Ingest Claude blog security post to wiki


<context timezone="America/Chicago" />
<task from="telegram-mg-17796" time="Jul 21, 2026, 5:00 PM">Script output:
{
  "newPosts": [
    {
      "slug": "how-anthropic-secures-its-ai-native-software-development-lifecycle",
      "url": "https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle"
    }
  ]
}

Instructions:
New posts were detected on the Claude blog. The script output is in `data.newPosts` — an array of {slug, url} objects.

For each new post:
1. Evaluate relevance — prioritize: Claude Code features, agent SDKs, workflows, plugins, founder/engineering org content, security. Skip: customer case studies for specific industries (finance team, sales leader), compliance/partner announcements unless they introduce new capabilities.
2. For relevant posts: fetch the content using WebFetch and create a wiki source page in /workspace/extra/second-brain/wiki/sources/ following the naming pattern "Claude Blog - [Short Title].md". Also create a concept page in /workspace/extra/second-brain/wiki/concepts/ if the post introduces a significant new concept.
3. Update existing wiki tool pages if a post adds capabilities to an already-documented tool (e.g., Managed Agents updates).
4. Update /workspace/extra/second-brain/wiki/Home.md — add entries to the Sources section for new source pages and to Concepts for new concept pages.
5. Update /workspace/extra/second-brain/wiki/Wiki Ingest Log.md with a dated entry noting what was ingested.
6. Update CLAUDE.local.md if any new monitoring tasks or sources should be noted there.
7. Message James (telegram-mg-17796) with a concise bullet list of what was new and what was ingested. If nothing was relevant, send a brief note saying the blog was checked and nothing worth ingesting was found.</task>


- update-config: Use this skill to configure the Claude Code harness via settings.json. Automated behaviors ("from now on when X", "each time X", "whenever X", "before/after X") require hooks configured in settings.json - the harness executes these, not Claude, so memory/preferences cannot fulfill them. Also use for: permissions ("allow X", "add permission", "move permission to"), env vars ("set X=Y"), hook troubleshooting, or any changes to settings.json/settings.local.json files. Examples: "allow npm commands", "add bq permission to global settings", "move permission to user settings", "set DEBUG=true", "when claude stops show X". For simple settings like theme/model, suggest the /config command.
- keybindings-help: Use when the user wants to customize keyboard shortcuts, rebind keys, add chord bindings, or modify ~/.claude/keybindings.json. Examples: "rebind ctrl+s", "add a chord shortcut", "change the submit key", "customize keybindings".
- simplify: Review changed code for reuse, quality, and efficiency, then fix any issues found.
- fewer-permission-prompts: Scan your transcripts for common read-only Bash and MCP tool calls, then add a prioritized allowlist to project .claude/settings.json to reduce permission prompts.
- loop: Run a prompt or slash command on a recurring interval (e.g. /loop 5m /foo, defaults to 10m) - When the user wants to set up a recurring task, poll for status, or run something repeatedly on an interval (e.g. "check the deploy every 5 minutes", "keep running /babysit-prs"). Do NOT invoke for one-off tasks.
- schedule: Create, update, list, or run scheduled remote agents (routines) that execute on a cron schedule. - When the user wants to schedule a recurring remote agent, set up automated tasks, create a cron job for Claude Code, or manage their scheduled agents/routines. Also use when the user wants a one-time scheduled run ("run this once at 3pm", "remind me to check X tomorrow").
- claude-api: Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements).
TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project.
SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.
- agent-browser: Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be us…
- frontend-engineer: Pro frontend engineering discipline. Enforces build-test-verify workflow for every web project. Never declare done until the site is built, tested, responsive, accessible, and visually…
- whatsapp-formatting: Format messages for WhatsApp, including mentions that render as real WhatsApp tags. Use when responding in a WhatsApp conversation (platform_id / chatJid ends with @s.whatsapp.net or @…
- vercel-cli: Deploy apps to Vercel. Use when asked to deploy, ship, or publish a web application, or manage Vercel projects, domains, and environment variables.
- slack-formatting: Format messages for Slack using mrkdwn syntax. Use when responding to Slack channels (folder starts with "slack_" or JID contains slack identifiers).
- welcome: Introduce yourself to a newly connected channel. Triggered automatically when a channel is first wired. Send a friendly greeting and brief overview of what you can do.
- self-customize: Customize your own agent — add capabilities, install packages, add MCP servers, edit code or CLAUDE.md. Use when the user asks you to add a feature, install a tool, or modify how you w…
- onecli-gateway: OneCLI Gateway: transparent HTTPS proxy that injects stored credentials into outbound calls. You MUST use this skill when the user asks you to read emails, check calendar, access GitHu…
- consult-codex: Get a second opinion from OpenAI Codex on a plan, a problem you're stuck on, or any task that benefits from a fresh perspective or higher reasoning effort. Use when the user says "ask …
- manage-local-models: List and remove local LM Studio models to reclaim disk, safely and durably. Use when the user says "remove <model>", "delete that model", "free up disk", "prune local models", "clean u…
- widget-install: Install widget build, bust caches, verify in gallery
- backlog-burndown: Triage a project's observations.md backlog and burn down the bounded, testable items by delegating their fixes to the LOCAL model (free), keeping only judgment/architecture work on clo…
- add-to-secondbrain: Capture a durable insight, decision, or project-state change into second-brain/ (wiki/concepts, wiki/reference, or a portfolio project card). Use after solving a non-trivial problem (C…
- new-web-project: Scaffold a new local web project with this monorepo's conventions baked in — free-port allocation, starter app files, CLAUDE.md+AGENTS.md, observations.md, a smoke-test gate, Tailscale…
- bench-local-model: Discover, pull, and benchmark a local LM Studio model as a coding / general-use contender — then update the routing recommendation. Use when the user says "find new models to try", "be…
- skill-review: Analyze the current session transcript to surface friction points — corrections made, clarifications added, questions Claude asked that a good skill or CLAUDE.md entry would have pre-a…
- deploy-to-mini: Deploy a project's local git changes to the always-on Mac Mini (jamess-mac-mini, where long-running services like nanoclaw, the pool monitor, and the congressional trading monitor run)…
- get-from-secondbrain: Look up existing knowledge in second-brain/ (wiki/concepts, wiki/reference, wiki/tools, portfolio/projects) before starting non-trivial work, making an architectural call, or when stuc…
- consult-agy: Get a second opinion from Google's Antigravity (agy/Gemini) on a plan, a problem you're stuck on, or any task that benefits from a fresh perspective, large context, or higher-capabilit…
- escalate: Escalate a stuck problem to an external agent (Codex, Claude, or agy/Gemini) and surface a structured summary of what was tried, what was observed, and alternative strategies. Invoked …
- consult-claude: Get a second opinion from Anthropic Claude Code on a plan, a stuck problem, or any task that benefits from a fresh perspective or higher reasoning effort. Use when the user says "ask C…
- code-route: Single entry point for delegating a coding task through the escalation ladder before reaching for local-dev, the codex subagent, or codex-rescue directly. Classifies task complexity, r…
- smell-fix: Read the current project's observations.md and propose (or apply) fixes for open code smell items. Use when the user says "/smell-fix", "fix smell observations", "address observations …
- init: Initialize a new CLAUDE.md file with codebase documentation
- review: Review a pull request
- security-review: Complete a security review of the pending changes on the current branch


Let me evaluate the new blog post and decide if it's relevant to ingest. The slug is "how-anthropic-secures-its-ai-native-software-development-lifecycle" - this is about Anthropic's security practices for AI-native software development. That seems relevant as it's founder/engineering org content about security practices.

Let me fetch the content first, then decide.


ToolSearch

Question: select:WebFetch


Question: select:WebFetch


WebFetch

Prompt: Extract the full content of this blog post: title, author, date, key topics, main concepts, security practices, tools mentioned, frameworks/methodologies described, and any specific techniques or processes explained.


# Blog Post Summary: Anthropic's AI-Native SDLC Security

## Title & Metadata
**Title:** "How Anthropic secures its AI-native software development lifecycle"

**Author:** Jason Clinton, Deputy CISO at Anthropic (with contributions from Michael Segner)

**Date:** July 21, 2026

**Reading Time:** 5 minutes

---

## Key Topics

1. Scaling security processes alongside exponential code velocity increases
2. AI as primary code author and reviewer (80% of merged code)
3. Managing non-deterministic agents within development workflows
4. Threat modeling specific to AI-native development

---

## Main Concepts

**Core Challenge:** "Claude authors about 80% of the code merged into our codebase today," requiring security processes that don't create bottlenecks while defending against prompt injection, supply-chain poisoning, and application vulnerabilities.

**Overarching Strategies:**
- Shifting security left into code generation
- Using hard access boundaries to limit blast radius
- Combining automated and agentic reviews
- Maintaining human oversight at high-leverage points

---

## Security Practices by SDLC Stage

### **Plan**
- Automated PSR (Project Security Review) using Claude Opus
- Connected to internal knowledge index for organizational context
- Risk-based auto-approval for low-risk projects

### **Code**
- CLAUDE.md files encode secure coding guidelines
- `/security-review` command for automated scanning
- Security guidance plugins integrated during code generation
- Remote VM development environments with egress allowlisting
- Restricts agent access to prevent prompt-injection exfiltration

### **Test/CI**
- Multiple specialized review agents (not monolithic super-agent)
- Risk-tiered codebase with selective automation
- "Proof-based" findings from agents (substantive comments increased from 16% to 54%)
- SAST tools integrated alongside agentic reviews
- Approximately one-third of past incidents would have been caught by current processes

### **Deploy/CD**
- Staging environment with standard security practices
- Continuous AI-powered DAST scans for complex multi-component vulnerabilities
- External pentesting for major launches

### **Monitor**
- Claude-powered incident response: reviews logs, root-causes bugs, writes post-mortems
- Single-purpose agent identity with minimal permissions (read logs, write docs, post to Slack)
- Separate agents act as checks on each other
- Agent-to-agent communication routed through human channels
- Automated code migrations for systemic fixes

---

## Tools & Technologies Mentioned

- Claude Opus, Claude Code, Claude Tag
- `/security-review` command
- Security guidance plugins
- MITRE ATT&CK framework
- SAST (Static Application Security Testing) tools
- DAST (Dynamic Application Security Testing)
- SIEM (Security Information and Event Management)
- Remote VM environments
- HackerOne bug bounty program
- Slack integration

---

## Frameworks & Methodologies

1. **Zero Trust for Agents** – Referenced framework emphasizing agent identity and access boundaries

2. **Principle of Least Agency** – Limiting agent permissions to essential functions only

3. **Shadow Mode** – New reviewers post non-binding comments until trust is established

4. **Risk Tiering** – Codebase classified by risk level to determine automation eligibility

5. **Sampling & Auditing** – Percentage of automated approvals reviewed by humans; all decisions logged with reasoning

---

## Key Techniques & Processes

**Closed-Loop Vulnerability Management:** Bug classes feed back into CLAUDE.md instructions, preventing recurrence in future generated code.

**Multi-Agent Review Strategy:** Specialized agents avoid single blindspots; if one is compromised, others catch errors.

**Permission Boundary Separation:** Agents handling detection (log review) cannot deploy fixes; separate human-agent-reviewer system required for deployment.

**Governance Dashboard:** Real-time monitoring of security metrics across all automated processes and workstreams.

**Identity-Based Access Controls:** Agent-to-agent communication treated as insider threat risk; all actions logged with attribution.

---

## Enduring Principles Highlighted

1. Connect security agents to organizational context rather than requiring extensive documentation
2. Shift left by integrating security into code generation stages
3. Multiple automated gates prevent single points of failure
4. Humans remain accountable but operate at different lifecycle points
5. Give agents single-purpose identities with minimal permissions
6. Security monitoring evolves from bug-focused to loop-focused oversight


This is definitely relevant - it's from Anthropic's CISO about their AI-native security development lifecycle. Key topics:
- 80% of merged code is from Claude
- Security practices for AI-native development
- Claude Code security review features
- CLAUDE.md for security guidelines
- Multi-agent review systems
- etc.

This is highly relevant: founder/engineering org content + security + Claude Code features.

Let me now read the relevant existing wiki files to understand what needs to be created/updated, then create the appropriate wiki pages.

Let me check what exists in the wiki sources and home files.


Relevant post — Anthropic engineering/security content. Let me read the existing wiki structure before writing.


1	# Wiki Index
2
3	A catalog of everything in this knowledge base. Updated by Nano on every ingest.
4
5	## Tools & Software
6	*Guest-endorsed or actively used — not sponsors.*
7	- [[Agent Browser]] — Vercel Labs Rust CLI for AI-driven browser automation. Credential vault, accessibility-tree refs, React introspection, HAR recording.
8	- [[Devin]] — AI coding agent by Cognition. 15-thread code factory model.
9	- [[OpenClaw]] — Open-source AI executive assistant / chief of staff.
10	- [[ClawChief]] — Ryan Carson's open-sourced OpenClaw chief-of-staff config.
11	- [[Claude Code]] — Anthropic's coding agent. Ryan Carson's preferred coding tool.
12	- [[Codex]] — OpenAI's coding agent / browser testing tool.
13	- [[Sentry]] — Error monitoring. Used with Devin for automated bug triage.
14	- [[Tailscale]] — WireGuard mesh network. Used for remote access to Mac Mini services from phone. Includes full recipe for exposing any local port via `tailscale serve` + launchd.
15	- [[Figma]] — Design/wireframing. Visual context layer in Ravi Mehta's system.
16	- [[AgentsView]] — Agent token/cost accounting tool. Useful when new frontier-model pricing appears before dashboards and pricing databases catch up.
17	- [[Teach Skill]] — `/teach` by Matt Pocock. ZPD-based personalized tutor with persistent learning records. Trigger-based (no idle context cost). Claude Code only. Install: `npx skills add mattpocock/skills --skill teach`.
18
19	## Anthropic Official Repos & Resources
20	*Official Anthropic repositories — tools, SDKs, plugins, and reference implementations.*
21	- [[Anthropic Skills Repo]] — Reference implementations of the Claude Agent Skills system. Template for building custom skills.
22	- [[Claude Plugins Official]] — Anthropic's curated plugin marketplace for Claude Code. Install via `/plugin install`.
23	- [[Ralph Loop Plugin]] — Stop-hook-based autonomous iteration loop. Feeds Claude the same prompt until it outputs a completion promise. For well-defined tasks with clear success criteria and automatic verification.
24	- [[Hookify Plugin]] — Create Claude Code hooks from natural language. `/hookify warn me when I use rm -rf` → working hook instantly. No hooks.json editing required.
25	- [[Knowledge Work Plugins]] — 18 open-source role-specific plugins (sales, legal, finance, design, engineering, HR, ops, etc.) built on Claude Agent SDK.
26	- [[Claude for Legal]] — Deep legal workflow plugin suite (transactional + litigation + learning). Integrates with Westlaw, CourtListener.
27	- [[Claude for Life Sciences]] — Research marketplace: PubMed, BioRender, Synapse, Consensus + RNA-seq/Nextflow skills.
28	- [[Claude for Healthcare]] — Healthcare marketplace: FHIR developer, prior-auth review, clinical trial protocols + CMS/NPI servers.
29	- [[Claude for Financial Services]] — 10 named agents (Pitch Agent, GL Reconciler, Market Researcher, KYC Screener, etc.) + 9 vertical skill bundles (IB, ER, PE, WM, fund admin). Deployable as Cowork plugins or Managed Agent templates.
30	- [[Managed Agents]] — Anthropic's hosted agent orchestration platform. Self-hosted sandbox option (tool execution on your infra via outbound-polling worker), mid-session tool/MCP updates, large MCP output auto-offload. Scheduled deployments (cron, no custom infra). Env vars in vaults (credentials injected at network boundary). Opus 4.8 tool-description guidance included.
31	- [[Claude Agent SDK Demos]] — 8 local demo apps showcasing Claude Agent SDK patterns (multi-agent, streaming, email, docs).
32	- [[Anthropic SDK Go]] — `go get anthropic-sdk-go@v1.56.0`. Go 1.24+. Type-safe Claude API client for Go: model constants, context support, standard Go idioms.
33	- [[Anthropic SDK Java]] — `com.anthropic:anthropic-java:2.49.0`. Java 8+. Maven/Gradle. Builder-pattern Claude API client for JVM applications.
34	- [[Claude Agent SDK TypeScript]] — `npm install @anthropic-ai/claude-agent-sdk`. Node.js 18+. Renamed from Claude Code SDK.
35	- [[Claude Agent SDK Python]] — `pip install claude-agent-sdk`. Python 3.10+. In-process MCP servers, hooks as Python functions, CLI bundled in wheel.
36	- [[Claude Cookbooks]] — Copy-paste code recipes and notebooks for Claude API (RAG, tool use, multimodal, agents).
37	- [[Claude Quickstarts]] — Production-ready starter projects: customer support, computer use, browser automation, coding agent.
38	- [[Anthropic Courses]] — 5-course official curriculum: API fundamentals → prompt engineering → real-world prompting → evals → tool use. Jupyter notebooks.
39	- [[Anthropic Prompt Engineering Tutorial]] — 9-chapter interactive prompt engineering course with exercise playgrounds. Available direct API and Amazon Bedrock variants.
40	- [[Claude Code Action]] — GitHub Action that brings Claude into PR review and CI/CD workflows.
41	- [[Defending Code Reference Harness]] — Reference impl for autonomous vuln discovery + human-reviewed patching. gVisor-sandboxed agents. Not actively maintained; Claude Security is the hosted version.
42	- [[Scone Bench]] — 417-task benchmark for evaluating LLM agents on smart-contract vuln discovery/exploitation. Historical DeFi incidents, MCP-based, Docker-sandboxed. From Anthropic Red Team.
43	- [[Claudes C Compiler]] — Claude Opus 4.6 wrote a dependency-free C compiler in Rust from scratch. Compiles PostgreSQL, SQLite, Linux kernel, FFmpeg. Capability showcase, not production-validated.
44	- [[Anthropic Performance Take-Home]] — Open version of Anthropic's original performance engineering take-home. Optimize a VLIW SIMD kernel; Claude Opus 4.5 scored 1,363 cycles vs 147,734 baseline (108× improvement).
45	- [[Claude Code Security Review]] — GitHub Action that auto-scans PRs for security vulnerabilities using Claude.
46	- [[Claude Desktop Buddy]] — ESP32 desk pet + Bluetooth API reference for makers integrating with Claude Desktop.
47	- [[HTML Effectiveness Examples]] — Anthropic's reference collection of single-file HTML artifacts (slide decks, dashboards, editing UIs, diagrams).
48	- [[Claude Code Setup Plugin]] — Official Anthropic plugin that scans your codebase and recommends tailored hooks, skills, MCP servers, subagents, and plugins. Read-only, 1-2 recs per category.
49	- [[Claude Code Monitoring Guide]] — Prometheus + OpenTelemetry toolkit for tracking Claude Code ROI, token spend, and team adoption.
50	- [[GitHub MCP Server]] — GitHub's official MCP server.
51	- [[PineForge MCP]] — Hosted MCP server for real Pine Script v6 backtests. `claude mcp add --transport http pineforge https://mcp.pineforge.dev/mcp`. No key/signup. 245/246 TradingView parity, 100 backtests/week, 13mo Binance data. Docker route for unlimited/custom data. 60+ tools: repos, issues, PRs, code search, security scanning.
52	- [[Devcontainer Features]] — One-line devcontainer.json feature that installs Claude Code CLI in any dev container.
53	- [[Claude Code Routines]] — Scheduled/triggered cloud automation. Runs on Anthropic infrastructure, not your machine. `/schedule` command, API + GitHub + time triggers. Research preview.
54	- [[Long-Running Agent Primitives]] — 3 core primitives (Default-FAIL, Fresh-context evaluator, Handoff) + 2 operator hooks (kill switch, STEER.md). From Anthropic's own patterns.
55	- [[Claude Code Migration Kit]] — Official Anthropic toolkit for large-scale language migrations. 8 sequential prompts (00-feasibility → 06-post-parity), templates (RULEBOOK.md, manifest.tsv, inventory.tsv, cost-log.tsv, settings.json), scripts (dependency mappers, queue runners, build daemons). Companion to the AI Code Migration blog post. Operationalizes [[Rulebook-Driven Migration Loop]].
56	- [[Claude Plugins Community]] — Community plugin marketplace (security-reviewed). Submit at clau.de/plugin-directory-submission.
57	- [[Anthropic CLI]] — `ant` CLI for the Claude Developer Platform API. `brew install anthropics/tap/ant`.
58	- [[Anthropic CWC Workshops]] — 8 Code-with-Claude workshop curricula: Managed Agents, memory primitives (Dreaming Service), eval-driven dev, multi-agent decomposition, Deal Desk reference impl.
59	- [[Agent SDK Workshop]] — Hands-on workshop for Claude Agent SDK: 4-stage guided demo (chat → tools → subagents → memory) + breakout scenarios. Python 3.10+, flip switches in config.py.
60	- [[Long-Horizon Coding Agent Demo]] — Archived AWS re:Invent 2025 demo. GitHub issue → agent builds full-stack app → CloudFront preview → human approval gate. Bedrock AgentCore + Claude Agent SDK.
61	- [[Claude Foundation Models Swift Package]] — Swift package for hybrid Apple-platform apps: on-device model for fast/private tasks, Claude for reasoning + web search. iOS 27+, SPM install. Announced June 2026.
62	- [[Claude Tag Plugins]] — 19 SaaS integration plugins (Jira, Linear, Snowflake, Salesforce, Sentry, Datadog, etc.) via Claude Tag CLI. Credentials injected at runtime; install only what you need.
63	- [[Launch Your Agent]] — Claude Code skill that guides a founder from raw idea to live Claude Managed Agent: interview → scope → deploy → grade → schedule. One session, costs cents.
64	- [[Claude Fable 5 and Mythos 5]] — Anthropic's latest frontier models. Always-on adaptive thinking, new tokenizer (~30% more tokens), refusal stop reason + SDK fallback middleware, 30-day data-retention requirement. Fable 5 = GA; Mythos 5 = Preview.
65
66	## Third-Party Tools & Platforms
67	- [[Supertonic]] — On-device TTS. 66M params, ONNX, MIT license. 167× realtime on M4 Pro. Zero cost, zero cloud. Drop-in OpenAI TTS API compatible. Primary use case: StageHand narration replacing ElevenLabs.
68	- [[Legora]] — AI-native operating system for legal teams. Autonomously plans, executes, reviews, and completes complex legal work end-to-end. Built on Claude. "Raises the tide" model: improves with each Claude release.
69
70	## Sources (Talks, Posts, Papers)
71	- [[Claude CwC - The Prompting Playbook]] — Margot van Laar (Anthropic), CwC London 2026. Eval-first, XML structure, delete legacy patches, tools > instructions, Generator→Evaluator→Repairer loop.
72
73	## Concepts & Reference Docs
74	- [[Test Isolation for Runtime Activity Logs]] — Prevent orchestration tests from polluting live alert/error/state feeds by redirecting module-level runtime paths to `tmp_path`, then prove production logs are unchanged by the suite.
75	- [[LaunchAgent Quarantine and Tailscale Recovery]] — Recover a reboot-stalled local site by clearing the LaunchAgent quarantine and re-bootstrapping it, then separately reconnecting Tailscale and verifying both local and public routes.
76	- [[Orthogonal Visual Channels on Map Lines]] — Don't recolor a line to encode a boolean when color already carries a scalar; add a near-black dotted overlay (Mapbox: short dash + round cap, dasharray units are line-widths so zoom-scaling is free). Plus a puppeteer pattern for E2E-verifying map layers via the app's own custom events.
77	- [[CLAUDE.md Progressive Disclosure]] — Every-session context files hold only always-relevant rules; situational procedures move to `.claude/docs/` behind trigger-phrased pointers. Measure per-section cost first; add a size budget against regrowth.
78	- [[Claude Constitution]] — Anthropic's foundational values document. CC0 licensed. January 2026.
79	- [[Agentic UI Impedance Mismatch]] — Dario Amodei's framing: agents will complete tasks end-to-end most of the time, but humans need deep-dive inspection capability for the exceptions. No product solves this yet.
80	- [[Claude Code Subagents]] — Separate Claude instances with their own context windows. 5 copy-paste templates (reviewer, test-writer, doc-writer, security, pr-writer). Route to Sonnet for 5× cost savings.
81	- [[WebMCP]] — Chrome's proposed web standard for exposing structured tools to AI agents. Declarative HTML annotations + JS API replace fragile UI actuation. Origin trial in Chrome 149.
82	- [[But For Real Skill]] — Self-audit pattern: follow-up prompt that assumes bugs are present and bullies the AI into finding them. Simulates PR code review. From Josh Pigford's solo-founder skills stack.
83	- [[Claude Code Agent Teams]] — Native experimental feature: Team Lead + Teammates model with shared task list, dependency management, plan approval, and hooks. Enable via env flag. Claude Code only (no Codex/Aider).
84	- [[Claude Code Dynamic Workflows]] — Claude writes its own JS orchestration harness on the fly (`ultracode` keyword). 6 patterns: classify-and-act, fan-out-and-synthesize, adversarial verification, generate-and-filter, tournament, loop-until-done. Opus 4.8 era.
85	- [[Finding Your Unknowns Framework]] — Pre-flight protocol for agentic work. 4-quadrant unknowns model (Known/Unknown × Knowns/Unknowns) + 8 elicitation techniques (blind spot pass, interview mode, reference prompting, implementation plan, explainer artifact, quiz mode). Fable-era shift: user clarity is now the bottleneck, not model capability.
86	- [[AI-Native Engineering Org]] — Fiona Fung (Claude Code eng director): JIT planning, Claude reviews style/bugs/humans review domain, kill obsolete processes, track ramp time + PR cycle time + Claude-assisted commit rate.
87	- [[Claude Code Skills Best Practices]] — Thariq Shihipar: 9 skill categories, Gotchas sections, progressive disclosure via file system, trigger keywords, `${CLAUDE_PLUGIN_DATA}` memory, on-demand hooks. From Anthropic's own usage.
88	- [[X AI Signal Ingestion Source]] — Regular monitored X source for high-signal AI voices. Uses browser-visible/public pages only; no credential extraction or social-account side effects.
89	- [[NanoClaw Slack Mention-Sticky Session Bug]] — Two stacked router bugs made a documented `session_mode='shared'` config inert on threaded adapters (Slack/Discord): a forced per-thread coercion, plus a sticky-engagement check that always did an exact-thread lookup regardless of the wiring's actual session mode. Fix makes `mention-sticky` self-bootstrapping: first message creates the shared session, every message after keeps engaging.
90	- [[NanoClaw REST Fallback Tool-Call Hallucination]] — A toolless LM Studio/Codex fallback rung hallucinated fake tool-call tags (`<read_file .../>`) instead of admitting it had no tools, and the existing `<message>`-block validation only checked the wrapper, not the content, so raw tag soup reached the user. Fixed with an output-side allowlist check + corrective retry + honest fallback, deliberately without over-fitting the routing heuristic.
91	- [[Hermes Provider Fallback Config]] — Configure Hermes LLM quota failover with top-level `fallback_providers`; put LM Studio first for cloud usage-limit failures, include only authenticated providers, and use Hermes' fallback CLI/runtime/gateway tests as evidence.
92	- [[Cowork Dispatcher-Specialist Pattern]] — Dispatcher routes intake → specialist agents execute → independent audit agent verifies → human reviews. Skills as living systems: corrections loop back into skill instructions. Applicable to qip-qien triage, nanoclaw agent architecture, and signal-routing in trading projects.
93	- [[Frontier Code Evaluation]] — Use your best engineers to test models on real production work; gate on "Would I keep this code?" Cognition's internal benchmark showed 3× Fable 5 improvement over prior Opus on their hardest subset.
94	- [[Cross-Agent Session State]] — A gitignored `.agent-state/session.md` Markdown handoff lets Claude Code, Codex, Antigravity, Grok, and local agents resume interrupted work from shared evidence-based state.
95	- [[Eval-Routed Local-First Code Delegation]] — Use a standing eval's machine-readable routing block to pick the cheap local default, per-task exceptions, and cloud-only task classes instead of guessing model choice.
96	- [[Freshness-Fit-Eval Model Radar]] — Separate external freshness discovery, hardware fit scoring, and local eval verdicts so a proxy scorer can help candidate selection without silently becoming the promotion metric.
97	- [[Productization and Pricing Research Concierge Reel Workflow]] — Stagehand go-to-market memo: sell a concierge reel retainer first, keep Telegram as intake, run locally until 2-3 paying clients, and charge for reviewed outcomes rather than raw AI access.
98	- [[Rulebook-Driven Migration Loop]] — Fix the translation rulebook → regenerate the affected batch, not individual files. Loop: Rulebook → Batch Generator → Output Files → Compiler/Tests → Error Feedback → Fix rule. Includes work-queue via file existence (resumable), build daemons, advisory model split (Fable 5 judgment + Opus workhorse), parity harnesses.
99	- [[Named-But-Unbuilt Skill References in CLAUDE.md]] — A CLAUDE.md line can *describe* a primitive (`get-from-secondbrain`/`add-to-secondbrain`) convincingly enough that no one checks it exists. Verify any named skill/script actually resolves to a file before trusting the instruction.
100	- [[Layer-Matrix Verification for Multi-Layer Rendering Bugs]] — When a visible feature is composited from several rendering layers, write the intended predicate per layer × mode as an explicit matrix, apply it atomically, and verify against the live rendered state (not a unit test) — watch for stale production builds.
101	- [[Default-Off for Heavy Optional Background Features]] — If an optional feature's real implementation is heavyweight (hidden webview, continuous polling) relative to the app's baseline cost, default it off; an opt-out toggle alone still exposes users who never read settings.
102	- [[A Reported Click Does Nothing Bug Can Be An Off-Screen Render]] — "clicked and nothing happened" can mean the state update is correct but the result rendered off-screen (e.g. a mobile reflow) — verify state changed and re-test at the actual breakpoint before concluding the handler is broken.
103	- [[Symlink Hijack in Skill Updaters]] — Any auto-updating CLI with write access to shared agent config can relink every agent's skill dir under `$HOME`, indistinguishable from a supply-chain attack. Decouple detection (sandboxed `HOME`+`PATH`, not just the tool's own scoping flag) from adoption.
104	- [[Converge on One Canonical Engine]] — Two agents each defaulting to their own implementation path for the same capability diverges silently until outputs are compared. Root cause is usually an asymmetric instruction file (e.g. `AGENTS.md` with no mirrored `CLAUDE.md`); fix with a guardrail test on file symmetry, not just better docs.
105	- [[Specification-First Agentic Development]] — Agents emit specs, not code; a deterministic kernel verifies + executes. No drift between proof and production. Verification cascade: symbolic reasoning → exhaustive state exploration → deterministic simulation → property testing. Applies when agent throughput exceeds human review capacity.
106	- [[Graph Engineering Patterns]] — 5 multi-agent graph patterns (sequential chain, router, parallel fan-out, loop-with-gate, human-in-the-loop) + 4 building blocks (Node, Edge, Router, State) + model tiering (Haiku router, Sonnet builder, Opus gate). A loop is an agent; a graph is a team. No framework required.
107	- [[AI-Native SDLC Security Loop]] — When agents author/review most code, security shifts from reviewing outputs to governing loops: context-connected planning, instruction feedback, narrow reviewer agents, risk-tiered gates, separated identities, and auditable telemetry.
108
109	## 📢 Sponsor-only mentions
110	*Paid placements — not guest endorsements. Pages exist for reference.*
111	- [[Granola]] — AI meeting notes (Behind the Craft sponsor)
112	- [[Wispr Flow]] — Voice dictation (Behind the Craft sponsor)
113	- [[Linear]] — Project management / AI agent platform (Behind the Craft sponsor)
114
115	## Frameworks & Mental Models
116	- [[Apple Widget Rendering Modes]] — How to design SwiftUI widgets that work in both full-color and monochrome/accented modes (macOS, iOS, watchOS). Luminance zones, arc opacity, adaptive line colors, and `widgetAccentedRenderingMode`.
117	- [[WidgetKit Engineering Pitfalls]] — Infrastructure and data-layer pitfalls: intent-type orphaning, chronod descriptor caching, provider-data siloing, weekly-exhausted 5H row rules (0% + weekly reset + blank chart), and the early-cap reset pattern.
118	- [[Mac Widget Runtime Verification Loop]] — Layered macOS WidgetKit validation: active target membership, render tests, installed AppIntents metadata, chronod cache refresh, and desktop screenshot proof.
119	- [[Human Sandwich Model]] — Human frames → AI executes → Human judges. Dan Shipper's model for human-AI collaboration.
120	- [[Screenshot-First Visual Verification]] — Screenshots are the only ground truth for visual UI work; code correctness ≠ visual correctness.
121	- [[3-Layer Context Engineering System]] — Functional + Visual + Data layers for polished AI prototypes. Ravi Mehta's framework.
122	- [[Tokenmaxxing]] — Accusation that AI companies inflate token metrics; Boris Cherny's 250% productivity rebuttal.
123	- [[Saaspocalypse]] — Thesis that agents erode SaaS switching costs. Boris Cherny's nuanced take via Seven Powers.
124	- [[Claude Code Drift Problem]] — Config entropy at ~5 months: stale CLAUDE.md, bad folder structure, manual triggers that should be routines.
125	- [[4 AI Digital Employees Framework]] — 4 agent roles to "hire": Research Analyst, Strategic Advisor, Communication Specialist, Operations Manager.
126	- [[Friction-First Development]] — 6-principle philosophy for personal tool building: scratch your own itch, define the friction before the code, resist market-bias. Includes a pre-code Problem & Friction Analysis template.
127	- [[Devin vs Claude Code]] — Head-to-head comparison: philosophy, SWE-Bench (80.8% vs 13.86%), billing model, failure modes. Verdict: Claude Code wins for James's current stage.
128	- [[Frontier Model Qualitative Step Change]] — Pattern for treating credible practitioner reports as eval triggers when a model feels like a major-version jump on long tasks.
129	- [[Builder-Verifier Loop Pattern]] — Every code-writing loop needs a separate verifier running the real app. Builder makes the change; Verifier confirms feature correctness; you read the diff. Boris Cherny's core rule for avoiding confident-but-broken PRs.
130	- [[Question-Led Selling Arc]] — Synthesis of SPIN / Sandler / NEPQ / Oren Klaff / Chris Do into a four-step ask-don't-pitch arc (problem → change → cost → worth) plus a button-driven profiling block. Cross-project pattern for solution-selling sites' stage-2 discovery flow.
131	- [[Frontier Model Extraction Strategy]] — Frontier judgment required to *create*, ordinary intelligence sufficient to *use*. The irreversibility filter test: "Can a cheaper model redo this tomorrow?" Basis for the Learning Law in root CLAUDE.md.
132
133	## Reference
134	- [[Local Coding Model Benchmarks]] — 🔁 auto-maintained leaderboard for local (LM Studio/MLX) and cloud coding models on the `evals/local-code` gate, synced from `projects/` on every benchmark run. Includes a vetted list of where to source new local-model candidates (Aider Polyglot, LiveBench, model-discover.sh, aidatatools/ollama-benchmark) and a list of low-trust SEO leaderboards to avoid.
135	- [[Coding Agent Behavior Guide]] — INTJ-A derived instructions for coding agents working with James. Communication style, autonomy rules, pushback expectations, blindspot compensations.
136	- [[Ingestion Pipeline Patterns]] — 6 cost/quality optimization patterns for the wiki ingest pipeline: QFS, chapter chunking, map-reduce, tiered models, prompt caching, RAPTOR. Includes Phase 1–3 implementation order.
137	- [[Instagram Reel Transcription Pipeline]] — agent-browser + OpenAI Whisper pipeline for overnight reel-to-transcript processing. ~$0.003–$0.008/reel.
138	- [[Shared Vault Mount Guide]] — Step-by-step for mounting a shared host directory into multiple NanoClaw agent containers. `additionalMounts` config, allowlist setup, restart flow.
139	- [[Ryan Carson Tool Usage Notes]] — Detailed "how he actually uses it" notes for each tool from the May 24 episode (OpenClaw, Devin, Codex, Claude Code, Sentry, Tailscale, ClawChief).
140
141	## People
142	- [[James Lopez]] — Owner of this wiki. INTJ-A, mobile engineer (LinkedIn iOS), Austin TX. Full personality profile and background.
143	- [[Ramón Lopez]] — James's brother. Sr. Director Digital Manufacturing Architecture at Jabil. 25+ yrs medical device quality (FDA/ISO 13485). Domain expert persona for qip-qien.
144	- [[Ryan Carson]] — 5x founder, building Untangle solo with AI agents.
145	- [[Peter Yang]] — Host of Behind the Craft podcast.
146	- [[Dan Shipper]] — Co-founder of Every. Author of "After Automation."
147	- [[Andrej Karpathy]] — AI researcher and educator. High-signal source on frontier model capability and workflow ergonomics.
148	- [[Simon Willison]] — Developer and LLM tooling analyst. High-signal source on evals, sandboxing, cost accounting, and practical AI tools.
149	- [[Nathaniel Whittemore]] — Host of The AI Daily Brief.
150	- [[Ravi Mehta]] — AI instructor, ex-CPO Tinder. Created 3-layer context engineering system.
151	- [[Boris Cherny]] — Head of Claude Code at Anthropic.
152	- [[Alex Kantrowitz]] — Host of Big Technology Podcast.
153	- [[Gael Breton]] — Co-founder, Authority Hacker. Small biz AI automation practitioner.
154	- [[Mark Webster]] — Co-founder, Authority Hacker.
155	- [[Nufar Gaspar]] — Co-host, The AI Daily Brief.
156	- [[Delba de Oliveira]] — MTS Claude Code engineer at Anthropic. Created "Claude Code Patterns: Feedback loops" video — Cherny's cited breakdown of self-verification.
157	- [[Josh Pigford]] — Solo founder building 5 apps with AI agents. Creator of /but-for-real, /adversarial-code-review, /build, /learnings skills.
158	- [[Max Junestrand]] — Founder/CEO of Legora. Building AI-native OS for legal teams on Claude.
159
160	## Sources
161	- [[AI Daily Brief - The 4 AI Team Members Execs Should Hire Right Now]] — May 25, 2026. Framework for 4 agent roles leaders should implement.
162	- [[Instagram - hegetfunds - Claude Code Team of Developers]] — May 6, 2026. Using plugins/skills to assign specialist developer roles in Claude Code.
163	- [[Authority Hacker - Claude Code Setup Roast]] — May 21, 2026. 5-month setup audit: CLAUDE.md, folder structure, drift problem.
164	- [[Big Technology Podcast - Boris Cherny Claude Code]] — May 20, 2026. Claude Code growth, tokenmaxxing, agents beyond coding.
165	- [[Behind the Craft - Ryan Carson Episode]] — May 24, 2026. Tools for running a solo startup with AI agents.
166	- [[Behind the Craft - Ravi Mehta Context Engineering]] — May 3, 2026. 3-layer context engineering system with live demo.
167	- [[AI Daily Brief - Why Agents Still Need Humans]] — May 24, 2026. Covers Dan Shipper's After Automation essay.
168	- [[Dan Shipper - After Automation Essay]] — May 21, 2026. Why AI creates more expert human work, not less.
169	- [[Cheeky Pint - Dario Amodei Interview]] — Aug 6, 2025 (ingested May 30, 2026). Dario Amodei on Anthropic's business model, market structure, AGI-pilled products, the AI UI problem, regulation, and how he uses AI.
170	- [[Behind the Craft - Josh Pigford AI Skills Stack]] — May 31, 2026. Solo founder's exact AI skills: /build, /adversarial-code-review, /but-for-real (self-audit), /learnings. Transcript pending.
171	- [[CWC - Problem Solvers Max Junestrand Legora]] — June 2, 2026. Legora's bet on Claude as AI-native legal OS. "Raises the tide" model thesis.
172	- [[Authority Hacker - Claude Opus 4.8 Review]] — May 29, 2026. What changed: 4.7 regression fixed, more honest, 4x fewer logic errors in code. Full transcript pending.
173	- [[Claude Blog - Dynamic Workflows in Claude Code]] — June 2, 2026. Claude writes its own JS harness on the fly (`ultracode`). 6 patterns: classify-and-act, fan-out-and-synthesize, adversarial verification, generate-and-filter, tournament, loop-until-done.
174	- [[Claude Blog - Introducing Dynamic Workflows]] — May 28, 2026. Announcement post: availability, plan tiers, Bun Zig→Rust case study (750K lines, 11 days, 99.8% tests passing).
175	- [[Claude Blog - Managed Agents Self-Hosted Sandboxes]] — May 19, 2026. Sandbox providers: Cloudflare, Daytona, Modal, Vercel. MCP Tunnels for private-network MCP servers.
176	- [[Claude Blog - Founders Playbook]] — May 14, 2026. 4 AI-remapped startup stages + Chat/Cowork/Claude Code tool selection matrix. PDF download available.
177	- [[Claude Blog - Running an AI-Native Engineering Org]] — June 3, 2026. Fiona Fung on JIT planning, killing obsolete processes, metrics, and blurred roles.
178	- [[Claude Blog - Lessons from Building Claude Code How We Use Skills]] — June 3, 2026. Thariq Shihipar: 9 skill categories, best practices, distribution models, measurement via PreToolUse hooks.
179	- [[Claude Blog - Claude Cowork Product Guide]] — June 5, 2026. Official product guide: 7 workflow templates, permissions model, plugin usage, 3-tool selection matrix. eBook available.
180	- [[X AI Signal Sweep - 2026-06-09]] — Seed sweep for the regular X source. Captures Karpathy, Simon Willison, Dan Shipper, Ethan Mollick, and Claude Fable 5 / Mythos field reports.
181	- [[Claude Blog - Best Practices for Claude Cowork]] — June 3, 2026. Chat vs Cowork vs Claude Code matrix. 5 ingredients of a Cowork task. Context > prompt quality.
182	- [[Claude Blog - Self-Service Data Analytics with Claude]] — June 3, 2026. 3 failure modes + 4-layer architecture for agentic analytics. 95% query automation at 95% accuracy.
183	- [[0xchromium - Claude Workflows That Run Without You]] — June 4, 2026. 4-part workflow anatomy (Role/Tools/Trigger/Output), 12 workflow templates by role, 5-step build process, copy-paste morning briefing prompt.
184	- [[Andrej Karpathy - How I Use LLMs]] — Feb 27, 2025. 2h11m practical guide: zip-file mental model, LLM council approach, model selection matrix, tool integration hierarchy. Full chapter list.
185	- [[Claude Blog - Claude for Foundation Models]] — June 8, 2026. Swift package for hybrid Apple apps: on-device model + Claude handoff. iOS/macOS 27+, typed Swift inputs, streaming to SwiftUI.
186	- [[Claude Blog - Connector Observability]] — June 8, 2026. Performance dashboards (active users, tool calls, latency by tool) for published MCP connectors. In-app directory submission. Public beta.
187	- [[Reddit - Depureco MCP Case Study]] — June 2026. Depureco (Italian industrial vacuum manufacturer) connected product catalog to Claude via Remote MCP. Key insight: grounded AI becomes more humble and asks better questions — directly applicable to qip-qien and any regulated/safety-critical B2B tool.
188	- [[Mountain Movers - Boris Cherny Loop Definition]] — June 2026. Cherny's 3-stage engineer evolution + definition of a loop as a program that prompts, reads, evaluates, re-prompts. Hard stops, skills vs. plumbing distinction, cost reality (Uber $1,500/mo cap).
189	- [[Claude Blog - Building With Claude Managed Agents]] — June 10, 2026. Foundational engineering post: decoupled harness/sandbox architecture (p50 ~60% / p95 >90% latency reduction), Dreaming (scheduled memory refinement), Outcomes (agent self-grading), context anxiety history, three-phase evolution, when-to-use guidance.
190	- [[Claude Blog - Whats New in Claude Managed Agents]] — June 9, 2026. Two new public beta features: scheduled deployments (cron, no infra) and env vars in vaults (credential injection at network boundary). Customer examples: Rakuten, Notion, Browserbase, Milana.
191	- [[Alpha Batcher - Boris Cherny 5-Day Claude Code Setup]] — June 9, 2026. 5-day progressive setup ladder from Boris Cherny's loop philosophy. Includes embedded "Reflecting on a year of Claude Code" video (18 min) with Cherny & Cat Wu.
192	- [[Boris Cherny - Self-Verification Loops]] — June 9, 2026. Cherny's own statement: self-verification is the mechanism that enables longer autonomous runs. Cites ClaudeDevs video by Delba de Oliveira (839K views).
193	- [[DCBitMax - Bitcoin Power Law Out-of-Sample Test]] — June 10, 2026. Out-of-sample validation of Bitcoin Power Law using Claude Opus 4.8. Froze model at 2016 → 10-year mean residual −0.05σ. Same validation methodology applies to congressional-trading.
194	- [[AdiiX - Claude Trading Bot Architecture]] — June 9, 2026. 7.1M views. Claude Code writes trading logic; Claude Cowork sends 7am/9pm daily briefings. Multi-asset: SPX/NDX mean reversion (15m), crypto momentum (1h), commodities trend (4h). ATR sizing + correlation filter. No repo — marketing post. Architecture applicable to tradingbot25 and congressional-trading.
195	- [[Claude Blog - Field Guide to Claude Fable]] — July 6, 2026. Thariq Shihipar. 4-quadrant unknowns framework, 8 elicitation techniques (blind spot pass, interview mode, reference prompting, implementation plan, explainer, quiz). Core claim: with Fable, output quality is now bottlenecked by user clarity, not model capability.
196	- [[Claude Blog - Marketing Ops Cowork Automation]] — July 8, 2026. Anthropic's own marketing ops team. Dispatcher-specialist architecture, audit agent pattern, skill refinement loops. Concrete Cowork workflow patterns applicable to qip-qien and nanoclaw.
197	- [[Claude Blog - Cognition Claude Fable 5]] — July 10, 2026. Silas Alberti (Cognition SVP of Research). Production validation: 8h overnight autonomous runs, 3× improvement on Frontier Code hardest subset (30% vs 10% prior Opus), honest uncertainty, tool use under noise.
198	- [[Claude Blog - Working at the Frontier Cursor]] — July 17, 2026. Cursor's evaluation of Fable 5: 72.9% on CursorBench. Global vs local reasoning framing: Fable figures out what B is when you don't know; lighter models for when B is clear. Route by problem ambiguity, not just complexity.
199	- [[Claude Blog - CISO Guide to Agentic AI]] — July 17, 2026. Jason Clinton (Anthropic Deputy CISO). Four-question agent assessment framework + seven governance requirements. Service account vs human credential agents. Key: shadow adoption is worse than governed adoption; design for model capability in 6 months, not today.
200	- [[Claude Blog - AI Code Migration]] — July 16, 2026. Large-scale code migration in days using multi-agent loops. Core insight: "You don't fix the code. You fix the process (loop) that produced the code." Six-step process, real proof: Bun 1M-line Zig→Rust (2 weeks), Python→TS 165k lines (weekend).
201	- [[Claude Blog - Fable 5 in Claude Cowork]] — July 16, 2026. Josefina Albert (Anthropic Education). New Fable 5 Cowork features: adjustable effort settings, transparent planning panel, multi-day context retention. Delegation model: define done, hand off, review outputs.
202	- [[Claude Blog - Datadog Universal Machine Tool for Claude Code]] — July 21, 2026. How Datadog built Temper: agents emit specifications, a deterministic kernel verifies + executes them. Spec = proof artifact = running artifact. Verification cascade (symbolic → exhaustive state → simulation → property testing). "Dark factory" for autonomous agentic systems.
203	- [[Claude Blog - AI-Native SDLC Security]] — July 21, 2026. Jason Clinton (Anthropic Deputy CISO). How Anthropic secures a lifecycle where Claude authors ~80% of merged code: context-connected PSR agents, CLAUDE.md/skill feedback loops, narrow multi-agent PR review, continuous AI DAST, single-purpose agent identities, SIEM-audited governance.
204	- [[X - 0xRafy - Graph Engineering with Claude]] — July 21, 2026. @0xRafy. Dense 11-step playbook: loop → graph. 4 building blocks, 5 patterns, model tiering (Haiku router / Sonnet builder / Opus gate), state discipline, fallback paths, full customer-support ticket example. No framework required.
205
206	[[Wiki Ingest Log]]
207

# Wiki Index

A catalog of everything in this knowledge base. Updated by Nano on every ingest.

## Tools & Software
*Guest-endorsed or actively used — not sponsors.*
- [[Agent Browser]] — Vercel Labs Rust CLI for AI-driven browser automation. Credential vault, accessibility-tree refs, React introspection, HAR recording.
- [[Devin]] — AI coding agent by Cognition. 15-thread code factory model.
- [[OpenClaw]] — Open-source AI executive assistant / chief of staff.
- [[ClawChief]] — Ryan Carson's open-sourced OpenClaw chief-of-staff config.
- [[Claude Code]] — Anthropic's coding agent. Ryan Carson's preferred coding tool.
- [[Codex]] — OpenAI's coding agent / browser testing tool.
- [[Sentry]] — Error monitoring. Used with Devin for automated bug triage.
- [[Tailscale]] — WireGuard mesh network. Used for remote access to Mac Mini services from phone. Includes full recipe for exposing any local port via `tailscale serve` + launchd.
- [[Figma]] — Design/wireframing. Visual context layer in Ravi Mehta's system.
- [[AgentsView]] — Agent token/cost accounting tool. Useful when new frontier-model pricing appears before dashboards and pricing databases catch up.
- [[Teach Skill]] — `/teach` by Matt Pocock. ZPD-based personalized tutor with persistent learning records. Trigger-based (no idle context cost). Claude Code only. Install: `npx skills add mattpocock/skills --skill teach`.

## Anthropic Official Repos & Resources
*Official Anthropic repositories — tools, SDKs, plugins, and reference implementations.*
- [[Anthropic Skills Repo]] — Reference implementations of the Claude Agent Skills system. Template for building custom skills.
- [[Claude Plugins Official]] — Anthropic's curated plugin marketplace for Claude Code. Install via `/plugin install`.
- [[Ralph Loop Plugin]] — Stop-hook-based autonomous iteration loop. Feeds Claude the same prompt until it outputs a completion promise. For well-defined tasks with clear success criteria and automatic verification.
- [[Hookify Plugin]] — Create Claude Code hooks from natural language. `/hookify warn me when I use rm -rf` → working hook instantly. No hooks.json editing required.
- [[Knowledge Work Plugins]] — 18 open-source role-specific plugins (sales, legal, finance, design, engineering, HR, ops, etc.) built on Claude Agent SDK.
- [[Claude for Legal]] — Deep legal workflow plugin suite (transactional + litigation + learning). Integrates with Westlaw, CourtListener.
- [[Claude for Life Sciences]] — Research marketplace: PubMed, BioRender, Synapse, Consensus + RNA-seq/Nextflow skills.
- [[Claude for Healthcare]] — Healthcare marketplace: FHIR developer, prior-auth review, clinical trial protocols + CMS/NPI servers.
- [[Claude for Financial Services]] — 10 named agents (Pitch Agent, GL Reconciler, Market Researcher, KYC Screener, etc.) + 9 vertical skill bundles (IB, ER, PE, WM, fund admin). Deployable as Cowork plugins or Managed Agent templates.
- [[Managed Agents]] — Anthropic's hosted agent orchestration platform. Self-hosted sandbox option (tool execution on your infra via outbound-polling worker), mid-session tool/MCP updates, large MCP output auto-offload. Scheduled deployments (cron, no custom infra). Env vars in vaults (credentials injected at network boundary). Opus 4.8 tool-description guidance included.
- [[Claude Agent SDK Demos]] — 8 local demo apps showcasing Claude Agent SDK patterns (multi-agent, streaming, email, docs).
- [[Anthropic SDK Go]] — `go get anthropic-sdk-go@v1.56.0`. Go 1.24+. Type-safe Claude API client for Go: model constants, context support, standard Go idioms.
- [[Anthropic SDK Java]] — `com.anthropic:anthropic-java:2.49.0`. Java 8+. Maven/Gradle. Builder-pattern Claude API client for JVM applications.
- [[Claude Agent SDK TypeScript]] — `npm install @anthropic-ai/claude-agent-sdk`. Node.js 18+. Renamed from Claude Code SDK.
- [[Claude Agent SDK Python]] — `pip install claude-agent-sdk`. Python 3.10+. In-process MCP servers, hooks as Python functions, CLI bundled in wheel.
- [[Claude Cookbooks]] — Copy-paste code recipes and notebooks for Claude API (RAG, tool use, multimodal, agents).
- [[Claude Quickstarts]] — Production-ready starter projects: customer support, computer use, browser automation, coding agent.
- [[Anthropic Courses]] — 5-course official curriculum: API fundamentals → prompt engineering → real-world prompting → evals → tool use. Jupyter notebooks.
- [[Anthropic Prompt Engineering Tutorial]] — 9-chapter interactive prompt engineering course with exercise playgrounds. Available direct API and Amazon Bedrock variants.
- [[Claude Code Action]] — GitHub Action that brings Claude into PR review and CI/CD workflows.
- [[Defending Code Reference Harness]] — Reference impl for autonomous vuln discovery + human-reviewed patching. gVisor-sandboxed agents. Not actively maintained; Claude Security is the hosted version.
- [[Scone Bench]] — 417-task benchmark for evaluating LLM agents on smart-contract vuln discovery/exploitation. Historical DeFi incidents, MCP-based, Docker-sandboxed. From Anthropic Red Team.
- [[Claudes C Compiler]] — Claude Opus 4.6 wrote a dependency-free C compiler in Rust from scratch. Compiles PostgreSQL, SQLite, Linux kernel, FFmpeg. Capability showcase, not production-validated.
- [[Anthropic Performance Take-Home]] — Open version of Anthropic's original performance engineering take-home. Optimize a VLIW SIMD kernel; Claude Opus 4.5 scored 1,363 cycles vs 147,734 baseline (108× improvement).
- [[Claude Code Security Review]] — GitHub Action that auto-scans PRs for security vulnerabilities using Claude.
- [[Claude Desktop Buddy]] — ESP32 desk pet + Bluetooth API reference for makers integrating with Claude Desktop.
- [[HTML Effectiveness Examples]] — Anthropic's reference collection of single-file HTML artifacts (slide decks, dashboards, editing UIs, diagrams).
- [[Claude Code Setup Plugin]] — Official Anthropic plugin that scans your codebase and recommends tailored hooks, skills, MCP servers, subagents, and plugins. Read-only, 1-2 recs per category.
- [[Claude Code Monitoring Guide]] — Prometheus + OpenTelemetry toolkit for tracking Claude Code ROI, token spend, and team adoption.
- [[GitHub MCP Server]] — GitHub's official MCP server.
- [[PineForge MCP]] — Hosted MCP server for real Pine Script v6 backtests. `claude mcp add --transport http pineforge https://mcp.pineforge.dev/mcp`. No key/signup. 245/246 TradingView parity, 100 backtests/week, 13mo Binance data. Docker route for unlimited/custom data. 60+ tools: repos, issues, PRs, code search, security scanning.
- [[Devcontainer Features]] — One-line devcontainer.json feature that installs Claude Code CLI in any dev container.
- [[Claude Code Routines]] — Scheduled/triggered cloud automation. Runs on Anthropic infrastructure, not your machine. `/schedule` command, API + GitHub + time triggers. Research preview.
- [[Long-Running Agent Primitives]] — 3 core primitives (Default-FAIL, Fresh-context evaluator, Handoff) + 2 operator hooks (kill switch, STEER.md). From Anthropic's own patterns.
- [[Claude Code Migration Kit]] — Official Anthropic toolkit for large-scale language migrations. 8 sequential prompts (00-feasibility → 06-post-parity), templates (RULEBOOK.md, manifest.tsv, inventory.tsv, cost-log.tsv, settings.json), scripts (dependency mappers, queue runners, build daemons). Companion to the AI Code Migration blog post. Operationalizes [[Rulebook-Driven Migration Loop]].
- [[Claude Plugins Community]] — Community plugin marketplace (security-reviewed). Submit at clau.de/plugin-directory-submission.
- [[Anthropic CLI]] — `ant` CLI for the Claude Developer Platform API. `brew install anthropics/tap/ant`.
- [[Anthropic CWC Workshops]] — 8 Code-with-Claude workshop curricula: Managed Agents, memory primitives (Dreaming Service), eval-driven dev, multi-agent decomposition, Deal Desk reference impl.
- [[Agent SDK Workshop]] — Hands-on workshop for Claude Agent SDK: 4-stage guided demo (chat → tools → subagents → memory) + breakout scenarios. Python 3.10+, flip switches in config.py.
- [[Long-Horizon Coding Agent Demo]] — Archived AWS re:Invent 2025 demo. GitHub issue → agent builds full-stack app → CloudFront preview → human approval gate. Bedrock AgentCore + Claude Agent SDK.
- [[Claude Foundation Models Swift Package]] — Swift package for hybrid Apple-platform apps: on-device model for fast/private tasks, Claude for reasoning + web search. iOS 27+, SPM install. Announced June 2026.
- [[Claude Tag Plugins]] — 19 SaaS integration plugins (Jira, Linear, Snowflake, Salesforce, Sentry, Datadog, etc.) via Claude Tag CLI. Credentials injected at runtime; install only what you need.
- [[Launch Your Agent]] — Claude Code skill that guides a founder from raw idea to live Claude Managed Agent: interview → scope → deploy → grade → schedule. One session, costs cents.
- [[Claude Fable 5 and Mythos 5]] — Anthropic's latest frontier models. Always-on adaptive thinking, new tokenizer (~30% more tokens), refusal stop reason + SDK fallback middleware, 30-day data-retention requirement. Fable 5 = GA; Mythos 5 = Preview.

## Third-Party Tools & Platforms
- [[Supertonic]] — On-device TTS. 66M params, ONNX, MIT license. 167× realtime on M4 Pro. Zero cost, zero cloud. Drop-in OpenAI TTS API compatible. Primary use case: StageHand narration replacing ElevenLabs.
- [[Legora]] — AI-native operating system for legal teams. Autonomously plans, executes, reviews, and completes complex legal work end-to-end. Built on Claude. "Raises the tide" model: improves with each Claude release.

## Sources (Talks, Posts, Papers)
- [[Claude CwC - The Prompting Playbook]] — Margot van Laar (Anthropic), CwC London 2026. Eval-first, XML structure, delete legacy patches, tools > instructions, Generator→Evaluator→Repairer loop.

## Concepts & Reference Docs
- [[Test Isolation for Runtime Activity Logs]] — Prevent orchestration tests from polluting live alert/error/state feeds by redirecting module-level runtime paths to `tmp_path`, then prove production logs are unchanged by the suite.
- [[LaunchAgent Quarantine and Tailscale Recovery]] — Recover a reboot-stalled local site by clearing the LaunchAgent quarantine and re-bootstrapping it, then separately reconnecting Tailscale and verifying both local and public routes.
- [[Orthogonal Visual Channels on Map Lines]] — Don't recolor a line to encode a boolean when color already carries a scalar; add a near-black dotted overlay (Mapbox: short dash + round cap, dasharray units are line-widths so zoom-scaling is free). Plus a puppeteer pattern for E2E-verifying map layers via the app's own custom events.
- [[CLAUDE.md Progressive Disclosure]] — Every-session context files hold only always-relevant rules; situational procedures move to `.claude/docs/` behind trigger-phrased pointers. Measure per-section cost first; add a size budget against regrowth.
- [[Claude Constitution]] — Anthropic's foundational values document. CC0 licensed. January 2026.
- [[Agentic UI Impedance Mismatch]] — Dario Amodei's framing: agents will complete tasks end-to-end most of the time, but humans need deep-dive inspection capability for the exceptions. No product solves this yet.
- [[Claude Code Subagents]] — Separate Claude instances with their own context windows. 5 copy-paste templates (reviewer, test-writer, doc-writer, security, pr-writer). Route to Sonnet for 5× cost savings.
- [[WebMCP]] — Chrome's proposed web standard for exposing structured tools to AI agents. Declarative HTML annotations + JS API replace fragile UI actuation. Origin trial in Chrome 149.
- [[But For Real Skill]] — Self-audit pattern: follow-up prompt that assumes bugs are present and bullies the AI into finding them. Simulates PR code review. From Josh Pigford's solo-founder skills stack.
- [[Claude Code Agent Teams]] — Native experimental feature: Team Lead + Teammates model with shared task list, dependency management, plan approval, and hooks. Enable via env flag. Claude Code only (no Codex/Aider).
- [[Claude Code Dynamic Workflows]] — Claude writes its own JS orchestration harness on the fly (`ultracode` keyword). 6 patterns: classify-and-act, fan-out-and-synthesize, adversarial verification, generate-and-filter, tournament, loop-until-done. Opus 4.8 era.
- [[Finding Your Unknowns Framework]] — Pre-flight protocol for agentic work. 4-quadrant unknowns model (Known/Unknown × Knowns/Unknowns) + 8 elicitation techniques (blind spot pass, interview mode, reference prompting, implementation plan, explainer artifact, quiz mode). Fable-era shift: user clarity is now the bottleneck, not model capability.
- [[AI-Native Engineering Org]] — Fiona Fung (Claude Code eng director): JIT planning, Claude reviews style/bugs/humans review domain, kill obsolete processes, track ramp time + PR cycle time + Claude-assisted commit rate.
- [[Claude Code Skills Best Practices]] — Thariq Shihipar: 9 skill categories, Gotchas sections, progressive disclosure via file system, trigger keywords, `${CLAUDE_PLUGIN_DATA}` memory, on-demand hooks. From Anthropic's own usage.
- [[X AI Signal Ingestion Source]] — Regular monitored X source for high-signal AI voices. Uses browser-visible/public pages only; no credential extraction or social-account side effects.
- [[NanoClaw Slack Mention-Sticky Session Bug]] — Two stacked router bugs made a documented `session_mode='shared'` config inert on threaded adapters (Slack/Discord): a forced per-thread coercion, plus a sticky-engagement check that always did an exact-thread lookup regardless of the wiring's actual session mode. Fix makes `mention-sticky` self-bootstrapping: first message creates the shared session, every message after keeps engaging.
- [[NanoClaw REST Fallback Tool-Call Hallucination]] — A toolless LM Studio/Codex fallback rung hallucinated fake tool-call tags (`<read_file .../>`) instead of admitting it had no tools, and the existing `<message>`-block validation only checked the wrapper, not the content, so raw tag soup reached the user. Fixed with an output-side allowlist check + corrective retry + honest fallback, deliberately without over-fitting the routing heuristic.
- [[Hermes Provider Fallback Config]] — Configure Hermes LLM quota failover with top-level `fallback_providers`; put LM Studio first for cloud usage-limit failures, include only authenticated providers, and use Hermes' fallback CLI/runtime/gateway tests as evidence.
- [[Cowork Dispatcher-Specialist Pattern]] — Dispatcher routes intake → specialist agents execute → independent audit agent verifies → human reviews. Skills as living systems: corrections loop back into skill instructions. Applicable to qip-qien triage, nanoclaw agent architecture, and signal-routing in trading projects.
- [[Frontier Code Evaluation]] — Use your best engineers to test models on real production work; gate on "Would I keep this code?" Cognition's internal benchmark showed 3× Fable 5 improvement over prior Opus on their hardest subset.
- [[Cross-Agent Session State]] — A gitignored `.agent-state/session.md` Markdown handoff lets Claude Code, Codex, Antigravity, Grok, and local agents resume interrupted work from shared evidence-based state.
- [[Eval-Routed Local-First Code Delegation]] — Use a standing eval's machine-readable routing block to pick the cheap local default, per-task exceptions, and cloud-only task classes instead of guessing model choice.
- [[Freshness-Fit-Eval Model Radar]] — Separate external freshness discovery, hardware fit scoring, and local eval verdicts so a proxy scorer can help candidate selection without silently becoming the promotion metric.
- [[Productization and Pricing Research Concierge Reel Workflow]] — Stagehand go-to-market memo: sell a concierge reel retainer first, keep Telegram as intake, run locally until 2-3 paying clients, and charge for reviewed outcomes rather than raw AI access.
- [[Rulebook-Driven Migration Loop]] — Fix the translation rulebook → regenerate the affected batch, not individual files. Loop: Rulebook → Batch Generator → Output Files → Compiler/Tests → Error Feedback → Fix rule. Includes work-queue via file existence (resumable), build daemons, advisory model split (Fable 5 judgment + Opus workhorse), parity harnesses.
- [[Named-But-Unbuilt Skill References in CLAUDE.md]] — A CLAUDE.md line can *describe* a primitive (`get-from-secondbrain`/`add-to-secondbrain`) convincingly enough that no one checks it exists. Verify any named skill/script actually resolves to a file before trusting the instruction.
- [[Layer-Matrix Verification for Multi-Layer Rendering Bugs]] — When a visible feature is composited from several rendering layers, write the intended predicate per layer × mode as an explicit matrix, apply it atomically, and verify against the live rendered state (not a unit test) — watch for stale production builds.
- [[Default-Off for Heavy Optional Background Features]] — If an optional feature's real implementation is heavyweight (hidden webview, continuous polling) relative to the app's baseline cost, default it off; an opt-out toggle alone still exposes users who never read settings.
- [[A Reported Click Does Nothing Bug Can Be An Off-Screen Render]] — "clicked and nothing happened" can mean the state update is correct but the result rendered off-screen (e.g. a mobile reflow) — verify state changed and re-test at the actual breakpoint before concluding the handler is broken.
- [[Symlink Hijack in Skill Updaters]] — Any auto-updating CLI with write access to shared agent config can relink every agent's skill dir under `$HOME`, indistinguishable from a supply-chain attack. Decouple detection (sandboxed `HOME`+`PATH`, not just the tool's own scoping flag) from adoption.
- [[Converge on One Canonical Engine]] — Two agents each defaulting to their own implementation path for the same capability diverges silently until outputs are compared. Root cause is usually an asymmetric instruction file (e.g. `AGENTS.md` with no mirrored `CLAUDE.md`); fix with a guardrail test on file symmetry, not just better docs.
- [[Specification-First Agentic Development]] — Agents emit specs, not code; a deterministic kernel verifies + executes. No drift between proof and production. Verification cascade: symbolic reasoning → exhaustive state exploration → deterministic simulation → property testing. Applies when agent throughput exceeds human review capacity.
- [[Graph Engineering Patterns]] — 5 multi-agent graph patterns (sequential chain, router, parallel fan-out, loop-with-gate, human-in-the-loop) + 4 building blocks (Node, Edge, Router, State) + model tiering (Haiku router, Sonnet builder, Opus gate). A loop is an agent; a graph is a team. No framework required.
- [[AI-Native SDLC Security Loop]] — When agents author/review most code, security shifts from reviewing outputs to governing loops: context-connected planning, instruction feedback, narrow reviewer agents, risk-tiered gates, separated identities, and auditable telemetry.

## 📢 Sponsor-only mentions
*Paid placements — not guest endorsements. Pages exist for reference.*
- [[Granola]] — AI meeting notes (Behind the Craft sponsor)
- [[Wispr Flow]] — Voice dictation (Behind the Craft sponsor)
- [[Linear]] — Project management / AI agent platform (Behind the Craft sponsor)

## Frameworks & Mental Models
- [[Apple Widget Rendering Modes]] — How to design SwiftUI widgets that work in both full-color and monochrome/accented modes (macOS, iOS, watchOS). Luminance zones, arc opacity, adaptive line colors, and `widgetAccentedRenderingMode`.
- [[WidgetKit Engineering Pitfalls]] — Infrastructure and data-layer pitfalls: intent-type orphaning, chronod descriptor caching, provider-data siloing, weekly-exhausted 5H row rules (0% + weekly reset + blank chart), and the early-cap reset pattern.
- [[Mac Widget Runtime Verification Loop]] — Layered macOS WidgetKit validation: active target membership, render tests, installed AppIntents metadata, chronod cache refresh, and desktop screenshot proof.
- [[Human Sandwich Model]] — Human frames → AI executes → Human judges. Dan Shipper's model for human-AI collaboration.
- [[Screenshot-First Visual Verification]] — Screenshots are the only ground truth for visual UI work; code correctness ≠ visual correctness.
- [[3-Layer Context Engineering System]] — Functional + Visual + Data layers for polished AI prototypes. Ravi Mehta's framework.
- [[Tokenmaxxing]] — Accusation that AI companies inflate token metrics; Boris Cherny's 250% productivity rebuttal.
- [[Saaspocalypse]] — Thesis that agents erode SaaS switching costs. Boris Cherny's nuanced take via Seven Powers.
- [[Claude Code Drift Problem]] — Config entropy at ~5 months: stale CLAUDE.md, bad folder structure, manual triggers that should be routines.
- [[4 AI Digital Employees Framework]] — 4 agent roles to "hire": Research Analyst, Strategic Advisor, Communication Specialist, Operations Manager.
- [[Friction-First Development]] — 6-principle philosophy for personal tool building: scratch your own itch, define the friction before the code, resist market-bias. Includes a pre-code Problem & Friction Analysis template.
- [[Devin vs Claude Code]] — Head-to-head comparison: philosophy, SWE-Bench (80.8% vs 13.86%), billing model, failure modes. Verdict: Claude Code wins for James's current stage.
- [[Frontier Model Qualitative Step Change]] — Pattern for treating credible practitioner reports as eval triggers when a model feels like a major-version jump on long tasks.
- [[Builder-Verifier Loop Pattern]] — Every code-writing loop needs a separate verifier running the real app. Builder makes the change; Verifier confirms feature correctness; you read the diff. Boris Cherny's core rule for avoiding confident-but-broken PRs.
- [[Question-Led Selling Arc]] — Synthesis of SPIN / Sandler / NEPQ / Oren Klaff / Chris Do into a four-step ask-don't-pitch arc (problem → change → cost → worth) plus a button-driven profiling block. Cross-project pattern for solution-selling sites' stage-2 discovery flow.
- [[Frontier Model Extraction Strategy]] — Frontier judgment required to *create*, ordinary intelligence sufficient to *use*. The irreversibility filter test: "Can a cheaper model redo this tomorrow?" Basis for the Learning Law in root CLAUDE.md.

## Reference
- [[Local Coding Model Benchmarks]] — 🔁 auto-maintained leaderboard for local (LM Studio/MLX) and cloud coding models on the `evals/local-code` gate, synced from `projects/` on every benchmark run. Includes a vetted list of where to source new local-model candidates (Aider Polyglot, LiveBench, model-discover.sh, aidatatools/ollama-benchmark) and a list of low-trust SEO leaderboards to avoid.
- [[Coding Agent Behavior Guide]] — INTJ-A derived instructions for coding agents working with James. Communication style, autonomy rules, pushback expectations, blindspot compensations.
- [[Ingestion Pipeline Patterns]] — 6 cost/quality optimization patterns for the wiki ingest pipeline: QFS, chapter chunking, map-reduce, tiered models, prompt caching, RAPTOR. Includes Phase 1–3 implementation order.
- [[Instagram Reel Transcription Pipeline]] — agent-browser + OpenAI Whisper pipeline for overnight reel-to-transcript processing. ~$0.003–$0.008/reel.
- [[Shared Vault Mount Guide]] — Step-by-step for mounting a shared host directory into multiple NanoClaw agent containers. `additionalMounts` config, allowlist setup, restart flow.
- [[Ryan Carson Tool Usage Notes]] — Detailed "how he actually uses it" notes for each tool from the May 24 episode (OpenClaw, Devin, Codex, Claude Code, Sentry, Tailscale, ClawChief).

## People
- [[James Lopez]] — Owner of this wiki. INTJ-A, mobile engineer (LinkedIn iOS), Austin TX. Full personality profile and background.
- [[Ramón Lopez]] — James's brother. Sr. Director Digital Manufacturing Architecture at Jabil. 25+ yrs medical device quality (FDA/ISO 13485). Domain expert persona for qip-qien.
- [[Ryan Carson]] — 5x founder, building Untangle solo with AI agents.
- [[Peter Yang]] — Host of Behind the Craft podcast.
- [[Dan Shipper]] — Co-founder of Every. Author of "After Automation."
- [[Andrej Karpathy]] — AI researcher and educator. High-signal source on frontier model capability and workflow ergonomics.
- [[Simon Willison]] — Developer and LLM tooling analyst. High-signal source on evals, sandboxing, cost accounting, and practical AI tools.
- [[Nathaniel Whittemore]] — Host of The AI Daily Brief.
- [[Ravi Mehta]] — AI instructor, ex-CPO Tinder. Created 3-layer context engineering system.
- [[Boris Cherny]] — Head of Claude Code at Anthropic.
- [[Alex Kantrowitz]] — Host of Big Technology Podcast.
- [[Gael Breton]] — Co-founder, Authority Hacker. Small biz AI automation practitioner.
- [[Mark Webster]] — Co-founder, Authority Hacker.
- [[Nufar Gaspar]] — Co-host, The AI Daily Brief.
- [[Delba de Oliveira]] — MTS Claude Code engineer at Anthropic. Created "Claude Code Patterns: Feedback loops" video — Cherny's cited breakdown of self-verification.
- [[Josh Pigford]] — Solo founder building 5 apps with AI agents. Creator of /but-for-real, /adversarial-code-review, /build, /learnings skills.
- [[Max Junestrand]] — Founder/CEO of Legora. Building AI-native OS for legal teams on Claude.

## Sources
- [[AI Daily Brief - The 4 AI Team Members Execs Should Hire Right Now]] — May 25, 2026. Framework for 4 agent roles leaders should implement.
- [[Instagram - hegetfunds - Claude Code Team of Developers]] — May 6, 2026. Using plugins/skills to assign specialist developer roles in Claude Code.
- [[Authority Hacker - Claude Code Setup Roast]] — May 21, 2026. 5-month setup audit: CLAUDE.md, folder structure, drift problem.
- [[Big Technology Podcast - Boris Cherny Claude Code]] — May 20, 2026. Claude Code growth, tokenmaxxing, agents beyond coding.
- [[Behind the Craft - Ryan Carson Episode]] — May 24, 2026. Tools for running a solo startup with AI agents.
- [[Behind the Craft - Ravi Mehta Context Engineering]] — May 3, 2026. 3-layer context engineering system with live demo.
- [[AI Daily Brief - Why Agents Still Need Humans]] — May 24, 2026. Covers Dan Shipper's After Automation essay.
- [[Dan Shipper - After Automation Essay]] — May 21, 2026. Why AI creates more expert human work, not less.
- [[Cheeky Pint - Dario Amodei Interview]] — Aug 6, 2025 (ingested May 30, 2026). Dario Amodei on Anthropic's business model, market structure, AGI-pilled products, the AI UI problem, regulation, and how he uses AI.
- [[Behind the Craft - Josh Pigford AI Skills Stack]] — May 31, 2026. Solo founder's exact AI skills: /build, /adversarial-code-review, /but-for-real (self-audit), /learnings. Transcript pending.
- [[CWC - Problem Solvers Max Junestrand Legora]] — June 2, 2026. Legora's bet on Claude as AI-native legal OS. "Raises the tide" model thesis.
- [[Authority Hacker - Claude Opus 4.8 Review]] — May 29, 2026. What changed: 4.7 regression fixed, more honest, 4x fewer logic errors in code. Full transcript pending.
- [[Claude Blog - Dynamic Workflows in Claude Code]] — June 2, 2026. Claude writes its own JS harness on the fly (`ultracode`). 6 patterns: classify-and-act, fan-out-and-synthesize, adversarial verification, generate-and-filter, tournament, loop-until-done.
- [[Claude Blog - Introducing Dynamic Workflows]] — May 28, 2026. Announcement post: availability, plan tiers, Bun Zig→Rust case study (750K lines, 11 days, 99.8% tests passing).
- [[Claude Blog - Managed Agents Self-Hosted Sandboxes]] — May 19, 2026. Sandbox providers: Cloudflare, Daytona, Modal, Vercel. MCP Tunnels for private-network MCP servers.
- [[Claude Blog - Founders Playbook]] — May 14, 2026. 4 AI-remapped startup stages + Chat/Cowork/Claude Code tool selection matrix. PDF download available.
- [[Claude Blog - Running an AI-Native Engineering Org]] — June 3, 2026. Fiona Fung on JIT planning, killing obsolete processes, metrics, and blurred roles.
- [[Claude Blog - Lessons from Building Claude Code How We Use Skills]] — June 3, 2026. Thariq Shihipar: 9 skill categories, best practices, distribution models, measurement via PreToolUse hooks.
- [[Claude Blog - Claude Cowork Product Guide]] — June 5, 2026. Official product guide: 7 workflow templates, permissions model, plugin usage, 3-tool selection matrix. eBook available.
- [[X AI Signal Sweep - 2026-06-09]] — Seed sweep for the regular X source. Captures Karpathy, Simon Willison, Dan Shipper, Ethan Mollick, and Claude Fable 5 / Mythos field reports.
- [[Claude Blog - Best Practices for Claude Cowork]] — June 3, 2026. Chat vs Cowork vs Claude Code matrix. 5 ingredients of a Cowork task. Context > prompt quality.
- [[Claude Blog - Self-Service Data Analytics with Claude]] — June 3, 2026. 3 failure modes + 4-layer architecture for agentic analytics. 95% query automation at 95% accuracy.
- [[0xchromium - Claude Workflows That Run Without You]] — June 4, 2026. 4-part workflow anatomy (Role/Tools/Trigger/Output), 12 workflow templates by role, 5-step build process, copy-paste morning briefing prompt.
- [[Andrej Karpathy - How I Use LLMs]] — Feb 27, 2025. 2h11m practical guide: zip-file mental model, LLM council approach, model selection matrix, tool integration hierarchy. Full chapter list.
- [[Claude Blog - Claude for Foundation Models]] — June 8, 2026. Swift package for hybrid Apple apps: on-device model + Claude handoff. iOS/macOS 27+, typed Swift inputs, streaming to SwiftUI.
- [[Claude Blog - Connector Observability]] — June 8, 2026. Performance dashboards (active users, tool calls, latency by tool) for published MCP connectors. In-app directory submission. Public beta.
- [[Reddit - Depureco MCP Case Study]] — June 2026. Depureco (Italian industrial vacuum manufacturer) connected product catalog to Claude via Remote MCP. Key insight: grounded AI becomes more humble and asks better questions — directly applicable to qip-qien and any regulated/safety-critical B2B tool.
- [[Mountain Movers - Boris Cherny Loop Definition]] — June 2026. Cherny's 3-stage engineer evolution + definition of a loop as a program that prompts, reads, evaluates, re-prompts. Hard stops, skills vs. plumbing distinction, cost reality (Uber $1,500/mo cap).
- [[Claude Blog - Building With Claude Managed Agents]] — June 10, 2026. Foundational engineering post: decoupled harness/sandbox architecture (p50 ~60% / p95 >90% latency reduction), Dreaming (scheduled memory refinement), Outcomes (agent self-grading), context anxiety history, three-phase evolution, when-to-use guidance.
- [[Claude Blog - Whats New in Claude Managed Agents]] — June 9, 2026. Two new public beta features: scheduled deployments (cron, no infra) and env vars in vaults (credential injection at network boundary). Customer examples: Rakuten, Notion, Browserbase, Milana.
- [[Alpha Batcher - Boris Cherny 5-Day Claude Code Setup]] — June 9, 2026. 5-day progressive setup ladder from Boris Cherny's loop philosophy. Includes embedded "Reflecting on a year of Claude Code" video (18 min) with Cherny & Cat Wu.
- [[Boris Cherny - Self-Verification Loops]] — June 9, 2026. Cherny's own statement: self-verification is the mechanism that enables longer autonomous runs. Cites ClaudeDevs video by Delba de Oliveira (839K views).
- [[DCBitMax - Bitcoin Power Law Out-of-Sample Test]] — June 10, 2026. Out-of-sample validation of Bitcoin Power Law using Claude Opus 4.8. Froze model at 2016 → 10-year mean residual −0.05σ. Same validation methodology applies to congressional-trading.
- [[AdiiX - Claude Trading Bot Architecture]] — June 9, 2026. 7.1M views. Claude Code writes trading logic; Claude Cowork sends 7am/9pm daily briefings. Multi-asset: SPX/NDX mean reversion (15m), crypto momentum (1h), commodities trend (4h). ATR sizing + correlation filter. No repo — marketing post. Architecture applicable to tradingbot25 and congressional-trading.
- [[Claude Blog - Field Guide to Claude Fable]] — July 6, 2026. Thariq Shihipar. 4-quadrant unknowns framework, 8 elicitation techniques (blind spot pass, interview mode, reference prompting, implementation plan, explainer, quiz). Core claim: with Fable, output quality is now bottlenecked by user clarity, not model capability.
- [[Claude Blog - Marketing Ops Cowork Automation]] — July 8, 2026. Anthropic's own marketing ops team. Dispatcher-specialist architecture, audit agent pattern, skill refinement loops. Concrete Cowork workflow patterns applicable to qip-qien and nanoclaw.
- [[Claude Blog - Cognition Claude Fable 5]] — July 10, 2026. Silas Alberti (Cognition SVP of Research). Production validation: 8h overnight autonomous runs, 3× improvement on Frontier Code hardest subset (30% vs 10% prior Opus), honest uncertainty, tool use under noise.
- [[Claude Blog - Working at the Frontier Cursor]] — July 17, 2026. Cursor's evaluation of Fable 5: 72.9% on CursorBench. Global vs local reasoning framing: Fable figures out what B is when you don't know; lighter models for when B is clear. Route by problem ambiguity, not just complexity.
- [[Claude Blog - CISO Guide to Agentic AI]] — July 17, 2026. Jason Clinton (Anthropic Deputy CISO). Four-question agent assessment framework + seven governance requirements. Service account vs human credential agents. Key: shadow adoption is worse than governed adoption; design for model capability in 6 months, not today.
- [[Claude Blog - AI Code Migration]] — July 16, 2026. Large-scale code migration in days using multi-agent loops. Core insight: "You don't fix the code. You fix the process (loop) that produced the code." Six-step process, real proof: Bun 1M-line Zig→Rust (2 weeks), Python→TS 165k lines (weekend).
- [[Claude Blog - Fable 5 in Claude Cowork]] — July 16, 2026. Josefina Albert (Anthropic Education). New Fable 5 Cowork features: adjustable effort settings, transparent planning panel, multi-day context retention. Delegation model: define done, hand off, review outputs.
- [[Claude Blog - Datadog Universal Machine Tool for Claude Code]] — July 21, 2026. How Datadog built Temper: agents emit specifications, a deterministic kernel verifies + executes them. Spec = proof artifact = running artifact. Verification cascade (symbolic → exhaustive state → simulation → property testing). "Dark factory" for autonomous agentic systems.
- [[Claude Blog - AI-Native SDLC Security]] — July 21, 2026. Jason Clinton (Anthropic Deputy CISO). How Anthropic secures a lifecycle where Claude authors ~80% of merged code: context-connected PSR agents, CLAUDE.md/skill feedback loops, narrow multi-agent PR review, continuous AI DAST, single-purpose agent identities, SIEM-audited governance.
- [[X - 0xRafy - Graph Engineering with Claude]] — July 21, 2026. @0xRafy. Dense 11-step playbook: loop → graph. 4 building blocks, 5 patterns, model tiering (Haiku router / Sonnet builder / Opus gate), state discipline, fallback paths, full customer-support ticket example. No framework required.

[[Wiki Ingest Log]]


Error: File content (27270 tokens) exceeds maximum allowed tokens (25000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.


I can see that line 107 in Home.md already has an entry: `[[AI-Native SDLC Security Loop]]` in the Concepts section, and line 203 already has: `[[Claude Blog - AI-Native SDLC Security]] — July 21, 2026. Jason Clinton (Anthropic Deputy CISO). How Anthropic secures a lifecycle where Claude authors ~80% of merged code: context-connected PSR agents, CLAUDE.md/skill feedback loops, narrow multi-agent PR review, continuous AI DAST, single-purpose agent identities, SIEM-audited governance.`
Let me verify whether the source and concept files are already present.


I can see entries already exist in Home.md (lines 107 and 203) for this post. Let me check if the wiki files actually exist.


Glob

**/wiki/sources/Claude Blog - AI-Native SDLC*


/workspace/extra/second-brain/wiki/sources/Claude Blog - AI-Native SDLC Security.md


/workspace/extra/second-brain/wiki/concepts/AI-Native SDLC Security Loop.md


Both files already exist. Let me check what's in them to see if they contain actual content or if they're just stubs.


Both already exist. Let me verify they have real content.


Read

/workspace/extra/second-brain/wiki/sources/Claude Blog - AI-Native SDLC Security.md


1	# Claude Blog - AI-Native SDLC Security
2
3	**URL:** https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle
4	**Date:** July 21, 2026
5	**By:** Jason Clinton (Anthropic Deputy CISO)
6	**Type:** Security engineering / AI-native SDLC reference
7	**Importance:** 88
8
9	## Summary
10
11	Anthropic describes how its security engineering process changed once Claude became the primary author and reviewer of code. The durable takeaway is that AI-native security is not just "more review"; it is a redesigned lifecycle where agents receive organizational context, operate inside hard identity and egress boundaries, review each other through narrow scopes, and emit auditable telemetry.
12
13	The post extends [[Claude Blog - CISO Guide to Agentic AI]] from governance questions into SDLC mechanics: planning reviews become context-connected agents, coding guidance becomes live CLAUDE.md / skill feedback, CI becomes multi-agent proof-backed review, dynamic testing becomes continuous, and security engineers monitor loops as first-class production systems.
14
15	## Key Numbers
16
17	- Anthropic engineers ship about 8x as much code per quarter as they did from 2021 to 2025.
18	- Claude authors about 80% of merged code at Anthropic.
19	- More than half of all code is merged by Anthropic's internal version of [[Claude Tag Plugins]].
20	- Automated review comments with substance rose from 16% to 54% after requiring review agents to prove findings.
21
22	## SDLC Pattern
23
24	| Stage | AI-native security adaptation |
25	|---|---|
26	| Plan | Claude-powered project security reviews connect to internal knowledge indexes, prior reviews, policies, and code context. |
27	| Code | CLAUDE.md files and org-wide skills encode secure coding guidance; discovered bug classes feed back into instructions. |
28	| Test / CI | Multiple narrow review agents plus deterministic scanners review PRs; risk-tiered code keeps humans at high-leverage gates. |
29	| Deploy | Continuous AI-powered DAST in staging looks for cross-service logic failures that periodic scans miss. |
30	| Monitor | Single-purpose incident agents triage logs, root-cause bugs, draft postmortems, and may draft fixes without deploying them. |
31	| Governance | Agents run in shadow mode first, approvals are sampled, and every automated action/tool call/message routes to SIEM. |
32
33	## Enduring Principles
34
35	- Connect security agents to organizational context instead of forcing heavyweight docs into a compressed planning cycle.
36	- Close the loop from vulnerability discovery back into CLAUDE.md files, skills, and generation-time guidance.
37	- Treat automated review as a different risk profile controlled by separate agents, separate contexts, deterministic gates, and human sampling.
38	- Match dynamic testing cadence to deployment cadence.
39	- Give every agent a single-purpose identity with minimum permissions.
40	- Monitor loops, not just bugs.
41
42	## Relevance to James
43
44	- **nanoclaw:** The post maps directly to NanoClaw architecture: agents need single-purpose identities, scoped destinations/tools, auditable messages, and hard boundaries around agent-to-agent communication.
45	- **qip-qien:** The incident-agent pattern is relevant to expert triage: one agent can analyze and draft, but a separate reviewer/human gate should own regulated or customer-impacting action.
46	- **congressional-trading / TradingBot25:** Risk-tiered automation applies to signal workflows: low-risk notifications can be automated, but high-impact trading or public claims need proof artifacts and sampled human review.
47	- **StageHand:** The "monitor loops" framing fits the QA retry loop: the loop itself needs metrics, failure sampling, and drift checks, not only final video review.
48
49	## Related
50
51	- [[AI-Native SDLC Security Loop]]
52	- [[Claude Blog - CISO Guide to Agentic AI]]
53	- [[Claude Code]]
54	- [[Claude Tag Plugins]]
55	- [[Long-Running Agent Primitives]]
56	- [[Cowork Dispatcher-Specialist Pattern]]
57

/workspace/extra/second-brain/wiki/sources/Claude Blog - AI-Native SDLC Security.md

# Claude Blog - AI-Native SDLC Security

**URL:** https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle
**Date:** July 21, 2026
**By:** Jason Clinton (Anthropic Deputy CISO)
**Type:** Security engineering / AI-native SDLC reference
**Importance:** 88

## Summary

Anthropic describes how its security engineering process changed once Claude became the primary author and reviewer of code. The durable takeaway is that AI-native security is not just "more review"; it is a redesigned lifecycle where agents receive organizational context, operate inside hard identity and egress boundaries, review each other through narrow scopes, and emit auditable telemetry.

The post extends [[Claude Blog - CISO Guide to Agentic AI]] from governance questions into SDLC mechanics: planning reviews become context-connected agents, coding guidance becomes live CLAUDE.md / skill feedback, CI becomes multi-agent proof-backed review, dynamic testing becomes continuous, and security engineers monitor loops as first-class production systems.

## Key Numbers

- Anthropic engineers ship about 8x as much code per quarter as they did from 2021 to 2025.
- Claude authors about 80% of merged code at Anthropic.
- More than half of all code is merged by Anthropic's internal version of [[Claude Tag Plugins]].
- Automated review comments with substance rose from 16% to 54% after requiring review agents to prove findings.

## SDLC Pattern

| Stage | AI-native security adaptation |
|---|---|
| Plan | Claude-powered project security reviews connect to internal knowledge indexes, prior reviews, policies, and code context. |
| Code | CLAUDE.md files and org-wide skills encode secure coding guidance; discovered bug classes feed back into instructions. |
| Test / CI | Multiple narrow review agents plus deterministic scanners review PRs; risk-tiered code keeps humans at high-leverage gates. |
| Deploy | Continuous AI-powered DAST in staging looks for cross-service logic failures that periodic scans miss. |
| Monitor | Single-purpose incident agents triage logs, root-cause bugs, draft postmortems, and may draft fixes without deploying them. |
| Governance | Agents run in shadow mode first, approvals are sampled, and every automated action/tool call/message routes to SIEM. |

## Enduring Principles

- Connect security agents to organizational context instead of forcing heavyweight docs into a compressed planning cycle.
- Close the loop from vulnerability discovery back into CLAUDE.md files, skills, and generation-time guidance.
- Treat automated review as a different risk profile controlled by separate agents, separate contexts, deterministic gates, and human sampling.
- Match dynamic testing cadence to deployment cadence.
- Give every agent a single-purpose identity with minimum permissions.
- Monitor loops, not just bugs.

## Relevance to James

- **nanoclaw:** The post maps directly to NanoClaw architecture: agents need single-purpose identities, scoped destinations/tools, auditable messages, and hard boundaries around agent-to-agent communication.
- **qip-qien:** The incident-agent pattern is relevant to expert triage: one agent can analyze and draft, but a separate reviewer/human gate should own regulated or customer-impacting action.
- **congressional-trading / TradingBot25:** Risk-tiered automation applies to signal workflows: low-risk notifications can be automated, but high-impact trading or public claims need proof artifacts and sampled human review.
- **StageHand:** The "monitor loops" framing fits the QA retry loop: the loop itself needs metrics, failure sampling, and drift checks, not only final video review.

## Related

- [[AI-Native SDLC Security Loop]]
- [[Claude Blog - CISO Guide to Agentic AI]]
- [[Claude Code]]
- [[Claude Tag Plugins]]
- [[Long-Running Agent Primitives]]
- [[Cowork Dispatcher-Specialist Pattern]]


The source page already exists and is complete and well-written. The wiki already has:
1. `wiki/sources/Claude Blog - AI-Native SDLC Security.md` — complete and rich
2. `wiki/concepts/AI-Native SDLC Security Loop.md` — exists (let me check its content)
3. Home.md entries for both (lines 107 and 203)

So this post was already ingested. Let me check the Wiki Ingest Log to see if this is noted, and if not, maybe it was ingested during a previous session earlier today.
Both the concept and source entries are already in Home.md, and the wiki files exist with full content, so this post has definitely been ingested before. Let me check the Ingest Log to confirm the entry and see what the most recent activity shows.


The source page is already complete and rich. Let me check the ingest log to confirm when it was done.