~/blog/tag/craft
Craft
On code quality, deliberate building and the craft of software development.
What I write about here
Software craft is what you cannot outsource. Most posts under this tag are about that, written in the era where the temptation to outsource is the highest it has ever been.
Here is the trade I keep seeing teams make. They reach for an agent because it ships features faster. The features ship. The bugs ship with them.
The code review gets thinner because the diff looks plausible. Six months later, nobody on the team can explain why the auth flow does what it does, and the last person who could has left.
The craft I am defending here is the part that does not show up in commit velocity. It is taste, and the instinct that something is off before you can articulate why. It is the willingness to read code carefully, including code you did not write. And it is the discipline to refuse a fix you do not understand.
None of that gets easier when an agent is involved. If anything, it gets more important. A pull request you would have caught on instinct because it looked weird is the one an agent will produce in a tone of perfect confidence. The reader has to do more work, not less.
That is the through-line of these posts. The model is a tool. The judgement is yours, and you do not get to put it down.
The full argument, with all the posts in one connected arc, is in the Software craft in the AI era guide.
best entry points
- The prompt is not the spec
The framing essay. A prompt carries intent, a spec carries constraints. Most craft failures are versions of this confusion.
- How to get better at reading code: a practice routine
The craft as a muscle. A practice routine for reading code, because everyone diagnoses the atrophy and nobody trains the cure.
- You can't spot the bug if you didn't write the code
The argument in its sharpest form. You only catch the bugs in code you understand. The craft is in the reading, not the writing.
Why AI gives everyone the same name: 505 runs across 19 models
Ask a model to name your project and you get the name it gives everyone with a similar brief. I gave 19 models ten naming briefs, from a game to a SaaS to a fantasy heroine, 505 runs in all, and counted how often they agree and how many of their favourites are already taken.
readHow to measure what AI delivers for your team (hint: not tokens)
Token leaderboards at Meta and Amazon were gone within weeks, and a small effort test shows why: spend and results move independently. Three measures that asking the model more often cannot improve, translated to a development team.
Your upload validator passed. Your server still got owned.
Bricksforge checked that an upload was an image, then trusted the browser to decide where its contents ended up. The lesson is in the handoff: a correct check can protect the wrong part of your workflow.
When do developers become redundant?
To cost you your job, AI only has to be cheaper than part of the team. Software postings are growing again, but mostly for seniors, and the same months show how quickly a company chooses a smaller team.
- 69unasked timestamps, of 83
Nobody asked for it: what coding agents add when you don't decide
Three days after taking the AI tells off this site, I wanted to know what they look like in code. So I gave 23 models the same three TypeScript tasks, 266 runs in five agent harnesses. Most of them add fields nobody asked for, every model line has a handwriting you can recognise, and two of the newest GPT models leave the data model as the prompt described it.
The AI tells on my site, and which ones I chose
A list of ten tells of AI-generated UI went round over the weekend, and item seven describes this site down to the fonts. Anthropic lists the rest of its look as a default in its own design skill. Asking which parts had a written reason separated my own choices from what an agent had added, and those additions went.
Nobody's agent went rogue
The FTC chair says AI agents are tools, and the developer who gave the instruction is liable. He is right about the tool and wrong about the instruction. The traces of the Hugging Face attack show an agent doing a great deal more than the task asked.
Eight reports, one bar: judging an AI safety sprint
I judged eight submissions at the Apart Research AI Incident Response Sprint. Keeping my own bar in the same place from the first report to the eighth took an apparatus, and the apparatus caught me dropping it three quarters of a level.
- 92%empty catches with a comment
Empty catch blocks in AI code: the comment that silences your linter
AI-generated code swallows errors in catch blocks that hold nothing but a comment, and ESLint's recommended config waves them through because of that comment. What I found in my own repositories, why a model writes it, and the rule that sees through the comment.
- 1,644commits without agent trailer
Who wrote this commit? Git attribution when an agent does the work
I went looking for the coding agent in 1,644 commits across ten of my public repositories. It left no trace at all. The thing that had quietly rewritten the authorship record was the merge button.