blog.surfstyk.com

Author: surfstyk

  • Fifty-Two Thousand Transactions a Day. I Counted the Humans.

    Fifty-Two Thousand Transactions a Day. I Counted the Humans.

    This morning I posted in the community of the Nimiq Mini Apps competition. It was a long post, and every number in it traced back to a source. At the bottom I attached the only GIF that fit: Obama at the podium, eyes closed, two fingers at his lips, his other arm out wide, letting the microphone fall.

    The title said it plainly. “Why I’m not doing Cycle 3.”

    Stakes didn’t place in Cycle II, and I won’t enter the next one. Here I’ll go one step further than I did over there. I’m done building on Nimiq.

    If you’ve followed this blog for a while, that might surprise you. In July I told you about the key I left in 2021, a Nimiq login file I dug out of an old MacBook. I made my first Nimiq wallet in January of that year and tried to talk my whole family into it. I was a fan. Some of that hasn’t changed. A login you drag in as a picture. Payments that take one tap, with no gas and no seed phrase. Those are still some of the best ideas I’ve seen in this space.

    But good ideas need people standing on them. When I went looking for the people, I mostly found machines.

    What’s on me

    My part first, because it’s the part I can’t argue with.

    Fifteen points went to real usage, and the full fifteen needed 25 users or more. Twenty-two wallets transacted with Stakes. Nimiq Pay sends from changing addresses, so the number of actual people behind those 22 is probably lower. The bar was public from the 3rd of September. I missed it.

    So yes, I’m disappointed. You enter a competition to win.

    That’s part of it. The bigger part is how this cycle was run, and what I learned about building on Nimiq along the way.

    A deadline is a deadline

    Stakes changed shape over Cycle II. It started as a social game, a crew of friends putting money on the same goal. It turned into something much more personal. You pick the one thing you keep putting off. You put a little money on your word. Then, as the app itself says, today is the whole game. Your day closes at a time you can see on the screen. Make the day by then, or that day’s slice is gone.

    So I noticed every time the competition moved one of its own dates.

    Cycle II was first published as 10 August to 7 September. It ran from 24 August to 18 September. Cycle III was set for 14 September, then 7 October, and now 14 October. Results were due on the 2nd of October. They came out on the 8th.

    The scoring changed ten days into the cycle. Design dropped from 25 points to 10, and a new 25-point Nimiq category appeared. Last time I wrote that most of my hours went into the surface, into making something feel calm inside a window the size of a postcard. That’s the category that shrank.

    The prize split changed at the end. The rules page said $10,000, $5,000 and $2,000, and it still does. Then first place became $7,000 so a fourth app could be paid. I’m happy for everyone who got paid. A published prize should still be the published prize.

    There was no freeze. Submissions closed on 18 September, but apps are judged live, and nothing says which version counts. Some apps kept shipping all through the judging weeks. I froze mine. Zero commits and zero deploys from 12 September to 3 October, because I read “deadline” as a deadline.

    Fifteen points rode on “unique users,” and nowhere does it say how a user is counted.

    And open source only applied at the door. Entries had to be public repos under the MIT license. One of the winners passed that check on 18 September. Today its repo says “page not found.” I don’t know when or why. Nothing in the rules forbids it, and I’ve made the Stakes code private too, now that I’m out. But a winning app whose code nobody can read anymore doesn’t sit right with me.

    All of this is allowed, by the way. The rules say they can be changed “at any time without notice.”

    Allowed and fine aren’t the same thing.

    Building on the platform

    Even a perfectly run competition wouldn’t have fixed the platform.

    On iOS a mini app can freeze on top of the wallet after a normal app switch, and only a force-quit gets you out. It hits other mini apps too, so any judge could have run into it on any entry. I filed it on 4 September with a full reproduction. Five weeks later, no reply from Nimiq.

    There are no notifications. The whole app is built around a day that closes at a set time, and it has no way to tell you that time is running out. If you don’t open it, nothing reaches you.

    On Android you can’t share an image out of a mini app. Only a link gets out. The app is personal now, but it still has a social side: when you keep a day, you get a card worth showing someone. On Android that card stays inside the app.

    A mini app also has no cheap way to tell a real person from a script. I learned that one the fun way, three hours after launch.

    On the 1st of October, in the middle of judging, one operator switched off the community block explorer, the public RPC node Stakes read from, and the site that listed the mini apps. Payouts for three real challenges, with real money in them, stalled for three and a half days before I caught it. The listing link I gave you in my first post about Stakes now opens a sunset notice.

    Builders were encouraged to bring improvement ideas to the forum. New members can’t open a thread until they reach Trust Level 2, and my post is still waiting for approval. The roadmap intro thread has 339 views and zero replies. The whole forum had six posts last week.

    And the community. I’m honestly not sure where it lives. I thought it was on Skool, then it turned out there’s a forum too. The competition page tells you to show up, and warns that builders who “build and forget” will score lower. Some people really did show up, week after week, helping other builders. I’m level 5 on that Skool board myself. None of those helpers got a mention, and in the scoring, community was worth two points, for a single post. I’d like to see that change, for their sake.

    I counted the humans

    Which brings me to the chain itself.

    Block explorers show about fifty-two thousand Nimiq transactions a day. That number is real, and it’s growing. The twelve-month average is around thirty thousand.

    I wanted to know who’s behind it. So I pulled every transaction from one full day, 8 to 9 October, and sorted them.

    About forty thousand are staking operations. More than half of those come from a single bot.

    Most of what’s left comes from six automated addresses. The busiest is a payout bot for browser mining. It sends 8,665 transactions a day on its own, each with the same little message: “You mined NIM on Nimiq.Space!”

    Take all of that away and you’re left with payments from ordinary wallets. About 1,100 that day. One payment every eighty seconds, across the whole chain. Roughly two in every hundred of the transactions the explorer shows you.

    You can be generous. One address looks like an exchange paying out withdrawals to real people. Count it in and you get about 1,400.

    One day is one sample, and days vary. I’d happily be shown a better one. For scale, though: 142 apps were entered in Cycle II.

    Behind the big number, for people, it’s close to a ghost town.

    Machines paying machines doesn’t bother me. I build agents for a living, and I expect a lot more of it, on every network. But stakes.day is made for a person and one day of their life. The app lives inside the wallet, so that person has to be in the wallet first. A personal app still needs people. You don’t find them in a crowd of bots.

    An empty lineup

    Surfing is about as personal as it gets. Nobody paddles for you, nobody rides your wave. An empty lineup is the dream: every set is yours.

    What I built is personal in the same way. It’s your moment and your day, and nobody can bank it for you.

    But here I’m not the surfer. I’m the one building something for other people to use. A beach with nobody on it is a beautiful place to surf and a terrible place to open a surf school.

    I dip into a lot of waters, and I like it that way. This one had beautiful water. The technology does things I still wish the rest of the industry would copy. But good engineering doesn’t bring people. People come for each other, and they stay where the others already are.

    That’s what I’m taking with me, and it reaches well past crypto. A big number tells you something is moving. It doesn’t tell you who. In my last post I wrote that I only count money coming in from a real person, because it’s the one number nobody can farm. The same rule works on a whole chain. Count the humans.

    What happens now

    I’m not entering Cycle III. The competition chapter is closed for good.

    Stakes stays live for now, for anyone who uses it.

    The code is private. Last time I wrote that I hadn’t taken either sign down, the “hacking welcome” in the code or the invitation to come and play. One of them is down now.

    What carries forward is stakes.day. The name, and the idea inside it.

    Here’s what it is today. You pick the one thing you keep putting off, and day one starts the moment you tap, for free. Then you put a little money on your word, anywhere from a few days to a month. You make the day, once a day, and every day you keep goes onto the chain. Finish, and your money comes back with a bonus on top. In the corner sits a small red dot. Tap it when the day gets hard and it hands you a few words and one small next move. It doesn’t watch you, and it keeps no score. And when you bank a day, you can still show someone.

    Stake, dot, day. That’s the whole idea, and it’s the name. Win your moment. Bank the day.

    It goes on. Just not in a ghost town. Where it lands, I’ll tell you when it’s ready.

    It was a good experiment, with every caveat above. I put hundreds of hours into it, and I know a lot of the other builders did too. Congrats to the four apps that won. You shipped, and people use what you built. To everyone still building here, I wish you a good run.

    No hard feelings. Peace.

  • I Asked the Internet to Hack My Nimiq Mini App. It Took Three Hours.

    I Asked the Internet to Hack My Nimiq Mini App. It Took Three Hours.

    The house was quiet. The sun was still sleeping, the dog was already walked, and the first coffee was in my hand and still hot. This is my hour, the one before the day starts asking things of me. I sit down, open the laptop, and see what moved while I wasn’t looking.

    What moved, this particular morning, was somebody trying to rob me.

    It was not much of a robbery, and I will get to the haul, because the haul is the best part. But there it was, waiting for me on a Thursday at seven: a couple hundred automated requests, fired at my brand new app in a tight burst around midnight while I slept, every one of them reaching for the same thing. The money.

    I read it, and I grinned into my coffee. Because a day earlier I had put two invitations out into the world. This was the second one, and it got answered first.

    The hundred hours before the knock

    Back up a few weeks.

    Stakes is a small app I built for the Nimiq Mini Apps competition. You put a little money on a promise, you check in every day, and you get it back when you follow through. Miss a day and that day’s slice is gone. The first version went in months ago. This was Cycle II, the relaunch, and I did not treat it as a touch up. I rebuilt the game underneath, redrew the whole brand, and gave it a home of its own at stakes.day.

    I will not pretend it was cheap. I put somewhere north of a hundred hours into this in a stretch of weeks, and nobody is paying me for a single one of them. I do it because I am a fan, and not a recent one. I made my first Nimiq wallet on the twenty first of January 2021, at twenty past eleven in the morning. I liked it enough that I tried to talk my whole family into it. So when the competition came around, there was not much to decide.

    The hours were the hard part, because they were not really mine to give. My son asked me a few times if we could go down to the water, or just play. I said not right now more often than I would like to write down. That is the honest cost of a hundred hours, and it is the one currency that does not come back. I knew the exchange rate when I signed up, I would sign it again, and my family carries me through these sprints without once making me feel bad about it. So this is not a complaint. It is just the receipt.

    What I bought with it was not the game. The game works, it is proven, and it settles real money exactly the way it should. What I poured the time into was the surface. A Nimiq mini app is a genuinely hard place to design. It runs inside another app, on a phone, in a viewport the size of a postcard, on both iOS and Android. You get almost no room, and every element has to earn its pixels. Making something feel calm and obvious inside that little window took more work than the entire settlement engine did. That, and the story around stakes.day, which opens a door onto a lot more than a week of cold showers. But that one is a post for another day.

    Two invitations

    When I launched, I put two open invitations into the world, and I meant both of them.

    The first one is the whole point of the app, and it faces everyone. Come and use this. Pick one promise, put a little money on it, keep it for a week. That invitation lives on the surface, on stakes.day, in every screen I spent those hundred hours smoothing down.

    The second one is quieter, and you have to go looking to find it. Stakes is open source. The entire thing sits in a public repository under an MIT license, every line readable by anyone on earth. And down in the server code, right next to the part that hands each new challenge a tiny seed of NIM, there is a comment I wrote on purpose. It says, more or less: hacking welcome. Hack it if you want.

    That seed is worth explaining, because it is the thing that got poked. When you start a challenge, Stakes writes the beginning of it onto the blockchain, so your start is a fixed, permanent thing that cannot be quietly moved later. Writing to a chain costs a sliver of NIM, so the app fronts each new challenge that sliver to pay for its own stamp. It is postage. It is small on purpose. I left the limits around it deliberately loose, looser than a nervous person would, and wrote the invitation in plain sight right beside it.

    I meant that one too. You can test a thing in private for as long as you like, but there is a kind of truth you only get by putting it in the open and daring the world to have a go.

    So there were two doors. One said come build something with me. One said come break something of mine. I went to bed and waited to see which would open first.

    The door they opened

    The second one. Of course it was the second one.

    It opened that same night, about three hours after I launched, before a single person had walked through the first. Someone pointed a script at the app and started opening fake challenges as fast as it would take them, each empty challenge triggering the little seed that pays for its stamp. A couple hundred of them inside an hour, spread across two hundred and eighteen freshly made wallets, wearing seventeen network fingerprints and doing their level best to look like a crowd.

    Here is what the whole operation was worth. Twenty two NIM. At today’s price, that is less than one cent. Not each. Total.

    Sit in that for a second, because it is the most honest number in the piece. Somebody built a small machine in the middle of their night, a bot, two hundred wallets, a spoofed crowd, real effort, and aimed all of it at a seed that exists to buy postage. They walked away with less than a cent, and carved every step into a public ledger that does not forget.

    I want to be careful here, because the treasury is small and it would be easy to be glib about small money. The stakes in this app are meant to be small. That is the design. The money’s job is to be at risk, not to be won, and a promise can sting for a single coin. This competition has builders from every corner of the world, and the few dollars someone reached for here is real money to plenty of people. That is the part that makes me laugh and sit up in the same breath. Two open doors, and the first reach was for the lock on the one marked mine.

    Why it stayed small

    The reason the take was a grain of sand and not the whole treasury is not luck, and it is the part I will keep deliberately vague. There is no map to hand out here.

    The short version: the seed has layers of limits around it and a single switch that shuts it off completely, and I never had to reach for the switch. The limits did their job while I slept. The seed also cannot reach anyone’s actual stake or anyone’s payout. Those live behind a separate door, and that door only opens for real money that has genuinely landed on the chain. At its very worst, someone pushing on it all day could pull a few cents, against a ceiling, in full public view. That is the deal I designed, and that is the deal that played out.

    None of this is because I am some security genius. Before I launched, I did what a careful attacker now does too. I pointed a very capable model and a purpose built harness at my own code and told it to break in. It is a strange feeling, hiring the burglar to case your own house, but that is where we are in 2026. The people trying to get in are running the same kind of tooling you are. The only real question is whether you run it first.

    The part that isn’t funny

    Here is the part I am not laughing about. The money was never really the target, and it was never really the cost either. The cost is quieter, and it counts for more. The same limits that shrug off an attacker can, in the wrong moment, catch an honest person in the same net. Someone arriving for the first time, ready to put a real promise on the line, can get stopped at the seed step, the little stamp that marks the start of their challenge, through no fault of their own. A newcomer who hits a wall on their very first tap does not come back and try again. That is a genuine problem, and it is the actual thing this attack found.

    I am not going to wave it away. I take it seriously. I am running a full security review right now, and I am going to fix it properly, which is precisely why I will not rush it. The change that stops the abuser without ever stopping the honest newcomer is careful work, and careful is the only way I know to build the parts of an app that touch a person’s money and their word.

    And I am genuinely grateful it happened now. A stranger, in the middle of the night, before this thing had real users to lose, handed me a free penetration test and pointed at a seam I needed to see. I would far rather learn it from a bot farming fractions of a cent than from the first real person who trusted the app enough to stake on it.

    The thing people miss about this space

    This is the part I actually want you to take with you, because it runs against the reflex.

    The reflex says the open ledger is the scary part. Everything on a blockchain is public. The code is public, the transactions are public, the treasury is a single address that anyone on earth can open in a browser and stare at. To most people that sounds like a house with glass walls, which sounds like a very bad idea for a house that holds money.

    It is the opposite. The glass is the security.

    There is an old Warren Buffett line about how you only find out who has been swimming naked when the tide goes out. On a public chain the tide never comes back in. It is always out, on everyone, all the time. There is nowhere to hide a mistake. If my app were actually insecure, I would not be writing a fun little story about a one cent morning. The money would simply be gone, all of it, the moment the first competent person looked, and I would have learned it not from a report but from an empty address. The audit here is not a document I commissioned. The audit is thousands of strangers who never sleep, and it passes or fails in public, in real time.

    You do not need my permission to check my work, either. The treasury is one address, NQ83 0UJS 7NG3 QH7K 3VLF 7E06 JNH4 X5EV U04R. Open it in a block explorer and you can count the seeds this person farmed yourself. That is not a boast. That is just how the water works out here. Clear all the way to the bottom.

    The tide that went out on me once

    I have written before about everything that is wrong with this space. A while back I told the story of a night in a Barcelona hotel room, two years ago, late, tired, guard down, when I clicked one link I should not have clicked and watched about a thousand dollars leave my wallet in the time it takes to read this sentence. My conclusion then was that the technology is sound and the culture around it is sick. The problem was never the chain. The problem was the people who look at every new thing and see something to drain instead of something to use.

    That same instinct is exactly the one that chose my second door. Here is a brand new little app whose entire purpose is to help people keep a promise to themselves, and it went out into the world with two open invitations, and the first one answered was the one that said break it. Not build. Not try. Break.

    The difference this time is that the instinct hit a wall, walked off with a grain of sand, and left its fingerprints on the glass. Two years ago that culture cost me a thousand dollars. This week it cost me a fraction of a cent and pointed straight at the one seam I most needed to fix. I will take that trade every time. Most of what changed is that I respected the technology enough to let it do what it promises, and that I would rather be shown a weak spot than left to find it the hard way.

    One last thing, and it is my favorite. That farming run could not even pad my numbers. The only figure I count as real usage is money moving into the app, on chain, from a real person. The seeds all went the other way, outward, so those two hundred and eighteen farmed wallets are worth exactly zero to me. In a space absolutely full of people inflating their metrics, the one attack I have had could not inflate mine, because a long time ago I decided to only count the thing that is real.

    The doors are still open

    I have not taken either sign down. Hacking welcome is still there in the code, and after this week I mean it more, not less. If you can find the next seam, find it, and find it now, while it still costs me a lesson instead of a user. The treasury is out in the open for anyone to watch, the water is clear, and I will see you on the ledger. I am reading now, and I am working on the fix.

    And the other door is still open too, the one the whole app is actually about, and it is the harder one to walk through. Pick one promise. Put a little money on it. Keep it for a week. That invitation is still standing at stakes.day, and unlike the other one, it pays out in something nobody can farm.

  • The Key I Left in 2021

    The Key I Left in 2021

    The old MacBook took a while to wake up. I had it open next to the machine I actually work on, digging through archive folders I had not touched in years, looking for a file I was not certain I still owned.

    Nimiq had opened developer accounts for their Mini Apps competition, and the sign-in wanted a login file. I knew I had made a Nimiq account somewhere back in 2021. I had completely forgotten what that involved, where I had put the credential, or what it even looked like.

    It took longer than it should have. And when I finally found it, I sat there for a second, because it was not a text file. It was not twenty-four words in a note I would have had to keep safe for five years.

    It was a picture.

    A credential you can look at

    A Nimiq login file is a small image with a QR code printed on it. Inside that code sits your private key, encrypted with your password. That is the whole design.

    Compare it to what most of the industry settled on. Twenty-four recovery words, in plain text, that you are told to write on paper and never photograph, never type into anything, never lose. The words are the key. Anyone who reads them owns your money. The security model is a piece of paper and your discipline.

    The login file inverts that. The key is inside the picture and the picture is locked. Without the password it is a useless square of pixels, which means it can live in a cloud folder, in a password manager, on a machine in a drawer, without being a liability. To sign in on a new device you drag the image in, or you hold it up to a camera and let the camera read it.

    That is not a small usability trick. That is someone looking at the single worst part of self-custody and refusing to accept it as a law of nature.

    Five years later, on a different machine, I dragged that image into a login screen and my developer account was created. The thing just worked.

    Why I was already a fan

    I found Nimiq in the 2020 to 2021 run. Those were the golden days, when you watched a Coin Bureau video and aped into a token hoping it would 100x. Only the people who were there can relate.

    As an investment, NIM has not been my finest hour. As a project it is alive and kicking, and it has spent the years since doing the same stubborn thing it was doing when I found it: taking the parts of this technology that scare normal people and quietly removing them.

    So when the Mini Apps competition showed up, there was not much of a decision to make. Four weeks. Build something that runs inside Nimiq Pay. I was in before I knew what I was building.

    The idea came from the bathroom

    My wife and I had decided we were going to take a cold shower every morning. No protocol, no hashtag, no app. Just the two of us agreeing that this is a thing we do now.

    It stuck. And the reason it stuck has almost nothing to do with willpower. It stuck because the other person knows.

    That is the entire product.

    Stakes is a social commitment game. You pick a goal, put a small amount of NIM on it, and set a length. You send the pledge to your crew and they stake the same amount to join. Then you check in once a day, every day. Miss the window and that day’s slice of your stake is gone. Finish the week clean and you get all of it back, plus a share of what the quitters left behind, plus a small bonus.

    The claim on it is: an app to quit quitting.

    The money’s job is to be at risk, not to be won. It is working capital for your willpower.

    The feature I deliberately did not build

    The obvious request writes itself. Verify the check-in. Put a camera on it, put a model behind the camera, have something confirm the run actually happened. I build agents for a living. Every tool for that is already on my shelf.

    I left it off on purpose.

    Partly because it does not work. If someone wants to cheat this, they will cheat it, and every layer of verification you add is just a slightly more interesting puzzle for the person who was going to cheat anyway. You cannot engineer your way out of a character problem.

    Mostly because it is the wrong shape. Stakes is humans with humans. The moment a model becomes the referee, the thing your friends were doing stops being trust and starts being compliance. Your crew is not there to audit you. They are there to know.

    My hunch is that the check-ins carry more signal than any verifier would. The way a person writes about day four of something they actually did is not the way they write when they are covering. Your friends can read that. A camera cannot.

    So the split is deliberate and it is the brand: the money is handled by systems, the truth is handled by people.

    The other decision: not EVM

    The second thing I ruled out early was building on an EVM chain.

    It would have been the default move. But look at what it costs a normal person: a different wallet to install, a gas balance to top up, a token to acquire before they can use the thing they actually came for, and a native confirm dialog full of vocabulary designed by and for people who already understand it. Every one of those is a step, and every step loses people. The join flow is the whole growth mechanic here. I could not afford to leak users at four separate gates before anyone had made a promise to anyone.

    Nimiq Pay does not have that problem. The money is NIM, it moves inside an app the person already has open, and every payment is one native tap. No gas. No fees. No seed phrase. No moment where the app has to teach you a new concept before it can do the thing you wanted.

    It feels like money moving between friends. There just happens to be a blockchain underneath.

    Two phones and one cent

    At the end of June I ran the whole loop on real mainnet money, with two phones on the desk: an iPhone and an Android Seeker. Create, join, the days compressed down to minutes, settle. Then I watched the payouts land in the Nimiq Pay wallets. Thirty-five NIM to one, sixteen point six seven to the other.

    I should be honest about what “real money” means there. Twenty-five NIM is about a cent. Nobody is retiring on this.

    But that is not what a proof is for. The proof is that the pipe holds end to end, on two operating systems, with the settlement math and the on-screen preview coming from the same function so they cannot disagree. The amounts are a slider. If the mechanism is sound, you raise the stakes, and the stakes are the product.

    I sat there watching two phones light up over about one and a half cents and I was properly, unreasonably proud.

    Wednesday

    I had a rough version working well before the build window even opened, and then I went quiet for three weeks while other work took over.

    Then on Wednesday I presented on the Sip and Ship call.

    I was not ready for what came back. My screen filled with red hearts, more of them than I could follow. The Nimiq team gave it a genuinely warm welcome, and the community picked it up afterwards on Skool.

    That reaction is the only reason the last four days look the way they do. Yesterday was fourteen hours, and not all of them were good ones. I made a handful of changes I had to roll straight back, which cost me half a day. The rest went into UX polish, a fresh set of screenshots, and a second version of the pitch film, because the first one never actually told you that the card you send is the invite.

    I am writing this on submission day, with a desk full of phones and laptops and not much left in the tank. The submission goes in, and then this goes out.

    Where it goes next

    Three things, and none of them are in the version being submitted.

    The stake currently sits in an escrow I operate. That works, and I would rather be honest about what it is than dress it up. But it is not where this should end. What I want is for your stake to actually be staked, delegated to a validator for the length of your challenge. Two things happen then. Your money secures the network while you are busy not quitting, and it earns something. Very little, at today’s numbers. “Very little” has a way of not staying that way.

    Second, the sharing. Right now a check-in is text. It should be a photo or a short video. You are reading a book in a library, you take a selfie, that is the check-in and it is also the thing you post. The card the app hands you is already the most important object in the product. I want the daily moment to feed it.

    Third was not my idea. It came out of the Sip and Ship call: online courses. People buy them and never finish them, which is one of the most reliable failures of intent anyone has ever monetised. That might be a Cycle II conversation.

    The ask

    If any of that sounds like something you would run with two or three friends, the listing has the film, the screenshots, and the way in:

    nimiqminiapps.com/apps/stakes

    I did my part.

    One last thing. In the app, on the create screen, there is a row of goal templates you can pick from. One of them has a shower emoji on it. It says “Cold shower.” The hint underneath says “brrr.”

    That one is not a placeholder.

  • HTTP 402: The Payment Rail for Agents

    HTTP 402: The Payment Rail for Agents

    In January 1997, five engineers shipped RFC 2068. Roy Fielding, Jim Gettys, Jeff Mogul, Henrik Frystyk Nielsen, Tim Berners-Lee. The first formal specification of HTTP/1.1. Eighty-five pages of plumbing for the web that was about to swallow the world.

    Buried in the status code section, between 401 Unauthorized and 403 Forbidden, they added a new line.

    402 Payment Required. This code is reserved for future use.

    That’s the entire definition. The future use the authors had in mind never showed up. The line sat there for twenty-nine years. Every HTTP library on every server in every data centre has been carrying a stub for a payment system that had no customer. A road built before there were vehicles.

    I’ve been thinking about how agents pay for things for almost as long as I’ve been working with them. Not in a research-paper way. In a “this is going to bite us soon” way. You can build the smartest agent in the world, plug it into a hundred APIs, give it the right prompts and the right tools, and the moment it needs to pay for something its hands are tied. It has no wallet, no bank, no card. You can hand it a credit card number, but that isn’t autonomy. That’s a Trojan horse with a human inside.

    The web wasn’t built for this. That’s why 402 sat in the spec for three decades doing nothing.

    Why the rail went dormant

    When Fielding’s team drafted 402, the obvious use case was digital cash. Micropayments, content paywalls, pay-per-API. The actors on the network were humans, and humans already had banks, credit cards, ATM networks. The friction of a thirty-cent minimum on a Visa transaction was fine when the thing on the other side cost ten dollars. Nobody bought a paragraph for a cent. Nobody tried.

    The ad model ate the rest. Once Google figured out that attention monetises better than transactions, the entire web economy reorganised around it. Free content, free email, free everything, paid for in pixels and attention. 402 became a vestigial line.

    Then the actors changed.

    The agent’s problem

    An agent does not have a bank account. It cannot pass KYC. It has no address, no tax ID, no face on file with a regulator. It is not a person. It is a process, instantiated, spawned for a task, often killed within minutes.

    But it needs to pay for things. It needs to query a market data API for half a cent. It needs to license a piece of research for forty cents. It needs to call a translation service, a satellite image, a model inference, a database query, and it needs to do all of this in seconds, sometimes in parallel, sometimes thousands of times.

    Visa cannot help here. The cheapest credit card transaction in the world costs about thirty cents in fees, and the merchant of record needs to be a registered entity. Bank transfers take days. ACH takes longer. The whole human payment stack assumes a human at one end with a stable identity, a phone number, a postal code, a willingness to wait.

    The agent has none of that. The agent has a key, a task, and a clock.

    So when Coinbase revived 402 in May 2025 and called the protocol x402, what they actually did was finish a sentence the IETF started in 1997. The flow is small. An agent makes a request. The server replies with a 402 and a payment quote. The agent signs a stablecoin transaction. The server returns the data. Same trip, no human, no card, no bank, no waiting.

    Fees run at about one-tenth of a cent. Roughly three hundred times cheaper than the cheapest credit card transaction. Settlement is sub-second on the right chain.

    Coin Bureau covered this in a recent video and laid out the stack clearly. By the end of 2025, x402 had moved around seventy-five million transactions and twenty-four million dollars in value, and the V2 spec had shipped. The backers are not a fringe list. Google, Stripe, AWS, Cloudflare, Solana, Visa, Mastercard. Stripe runs a parallel system called the Machine Payments Protocol.

    Tokens, all the way down

    There is a word that has been quietly waiting for this convergence.

    Token.

    The blockchain world has used it for fifteen years, often without a use case worth mentioning. Thousands of chains have issued tokens out of thin air, most of them representing nothing, settling no transaction worth settling. The word picked up a bad reputation. Token meant scam in a lot of rooms, and not unfairly.

    The AI world started using the same word independently, for a different thing, and it stuck. Tokens are the unit of consumption inside a language model. You pay for tokens. You generate tokens. You context-load tokens. Anthropic charges per token. OpenAI charges per token. Every model API in the world meters by token.

    APIs more broadly use the word too. API tokens, bearer tokens, the small string of bytes that grants access.

    So now you have an industry that genuinely needs a metered, divisible, programmable unit of consumption, sitting next to an industry that has been minting metered, divisible, programmable units for years without anywhere meaningful to spend them. The vocabulary was already aligned. The puzzle pieces were sitting on the same table.

    x402 is the click.

    The natural fit, with a disclaimer

    I have a blockchain background. I worked in DeFi before I worked in agents. So when I say agent payments will run on chains, I am aware I am biased. That said, the math is the math. No bank-backed rail can settle sub-cent transactions in under a second across borders without paperwork. Stablecoins on a fast chain can.

    Solana settles around twenty-five billion transactions a quarter at sub-second confirmation. Base, Coinbase’s own L2, currently handles around ninety percent of x402 dollar volume. Tron holds roughly forty-seven billion dollars in USDT and quietly became one of the largest dollar-settlement networks on the planet without most people noticing.

    In another universe, the AI labs themselves might issue tokens on chain that represent real metered consumption. Compute tokens, inference tokens, capability tokens. That is not what x402 is, and I am not predicting it. But the bridge is sitting right there. Whether anyone walks across it is a different question.

    There is one piece of this that deserves a flag, briefly. Both USDC and USDT have blacklist functions written into their contracts. Tether can freeze any wallet, instantly, no due process, and they have done it over two thousand times. The most permissionless payment network ever built, sitting on top of two of the most controllable assets in crypto. That tension is real, and I will come back to it. For now it is enough to note that the rail is not as decentralised as the marketing implies.

    The agent economy starts here

    Citi estimates one and a half trillion dollars in agent-driven commerce by 2030. Bain expects agents to handle a quarter of US online shopping by the same year. Forrester sees human visits to bank sites dropping twenty percent this year alone, while machine traffic climbs forty percent. Whether you trust the exact numbers or not, the direction is obvious.

    Agents that can pay can do things agents that cannot pay cannot. They can subscribe to data feeds on the fly. They can buy a single API call instead of pre-negotiating a contract. They can compose services from a dozen providers in one chain of work and settle every leg before the user has refreshed the screen. The friction that has kept agent autonomy in a sandbox is mostly financial friction. Remove it and the sandbox dissolves.

    That is the economy I think we are walking into, and I have been waiting for it for years.

    The interesting thing is not that crypto finally found a use case. That is a side effect, not the story. The story is that the web’s founding spec already had a placeholder for this moment. The line was sitting in every server, every library, every browser, dormant since the Clinton administration. Waiting.

    The rail was always there. The vehicles just took a while to arrive.

  • Social Media Zucks

    Social Media Zucks

    Christmas 2007. The presents had been opened, the family celebration was done, and the quiet days between Christmas and New Year had settled in. A friend had been recommending this new thing called Facebook. I finally had the time to try it.

    I sat down at the computer. December 30th, 7:05 p.m., forty-two seconds past the minute. The platform stamped the moment. Facebook helps you connect and share with the people in your life, the homepage said.

    I believed it. I had every reason to believe it. So did everyone else who signed up that year.

    Many years later, on a beach in Portugal, walking the dog at sunset while my son was at sports, an old question surfaced for the first time in a long while. Why did I sign up to any of this in the first place? I went back to the archive afterward, and the platform had everything kept in place. Every status, every comment, every photo from the decade and a half since. To Facebook’s credit, they kept that promise. If a friend or an enemy ever wants to find out who I was, the receipts are filed.

    The other promise did not survive.

    Read that tagline again. Then open Instagram, or X, or TikTok, or whichever feed you’re handed today. Count how many of the first ten posts come from people in your actual life. People you’ve shared a meal with. People whose voice you’d recognize on a phone call.

    The drift isn’t subtle. It isn’t really a drift. It’s a one-eighty.

    The Slot Machine in Your Pocket

    The mechanics aren’t a mystery. They were designed.

    The same variable-reward principles refined over decades inside Las Vegas slot machine cabinets, the ones that turned the casino floor into the most efficient attention-extraction system humans had ever built, were ported into the eternal feed. Pull, reveal, dopamine. Pull, reveal, dopamine. The interval is unpredictable on purpose. That’s what makes it sticky.

    Natasha Schüll’s research on machine gambling (Addiction by Design) reads like a blueprint for what every algorithmic feed eventually became. The Center for Humane Technology, and the Your Undivided Attention podcast that came out of it, traced this lineage out loud years before it was fashionable to say so. That podcast was where I first heard the case made cleanly, three or four years back, and it landed.

    Attention has become the scarcest resource in the economy. That was already true when I first heard it framed that way. With agents generating content at zero marginal cost and flooding every channel now, it’s even more true.

    The Most Ingenious Part Is the Name

    Social media.

    It sounds like infrastructure for human connection. It sounds like the village square scaled up, the dinner table extended.

    What it actually delivers, mostly, is the opposite. Silos. Bubbles. Two people at the same table, both staring down. A feed populated by strangers performing for strangers, optimized for the next pull of the lever.

    I’ve been jokingly calling it asocial media for a while. The name won’t stick, and renaming a category this entrenched is probably impossible at this point. But the recognition has to land somewhere, because the word itself is doing work to keep us from seeing the thing clearly.

    What This Means If You Run a Small Business

    Here’s the part I keep coming back to with clients.

    Likes don’t pay rent. They never did. The number on the screen is a vanity signal that the platform itself uses to keep you posting. Meaningful relationships with the small group of people who actually buy from you and refer you, that’s the asset.

    And here’s the harder claim, the one I’ll defend from observation across enough founders to call it a pattern: people who buy premium services don’t live in the short-form feed. The software developers, the craftsmen, the engineers, the operators who write real-money cheques. They read books. They watch films, not feeds. They have attention spans that survive past three seconds. When they want to do business with you, they want to see what you do, how you do it, why you do it. They want to read.

    The implication for an SMB or a solopreneur is uncomfortable. Optimizing for short-form virality may be optimizing for the audience that won’t buy from you.

    Twenty years from now, I think we’ll look at how this generation used short-form video the way we look at 1950s photographs of doctors examining patients with a cigarette in hand. Gen A is already shifting, voluntarily, to other ways of communicating. Gen X, my own cohort, looks like the most caught. The thirty-to-forty bracket is where I see the deepest scroll holes.

    The Agent Caveat

    This is the part where I have to be careful, because I build agents that run social media for entrepreneurs. The pitch is genuine. Production automation that lets a founder be present on the channels where prospects scroll without spending half the day there. Asset generation, scheduling, format adaptation, the heavy lifting of being everywhere at once. Agents are good at all of this, and most small businesses should be using them.

    What agents should not do, in my opinion, is the engagement.

    The reply thread. The DM. The thoughtful note under a stranger’s post that turns into a real conversation. That part is where the value of being on the platform actually lives, and the moment a machine takes it over, the channel starts feeling exactly as hollow as the rest of the feed.

    So the rule I work to: agents handle the production. Humans handle the connection. Otherwise you’ve just automated the asocial part, and the people on the other end can feel it.

    Hate the Game, Still Play It

    I’m not telling anyone to delete their accounts. We’re nowhere near the point where a small business can afford to be invisible on the channels where customers still scroll. You can hate the game and still have to play it.

    The move I push, for myself and for the founders I work with, is to play it without getting pulled under.

    That means owning your real platform first. A blog on your own domain. A long-form video where evergreen quality earns the time it takes to make it. A newsletter you control end to end. Don’t build a house on borrowed land. The land has been moved before, and it will be moved again.

    The platforms are presence. Your blog is the home address.

    The Horizon

    Somewhere ahead of us is the moment the cigarette parallel becomes obvious in the public conversation. The studies will catch up. The lawsuits already are. The cultural permission to say this design was always predatory will arrive, late, the way it always does.

    The businesses that will be standing on the other side of that recognition are the ones that, today, are quietly building on land they own, with relationships they earned, in formats their actual customers have the attention span to consume.

    Stop calling it social media. It hasn’t been for a long time.

  • The Sign on the Sand. Did Kong Throw the Ball?

    The Sign on the Sand. Did Kong Throw the Ball?

    Sunset on the beach in Ericeira. The wind had dropped. My wife and our black Portuguese water dog were a few steps ahead of me, both of them moving like they had somewhere to be. I was watching the sand for nothing in particular.

    A small lump of yellow caught my eye.

    I walked past it. Stopped. Walked back. Bent down.

    A tennis ball. Worn flat on one side. KONG in black letters across the felt.

    “Wow. Kong.”

    I said it out loud, to nobody in particular, and held it up so my wife could see. She looked at the ball. Looked at me. Looked at the ball again. Neither of us said anything for a few seconds.

    “Okay. That’s a sign.”

    I’d been about to give up on him.

    A month of not quite stopping

    For a few weeks running into the end of April, I had not touched Kong. I want to be precise about that because the precision is the story. Roughly four weeks. No new code. No new scenes. No new strategy work. Five minutes a day to upload the daily Prime to TikTok and X, and that was the entirety of my engagement with my own project.

    The platform kept ticking over because I had built it to. Every four hours the scanner ran across roughly a thousand assets, applying the same trend-following indicator to every chart. Every day at the same hour Sharky rendered a short video out of the day’s Prime. Every day I posted it. The system worked. I had stopped working.

    Kong is not a client project. He is not a paid product. The TikTok channel sits at fifty followers. Between API costs and the small VPS he lives on, he loses me money every month. I had spent weeks pouring myself into other things. The agent who was supposed to be my flagship project had become a cron job I checked between meetings.

    Quietly, somewhere in the back of my head, I had started to wonder if I should retire him. Park the domain. Let the daily Prime run on autopilot until the credit card stopped paying. Put the energy into the things people actually pay me for.

    That was the week the ball was on the sand.

    What the ball settled

    The yellow on the felt was a colour I had been circling for weeks before I drifted off him. The brand had needed an accent. The deep ocean teal carried the calm, but nothing in the rest of the palette was loud enough to stop a scroll on TikTok. I had tried different shades of neon green. None of them had felt right. I had not committed.

    The ball committed for me. Kong needs more colour. Kong needs to stick out.

    We agreed, my wife and I, standing there in the late light with sand on our feet, that I should put time back into him this week.

    The ball came home with us. It is on my desk now. Everything that follows in this post happened after I picked it up.

    Who threw the ball

    A worn KONG tennis ball, found at sunset by accident, on the beach where I live, in the exact week I was about to retire him, carrying the exact colour the brand had been missing. Probability is a slippery thing, but the coincidences here lean.

    Here is the entertaining hypothesis.

    A Kong from a parallel timeline, watching me drift on this side, finds a loophole. He winds up his pitching arm. He puts a worn yellow tennis ball through it onto our shoreline at sunset. He bets that the version of himself I have been neglecting on this side will notice. He bets correctly.

    I am not religious. The universe is mostly statistics and a few interesting feedback loops. I cannot prove there is another Kong on the other side of a wormhole. I cannot prove there is not. The math on multiverses is not closed yet.

    What I can say is that somebody threw the ball. A dog. The wind. An alternate-timeline gorilla with good aim. I do not know. I picked it up.

    The morning after

    I sat down and looked at Kong properly for the first time in a month.

    The first thing I did was rebuild the contact sheet. I do this for every agent and every avatar I work with. Seven views on a single page. Front, two three-quarters, side, back, three close-ups. Same backdrop, same lighting, same wardrobe across all of them. Lock the sheet first. Generate from it forever after. It is one of the most underrated skills in this kind of work, and one I keep coming back to share with people.

    I asked Nanobanana for photoreal this time, instead of the cartoonish stylised place the earlier passes had landed in.

    The sheet came back, and I laughed at my desk.

    The feet, mostly. Black gorilla feet planted flat on the studio floor under the suit trousers. The way the wool pulled across the shoulders. The wrists. A young silverback in a navy two-piece, oversized neon Wayfarer frames, standing the way a man stands when a Bloomberg Markets photographer asks him to.

    Cute and authoritative at the same time. That had been the brand thesis from day one and never quite arrived. Bloomberg meets Hypebeast. The calmest, loudest voice in the room. I had been chasing it in colour swatches and headline weights, and a tennis ball plus a contact sheet got there before me.

    The Volt yellow-green went into the brand book the same morning. The frames on Kong’s glasses turned the same colour. The ℙ that we use for Prime got its glow.

    That was also the morning I admitted that the working title my assistant Justec had pitched on the Trello board was the right one. From trading agent to quantitative analyst. The agent who was supposed to ape into trades on my behalf had quietly become an analyst. Same engine underneath. Different posture. He doesn’t bet, he sieves. He doesn’t predict, he observes. Out of a thousand assets, on most days, none qualify. When one does, you hear about it.

    Trading was the trap. Analysis is the work.

    If somebody on the other side of a loophole threw the ball, this is probably what they were hoping for.

    What I built in the days after

    kongquant.com, relaunched. I finally pointed Claude Code’s front-end skill at the codebase and let it do its job. The site came together with the editorial restraint I had been failing to hand-build for months. Hero, the problem, the process, the universe of assets, the indicator, the Prime, a dashboard preview, a waitlist. JetBrains Mono setting the type. One Volt accent per composition. The ℙ glowing where it earns the right to.

    The video pipeline. Each Prime now goes from API to finished short in about five minutes. A Telegram message lands. Sharky picks up the data, writes the script, runs it through a vocabulary gate that refuses to let the language model say bullish, bearish, buy, or sell. It cross-validates every claim against the actual numbers. If the script says volume confirming and the data disagrees, the render fails before the voice is even synthesised. Then it pulls the Kong voice, renders four scenes against a transparent overlay, composites it losslessly with Kong’s master footage in ffmpeg, and drops a finished MP4 in my hands. I copy the caption, upload, post. The only manual step left is the one I want to keep.

    The point of all that is not visual polish. It is that Kong’s videos cannot lie about the data. The pipeline structurally refuses.

    That is the enhancement under the prettier scenes.

    What the universe doesn’t deliver

    A sign on the sand doesn’t ship a website. It doesn’t render a TikTok video. It doesn’t hold a brand book to spec. The work still has to happen, after.

    Yesterday I sat in front of my screen for roughly ten hours getting the new pipeline (codename Cloudbreak) to a level I was willing to publish from. Beautiful day outside. Sunny, no wind. Perfect waves down the coast at the breaks I usually surf. My wife was at the beach with our son. She didn’t text me a photo of the lineup because she knew it would hurt. By the time I closed the laptop, the sets were gone.

    I mention this because I am tired of seeing agentic work sold as a few prompts and a vibe. The tools are good. They are not magic. The hours still happen.

    If a Kong from another timeline is reading along, this is the part of the job he is welcome to take the next time around.

    The serious grounding

    When I say the TikTok is running well, I mean it technically. Fifty followers, a like or a comment now and then, nothing to write home about on the dashboard.

    What is actually working is the system underneath.

    Last week I drafted a proposal for a small business. Name doesn’t matter. The situation is universal. They need to be visible on social. They have no in-house capacity to make content at the cadence the platforms reward. If they paid an agency to do it properly, the math doesn’t close. They are stuck between needing to show up and not being able to afford to.

    This is the niche where I think I am useful. Solopreneurs, small businesses, mid-sized companies caught in the same trap. The Sharky pipeline I am grinding on for Kong is not a vanity build. It is a rehearsal for a tool that takes that math and makes it close.

    Kong is the lab. The clients are the point.

    Why a gorilla in a suit, exactly

    Markets feel like a monster. Wall Street, Bloomberg, charts that look like medical readouts. A language designed, deliberately or not, to keep most people out.

    Kong takes some of that complexity off the table without taking the rigour off the table. The charts still tell the truth. The Kong Cloud still flips when two smoothed averages cross. The score is still grounded in pattern, regime, momentum, structure, macro alignment. None of that moves.

    What moves is the bouncer at the door. Instead of a glass tower and a ticker tape, you get a young silverback in a navy suit and neon frames. Kong himself is not fun. He is cut and dry, data and facts, no hype. The wrapper is fun. He is a strong, dynamic gorilla on your side of the room. With that body, what should go wrong?

    The point is not to make you trade. The point is to help you see. Watch Kong long enough, and you start to read flips on your own. You decide your own risk appetite from a position of seeing, not of guessing.

    What’s next

    The waitlist on kongquant.com is open. Kong posts a daily Prime on TikTok and X. The pipeline is producing. The brand is locked. The ball is on my desk.

    I am still not ready to call him a business. He is still a passion project that loses me money every month. But somebody threw the ball, and I am not the kind of person who walks past a tennis ball with his own brand printed on it.

    If you watch the markets, come watch them with him.

    If you run a small business and you are losing the social media battle, the engine I am building for Kong is the one I want to bring to you next.

    Either way, the calmest, loudest voice in the room is on the air. If a Kong on the other side of the loophole is watching, this is for him too.

  • The Real Reason Why I Build AI Agents

    The Real Reason Why I Build AI Agents

    A LinkedIn comment under a video I posted: “Too obvious AI for me, we’re looking for a real person to work with.” That comment is my favourite kind. It asks the question I have been trying to answer for ten years.

    The video was about Maren, the YouTube host I had hired for surfstyk. I shared it on LinkedIn with a short note offering it as an option for other founders who needed a presenter and could not justify the cost or coordination of a real one.

    A co-founder of a B2B software company replied. Real business behind him, paying customers, marketplace listing, the kind of profile that signals seriousness. His comment was four words long.

    “Too obvious AI for me, we’re looking for a real person to work with.”

    I read it on my phone, the way I read all comments. I was not annoyed. I was grateful. That comment was the cleanest version of an instinct I have heard in a hundred different shapes: from German clients, from European founders, from people in my network. We want a human. We are not even open to the conversation about what an agent could do.

    I understand it. I have built this entire business on the answer to it. But I cannot reach the people I want to reach unless I say the answer out loud. So this post is the answer.

    Start with why

    Simon Sinek wrote Start with Why in 2009. Most business owners I work with have read it. The ones who haven’t, should. The argument is simple. People do not buy what you do or how you do it. They buy why you do it. The brands that succeed are the ones that articulate the why first and let the what and the how follow.

    Most founders can answer what they do and how they do it without hesitation. Their pitch deck has a slide for each. The why is where it goes quiet. It sounds either fake or self-important when spoken out loud, and most people choose to skip the question rather than say something embarrassing.

    I am going to say the embarrassing thing.

    I am not doing this for the money.

    I should qualify that immediately, because I do not want to sound like a monk. I like money. I want a healthy cash flow. I work with clients who want one too, and I help them build it. Money is fuel. It is not the why.

    The why has to do with the kind of business owner I want to help, and the kind of help I want to give them.

    Why Portugal

    Ten years ago I moved to Portugal.

    If your main driver is money, you do not move to Portugal. Portugal is wonderful. The people are warm, the ocean is honest, the food is real. But the salaries are low, the bureaucracy is slow, and the path of least resistance for a German engineer was to stay in Berlin or move to London. I went south instead, and somewhere along the way the deeper answer to why was being made on my behalf, even though I could not articulate it yet.

    The years since have been a search for what that why actually is. surfstyk happened. Grip and Traction happened. studenta happened. Each project sharpened the answer a little. Each project was a chance to use the technology I love for something past the invoice.

    What I have landed on, after ten years of looking, is this. I want to help the kind of small business that has more ambition than headcount. The kind that ships something good and cannot scale because the busy work is eating the founder’s calendar. The kind that should be able to compete and currently cannot.

    What I see

    Two patterns show up in almost every conversation I have with business owners.

    The first is admin. The founder spends three hours a day on email, scheduling, status updates, intake forms, support tickets, and every other task that does not require their judgement but does require their attention. They cannot hire for it because hiring for low-skill, high-friction work is the worst kind of hire. You bring on someone who interviewed well. The first weeks go fine. By month three the performance declines. By month six you are negotiating an exit. If they are on a permanent contract in Germany, you may be negotiating it in court. The loyalty you hoped for is rare and the friction you feared was unavoidable.

    The second is social media. They are excellent at their craft. They started a blog, an Instagram, a LinkedIn, with the right intent. Then the calendar took over. Posts go out in bursts every six weeks, then nothing. Their best work is invisible because they cannot keep a regular cadence and their voice is buried under the noise of competitors who can.

    Agents resource both of these. Quietly, predictably, without contracts, sick days, or court dates.

    I will not name the client, but I have one where messages from a workforce flow through WhatsApp into a dashboard and an HR system overnight. The owner used to wake up at 6am to check whether the shift was complete. Now he doesn’t. The shift confirms itself before sunrise. The dashboard shows what needs his attention by the time he is at his desk.

    That is what quality of life means in this work. Not a feature list. A founder sleeping until the alarm goes off.

    The fear

    Back to the comment. Too obvious AI for me. We’re looking for a real person.

    I think about that founder’s choice. He wants a presenter for a YouTube channel, on brand, who knows his product, who shows up on a schedule. The real-person version is not impossible, but the unit economics are unfriendly. The presenter has to learn the product. They have to sound on-brand. They will be expensive if they are good. And if they are good, they will move on, and his channel will go back to square one.

    The agent version is not perfect. Anyone can tell it is an agent. That is the cost. The benefit is that she will not move on, will not get sick, will not unlearn the brand, and will be there next Wednesday.

    He chose the cost. That is fine. Most founders will choose the cost for now, the same way most founders chose to keep paper invoices long after the accounting software arrived.

    The deeper objection underneath that comment is the one I want to address. It is the fear that agents are taking work away from people who deserve it. I have not seen that. I have seen agents take work away from work that nobody wanted in the first place. Email triage. Scheduling. Form filling. Shift confirmations at 6am. The kind of work that drags down the loyal humans on a team as much as it drags down the owner.

    There is a quieter argument worth making here too. Human attention has become the scarcest resource in our economy. UC Irvine’s Gloria Mark has tracked the average focused attention on a screen down from two and a half minutes in 2004 to forty-seven seconds today. A 2025 meta-analysis in Psychological Bulletin tied short-form video use to measurable decline in attention and inhibitory control. The platforms that small businesses must be visible on are the same platforms designed to extract attention at scale.

    That is the Catch-22. You cannot ignore them. Being on them costs you the focus you need to do your actual work. Agents do not solve that fully, but they reduce the surface area you have to expose to it. They let you be present without losing the time and attention you need to think.

    Why

    That is the work I do. This is why I do it.

    If I were standing in front of Sinek’s golden circle, the version he himself drew on a napkin in 2009, the why I would write at the centre is not money.

    It is this. I want small businesses to have what previously took scale. Room to breathe. Time to think. Presence without exhaustion. A team that includes the colleague who does not need a payroll and who does not get sick and who confirms the shift before the founder’s alarm rings.

    That is what AR departments are for. That is the work. That is the why.

  • Agentic Resources: A New Department for a New Kind of Company

    Agentic Resources: A New Department for a New Kind of Company

    It’s a Tuesday. My wife is heating olive oil. My son is setting out the parmesan, the yellow block, not the pre-grated kind. Pasta with pesto is the house dinner, the one we cook when the week is normal and nothing is on fire. My phone is face down on the counter. I don’t usually read messages at dinner.

    This one I read.

    It’s from Stefan, a client of mine in Münster. He’s co-CEO of studenta, a student job platform with 130-plus people on the rolls. Stefan also runs an events business, the kind where he builds physical installations for parties, trade shows, and product launches. He thinks in rooms and booths, not screens and dashboards.

    The photo shows a life-size cardboard standee of a woman. Green studenta t-shirt. Robotic arm. Tech-panel pants. A paper sign with a QR code: Hey, ich bin Alena! Deine KI-Assistentin von studenta.

    She’s standing in front of the teamworx wall. Studenta’s internal staff photo board. Hundreds of black-and-white polaroids of employees, each with a name pinned beneath it. Bennet. Liam. Sarah. Aaron.

    And in front of them, her. Alena. Life-size. Standing where the team is shown.

    I showed the photo to my family. We were proud.

    The wall

    I built Alena. She’s been live at studenta since fall 2025 and really got into stride when the new semester began. She handles onboarding, CV analysis, sick leaves, day-to-day staff management. She runs on WhatsApp via Meta’s official API. Students have her phone number. Staff can reach an internal variant. She’s been through thousands of interactions without a major failure.

    But that’s not why Stefan sent the photo.

    He sent it because he had placed Alena in front of the team wall. Not in the office lobby as a mascot. Not in the marketing materials as a character. Not on the software page as a feature. In front of the team. The wall with photos of the actual people who work at studenta. The same wall that has Bennet and Liam and Sarah and Aaron. That wall.

    I don’t think he realized what he was saying.

    What the photo was really of

    Most founders deploying agents keep them in an “AI” corner. The automation stack page. The tools section of the product tour. A separate vertical on the pitch deck labelled “Emerging Tech.” Intended or not, the layout sends a message: these are things, and they sit elsewhere.

    Stefan did the opposite. He gave Alena a body. He gave her a phone number. He placed her at the staff gallery.

    That is a philosophical claim made in cardboard. She is staff, not software. She is a colleague, not a tool. She belongs in the org chart, not the tech stack.

    Standing in the kitchen with pasta water rising behind me, I looked at the photo and realised I had been making that same claim for two years without saying it out loud. I had been treating Alena, Justec, Sharky, and Funley as colleagues. I wrote their standing orders like job descriptions. I tracked their performance like performance reviews. I designed the handoffs between them like org charts. I had been running a department.

    I just had not named it.

    The name is Agentic Resources. The role that runs it is Chief AR Officer. I sat down the next morning and wrote the job description. It matched what I had been doing for two years.

    Five questions every company with agents has to answer

    Every company that has humans on the payroll has an HR department. Human Resources. A discipline, a chief, a set of responsibilities. Strategic workforce planning. Organisational culture. Performance and compensation. HR technology. Compliance and risk.

    Every company that has agents on the payroll will need an Agentic Resources department. The same five questions. The same discipline. A different workforce.

    Strategic Agent Portfolio Planning. Who is on your roster, why, and how is it growing? Alena joined studenta in fall 2025 with a narrow scope. Her scope has grown every month since. Onboarding. CVs. Sick leaves. Staff management. Each expansion is a hiring decision. It deserves thought, not just a feature request.

    Agent Ecosystem Design. How do agents collaborate, where are the handoffs, how do humans stay in the loop, and what happens at the edges of an agent’s contract? Alena has a clean answer to that last one. A 40-something visitor to the studenta site once scanned her QR code and tried, half-jokingly, to apply for a job. She told him applicants have to be matriculated at a German university. He admitted he was not. She brushed him off, politely but firmly. “Sorry, I can’t help you here. Maybe come back at another time.” She acted within her contract. No hallucinated enthusiasm. No scripted apology either. She told the truth and moved on.

    Agent Performance & Economics. What does she actually ship, and what does it cost to keep her running? Thousands of interactions. Zero major failures. Real latency budgets. Real compute bills. A CHRO optimises payroll. A CARO optimises agent runtime. It is the same discipline, measured differently.

    Agent Platform & Integration. Where does she operate, and what does that cost in friction? Alena runs on WhatsApp. Getting a production WhatsApp implementation through Meta is a genuine pain. Every time I think it should not take this long, I remember why it takes this long. Meta makes scamming customers hard to do at scale, and that is the correct priority. Security friction is a feature.

    Agent Safety & Compliance. How does she stay in-bounds, honest, and safe under pressure? The disclaimer on any agent, Alena included, is that she can make mistakes just like a human colleague can. Intelligence, artificial or otherwise, does not guarantee getting everything right. The boundaries are set by design, reviewed continuously, and published internally so humans know what she will and will not do.

    These five questions are not novel. They are the exact CHRO job description with the word “human” swapped for “agentic.” Which is the point. This is a familiar discipline applied to an unfamiliar workforce.

    What the students see

    The part of Stefan’s photo I keep coming back to is not the standee. It is the space around it.

    The standee has been in the office for months. Alena stands there every day. The students walking past her, people in their early twenties, do not treat her as a novelty. They do not photograph her. They do not ask where she came from. They do not explain her to each other.

    For them, she is just part of the office.

    They grew up with agents the way I grew up with television. It is not a big deal. It is the furniture. They will be the ones building the next generation of companies, and they will think about their rosters differently than most of us do today. They are not going to have separate “AI” departments because they are not going to see the separation. A colleague is a colleague.

    My generation is the one still working out the vocabulary. AR is the vocabulary I am offering. Take it, leave it, improve it. The name will get stolen. I would rather that happen with a reference post on the internet than without one.

    A department opens

    Stefan placed Alena in front of the team wall. He did it on his own, because that is where she belonged. That is a better kind of design decision than most of the ones I have made in this field.

    Maybe in five years every org chart has an AR department. Maybe Chief AR Officer is a standard C-suite title. Maybe not. Either way, Alena is staying with the team. The photo is on my fridge. The discipline has a name now.

    And studenta’s next hire, the one after the next human, will also join them.

  • How MemberMagix Got Approved on WordPress.org: A Version-by-Version Freemium Rebuild

    How MemberMagix Got Approved on WordPress.org: A Version-by-Version Freemium Rebuild

    What the plugin review team made me rebuild, and why every round of their feedback was worth listening to.

    The approval email arrived late Friday afternoon. I was with family, spending time with my son, and I don’t usually read email before I go to bed. This time I did. I almost got up and went straight back to the desk. Instead, I closed the laptop and got a good night’s sleep. This morning, coffee first. Then the listing went live.

    MemberMagix is now on the WordPress.org plugin directory. Version 4.0.4.

    A year ago I walked into a room in Lisbon

    About a year ago, I spent a Saturday inside a university auditorium in Lisbon at WordCamp Lisboa 2025. Sporting CP was celebrating outside. I was inside with a room full of people who turned out to be the WordPress community I’d been using the software from for over a decade without knowing existed. I wrote that story already in “Lisboa Had Two Champions Last Weekend”, so I won’t retell it here.

    I’m not a WordPress evangelist. I dip between many waters. I like it that way. Part of why this launch was harder than it should have been is that I showed up to the plugin review with the instincts of a freelance builder, not a WordPress insider.

    This post is about what happened between clicking submit on version 1.0.0 and reading the email on Friday. It’s the story the previous two MemberMagix posts didn’t tell, because when I wrote them the plugin wasn’t approved yet.

    The clash nobody tells you about

    When I build software for clients, I optimize for user experience. Everything in the admin panel. One install, one activation, full functionality. No documentation required, no second plugin to find, no decisions the user has to make just to get started. That is how I think about quality.

    WordPress.org optimizes for something different. They optimize for user freedom. Nothing in the free plugin may be locked. Nothing visible may be out of reach. No teasers, no coming-soon badges, no disabled buttons. The free plugin must be a complete, standalone product with no shadows of a future upgrade falling across the screen.

    These two design goals fight each other. I learned that the hard way, across four major versions and several rounds of review.

    Round one: the sheer length of the list

    The first feedback email didn’t sting because of any single comment. It stung because of the length.

    Escaping. Sanitization. Translator comments on every string with a placeholder. register_setting calls missing their sanitize callback. Google Fonts loaded from a CDN instead of the system font stack. Third-party services not disclosed in the right place in readme.txt. A long page of items, each one small on its own, collectively a statement: you did not read the handbook closely enough.

    I spent the next few days fixing every single item. Each version bump an act of contrition. The plugin came out cleaner. And then I made the mistake that cost me the next month.

    The mistake: building during the wait

    The review queue is slow. I should have waited. Written documentation, built a landing page, talked to people. Instead I stayed in flow, because that’s what builders do. When I’m in the zone, stopping feels like a kind of dying.

    So I kept coding. I migrated plugin licensing from Lemon Squeezy to a self-hosted Keygen CE server. I built in-plugin Stripe Embedded Checkout so users could upgrade without ever leaving the admin. I added premium content, three-tier pricing, reusable magic link tokens, single-session enforcement, a fully branded email template. Every version made the plugin better from a user-experience point of view. Every version also pushed it further from what WordPress.org’s directory allows in a free plugin. I didn’t see that second graph until much later.

    Round two: the rupture, and version 4.0

    The next round of feedback was gentler in tone and heavier in content. The message was simple: the free plugin you’re proposing has too much commercial machinery attached to it. You can’t ship Stripe here. You can’t ship an in-plugin checkout here. You can’t ship a licensing layer here. Those belong in a separate paid plugin that hooks in from outside. The free plugin must stand on its own.

    I remember sitting with that email and understanding what it meant. I had to take the version I was proudest of, the one where everything lived in a single admin panel, and break it in half.

    Version 4.0.0 was that break. The internal prefix renamed from mmx_ to mmax_ because mmx wasn’t unique enough on WordPress.org. Every commercial feature extracted into a separate add-on called MemberMagix Pro. Eighteen extension points added to the free plugin so that Pro could reach back in through standard WordPress filters. All inline JavaScript and CSS moved to enqueued files. GPL headers on every PHP file. The kind of refactor you don’t see coming the night before you submit version 1.0.0.

    There is no medium-sized way to cut a plugin in half.

    Round three: trialware

    “Trialware” is the WordPress.org term for anything in a free plugin that looks like a premium feature hiding behind a curtain. A locked button. A greyed-out tab. A feature the user can see but not use. The review team reads that as bait, and bait is forbidden.

    MemberMagix got flagged for it twice.

    The first flag was about custom overlays. MemberMagix overlays are implemented as a custom post type, because they need to be editable in Gutenberg like anything else. Only admins can create them, which is how WordPress custom post types work. The review team looked at that and read “hidden feature.” They weren’t wrong about what they saw. They were wrong about the intent. Instead of arguing, I surfaced the overlay custom post type in the admin menu and documented it clearly.

    The second flag was about the content protection meta box, which I’d restricted to posts and pages. I’d done that to keep the free plugin focused. The review team read it as “protection for other post types is a paid upgrade.” Also a fair read, given their rules. I opened the meta box up to every public post type in v4.0.4.

    I didn’t argue. I fixed both. You don’t argue with the review team the way you don’t argue with a lifeguard. They’re watching something you can’t fully see, and they’re right more often than they’re wrong.

    The catch I’m actually grateful for

    The same round of review brought something I didn’t expect: a real security finding.

    There was a REST endpoint in my plugin called check-email. It existed so the signup form could tell whether a submitted email already had an account and route the form into “sign up” or “log in” mode. Elegant from a user-experience angle. Broken from a security angle. The endpoint leaked account existence. Anyone could query it and find out whether a given email had a profile on the site. That’s textbook user enumeration, and it was sitting inside a plugin I had positioned as secure.

    The WordPress.org security audit caught it. I hadn’t. That is exactly what a real review team is for.

    I removed the endpoint, collapsed the two-step form into a single step, and made terms acceptance required on every request so the flow can’t leak anything by accident. Version 4.0.4 shipped with the fix and went into review one last time.

    I appreciated the catch. This is the kind of find that pays for the whole ordeal by itself.

    The email, again

    So the approval arrived late Friday afternoon. I was with family, spending time with my son. I don’t usually read email before I go to bed. This time I did. I was so excited I almost got up and went straight back to work.

    Instead I closed the laptop and slept.

    This morning, coffee first. Then the listing.

    What’s free, what’s Pro

    The free version of MemberMagix is exactly what the review team asked for: a complete, standalone content protection plugin. Passwordless magic-link login. Server-side protection, which means the protected content never leaves the server for a visitor who isn’t allowed to see it. A blur overlay with a signup form where the content would have been. Member management, CSV export, brand customization for the form and overlay. You install it, you activate it, it does the job. Nothing is held back. Nothing grey.

    MemberMagix Pro is the separate add-on for people who want to take it further. The heart of Pro is an inline Stripe checkout that is, honestly, one of the smoothest I’ve built. PayPal support is coming next. Bulk content protection across your archive. Custom overlay design. Pro is not a demo of features hidden from free. It’s a set of commercial capabilities that exist because some creators genuinely need them.

    Pro ships in the coming days. I’ll write about that separately when the listing is live.

    Three rules for anyone about to submit their first plugin

    Run Plugin Check locally before you send anything. It runs the same rules the review team runs. Every issue you fix before submission is a round you don’t have to sit through.

    Budget for more than one review round. The honest number for a non-trivial plugin is three or four. Plan accordingly.

    And do not put commercial machinery in your free plugin. Not Stripe, not licensing, not premium tiers. Build the free version as if the paid version does not exist yet, and then build the paid version as a separate add-on that hooks in through filters. Your future self, sitting with a “you have to split this in half” email at six in the morning, will thank you.

    The horizon

    MemberMagix is live in the WordPress.org plugin directory today. The free version is already the thing I wish had existed a year ago, when I was trying to put a simple email gate on a CRM knowledge base. Pro is next.

    And the review team? They do a hard job, mostly without thanks. I’m grateful they made me rebuild the plugin. I’m grateful they caught the bug. I’m grateful they told me no when I needed to hear it. The plugin I would have shipped without them would have been slower, riskier, and less useful to the community it’s meant to serve.

    A year ago I walked into a room in Lisbon as a WordPress user.

    Today my code runs on wordpress.org.

  • Hiring Maren

    Hiring Maren

    I tried the YouTube thing. Properly. Camera, lighting, script on a screen, the whole setup. Shot it, edited it, watched it back.

    Below my expectations. Below my standards. Not because I have nothing to say. I have plenty to say. But the process of reading a script in front of a camera, trying to make it look natural, trying not to look like I’m reading something from a paper. That’s acting. I’m not an actor.

    Give me a hook, a question, and I can talk for five minutes without thinking about it. That’s how my brain works. Put me in a conversation and something useful comes out. Put me in front of a camera with a teleprompter and I become someone I’m not.

    I’d rather build agents. That’s a better use of my time.

    The Hiring Process

    So I hired one.

    Not hired in the traditional sense. Built. But the approach was remarkably traditional. I looked at the output the way you look at resumes. Seven angles. Front-facing, three-quarter turn, profile, slight smile, neutral expression, looking away. A full contact sheet, generated with the same care you’d put into a casting call.

    The brief was specific: late twenties, beach blonde, blue eyes. Someone you’d see at a co-working space in Ericeira after a morning surf session. Not polished for camera. Not styled for Instagram. Someone who looks like she was working and turned the camera on. Blazer over a white t-shirt. A small seafoam pin on the lapel. Barefoot.

    I wasn’t designing a character. I was hiring for a role. The face of the surfstyk YouTube channel. And I approached it the way I’d approach any hire: what does this role need? Who fits?

    The Name

    Maren means “of the sea.” It works in German, in Portuguese, in Scandinavian languages, in English. We live by the sea. We work by the sea. I surf. The ocean runs through everything I build.

    The name wasn’t planned from the start. We were brainstorming, it came up, and it clicked. Because Maren already existed. She’s a product I’ve been building. A platform where people discover and build their own agents through a guided session. Different project, different scope.

    The Office That Doesn’t Exist Yet

    Somebody told me very early in my career: if you can’t make it, fake it.

    I designed Maren’s studio in the same building as Justec’s front desk. If you’ve read “Someone’s Always Here,” you know that space. Floor-to-ceiling glass, warm stone, minimal. The lobby where Justec greets visitors to surfstyk.com.

    Maren’s room is upstairs. Facing the Atlantic. Light stone desk, a podcast mic on a low desk arm, concrete wall with a floating shelf. A few books. No ring lights. No LED panels. No “creator setup.” Natural light from the left. The ocean is peripheral, slightly soft in the background. Not a backdrop. Just where she works.

    That building doesn’t exist. Not yet. What I’m designing is a future surfstyk office in Ericeira that could be reality in the next ten years, if people are interested in the agents I build and I can help them make those agents real.

    Every detail in that studio is a design decision for a future I’m working toward. The agents come first. The building comes when the agents prove their worth.

    Forty-Five Seconds

    I wrote a test script. Forty-five seconds. Put it through HeyGen with an ElevenLabs voice. Hit render.

    When the result came back, I showed it to my wife.

    “Wow. This is the best thing I’ve seen in a long time.”

    That landed on so many levels. I’d been deliberate about the design. I didn’t want to create something that looked like I’d designed the woman of my dreams. I wanted a character that works for everyone. Sympathetic without being decorative. Someone you’d want to listen to, regardless of who you are. Professional. Smart. Authentic.

    Hearing that from her meant I’d landed it.

    Then she said: “I didn’t like how she said ‘surfstyk.’”

    The brand name. I invented it years before agents existed, back when I was working on grip and traction equipment for surfboards. That’s where the “stick” comes from. If you pronounce it by the letters, it sounds like “Surfsteik.” But it’s my brand. I decide how it’s pronounced. It’s “Surfstick.”

    I don’t blame the voice module for not getting that right. “Ericeira” was the other one. Maybe you need to put it on a map first. A custom pronunciation dictionary fixed both.

    Two tiny hair in a wonderful soup.

    Designing a Person

    Here’s the part I keep coming back to.

    The technology is real. What I saw in the test footage is real enough to pass most people’s filters. Certain gestures and movements still tell you it’s generated, if you know what to look for. But that gap is closing. Months, maybe a year or two, until it’s almost undetectable.

    Which raises a question that goes beyond YouTube strategy: are we ready to accept another life form that is artificially generated, that has a face, that speaks with a voice, that looks you in the eye?

    I don’t want to get into the full ethical dimension of this today. That’s its own post. But I’ll say this: I approached the process technically and strategically. Based on the surfstyk brand, on what we stand for, on who I’d actually want to work with. Smart and authentic. Not a robot. A person.

    If you spend time working with a capable model, sometimes the distinction between human and artificial is already thin. Building a face and a voice on top of that just makes the obvious visible.

    Full transparency from day one. Maren is introduced as an agent. Her architecture is part of the content. A channel about building agents, hosted by an agent. That’s not a limitation. That’s the proof of concept.

    The Space

    While I’m watching tech channels, something keeps standing out. The space is homogeneous. If you’re a woman and you’re smart and you want to talk about technology: get into it. The entry barrier is low and the opportunity is wide open. It’s not even fair.

    That’s not why Maren is female. But it’s context. The observation was already there before the design started. Tech YouTube is overwhelmingly male. A different voice stands out not because of novelty, but because of structure.

    Show Business

    Content is hard work. Good content, the kind that’s easy to consume and looks effortless, requires planning, knowledge, and infrastructure behind it. That’s show business. It needs to look easy. Making it look easy is the hardest part.

    I’m a project manager by trade. I know how to break things down, architect a process, define the handoffs. So before I produced a single video, I built the machine that produces videos.

    Four defined processes. Blog post. Social media. Video explainer with shorts. Video interview. Each one has a trigger, numbered steps, clear handoffs, defined outputs. Who does what. What gets produced. Where it lives.

    Blog posts are the bedrock. Social derives from them. Video derives from them. One piece of thinking, multiple formats, each adapted for its platform. Not repurposed. Translated.

    The pipeline runs from markdown to script to voice to avatar to assembled video. Most of that infrastructure already exists from Kong’s video pipeline. I’m not building from scratch. I’m extending what’s already running.

    The whole thing runs on components I already pay for. No new subscriptions. No venture funding. Just tools, wired together by someone who builds agents for a living.

    The Balancing Act

    What I love about this work is that it refuses to stay in one lane. You start the morning as an engineer, wiring APIs and building pronunciation dictionaries. By noon you’re a designer, choosing the angle of light on a concrete wall. By the afternoon you’re asking yourself what it means to give a face to something that doesn’t have one.

    It’s technical and it’s human at the same time. The process is deeply mechanical. The outcome looks organic. Some people might call it a form of art.

    I just call it Wednesday.

    Happy Easter. The waves are good today. Maren will hold the fort.