Blog
We deleted most of our agents. Our evals told us to.
Our root cause investigation ran as a team of agents. We folded it into one investigator and measured every step on SREGym. Without Kubernetes tools, the one agent diagnosed 1.5x as many faults, with 49% fewer tool calls. It cost 60% less per investigation and reached a diagnosis 2.5x faster. Most of our other ideas failed the same evals.
Brig on hvi is immune to the PwnEscape guest-to-host escape
A guest-controlled checksum can corrupt an IPv4 header and leak Linux host-kernel memory. hvi drops that metadata before it reaches the host. Here's the boundary, the regression test, and what Brig users on Linux need to update.
Opsgenie retirement: what happens on April 5, 2027, and how to move
Atlassian ends Opsgenie support on April 5, 2027, and deletes the data you did not migrate. The dates, what to move, a migration checklist and what to look for in a replacement.
Why AI Incident Response Should Start at L1, Not L3
From a real-time Production Graph to autonomous Level 1 support, and why NOFire AI cuts Level 1 scope by up to 60% without the hallucination risk.
Why AI Agents Need a Control System Before Touching Production
An agent needs a versioned, inspectable account of production before it can investigate an incident, and a control system outside itself before it can act on one. This is what each of those has to do.
Defense in depth in a microVMM: the virtio-fs path bug our sandbox caught
Docker's macOS VMM lost the host filesystem to a virtio-fs path re-resolution bug (CVE-2026-77179). We replayed the sequence against hvi, our own microVMM. Its handle-based write path held, but one stateless read path exposed the same primitive. The deny-default Seatbelt profile stopped it before the host file could be opened. This post explains the FUSE state involved, the residual exposure, and the descriptor-relative fix.
Why we wrote our own microVMM
Our agent sandbox must behave consistently on macOS laptops and Linux servers. Porting Firecracker would require a long-lived fork, so we built a small VMM around an explicit hypervisor interface. This post describes the implementation cost, the components we reused and the work that remains.
Archive
Get production ownership back.
A 30-minute call with a founder. We map your stack to the Context & Control Model, live.