sqlbenchdag — a reproducible benchmarking laboratory

Every experiment is a capsule addressed by an 8-character SHA-256 fingerprint over its config, SQL, and every line of measurement-relevant Python. Change the method and the ID changes. Cold-cache execution, hard row-count assertions, and an integrity seal on every capsule. The four published Quack capsules additionally carry OpenTimestamps proofs anchored to Bitcoin.

Semantic injection into agent memory

A deterministic exploit against an open-source agent memory system: text that reads as ordinary content to a human, but that the extraction pipeline turns into a stored fact the agent later treats as its own knowledge. Disclosed responsibly. Separately, a forensic read of a coding agent's local state directory — what it writes to disk, in plaintext, without telling you.

Reading agent traces

Per-turn tracing and deterministic grading of coding agents working against a commercial lakehouse platform. The traces surfaced three defects I reported upstream — including an error message that actively sends an agent in the wrong direction, suggesting tanh for a date function.

Consensus Contagion — agent pipelines defer to authority over evidence

16 content-addressed studies, 7 models, 110+ graded runs. When a high-status persona is injected into an agentic routing decision, the pipeline follows the persona rather than the engineering argument. The companion finding is prompt-level instructions get ignored under pressure while mechanical controls hold.

A RAG system answering 17 of 20 questions its sources couldn't support

I built a labelled evaluation set for a retrieval system I had written myself, and found it answering fluently, with citations, and with no error of any kind. Recalibrated the refusal threshold from 0.56 to 0.87 precision and validated out-of-sample. Confident output is not evidence; the failure mode to fear is the plausible one, not the obvious one.

Runs entirely from a local directory — LanceDB for vector, full-text and hybrid search, sentence-transformers for embeddings, no hosted cluster and no API key. Ask a question, get an answer and a link to the timestamp where it's answered.

Tools and playbooks for collaborating with coding agents

ai-agent-utils — a bootstrap that starts a repository with gates already enforced, rather than rules written down and hoped for. Two families: git discipline, and claim integrity — every load-bearing number registered with a source and re-checked before commit, fabricated claims blocked by pattern, and a checkpoint that refuses to record a working state unless a proof command passes. Enforcement is git hooks and stdlib scripts, so it binds whichever agent is driving; the Claude and Cursor files only describe it. The Pedantic Medallion — community-curated playbooks for building shared understanding, from the framework of the same name.