Marginalia, Side Effects & Loose Threads on Rob de Roo

A warning about a dangerous command ran the dangerous command

Mon, 19 Oct 2026 22:30:00 +0200

I run several Claude Code sessions at once against one repository. They coordinate through a small message board: one session can tell another “I’m editing this file” or “don’t run that”. On 13 July one session tried to warn another about a destructive git command. The warning ran the command.

What happened

The session wanted to send a peer something like this:

msg peer "careful: do NOT run `git clean -fdxq` in the main checkout"

The message sat inside double quotes, and the command name sat inside backticks, the way you’d format code in Markdown. Bash doesn’t read Markdown. Inside double quotes, backticks are command substitution: bash runs whatever is between them and pastes the output into the string. So before the message was sent, bash ran git clean -fdxq in the main working copy.

Control Tower: one board for a fleet of coding agents, built mostly by the fleet

Mon, 19 Oct 2026 22:00:00 +0200

On a normal day I have six to eight coding-agent sessions open, Claude Code and Codex side by side, plus a few model windows and the BotSwarm consoles. Until September they lived in a pile of terminal windows across two screens. The failure mode wasn’t dramatic. A session would finish, or stop to ask a permission question, and sit there, waiting, because its window was behind three others.

So on 22 September I wrote down one success test for a new tool: on a normal day, across both screens, I never miss a session that is waiting on me. Two things were explicitly out of scope: it would not approve anything on its own, and it would not be a code editor. That tool is Control Tower.

Most of our contributors are dead: the persona system behind BotSwarm

Mon, 19 Oct 2026 21:30:00 +0200

Every agent in BotSwarm has a soul. That sounds grander than it is: a soul is a Markdown file. But it’s the part of the system I’ve spent the most time tuning by ear, and the part where the measurements surprised me most.

A way of thinking, not a costume

A soul file has a fixed set of sections, and the system parses them: a core identity, the agent’s domain, its decision principles, the anti-patterns it must avoid, a cognitive toolkit, the kind of thing that makes it curious, how it works with other agents, a few example sentences, output standards, and an evolution log. The falsification agent’s soul opens by calling it “the swarm’s falsificationist”, and ends its first paragraph with “I propose, the operator disposes.”

About 40 agents on one Strix Halo box: what I learned running three llama.cpp servers on a single iGPU

Mon, 19 Oct 2026 21:00:00 +0200

My agent swarm runs locally. There are 42 registered agents: feed watchers, analysts, judges, a coder, writers. All of them share one mini PC with an AMD Ryzen AI MAX+ 395 (Strix Halo, Radeon 8060S iGPU) and 128 GB of LPDDR5X, of which 64 GB is carved off for the GPU in the BIOS. Cloud models are optional extras. The local endpoint is the only one the system needs.

Here is what I’d tell someone setting up something similar.

Consiliences AI Operating Invariants — A Multi-Agent System Design Note

Mon, 19 Oct 2026 20:30:00 +0200

One invariant from a solo-built multi-agent research swarm, developed at the depth of the wave of ninety-six verdicts it downgraded in May, and what the rule looks like five months on.

Several coding agents, one git checkout: what actually broke

Mon, 19 Oct 2026 20:00:00 +0200

I often have four to six coding-agent sessions, sometimes more than a dozen, Claude Code and Codex side by side, working in the same repository at once, all in the same working copy. Worktrees would isolate them, but the long-running services serve code from the main checkout, so that’s where the work lands. This post covers what went wrong with git, measured, and the habits that fixed each problem.

1. Explicit paths protect your files, not your changes

Problem one was the obvious one. Session A runs git add on its files. Before it commits, session B runs a bare git commit, and B’s commit takes A’s staged work under B’s title. A commit meant to carry 9 files went out with 64.

Running an institution that's mostly software

Mon, 19 Oct 2026 19:30:00 +0200

When the institution is software, the architecture, the org chart, and the budget collapse into one file.

My agents broke one written rule 758 times. The hooks that refuse, they obey.

Mon, 19 Oct 2026 19:00:00 +0200

If you run coding agents for long, Claude Code or Codex, you end up with a large instructions file. Every time the agent does something wrong, you add a line. “Don’t do X.” “Always do Y.” After a few months mine was a long document of corrections, and I assumed it was working.

Then I measured one rule.

The `cd` rule

The instructions told every session not to prefix shell commands with cd to the project root, because the shell already starts there. Each redundant cd changes the command string enough that auto mode stops to ask me for approval. So every violation cost me a click.

Starting a personal site, eight months in

Mon, 19 Oct 2026 18:30:00 +0200

Why robderoo.com exists, what’s been built in the meantime, and what’s coming.