From AI art to a real system.

01 · THE CLAIMA dashboard is only real if something behind it is tested.

Our homepage looks like a command center. It has dials for cloud watch, red teaming, evals, agent identity and more. Today most of it is AI art: the design is real, the systems behind the dials are not built yet. Phase 2 changes that. We build each dial for real, in public, one slice at a time, and every slice ships with its tests, its numbers and what broke.

Art shows the plan. A passing test shows the system.

02 · WHERE WE'VE BEENPhase 1: learning in public.

In mid-September 2026 we started from zero: no tech experience. We took a six-week applied AI course and began building a private lab alongside it. When the course handed off, on 28 October, we started publishing: by 2 November there were nine write-ups and videos on AI agents, starting with "Better score. Worse behavior." and ending with "Run agents like a service". Each one followed the same method: read a good source, write the rule, run a small check in the terminal, keep the real output, and say what it does not prove.

That method stays. What changes is the target: the checks stop being one-off demos and become parts of one real system.

03 · THE PLAN12 dials. The 8 core builds come first.

The homepage has 12 dials to make real (the podcast is separate). First comes the command center: one screen that tracks all 12 dials, every test and every checklist. Then the 8 core dials along the bottom, because they watch, test and limit agents. The 4 product dials at the top come after, because they are built from what the core dials teach us. The agents themselves come last: first the dials that watch them.

04 · THE FIRST TESTA helper agent can't get more access than its parent.

One piece already runs, early, as a test for the identity dial. When an agent hands work to a helper (a sub-agent), the helper's access should only shrink: same or fewer permissions, same target, shorter life. This follows where the standards are today: agent IDs shaped like SPIFFE IDs, and hand-offs modeled on OAuth token exchange (RFC 8693). This is the hand-off check, copied from agent_identity.py:

def delegate(self, parent_token, child_aid, scopes, aud, ttl=120, now=None):
    """Token exchange (RFC 8693 style): a sub-agent token can only narrow scope, audience and lifetime."""
    p = self._check(parent_token, now)
    if p["depth"] + 1 > MAX_DEPTH: raise DenyError("delegation too deep")
    if not set(scopes) <= set(p["scope"]): raise DenyError("sub-agent cannot get more scope than parent")
    if aud != p["aud"]: raise DenyError("sub-agent cannot change audience")

$ python3 -m unittest -v test_agent_identity
test_delegation_cannot_change_audience (test_agent_identity.T) ... ok
test_delegation_cannot_widen (test_agent_identity.T) ... ok
test_delegation_depth_limit (test_agent_identity.T) ... ok
test_delegation_narrows (test_agent_identity.T) ... ok
test_expired_denied (test_agent_identity.T) ... ok
test_id_is_spiffe_shaped (test_agent_identity.T) ... ok
test_missing_scope_denied (test_agent_identity.T) ... ok
test_pausing_parent_kills_child_token (test_agent_identity.T) ... ok
test_revoke (test_agent_identity.T) ... ok
test_scope_not_registered_denied (test_agent_identity.T) ... ok
test_tampered_denied (test_agent_identity.T) ... ok
test_ttl_capped (test_agent_identity.T) ... ok
test_verify_ok (test_agent_identity.T) ... ok
test_wrong_audience_denied (test_agent_identity.T) ... ok

----------------------------------------------------------------------
Ran 14 tests in 0.001s

OK

Fourteen tests, all passing. The one we care about most is test_delegation_cannot_widen: a helper that asks for more than its parent has gets refused. Pausing a parent also kills its helpers' tokens, so one switch stops the whole chain.

05 · WHY WE'RE DOING ITOur shot at a tech career.

We're transitioning into tech. No guarantees, just the work. We don't claim these job titles. We're taking skills from six roles that teams hire for, and each slice practices some of them:

Under all six sit two foundations we're still building ourselves: Python and statistics. We study both alongside every slice. Our tools: Linux, Kali Linux in an isolated lab for red-team practice on our own systems only, Docker, and local open models such as Llama and Qwen. Kubernetes is a maybe, only if we need it. Each slice article names the exact tools, their licenses and what we configured ourselves.

06 · WHAT THIS DOES NOT PROVEHonest limits.

• A plan is not a system. Only the identity test above runs today. Every other dial is planned.
• The identity check is a small local demo. Made-up agents, shared-key signing, no network. Real use needs proper keys and an identity service.
• We have never worked inside an enterprise environment. How these pieces hold up at that scale is the part we are least sure about.

07 · WHAT WE'RE LOOKING FORMentors, apprenticeships, honest feedback.

• Mentors who have run AI or infrastructure in enterprise environments.
• Apprenticeships, internships and trainee roles. We're here for the experience: real work, real standards, real feedback. Put us on something small and let the work speak.
• Corrections. If something in the build log is wrong, tell us.

08 · TAKEAWAYBuild the watchers before the agents.

Start with one screen that shows the truth, then what watches, tests and limits agents, then the agents. Show every step with a test that passes or fails. Feel free to challenge our order: would you build the command center first, or the evals?

TRY IT YOURSELFTwo checks for your own dashboard.

1. Pick one number on your dashboard. Can you name the test or the log line that proves it?
2. Give a helper agent a task. Does its access shrink, or does it inherit everything its parent has?

THE BLACKBOARDThe whole plan on one board.

The same board sits in the Blackboards section of the ssss.company blog. We update it every slice as dials move from planned to building to done.