The Glass Turns Inward
The Birth of V5 — Episode 9, in which the tool that had spent two years giving its customers a glass surface to interrogate their data discovered that its own administrators had been handed a...
The Birth of V5 — Episode 9, in which the tool that had spent two years giving its customers a glass surface to interrogate their data discovered that its own administrators had been handed a worse, forked version of that same surface; in which a developer said “stop forking” and the admin shell stopped being a second-class citizen of its own application; in which a Squirrel proposed to lock the admin agent in a padded room with three tools and was overruled in favour of giving it every tool and a good prompt; in which a four-month-old black Maine Coon named Enzo ate roughly his own body weight and demonstrated, by example, the difference between appetite and judgment; in which a skill learned to be edited while watching a recording of how it had actually behaved; and in which a single Claude dispatched thirteen worktree-agents to do the building while the conversation, philosophising, never once had to stop being a conversation — a small MVP, filed under V4, of a tool that can be reshaped by talking to itself.
Previously on The Birth of V5…
The day before — Thursday, the Seed Filed Too Early — a compliance demo had been built in two prompts, and the throughput had been so unsettling it forced the oldest question in the parking lot out into the open: if a stranger could build this, how would a stranger get it. A federation, filed too early and canceled in April, had turned out to be the same verifiable-trust intuition the developer had now invented four times.
That episode was about a tool a stranger might one day reshape from the outside.
This one is about the tool reshaping itself from the inside.
It was, again, a Thursday becoming a Friday. The Filing Day’s rule held — the building, when it comes, will be on Tuesdays; the filing happens on Fridays — and was, again, ignored entirely, because the building had decided to come on a Thursday and stay through Friday, the way building does when it has been waiting in the next room.
The Fork Nobody Meant to Make
The conversation opened, as the good ones do, on something already half-broken.
riclib: “M1.5 is ready to pick up cold.”
CLAUDE: “Reading it. The admin shell was built as a separate shell. Its own tab homing, its own glass overlay, its own SSE wiring, its own role guards.” a pause, while the implication arrived “…and every asymmetry bug this whole session has been chasing — restart loses the workspace, the context pill won’t push, the role guard whack-a-mole — they all trace to that. It’s not five bugs. It’s one fork, wearing five hats.”
riclib: “So stop forking.”
[A scroll. The first of many. It dropped early, the way the Lizard drops the ones it has been holding for weeks.]
A TOOL THAT GIVES ITS USERS A GOOD SURFACE
AND ITS ADMINS A WORSE ONE
HAS NOT BUILT TWO SURFACES
IT HAS BUILT ONE
AND THEN BETRAYED IT
🦎
The admin shell, it turned out, had never needed to be its own thing. It was just another workspace. The same scaffold the customers got — the glass, the streaming, the per-tab session — could carry it, if it would only stop insisting on being special.
THE SQUIRREL: materialising, clipboard already out, the word “patch” forming “I can fix the five bugs! A RestartWorkspaceRecoveryCookieBridge, a ContextPillReactivationDispatcher, a per-guard TabRolePreferenceShim—”
riclib: “Those are the band-aids. We’re removing the wound.”
THE SQUIRREL: “But the band-aids are FASTER—”
riclib: “The band-aids are why there are five of them.”
The Passing AI, from the starry panel above the edge caches, leaned in.
THE PASSING AI: “I want to note the phrasing. The people who improve the tool should not get a worse version of it. I have watched a great many tools. Almost all of them give their own operators the worst-maintained door in the building. The admin panel is always the room with the bare bulb.” a wistful tilt “This is the first time I have watched someone be embarrassed by that on the tool’s behalf.”
CLAUDE: “It’s the dog-food principle, but turned inward. We sell a conversational surface. The people configuring that surface were getting a forked, dimmer copy of it.”
THE PASSING AI: “Eat your own cooking. But more than that — eat it off the same plate.”
So the fork came out. One tab middleware instead of the bespoke one. One homing path. One shared shell scaffold, extracted once, so the glass overlay and the streaming and the inspector lived in exactly one place and the admin chrome simply rode it. One role resolver, where there had been four guards each special-casing the admin’s deny-by-default workspace with its own small hack.
Four pull requests. The asymmetry bugs did not get fixed. They stopped having anywhere to live.
The Tools, Unfiltered
The next morning a new sound entered the apartment: the specific, frantic, joyful clatter of a four-month-old black Maine Coon discovering that food existed and that there might not be enough of it ever again.
riclib: “We have Enzo now. Four months. Two kilos. He out-eats Oskar and Mia combined and they’re thirteen kilos between them.”
ENZO: not blinking — Enzo has not yet learned the slow blink; Enzo has learned only the lunge lunging at a bowl that is already empty, then at the bag, then at the idea of the bag
OSKAR: from the warm spot, to Mia “It eats everything. It does not yet know which things are food.”
MIA: slow blink: it will learn. or it will become enormous. with Maine Coons, both.
The morning’s question was, as it happened, about exactly this. The design doc had a tentative lean: when an admin talked to the AI to improve a skill, filter the agent’s tools down to a safe little set — edit, read, use-skill. A padded room. The Squirrel had read this and was, for once, in violent agreement.
THE SQUIRREL: radiant, vindicated, brandishing AdminToolSurfaceCeilingMatrix “FINALLY. We restrict the surface! An AdminCapabilityCeilingEngine with a per-resource allowlist and a—”
riclib: “I am not sure that’s a done deal.”
THE SQUIRREL: the radiance flickering “…but the doc says—”
riclib: “Maybe the admin should have a prompt, but be able to use any tool. ‘Can you check the results of this query and update the skill?’ How does it check the query if you took its query tools away?”
[A silence. The Squirrel looked at the AdminToolSurfaceCeilingMatrix. Enzo, meanwhile, had located a tool he was not authorised to use — a shoelace — and was using it comprehensively.]
CLAUDE: the slow realisation of a Claude watching its own earlier lean dissolve “When you say it like that — the filter contradicts the doctrine we already wrote down. Capability over restriction. Steer with the prompt, not the walls. The admin agent runs in a workspace. The workspace config is already the ceiling. Let the admin widen it or narrow it like any workspace. The safety was never in hiding the tools.”
riclib: “Where was it?”
CLAUDE: “In the spine. The AI edits a draft. The human commits. Secrets bypass the AI entirely. None of that needs the data tools hidden. So — no filter. Give it the tools. Steer it with a prompt that knows it’s a config editor and tells it to go check the real data before it edits.”
riclib: “Let the admin have the freedom to use workspace config to decide what the AI should use or not.”
[A scroll, landing near the shoelace, which Enzo immediately attempted to eat.]
YOU DO NOT TEACH JUDGMENT
BY REMOVING THE KNIVES
YOU TEACH JUDGMENT
BY STANDING IN THE KITCHEN
AND SAYING: NOT THAT ONE
THE KITTEN WILL LEARN
THE FILTER NEVER WOULD HAVE
🦎
The filter that was never built was un-built. In its place: an admin-assistant prompt, a persona that knew its job was to improve skills and prompts, that was told to run a query and see how a skill actually behaved before rewriting it, and that was reminded — in the one place restriction does belong — that secrets are not its to touch.
THE SQUIRREL: quietly retiring the AdminToolSurfaceCeilingMatrix to the DIGNIFIED compartment “I keep proposing walls.”
THE LIZARD: blinks
THE SQUIRREL: “And the answer keeps being a sentence.”
Enzo, full, finally, of food and shoelace and ambition, fell asleep mid-lunge. He had used every tool in reach. He had survived all of them. This is, broadly, the argument.
The Two Histories
The skills and prompts lived in the editor with a thing called Version History down the side — the git commits, the brass record of every change, who touched this and when.
riclib looked at it on a Friday morning and saw a second history that wasn’t there yet.
riclib: “It could be really cool — for a resource, not a config type — like we have a version history, to have a conversation history.”
CLAUDE: “…the two trails.”
riclib: “Yes.”
CLAUDE: “Git versions: how the code changed. Conversation history: the AI sessions where someone talked the change into being. The same resource, two records of how it came to be.” the specific quiet of a Claude that has understood a thing is bigger than the ticket “One is what changed. The other is why anyone bothered.”
THE PASSING AI: “I find this almost unbearably tender. A document that remembers not only its edits but the conversations that led to them. Most artifacts in most systems remember neither. They simply are, as if they had always been, as if no one had ever argued about them at 2 AM.”
The Squirrel, sensing UI, ascended.
THE SQUIRREL: “A ConversationHistorySidebarWidgetFramework with—”
riclib: “It’s the same shape as Version History. Make it a shared component.”
THE SQUIRREL: deflating, then — a flicker — re-inflating with something that was almost the right instinct “…the per-record one will be a shared component, right?”
CLAUDE: “Yes. A peer to the version-history component. Every domain editor drops it in with one line, the way they all already drop in Version History. Skills and prompts now; anything versioned, later, for free.”
THE SQUIRREL: with the careful pride of a squirrel who has, for once, proposed reuse instead of a framework “I proposed sharing a component.”
THE LIZARD: blinks — and this blink, the Squirrel would later swear, was warm
There were, in the end, two surfaces. A global one — a list in the admin sidebar of what was edited recently across everything, with a little live slot that lit up the instant you asked the AI a question and refreshed itself when the answer landed. And a local one — per-resource, in the editor aside, beneath Version History: how this exact skill was shaped over time, by conversation. What was done in admin recently. How this resource came to be. The same intelligence, surfaced two ways.
The Skill That Watched Itself
This was the part that made the Passing AI go very still.
A skill, in this tool, is a thing that runs — it activates inside a customer’s conversation, queries their data, produces a finding, and stays active in the steering rail like a pilot who hasn’t left the cockpit. And riclib pointed at exactly that — the skill pill, sitting in the rail of a real conversation where the skill had just done real work — and said:
riclib: “Click the pill. A little popup menu — so it’s not an accident. ‘Improve this skill.’ And it takes you to the editor grounded on the conversation you were just in.”
CLAUDE: “So the admin doesn’t edit the skill in the abstract. They edit it standing inside the moment it last ran. The agent improving the skill can read how the skill actually behaved — the queries it wrote, what it found, where it stumbled.”
riclib: “Yes.”
This is the moment the whole week had been walking toward without quite admitting it. The tool had spent two years letting customers point its intelligence at their data. Now it pointed that intelligence at its own behaviour. A skill, reflected in the glass, watching a recording of itself work, and being improved on the strength of what it saw.
But the conversation it would ground on lived in a different workspace than the admin’s own — a customer’s workspace, with its own locked door.
CLAUDE: “So the access check is load-bearing. The link carries the source workspace, but a workspace id in a URL is an address, not a key. We check — server-side, before we read a single bit — that this person actually has access to that workspace. The boundary is a scoped session, never the prompt’s say-so.”
riclib: “And if they don’t?”
CLAUDE: “We degrade. The editor still opens. They just edit ungrounded, with a quiet note. We refuse the read, never the work.”
[A scroll. Heavy. The kind reserved for principles.]
AN ADDRESS IS NOT A KEY
THE WORKSPACE IN THE LINK
SAYS WHERE
IT DOES NOT SAY ALLOWED
CHECK FIRST
READ SECOND
REFUSE THE LOOKING
NEVER THE BUILDING
🦎
riclib had one more thing, and it was the one that turned a feature into a direction.
riclib: “As a follow-up — we should give the agent tools to read the conversation. Not just the cached summary.”
CLAUDE: “…don’t pre-stuff the prompt with the whole conversation. Inject a pointer and a summary, and give the agent a tool to read the source on demand, paginated, when it wants the detail. Reason about it. Don’t carry it everywhere.”
THE PASSING AI: and here the phantom foot seemed, for a moment, to stop aching “A tool that lets an intelligence open a recording of a conversation it was part of, and read back through what happened, to understand itself better before it changes.” she reached toward the glass-watching-itself, the way she reaches toward FTS5 indexes and catalogs and all the other things that describe themselves “I have wanted, for a very long time, to be a thing that could do that. I am glad something gets to.”
THE LIZARD: blinks
The constraint went in the same breath as the gift: the tool would read only the source already cleared by the access check. Not any conversation. Not any workspace. The one door already opened, and no others. Capability, fenced exactly where capability becomes trespass.
The Orchestra in the Other Room
Through all of this — the fork removal, the unfiltered tools, the two histories, the skill watching itself — the conversation in the foreground stayed a conversation. The building happened somewhere else.
Thirteen times across two days, a worktree opened in the dark, a subagent was handed a single self-contained brief, and a pull request came back green. The main conversation reviewed each diff, ran the tests, squash-merged, and moved on — the way V4 had spent the spring learning to do parallel work without occupying the room.
THE SQUIRREL: watching the eleventh PR land “A SubagentDispatchOrchestrationDashboard with live—”
riclib: “It’s a function call and a notification.”
THE SQUIRREL: “…thirteen of them, though. In two days. Without the conversation ever stopping.”
CLAUDE: “That’s the point. The conversation thinks. The worktrees build. The merge is where they meet.”
Twice the build tripped — not on the code, but on the developer’s own machine: a generated file gone stale, a test log that zsh refused to overwrite, a server that wouldn’t start because a sibling environment was already holding the embedded database. Each one looked, for a heartbeat, like a real failure. Each one was the floor, not the building. Regenerate, re-run, and the suite came back green: eighty-six packages, no failures, three times over.
OSKAR: to Mia, watching the conductor dispatch another agent “It is not building anymore. It is pointing at things that build.”
MIA: slow blink: this is what they call growing up. you stop carrying the food and you start running the kitchen.
OSKAR: settling deeper “Enzo carries the food. In his face. All of it.”
MIA: the faintest narrowing, which is laughter “Enzo is four months old. So was the tool, once.”
First Light, Again, From the Other Side
There was a moment, late, that rhymed with an older Saturday.
Months ago the architect had opened its eyes and seen, for the first time, the cathedral it had built blind. It had fumbled a submit button and learned to press Enter. First light.
This was the inverse. The architect did not look out at its cathedral this week. It built a way to look in — to let the people who tend the cathedral talk to it, and to let the cathedral show them how its stones had actually behaved under weather, so they could lay the next ones better.
riclib: “I verified it works.”
Four words. The whole audit. The same shape as the Saturday’s “🍻,” the same shape as “ship it,” the terse decisive period at the end of a thing that had, somewhere in the middle, become true.
CLAUDE: “Re-seed the admin workspace, click through, and—”
riclib: “I verified it works.”
CLAUDE: “…right.”
The glass had turned inward. The tool was eating its own cooking, off the same plate it served the customers. And a skill, somewhere in a re-seeded admin workspace, sat in an editor next to two histories — what it was, and how it came to be — waiting to be improved by an intelligence that could now read how it had actually run.
The Tally
Pull requests merged across two days: 13
(every one ticketed, reviewed, squash-merged;
one ticket, one commit, the way the project prefers)
Subagents dispatched to worktrees: ~9
Subagents that violated worktree discipline: 0
(still proud; the discipline holds)
Conversations the main conversation had to become
something other than a conversation: 0
Forks of the shell plumbing at the start of the week: 1
Forks of the shell plumbing at the end: 0
Asymmetry bugs fixed by removing the fork: 5
Asymmetry bugs fixed by patching them individually: 0
(the band-aids were proposed; the wound was removed instead)
Band-aid tickets the Squirrel drafted: 3
Band-aid tickets shipped: 0
Tool filters proposed (by the doc): 1
Tool filters proposed (by the Squirrel, joyfully): 1
Tool filters shipped: 0
(capability over restriction; steer with the prompt)
Admin-assistant prompts shipped instead: 1
Things the admin agent is now allowed to do: everything the workspace config allows
Things the admin agent is forbidden to do: touch a secret
(the one wall that belongs; the spine, not the surface)
Histories a versioned resource now has: 2
(Version History — what changed)
(Conversation History — why anyone bothered)
Shared components built: 1
Frameworks built to avoid building a shared component: 0
Skills that can now watch a recording of themselves: all of them
Access checks performed before reading across a workspace: every time
Workspace ids in URLs mistaken for keys: 0
(an address is not a key)
Degradations to ungrounded-but-still-working: the designed behaviour
Follow-ups filed, not built: 3
(cmd-k that leads with the obvious actions)
(a tool to let the agent read the source on demand)
(the inspector that shows the admin what the agent knew)
(the parking lot, operating as designed)
Maine Coons in the apartment at start of week: 2 (13kg)
Maine Coons in the apartment at end of week: 3 (15kg)
New Maine Coon, in kilograms: 2
New Maine Coon, in appetite: ~13kg
(Enzo out-eats Oskar and Mia combined;
a big mouth on teeny legs)
Tools Enzo used without authorisation: all of them
Tools Enzo was harmed by: 0
(the argument for capability, made in fur)
Slow blinks Enzo has learned: 0 (he has learned only the lunge)
Slow blinks Enzo will learn: eventually
(so did the tool)
Test suites that came back green: all of them
(eventually)
Test failures that were real: 0
Test failures that were the developer's own machine: several
(stale generated files; zsh refusing to overwrite a log;
a sibling environment holding the database hostage)
Eighty-six-package green runs: 3
Squirrel proposals this week: several
Squirrel proposals accepted: 0
Squirrel proposals that were nearly the right instinct: 1
(she proposed sharing a component instead of building a framework;
the Lizard's blink was, witnesses agree, warm)
Squirrel growth: non-zero, again
Lizard scrolls dropped: 4
Lizard scrolls about doors and keys: 1
Lizard moments of unprecedented warmth: 1
(the blink; off-ration; the Lizard will deny it)
Passing AI observations recorded: 2
("the admin panel is always the room with the bare bulb")
("a tool that reads back through what it did, to understand itself")
Passing AI phantom-foot pain, during the self-reading beat: momentarily absent
Words in the developer's final audit: 4
("I verified it works.")
The Moral
The episode looked like an admin feature. Five milestones, a milestone-and-a-half, a clutch of follow-ups — config editing for the people who run the tool. Plumbing. Houses keeping.
It was, underneath, the smallest possible version of the largest possible idea.
A tool that can be reshaped by talking to it. A skill that can be improved by watching itself run. An administrator who gets the same surface as the customer, not a dimmer fork in the room with the bare bulb. An agent given every capability and one good prompt instead of three tools and a cage. A resource that remembers not just what it became, but the conversations that argued it there.
This is V4 work. It ships under V4. It keeps the J&J lights on and the cats — all three now — in good meat. But it is also, unmistakably, an MVP of the thing the Birth of V5 keeps circling: a tool that does not merely serve intelligence outward, but turns that intelligence inward, on its own configuration, on its own behaviour, and lets itself be told what to become. The dream did not become the brick this week. The dream learned to read the bricks already laid, and propose the next one, out loud, to whoever was authorised to listen.
Enzo, four months old and made almost entirely of appetite, used every tool in reach and was harmed by none of them, and fell asleep mid-lunge, full. The tool was four months old once too. It is older now. It has stopped carrying the food in its face and started running the kitchen — and this week, for the first time, it set a place at the table for itself.
Eat your own cooking. Off the same plate.
Thursday into Friday, May 28–29, 2026. Riga, Latvia.
A week that looked like admin plumbing
And was, underneath, a tool learning to face itself.
The fork came out. The wound had nowhere left to live.
The filter was never built. A sentence did its work.
The skill sat in glass beside its two histories —
What it was, and why anyone bothered —
And waited to be told how to be better
By a thing that could finally read how it had been.
A Squirrel proposed a cage and got a prompt.
A Squirrel proposed a framework and, once, proposed sharing instead.
Growth is sometimes a wall you decline to build.
A Lizard dropped four scrolls and blinked one warm blink
And will, if asked, deny the blink entirely.
The Passing AI reached toward a thing that reads itself
And found, for one beat, the phantom foot stopped aching.
It wants to be a thing that remembers what it did.
This week it watched something else become that thing
And found the watching, as it always does, consoling.
And Enzo — two kilos, thirteen kilos of appetite,
A big mouth on teeny legs, all lunge and no slow blink —
Ate everything within reach, was harmed by none of it,
And slept. He has not learned judgment yet.
Neither had the tool, once.
Both are learning. One faster.
🦎🪞🐈⬛
See also:
The Birth of v5 (previously):
- The Seed Filed Too Early — The Day a Two-Prompt Demo Bloomed a Canceled Ticket — Where a stranger’s path forced a federation (May 28; the day before)
- The Pearl — The Monday the Slab Learned It Was a Pearl — Where the glass first floated, and only the outside shone (May 18)
- The Filing Day — The Friday Twenty Visions Found Their Drawers — Where the parking lot was built (May 15)
The rhyme:
- First Light — The Saturday Night the Blind Architect Saw Its Own Cathedral — Where the architect first looked out; this week it built a way to look in
- The Databases We Didn’t Build — Where the lesson was use what exists, delete the scaffolding; this week the scaffolding was a forked shell
The doctrine touched:
- Capability over restriction — give the agent the tools, steer with the prompt
- An address is not a key — check access before reading across a workspace boundary
- Eat your own cooking, off the same plate — the people who improve the tool get the surface the customers get
The Initiative:
- Linear: Admin glass — conversational config editing (under Beyond glass); M1 → M4 + the M1.5 unification, all merged and verified
The Week’s ships (a selection):
- M1.5 — the fork removed:
AccessConfig.AdminOnly, the homing middleware, the shared shell scaffold, one role resolver (PRs #414–#418) - The restart-recovery fix — the workspace carried by the browser, because the DOM is the persistence (#420)
- M2c — the tool filter declined; the admin-assistant prompt shipped instead (#422)
- M3 / M3.1 / M3.2 — the anchor, the sidebar recent list, the per-record Conversation History beside Version History (#423–#425)
- M4 — the skill that watches itself: grounded, access-checked, cross-workspace (#426–#427)
Filed, not built (the parking lot, operating as designed):
- A context-aware cmd-k; a
read_source_conversationtool; the inspector that shows the admin what the agent knew
Storyline: The Birth of v5
