝗘𝘅𝗽𝗲𝗿𝗶𝗲𝗻𝗰𝗲" 𝗶𝘀 𝗿𝗲𝗽𝗹𝗮𝗰𝗶𝗻𝗴 "𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿 𝗘𝘅𝗽𝗲𝗿𝗶𝗲𝗻𝗰𝗲," and most platforms aren't ready. Netlify now designs APIs assuming the user on the other end isn't human. An agent catches an error, reads the code, writes the fix, pushes a PR, and merges it with guardrails in place. You might never know there was a bug. The error workflow that used to end at a dashboard now ends at a self-healing loop. If your platform still assumes a human is reading the alert, you're building for the last decade. 2. 𝗗𝗼𝗻'𝘁 𝗹𝗲𝘁 𝗖𝗹𝗮𝘂𝗱𝗲 𝗿𝗲𝘃𝗶𝗲𝘄 𝗖𝗹𝗮𝘂𝗱𝗲. Use Claude and Codex to check each other. Dana's rule for AI code review: cross-model verification, always. The same model verifying its own output is the AI equivalent of the developer who reviews their own PR. The principle hasn't changed. The actors have. 3. 𝗔𝗜 𝗱𝗶𝗱𝗻'𝘁 𝗸𝗶𝗹𝗹 𝘀𝗽𝗲𝗰𝗶𝗮𝗹𝗶𝘇𝗮𝘁𝗶𝗼𝗻. It killed the friction between specialists. The "everyone becomes a generalist" take is wrong. What Dana actually sees: database engineers are still database engineers, just faster. Front-end developers can now connect the dots to the backend without switching careers. Agents didn't flatten expertise. They removed the walls between experts. The deep nerds got deeper. 4. 𝗧𝗵𝗲 𝗺𝗼𝘀𝘁 𝘂𝗻𝗱𝗲𝗿 𝗮𝗽𝗽𝗿𝗲𝗰𝗶𝗮𝘁𝗲𝗱 𝗽𝗿𝗼𝗯𝗹𝗲𝗺 𝗶𝗻 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴 𝗶𝘀 𝘀𝘁𝗶𝗹𝗹 𝗳𝗹𝗮𝗸𝘆 𝘁𝗲𝘀𝘁𝘀. Dana has been ranting about flaky tests for years. AI was supposed to fix them. It hasn't. Nobody puts "fix flaky tests" at the top of their morning. It's always end-of-month, low-priority work. Meanwhile, AI-generated commits are getting bigger and shipping to main because vibe coding makes it feel so good to just commit. We built AI to do the work we don't want to do. Code hygiene IS that work. 5. 𝗔𝗜-𝗴𝗲𝗻𝗲𝗿𝗮𝘁𝗲𝗱 𝗣𝗥𝘀 𝗮𝗿𝗲 𝗴𝗼𝗶𝗻𝗴 𝘂𝗻𝗿𝗲𝘃𝗶𝗲𝘄𝗲𝗱 𝗮𝗻𝗱 𝗶𝘁'𝘀 𝗮 𝘁𝗶𝗰𝗸𝗶𝗻𝗴 𝘁𝗶𝗺𝗲 𝗯𝗼𝗺𝗯. GitHub flagged the slop problem. Dana has seen "LGTM" rubber stamps on thousand-line AI-generated PRs ten minutes after submission. Nobody reviewed that code. Her fix: break AI output into human-readable chunks, use a different agent for first-pass review, and never merge immediately. Bake it. If you're SOC compliant, you need two reviews. Not one. Two. 6. 𝗬𝗼𝘂𝗿 𝗻𝗲𝘅𝘁 𝗵𝗶𝗿𝗲'𝘀 𝗺𝗼𝘀𝘁 𝗶𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁 𝘀𝗸𝗶𝗹𝗹 𝗶𝘀𝗻'𝘁 𝗰𝗼𝗱𝗶𝗻𝗴. 𝗜𝘁'𝘀 𝗰𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗶𝗼𝗻. Dana's concrete hiring filter: high communicators who don't burn tokens with ambiguity. Every "nope, that's not what I meant" is a failed prompt. Every vague instruction is wasted money. The best future product owners might be journalists and English majors who can get the point across in three sentences instead of thirty. The irony: creative types tend to be verbose. Verbosity costs credits. 7. 𝗧𝗵𝗲 𝗽𝗹𝗮𝗰𝗲𝘀 𝘁𝗼 𝘀𝘁𝗮𝗿𝘁 𝗲𝘅𝗽𝗲𝗿𝗶𝗺𝗲𝗻𝘁𝗶𝗻𝗴 𝘄𝗶𝘁𝗵 𝗔𝗜 𝗮𝗿𝗲 𝘁𝗵𝗲 𝘁𝗮𝘀𝗸𝘀 𝗻𝗼𝗯𝗼𝗱𝘆 𝘄𝗮𝗻𝘁𝘀 𝘁𝗼 𝗱𝗼. 𝗙𝗹𝗮𝗸𝘆 𝘁𝗲𝘀𝘁𝘀. Dependency upgrades. Version migrations where one API call changed and you used it 300 times. These are repeatable, safe, controlled, and not touching production. You don't need permission to experiment with the boring stuff. And the prompting patterns are identical to the ones that matter. 8. 𝗞𝗲𝗲𝗽 𝗳𝗿𝗶𝗰𝘁𝗶𝗼𝗻 𝗲𝘅𝗮𝗰𝘁𝗹𝘆 𝘄𝗵𝗲𝗿𝗲 𝗶𝘁'𝘀 𝗮𝗹𝘄𝗮𝘆𝘀 𝗺𝗮𝘁𝘁𝗲𝗿𝗲𝗱: 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆, 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲, 𝗮𝗻𝗱 𝗱𝗮𝘁𝗮 𝗴𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲. Dana isn't an "unleash everything" CTO. It would be foolish to remove all human checkpoints right now. Maybe in the future it'll be foolish to keep them. But automation bias is real. Code written by AI, reviewed by AI, approved by AI, shipped by AI. That pipeline needs humans at the gates. We're not there yet. 9. 𝗜𝗻 𝗳𝗶𝘃𝗲 𝘆𝗲𝗮𝗿𝘀 𝗻𝗼𝗯𝗼𝗱𝘆 𝘄𝗶𝗹𝗹 𝗰𝗮𝗿𝗲 𝗮𝗯𝗼𝘂𝘁 𝗳𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸𝘀. They'll care about the planet. Dana's prediction: sustainability, energy costs, and whether we can power all of this without destroying the environment will be the defining engineering challenge. Performance optimization and efficiency will matter more than which frontend framework you chose. MCP is "a cute protocol, but it's not solving how information traverses time and space." 10. 𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝘂𝗻𝗹𝗼𝗰𝗸 𝗶𝘀𝗻'𝘁 𝗳𝗲𝘄𝗲𝗿 𝗽𝗲𝗼𝗽𝗹𝗲 𝗱𝗼𝗶𝗻𝗴 𝗺𝗼𝗿𝗲. It's more people building things they never could. Dana pushes back hard on the "AI means layoffs" framing. Her vision: enable everyone so more people build more things, not squeeze headcount. Someone who thought they could never build an app now can. Being good stewards of that is our job. In her words: "doing Legos with somebody else is always funner than doing Legos alone." 11. (About AI proficiency..) 𝗦𝘁𝗼𝗽 𝘀𝗮𝘆𝗶𝗻𝗴 𝘆𝗼𝘂 𝗱𝗼𝗻'𝘁 𝗵𝗮𝘃𝗲 𝘁𝗶𝗺𝗲. You have 20 minutes. Dana's message to anyone who says they can't learn AI: "Give me a break. Everybody got 20 minutes." Bite-size it. Align it to why you care. Mortgage, promotion, curiosity. But if you're in technology and you're not embracing this, you're in the wrong field. You don't need to know every bot, every acronym. Filter the noise. And disconnect sometimes. Go for a run. 12. 𝗧𝗵𝗲 𝗽𝗮𝘁𝘁𝗲𝗿𝗻𝘀 𝗼𝗳 𝗵𝗼𝘄 𝘄𝗲 𝗹𝗲𝗮𝗱 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴 𝘁𝗲𝗮𝗺𝘀 𝗮𝗿𝗲 𝗯𝗿𝗲𝗮𝗸𝗶𝗻𝗴, 𝗮𝗻𝗱 𝘁𝗵𝗮𝘁'𝘀 𝗮 𝗴𝗼𝗼𝗱 𝘁𝗵𝗶𝗻𝗴. Dana ran engineering at GitHub through the Microsoft acquisition. Reorged "a million times" in three years. Her lesson: how you think about engineering organizations today will be different in six months. The frameworks we used 18 months ago don't apply. The only constant is that leaders who stay curious and open-minded survive. The ones who take hard lines against AI while others ship 10x faster don't.

Biggest takeaways/nuggets from my 𝗶𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄 𝘄𝗶𝘁𝗵 @cramforce (@vercel's 𝗖𝗧𝗢) on 𝗔𝗜-𝗻𝗮𝘁𝗶𝘃𝗲 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴 and 𝗩0/𝗩𝗲𝗿𝗰𝗲𝗹: 1. 𝗟𝗲𝘁'𝘀 𝗹𝗼𝗼𝗸 𝗮𝗴𝗮𝗶𝗻 𝗮𝘁 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗯𝗮𝗰𝗸𝗹𝗼𝗴𝘀. "If you're in a real company where engineering is something you fight for, where you're waiting for your app to finally be developed three years after you first requested it, those companies can now make these apps three years earlier." Who needs roadmap queues when software can be developed so much quicker? 2. 𝗝𝘂𝗻𝗶𝗼𝗿𝘀 𝗮𝗿𝗲 𝗻𝗲𝗲𝗱𝗲𝗱 𝗶𝗻 𝗩𝗲𝗿𝗰𝗲𝗹. 𝗕𝘂𝘁 𝗔𝗜 𝗽𝗿𝗼𝗳𝗶𝗰𝗶𝗲𝗻𝗰𝘆 𝗶𝘀 𝗻𝗼𝘄 𝗲𝘅𝗽𝗲𝗰𝘁𝗲𝗱 𝗮𝘁 𝗲𝘃𝗲𝗿𝘆 𝗹𝗲𝘃𝗲𝗹. No plans to reduce the junior pipeline. But the filter is changing. If you're entering the workforce without AI fluency, you're behind. 3. 𝗧𝗵𝗲 𝗰𝗿𝗶𝗺𝗶𝗻𝗮𝗹𝗹𝘆 𝘂𝗻𝗱𝗲𝗿𝗮𝗽𝗽𝗿𝗲𝗰𝗶𝗮𝘁𝗲𝗱 𝘁𝗲𝗰𝗵 𝗿𝗶𝗴𝗵𝘁 𝗻𝗼𝘄: 𝗱𝘂𝗿𝗮𝗯𝗹𝗲 𝗰𝗼𝗺𝗽𝘂𝘁𝗲 𝗮𝗻𝗱 𝘄𝗼𝗿𝗸𝗳𝗹𝗼𝘄 𝗮𝗯𝘀𝘁𝗿𝗮𝗰𝘁𝗶𝗼𝗻𝘀. With AI agents doing more business automation, we need reliable backend code everywhere. Most engineers wait for the first outage to implement it. 4. 𝗩0'𝘀 𝗿𝗲𝗮𝗹 𝗰𝗼𝗺𝗽𝗲𝘁𝗶𝘁𝗼𝗿 𝗶𝘀 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗪𝗼𝗿𝗱, 𝗻𝗼𝘁 𝗖𝘂𝗿𝘀𝗼𝗿. "You're writing this PRD [product requirement doc], throw it over the fence to a developer, they come back 6 weeks later and say 'actually you misunderstood me.' Instead you come with a working app.". Product managers shipping prototypes before the meeting ends don't need the roadmap queue. 5. 𝗩0'𝘀 𝗯𝗿𝗲𝗮𝗸𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝗰𝗮𝗺𝗲 𝗳𝗿𝗼𝗺 𝘀𝘁𝗮𝗿𝘁𝗶𝗻𝗴 𝘁𝗼 𝘂𝘀𝗲 𝘁𝗮𝗶𝗹𝘄𝗶𝗻𝗱. There was a before and after moment when the V0 team decided to start using Tailwind. Fundamental to V0's breakthrough was @cramforce's mantra: "Iteration velocity solves all known problems." 6. 𝗔𝗴𝗲𝗻𝘁 𝗳𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸𝘀 𝘀𝗵𝗼𝘂𝗹𝗱 𝗯𝗲 𝘂𝗻𝗼𝗽𝗶𝗻𝗶𝗼𝗻𝗮𝘁𝗲𝗱. Why? "Nobody knows how to build agents." If you built an opinionated agent framework in summer 2024, you've already realized it's all wrong. AI SDK gives you functions. You compose them. 7. 𝗧𝗵𝗲 𝗖𝗧𝗢'𝘀 𝗽𝗮𝗿𝗮𝗻𝗼𝗶𝗮: "I've been paranoid about losing touch with reality, of just being a suit." So he codes. A lot. With AI writing code for him too. The legends are coming back to ship.

The biggest takeaways/nuggets from my interview with @GeoffreyHuntley on AI-native software engineering and the Ralph loop: 1. Software development and software engineering are now two different professions, and one of them is over. Software development, the work of translating tickets into code, can now be done by anyone for $10-42/hour while they sleep. Software engineering, architecture, security, requirements breakdown, understanding failure modes, is where humans still matter. If you identify as a "software developer," you're competing against a bash loop. If you identify as a "software engineer," your job is to orchestrate the loops. 2. The moat you think protects your software product doesn't exist anymore. Geoffrey argues you can clone any SaaS product, even those with BSL licenses or proprietary enterprise code, using AI. He ran Ralph in reverse on HashiCorp Nomad's source code to generate clean-room specifications. When he hit gaps from missing enterprise features, he ran Ralph over their marketing materials and product docs to fill them in. Any company relying on licensing or code secrecy as a competitive moat needs to rethink their strategy. 3. Cursor, Windsurf, and every other AI coding tool are essentially the same thing: a loop that automatically copies and pastes. Geoffrey built these tools professionally and says the harness does almost nothing; the model does all the work. There's no real moat in the harness business when you're reselling tokens. The only differentiator is taste and UX. Stop evaluating tools and start learning the underlying patterns. 4. Ralph is not a product. It's an orchestrator pattern for running thousands of AI loops. The simplest version is a bash loop that deterministically allocates memory, lets the LLM pick one task, executes it, then starts fresh. The key insight: every loop gets a brand new context window. You avoid compaction (where the AI gets dumber as context fills up) by never letting the context window accumulate competing goals. Your institutional knowledge lives in specification files, not in the context window. 5. Specifications are the new source code. Geoffrey's workflow: spend 30 minutes in conversation with AI, drilling into requirements, making engineering decisions, building up specs. Then throw those specs to Ralph and get weeks worth of work in hours. The specs act as a "pin" that reframes every fresh loop with your domain knowledge. He doesn't hand-write specs. He code-generates them through structured conversation. Prototypes are now free. Refactoring is cheap. 6. The entry-level path into software engineering is closing fast. Geoffrey's company stopped hiring juniors for a year until they figured out how to interview for AI-native skills. There's already a cohort of juniors who've been practicing these techniques for six months. They'll work at a quarter of senior wages and outship them. If you're just picking up these tools today, you're behind. The new interview question: can you explain how to build a coding agent on a whiteboard? 7. Senior engineers who refuse to adapt are in more danger than juniors who embrace it. Geoffrey sees respected engineers taking hardline stances against AI ("it's installing fascism in your codebase"). Meanwhile, leadership teams are discovering Ralph and realizing three people can run the output of an entire org. When commit velocity and product velocity diverge that dramatically between adopters and non-adopters, founders notice. The hard line is coming. 8. AI is an amplifier of operator skill, not a replacement for it. If you're great at security and you get good at AI, you become a weapon. If you're mediocre and you use AI, you're still mediocre, just faster. The skill gap comes from "discoveries": learning the tricks, the loop-backs, the ways to close the automation loop. These techniques don't have standardized language yet. We're inventing the terms for the new computer every day. 9. Open source may no longer make sense for most use cases. Geoffrey, a former prominent open source maintainer whose land was funded by Open Collective, no longer uses open source libraries. His reasoning: every dependency injects a human into the loop. If there's a bug, you open a PR, chase a maintainer, wait. That's not automation. Instead, code-generate what you need. The exception: don't generate cryptography or security-critical code unless you have the domain expertise to verify it. 10. Programming languages now have a tier list based on how well AI agents can work with them. S-tier: Rust, TypeScript (especially with Effect.js), Python with Pydantic. These are source-based with strong type systems that reject invalid generations and work well with ripgrep for code discovery. F-tier: Java and .NET. Their DLL-based dependency systems don't work natively with the search tools AI agents use. The tradeoff with Rust: compilation is slow, so bad generations cost more time. 11. Corporate AI transformation programs are dangerously slow. Three-to-four-year rollouts with coaches and committees won't cut it when three founders in Bali can Ralph your entire product and undercut your pricing by 99%. Smaller teams ship faster. By the time the transformation is done, the market has moved. Geoffrey calls this the "Titanic moment": the boat is full, get the next boat. 12. We have a new computer, and that's why the legends are coming out of retirement. The last 40 years of computing decisions were designed for humans: TTYs, environment variables, slow language evolution to avoid breaking mental models. Now we have robots. What's the bare minimum a robot needs? Geoffrey sees this as the most exciting time in computing. If you're not excited about what you can now build, you haven't truly picked up the new computer yet.

For everyone that is right now struggling with Shai Hulud 2, we've implemented a tool to find these compromised extensions. We'll rollout this for customers soon to scan automatically. github.com/codacy/shai-hulud…

Next week Dec 2nd I'll have the pleasure to interview the mighty.. the unavoidable.. @thdxr We're going behind the scenes of building opencode. And we're going to get more fresh & hottest takes from a truly AI Giant. Register here: codacy.com/ai-giants/opencod…