Articles

What we measured, written so it can be done again

No number in these pieces is typed by hand: each one carries the command or the file:line that produces it, and the one without a declared denominator is not published.

• The bug that answers SUCCESS: a reproducible audit of litellm#46923 2026-11-06
  Six arms, an HTTP server that records the real payload and a negative control. How to audit a framework defect without mocks, why the candidate patch makes the synchronous path worse, and why the dangerous state is the one that looks like success.
• I swept 50 repositories: two real defects and a 2 % hit rate 2026-11-06
  I measured 765 workflow files in 50 repos with more than 5 000 stars: 262 steps invoke a test runner and 11 cannot make the workflow fail. The defensible-defect rate is 2 %, and the most severe one sits in the deadest repository.
• Context economics — the 99.2 % 2026-11-06
  99.2 % of an agent's cost is input, not output. Measured across two generations of the same panel: the total moves 28.19 % between runs, the ratio moves 0.06 points. That is why what is sold is a ratio and not a receipt.
• The $6.3B hack was not a code bug 2026-11-06
  Ten public repositories with a deployment workflow, measured with the exact commit of each one: 807 findings and 115 with a conjunction of authority. None of the ten returns a clean green, and the article says why that is not 807 vulnerabilities.