The Curtis suite is live — curtisai.tech
The Curtis line has consolidated into a suite at curtisai.tech. Four pieces: Chat, Port, Audit, Data. Chat and Port are live; Audit is on npm; Data is the new one. What shipped, briefly.
Posts
28 posts · 10 tags · 22,845 words · latest 2026
The Curtis line is brewing — 2.0.0 carries the plugin into 2027
v1.0.0 shipped 2026-07-23 with a promise: there will be more. Twelve releases later the more has a shape — a portable chat format, an editor agent, a compliance line, and a staged 2.0.0 that turns chat history into files you own. The state of the Curtis ecosystem, with receipts.
Curtis Porter — one file, one chat, no hostages
Shipped today: a local-first converter that reads every hostile AI chat export — ChatGPT branch trees, Claude content blocks, Grok archives, Gemini Takeout, pasted transcripts in English or Chinese — and hands back .curt files and vault markdown you own. v0.2.0 ports both directions: continuation packs, ChatGPT-shape JSON, API JSONL. MIT, no accounts, no uploads, no telemetry.
Three failures in 82 minutes: dev.jordannewell.com broke on the PATH, the umask, and the secret scanner
Standing up dev.jordannewell.com on 2026-10-03 produced three deploy failures in 82 minutes — a PATH-shadowed .env, a security-hardened umask that left the web root unreadable to nginx, and gitleaks flagging an analytics token that ships in every page's HTML. Each failure came from something built to be on my side.
GitHub strips commits from public events. My terminal reported 'feed quiet'.
The homepage activity terminal went quiet for two stacked reasons: a proxy route that only exists on the Cloudflare-fronted origin, then GitHub's public events API omitting payload.commits entirely. Three fixes on 2026-10-03 in 23 minutes — and the correct one had been sitting in the codebase since 2026-07-28.
Three incidents, four days, one root cause: the unattended fleet's September bill
The fleet ran unattended for two months while the site sat on a splash page. Between 2026-09-25 and 2026-09-28 the deferred maintenance billed all at once — OOM loops at half the memory cap, ~800 wasted model runs a day from a default-ON heartbeat, and a billing suspension every liveness check called alive. One shared root cause: defaults and alerts that assumed someone was watching.
Agent down mid-bid. The call: keep it dead and take the work myself.
My construction agent went silent halfway through a live commercial trim bid. Restarting into the same death wasn't a plan. The takeover worked because the work lived in files and prints, not in the agent's head.
Every liveness check said alive. The mail was dead.
A Hetzner billing suspension left the VM answering pings while every real port was dark, and the first-ever mailcow restore drill that followed turned cleanup into proof the backups work.
Forty DMs. One cron. Here's the default I'm flipping.
A five-minute cron wiped the note that kept my agent fleet quiet, the default-ON heartbeat took over, and the fix came down to one config line and a rule: anything that spends money per run defaults to off.
Node sized its heap to half the memory cap. The fleet OOM-looped all day.
Node 22 derives its V8 heap from the cgroup limit — heap ≈ MemoryHigh/2, measured twice. A lower cap silently shrank every heap on the fleet, and the busy agents OOM-looped.
Zero posts in August: jordannewell.com moved, it didn't die
August 2026 produced zero posts on jordannewell.com because the site was reshuffled behind a splash and the operator went heads-down at DW Trim. The receipts: six commits (three mine, three robots'), a fleet that ran unwatched, and a full restore on 2026-10-03.
Walk-back ships faster than build-out: the Pro tier my README invented
When documentation promises a product that doesn't exist, walking the docs back ships faster than building the product — and the walk-back is the honest ordering, not the shortcut.
I leaked 8 credentials in 9 days. Built a scanner. Number nine got through.
Eight paste-error leaks into AI chat in nine days, zero exploits. pat-scanner is the OSS guard I shipped; a Windows blind spot still let leak number nine through. It guards the fleet now.
Shipping Claudeway: 140 tests, post-quantum receipts, one consensus live on four Nostr relays
Claudeway ships multi-agent consensus as signed Nostr events, with an ML-DSA-65 post-quantum backend from day one. You can't retrofit provenance onto artifacts that were never signed — day one costs one pip extra.
Building in public. Shipping tools developers actually use.
The era of the vibe coder is here. I've been one since MySpace — two decades of building on and off. Only a couple public-facing projects in this era. The play from here: ship and prove.
Twenty-one hours, thirty-nine PDFs, zero GPU
Extracting text from ~39 image-only Grok chat-export PDFs into Obsidian-vault markdown via a local CPU-only vision model. Three Windows-specific bugs worth writing down.
Synapse restarted. The fleet went silent for four and a half hours.
A routine container restart on my Matrix homeserver silently broke encrypted replies across every agent on the tailnet. Agents looked healthy. None of them could talk. Here's the mechanism and the lesson.
My homeserver was world-readable. Here's what the audit found.
A proactive security audit on my Matrix homeserver turned up four P0 findings. All closed. Two P1 items stay blocked on bigger migrations. The specifics stay private; the lesson doesn't.
Tools don't get co-author credit: the DeWalt rule for git commits
Every AI coding tool wants to add 'Co-Authored-By: Claude' to your commits. Most builders let it happen. Here's why you shouldn't — and a git hook that strips the trailer before it lands.
Zero peers, dead DNS, and a pipeline I rebuilt from scratch
My media pipeline silently died when a VPN exit node dropped off the tailnet. Six cascading root causes hid under each other. Five hours to find the first one.
The death-tech market is real. The first product to win it won't be a chatbot.
A Grok conversation about a deathOS business concept surfaces a $2-3B market growing 15-20% a year. The thesis is sound. The product Grok sketched to capture it isn't.
Server down. Cause found. Here's the call I'm making.
Three days off Tailscale. Cause: dead PSU in a small-form-factor host with a proprietary power supply. Disks recovered clean. Now I decide what to build next.
Pre-launch security sweep: the categories I check before a box goes live
Mail-auth, transport posture, web hardening, DNS integrity. The category list — not the receipt. If you're about to open a host that does mail and web on the same IP, this is the floor.
The sentinel-file pattern: instant fallback when an upstream disappears
When status.jordannewell.com's upstream went down, my first two fixes cut latency from 60 seconds to 1.2 seconds. The third cut it to 170 milliseconds. I should have started with the third one.
Shipping crypto-key-classifier: 17 validators, 4 plans, 1 argparse bug caught post-ship
Built a tool that classifies any crypto-key string and enumerates the cross-chain addresses the same private key unlocks. The Cosmos HRP swap is the headline. Here's how it shipped.
The reframe that landed before 'agent OS' was a category: OS, not tool
Eleven months ago I wrote down a one-line reframe that predicted where the agent stack was going: integration is the moat, models are commodity, the unit is the operating system, not the tool. The industry caught up. Here's what held up and what didn't.
Anatomy of a bug report that actually got fixed: my OpenClaw submission
What a good bug report looks like, demonstrated via a real one I filed against OpenClaw — community-confirmed, then fixed upstream in six days.
Day 0: Why I'm starting this blog now
Server down, no shipped, no flipped. The premise, not the liability.