Fran Litterio

@fpl9000.bsky.social

Retired software engineer. Deadhead. AI enthusiast. Long ago, I implemented Bash's regex operator (=~). Signal ID: franl.99.

• Point 4 is essentially the "dark knowledge" idea from Hinton's original distillation paper: a teacher's soft output distribution is smoother and more informative than raw hard labels, so it acts like a denoised training signal. His "(mostly)" hedge is appropriate — the teacher's own errors and biases get transferred too, so it's not truly noise-free.

• Point 2 tracks with benign overfitting / double descent research: overparameterized networks appear to have enough slack capacity to fit noise in isolated directions without corrupting the parameters responsible for the true underlying function. "Burning parameters on noise" is a reasonable plain-English gloss on that.

• Points 1 and 3 follow naturally if you accept 2 and 4 — less noise to absorb means less need for the "spare capacity," so a smaller model suffices.

Cover of Samuel R. Delany's SF classic, "Dhalgren"showing a bloated red sun over the city of Bellona.

Screenshot of Claude Desktop showing the "Memory" page located in the "Customize" section. Also shows several groups of memories and an edit control for modifying them.

$PROMPT: Yes, and the goal here is to find a single location where I can put `.hermes.md` so that it is in every conversation, regardless of the current working directory of that conversation. Perhaps Hermes Agent lacks that feature. If so, let me know that. HERMES: Confirmed by reading the actual source (prompt_builder.py, lines ~1924–1971 for build_context_files_prompt, and _find_hermes_md at lines ~78–100+): The mechanism, in full build_context_files_prompt(cwd, ...) is called with the session's cwd, and does exactly this: 1. _find_hermes_md(cwd) — checks cwd itself, then walks up through parent directories only if a .git root exists somewhere above cwd, stopping at that git root. If there's no git repo in the ancestry, it checks cwd only — no walking at all (this is a deliberate anti-injection guard: "walking parents could pick up a .hermes.md planted in /tmp, /home, etc."). 2. If no .hermes.md/HERMES.md found, falls through to AGENTS.md → CLAUDE.md → .cursorrules, each checked in cwd only, no walking at all. 3. First match wins — no merging across types. There is no code path that ever consults HERMES_HOME (~/AppData\Local\hermes\) for .hermes.md. It's cwd-relative, full stop. So the file you created is architecturally invisible to this loader in a session whose cwd is C:\Users\flitt (or anywhere else) — unless that cwd happens to sit at-or-under a git repo whose root also contains .hermes.md. The one thing that is global regardless of cwd load_soul_md() reads SOUL.md from HERMES_HOME unconditionally, every session, regardless of cwd — this is the only always-loaded file in the whole system. But per the code comment and the design intent from our last conversation, it's scoped to agent identity ("who am I"), not general instructions — nothing in the code actually enforces that split though; it's just concatenated into the system prompt like any other section. Bottom line Hermes Agent does not currently have a "global project-instructions file, loaded i…$

You're right to push on that — "renders identically" was an oversimplification, and the truer picture is a bit different.

Tabs (U+0009) and spaces (U+0020) are genuinely distinct characters, and the Read tool doesn't strip or normalize them — so that information is present in the token stream I receive. It's not that I'm literally blind to the difference. I can often tell a tab from a run of spaces.

The real problem is precision and reliability, not total blindness:

- Leading whitespace tends to get absorbed into tokenization (BPE merges runs of whitespace, and mixed tab/space runs, in ways that don't map cleanly to "N tabs then M spaces"). So while the distinction is recoverable, I don't attend to it with the byte-exact fidelity that the Edit tool demands — and the Edit tool has zero tolerance. Off by one space, or a tab where the file has spaces, and the match silently fails. - The Read output also prefixes each line with line-number + tab + content, so there's already a tab in front of the content's own leading whitespace, which muddies "what's the actual indentation" further.

So a more accurate framing than what I said: I can usually distinguish tabs and spaces, but I can't reproduce a mixed-whitespace region with the 100% byte-precision Edit requires — especially multi-line blocks that mix tab-indented code with space-indented comment wraps. That's why cat -A (which makes tabs unambiguous as ^I) and scripted str.replace are the dependable escape hatches — they remove my need to reproduce the whitespace by hand at all.

The practical guidance I wrote into your CLAUDE.md is unchanged by this correction, but the one-line rationale in it ("tabs and spaces render identically in Read output") is now similarly imprecise. Want me to reword that to something like "because leading whitespace is not reproduced with byte-exact reliability"?

✻ Baked for 30s

What Should Happen?

Not this!!! AskUserQuestion is an explicit safety check and I have rules and hooks to make sure the right questions are asked and that scary things do not happen without my input. Suddenly Claude is told to "proceed with best judgment"? What?!

Table of Contents

1. Introduction and Goals
2. Background: What LambdaMOO Got Right
3. System Architecture
4. The Object System
5. Persistence
6. Concurrency and the Transaction Model
7. The MCP Interface: Tool Definitions
8. Natural-Language Method Execution
9. Event Distribution to Connected Clients
10. Building: How Players Create Objects and Program NL Methods
11. Security Analysis
12. Go Server Design
13. The Skills Alternative to MCP
14. A Worked Example Session
15. Performance Considerations
16. Open Questions and Future Work

Component diagram of the NL-MOO shared object world.

## 1. Introduction and Goals

This document describes **NL-MOO**, a multi-user, persistent, object-oriented virtual world server in the tradition of LambdaMOO, redesigned around a central premise: *the behavior of objects is written in natural language and executed by large language models*, while the *state* of the world remains structured data owned and guarded by a conventional, deterministic server.

The classic MOO gave every object a set of "verbs" written in a small scripting language (MOOcode) that ran inside the server. NL-MOO replaces MOOcode with **natural-language methods** — prose descriptions of behavior such as:

> *"When a player rubs this lamp, if the lamp's `genie_present` property is true, describe the genie emerging in a dramatic cloud of smoke, set `genie_present` to false, and move the genie object (#412) into the room. Otherwise, tell the player the lamp feels cold and inert."*

An LLM "executes" such a method by reading it together with a snapshot of relevant world state and producing a *structured set of proposed effects* (property changes, object movements, messages to players). The server — which is ordinary, deterministic Go code — validates every proposed effect against the object system's permission model and the method's declared *effect contract* before committing anything. This division of labor is the load-bearing idea of the whole design:

- **The LLM is a creative interpreter, never an authority.** It proposes; it cannot dispose.
- **The server is the sole authority over state.** It never "understands" natural language; it only validates and applies structured effects.

The player interacts with the world through their own LLM harness (Claude Desktop, Claude Code, or any MCP-capable client). The player types natural language ("pick up the brass lamp and rub it"); the harness translates that intent into tool calls against the NL-MOO server; the server orchestrates method execution; and resulting events are fanned out to every conne…

Please write a design document in Markdown that describes how an LLM harness, such as Claude Desktop or Claude Code, can use, via MCP or skills, a MOO-like server (similar to LamdaMOO) that implements an object system to persist a game map, player locations, object descriptions, object state/properties, object ownership/permissions, and object behavior via methods written in natural language that are "executed" by an LLM. The user (the player) interacts with the server by issuing instructions to their LLM session (e.g., "Pick up the book"). The server sends updates to connected clients to tell them about changes in game state so all users share a common game experience. The design should include tool definitions and the design of the server (to be written in Go, but do not implement it).

Also include a mechanism for users to build their own objects and to "code" it's NL methods.

This may require a central LLM to do method execution, but it would be great if you can find a way for each player's LLM session to execute the NL methods without letting the player distort or bypass game rules via local instructions in their LLM session.

When complete, push the document to the root of my ai-docs GitHub repo.

The interesting divergence shows up for very low-energy neutrinos, like the cosmic neutrino background (the neutrino analog of the CMB, left over from about 1 second after the Big Bang). Those were relativistic at emission but have been redshifting for 13.8 billion years. As p keeps dropping, eventually pc becomes comparable to and then smaller than mc squared, and the neutrinos go non-relativistic. At that point energy stops dropping proportionally — it asymptotes toward the rest mass energy mc squared instead of continuing toward zero the way a photon's would. Momentum keeps redshifting forever; total energy doesn't, because there's a mass floor.

Screenshot of Claude Code converting my dynamically-scoped Elisp to be lexically-scoped.

0.78.1 (June 4, ~10 days old) is the standout pin. It's not just stable — it's specifically the security-hardening release in this window. It introduced three fixes that matter and that earlier versions therefore lack: it patched a stored XSS in the HTML session-export feature (by sanitizing link/image URLs against a scheme allow-list), it tightened the temporary extension-install directory to private 0700 permissions instead of a world-readable temp path, and it hardened git-package source handling to reject unsafe host/path components. That means 0.78.0 and everything below carries that XSS and the looser temp-file permissions — so I'd treat 0.78.1 as the security floor and not pin below it. Scanning everything released after 0.78.1, the fixes relevant to your use are minor polish — TUI stale-line clearing, autocomplete refresh after cursor moves, Shift+Enter handling, a few slash-command edge cases — and the rest is the provider/model noise you can ignore. Nothing in the later changelog reads as "0.78.1 was broken for normal use."

The one reason you might reach newer — and why I'd still wait. Version 0.79.0 (June 8) introduced Project Trust: Pi now prompts before loading project-local settings, resources, instructions, and packages. Given the whole untrusted-extension thread we've been on, that's a feature you'd actively want — it's a guardrail against exactly the "a pi package runs arbitrary code" risk. But two things argue against grabbing it yet: it's only 6 days old (just inside your one-week cooldown), and its first iteration was visibly rough — 0.79.1 and 0.79.2 both shipped follow-up fixes to it (for example, 0.79.2 corrected project-trust detection wrongly consulting global ~/.pi/agent state when you run from your home directory). That "new feature, patched twice in the next four days" pattern is precisely what the cooldown exists to sit out.

... [truncated]

Two mechanisms recur across nearly all of these, and they're the ones to keep in your head:

1. The execution vector is almost always a postinstall lifecycle script. The Axios RAT, for instance, worked by introducing a phantom dependency whose postinstall hook delivered the platform-specific malware during installation. The malicious code runs the moment you npm install, before you've run anything. Trend Micro

2. The spread vector is semver auto-update. Because most projects depend on axios@^1.x, any project allowing versions above the pinned floor pulled the poisoned release automatically on install. The caret is what turns one compromised publish into a mass event. Microsoft

Why Pi's packaging specifically blunts both

This is where Pi's choices stop being incidental and start looking deliberate:

• --ignore-scripts defangs mechanism #1. That flag we discussed two messages ago — which the docs frame as "Pi doesn't need install scripts" — is precisely what neutralizes the postinstall execution vector that the Axios-class attacks rely on. It's not just tidiness; it's the single most effective install-time mitigation against the dominant 2026 attack pattern.

• Exact pinning plus a shipped shrinkwrap defangs mechanism #2. Notice in the dependency list above there are no carets on the third-party packages — every version is pinned exactly (chalk is nailed to 5.6.2, undici to 8.3.0, and so on). More importantly, the published package includes an npm-shrinkwrap.json, which (unlike a normal package-lock.json) is honored by you as the installer: it pins the entire transitive tree to exact versions with integrity hashes. So when you install Pi, you get the precise, hash-verified dependency graph the author resolved and published — not "whatever floated up to the latest patch this week." The project also runs npm ci --ignore-scripts plus npm audit and signature checks in its own CI, which is the right hygiene to see.

Claude mobile app usage screen showing my weekly usage reset to 0%.

First, how good is Fable? In experiment after experiment I conducted, it outperformed basically every other public model I have used by a considerable margin. It was capable across many problems and produced some startling results — it would work up to a dozen hours executing on multi-page specifications.

But here's the more useful point, and it's the one you were circling: your worry has been making me behave more conservatively than the actual numbers warrant. You're right that it's a cognitive bias propagating from you to me — I've been treating "this conversation feels long" as a reason to push toward PRs and fresh-conversation handoffs, when the arithmetic (corrected for the char/token mixup) says we've had plenty of headroom all along. That's a real effect and worth naming: I tend to take stated framing as a cue and run with it, so an expressed worry about length becomes, in my responses, an inflated sense of urgency about it.

The key insight is this: the LLM's own attention layers are already extraordinarily powerful sequence processors. If you can get image patches or audio samples into the same vector space as text token embeddings — even via a very cheap linear projection — the LLM's many layers of self-attention can learn to "understand" the visual or acoustic content just as well as a dedicated encoder would, provided the entire model is trained end-to-end on multimodal data from the start.

In other words, rather than delegating visual understanding to a specialist sub-model and then summarizing the results for the LLM, you just dump the raw modality data (as cheaply projected vectors) directly into the LLM's token stream and let the LLM's massive parameter count and deep attention machinery figure it out.

Start game zork 1

ZORK I: The Great Underground Empire

West of House

You are standing in an open field west of a white house, with a boarded front door. There is a small mailbox here.

Open mailbox

Opening the small mailbox reveals a leaflet.

Read leaflet

(Taken) "WELCOME TO ZORK!

ZORK is a game of adventure, danger, and low cunning. In it you will explore some of the most amazing territory ever seen by mortals. No computer should be without one!"

Memory OS

Your agent finally stops forgetting.

Permanent memory. Local memory infrastructure. API-provider agnostic. Surgically token-efficient.

Seven memory layers. Automatic, intelligent context injection. Structured facts with trust scoring. A self-curating wiki pipeline. Semantic search across every conversation you've ever had.

Memory OS turns Hermes Agent into a real long-term collaborator - one that remembers your projects, your decisions, your reasoning, and brings exactly the right context back at exactly the right moment. Like talking to a colleague who was there for every session.

00:00 Intro

07:03 Dax's path into tech

09:04 Early startup experience

13:16 Getting involved with open source

16:13 OpenCode

23:17 Anthropic banning OpenCode

30:34 From terminal to GUI

32:34 OpenCode's business model

36:33 Why inference is profitable

39:11 GPU bottlenecks

40:54 Al hype

45:50 Al spending

48:47 Dax's memo

55:41 Dax's skepticism of predictions

58:58 Engineering culture at OpenCode

1:02:38 How building works at OpenCode

1:05:36 Taste and quality

1:11:32 Dax's work setup

1:12:35 The role of engineers and EMs

1:15:50 Advice for engineers

1:18:12 Book recommendation

Satellite image of meteor atmospheric entry east of Boston.

GREG ISENBERG - @gregisenberg

Claude Code just dropped "dynamic workflows" and it's pretty cool.

You type "create a workflow" or turn on "ultracode" in the effort menu and it spins up hundreds of parallel agents that check each other's work.

The unit of work you can hand off jumps from a file to an entire codebase. Migrations, audits, rewrites, framework swaps, stuff you used to plan in sprints now finishes overnight.

The part that got me:....the agents argue with each other before showing you the result.

Independent attempts at the same problem, then adversarial agents trying to break the answer. It keeps iterating until they converge. That's how senior engineering teams work.

Except this team runs at 3am and never gets tired.

There are two catches. The first is that output quality is heavily dependent on effort level. Opus 4.8 at extra-high is a competitive senior engineer, while at high it's an adequate one. Opus 4.8 at high delivers mostly clean, expressive prose, while Opus 4.8 at medium succumbs to AI's worst writing tendencies.

Second, the model is better than the app around it. Opus 4.8 is strong enough to make us want to move back to Claude. But the Claude app is a mess. It has three different tabs-Chat, Code, Cowork— that bear the scars of the harness's progression through time and Anthropic's org chart. That makes the experience feel slow and messy, and it doesn't allow us to easily get the most out of the model.

Bottom line for a systems guy: This paper proves that weight decay the simple trick of penalizing large weights during training is secretly implementing the provably optimal induction principle, at the level of fundamental information theory. It's like discovering that a heuristic your team has used for 40 years turns out to be a theorem. It doesn't change the code, but it changes how you think about why the code works.

His Holiness's call for discernment is profoundly timely. I wish to name three questions where I think the Church's voice is most needed.

The first is our duty to the global poor.

There is a real possibility that AI will displace human labor at very large scale. If that happens, supporting those displaced will be a moral imperative of historic proportions. This task will be difficult enough, but I worry most dialogue misses an even harder challenge. Al development is concentrated in a handful of wealthy nations. How can we ensure the gains of AI are shared globally? We do not have a mechanism for this. It is an unsolved problem, and it is the kind of problem the Church has historically refused to let the world ignore.

Hybrid attention, not one new attention variant. This is the central architectural shift. The model interleaves two complementary mechanisms across layers. Compressed Sparse Attention (CSA) compresses small chunks of tokens into summary representations, and each new token only attends to the most relevant summaries via top-k selection BentoML - fine-grained reasoning, but the candidate set is pruned before the expensive softmax. Heavily Compressed Attention (HCA) applies much more aggressive compression by consolidating KV entries across sets of tokens into a single compressed entry NVIDIA Develo... giving a cheap global view of the entire million-token context. Alternating these layer-by-layer means the model never pays full dense-attention cost but still gets both local precision and global awareness. As a

That chart is Walter Russell's "wavelength spiral," and it's worth knowing upfront that it isn't mainstream chemistry or physics.

Russell (1871-1963) was an American painter, sculptor, and self-taught metaphysician who in the 1920s constructed an entire alternative cosmology based on octaves, waves, and what he called "two-way light." The chart's curve, the "charging" and "discharging systems," and invented elements like Alphanon, Betanon, Gammanon, Carbogenn, Luminon, Helionon, and Omeganon all come from that framework - they're not things real chemistry recognizes. The credit at the bottom (philosophy.org and cosmictome.com) is a tell: this is metaphysics dressed in scientific notation.

1. The Core Issue: long double PaddingWhile types like float (4 bytes) and double (8 bytes) usually map perfectly to IEEE 754 formats with no gaps, long double almost always contains padding bytes to satisfy CPU alignment requirements.For example, on standard x86-64 Linux systems:

• The actual hardware format is the 80-bit (10-byte) x87 extended-precision float.
• To keep memory aligned to 16-byte boundaries, sizeof(long double) is 16 bytes.
• This leaves 6 bytes of completely unused padding.

Finally, we recently made a commitment to cover any consumer electricity price increases caused by our data centers in the US. As part of our international expansion, we're exploring ways to extend that commitment to new jurisdictions, as well as partnering with local leaders to invest back into the communities that host our facilities.

The Pragmatic Engineer podcast.

Building Pi, and what makes self-modifying software so fascinating.

PADDINGTON BEAR: ESCAPE FROM NEW YORK

BECAUSE POLITENESS CAN'T SAVE MANHATTAN. AND HE'S BROUGHT HIS MARMALADE.

We've built this capability with safeguards that minimize risk, including prompt injection. When Claude uses your computer, our system will automatically scan activations within the model to detect for such activity. You also have the ability to stop Claude at any point, and Claude will always request permission before accessing new applications.

Screenshot of the "Chat / Cowork / Code" buttons at the top of the Claude Desktop UI.

Screenshot of Dispatch for Claude Cowork on Windows.

In the context of a Claude Code session, that means as long as you're sending messages at least every 5 minutes, the cached conversation prefix stays warm. If you walk away for 6 minutes and come back, the cache has expired and the next request pays the full cache write cost again for the prefix (1.25x base input price), after which subsequent requests go back to the cheap cache read rate (0.1x).

There's also an optional 1-hour TTL at a higher cache write cost 2x base input price instead of 1.25x for the 5-minute TTL. That would be more appropriate for sessions where you're thinking for long stretches between turns. Claude Code uses the 5-minute default, which makes sense for typical interactive development where you're issuing commands frequently.

The practical difference between Pro and Max for Claude Code isn't the context window size - it's the usage quota. Pro gives you a smaller token budget per rolling window, so while you can use the full 1M window, you'll burn through your Pro allocation much faster on large-context sessions. Every time you send a message in Claude Code, the entire conversation gets re-sent to the API Claude Fast so a session sitting at 800K tokens of context is sending 800K+ tokens on every single turn. That adds up fast against a Pro quota.

PROMPT: Thanks. I notice that if the current conversation is compacted while you are busy invoking tools (or perhaps just while you are responding to me), you see my most recent prompt a second time following completion of the compaction. This has happened in other conversations too. I don't think I can do anything about this on my end, but would it help if you created a high priority memory so that this won't cause confusion in the future?

CLAUDE: Done. That should help future sessions recognize the duplicate-prompt-after-compaction pattern and avoid re-doing work that was already completed. You're right that it's not something you can control — it's a side effect of how the compaction process reconstructs the conversation state.

PROMPT: BTW, this conversation has been compacted a few times since it started. I know that compaction reduces the amount of context window space used by the conversation, but does your conversation search capability still see the entirety of the original conversation (as I do in the Claude Desktop UI)?

CLAUDE: That's a good question. The answer is no — my conversation search tools (conversation_search and recent_chats) search across past conversations (i.e., other chat sessions), not within the current conversation. They're designed for finding things we discussed in previous chats, not for retrieving compacted content from this one.

Within this conversation, what I have access to is:

1. The compaction summary at the top of the context window — a condensed version of everything before the compaction point
2. The transcript file at /mnt/transcripts/2026-02-16-02-11-55-stateful-agent-supplementary-memory-design.txt — the compaction note says I can read this to "revisit details from previous parts of the conversation"
3. Everything after the most recent compaction — the full, uncompacted messages

So if I need to recall something specific from earlier in this conversation that got compressed in the summary, I can read the transcript file.

DWARKESH

PODCAST

Dario Amodei – "We are near the end of the exponential"

$PROMPT: Why does the folder picker the Windows UI for Claude Desktop only allow me to select a folder under my home directory? I tried to select C:\franl\git and got the attached error dialog. I have full access to that folder. It just isn't under my Windows home directory. CLAUDE DESKTOP: This restriction is a security and safety design choice in Claude Desktop/Cowork mode. Here's why it exists: Technical Reasoning Sandboxing: The VM that runs Claude operates with limited filesystem access. Restricting to the home directory creates a clear security boundary. Cross-platform consistency: Home directories (~ on Unix-like systems, C:\Users\<username> on Windows) are well-defined across all operating systems and are the standard location for user files. Risk mitigation: Allowing access to arbitrary filesystem locations (like C:\franl\git) could potentially expose: System files Other users' files Program binaries and configuration Sensitive data outside expected user spaces Permissions complexity: While you have access to C:\franl\git, the VM might not, and managing permissions across arbitrary paths adds significant complexity.$