30 September 2026

From recent chats

Give each plugin a capability card

The recent expansion of agent plugins makes a small, personal capability review more useful than a generic “trusted/untrusted” label. For the next plugin or MCP server you consider, write down what private data it can read, what it can change, which external destinations it can reach, which credentials it receives, and how access is revoked. Then exercise its read-only path against disposable data before enabling writes. MCP tool annotations can seed the card, but the protocol’s maintainers explicitly describe them as hints rather than enforcement.

A useful follow-up question is: which combination would make you pause—private-data access, untrusted input, or an open-world write tool? Making that rule explicit once could guide every later installation.

Give one Go hot path a ratchet

Try a ninety-minute, benchmark-first optimization session on one operation you actually wait for: a Hugo transformation, a database-viewer query, or a CLI scan would all work. Freeze the correctness checks, capture a CPU profile and repeated baseline, then let an agent propose small changes one at a time. Keep a change only when benchstat shows a stable gain and the profile explains why; turn the winning number into a checked-in regression threshold or a scheduled comparison.

The interesting question is not how many patches the agent can produce, but whether one measurable improvement survives noise, review, and the next refactor. Stop if the benchmark does not correlate with the delay you feel in real use.

From the front page

Compile the house style from Markdown

Turn the Pages frustration into a small publishing fixture. Make one Markdown document containing every awkward structure you regularly use—nested lists, code, quotations, captions, footnotes and a wide table—then generate a DOCX through Pandoc with a deliberately styled reference.docx. Judge the result against three to five explicit invariants such as heading spacing, body font, code treatment and page margins, rather than repairing each document by eye.

If that fixture survives opening and lightly editing in Pages or Word, it becomes both a regression test and an executable description of the house style. The follow-up is to identify the first feature that still requires direct WYSIWYG editing; that boundary tells you how far the pipeline can realistically go.

Make the cluster proxy deliberately disposable

The socat-in-a-pod technique is worth wrapping as a tiny operational pattern: require a namespace and destination, generate a distinctive pod name, bind kubectl port-forward only to localhost, and delete the pod when the session ends. Where the cluster supports it, add an egress NetworkPolicy that permits only the intended host and port. Print the chosen endpoint and cleanup command before connecting so an improvised tunnel still leaves an understandable trail.

Try the wrapper first in a non-production namespace and use kubectl auth can-i to record the minimum permissions it needs. The design question is whether these tunnels are rare enough to remain ephemeral or common enough that the target deserves a maintained Service or approved access path.