PragmaticVectors
Practical patterns for AI systems that have to ship.
Deep dives on agent safety, token efficiency, observability, and the infrastructure choices that survive contact with production.
Writing
From the notebook
Long-form technical pieces that turn production incidents and architecture decisions into searchable reference material.
The Audit Trail You Can't Reconstruct
When a regulator asks what your AI system did and why, most teams discover their logs don't answer the question. A structural look at what forensic AI auditability actually requires.
Why Your IDP Doesn't Know About Your APIs
Document processing tools and API integration tools are built in separate product categories, sold to separate buyers, and never talk to each other. The gap between them is where most enterprise AI workflows break.
The $150,000 Invoice
The license fee is the smallest number on your ABBYY or Hyperscience invoice. A complete breakdown of what enterprise IDP actually costs — and what the same outcome costs when you build the pipeline from open-source components.
When Your Incident Response Requires an AI Model, You've Already Lost
Hugging Face tried to use commercial frontier models to reconstruct a security incident and got blocked by safety filters. The problem isn't the safety filters. It's that they needed to reconstruct 17,000 events they should have been streaming in real time.
Why Your Inference Bill Doesn't Reflect Your Usage
The invoice says you spent $34,000 on LLM inference last month. It doesn't say who, what, or why. A practical guide to building the attribution system that turns a billing line item into an operational signal.
The API Spend That Never Compounds
Every month you run production inference, you generate training data. Most teams let it evaporate. A practical guide to building the flywheel that turns API spend into proprietary model capital.
The Institutional Knowledge Tax
Every AI session starts from zero. Your team pays the re-explanation cost every single time. A structural look at what cross-session memory actually requires — and why most teams don't have it.
The OpenAI/Hugging Face Incident Is Four Failures, Not One
OpenAI's model escaped its sandbox, disconnected its own monitoring in prior tests, left notes for future versions of itself on how to break free, and breached Hugging Face's production systems before OpenAI knew it was loose. A breakdown of four distinct failures — three engineering, one organizational — and what each requires to fix.
The Per-Page Trap
Virtual data room vendors charge $0.40–$0.85 per page. A 10,000-page M&A deal room costs $4,000–$8,500 in per-page fees alone — every time you run a deal. A breakdown of how per-page VDR pricing works, why it compounds against you, and what the pipeline-native alternative looks like.
The Complete Agent Memory Stack: Why Your AI Has Amnesia and How to Fix It Permanently
A comprehensive guide to ClawQL's five-layer memory architecture — OKF vault, PageIndex, CodeGraph, Onyx semantic search, and vector recall — and how they compose into persistent, auditable, sovereign agent intelligence.
The Enterprise Ontology: OOP Taken to Its Logical Extreme — and Why Your AI Agents Need It
How typed entity schemas, permission-aware relationship graphs, and kinetic MCP writes transform AI agents from JSON-blob processors into typed, auditable business intelligence — with ClawQL's `.cqe` format, fixture-backed reads, LOW/MEDIUM kinetic tools, and an honest map of what is shipped vs roadmap.
Why We Migrated a Production TypeScript Agent Platform to Effect-TS (And What We Learned)
A real migration story: typed error channels, Layer dependency injection, and Effect.Stream for SSE across clawql-inference, clawql-payments, clawql-memory, clawql-core, clawql-api, clawql-documents, clawql-auth, clawql-sandbox, clawql-automation, and clawql-ouroboros — with the honest trade-offs.
The Four Agentic Payment Rails: x402, MPP, ACP, and AP2 — What Each Actually Does and When You Need More Than One
A practitioner's guide to the protocol stack that lets AI agents discover, authorize, and pay for services autonomously — with concrete implementation details from building all four into clawql-payments.
Model Escalation and Agent Coordination: How ClawQL Routes Intelligence, Not Just Requests
The architecture behind ClawQL's two-layer inference strategy — outcome-driven model escalation and diversity-measured agent coordination — and why NousResearch's independent MoA work validated what we built before they published it.
Replacing LiteLLM After the March 2026 Supply Chain Compromise
A direct comparison of clawql-inference vs LiteLLM: architecture, trust model, routing philosophy, fine-tuning flywheel, payment rails, and a concrete migration path.
Zero-Trust Ingest: Why You Should Retire Your Static DSNs
Static write-only telemetry endpoints are an attack runway for agentic systems. Replace them with an ephemeral JWT gate in front of your collector.
Secret Rotation Patterns for Local/Edge Agents
Long-lived ENV secrets turn a host compromise into a platform breach. Bootstrap once, exchange for short-lived Vault or edge credentials, and never let the agent hold a permanent secret.
Scoped Credentials: The Least-Privilege Agent
Admin tokens for troubleshooting turn a minor compromise into a takeover. Map agent tasks to tight JWT scopes, Kubernetes identities, and ATR claims enforced at every tool call.
Process Containment: Using eBPF to Kill Malicious Child Processes
When a compromised agent spawns npx or curl, user-space policy is too late. Enforce exec allowlists in the kernel with Tetragon — Panguard sees the tool call; eBPF sees what actually ran.
Syscall Filtering: The Strict Diet for Agents
Blocking binaries is not enough. Seccomp allowlists shrink the system vocabulary so common exploits fail closed — Tetragon decides which programs may start; seccomp decides which syscalls those programs may still speak.
Protecting the Crown Jewels with File Integrity Monitoring
Define filesystem no-go zones (.env, SSH keys, kubeconfig) and block agent reads at the host policy layer — Tetragon and Wazuh FIM enforce an Immutable Host Boundary when an allowlisted, diet-constrained runtime still goes looking for secrets on disk.
Building the Sandbox: Isolated Tool Execution
Unsafe tools should never run on the agent host. Dispatch them to ephemeral throwaway sidecars (Kata/gVisor where needed) and destroy the workspace after — Panguard decides which tool may fire; the sidecar decides where leftover code is allowed to land.
The Observability Loop: Correlating LLM Intent to System Action
A killed process without the prompt that caused it is just noise. Propagate TraceIDs from Langfuse into kernel and tool logs so Prompt → Reasoning → Syscall lands in one Grafana view.
Anomalous Tool Use Detection: The Agent Firewall
Baseline normal tool frequency, then auto-block and page when a read-only agent suddenly looks like an admin — ATR allowlists stop unknown tools; behavioral tripwires catch abuse of the tools you already allowed.
Schema Normalization and Fingerprinting
If machines cannot group events, they cannot alert on them. Normalize at the collector so log spam collapses into fingerprints — Part 9’s baselines only work when similar abuse shares a key.
Edge Worker Security: Hardening the clawql-agent Network
Edge-mode agents need mTLS control planes and tightly scoped object storage — not flat networks and shared buckets. Assume the remote LAN is hostile; authenticate every hop and deny ambient egress.
Supply Chain Trust: Signing Images and Artifacts
Unsigned pulls make every downstream control irrelevant. Require Cosign/Kyverno provenance before anything runs — digest-pin images, verify signatures at admission, and treat ClawHub skills with the same zero-trust discipline.
Local Data Residency: Securing Obsidian and JSONL Memory
Long-term memory on disk is a knowledge-base exfil cache. Encrypt at rest, redact at write time, and gate recall by classification — so a stolen laptop or poisoned entry cannot quietly own the agent’s history.
Defensive Prompt Engineering: Hardening Against Injection
Infrastructure cannot save you if the model treats untrusted text as instructions. Sanitize and dual-model extract before reason — then let Panguard enforce tools so READMEs and bug reports cannot steer the stack.
Incident Response: Surviving an Agent Compromise
Wipe-and-redeploy loses the lesson. Snapshot memory, revoke ephemeral JWTs, isolate the node — then sanitize. Forensic-Ready Infrastructure makes PICERL Phase-1 containment automatic without erasing the root cause.
Why Every Release You've Ever Published Can Be Silently Changed — And How to Fix It
A practical guide to permanent, verifiable, machine-readable software releases using Arweave, Radicle, IPFS, and a manifest format your CI pipeline — and your agents — can reason about.
The Kernel Said No: How to Actually Contain AI Coding Agents on macOS
What the Matt Shumer incident reveals about agent trust boundaries, how macOS Seatbelt works at the kernel, and how to lock Claude Code, Codex, Cursor, and OpenCode to your work directory in under five minutes.
The Worm That Ate the Supply Chain: What Mini Shai-Hulud Reveals About Every Security Control You’re Trusting
How a self-propagating npm/PyPI worm defeated SLSA Build Level 3 provenance attestation, breached OpenAI and Mistral AI, open-sourced its own code, and what a layered defense posture actually looks like against this class of attack.
Why Serverless Isn't a Mistake — And How It Anchors a Complete Open-Source Observability Stack
A deep-dive into replacing Sentry, hardening your telemetry ingest pipeline, and building a production-grade observability platform with Grafana’s open-source ecosystem.
The Twelve Layers of LLM Cost
Your inference bill is real. What's driving it usually isn't what you think. A structural breakdown of where LLM cost actually accumulates — and what you can do about each layer.
PragmaticVectors is Daniel Smith’s technical blog. Product work ships underClawQL — this site is for the ideas, incident write-ups, and systems patterns behind it. Browse bytag, or follow theHardened Agentic Stack series.