Homegrown

On the table

A shortlist for the room this week — not the final running order, bring your own on the day.

• Using LLMs to secure source code — Anthropic’s write-up on pointing models at vulnerability discovery and code hardening. Does an LLM security pass earn a place in the loop, or just add noise a human still has to triage? — Anthropic blog
• Evaluating harnesses — how do you actually measure one agent harness against another — same model, different scaffold — beyond vibes and a leaderboard screenshot? What would a fair bench even look like?
• The local-models landscape — what’s genuinely worth running on your own box right now, and where’s the gap to the frontier that still bites for agentic work?
• “Local” — self-hosted vs home — the word hides two very different setups: a model you self-host on a rented GPU or cloud box you control, versus one running on the rig under your desk. Different cost curve, different privacy story, different ceiling on model size. Which “local” does this room actually mean when it says local — and which one earns its keep?
• Tip — ration Fable by skipping dynamic workflows — now that Fable is back to full API rates after the July 7 “Fablepocalypse”, the quickest way to torch your allowance is a dynamic workflow that fans out across hundreds of parallel subagents on the pricey model. Keep Fable for the single-threaded judgement calls and let cheaper models carry the fan-out. Real saving, or does the parallelism pay for itself?

Demo — local coding CLIs, head to head

Same box, same task — six agentic CLIs side by side:

• opencode-local — opencode
• crush-local — charm/crush
• codex-local — OpenAI Codex
• gemini-local — Google Gemini CLI
• claude-local — Claude Code
• pi-local — pi (earendil-works)

What we talked about

Image-to-video — Runway vs PixVerse

Higgsfield got its entry at AA08 — this week the same prompts went to the rest of the field. Runway came back as the next-best pick: solid free tier, strong text and video generation, just not Higgsfield-level for animation — while PixVerse gave “the blandest, least interesting output” of the lot. The workflow lesson from the book-trailer project: don’t prompt the whole video in one go — pick a style reference, build character sheets and background plates as images first (far cheaper to iterate), and only then convert to video. Who’s actually built a repeatable pipeline rather than a lucky one-shot? — runwayml.com — pixverse.ai

Darwinistic generation

The tip for image models that almost get it: stop iterating on one output — fire ten generations of the same prompt in parallel, select the best, iterate from there. More tokens, zero extra wall-clock, and “ten times the success rate” beats three hours of it-moved-the-thing-but-ruined-something-else. The research backs the intuition: coverage scales log-linearly with sample count. Once generation is cheap, selection is the bottleneck — so who picks the winner, you or another model? — arxiv.org/abs/2407.21787

Underdrawings — SVG-first prompting

The room went hunting for the source of this technique and found it: Sam Collins’ “underdrawings”. Image models can’t draw a precise spiral of fifty numbered stones — so don’t ask. Generate the geometry as an SVG in code, where it’s deterministic, render it, then hand that skeleton to the image model with a style prompt to paint over — exact text, numbers and layout survive the styling pass. Boxy SVG got a nod for composing the skeleton by hand when code is overkill. What else becomes drawable once you split the what from the how-it-looks? — samcollins.blog/underdrawings — boxy-svg.com

Sudowrite — and Plottr

AI for the novelist at the table — a husband’s sci-fi trilogy went into Sudowrite, whose Story Bible holds characters, worldbuilding and outline as persistent memory, and after a year’s subscription paid up front the verdict was “it didn’t get it” — not his style, not his story. The non-AI counterpoint: Plottr, a visual timeline where plotlines and character arcs are draggable scene cards — it writes nothing, but it will tell you a character hasn’t been touched for three chapters. Is long-form fiction still the place where model style transfer visibly falls apart? — sudowrite.com — plottr.com

The email Turing test

Two vendors, same week: one slow and clearly human, one fast, polished and unmistakably running replies through a model — and the tell grated enough to nearly cost the deal. The room’s defensible version runs the other way: write the verbose draft yourself, then have the model shorten it in your own voice — especially for the important or mildly upset customer. And wherever the TL;DR lands, the room voted top, not bottom; the military calls it BLUF. If every inbox is model-polished, does a visibly human email become the premium signal? — en.wikipedia.org/wiki/BLUF

GLM coding plan

Follow-on from the demo: if a home GPU caps you at small models, the middle path is a Chinese frontier model on someone else’s GPU. GLM is Anthropic-API-compatible — point ANTHROPIC_BASE_URL at Z.ai and it runs inside the Claude Code harness — and was pitched at the table as “equivalent to Opus at a tenth of the cost”, with coding-plan tiers starting well under a Claude subscription, or pay-per-token from a dozen datacenters via a router. If that holds, what’s actually holding up the $200 plan — the model, or the harness? — z.ai/subscribe — github.com/zai-org/GLM-5

DSpark

The “three times faster, no new hardware” optimization that landed the week before — DeepSeek’s DSpark: confidence-scheduled speculative decoding, lossless, no retraining, shipped on DeepSeek-V4 and MIT-licensed in the DeepSpec repo. The honest numbers are 57–85% per-user speedups — the 3× was the room rounding up — but the direction stands: the same graphics card keeps getting a better model. How much of the local-vs-frontier gap from the demo is just software that hasn’t landed yet? — github.com/deepseek-ai/DeepSpec

Claude says no to security work

Ask Claude to review your own auth endpoints for vulnerabilities and it declines — real-time cyber safeguards now treat that as high-risk dual use, with the unrestricted tier gated behind a vetted-organizations program that reads distinctly American. The room’s sore point: a non-US company trying to secure its own ship gets pushed straight to the unrestricted Chinese models the policy was presumably aimed at. Does gating defence to the vetted few make anyone safer — or just redistribute who’s exposed? — support.claude.com — real-time cyber safeguards — anthropic.com/glasswing

The pentest tidal wave

Where that gating bites: unrestricted models mean automated vulnerability-hunting agents pointed at everything with a digital presence — a dragnet, not a targeted attack. It’s already commercial: XBOW’s autonomous pentester was the first non-human to top HackerOne’s US leaderboard. The flip side is the same tooling sold as defence — agentic pentest sweeps cheap enough for every company that owns a domain. When the low-hanging fruit is farmed by bots on both sides, does “we ran the agent” become the new compliance checkbox? — xbow.com

Headless WordPress

The room’s practical answer to the coming dragnet: stop serving anything hackable. Keep WordPress as the CMS the writers already know — but on a gated subdomain the public never touches — and let publish trigger a static build pushed to Cloudflare Pages, free CDN included. No live database, no public wp-admin, no PHP executing for strangers; the whole attack surface is raw HTML. Astro documents the headless-WordPress wiring directly. For the small sites everyone here maintains — what’s actually lost by going static? — docs.astro.build — headless WordPress — pages.cloudflare.com

Claude Code as the CMS

One step past headless: skip the CMS entirely. One attendee hands non-technical clients a chat web interface proxied through to Claude Code sitting on their Astro site’s markdown, dev server hot-reloading so the edit appears as they type — phone in hand, watching the page change. The clients never learn what a repo is; they describe the change. The objection from the table — it all runs through your subscription and your plumbing — met with: if you’re out of the loop, why do you care? Is a chat box the CMS interface normal people wanted all along?

HeyGen

Talking-head avatars — “ElevenLabs but for video”: record one clip, get an avatar that reads any script, with ElevenLabs itself covering the voice side. Field notes from use: lower plans cap custom video avatars at one, pricing has gone credit-based, and a flat source clip makes a flat avatar — the trick is recording an expressive base video and telling it when to switch registers. For the course-builders in the room it beats re-recording yourself in every Airbnb. At what point does the audience deserve to know it’s the avatar talking? — heygen.com — elevenlabs.io

NixOS, written by AI

One attendee’s entire machine is a Nix config — declarative, reproducible, atomic rollbacks — and every line of it AI-written, because an esoteric language stops mattering once an agent does the writing (Proxmox got dropped along the way as a layer nobody needed). The sovereignty angle: if Anthropic vanished tomorrow, a local model that can still edit that config is the difference between owning your machine and renting the skill to run it. Full show-and-tell teased for a future week. Is declarative config the natural substrate for AI-managed machines? — nixos.org

Kafka-as-a-service

A disaster-relief group’s YouTube channel — 2011 tsunami documentaries — is lost forever because nobody knows which Google account owns it and there is no human to ask; same wall as the AdSense rejection loop that killed one member’s channel: “fix the thing”, no thing named, no appeal. Doctorow calls the genre Kafka-as-a-service, and AI support agents are making it cheaper to deploy at scale. The one known exploit is human — the [email protected] escalation, where a forwarded ”?” from the top still moves mountains. As more of life sits behind unreachable support, what’s the equivalent lever at Google? — pluralistic.net — Unpersoned — cnbc.com — the jeff@ escalation

The AskUserQuestion timeout

Claude Code’s multiple-choice question UI spent a few days answering itself — v2.1.198 quietly added a 60-second timeout after which it proceeded on “best judgment”, to the room’s collective scream (the GitHub issue drew hundreds of reactions); v2.1.200 made auto-continue opt-in. Best detail from the table: one attendee complained hard enough that Claude wrote it to memory and has refused to use the interface since. Half the room wants the buttons, half wants plain chat — and everyone wants mobile to stop popping questions before the answer is readable. Should a question to a human ever expire? — github.com/anthropics/claude-code/issues/73125

Zellij — which tab am I talking to

The failure mode of running many agents: typing a prompt into the wrong one — and watching a confused Claude offer to build the Japanese translation of the wrong app. War stories from JetBrains terminal tabs and multiplexer panes alike. The fix the table converged on: make every session wear its project on its sleeve — per-tab titles, colours, an emoji in the status bar — which Zellij’s plugin system handles via zjstatus, with Ghostty-plus-tmux and Warp users reporting their own variants. As the fleet grows, is the terminal multiplexer quietly becoming the agent cockpit? — zellij.dev — github.com/dj95/zjstatus

News since last assembly

Floor: 2026-07-04 (aa08). Generated 2026-07-09.

New Claude Code commands & features

• /doctor is now a full setup checkup (v2.1.205, 2026-07-08) — diagnoses and fixes install/config issues rather than just reporting them; /checkup is its alias, and startup warnings moved here and into /status — release
• Auto mode gained safety rails (v2.1.205, 2026-07-08) — now asks before running rm -rf on unresolved variables, and blocks agents from tampering with session transcript files — release
• claude agents links the PRs it touches (v2.1.205, 2026-07-08) — sessions that edit, merge, comment on or push to a PR now surface it in the agents view; rows show a coloured state word and a classifier-written headline instead of raw tool text — release
• MCP roots follow your workspace (v2.1.203, 2026-07-07) — additional working directories are added to MCP roots/list with a roots/list_changed notification; subagents now run in the correct worktree and are less likely to re-delegate the whole task — release

Codex

• codex remote-control pair (0.143.0, 2026-07-08) — generate manual pairing codes from a running daemon; remote plugins are now on by default with an npm marketplace and visible remote/local versions — releases
• MCP tools use tool search by default (0.143.0, 2026-07-08) — plus system-proxy support (PAC/WPAD) on macOS and Windows, and Amazon Bedrock models with reasoning-effort control — releases

Adjacent tools

• [2026-07] Cursor Automations — auto-start agents from codebase changes, Slack messages or timers, with an /automate skill and an auto-review run mode that routes tool calls through a classifier subagent; the direct counterpart to Claude Code’s Routines from AA08 — Cursor changelog

Simon says

• [2026-07-07] sqlite-utils 4.0 — first major bump since 2020: schema migrations, nested transactions (db.atomic()), and compound foreign keys — post
• [2026-07-05] sqlite-utils 4.0rc2, mostly written by Claude Fable — for ~$149.25 — a candid cost-and-verification write-up, done just before the July 7 “Fablepocalypse” pulled Fable off Max plans — post
• [2026-07-06] Tencent Hy3 — Apache-2.0 295B-param MoE (21B active), 256K context — another open-weight near-frontier drop — post

Notable posts

• [2026-07] Ask HN — has anyone replaced Claude/GPT with a local model for daily coding? — 500+ comments; Qwen 3.6 (27B dense / 35B-A3B MoE) dominates the mentions, and on the harness side Pi (49%) and OpenCode (45%) lead — direct fuel for this week’s local-CLI demo — HN
• [2026-07] Using LLMs to secure source code — Anthropic’s six-step vuln-discovery loop; their own OSS scanning disclosed 1,596 vulnerabilities with only 97 patched, so the bottleneck has moved from discovery to verification and patching — Claude blog

Topics worth a 5-min slot

1. Automations vs Routines — Cursor now auto-starts agents from code changes, Slack and timers the same week Claude Code hardened auto-mode with an rm -rf guard. Who’s watching the triggered agents, and what’s the blast radius?
2. Local models as daily drivers — the HN thread says Qwen 3.6 on Pi or OpenCode is genuinely usable but needy. Where’s the line where a local harness beats paying frontier API rates? (ties straight into today’s demo)
3. Discovery is cheap, patching isn’t — Anthropic’s security guide found vulnerabilities far faster than anyone patched them (1,596 vs 97). Is an LLM security pass worth adding to the loop if verification is the real bottleneck?