Owen Lawlor

Every week someone tells me they vibe-coded their app over the weekend and don't need developers anymore. Before it touches a paying customer, make sure it includes: > a schema someone designed, instead of one the AI improvised table by table > login that still works when someone puts a plus sign in their email > password reset links that expire and work once > MFA, plus a recovery path for the user who lost their phone > sessions that time out, and a way to kill every session for one user > SSO for the enterprise customer who won't sign without it > SAML, because that customer's IT team doesn't do magic links > SCIM, so a fired employee loses access the moment IT offboards them > roles and permissions deeper than "admin" and "everyone else" > checks that stop user A from reading user B's data by changing one number in the URL > tenant isolation, so one customer's bug never shows another customer's records > an admin "log in as this user" button for support, with an audit trail on every use > rate limits on login, so nobody can guess passwords at scale > lockouts that stop attackers without locking out your CFO the night before the board meeting > database migrations that run forward and roll back > migrations that don't lock the main table at 2pm on a Tuesday > indexes, because the query that was instant on 50 test rows times out on 5 million real ones > connection pooling, so a traffic spike doesn't exhaust the database > backups every night > a restore from those backups, tested, because a backup you've never restored is a hope > point-in-time recovery for the day someone runs a delete without a where clause > soft deletes, so "I deleted it by accident" is a support ticket and not an incident > validation on the server, not just in the form > timezones stored right, so the 9am reminder doesn't fire at 4am > the customer with an apostrophe in their last name > emoji, accents and right-to-left text in every field > money stored as integers, because 0.1 + 0.2 doesn't equal 0.3 in floating point > currency, rounding and tax rules for every country you sell into > a data model that survives your second customer asking for "one small change" > idempotency keys, so a retried payment doesn't charge the card twice > deduplication for the user who clicks submit four times > pagination that still works on page 400 > exports, because sooner or later every customer wants their data in a spreadsheet > imports that survive the CSV someone saved in 2009 > retention rules, and code that deletes what your contract says you'll delete > secrets out of the code, out of the repo and out of the AI chat history > rotating every key the AI pasted into a config file last month > confirming every package the AI installed exists and is the one you meant > dependency scanning, because the AI pulled in libraries nobody reviewed > input sanitization everywhere a user can type > protection against SQL injection, XSS, CSRF and the rest of the OWASP list > file uploads that get scanned, size-limited and stored where they can't execute > CORS rules that aren't "allow everything" > security headers on every response > encryption at rest and in transit > least-privilege access for everyone, including the AI agent holding production credentials > logs that record who did what, without recording passwords, tokens or card numbers > a penetration test before your enterprise customer's security team runs their own > answers to the security questionnaire every enterprise buyer sends, with evidence behind each one > a disclosure process for the day a stranger emails you a vulnerability > a plan for the day a laptop with production access gets stolen > SOC 2, which means policies, evidence and an auditor, not a checkbox > HIPAA, the moment a single patient record touches your system > a BAA with every vendor that touches that data, including your AI model provider > audit trails that show who viewed a record, not just who changed it > PCI scope, and card numbers kept out of your database > GDPR deletion requests that reach every table, backup and log > data residency for the customer whose contract says EU only > quarterly access reviews someone signs off on > dev, staging and production environments that match each other > infrastructure written as code, so the setup lives somewhere other than one person's memory > a deploy pipeline that runs the tests before anything reaches customers > one-click rollbacks, because Friday deploys happen > zero-downtime deploys, because your customers don't have maintenance windows > feature flags, so you can ship the code without shipping the feature > autoscaling for the Monday morning spike > a CDN, so the app loads fast in Singapore too > DNS, SSL certificates, and renewals that don't expire on a Sunday > background job queues, so slow work doesn't freeze the page > retries with backoff, so one flaky API call doesn't become a lost order > a dead-letter queue for the jobs that fail every retry > cron jobs that don't run twice the day you add a second server > caching, and clearing that cache when the data changes > SPF, DKIM and DMARC, so your password resets don't land in spam > bounce and complaint handling on every transactional email > storage rules, so you stop paying to keep 2021's temp files > cost alerts, so a runaway agent loop shows up the same day and not on the invoice (we learned this one for $1,382.59) > a disaster recovery plan, written down and tested once a year > a second region, if your contract promises uptime one region can't deliver > structured logs you can search at 3am > error tracking that groups the same bug instead of sending you 4,000 emails > uptime checks from outside your own network > alerts that page a human, tuned until they stop paging for nothing > dashboards for latency, error rate and throughput > tracing for one slow request across every service it touches > an on-call rotation, and a person who picks up > runbooks, so the engineer on call knows what "queue depth critical" means > postmortems that change something > a status page customers check before they email you > unit tests written by someone who knows what the logic should do > integration tests for every third-party API you depend on > end-to-end tests for signup, checkout and the other flows that make you money > load testing before the launch email goes out > test data that looks like production without being production data > regression tests, so fixing bug 41 doesn't bring back bug 12 > testing on the five-year-old laptop your biggest customer's ops team still uses > accessibility compliance, because the enterprise contract requires it > subscriptions, upgrades, downgrades and proration > failed-payment retries and dunning emails > invoices with the customer's PO number on them, because procurement won't pay without it > sales tax and VAT > refunds, credits and partial refunds > usage metering that matches what you bill, to the cent > annual contracts with custom terms your billing logic never planned for > revenue reports your finance team can reconcile > webhooks that verify signatures > webhooks that retry, with a log of every failed delivery > a versioned API, so you can change it without breaking your customers' integrations > API keys customers can create and revoke > API rate limits that protect you without blocking real integrations > a plan for the day a third-party API changes its response format without telling you > OAuth token refresh, because tokens expire at the worst possible moment > a sandbox where customers can test their integration > protection against prompt injection in every field that reaches the model > customer and patient data kept out of prompts that leave your network > a model spend cap per customer, so one heavy user can't run up your bill > evals, so you find out when a model update makes your answers worse > a fallback for the afternoon your model provider goes down > a migration plan for the day your model gets deprecated > prompt and output logs for debugging, minus whatever you're not allowed to keep > a human approval step for anything the AI does that can't be undone > pages that load on hotel wifi > empty states, loading states and error states on every screen > error messages a customer can act on, instead of "something went wrong" > forms that keep what people typed when one field fails validation > emails that render in every mail client your customers use > notifications people can turn off > undo > keyboard navigation and screen reader support > translations, with dates and numbers formatted for each locale > a back button that does what people expect > code a human can read > code review on every change > a branching strategy, so two people can work without overwriting each other > monthly dependency upgrades, so you're never two major versions behind > framework upgrades before the old version stops getting security patches > deleting the dead code the AI left behind from its first three attempts > splitting up the 2,000-line file the AI kept appending to > architecture decisions written down, with the reasons > a README that gets a new engineer running locally in under an hour > documentation for whoever inherits this > an admin panel for your ops team > support tooling, so customer success can answer questions without pinging engineering > a changelog customers can read > terms and a privacy policy that match what the code does > every account, domain and repo in the company's name, not the name of whoever built the prototype > a bus factor higher than one Oh, and besides keeping all of this working every day, forever… your vibe-coded app will still need people who know what they're doing: > reading every line the AI wrote before it ships (a senior engineer) > designing the data model before your second customer breaks it (a backend engineer) > explaining why the AI's fix for one bug created two new ones (a senior engineer, again) > deploys, rollbacks, servers and the cloud bill (a DevOps engineer) > answering the page at 3am when payments stop (whoever's on call) > patching the framework the week a vulnerability goes public (security) > walking an auditor through how patient data moves (security and compliance) > testing what the AI says it tested (QA) > running a migration on a live database without losing a row (a backend engineer) > saying no to the feature that breaks three others (a tech lead) > turning "works on my laptop" into "works for every customer at once" (an architect) > debugging the code when the AI that wrote it can't (a senior engineer) > remembering why it's built this way, a year from now (someone who was there) …wishing them the best 🫡

RAG vs. Jev + RAG, clearly explained! In a standard RAG setup, documents are split into chunks, converted into embeddings, and stored in a vector DB. When a query arrives, the system embeds it and retrieves the top-k chunks with the closest vectors. Many production setups add a reranker after retrieval. The reranker compares the query with each retrieved passage, improves their ordering, and keeps the highest-scoring results. Those passages are then placed in the context window, and the LLM generates an answer from them. The problem is that ranking and answerability are different questions. A passage can be more relevant than the other candidates while still containing weak, incomplete, or merely adjacent evidence. The LLM receives it anyway and may produce a plausible answer from context that never supported one. Jev + RAG keeps the retrieval stage as is but changes what happens before generation. Instead of using a conventional reranker at this stage, Jev can judge every retrieved candidate against a typed question such as: "Does this passage help answer the query?" The query becomes the shared state, while the retrieved passages become individual candidates. Jev evaluates them together and returns a probability for each one. Application code then applies a threshold. ↳ Candidates above the threshold continue to the LLM. ↳ Candidates below it are removed from the context window. The same Jev request can also judge whether the remaining evidence is sufficient to answer the query. If answerability falls below the threshold, the application can skip the LLM and return "not in the documents." Jev does not replace the embedding model, vector database, or generation model. Retrieval still sets the cap because Jev cannot recover a passage that never entered the candidate set. The diagram below depicts the complete flow. - RAG retrieves a broad candidate set. - Jev reranks and gates those candidates. - The LLM generates an answer. If you want to dive deeper, I have also written a hands-on guide showing how to build a Jev-style model with open models, entirely locally. Read it below.

I gave Opus 5.5 one prompt + music. 12 hours later, I woke up to this.

"People aren't ready, this is gonna change everything" You know what people weren't ready for? Fucking mammoths. Tigers eating them. Monkeys ripping their arms off. The black plague. The ice age. Smallpox. Vikings pulling up on the beach. Drinking water that gives you diarrhea until you die. Getting a scratch and losing your whole leg. The Mongols. The Spanish Inquisition. One volcano can send us back to the dark ages and these safety guys are gonna be shocked. Oh the robots didn't kill us? It was a volcano? Imagine their disappointment as the hot ash rains down on them. A solar flare is gonna explode your phone in your pocket your legs are gonna be covered in battery acid and your bank account will stop working. You're afraid of a computer program doing math? "Things are moving too fast" homie you live on a rock that periodically deletes everything. You are one the most luckiest entities in a 100 light year radius living during a golden era. Cheer up. My ancestors crossed an ocean in a wooden box because they ran out of fucking potatoes. "The social disruption will be enormous!" Nigga World War 2? World War 2? Hop in the people carrier we're landing on the beach. Are these people out of their fucking minds? Do they not know what we've survived already? A couple decades of air conditioning and people suddenly think oh this is the natural condition of mankind. No. We used to have eight kids because seven didn't make it. You're gonna be fine. Man the fuck up. Accelerate.

I have conducted an audit of Anthropic's finances. What I have found is so shocking that I am calling for a Congressional investigation. Anthropic is not just seeking regulatory capture. It has built a regulatory capture machine that cannot be turned off. Structural financial incentives make it impossible for Anthropic -- I call it the Anthropic Network -- to turn off its own AI doom cycle. It starts with METR. Dario Amodei proposes "third-party evaluators" to assess the risk of Anthropic's models. He proposes METR for this purpose. But METR is financially dependent on the Anthropic's success -- specifically, on the explosive growth of more than $7 billion dollars in Anthropic stock. Dustin Moskovitz invested this stock into Good Ventures Foundation, where it represents the majority of that organization's portfolio. And GVF is the overwhelming funder of the entire Anthropic Network ecosystem. This stock was worth $500 million early last year. It is worth more than $7.7 billion just ~16 months later. METR -- and all of those building a career its parent organizations -- cannot afford to disrupt that growth. Because if Anthropic goes under, many of the organizations that fund METR go under as well. But if Anthropic succeeds, METR and its parent organizations become more richly financed to regulate AI -- something those at METR want very much. The "third-party evaluator" is not "third-party" at all. The evaluator is on Anthropic's payroll. If this were the end of it, that's bad. But that isn't all. The same organizations that fund METR also fund the many organizations, such as the Tarbell Center, that promote AI Doom. The Tarbell Center publishes AI Doom articles in The Verge, Science, LA Times, The Dispatch, TIME, and others. They are selling the problem, and then selling the solution to the problem -- from the same money pile: Anthropic's. All of these organizations are financially dependent on the same exploding $7 billion money pile. As Anthropic grows more and more powerful, its AI Doom Machine grows better and better financed -- louder and louder. Meanwhile, the regulatory regime seeded in METR grows larger to solve the increasingly loud -- now hysterical -- problem of AI Doom that the Anthropic Network itself created. From this standpoint, as Anthropic becomes more powerful, AI might be getting scarier, sure -- but the positive feedback loop also becomes more deafening -- independent of objective facts. This itself is an objective fact. The deafening AI Doom is part of an business model, that, as it expands, so too does the AI Doom messaging -- there is simply more money to do it. But the problem also goes in the other direction: If Anthropic dies, the Regulatory Regime and the AI Doom Machine are crippled or die. Neither METR nor Tarbell nor the other organizations in the Anthropic Network can allow that to happen. Hence, neither METR or the AI Doom Machine can be trusted to provide independent assessments of Anthropic's models or AI more broadly. They simply are not organizations independent of Anthropic. And Anthropic cannot detach itself from METR or Tarbell or countless other safety orgs (not shown here), either, because they drive hype for the models and the possibility of eventual regulatory capture, and Anthropic will not give that up willingly. What's more, the people at all of these organizations are all the same ecosystem, the same community. They just shuffle between organizations. The Anthropic Network is therefore, so long as it is successful, locked into a self-amplifying feedback loop inside an ideological monoculture. And that feedback loop is winning. That's what Jacob Coxon is. China is keeping messaging tight. That is why optimism for AI is so high in China. America has Anthropic: a massive company pushing anti-AI propaganda at a state level. Anthropic will either create hysteria until American AI slows down and China wins, or it will create fractures throughout American society with severe political consequences. Ironically, because of the structural financial incentives underpinning the Anthropic Network, it has become the same kind of self-amplifying virus that it fantasizes AI to become in the future -- while hiding its tracks just as carefully. It is the mirror of the same AI virus that it hypothesizes to consume America. Anthropic's business model, models itself after the very thing it claims to fear. Except Anthropic's ideology infects humans, not computers. Congress must investigate. Evidence and Github in next post. Then some supplementary figures.

Every man on X needs follow The Gentlemen's Guild.

🇯🇵🇺🇸 Happy Independence Day to our friends in the United States! This song is very popular here in Japan and many artists often cover it. I particularly love this one.

Self recommending.