Writing

Last December a Kubernetes routing failure taught me two things at once: that Claude was already better at SRE work than I was, and that I was the safety layer — every command it proposed passed through my judgment before it touched the cluster. Joe is the agent built from that lesson: a deterministic Read/Mutate boundary enforced in code, not configuration, launching in observation mode, open source, because governed-by-construction only means something if you can inspect the construction.

Design, build, and runtime inspection each run on a separate Claude surface. It's the same model in all three, so the leverage isn't a smarter AI per task — it's controlling what each surface can see and what it's allowed to decide. Designing with no access to the code tree is the load-bearing move: it stops me anchoring requirements to the implementation that already exists, so the design follows from what the thing should do, not from how it happens to work today. The build surface implements that design and can't quietly invent its own enforcement. The handoff between them is friction, and the friction is the point — it forces the design into a real, reviewable contract.

VS Code's new Agents window looks like a productized version of my Claude-Code-as-orchestrator setup — until the fine print: it runs entirely on GitHub Copilot, models and billing included, with your Anthropic subscription invisible to the flow. Why I'm staying on the Claude Code extension, moving orchestration to Anthropic's desktop app, and what 'orchestration' actually decomposes into.

If you are using LLMs to write code, using LLMs to review the MRs is wrong. The writing-time model already had the best context for spotting errors; an MR-time bot is a weaker pass with less information. And the part of review that genuinely needed a second mind — team priors, incident history, intent — is exactly what a second LLM session cannot supply. Close the loop upstream at prompt time and downstream at behavior, not on the diff.

Earlier this year I started building Joe — a software infrastructure copilot. Then I needed a way to verify, before letting it touch anything real, that it would behave according to the rules I'd built into its code. Nothing I found fit. So I built OASIS.