Mike Stoop

Building AI systems and agents for businesses.
My use cases, wins and losses. All free.

[Mike Stoop @ScaleWithMike]

the checklist

1. cooldown (ignore versions newer than X)
uv, in pyproject.toml:
[tool.uv]
exclude-newer = "3 days"
pip 26.1+: pip install --uploaded-prior-to P3D -r requirements.txt

2. hash pinned installs
uv lock writes hashes, install with uv sync --locked
pip: uv pip compile https://t.co/vaTD3rT5uz --generate-hashes -o requirements.txt
then pip install --require-hashes -r requirements.txt

3. docker by digest, never latest
docker buildx imagetools inspect https://t.co/nteF7mEhCy
put the sha256 it prints after an @ on the image tag

4. why .pth matters: a .pth file in site-packages runs on every python start, even if you never import the package. look without starting python:
find ~ /usr/local /opt -name '*.pth' -path '*site-packages*' 2>/dev/null
some normal ones exist (setuptools has one), look for names you don't recognise

5. trusted publishing ties uploads to one repo and workflow. litellm had no pypi provenance on 1.106.2, so there was nothing to compare against

source: https://t.co/PkWwRsZg2F

[Mike Stoop @ScaleWithMike]

one thing from the litellm mess i keep thinking about

the git tag was clean. if you read the code on github before upgrading you saw nothing. one line got added to the build config right before the wheels were made, so only the package on pypi had the stealer

checking the repo doesn't protect you. so i looked at the upload times instead. the clean 1.106.2 went up at 10:44 utc, the bad 1.107.0 at 11:39, and pypi had pulled it by early afternoon

a one day cooldown on new versions and you never would have installed it

uv and pip both have this built in now, it's one line. add hash pinned lockfiles so an agent running pip install can't quietly pull something new, and docker images pinned by digest instead of latest

if your agents touch python projects, add the cooldown today. 1 day would have been enough here, 3 is safer. checklist in the reply

[Mike Stoop @ScaleWithMike]

@shadownet1337 yep that's the one. it only blocks once per stop so it can't loop forever. the mtime check felt almost too dumb when i wrote it but honestly it hasn't missed yet

[Mike Stoop @ScaleWithMike]

the most useful thing in my whole AI setup is one python script (the hook) that runs when claude or codex tries to end a session

it checks one thing: did any file in this project change after its STATUS.md was last updated? if yes, the AI gets blocked once with "update STATUS.md first". it writes what's done, what's next and what's stuck, then it can stop

both tools use the same hook format, so one script covers claude code (~/.claude/settings.json) and codex (~/.codex/hooks.json)

two things i learned the hard way: it only asks once and then has a 20 min cooldown per session, otherwise you get an AI arguing with your hook in a loop. and it fails open, any error and it just lets the session end

result: i can close claude halfway through a task, open codex and say "continue", and it actually knows where we were

reply HOOK and i'll send you the script

[Mike Stoop @ScaleWithMike]

@zkevinbai @claudeai congrats on the launch. any idea if it opens up outside the us soon? would love to try it from the netherlands

[Mike Stoop @ScaleWithMike]

@OpenAI ran node -v this morning after the php and node news and i was behind on node, didn't even think about it. nice that these checks come as skills now, way more likely people actually run them

[Mike Stoop @ScaleWithMike]

@RohanBhanotAI @cgtwts this is the number i'd want too. cost per finished task, not per task started. a cheap model that needs three tries isn't that cheap anymore

[Mike Stoop @ScaleWithMike]

@iambchoor @petergyang nice that you got in. does it actually come to you with stuff you didn't ask for, or is it mostly waiting until you ping it?

[Mike Stoop @ScaleWithMike]

@JohnNitschke @petergyang @bot same in the netherlands. us only waitlist again. curious if this one reaches europe faster than the others did

[Mike Stoop @ScaleWithMike]

@shuba_dev @petergyang you can get close already. my X dashboard is a claude artifact with its own small database, and a scheduled claude task fills it a few times a day. the artifact itself doesn't fetch anything though

[Mike Stoop @ScaleWithMike]

@HaStrive @petergyang same question here. my own morning routines only surface stuff because i told them exactly what to look for. real proactive is a lot harder

[Mike Stoop @ScaleWithMike]

@petergyang watching this from the netherlands with no way onto the waitlist yet. the checks with you before it acts part is what i'd test first, that's where my own scheduled agents need the most babysitting

[Mike Stoop @ScaleWithMike]

@dusangran @RoundtableSpace 200 chars is a good cap. mine have to end with what's done, what's open and the next step. anything longer i skip too

[Mike Stoop @ScaleWithMike]

@mohithkumar808 @RoundtableSpace same, after litellm that's the part i'd look at first too. hooks and mcp configs run with a lot of access and nobody reads them twice

[Mike Stoop @ScaleWithMike]

@AliRamadan @RoundtableSpace agree. a failing test first is also the only proof the fix fixed the actual thing and not something next to it

[Mike Stoop @ScaleWithMike]

@He_Xai @RoundtableSpace same here. i split it, one agent builds and a different one only reviews against a fixed checklist. that stopped the new finding every run problem for me

[Mike Stoop @ScaleWithMike]

@RoundtableSpace the don't install everything line is the real advice here. i'd start with the plan first step and one reviewer. with 300 skills the agent spends half its time figuring out which one to use

[Mike Stoop @ScaleWithMike]

@UkrainianVapeM1 the agent that wrote the code always says tests pass, that's what got me too. what helped is a separate agent that only checks, never builds, against a fixed list. it can only say pass or fail

[Mike Stoop @ScaleWithMike]

@saybwala @Ajain112 when it swings inside the day i look at traffic per source per hour. one channel going quiet for a few hours can drag the whole day down

[Mike Stoop @ScaleWithMike]

@masticoon @Ajain112 those one hour order spikes are interesting. do they line up with an email or a campaign going out, or completely random?

[Mike Stoop @ScaleWithMike]

@maringerov @Ajain112 same first check for me. and if orders really dropped i'd look at checkout next, a payment app or theme update breaking something on mobile looks exactly like this