Writing
Blog
Notes from building Bounded’s full-stack AI app platform: client and runtime engineering, proofs, fail-closed boundaries, agent actions, and the occasional postmortem.
Letting strangers edit production
An open app is one the public can prompt-edit without you losing sleep. Gates run before any spend, some parts of the UI are locked, a second model audits the diff, and the prompter pays. Here is what actually ships.
The immortal alarm
A Durable Object alarm that rescheduled itself forever quietly burned about 2,300 times the cost it should have. Our own dashboards showed nothing. A postmortem on paying for idle loops in serverless.
Observability that never captures PII
Most logging pipelines capture everything and promise to redact later. Bounded's observe path records the shape of an action, not its contents. Raw payloads never leave the process. Here is how, and where the line is.
Agents need limits, not lectures
You give an agent work by giving it limits. A sentence in a system prompt is advice the model can ignore. A cap proven at deploy is a write that gets rejected. Only one of those lets you go to sleep.
Fail-closed is a feature
A guardrail that fails open is decoration. Every governed data write on documented Bounded paths passes through policy; app code cannot route around that data-plane check. Here is what that means mechanically.
Prove your backend can't lose money
Tests sample the inputs you thought of. A proof checks every input there is. Here is how Bounded turns a spend cap or a conservation rule into a thing a solver signs off on before it ships.