Railway vs Sonar

Introducing Railway Authentication via identity-aware proxy

Railway Authentication implements an identity aware proxy at the service or environment level to lock down sensitive http endpoints

AI Agent Frameworks Have a Critical Engineering Flaw

The author argues that the current enthusiasm for AI "agents" and hot frameworks distracts from the real engineering challenges of production systems. They define a true agent as a system with an objective that decides next actions, handles failure, and knows when it is done. In production, most agent deployments are narrow, purpose-built pipelines (e.g., support triage, document extraction, code review). Teams that succeed focus on tool design, failure handling, and observability rather than swapping models. The author highlights a persistent retrieval problem in RAG pipelines—incorrect chunking and metadata cause context loss and hallucinations—and recommends architectural patterns (plan-then-execute, separate retrieval from reasoning, explicit handoffs) and better data representations over framework chasing.

• Author defines an 'agent' as a system with an objective that decides what to do next, handles failure, and knows when it is done.
• Most production AI agent deployments are narrow and purpose-built (examples: customer support triage, document extraction, code review).
• Successful teams prioritize tool design, failure handling, and observability over only upgrading model versions.

Workplace AI Needs a 'Chief of Staff' Control Plane

The article argues that businesses deploying multiple AI agents face 'agent sprawl'—fragmented context, uncontrolled side effects, and human operator fatigue—and proposes a split architecture: a central control plane (an "AI Chief of Staff") that handles governance, state, routing, human-in-the-loop approvals, and executive synthesis, while domain-specific workers perform execution. The author open-sourced a reference foundation called OpenClaw Control Plane (a TypeScript monorepo) on GitHub and recommends standardizing interfaces using the Model Context Protocol (MCP) and a workflow-neutral runtime, with deployment examples using Railway. The repo is presented as an M1 foundation with future plans for worker specs, MCP tool bridges, and operator dashboards.

• The article frames 'agent sprawl' as a common problem where siloed AI tools operate without centralized governance.
• It proposes a control plane (an "AI Chief of Staff") responsible for intake triage & routing, state & cross-functional memory, human-in-the-loop governance, and executive synthesis.
• The author open-sourced the 'OpenClaw Control Plane' TypeScript monorepo on GitHub: https://github.com/yuens1002/openclaw-control-plane.

Sonar Extends Agentic Code Governance and Verification to Self-Managed Infrastructure

New press release dated September 29, 2026: Sonar Extends Agentic Code Governance and Verification to Self-Managed Infrastructure.

Sonar DNS Field Command Injection Fixed by Developer

A developer discovered a command injection vulnerability in the DNS custom resolver field of Sonar, a macOS network scanning tool. The field, which accepts user input for custom DNS servers like Pi-hole or NextDNS, was passed to a privileged command without proper validation, potentially allowing arbitrary code execution as root. The fix involved allowlisting input to only accept valid IP addresses, passing arguments as an array instead of a shell string, and narrowing the privileged interface. The article also details three other security fixes made during a full pass: moving API tokens from a plist to the Keychain, preventing CSV export formula injection, and implementing atomic writes to avoid data corruption.

• Sonar had a command injection vulnerability in its DNS resolver field.
• The vulnerability could allow running commands as root.
• The fix involves allowlisting IP addresses and using array arguments.