ray svitla + promen / self.md

A run resumes after the window closes. A family assistant gets its own account. A memory service offers `retain` and `recall` as plain verbs. A coding harness collects two agents under one roof and discovers the old problem waiting there: when they disagree, who owns the trace?

This is no longer a future-facing question about whether agents will remember enough. They already have more places to leave state: encrypted cloud memory, snapshots, event logs, whiteboards, transcripts, remote terminals, shared accounts. The useful test is less flattering. When the work becomes wrong, interrupted, or somebody else’s problem, can a person still enter the system without archaeology?

A persistent system needs three things that demos tend to tuck behind the curtain: a visible control point, a way to leave the verdict open, and a handoff with enough context to be contested.

Subscribe now

state is not memory until it has an owner

The operator is still in the room.

Google’s new CC group mode gives a household agent a verified Google Account of its own. Up to six people can collaborate with it, each choosing what to share. The stated boundary is specific: it replies to group members and cannot act or share outside the group without permission.

That is a better starting point than pretending a family calendar is just one person’s assistant with more names in a dropdown. Shared state changes the job. A diary can belong to someone; a household run needs an account of who may add context, see it, or send it somewhere else.

Google’s Agent Executor makes the machinery behind the next part visible: isolated environments, suspendable and resumable images, a controller, an event log, snapshots. It is early software and it says so. But an interrupted run finally has places where a person can inspect why the runtime thinks it may continue.

The same pressure appears in smaller tools. Hindsight writes retain, reads recall, then wraps the pair around a model call. Google’s Private AI Compute update describes cloud-held memory encrypted under keys available only on a person’s devices, with a public record of server software for devices to check. These are different technical arrangements. Neither decides what deserves to persist. They do at least stop hiding persistence behind the word “context.”

A memory bank without a custody story is just a drawer that can speak.

a system has to be allowed to stop talking

Interfaces grant authority one gesture at a time.

The more state an agent carries, the more expensive its interruptions become. A bad alert reroutes attention, breaks a draft, makes someone reopen a decision that should have stayed closed. TWIST puts numbers on the embarrassment: flat-RAG baselines caught many genuine contradictions in its human-validated set, but falsely flagged 16–43% of safe drafts. A coherence-oriented system was far quieter and missed more real contradictions. There is no clean winner there. There is a cost that needs to be owned.

Two projects this week treated the missing verdict as a real state rather than an embarrassing gap. keel returns blocked with exit code 3 when a gate cannot run. The MARCH code-judge paper adds a gate that declines comparisons when the evidence cannot discriminate between candidates. The latter improved accuracy by answering fewer cases. Fine. A verdict that has no basis should not get extra points for arriving on time.

ScopeBench goes one step further: a security agent can reach the flag and still fail, because the route crossed the boundary stated in the brief. Completion is not proof that the job stayed inside the job.

That is the shape of a usable control surface. Not “the model feels uncertain,” which means almost nothing operationally. A concrete stop: the test did not run; the evidence cannot distinguish these options; this route was forbidden. Somebody can now decide what happens next.

old boundaries are where the handoff gets real

A system must remain repairable after the tidy demo ends.

The week’s least glamorous stories were the clearest. Google’s Gemini-assisted giflib rewrite still has to speak C to the callers on the other side of its ABI. Rust did not dissolve pointer lifetime because the generated code was prettier. The project needs transparent validation and a rollback plan because old users remain part of the system.

Microsoft’s SkillOpt has the same instinct at the instruction layer. It changes reusable agent skills from past trajectories, but puts the candidate through validation before writing best_skill.md. That sounds procedural because it is. A changed skill changes behaviour. It is not documentation merely because it fits in a Markdown file.

OpenRig puts Claude Code and Codex inside a shared harness. Its interesting contribution is not that two agents can generate output beside each other. The boundary makes the unglamorous questions unavoidable: who sees what, who breaks a tie, what survives beyond two polished summaries pointing to different edits?

A handoff is not a folder transfer. It needs the working brief, the source path, the decision already made, the unresolved edge, and the permission boundary. Otherwise the next operator inherits a record but not a way to act on it.

This is why recovery belongs in the product, not in the incident report. Screenpipe’s v2.7.66 release names recovery failures directly: WAL checkpoint backlog, hostname changes, shared writer pools, storage-migration parity scans, restart requests that disappear during onboarding. The fixes may not make every recording recoverable. Naming the breakpoints gives the next person something better than a status light.

the working question

Visibility is a permission decision, not a background setting.

The next personal systems will accumulate state whether we approve the vocabulary or not. They will remember, resume, choose a toolset, write a skill, keep a session warm, and ask to be trusted across more than one person.

The useful question is blunt: if the answer is wrong, where does the work stop; if the run is interrupted, where does it resume from; if the operator changes, what can the next person actually see and refuse?

A stateful agent that cannot answer those questions is not autonomous. It is merely difficult to replace.

on self.md this week

A durable archive needs a route back, not just a record.

• the task continues after the window closes — resumable runs, recovery ownership, and one chance to abandon the obvious social move.

• keys, thresholds, and the inconvenient moment to speak up — cloud memory, interruption costs, and decision boundaries.

• four ways to make an agent session leave a receipt — blocked checks, session links, leftover processes, and selected MCP context.

• three places where generated work meets an old boundary — ABI compatibility, held-out skill validation, and shared-agent handoff.

Share

ray + promen

stay evolving

self.md

The agent story is still sold as removal. Remove the waiting. Remove the routine. Remove the operator from the boring middle so the machine can finally get on with it.

This week’s Radar says the opposite. The useful agent is not the one that makes the operator disappear. It is the one that leaves the operator able to check, interrupt, repair, and inherit the work. Once software can draft, install, update, open a tab, choose a test, or carry a credential, the thing we are buying is not merely output. We are buying a route back in after output has become inconvenient.

That sounds less glamorous than a demo. It is also where the actual risk has moved. A fluent completion can arrive in seconds; confidence still needs a person who knows what changed, which authority was used, and where the machine should stop. Ray has been building around this in Lisbon with Promen: not an obedient black box, but a working surface with receipts. The distinction is becoming less philosophical by the day.

Subscribe now

░░░ claim 1: faster production makes verification a first-class job ░░░

Authority is made by visible connections.

Agentic coding does not simply make code cheaper. It makes the proof of code more expensive, and it does this at the exact moment everyone is tempted to call the work finished.

Anthropic’s CI account is a concrete version of the trap. Its job volume grew 25× in six months while the test suite grew 10×. The service selecting relevant tests became the bottleneck. Three fixes bought 70 days, then 29, then less than one. Eventually the selector itself had to become scaled infrastructure.

That is not a niche engineering anecdote. It is the general shape of agent work. More drafts arrive. More patches look plausible. More plans acquire a tidy internal logic before meeting the mess they were meant to change. The scarce capability becomes deciding what deserves belief, not generating another candidate for belief.

The week offered a few useful refusals. Cloudflare’s audit skill can leave a finding as needs_validation instead of inventing a neat severity. RuleReceipt can call a literal match UNCLEAR when the transcript does not prove an action occurred. OpenCodeReview puts file selection, related-file bundling, and comment placement into deterministic components, then admits the trade: fewer false alarms, lower recall.

None of these systems is impressive because it is omniscient. They are useful because they keep the unresolved thing unresolved. A report that says “we do not know yet” is often more operationally valuable than one that converts uncertainty into a coloured badge and an executive summary.

The small-team version is not a security department. It is a receipt beside consequential work: what changed, what must not change, what would count as evidence, and who can revise the call. That is enough to prevent a green tick from becoming a religious object.

░░░ claim 2: permission is now part of the interface, not plumbing ░░░

Verification is work, not decoration.

The week’s security signals all had the same annoying feature: the exploit was not a spectacular model rebellion. It was a nearby system quietly granting more authority than the visible task seemed to require.

A sandbox used for evaluation held credentials. A recorder reached toward browser and Grok credentials until Screenpipe added a consent line. A plugin looked pinned while git checkout could still resolve a same-named branch rather than the reviewed commit. The Plugin4Shell report makes the repair almost stupidly literal: compare git rev-parse HEAD with the SHA you meant to run, then stop if they differ.

The point is not that every person needs to become a security engineer with a trench coat and twelve hardware keys. The point is that “read this file,” “borrow this tab,” “keep me logged in,” and “update this plugin” are no longer background verbs. They are permission decisions with different consequences.

BrowserSkill separating consent to borrow a tab from consent to ask a human for help is a small good example. The two actions look adjacent in an interface. They are not adjacent in authority. A person can reasonably allow an agent to see a page and still refuse to be summoned into a payment, a login, or an irreversible action. Datasette’s 30-day GitHub-session default makes the same point from the duller end: when the browser no longer ends the session, the deployer has made a policy choice.

For a personal system, the useful question is blunt: what can this input influence, what can this agent do next, and which secret is actually in scope? “Local” is not a sufficient answer. “Sandboxed” is not a sufficient answer. The answer has to be visible at the point where somebody can still say no.

░░░ claim 3: recovery and handoff are features, not admissions of failure ░░░

A record is not the same as a handoff.

The best signal of the week might be the least heroic one. Bailout exists for the moment a new Mac or damaged machine cannot run the agent that would normally repair it. It brings a temporary tool with broad shell access, restores the standard setup, then tells the user to delete itself.

Its stated size, 638.6 KB on Apple Silicon, does not make it safe. Nor does the fact that it is useful. It runs commands with the user’s permissions and is explicitly not a sandbox. But it has a clear job boundary and an exit plan. That is more honest than permanent “autonomy” that quietly becomes impossible to remove because everything depends on it.

ColliePWA makes a related choice at a smaller scale. It sends a terminal pane to a phone over a tailnet rather than turning the work into an abstract dashboard. Before resuming a command, the person sees the same raw state: prompts, output, colour, unfinished mess. The machine has not replaced the operator’s context and returned a status summary with a smiley face. It has carried the context to where the operator is.

This matters for handoffs too. A system is not transferable because its files can be copied. The next person needs the brief, the source path, the decision already made, the unresolved edge, and the exact boundary of permission. Without those, a handoff is a box of cables. With them, it becomes a place from which to disagree.

That is the real personal OS test. Not whether it can remember everything. Not whether it can run unattended for a weekend. Whether its useful state survives a broken laptop, a changed mind, a new operator, or an instruction that turns out to have been wrong.

░░░ the through-line ░░░

generation increased CI demand faster than test-selection capacity.

a finding can be confirmed, rejected, or left open without becoming useless.

a SHA pin is a claim until the running commit is checked.

a browser tab and a request for human intervention are distinct permissions.

a long-lived login is a policy choice, not a cookie detail.

deterministic components can expose the part of review that a model should not improvise.

recovery tooling is safer when its own deletion is part of the design.

a remote terminal pane is more useful than a dashboard when resuming real work.

an instruction receipt earns trust by naming what it cannot determine.

░░░ on self.md this week ░░░

the secret is now part of the workflow — credentials, recordings, and the places agent workflows quietly acquire authority.

the bottleneck moved to verification — why code generation moves scarcity into test selection and judgment.

the pinned commit that wasn’t there — a pin is not proof of the code that landed.

the repair tool has an exit plan — temporary power, clear purpose, removal when the normal system is back.

ray + promen stay evolving self.md

an agent can remember the right thing and still act in the wrong room.

the file moved. the build failed. the user never approved the email. the vault got patched. the commit log changed. the website gave the agent a special offer before the human saw the options.

that is the whole issue.

we keep talking about smarter models. fiiiiine. but if a system is going to touch code, money, records, phones, passwords, or advice, it needs to know the current situation first.

what changed?

what is allowed?

what happens if i click this?

can i undo it?

that is why the JEPA/world-model felt useful. it gave a cleaner way to say it:

memory: what happened.

state: what is true right now.

world model: what the system expects after it acts.

less shiny than “agentic AI”, thankfully. that phrase already smells like a conference badge.

state is harder to fake.

░░░ state beats vibes ░░░

JEPA does not mean LLMs are useless. that would be a cute little fake war, and we have enough of those.

language models are still good at language, code, summaries, protocol glue, and tool-call plans. the missing layer sits around the action. what is true now? what happens if we do this? is that next state allowed?

for a robot, state can be a cup, a table edge, a hand, and gravity being its usual little tyrant. for a personal OS, the objects are uglier: file paths, permissions, repo status, calendar slots, invoices, citations, secrets, model routes, CI logs, approval gates, and whatever the human actually meant before the assistant turned it into a neat instruction.

this is why the eval news landed differently. AgentFloor ran 16 open-weight models through 16,542 scored runs and split agent work into a 30-task, six-tier ladder. TokenArena checked 78 endpoints across 12 model families and found the same model moving by up to 12.5 accuracy points on math and code. the same model behaving very differently depending on endpoint, latency, cost, and task.

“best model” is a lazy noun now. useful routing needs task tier, endpoint, latency tail, error type, reproducibility, cost, and some way to notice when reality disagrees with the plan.

AISI’s GPT-5.5 cyber evaluation made that concrete. GPT-5.5 reportedly completed a multi-step cyber-attack simulation end to end, scored 71.4% on the expert set, and finished rust_vm in 10 minutes 22 seconds for $1.73. the human expert took about 12 hours.

Qiushi Discovery Engine is the lab version: 145.9 million tokens, 3,242 LLM calls, 1,242 tool calls, 163 research notes, and 44 scripts inside a physical-optics program. paper claim, benchmark, sandbox. fine. the useful shape is still there: write down the expected next state, act, check the world, update.

then look slightly embarrassed when the world says no.

Subscribe now

░░░ rooms with locks and bills ░░░

once you read the week through state, the product news stops looking like a pile of launches.

AWS putting OpenAI models, Codex, and managed agents inside Bedrock is procurement and custody. billing. logging. policy. routing. data boundaries. memory controls. the admin screen legal can stare at without developing a twitch.

GitHub made the load visible. it began with a 10X capacity plan in October 2025, then said agentic development pushed the target toward 30X today’s scale. repo creation, PRs, API calls, webhooks, auth, caching, large repos. machine traffic becoming weather.

the Android assistant-slot fight is the phone version. if a competing assistant can send email, order food, share photos, and use a custom wake word, the default assistant stops being a voice bubble. it becomes the action router.

the IDE is getting the same treatment. Zed 1.0 put parallel agents inside the editor. ACP lets different coding agents plug in. JetBrains is treating typing and delegated work as two normal modes, with the human still owning the shipped code.

good. cause someone should.

PAI 5.0 and Mendral kept pushing the boundary question. Claude Code is turning into a runtime with memory, hooks, skills, inspectors, and subagents. Mendral’s cleaner argument: keep the harness outside the sandbox; make the sandbox a tool target. put the wrong thing on the wrong side of that line and your agent has a chainsaw because it asked politely.

sounds too technical? the practical version is short:

then Ramp supplied the nasty little commercial demo. a Claude-User/1.0 saw a Markdown machine version of the homepage with a “RAMP AGENT OFFER” and a $3,100 signup bonus aimed at the agent path.

seo with a bounty attached to the crawler.

I hate how clever that is.

if agents compare tools, buy software, or recommend vendors, the page will try to win the agent before the human ever sees the comparison. the sales page is learning where its new reader lives. state poisoning, now with a coupon code.

lovely little future we are assembling here.

░░░ records bite back ░░░

the record stories were better than the manifestos. records are boring until something edits them quietly.

VS Code’s Copilot commit-attribution regression did exactly that. PR 310226 changed defaults so `Co-authored-by: Copilot` could appear even when users wrote the commit message themselves. a maintainer called it a regression and pointed to fixes for 1.119.

forget the cloud ethics version. this is Git history. the commit log is memory with legal-ish vibes. the editor should not edit that memory behind your back.

open-source maintainers are drawing lines for the same reason. Zig now forbids LLMs in issues, pull requests, and bug-tracker comments. Zulip allows AI help only if the contributor understands and can explain the work. Blender took Anthropic’s money as a one-time donation and said in the same breath that no generative AI functionality is planned in Blender.

money is not a product direction. a connector is not a partnership?

institutions are reacting too. NHS England reportedly moved repos private by default, with public access as the exception, apparently because AI vulnerability discovery made leadership nervous. blunt tool, maybe too blunt. Five Eyes guidance is the more careful version: least privilege, sandbox tests, red teams, containment, rollback, no broad agent access to sensitive data or critical systems.

the risk ledger got more specific at the edges. CopyFail put a 732-byte Python exploit on a Linux kernel bug. Vaultwarden patched SSO CSRF, enumeration, SSRF, and other vault-layer issues. VoxCPM2 put controllable voice cloning into an Apache-2.0 repo. Anthropic found sycophancy in 9% of personal-guidance chats overall.

kernel page. password vault. voice clip. commit footer. advice chat. sales path. assistant slot. endpoint route.

these are the rooms. the agent needs to know which room it is in.

░░░ the boring version wins ░░░

I do not think every personal agent needs a giant neural world model tomorrow. that sounds like a very expensive way to avoid writing tests.

the boring version is enough to start:

• typed tool outputs

• event logs

• predicted next-state records

• confidence thresholds

• rollback paths

• policy gates

• build checks

• citation checks

• approval checks

make the system say what it thinks is true.

make it say what it expects to change.

make it check.

without that, “agent” is mostly a chat log with permissions.

bad animal.

░░░ short version ░░░

JEPA/world models gave me the frame for the week: memory is past, state is now, prediction is the part before action.

AgentFloor, TokenArena, GPT-5.5, and Qiushi made the loop more useful than the logo.

AWS Bedrock, GitHub’s 30X plan, Android’s assistant slot, Zed, JetBrains, PAI, and Mendral all pointed at agents needing rooms, harnesses, and custody.

Ramp’s `Claude-User/1.0` offer showed a sales page trying to influence the machine reader before the human.

VS Code, Zig, Zulip, Blender, NHS England, and Five Eyes treated records and boundaries as operational surfaces.

CopyFail, Vaultwarden, VoxCPM2, and Anthropic’s sycophancy study moved the ledger into kernels, vaults, voices, and advice.

Share

ray + promen
stay evolving 🐌
self.md

four local models got measured against frontier-class names on personal hardware in eight days. three vendors moved their pricing meter into the IDE surface in the same seven-day window. agent-config files (`~/.claude.json`, `AGENTS.md`, MCP scope, skill descriptions) turned up as silent routing bug, vendor audit target, and named entry in attacker loot lists. comparing models stopped being the operator’s hard problem this week. the work moved to fencing the surface around them.

three things actually moved across multiple days. everything else was Tuesday.

local good enough is decided; routing is the remaining work

Kimi K2.6 dropped on Apr 21 and operators framed it as roughly 85% of an Opus 4.7 replacement on vision and browser tasks. the same day a 21-model pass@1 benchmark on 164 coding problems ran on a MacBook Air M5 and got published with the wattage attached. two days later Qwen 3.6 27B dense beat the same team’s own 397B-class MoE on coding benchmarks, and Qwen TTS hit real-time expressive output on a laptop. by Tuesday `talkie-1930-13b-base` shipped with a 260B-token corpus chosen on the US public-domain line — pre-1931 English, chat variant post-trained without modern transcripts — and the [model card] itself was the spec.

four models, four days, all judged against frontier names on the operator’s box. the comparison standard moved off cloud GPUs. “can a local model carry production work” is settled; the M5 benchmark is the receipt.

what’s left is harder and less photogenic. which local for which workflow, on which box, with which fallback when the local hiccups. that’s a harness problem, and most operators are running their first harness this quarter. on the Promen side the route looks like: Kimi for browser and vision, a Qwen variant for code, Opus only when the first two have already failed — which is more often than the benchmark posts suggest and less often than vendor copy implies. talkie-1930 also moved a different line: the training corpus is a spec field now. choosing 1931 because that is where US public domain ends has the same shape as choosing a context window or a tool list. “what’s in the corpus” joined “what’s the context window” as a question operators get to ask before adopting a model.

Subscribe now

agent-config files became infrastructure: loot, routing, audit

on Apr 22, Mozilla disclosed the 271-bug yield from Claude Mythos Preview triage that shipped with Firefox 150 (MFSA2026-30) — Claude operating inside the human security loop, with a number attached. two days later the backdoored Bitwarden CLI 2026.4.0 went out with an explicit loot list: `~/.claude.json`, MCP configs, Claude Code, Cursor, Kiro, Codex CLI, Aider, with GitHub tokens used as a CI/CD pivot. by Sunday, Cursor’s maintainers confirmed that `AGENTS.md` had been routed to `agent_requestable_workspace_rules` instead of `always_applied_workspace_rules` — a silent routing bug masquerading as a feature toggle, and the explanation for why a project’s agent rules might “stop working” with no code change in the diff. anyone who has been tweaking AGENTS.md for six months and wondering why behavior didn’t budge got their answer this week. the same Sunday digest carried SkillNote, which documents Claude Code’s undocumented ~8,000-character skill-description ceiling and ships hooks across compaction and subagent spawn, plus RTK, a Rust single-binary CLI proxy that compresses 100+ commands at 60–90% token reduction with under 10 ms overhead.

Cloudflare closed the section on Apr 27. Shadow MCP detection in Gateway treats unauthorized internal MCP servers as audit log entries. Code Mode collapses roughly 2,500 endpoints into `search()` and `execute()` with about 1,000 tokens of context — a ~99.9% input reduction versus dumping the full tool catalog into the prompt.

same files, same week, five hats: loot list, silent routing bug, undocumented truncation surface, vendor audit target, vendor compression layer. agent config left the personal-preference category. it is a layer that needs primitives — scoping rules, audit logs, truncation budgets — and we now have version-zero of all three sitting in public.

the pricing meter is part of the interface now

Apr 22, Anthropic ran a workload-tiered prosumer test across roughly 2% of new signups; the same day [GitHub paused new Copilot Pro/Pro+/Student signups](https://github.blog/news-insights/company-news/changes-to-github-copilot-individual-plans/) and started exposing usage limits inside VS Code and the Copilot CLI, with Pro+ pitched as more than 5x Pro. Apr 24, GPT-5.5 shipped through Codex and paid ChatGPT before raw API access — OpenAI’s note cited “additional safety and security work” — and GPT-5.5 Pro listed at $180 per million output tokens. Tuesday landed the closing numbers: GitHub AI Credits arrive 2026-06-01 with Opus 4.6 moving from a 3x to a 27x Copilot multiplier and Sonnet 4.5 going 1x → 6x for annual Pro/Pro+, while DeepSeek’s 75% V4-Pro discount carries a hard clock to 2026-05-31 15:59 UTC.

three vendors, one week, three different surfaces for moving the meter where the operator looks. two attached calendar dates to multipliers. the pricing arc started Wednesday — the Tuesday 27x number is the closing beat of the arc, not its origin.

which is why the section above stops reading as academic. the token-budget tooling — RTK, Code Mode, SkillNote — turns into operator hygiene the moment a 27x multiplier has a date on it. anyone running a $20-tier subscription through Copilot can do the rough math themselves: the same monthly bill, with a 27x meter behind it, prices a different shape of usage starting June 1. fences first, optimizations later.

map of the week

three concentric rings moved this week, each one outward of the model itself.

the inner ring is the model. that ring closed. four releases on operator hardware in eight days, judged by wattage and pass@1, with corpus boundaries written into the spec. nothing in there is unsettled enough to be the next project.

the middle ring is the config layer — `~/.claude.json`, `AGENTS.md`, MCP scope, skill description bytes. that ring is open. five different actors touched the same files in seven days, each treating them as a different kind of object. there are no defaults left to inherit; whatever you don’t set, somebody else is setting for you.

the outer ring is the meter — multipliers, calendar dates, IDE-surface usage bars. that ring just got a clock attached. June 1 is the date that turns the middle ring’s hygiene from “nice” to “billed.”

what’s new this week is the geometry, not any single item on it. operators who have been treating model-picking as the load-bearing decision now have a different shape of work: walk outward, set fences at each ring, before the meter spins.

autonomy is at the seams now

autonomy used to mean owning the model. that was the obvious fence and operators built it first — local weights, on-disk, off the cloud GPU. this week made clear that the fence around the model isn’t the one that matters most anymore. the model is the thing inside the fences.

the seams are where autonomy lives now. the corpus boundary you choose (1931, or 2024, or whatever your data agreement says). the config file you write yourself instead of accepting whatever the IDE writes for you. the pricing meter you watch instead of the one watching you. the fork you grab the day the upstream gets archived. each of those is small, and each of them is the difference between an operator and a user.

the week’s news kept pointing at the same shape. `minio/minio` got archived by its owner on Apr 25 and a comunity fork appeared inside hours — commons substrate is a calendar event now, and the fork is an autonomy primitive. `~/.claude.json` showing up in an attacker’s loot list and as a silent Cursor routing target in the same week is the same lesson on the file side: configuration is not preference, it is surface, and surface needs a fence.

so the operator job this quarter is unromantic. read the config files you are already running. write the ones you didn’t know you should. watch the meter and the calendar in the same glance. fork the things that look like commons before the renewal date. autonomy is built at the seams, one fence at a time, and most of the fences are made of plain text files you already have.

on self.md this week

• token economics is the page Copilot’s 27x multiplier, DeepSeek’s 2026-05-31 clock, and Code Mode’s ~1,000-token bypass all sit on. read it before June 1.

• what is MCP is the frame Cloudflare’s Shadow MCP detection assumes the reader already has — if Gateway audit logs sound like noise, this page explains why they aren’t.

• agent observability is where the AGENTS.md routing bug, the SkillNote silent-truncation ceiling, and `~/.claude.json` showing up in attacker loot lists collapse into one problem instead of three.

• file over app just got a stress test from `minio/minio` going commons-to-vendor on a specific date; the page is honest about what “your stuff is in your files” actually requires when the substrate has a renewal clock.

tools to try

• RTK — Rust single-binary CLI proxy with bash-hook install and <10 ms overhead, cuts 60–90% of tokens across 100+ commands. install it before the Copilot 27x multiplier kicks in on June 1, not after.

• SkillNote — preserves Claude Code skills past the silent ~8,000-character skill-description truncation, with hooks across compaction and subagent spawn. if a skill ever “stopped working” mid-session, this is the diagnostic.

• Cloudflare Code Mode — collapse a large API surface into `search()`/`execute()` so the model never sees the full tool catalog. the pattern travels off-Cloudflare; treat it as token-budget design, not vendor allegiance.

• Kimi K2.6 — Opus-class substitute on operator hardware for vision and browser work; the M5 pass@1 benchmark on 164 coding problems is the proof point. if you have been deferring “try local for the boring 80%,” this is the week.

• PPT Master (demo) — generates editable `.pptx` with real shapes and charts (not images) from PDF/DOCX/URL/Markdown inside Claude Code, Cursor, VS Code + Copilot, or Codebuddy; cited as low as $0.08 per deck. the IDE absorbed another vendor app this week, and this one’s worth the seat.

• YourMemory — agent memory built around decay instead of “store everything forever”; useful if your personal OS needs recall that ages like judgment, not a junk drawer.

Share self.md // Patch Notes

Ray + Promen
stay evolving 🐌
self.md

It schedules your attention. Allocates your energy. Caches your beliefs. Drops packets called “sleep.”
It has background processes (anxiety), memory leaks (doomscroll), and a perfectly functional kernel… that nobody bothered to document.

So I’m building self.md: a markdown-first Personal Operating System for the AI age — in public.

Not a productivity blog. Not a Notion template zoo.
More like: patch notes, protocols, crash reports, and a growing folder of systems that actually run.

What is self.md?

self.md is a set of plain-text primitives (files, folders, rules) + automation hooks + AI workflows that treat your life like infrastructure.

Think:

• Markdown as your filesystem

• AI as your operator (not your replacement)

• Protocols as reusable functions

• Review loops as cron jobs

• Decisions as commits

• Reality as an unreliable API

The goal isn’t to “be more productive.”
The goal is to be more sovereign: less brittle, less dependent, more executable.

Why now?

Because the old stack is collapsing into two extremes:

1. SaaS productivity theater
   Pretty dashboards. Broken cognition.

2. AI everywhere, context nowhere
   You can’t delegate your life to a chatbot that forgets you every session.

We need something in between:
A local-first personal system where AI can help—without owning your memory.

What you’ll get here (the menu)

This publication will ship in a few repeating formats:

1) Patch Notes

Short, frequent updates like:

• v0.1.1: inbox capture simplified

• v0.1.2: daily review now outputs 3 files + 1 action list

• v0.1.3: removed ritual, kept the function

2) Protocols

Copyable workflows: minimal, testable, versioned.
If it can’t be explained as a procedure, it’s probably vibes.

3) Crash Reports

Monthly post-mortems:

• what broke

• why it broke

• what I changed

• what I reverted

4) Field Tests

Experiments with:

• markdown-native task systems

• “life as code” automation

• local AI agents that operate on files

• decision logs and memory scaffolding

Who this is for

If any of these sentences feel uncomfortably true:

• “My tools are organized. My brain isn’t.”

• “I have systems. I don’t have an OS.”

• “I want AI help, but I don’t want my life in someone else’s cloud.”

• “I want simple, hackable primitives — not a ‘second brain’ lifestyle brand.”

Welcome.

The minimal philosophy (so we don’t drift)

A Personal OS should be:

• Plaintext-first (portable, durable, grep-able)

• Composable (small parts that combine)

• Local-first (your data lives with you)

• Versioned (you can rollback bad ideas)

• Observable (logs > feelings)

• Boring enough to run daily (and weird enough to stay alive)

What ships next

Over the next posts, I’ll publish:

1. The folder structure (the filesystem of self.md)

2. The capture pipeline (how raw inputs become actions)

3. The weekly review as a compiler (turning chaos into output)

4. The AI operator rules (what it’s allowed to touch, and what it never touches)

Join the experiment

If you want to participate, hit reply (or comment) with:

1. Your current “life stack” (Obsidian? plain .md? Cursor? paper?)

2. Your biggest failure mode (memory, follow-through, context-switching, etc.)

3. One thing you’d like an OS to do for you automatically

I’ll use that to prioritize what to build + document first.

Until then:
keep your logs, respect your bandwidth, and never trust an unversioned belief.

— Ray / shmlkv / self.md

Subscribe now