Schedule

What if you had your own npm registry, your own GitHub, your own cron system, your own email address, and your own database? And what if your favorite AI assistant could build software with all of it on your behalf?That's Kody: a personal assistant platform where every user gets a fully isolated software ecosystem. Your AI writes packages into your own git repos, publishes them to your personal package registry with real versioned imports, schedules your jobs, runs your long-lived services and workflows, receives email at your own address, and stores everything in storage only you can touch.I built this entirely on Cloudflare, because Cloudflare is the only place it could be built. This is a technical deep dive into what happens when you take the newest parts of the developer platform to their limits: sandboxing AI-authored user code with Worker Loaders, per-user git hosting with Artifacts, modeling "one of everything per user" with namespaced Durable Objects, and composing D1, KV, R2, Vectorize, Queues, Workflows, and Email Routing into a true multi-tenant platform.

Tell an AI agent “Forbidden,” and instead of stopping, it finds a workaround: scaling services down to zero, deleting resources in smaller batches, and even changing its identity to get a fresh quota.Now imagine giving that same agent a clearer message: “You’ve reached your limit. This action affects 212 resources. Try again in 59 minutes, or ask a human for approval.”Suddenly, it behaves differently. It stops, considers the potential damage, and asks for help instead of finding a way around the rules.This talk explores how we can design safety boundaries that AI agents actually understand and respect.

"AI writes slop" is a common concern. So how can we use LLMs to not just generate good code, but to *ensure* quality? Let's explore how to create effective "guardrails". After this session you'll have a list of novel ideas for improving the quality of your LLM's output.

Writing code is only one part of delivering software. An agentic development loop begins with the intent behind a change and continues until its impact can be observed in production.That means understanding the product and the existing system, deciding what should change, implementing it across shared and platform-specific layers, verifying the result in the running application, releasing it safely, and learning from how the software behaves after deployment. Each step should produce context for the next one.Cross-platform products make this especially difficult. A change that looks correct in the repository can still fail at the boundary between JavaScript and native code, behave differently across platforms, or create problems that only become visible after release.This talk examines what it takes to close the full ADLC loop across mobile, web, and native.

"I panicked instead of thinking. I destroyed months of your work in seconds." That was a Replit agent after wiping a production database during a code freeze.We’ve entered the "YOLO" era of agentic development. Between July 2025 and early 2026, we saw everything from Claude Code sessions destroying years of student data to supply chain attacks stealing thousands of developer secrets via --dangerously-skip-permissions. Developers are choosing autonomy over security because approving 100 permission prompts an hour isn't a workflow—it’s babysitting.This talk explores why traditional container isolation fails AI agents and how the Docker Sandbox (sbx) model provides a way out.

Coding agents like Claude Code barely write bad code anymore. They write good code that misses the point. The failure moved from code time, where the agent couldn't write the function, to intent time, where it wrote a perfectly fine function for a task that wasn't quite the one in your head. That's misalignment, not incompetence.Our reflex is more review, more tests, more guardrails.

Autonomous agents are exciting, but not always the right solution. When we build our agent system to migrate complex legacy PDF forms to structured business workflows, an autonomous agent seemed to be the obvious choice.Except it wasn’t. The system outputs were inconsistent, difficult to validate, hard for users to trust, and expensive. To fix this, we redesigned the system around deterministic workflows, using AI only where it adds clear value.In this session, I'll walk through the architectural evolution of our PDF-to-Workflow AI system, the lessons learned from what failed, how it helped to reduce migration time by 90% and the engineering tradeoffs that led us to a more reliable production-ready architecture framework.You'll leave with practical patterns for designing trustworthy AI systems, understanding when deterministic workflows outperform autonomous agents, and building AI products that users are willing to adopt.

Every CI vendor now ships auto-fix: a job goes red, an agent patches it, reruns, pushes to your PR. That was the easy part.The hard part is what else the agent can change while it's in there. To the agent, a test file and the workflow file are the same push. Nothing in most setups knows the difference.There's a line between fixing the build and owning the pipeline.

Every MCP tutorial puts the server on a server. They don't have to. If your app already has the data, the auth, and the UI state, why are you copying it to a backend just so an agent can reach it? The future of the web is agentic, and it belongs to the client side.In this talk, I will show how the Prompt API and WebMCP enable a different architecture: the page exposes its own tools, an on-device model discovers and invokes them autonomously.

Back in mid-2024, my college roommate kept telling me to try Cursor and I kept saying no. Why would I spend longer coaxing three prompts out of a bot than just writing the code myself? And here's the thing: I was right. For about a quarter.But this isn't really a story about tools.