What Elixir Gives a Coding Harness for Free
José Valim's case for Elixir as a coding-agent harness holds up on the runtime. The tax is the ecosystem around it — sandboxing, plugins, and SDKs.
Jared Smith
Jared Smith is a founder and engineering leader who builds and runs the security and engineering function — at his own companies and fractionally for pre-Series-A teams that need that judgment without a full-time hire. 13+ years shipping production AI, distributed backend systems, and resilient multi-cloud infrastructure.
Latest posts
Metering LLM Usage Per Customer in Phoenix
ReqLLM emits token-usage telemetry; turning it into a per-customer invoice line needs an append-only ledger, integer-cent math, and idempotent writes.
Your Junior Dev Leans on the Agent. Good.
Telling a junior to use less AI is advice with an expiry date. Move the quality bar off style and onto verification — here's what that looks like.
The Hard Part Was Never the Code. It Was the Theory.
Senko Rašić is right that “code was never the hard part” insults programmers. Peter Naur explained what it actually gets wrong — in 1985.
Phoenix Secrets: runtime.exs, Fly.io, and LLM Keys
The compile-time trap in config.exs, why System.fetch_env! should crash your boot, and how to actually wire Fly secrets and LLM keys through a Phoenix release.
The Office Mandate Is a Measurement Failure
Return-to-office mandates are what companies reach for when they can't measure output. Agents just destroyed the last proxies that were limping along.
Every Insane Codebase Was Once Rational
Architecture certainty isn't on the menu. Decide for the horizon you can see — three to six months — and know which doors only open one way.
Nobody Got Replaced. Agents Got Added.
McKinsey didn't swap 25,000 people for AI agents. What its CEO actually said is more useful to founders — and changes the question to ask before hiring.
What I Check When I Inherit a Vibe-Coded App
The consultant's playbook for taking over an undocumented AI-built app after the builder walks away — what to audit first, and how to price it.
Multi-Tenant AI SaaS in Phoenix: Isolation That Holds
Tenant isolation for AI SaaS in Phoenix: per-tenant API key tradeoffs, Ecto context scoping, and the pgvector bug that leaks one tenant into another.
The Schlep Is the Only Moat Agents Can't Cross
Paul Graham's schlep blindness in 2026: agents made the fun half of your product free to copy, so the tedious half is the only part left worth owning.
What Four Months of Embedded AI Engineering Ships
What a sixteen-week embedded AI engineering rotation ships, month by month, from the first merge to the handoff artifacts that let it end.
Estimating Client Work When Agents Do the Building
Agent-era velocity is bimodal: the same feature can take 20 minutes or 3 days. How I scope, bill, and talk to clients about it honestly.
The Career I Built on Work Nobody Wanted
A career built on the audits, migrations, and offshore coordination nobody volunteered for — because that work maps a company fastest.
Your Coding Agent Has No Reason to Write Good Code
Coding models are trained on a pass/fail test signal. Maintainability isn't graded, so it isn't learned — and no harness you build can fix that.
AIOS v2: The Scope Is the Filesystem
A restructure log: what broke in the AIOS v1 tree at multi-scope scale, why identity-first beats type-first, and what shipped in v2.
Jose Valim Is Right: Anthropic's Incentive Problem
José Valim says Anthropic hasn't separated its security case from its commercial interest. He's right — and it's every frontier lab's problem.
Instrumenting LLM Calls in Phoenix with Telemetry
ReqLLM already emits token cost and latency telemetry events. The real gap is a few lines wiring them into LiveDashboard and PromEx, not another SaaS bill.
Detection Got Cheap. Remediation Didn't.
Microsoft just made vulnerability detection cheaper and more accurate. For a 12-40 person AI startup, that was never the bottleneck.
The One File Where Your AI Model Names Live
Model names scattered across every repo's config rot the day a model gets deprecated or repriced. One git-versioned markdown table fixes it for good.
What a 96% Security Benchmark Actually Measures
Microsoft's security system hit 96% on a benchmark this week. Here's what that score actually measures, and how to read any vendor's benchmark claim.
10 Ecto Query Patterns for N+1 and Beyond
The Iron Law for has_many vs belongs_to, plus when Dataloader, subqueries, or raw SQL are the honest fix, not another preload tutorial.
Isolating Parallel Claude Code Agents in Phoenix
Elixir/Phoenix mechanics for parallel Claude Code agents: templating PORT per worktree, one Postgres DB per branch, and asset-watcher collisions nobody covers.
What Reverse Acqui-Hires Actually Diligence
What a buyer's technical reviewer checks in a reverse acqui-hire when the code isn't the asset: key-person risk, IP scope, and contribution forensics.
The Four Claude Code Hooks I Run on Every Project
The exact hooks in this repo settings.json: a .env guard, a draft-post warn, mix format, a JSON validator, and the real matcher and exit-code mechanics.
Performance Reviews When Agents Do the Typing
Commit count and PR volume are agent-inflated now. Here's what I actually evaluate in reviews, and the 1:1 questions that surface real judgment.
What Together AI's $800M Round Says About Elixir
Together AI raised $800M at an $8.3B valuation. Its own job postings show Elixir/Phoenix on the BEAM running auth, orgs, and access control.
Why We'd Pick Elixir for an AI Startup Backend
A founder-readable case for Elixir as an AI startup's backend — what the BEAM gets right for agents, streaming, and durable jobs, and when to skip it.
Shadow AI at a Startup That Can't Buy a CASB
The enterprise shadow-AI playbook assumes a CASB budget you don't have. Here's the free, no-blame version for a 5-15 person team: three steps, zero procurement.
12 Phoenix LiveView Patterns for Production
Twelve Phoenix LiveView patterns that hold up in production — streams vs assigns, async mounts, PubSub gating, and the failure mode behind each one.
Testing AI Agent Outputs in Elixir with ExUnit
An ExUnit suite for agent loops in Elixir: asserting on tool-call order and hallucinations, not just final strings — plus evals that survive model upgrades.
The Onboarding Playbook for an Agent-Heavy Codebase
First-PR review, authorship transparency, and mentorship all change when half the diffs a new hire reads were written by an agent. Here's the process.
TDD With Claude Code in Elixir: What Holds Up
Where TDD with Claude Code actually holds up in an Elixir/Phoenix codebase — ExUnit async, mix precommit, Ecto.Multi idempotency — and where it breaks.
Security Engineer or vCISO? Your First Hire, by Stage
A security engineer builds; a vCISO decides. Which one your startup needs first, stage by stage — and the cases where the answer isn't a vCISO at all.
What I Put in CLAUDE.md After 50 Commits With It
The CLAUDE.md entries that actually earned their place on a real project — mistake-driven rules, not a speculative template you copy once and forget.
Secrets Management for AI Agents on Small Teams
Your agent doesn't need your production keys — its tools do. The broker pattern, per-tool scoping, and what a five-person team can skip despite vendor pitches.
Streaming LLM Tokens in LiveView, the 2026 Way
Token-by-token LLM streaming in Phoenix LiveView, no React — the 2026 async APIs, plus the production failure modes most tutorials skip.
Trust Is the Operating System
One operating system runs a team whether the teammate is a person or an agent. My blueprint: trust, pods, outcomes over hours, managing agents like interns.
The 17x Discount Hiding in Your AI Coding Bill
My team's $200 AI coding seats consume $1,800–$3,500 of API-priced tokens a month. The 10–17x arbitrage nobody prices in, and how to budget for it.
A Scared Team Is Your Biggest Attack Surface
A scared employee hands over access to avoid a manager's wrath — the exact move social engineering exploits. Why psychological safety is a security control.
What Cyber Insurance Underwriters Ask AI Startups
The cyber insurance application is a security audit in disguise. What underwriters check in 2026, the AI exclusions creeping in, and when coverage is real.
Build an MCP Server in Phoenix With Hermes
An MCP server lets Claude and other agents call your Phoenix app directly. How to ship one with Hermes — auth, transport, and safe tool boundaries.
AIOS: An AI Operating System in Plain Markdown
I open-sourced the AI operating system I run daily: a git-versioned markdown vault, cross-repo wiring, and a nightly ingest loop. Fifteen minutes to set up.
What an AI Agent Postmortem Should Contain
Classic SRE postmortems can't explain agent incidents. The sections to add — decision-time context, autonomy rung, permissions delta — with a template.
Why Auto-Filled Security Questionnaires Kill AI Deals
Why auto-filling an enterprise security questionnaire backfires on an AI startup — the answers that kill deals, and the questions your SOC 2 won't cover.
Building an AI Memory That Outlives Any Single Agent
Your accumulated agent memory is a bet on one vendor's format. Build a portable, git-versioned knowledge layer any agent can read instead.
The Claude Code Plugin Stack I Actually Run
The Claude Code plugins that earn a permanent slot in my stack, sorted by what they actually change — my process, my domain expertise, or just friction.
4,154 Commits in Six Months With AI Agents
I shipped more code in 2026 than the previous four years combined. The commits are real. The productivity is real. What I lost is harder to measure.
Programming Sucks, Now With Agents
An homage to Peter Welch's Programming Sucks, updated for agents: a genius intern with amnesia, hallucinated packages, and a closet that eats your auth layer.
Prompt Injection Defense for a 5-Person AI Startup
Prompt injection defense a five-person team can ship in a week — trust boundaries, least-privilege tools, approval gates, and what not to build yet.