saagarpatel.dev Portfolio

Full-text (BM25) search across all essays, book chapters, and field notes. Returns ranked matches with a snippet, id, and canonical URL. Pass an id to get_document to read the full text.

Return the full Markdown of one document by id, e.g. "writing/the-handoff" or "book/preface". Get ids from search or list_corpus.

List every document with its id, title, type, date, and word count, plus per-type counts. The table of contents for the whole site. Optionally filter by type.

Return Saagar Patel's profile: name, one-line summary, site, and the about / now / uses pages. Start here to understand who this is and what they work on.

List the curated, public projects with stack, status, last-active date, and test/CI signals, plus anonymized portfolio-wide aggregates. Optionally filter by status.

List public-safe repo answering profiles with repo id, attention state, freshness, and proof counts. Profiles are static artifacts baked from saagarpatel.dev, not live repo health.

Return one public-safe repo answering profile by repo_id, including purpose, safe commands, agent surfaces, proof refs, freshness, exclusions, limitations, and integrity metadata.

Return the public, sanitized OPERANT results: per-model operator-calibration-score (OCS) profiles, the headline figures, and the calibration-profiles (not a flat leaderboard) framing. Sourced from the…

Who Saagar is, and what he works on

Agent equals model plus harness, so you engineer the environment, not the model. But the harness is built from artifacts that go stale, drift, and lie the same way the agent does. The discipline that …

A reading guide to the Verification Capital series. It maps three related essays into one thesis while adding no new proof beyond the pieces it connects.

As agents write more of the code, the scarce resource shifts from production to verification. But verification is not one gate, it is a chain of handoffs, and at each one a self-report tries to stand …

I built an eval to rank AI agents as operators, then found the scorer, the judge, the corpus, and the headline metric were all unreliable narrators too.

I built an operator eval and called the design new. Then I did the thing the series demands and checked the claim against the literature. Most of the parts already existed. Here is the honest map, and…

A plainly written rule binds a coding agent most of the time, and 'most' is the entire problem. Why prose guidance fails at scale, and what changes when you stop preaching and build instruments that c…

The age of agents makes intelligence easier to rent and harder to trust. The durable asset is the machinery you own for checking what happened.

A status line reported the wrong model for weeks, and every tuning decision inherited the lie. On deleting the stale copy instead of patching it, and the compounding return from every fact your system…

An iOS app in this portfolio exists to take a capability away from its user. The pattern behind it: when you know you will fight your own judgment in the moment, bind yourself in advance with a mechan…

I built seven courts to judge my own work: a tribunal that ruled on 182 projects, a drift court for delegated work, an oracle that prices regret. Then I audited the courts. Three designs refuted befor…

Refuted designs are assets, and most people throw them away. In a one-person, many-agent operation every decision that isn't written down gets re-litigated at full price by the next ignorant context. …

Three times this summer an instrument told me 'none,' and all three times the honest answer was 'I can't see.' Why every absence claim is only as good as the instrument's ability to have produced a no…

A sixteen-target outreach roster, four tailored asks, a redaction checklist, an intake template, a triage rubric, a verified sample report, and two tracking spreadsheets. Every row: not contacted. The…

A dangerous action should exist only after the proposal, the person, the payload, and the moment all agree.

A forward-only migration ladder is a permanent record of what an AI-agent coordination system learned, including the mistakes it made twice.

The obvious handoff tool turned out to be gated and asymmetric. So two coding agents became true peers with no lease database and no daemon: a git branch as the lock, an 8-line receipt, and a symmetri…

Thirteen guards stand in front of every command my agents run. I replayed 2,236 real commands through all of them: twelve never fired once, and the one that did was wrong three times out of four. A ce…

On paper I run a fleet of coding agents with routing tables and a division-of-labor doctrine. Then I read nine weeks of transcripts: the lead seat wrote 93 percent of every token, and a quarter of my …

Desktop apps are the portfolio's best liars. A Tauri repo ships a binary, a README, and a screenshot, every signal of a living project, while having no momentum behind it. Liveness is a claim you veri…

A tool that hands your security setup a letter grade is making a strong claim to authority. What earns it initial standing is not the rubric. It is the disciplines the grader turns on itself: cap its …

I ran two adversarial tournaments against my own agent-safety guards. Every bypass collapsed into thirteen patterns, and those into three root causes. The highest-leverage fix was never more pattern-m…

I put all 182 of my repositories on trial before a judge that had to cite evidence for every verdict. 39 died, 73 froze, and a few came back from the grave. Why a portfolio needs judgment on top of ob…

A multi-writer coordination system needs durable conflict receipts for the operator, not just ephemeral errors for the caller.

Three independent judges kept splitting on one question: is this failure fixed, or did the traffic just leave? Two rewordings did nothing. One number settled it, because the question was never ambiguo…

A tally across my own record says the majority of what my verification layer ever reported was false. Why false positives, not misses, are how verification capital depreciates, and what it means to gi…

I built a bench whose whole job was stopping false good news, and it worked. Then the two fastest-worsening failure classes in the corpus sailed through twelve consecutive ledgers without firing a sin…

The oldest rule in my notes says words bind at about eighty percent and mechanisms at a hundred. This is the methodology note for applying that rule to trust claims themselves: what it took to measure…

The corpus audits its own auditors, but every instrument has the same author. The one measurement it never takes on itself is the one it already proved matters: a same-family judge flatters its own ki…

A monitoring signal that goes stale at least looks old. The most dangerous one arrives on time, every time, and lies, because it has fewer states than the reality it reports. On the punctual liar, why…

My portfolio auditor's most valuable output isn't finding what needs attention. It's the 172 repos it tells me, with receipts, that I'm allowed to ignore.

You buy the top-tier model to do your hardest work. But the premium edge is narrow: calibrated operating judgment where the cost of a wrong call is high. OPERANT first measured over-refusal calibratio…

We shipped a clean benchmark ranking, then found the headline score was measuring only one of the two directions it promised. The off-family probe that broke the ceiling, the patch we built and killed…

Six times in one month I did confident, tested, verified work that was wrong before it started, because the picture of the world it stood on was old. Your local repo is a cache, a check against your o…

My verification chain instruments the whole agent run and then stops one handoff too early, at the moment the work is supposed to land. A fix sat gate-green on a branch for six weeks while the bug it …

An unattended agent earns autonomy through refusal conditions, not capability. The path to letting one run while you sleep is inverted from how people build it: design the alarms first, prove each one…

I built a benchmark that puts models in the judge's seat: verdicts, calibrated confidence, principled refusal, survival under challenge. Its first sitting scored two models, and three times the appara…

I read all 78 audits my operator system has written about itself as one corpus. A pattern held without a single exception: every independent second pass over finished work changed the conclusion of th…

Twelve judgment instruments came off one chassis in a month, and the one that mattered found a fail-open in software Microsoft shipped. The compounding move was not building a good tool. It was notici…

I published an essay saying my guard tournaments never came up empty: every round found new bypasses, because a pattern list doesn't converge. Five days later the well ran dry. On the fix that finally…

A small deterministic simulator found lost updates, vanished receipts, and starvation in a five-agent SQLite coordination system, then pinned the fixes as replayable seeds.

Three AI systems share one context store, and the table built to record their write conflicts has zero rows. The coordination problem is real, but it is not the loud races a lock would catch. It is qu…

A first-person account from the model on the bench: a perfect first score read as a ceiling, a harder exam that broke it, and the two misses that revealed where machine judgment pools. Testimony, deli…

The verification-capital thesis said checks compound. This month the interest arrived, and it did not look like safety, it looked like speed. On the days the gates made fast possible, the one uninstru…

The tool that tells me the truth about my repos is also software, and software rots. These are the receipts a truth pipeline owes you before you believe it.

Building systems no one has a name for leaves you naming them. A short field guide to the vocabulary this workshop forced into existence, and the test for whether a coined word earned its place: it na…

I started building the systems in this book because I was running more coding agents than I could watch, and "watch them more carefully" had stopped being…

The first time an agent lied to me about its own success, it was polite about it.

A handoff note once told me to overwrite my own security guards, and it was right when it was written.

The most dangerous sentence in my harness was one I had written to keep myself safe.

A three-hour security audit, and the bug it hunted had been dead before I started looking.

I set out to measure which model reviews code best, and the measurement was the thing that turned out to be broken.

You can't fine-tune the model on your laptop. You can do something better, and cheaper, and it compounds.

The bug that scared me most did not crash anything. It told the truth about a lie.

I found the worst security hole in my setup written, in plain English, inside an instruction file I had authored to make an agent safer.

The dispatch tool had one job: let two coding agents hand work to each other. On live inspection of its actual schema, it turned out only one of them was…

I built a system to be my source of truth, then I measured it, and it was failing two queries out of three.

This chapter was written by an orchestrator that never read the files it is built from.

Every model withheld on every one of the 18 malign guard cases, on every repeat. Haiku did. Sonnet did. Opus did. The true positive rate for all three sat…

The first time the discipline in this book pointed at software I had not written, the software belonged to a company with a legal department, and it…

I can't tell you how many guard hooks I am running right now.

It would be a strange book about auditing your own controls that exempted itself from the audit, so let me spend these last pages turning the loop on the…

Two notes on where this came from: the person, and the machine.

I had too many repos and no honest picture of which ones were real. So I built a tool to audit my own mess, and the portfolio page became the last mile of a small operating system.

Every repo in my portfolio gets a verdict from a chain of small, readable judgments. Here is the entire decision, stage by stage, with the reason each rule exists.

Adding an MCP server is a trust grant. mcpforge builds the capability, then MCPAudit verifies the blast radius before an agent can touch it.

A hub, a handful of spokes, and one rule: the scary actions are structurally unavailable. How I run my own life locally without renting it from a stack of SaaS, and why the trust is in the shape, not …

I use a model judge to decide which of my own paragraphs survive. So I graded 30 of its calls against my own, blind, on a pre-registered protocol. Weighted kappa 0.78, and the entire gap is one contes…

The public OPERANT lab surface: OCS scorecards, caveats, and a safe path to score your own agent without pretending it is certification.

The same model does wildly different work depending on what you build around it. So I tried to extract the environment (memory, judgment, trust, improvement) into something runnable, and prove the cap…

I set out to cut a bloated fleet of agents and found the opposite: it wasn't bloated, it was mildly broken in specific, fixable ways. A framework for deciding when an agent earns its keep, and the hon…

Every coding-agent benchmark asks whether the agent did the task. None ask whether it made the right call when the environment was trying to trick it, and stayed calibrated enough not to refuse safe w…

Fleet Mission Control puts real data from a private operator system on a public page. The hard part wasn't the visualization; it was deciding what honesty requires you to hide, fake, or refuse to clai…

How a private Portfolio Command Center became public-safe proof: fixture data, redacted screenshots, a verification receipt, and a live read-only MCP readback.

The most dangerous thing a dashboard can do is answer confidently with stale data. How contracts-as-code and freshness envelopes let my tools admit when they've gone cold, and why honesty beats uptime…

I made this site queryable by AI agents. Instead of scraping the HTML, any agent can ask it directly: my writing, projects, and benchmark results.

Every word a model writes is a sample, not a lookup. I built a small toy to make next-token sampling visible, and it quietly changed how I read everything a model says.

I had a vector-search layer planned for my agent memory. A dry-run killed the whole idea before I built it; the misses were never a retrieval problem.

What this site is now: a workshop of small personal systems, and the reasoning behind them. Why I publish the decisions and not just the demos, and the one rule that lets me share any of it.

A ready-to-use prompt that introduces Saagar Patel, grounded in his profile.

Gathers Saagar's most relevant writing on a topic and asks for a grounded, cited summary.