The Changelog: Software Development, Open Source

Dave Kerr created hacker laws, and now he finds himself reviewing agent-written code for them. Back on the show after six years, Dave names what he sees limiting teams today: keeping everyone’s mental model in sync with what’s actually been built. Adam declares it Kerr’s Law on the spot. We get into why Dave’s team treats code review as a deliberate slowdown, how Shellwright lets agents bring evidence to a pull request, and what living with bipolar disorder has taught Dave about noticing when the excitement of these tools stops being healthy. Join the discussion Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today! Sponsors: Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. KubeCon + CloudNativeCon – Get a generous discount by using changelogpod (think Earlybird pricing!). Learn more and register. WorkOS – WorkOS is building the infrastructure for the AI era. Explore three new product previews: Airlock for secure AI agent permissions, Atlas for deploying AI-built internal apps, and Passport for seamless, passwordless access to work apps. See the announcements, demos, and highlights in the WorkOS init() 2026 recap. Fingerprint – Detect threats, AI agents, and bots with device intelligence. Featuring: Dave Kerr – Website, GitHub, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Kerr’s Law — A team’s ability to scale is limited by its ability to keep a shared mental model in sync with the system it builds. Dave Kerr’s website Hacker Laws Effective Shell Ark (Agents at Scale) Shellwright Tailscale Playwright asciinema k9s Something missing or broken? PRs welcome!

Craig Kerstiens returns to talk about the ever-expanding world of Postgres: a deliberately boring core, a thriving extension ecosystem, and pg_lake bringing DuckDB and Iceberg into the mix. We dig into the pain of ETL, what Craig is watching in Postgres 19, the impact of AI on open source maintainers, and why the database still has plenty of room to grow. Join the discussion Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today! Sponsors: Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. KubeCon + CloudNativeCon – Get a generous discount by using changelogpod (think Earlybird pricing!). Learn more and register. Fingerprint – Detect threats, AI agents, and bots with device intelligence. WorkOS – WorkOS is building the infrastructure for the AI era. Explore three new product previews: Airlock for secure AI agent permissions, Atlas for deploying AI-built internal apps, and Passport for seamless, passwordless access to work apps. See the announcements, demos, and highlights in the WorkOS init() 2026 recap. Featuring: Craig Kerstiens – Website, GitHub, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Iceberg Parquet Heroku Supabase PlanetScale PostgreSQL pg_lake DuckDB pgsql-hackers mailing list Something missing or broken? PRs welcome!

This week I’m talking with Zeno Rocha, CEO of Resend, about scaling “boring” email to 3 million users, the secret Go rewrite behind it, and building for agents. We cover pricing.md, MCP, spam gangs, and why Resend keeps what’s next for email. Join the discussion Changelog++ members save 10 minutes on this episode because they made the ads disappear. Join today! Sponsors: WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace. Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: Zeno Rocha – Website, GitHub, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Resend Resend Inboxes Resend CLI Dracula Dracula Pro Something missing or broken? PRs welcome!

Gavriel Cohen, creator of NanoClaw and co-founder of NanoCo, joins Adam to explain how a 40-hour weekend project became a viral open source hit and the foundation of an enterprise AI company. Gavriel describes the security concerns that led him to build a small, container-isolated alternative to OpenClaw, why he released it under the MIT license, and why the project’s community and credibility are more valuable than keeping its code private. They explore the shift from writing code to architecting the environments in which agents work, NanoClaw’s “skills over features” approach, the approval and governance layers required inside large companies, and a future where every worker manages agents without surrendering human judgment. They close with the technical simplicity behind NanoClaw, containers, TypeScript, SQLite, and a two-database design, and Adam’s case for durable Agent Flow artifacts that keep organizational context from disappearing into chat. Join the discussion Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today! Sponsors: Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace. Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: Gavriel Cohen – LinkedIn, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: NanoClaw and NanoCo NanoClaw NanoClaw on GitHub NanoClaw design philosophy and README NanoClaw customization with skills and recipes NanoClaw v2 two-database session design NanoCo Agent projects and models OpenClaw OpenClaw on GitHub Hermes Agent Claude Fable 5 Containers and databases Apple container Docker Sandboxes SQLite write-ahead logging Turso libSQL Something missing or broken? PRs welcome!

This week I’m joined by Peer Richelsen, co-founder of Cal.com. What if the majority of open source repositories are already compromised and we just don’t know it yet? That’s the theory Peer brings to the table this week. We dig into how AI has flattened the knowledge graph to the point that a 16-year-old can vibe hack a power station just as easily as their mom can vibe code an iOS app, why the reporting culture that has kept open source safe all these years is collapsing under AI generated noise, Cal.com’s move to fork its own codebase and take the sensitive parts private, and the eye opening reality that shipping “$1 of AI tokens for pennies on the dollar” is now a common startup business model. Join the discussion Changelog++ members save 10 minutes on this episode because they made the ads disappear. Join today! Sponsors: Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace. WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: Peer Richelsen – Website, GitHub, LinkedIn, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Editorial disclosure: Adam states in the episode that he is a small seed investor in Cal.com. Cal.com and Cal.diy Cal.com is going closed source — here’s why Moving to closed-source: the technical changes Cal.diy on GitHub Cal.diy contributing guide Cal.com Open source, agents, and contribution workflows Swamp Club OpenClaw Mitchell Hashimoto: Vibing a Non-Trivial Ghostty Feature GitHub Agentic Workflows GitHub issue-intent, rationale, confidence, and approvals AI-assisted security Mozilla: Hardening Firefox with Anthropic’s Red Team Mozilla: The zero-days are numbered Anthropic and Mozilla’s Firefox security collaboration Next.js security advisories LiteLLM issue: malicious package and credential stealer Something missing or broken? PRs welcome!