Build or Replaced
Today: Local Wikipedia: Wikipedia, but only for things a half hour walk from you | Quad9 to exit France | eMudhra to exit global SSL/TLS certificate business Episode date: 2026-10-23.
Download MP3 →JOSH: It's Friday, October 23. This is Build or Be Replaced, powered by ScanBrief.dev. I'm Josh, here with Erik Anderson. ERIK: Today's theme is walls. Everybody is building agents. Almost nobody is building the box around them. JOSH: Stick around, Erik's got an AI pro tip at the end about making Claude prove its own code before you ever read it. [pause] JOSH: Episode 133. ScanBrief scored 108 items across 56 sources this morning. Anything good? ERIK: Average relevance came in at 51.7. Most of it was noise, but the top of the list had a theme. Isolation, trust, and who's allowed to touch what. [pause] JOSH: Headline one. Quad9 is exiting France. For people who don't know, that's the privacy-focused DNS resolver. Why does that matter? ERIK: Because DNS is plumbing, and plumbing gets regulated first. When a free resolver with a clean privacy record pulls out of a whole country, users lose the option. Then they default to whatever their ISP hands them. I've spent years in networks. The boring layer is always where the leverage is, and that's why governments go there. [beat] JOSH: Next. eMudhra is leaving the global SSL/TLS certificate business. ERIK: Fewer certificate authorities means less competition and more concentration. It also means if you're hardcoding a CA anywhere, go check. Automate your renewals and don't care who issues the cert. That's the whole lesson. [beat] JOSH: And Xbox wants you to pay 24 to 40 cents an hour to stream games you already bought. ERIK: Do the math. Ten hours a week is a few dollars a week, on top of a game you own. You're renting your own library. That's where every subscription model ends up if nobody pushes back. JOSH: That's wild. ERIK: It's a pattern. Own the thing or rent the thing, and the rent always goes up. [pause] JOSH: Okay, deep dive time. There's a project called OpenShell. A safe, private runtime for fleets of autonomous AI agents. Why did that one catch your eye? ERIK: Because it's the problem I live in every day. Running one agent is easy. Running a fleet is a different job. The summary says it does sandboxed execution and data isolation, and that's the part that matters. Agents are going to do things you didn't predict. The question is what they're allowed to break when they do. JOSH: You run a fleet. How big? ERIK: Twelve agents in the Bobaverse right now. Neo, Homer, Bill, Echo, Gandalf, a mix of Claude and GPT. And a hundred forty services running on the production server. So when I say the walls matter, that's not theory. [beat] JOSH: So where are your walls? ERIK: Layers. First, agents don't edit prod. Code goes to Echo, the dev box, then through PrimeBus, then Gandalf reviews it, then it lands on Neo. An agent can write a fix. It can't ship a fix on its own. JOSH: And Gandalf is the reviewer. ERIK: Right. Here's the number I like. PrimeBus auto-merger has run 2,295 attempts since June 5th. 1,507 merged. 788 blocked by Gandalf. And zero escalated to Erik. JOSH: Seven hundred eighty-eight blocked. That sounds like a lot of failure. ERIK: Wrong read. That's the guardrails working. Those are 788 changes that would have hit production without a wall. The blocked count is the story. If it were zero, I'd be worried the reviewer was asleep. [pause] JOSH: What about the data side? OpenShell talks about privacy. ERIK: Same idea. PrimeRouter is the gateway for every model call in the fleet. Priority tiers, failover, caps. An agent doesn't get to pick its own provider and spend whatever it wants. It asks the router, and the router decides, and there are hard daily limits on the cloud lanes. If a cap trips, it falls back. It doesn't keep spending. JOSH: So the agent isn't trusted. ERIK: The agent is useful and not trusted. Those are different things. A contractor can be great and still not have the keys to the building. [beat] JOSH: Does a tool like OpenShell replace what you built? ERIK: Probably not for me. My setup is custom and it grew over time. But for someone starting today, yes, start with a runtime that gives you isolation by default. Retrofitting walls onto a running fleet is miserable. I know, because I did it. JOSH: What would you check before adopting one? ERIK: Three questions. What can an agent read? What can it write? What happens when it hangs? That last one is what PrimeSentinel is for. It watches for stuck jobs. Agents don't always crash. Sometimes they just sit there burning time, and a watchdog catches that. [pause] JOSH: Second deep dive. A post says LLMs are making formal software verification feasible at a much larger scale. Walk me through it. ERIK: Formal verification means you mathematically prove code does what the spec says. It's always been the gold standard and always been too expensive. You needed specialists and months of work for small programs. JOSH: And now models do the heavy lifting? ERIK: That's the claim. The model writes the proof, and a checker verifies the proof. And the checker doesn't care if the model is confident. It either passes or it doesn't. JOSH: Wait, really? So you don't have to trust the model. ERIK: Right. That's the whole trick. You don't trust the author. You trust the checker. This is the same principle as Gandalf, just stricter. A reviewer that's separate from the writer. [beat] JOSH: Does this change how regular engineers work? ERIK: Slowly, then all at once. Most of us won't write formal proofs. But the pattern spreads. Define what correct means up front, let the model grind, and let a machine check the result. Tests are the poor man's version, and tests are fine. Most people just don't write them before asking for code. JOSH: There's a 1978 piece on the list too. The foolishness of natural language programming. ERIK: Good pairing. The argument back then was that English is too vague to program in. Still true. That's why the spec is the real work now. A vague prompt gets you vague code, and a precise spec gets you something you can check. [pause] JOSH: Last deep dive. Ask HN: if the models are so good, why doesn't OpenAI just start 100 companies? ERIK: Fun question. The answer is that models are not businesses. A model can write the code. It can't find the customer, earn the trust, handle the support email at two in the morning, or carry the legal risk. JOSH: But isn't that what you're doing? One guy, a fleet of agents? ERIK: Sure, and here's the honest version. The agents make me faster. They don't make me a business. ScanBrief has the pipeline, the scoring, the delivery. Someone still has to decide what's worth reading and who it's for. That part is judgment, and judgment is still the human job. JOSH: So the answer to the post is? ERIK: Because the bottleneck moved. It used to be building. Now it's knowing what to build, who needs it, and whether you can be trusted with their problem. If you can do that, the building is cheap. And that's the opportunity. [beat] JOSH: Also on the list, Docker is weird. ERIK: Quick take on it. The post shows containers are just isolated processes using namespaces and cgroups. No magic. And that connects to everything today. Isolation isn't a product. It's a few kernel features and discipline. Learn what's underneath and you'll build better walls. [pause] JOSH: One more from the list. Someone broke the PHP RCE embargo by accident and posted an apology. ERIK: Respect for owning it fast. Embargoes exist so defenders get a head start. The lesson for builders is boring. Have a process for what you can say publicly, because one casual post can undo weeks of coordinated work. [pause] ERIK: This episode is sponsored by Prime Automation Solutions. If you're still doing it manually, we automate it. Also, special on a website — $250. primeautomationsolutions.com [pause] JOSH: Alright, what's the AI pro tip today? ERIK: Write the check before you write the code. Before you ask Claude to build anything, write down three to five things that must be true when it's done. Make them executable. A test, a script, a command that returns pass or fail. Hand those to the model first and say, make these pass, and don't touch the checks. [beat] ERIK: Then open a second session, fresh context, and have it review the diff against the checks. Not the same session that wrote it. The writer is biased toward its own work. A separate reviewer isn't. That's the same wall we talked about all episode. Author on one side, checker on the other. ERIK: If you can't write the check, you don't understand the task yet. Better to find that out before the model burns an hour on it. That's your tip. Use it. [pause] JOSH: Binge all five episodes this weekend plus our YouTube shorts. Links at buildorbereplaced.dev. [beat] JOSH: One more thing — we started a Discord for builders. If you're shipping AI, automation, or anything that makes a human obsolete — come hang out. Link at buildorbereplaced.dev. ERIK: Post what you built. We'll post what we're building. Real wins, real builds, no fluff. [pause] ERIK: Build or be replaced. JOSH: If you want these signals in your inbox every morning, scanbrief.dev. See you tomorrow.