Research and field notes

Start with the research

• Website agent-readiness across 567 company sites: one scanner over a selected prospecting sample of 567 company sites in ten weeks, with the changing check set recorded as a limitation.
• What four AI assistants call an agent-readiness audit: fifty buyer questions, 193 answers, one day's conditions.
• Thirty-day follow-up: 201 comparable site readings: a 210-site cohort, 201 comparable readings, four changed level, and no effect from the briefs established.

Browse all articles

47 articles.

No articles match your search.

• What a publisher owes someone else's agent. 2026-11-02. Protocol notes. ASD's guide on agentic AI is written for operators. What an MCP server's publisher owes them, read from the MCP spec and from my own server.
• Finnish MiCA crypto providers and AI agents. 2026-10-31. Research. All five Finnish crypto providers in the MiCA register sit at isitagentready Level 1 of 5, and none passes the scanner's nine agent protocol checks.
• Keeping my lab and my client work apart. 2026-10-26. Build notes. Client work now runs in a Windows virtual machine apart from my own lab. How I tested it with two test clients, and what it does not isolate.
• TLA+ on my own tools, in numbers. 2026-10-22. Build notes. Four outside reviews raised 189 claims and none was refuted, which says little, and a full mutation run caught 1 002 of 1 002 in 64 minutes.
• What Shopify changed for agent shopping since August. 2026-10-18. Protocol notes. Shopify moved store agent tools to /api/ucp/mcp and opened checkout to agents. What a merchant can check publicly and what stays hidden.
• Three outside reviews of my TLA+ models. 2026-10-17. Build notes. Three outside reviews read my TLA+ models, none of their claims was refuted, and the third left no high rated finding.
• Microsoft's own CVE count is up nearly eightfold in a year. 2026-10-14. Research. Microsoft-assigned CVEs rose from 180 to 1417 a month in a year, and the monthly release keeps growing after Patch Tuesday.
• Thirteen review rounds and one rollback. 2026-10-12. Build notes. Eight review rounds kept breaking one gate fix until I undid it, and the mutation runs put me on a forced break.
• Twelve days of TLA+ on my own tools. 2026-10-09. Build notes. What TLA+ found in my own tools in twelve days, what outside reviews confirmed and the 21 fix rounds so far.
• What 497 cloud agents asked of my desktop. 2026-10-08. Build notes. 497 Sonnet subagents checked 70 fixes from my desktop. The model ran in the cloud and the tests ran here. By my estimate a local model would have taken days.
• The browser my agent and I both run. 2026-10-06. Build notes. Why my agent and I both ran Brave with the V8 optimizer off, Forgetful Browsing and passkeys, with the sources and the limits.
• A clean Windows install for agent work. 2026-10-05. Build notes. How I set up a reinstalled Windows 11 machine for parallel Claude Code sessions, and what each protection layer covers that the others leave open.
• Why I publish every guide for free. 2026-09-29. Build notes. I answer for client work under my own name. The rules I measure sites against move monthly. What moved from July to September, and one finding that was wrong.
• My own site is my proof of work. 2026-09-26. Build notes. Why my site shipped 54 minor versions in three weeks, what gets fixed the same day, and what it cost when a change broke my own parity check.
• What agent memory in local files gets me. 2026-09-25. Build notes. Plain local files let each Claude Code session look up what the earlier sessions recorded. A count of that memory, and why it now reads like a private language.
• HTML and Markdown can disagree. 2026-09-12. Build notes. A Markdown version can leave out part of a page or send a reader to a different link. I built markdown-parity-check to compare what the two versions contain.
• I rebuilt turva.dev around the report. 2026-09-07. Build notes. The updated site puts sample reports beside the services they describe, with evidence, correction owners and acceptance checks visible before purchase.
• What 19 identity vendors publish for agents. 2026-09-05. Research. A dated scan of 19 identity vendors examines what their public sites expose for agents, and what the results cannot say about the products behind them.
• Two files called auth.md, and they disagree on the field names. 2026-09-04. Protocol notes. Two auth.md conventions use similar language and different field names. This comparison records the mismatch and the limited role of turva.dev's own file.
• Thirty-day follow-up: 201 comparable readings from 210 sites. 2026-09-03. Research. A 210-site follow-up cohort produced 201 comparable readings. Four changed level. The observations do not establish an effect from the unsolicited briefs.
• What four AI assistants call an agent readiness audit. 2026-09-03. Research. Fifty buyer questions produced 193 answers across four assistants. The study shows how the same audit term can refer to websites or organizational AI adoption.
• Website agent readiness, measured on 567 company sites. 2026-09-03. Research. One scanner measured 567 selected company websites over ten weeks. The results describe that prospecting sample, and the changing check set is a stated limit.
• TRACE signs how an agent ran, not what it was allowed to reach. 2026-08-30. Protocol notes. This article examines what a TRACE Trust Record attests to, and why runtime evidence does not itself establish the right permissions or correct decisions.
• I scanned thirteen code hosts. Not one served an MCP server card. 2026-08-22. Research. Fourteen code-host surfaces were scanned on one day. The findings concern public discovery paths, not the full capabilities of each hosting service.
• It would be cheating to keep the old price. 2026-08-21. Build notes. A dated account of pricing changes and the work behind them. Historical prices remain in the article, with the current service prices linked separately.
• I thought it was a small job. 2026-08-16. Build notes. A seven-day review of the author's own workspace found 367 issues across nine packages. The article records the effort, findings and limits of that work.
• My gate could not see a sixth. 2026-08-04. Build notes. A passing validation gate missed elements it never expected. The investigation shows why checking required members differs from checking the complete set.
• A red reading that measured my own client. 2026-07-30. Build notes. An MCP request seemed to expose a server regression but selected the wrong compatibility path. The article records how request and response were told apart.
• The checks that pass for the wrong reason. 2026-07-29. Build notes. A link can resolve successfully and still point to the wrong version. This investigation examines checks that pass while validating the wrong target.
• Finishing the optional commerce checks. 2026-07-20. Build notes. A dated implementation note separates discoverable payment declarations from settlement. The scanner checks changed, the settlement boundary did not.
• The twin is the page. 2026-07-19. Build notes. Two separately maintained versions of the same content drifted apart. This build note explains the move to shared content and the limits of the checks on it.
• Every response promised a rate limit. Nothing enforced it. 2026-07-18. Build notes. A response header advertised a request limit that no code enforced. The investigation separates a published policy, the code and what a probe can show.
• Microsoft said the patches would get bigger. I measured how much bigger. 2026-07-15. Research. A comparison of selected Microsoft security-update datasets examines changes in reported vulnerability counts and severity, with the comparison limits stated.
• Reducing secret exposure in coding-agent workflows. 2026-07-12. Build notes. Ways to reduce secret exposure when coding agents work with a repository, including credential storage and the permissions around runtime access.
• How agent-ready are Finnish B2B sites? I scanned sixteen. 2026-07-07. Research. A scan of sixteen selected Finnish B2B sites records gaps in agent-readiness. This historical sample leads into the later study of 567 sites.
• When honesty and the checker disagree. 2026-07-06. Build notes. An optional credential was both declared and denied in the same metadata. The repair made the description consistent without claiming access it did not grant.
• Four AI agents re-checked the guides. 2026-07-04. Build notes. A dated review of the guides found that source specifications and local claims had moved. The article records corrections and the limits of automated checks.
• The page grew, the agent token count did not. 2026-07-04. Build notes. A July measurement compared the token counts of the homepage's HTML and Markdown representations. The result describes that page and measurement date.
• Moving the source from GitHub to Codeberg. 2026-07-04. Build notes. The source moved to Codeberg and later returned to GitHub. This dated incident log preserves the sequence and links readers to the current public source.
• A free llms.txt validator. 2026-07-02. Build notes. The launch note for turva.dev's llms.txt validator explains its original checks. The live tool page carries the current interface and supported checks.
• Agent access is now a setting. 2026-07-02. Protocol notes. A July product update illustrates how crawler access, discovery and payment controls can sit at the network edge, before the site's content is reached.
• Publishing an ai-catalog.json for agentic discovery. 2026-06-29. Build notes. A dated implementation log records adding an AI Catalog discovery manifest. Later ARD conventions are explained in the current resource-discovery guide.
• What the Open Knowledge Format is, and what it is not. 2026-06-27. Protocol notes. An early reading of Open Knowledge Format version 0.1 separates the file structure it defines from the semantic promises it leaves open.
• What an agent pays to read your site. 2026-06-26. Build notes. This article examines the publisher's influence on the content a text-based client receives, using a dated HTML-versus-Markdown comparison.
• When an agent can prove it is Claude. 2026-06-25. Protocol notes. Signed requests can give evidence of a sender's identity. This dated article separates that evidence from trusting a user-agent string or granting an action.
• What makes an AI agent's decisions reliable. 2026-06-22. Protocol notes. Usable inputs and explicit operating limits matter for agent decisions, alongside model uncertainty. The article asks where control and verification belong.
• Owning your fediverse identity. 2026-06-21. Build notes. A build note on separating a public identity domain from the server that hosts the account, and the dependencies that still remain.