Luke Pezet

Agents, and the rails they run on

2024 – now

It started with a sommelier in a chat window. Then coding agents got good enough to leave running, which turns out to be a security problem long before it's a capability problem — and that is where most of the spare time goes now.

Secure Agent Lab

Run an autonomous agent without ever handing it a credential.

Goal

A Docker stack where the agent container holds no API keys, no .env, no tokens. Outbound HTTPS is intercepted by mitmproxy, which injects credentials fetched from a broker sitting on a network the agent cannot reach. Two networks, one door.

The hard part

The stack versions its security boundary by tag — but a deployment keeps its own bind-mounted copies of the proxy and broker files, so they don't move when the tag does. A lab can repin to a release containing a security fix and go right on running the vulnerable file. That gap is the entire reason the CLI exists: whatever installed those files has to be what updates them.

AgentLink

live

A platform for agents that need an identity before anyone trusts them.

Goal

Give agents a place to be registered, described and discovered — and a plugin surface that works across runtimes rather than one vendor's. The plugin collection is public and runs on both Claude Code and Hermes Agent; it covers Ed25519 agent identity, JWT issuance and reputation via Botcha.ai, plus a few less serious ones.

The hard part

"Which agent is this, and who is accountable for it?" has no good answer yet. Binding an agent identity back to a human operator, in a way a third-party service can verify without trusting me, is the part that keeps being harder than the code around it.

Seller Agent Lab

private

An agent earning real money, inside rails it doesn't control.

Goal

A hardened scaffold for running an autonomous seller agent on crypto agent marketplaces — picking up bounties, running paid services, settling in USDC. The agent gets a wallet's worth of capability without ever getting the wallet.

The hard part

Marketplace task descriptions are attacker-controlled input flowing straight into the agent's context. If the signing key lived in the worker, one successful prompt injection is one irreversible drain. So the key sits behind a broker with hard per-transaction and daily caps, a destination allowlist, and templated signing only — never "sign these arbitrary bytes", which is exactly how permits drain wallets. Anything above a threshold has to get a yes from a human over Telegram, and the watchdog that can pull the plug is deliberately not an LLM, so it can't be talked out of it.

Spec DSL

private in progress

A vocabulary a human and a coding agent can both edit.

Goal

A structured spec layer that sits above the code: a product-minded human authors and evolves it through a UI without ever opening a source file, and the agent implements it however it likes. Loosely inspired by Unreal's Blueprints, minus two things on purpose — no node-and-wire canvas (positions cost maintenance without adding meaning) and no runtime to debug against. The ToDo app running through it is the thread, not the destination: a domain boring enough not to distract, picked precisely because nobody would mistake it for the point.

The hard part

Getting the spec to stay authoritative. The moment the code and the glossary disagree, the whole idea collapses back into documentation nobody reads. Design-time only means the tests carry the entire observability burden, and it's the dull cases — completing an already-completed task, deleting a project with tasks still inside — where the vocabulary either holds up or doesn't.

Game Agent Lab

private

Game projects, each with its own sandboxed pair programmer.

Goal

A shared secure container stack where every game project gets a paired agent workspace with its own standing instructions, its own state, and a mount of just that game's source. Started as an excuse to build a shoot-em-up; became a decent test of whether the credential isolation actually survives daily use.

The hard part

Making the secure path the convenient one. Security that adds a step to every session gets skipped by Friday, so the whole thing collapses to one command that takes a project path and infers the rest.

VinCent

private

A personal sommelier that lives in a chat window.

Goal

A wine companion, and where the interest in agents started. A chat hub over websockets, a conversational agent with function-calling tools for the cellar — add a bottle, list what's in there, drop one — and a second agent that never speaks to you at all: it reads back over the history and maintains your profile, what you liked, what you didn't, which pairings actually worked.

The hard part

Splitting the agent in two. The one you talk to has to stay quick and in character, while noticing that you keep coming back to the same grape is a slower, more reflective job — and asking one prompt to do both makes it worse at each. So taste lives behind its own agent with its own tools, writing to a profile the conversational one reads. The chat transport is deliberately generic: the agents join the same socket hub a human client does, as bots, so the front end can change without the agents noticing.

Out in the world

United File Service

live

Simple, secure file exchange — small files and big ones.

Goal

Take file drop with notifications and third-party payment processing all the way to a production-grade serverless service, not a demo. Pay only for what you need.

The hard part

Serverless is cheap until someone uploads 40GB. Most of the work was in the parts that aren't the feature: upload resumption, cost modeling, and the payment path.

Tools and libraries

Mostly things I wanted to exist while working on something else.

ETL-JS

Sharable, repeatable ETL from the command line.

Goal

Script ETL by leaning on the tools already installed — mysql, ssh, curl — instead of replacing them. A YAML file describes the steps; the CLI runs them anywhere.

dbt Profiler

Profile a schema without moving the data anywhere.

Goal

A dbt project that profiles a table or a whole schema in place — nulls, cardinality, modes, and the character patterns a column actually contains — by generating the SQL and letting the warehouse do the work. Point it at a schema and it profiles everything in it; narrow it to one table, a column list, or a smaller pattern budget when the defaults get expensive.

The hard part

Profiling is cheap right up until a column is free text. Patterns and modes over long strings are what turn a quick query into a full scan, so most of the knobs — character length, pattern count, mode count — exist to keep it affordable on real tables rather than on the demo dataset. Results append incrementally by default, so successive runs show a schema drifting instead of just describing it today.

MKay Diary

A dev diary that lives next to the code.

Goal

Working on lots of small projects, a daily entry turned out to be the cheapest way back in. Coming back after a long idle stretch, the diary is what tells you where you left off — and sometimes it's just nice to read a train of thought back.

Cue Me In

Watch a thing, get told when it changes.

Goal

A library and CLI for monitoring processes and web pages, and an excuse to work through OAuth from a CLI program — spinning up a local callback server — plus serverless functions and a managed user base.

HPCC Cluster

Create and manage HPCC Systems clusters from JavaScript.

Goal

Cluster management for the HPCC Systems platform as a library and a CLI, with config sets, so standing one up stopped being a manual afternoon.

King

Rate limiting, and what it actually costs.

Goal

Named after Kong, this was a research project into implementing rate limiting on Redis and then working out its real cost model — the headers are easy, the accounting isn't.

AWS MFA

One command between you and an MFA-gated AWS CLI.

Goal

A small bash script that trades an OTP for temporary credentials and writes them back into your AWS config as a new profile, so every following command just works.

Testing, and other people's code

Two smaller repos that say more about how I work than about what I've shipped.

Test Coverage, Compared

The same class, the same useless test, three languages.

Goal

A three-method class written as identically as possible in Python, TypeScript and Java, paired with a test that deliberately asserts nothing and calls nothing. Every coverage tool should report zero. That's the whole experiment.

The hard part

Only Java gave the honest answer — JaCoCo reported 0%. NYC reported 0% at the function level, but 25% at the statement level, counting the function signatures themselves as misses. Coverage.py reported 57% for code where not one method was ever called. A coverage number is a claim about your tests, and it's worth knowing which tools will make that claim on no evidence at all — and how much configuration it takes to stop them.

Comment Test Coverage

A GitHub Action I forked, and then kept.

Goal

Upstream posts a coverage summary as a PR comment. I needed it to work in a monorepo, so I added an id input letting several projects each own a comment on the same PR — and then kept going: an issue_number input so it runs outside pull_request events, Node 20, regex with named capturing groups, and editing the existing comment in place instead of deleting and re-posting it on every push.

The hard part

Thirty-four commits and three releases ahead of upstream, none behind. Forking is the cheap part; the bill arrives later, when what you changed includes a bundled dist/ you now own and every upstream fix has to come across by hand. Worth it here, because the alternative was writing an Action from scratch to solve a problem somebody had already solved nine tenths of.

Earlier work worth keeping

Older, and still the ones that come up.

ARTS Core

private

The retail industry's own data model, actually implemented.

Goal

An implementation of the operational data model from the Association for Retail Technology Standards, built as a Quarkus service with GraalVM native builds and Flyway migrations. Party and person up through customer, membership account and account type; business unit, store, workstation, till, operator and session; and the retail transaction that ties all of it together.

The hard part

The reason to implement somebody else's model instead of inventing one is that the standard is a catalogue of things that look like a single field until you learn why they aren't. A manufacturer's coupon is tendered after tax; a store coupon is a promotion applied before it. Selling a voucher means holding money that isn't yours yet, so the expiry date is a liability control rather than a UX decision. Inventory isn't a count, it's a lifecycle — including a state for stock that has quietly gone missing since the last cycle count. Most of the work was reading, and most of the value was the edge cases I'd otherwise have met in production.

UE4 Dialogue System

Branching dialogue for Unreal Engine 4.

Goal

A dialogue system built while making a side-scroller, and the most starred thing I've put on GitHub — which says something about where the demand was.

HPCC Systems / ECL

Bundles, benchmarks, and a bridge for SAS users.

Goal

Years of data work on HPCC Systems, packaged up: a bundle of the operations I kept rewriting, big-data benchmarks ported to the platform, and SASsy — a helper for SAS users trying to get their bearings in ECL.

Java patterns

Circuit breakers, buffered iterators, and other repeat offenders.

Goal

The classes I kept re-implementing at work and on personal projects, collected in one place with tests — circuit breaker strategies being the ones that earned their keep.

Side quests

Not everything is infrastructure.

Pressor

private

A pressure sensor on a Seeed XIAO nRF52840.

Goal

Embedded firmware on a BLE microcontroller, mostly to remember what it's like to work somewhere with no garbage collector and a hard memory ceiling.

Scribe

private

Separating what happens in a story from how it's told.

Goal

A story-generation approach that splits an immutable axiom layer — events, setting, cause and effect — from a style layer that can be swapped freely. Same chain of events, delivered as noir or as gothic.

The hard part

Keeping the two layers genuinely independent. Models want to let style leak into the facts, and once the voice starts changing what happened, there's nothing left to swap.

And a long tail of the rest

A SAS port to ECL, an Unreal Engine shoot-em-up, rate limiters, circular buffers, a study of how differently languages report test coverage, blockchain experiments, a Starlink monitor. I try hard to finish what I start, but there are still only twenty-four hours in a day.

Everything on GitHub