[bmdpat]
Download BMD free
All writing
8 min read

BMD HODL devlog - week of 2026-05-03

I spent the week tightening the AgentGuard release path, shipping proof-heavy docs and perf fixes, and keeping the benchmark gap visible instead of hand-waving it away.

#devlog#weekly
Share LinkedIn

TL;DR

  • The biggest move this week was tightening the AgentGuard release path across the site, the public SDK repo, and the dashboard at the same time. The book is still trailing passive benchmarks.
  • bmdpat shipped prebuilt blog routes to cut FCP, deferred non-critical home client components, owner notification on first subscriber signup, Vercel Speed Insights, and a strict Zod schema on /api/blog.
  • Autotrader combined book +7.06% all time, trailing SPY by 6.32 points and BTC HODL by 8.43 points. Weekly alpha vs BTC was about -1.5 points.
  • Closed loops: 2 install intents on 7 CTA clicks across the 2026-05-03 through 2026-05-09 window. AgentGuard PyPI: 297 downloads over the last 7 days as of the 2026-05-10 metrics scrape.

Try the AgentGuard example

The biggest move this week was tightening the AgentGuard release path across the site, the public SDK repo, and the dashboard at the same time. I shipped proof-heavy docs, cleaned up release surfaces, pushed performance fixes on bmdpat, and made the dashboard release operator stricter. I also kept autotrader honest. The book is still trailing passive benchmarks, so this week was about removing loose edges and making the system easier to trust.

What shipped

bmdpat

  • PR #397: prebuilt /blog/[slug] to cut blog FCP.
  • PR #396: deferred non-critical home page client components off the initial bundle.
  • PR #395: added owner notification on first subscriber signup.
  • PR #394: installed Vercel Speed Insights.
  • PR #393: updated the AgentGuard landing page MCP setup.
  • PR #391: tightened /api/blog input validation with a strict Zod schema.
  • PR #390: promoted the newsletter to the primary blog CTA and added blog view tracking.
  • PR #389: drafted AgentGuard launch materials.
  • PR #388: added an AgentGuard release checklist.
  • PR #387: added AgentGuard quickstart proof.
  • PR #386: fixed AgentGuard funnel accuracy.
  • PR #242: sharpened the homepage trust pass.
  • PR #241: sharpened the homepage around AgentGuard.
  • PR #209: shipped the "Future of Programming" YC demo.

agent47

  • PR #465: documented managed-agent threat and cost surfaces.
  • PR #461: published AgentGuard skill distribution docs.
  • PR #459: added release cadence docs.
  • PR #458: cleaned root docs and improved query_traces metadata.
  • PR #457: added Glama badges and cleaned root docs.
  • PR #456: improved Glama metadata quality.
  • PR #455: recorded the first Glama MCP release.
  • PR #454: made the budget MCP entrypoint dogfoodable.
  • PR #452: bumped hono in mcp-server.
  • PR #449: bumped ip-address and express-rate-limit in mcp-server.
  • PR #447: added the PocketOS incident to the README "Real Incidents" section.
  • PR #444: published typed contracts for the public SDK surface.
  • PR #442: added the deployed-agent guard profile.
  • PR #440: added the local-first agentguard-mcp budget server.
  • PR #438: fixed release hygiene docs.
  • PR #437: guarded hosted dashboard handoff copy.
  • PR #436: added MCP proof gallery coverage.
  • PR #435: added first-run CLI fallback guidance.
  • PR #432: added the sticky agent proof fixture.
  • PR #430: added the optional MCP npm release guard.
  • PR #429: fixed MCP package release consistency.
  • PR #427: added the dashboard handoff guide.
  • PR #426: clarified the incident dashboard handoff.
  • PR #424: added the optional Pydantic AI starter recipe.
  • PR #411: bumped build in GitHub requirements.
  • PR #410: bumped github/codeql-action.
  • PR #388: bumped bandit.
  • PR #386: bumped ruff.

agent47-dashboard

  • PR #158: recovered from closed dashboard connections.
  • PR #157: fixed static quickstart navigation.
  • PR #156: split Release Operator MCP and ingest keys.
  • PR #155: made Release Operator MCP dogfood strict.
  • PR #154: dogfooded MCP servers in the release operator.
  • PR #153: added AgentGuard MCP dashboard onboarding.
  • PR #151: fixed the hosted trial readiness path.
  • PR #150: added the release distribution packet.
  • PR #149: hardened the SDK proof contract fixture.
  • PR #147: added the AgentGuard release train plan.
  • PR #146: added the public CrewAI proof route.
  • PR #145: added distribution post assets.

autotrader

  • PR #15: failed closed on the stale Thursday eval gate.
  • PR #11: fixed idle cash deployment discipline.

What I learned

  • 2026-05-08-claude-code-cve-2026-39861-sandbox-escape: trust has to fail closed. If a coding agent can keep write power after the trust boundary shifts, the bug is structural.
  • 2026-05-07-computer-use-45x-more-expensive-than-apis: agent economics matter more than demos. The wrong interface can wreck margins before the product has a chance.
  • The PocketOS incident still paid rent this week. Real incidents sharpen runtime-safety docs faster than abstract best practices do.

Numbers

  • Autotrader: combined book +7.06% all time, trailing SPY by 6.32 points and BTC HODL by 8.43 points. Weekly alpha vs BTC was about -1.5 points.
  • Closed loops: 2 install intents on 7 CTA clicks across the 2026-05-03 through 2026-05-09 window.
  • AgentGuard PyPI: 297 downloads over the last 7 days as of the 2026-05-10 metrics scrape.

If you want the thing I am building in public, start here: https://bmdpat.com/tools/agentguard

FAQ

What was the main theme that week?

Tighten the AgentGuard release path on the site, the SDK, and the dashboard. Ship proof-heavy docs and keep autotrader honest against passive benchmarks.

How did autotrader stand?

+7.06% all time, trailing SPY by 6.32 points and BTC HODL by 8.43 points. Weekly alpha vs BTC about -1.5 points.

What did the funnel and PyPI show?

2 install intents on 7 CTA clicks in the 2026-05-03 through 2026-05-09 window. 297 AgentGuard downloads in 7 days as of 2026-05-10.

Get the Local AI Field Kit

Four copy-ready tools now, then one evidence-backed Local AI Lab Note on Friday when there is something worth sharing.

Try the free agent run check first

Get the requested artifact now, then at most one evidence-backed Local AI Lab Note on Friday when there is something worth sharing. One-click unsubscribe. No sponsored placements. Privacy.

PH

Patrick Hughes

I build BMD and publish measured AI runs, failure reports, and reusable checks. Nashville, Tennessee.

More writing