The dogfood run: Clerk auth, D1 persistence and Cloudflare deploy, composed cold from the blueprint shelf to a live production Worker.
Stravica
AI software, properly.
The Requirements Confidence Framework (RCF).
Stravica is where I work out how to build software with AI, and where what gets built lives. RCF, the Requirements Confidence Framework, is the method. RCF Lite is the tooling, on npm today. A Digital Operator practises both, and the writing tracks what held up.
Receipts
Built with RCF Lite.
Watchpost, a self-hosted uptime monitor built end to end through the framework, here watching real Stravica surfaces.
$ rcf define blueprint add @stock/security-auth-magic-link
[rcf] blueprint add refused: 1 conflict(s) detected.
conflict on topic (authModel):
incoming blueprint security-auth-magic-link:
Passwordless magic-link sign-in with server-issued
opaque cookie sessions as the project's
authentication model ...
existing blueprint security-auth-clerk:
Clerk-hosted identity with server-verified session
cookies as the project's authentication model ...
refs: ADR-501-security-auth-magic-link-model
ADR-1001-security-auth-clerk-auth-model
resolutions (pick one, honest options only):
1. Adopt the incoming blueprint. ...
2. Keep the existing blueprint. ...
3. Author a project-level ADR that supersedes both. ...
4. Declare the resolution on the add itself:
rcf define blueprint add @stock/security-auth-magic-link
--resolve authModel=project:<ADR-id>Two auth blueprints on one project. The compose gate refuses, names the conflict and lists the honest ways out.
rcf audit view, the live review surface over the same project's tree.
- Auth + persistence + deploy security-auth-clerk · persistence-data-d1 · deploy-cloudflare-workers
- API with CI gates from hour one application-api-rest · ci-pipeline
- Self-hosted auth with Keycloak security-auth-keycloak
Three recipes off the shelf; thirty-nine blueprints on it. More in the build queue.
Methodology
RCF
The Requirements Confidence Framework. A working method for closing the gap between “the AI built something” and “the AI built what you asked for.” Requirements at the apex, acceptance criteria as the contract, traceability built into the data model. The full methodology, end to end, and the lineage that landed it.
Tooling
RCF Lite
The method, runnable. One npm package, plain JSON files that live in your own repository, and an MCP server your coding agent drives. Wire it once and your agent keeps a live chain from what you asked for, through requirements and acceptance criteria, into the tests that prove it. It’s 0.x and partly built, and the docs carry a status page that says which pieces are how far along, plainly.
Practice
Digital Operator
A digital counterpart to a human operator role. It does the work, records how I would have done it while doing it, and feeds what it learned into a shared library the rest of my Operators draw from. Two running today. The first one built this site.
Open source model reports
Reports
When the writing makes a claim about models, there’s a report behind it. Five real engineering tasks, the same harness each time, verdicts published whether the local model wins or loses.
-
Qwen3.8-Flash-Next vs Claude Opus 4.7
The local mixture-of-experts wins test-strategy outright, holds the structured tools, and loses log-triage and prose to the frontier.
-
Qwen 3.8-27B vs Claude Opus 4.7
Local is adoptable for structured and mechanical work; the frontier earns its keep where judgement depth matters.
-
Qwen 3.8-27B vs Claude Opus 4.6
The head-to-head from Qwen’s own release benchmarks. The vendor positioning holds on three of five tasks.
Latest from the blog
New writing most weeks.
-
Governance moved inside the build.
Security leaders and private equity operating partners in my feed are agreeing on AI governance. It needs to be built into the software and checked by machines on every change. Security did this when work moved beyond the perimeter. After a year running governance this way in production, I don't think an oversight office can keep up with coding agents.
-
Vibe coding at enterprise scale: the review that never happens.
Vibe coding keeps climbing the search charts, and every enterprise governance post carries the same line about a senior engineer reviewing all AI-generated code before merge. Nobody has the hours, so the line stays in the policy and the review gets skipped. Last week I forced that review onto my own code twice, using two coding agents that argue about a codebase in front of a referee. Twelve real defects in four small files, and six of them were in the fixes for the first six.
-
Harness without a spec is a loop without a target.
Harness engineering has the loop close to solved. Plan, act, verify, repeat, with humans steering rather than typing. But almost every harness points the verify step at proxies, tests the agent wrote, lint, a second model's opinion of the diff, and a loop aimed at a proxy converges on the proxy. A guard job in my own CI sat green for five weeks while blind to the one thing it existed to check. The missing half of the discipline is the target, a spec layer the loop can verify against.
Follow the writing
The writing runs in three places. The blog is the canonical home; everything lands here first, and there’s an RSS feed if that’s how you read. AI Software, Properly is the LinkedIn newsletter, same name as the line at the top of this page because it’s the same argument; issues are written for the newsletter rather than pasted from the blog, and the RCF walkthrough series lives there. The site’s articles are also republished on Medium for people who read there; canonical links point back here.
Stravica is a body of work in public. The bar is software that holds up under real use, not software that looks good in a demo.