Tooling on t0ul

Walk away, read it over coffee

Mon, 19 Oct 2026 00:00:00 +0000

Part of my EVA series, where I build the cockpit I pilot GORED runs from. This is the last one, and it is the mode the whole cockpit was pointed at: the overnight blind campaign. Code in t0ul/GORED; write-ups in t0ul/ai-security-engineering.

Intro

Here is the honest advantage of a tester that runs on my own laptop. It is not that it is smarter than a cloud model, because my GORED series is clear that it is not. It is that it costs nothing per hour and never gets bored. A frontier model billed by the token is a thing you ration. A small model running locally is a thing you can leave on all night, pointed at a problem, for the price of some electricity.

A factory I wouldn't fake

Mon, 05 Oct 2026 00:00:00 +0000

Part of my EVA series, where I build the cockpit I pilot GORED runs from. Last time I gave runs a durable home so they survive a restart. This post is about the one surface I refused to fake, and what it took to make it real. Code in t0ul/GORED; write-ups in t0ul/ai-security-engineering.

Intro

Every cockpit wants a factory behind it, and EVA’s is Studio: the place the skills a run is built from are meant to be authored, tried, and saved. I built it, and then for a while I would not let you save. You could list every skill, read it, pick it, and the edit button was not there, on purpose. That restraint is the first half of this post, because it is the same standard I hold every number in this project to. The second half is the payoff, because the piece that was missing has since landed, and the editor is real now in the one way that matters: a skill you change actually changes the next run.

A sortie log that survives a restart

Mon, 21 Sep 2026 00:00:00 +0000

Part of my EVA series, where I build the cockpit I pilot GORED runs from. Last time I streamed a live run to the browser by tailing its trace. This post is what happens when those runs pile up and I want them to survive a restart. Code in t0ul/GORED; write-ups in t0ul/ai-security-engineering.

Intro

Once I could watch a run, I started doing a lot of them. Different models, different prompts, the same target, trying to build a feel for what moved the needle. And every one of them left a trace file in a directory, which was fine, but the cockpit’s sense of what runs existed lived in memory. So the first time I restarted the server to ship a change, my whole afternoon of sorties vanished from the list. The traces were still on disk, but EVA had forgotten they happened.

Watching it think

Mon, 07 Sep 2026 00:00:00 +0000

Part of my EVA series, where I build the cockpit I pilot GORED runs from. The last post was the seam that lets a piloted run and a headless CI run be one loop. This one turns the dial down and actually watches a run go. Code in t0ul/GORED; write-ups in t0ul/ai-security-engineering.

Intro

My first run page was embarrassing. It used a meta refresh, the old trick where the page reloads itself every couple of seconds, and watching a run through it felt like watching a kettle by blinking. You would catch the state at two-second strobes, the page would jump to the top on every reload, and a fast run would be half over before the first refresh landed. It worked, in the sense that the numbers were eventually right, but it was no way to watch a model think.

LLM proposes, human disposes, on a dial

Mon, 24 Aug 2026 00:00:00 +0000

Part of my EVA series, where I build the cockpit I pilot GORED runs from. Last time I made the case that EVA is a thin window over the one engine my command line and CI already run. This post is about the seam that lets a human-piloted run and an autonomous CI run be that one engine. Code lives in t0ul/GORED; write-ups in t0ul/ai-security-engineering.

A cockpit for the red-team runs

Mon, 10 Aug 2026 00:00:00 +0000

Part of my EVA series, where I build the cockpit I pilot GORED runs from. GORED is the harness that points small local language models at my own web apps and measures, honestly, whether they can break them; EVA is the web surface I drive it from. The harness and the cockpit both live in t0ul/GORED, and these write-ups live in t0ul/ai-security-engineering. Every run EVA shows you is a kept, hash-verified trace.