Engineering leader pushing limits with AI agents. I write the Agentic Playbook. Off-hours: @royalslugs, a slug-launching chaos party game, Save the King! 👑🐌
Oxford, England
Joined May 2015
- Tweets397
- Following347
- Followers132
- Likes5.4K
Pinned Tweet
Side project reveal 👑🐌 @royalslugs
Since July I've been building Royal Slugs: a browser party game where you and a mate secretly plan your slugs' launches, lock in, then watch both plans collide at once. Phones become controllers with a QR code.
Built end to end by directing AI agents, using the practices from my #Agentic #Playbook. So it's also my biggest experiment in how far that approach goes.
It's in public alpha today. Expect wobbles, physics chaos and a lot of build-in-public posts from me.
#indiedev #gamedev
Marcin.Wojtala retweeted
After digging through a #steamNextFest full of low-effort releases, I’m looking for games Made With Care.
AI-assisted is fine: AI assets you’ve curated and polished are welcome. Games thrown together in a weekend aren’t.
Drop your link + one line about your game below 👇
#indiegames #indiedev
🧵How I built a multiplayer 3D physics game in the browser by directing AI agents (mainly @OpenAI's Sol and Kimi K3) @royalslugs. Started in July 2026, stats: 155 commits, 22 architecture decision records (ADRs), one very stubborn Chrome vs Firefox desync.
What actually worked:
It's an alpha and it wobbles, but it's real and it's fun. Come and outsmart your friends:
royalslugs.com/?utm_source=x…
Reach out with the feedback please!
The method behind it is in my Agentic Playbook.
5. Engineer the loop, not just the prompt.
The agents run the browser tests the change affects, read the evidence, fix, rerun. I run them too on my machine.
Then I review the code and push every commit myself. My job is designing that loop and catching it when it's confidently wrong.
4. Direction shift
Not everything went according to the plan. I had to rewrite the Multiplayer engine to utilise web sockets; agents' recommendation (even in x high thinking mode) was not producing any tangible results. It's okay to go back to the research, you need to drive the decisions.
3. Small, reviewable steps.
The desync: Soccer rules ran on the render loop, so each browser fitted a different number of physics steps per frame.
The fix wasn't a rewrite. One rule: anything that affects the game runs on the fixed 120 Hz clock.
2. Hard calls become ADRs.
Host vs server authority, fixed-step physics, how phones talk to the screen. The agent reads the relevant ADRs before touching code.
It's my cure for comprehension debt: I can still explain every big decision in this codebase
1. GUARDRAILS: Agents don't get to call it done
The repo has a delivery contract for every agent: finished means checked against the docs, rules under deterministic tests, the browser journey passing, and the docs describing what shipped
It was mostly a note to myself, too.
There should be an award or medal for sticking as close to the actual weekly usage limit for @bot. For anyone that has not tried it, yet, I strongly recommend!
Marcin.Wojtala retweeted
A dev got so frustrated watching his AI agent write 500 lines for a 5-line problem that he built a fix.
He called it Ponytail. Named after the guy every team has - long ponytail, oval glasses, been there longer than the version control. You show him fifty lines; he looks at them, says nothing, and replaces them with one.
Now your agent does the same. Before writing anything, it looks for a reason not to.
80-94% less code. 47-77% cheaper. 3-6x faster.
The best code is the code you never wrote.
GitHub Repo: github.com/DietrichGebert/po…
Marcin.Wojtala retweeted
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
github.com/TanStack/router/i…
Credit to the security researcher for responsible disclosure.
Anyone's else @OpenAI codex, 'out-of-the-blue' requested access to basically everything running on my mac?
