What we publish, and why

The lab publishes three kinds of things: software, prose, and the occasional research artifact.

The bias is toward open. Not as a marketing posture, but because — for the kind of infrastructure work we do — the alternative is illegible. An on-prem AI gateway that ships only as a tarball is harder to evaluate, harder to audit, and harder to trust than one whose source you can read. The same is true of a static analysis rule set, a desktop agent, a search index pipeline. If our customers are going to run our code in their environment, on their data, under their compliance regime, they should be able to read what they are running.

That bias has limits. A few categories stay private:

• Security-sensitive material that benefits attackers more than defenders — concrete exploit chains we discover, customer-specific firewall rules, the contents of detection rule databases for products that we sell to defenders.
• Material that is not ours to publish — code or data developed under a customer engagement and contractually owned by them.
• Premature work — half-finished experiments where releasing the current state would mislead more than inform.

We try to be clear-eyed about which of those is genuinely operative. "This is too early" is a comfortable place to hide work that just isn't very good. We push past it when we can.

The writing follows the same logic. Engineering posts are about how we built the things we shipped, in enough specific detail that another engineer could either reproduce the work or argue with it. Position pieces — like the one on sovereign-by-default — exist to make our terms precise, so that the rest of the writing has somewhere to stand. Research items are reserved for work that has a methodology and a result, not just an opinion.

We post in a single institutional voice. Posts are not bylined. This is not a denial of authorship — most posts have a small set of writers and reviewers — but a deliberate choice. Credibility, if it accrues, accrues to the lab. So does the responsibility when we get something wrong.