03 Case study
AFK Dev
AFK Dev is a phone-triggered remote coding pipeline. A message over SSH kicks off an AI agent that implements the change in an isolated git worktree. A second model reviews the diff. Playwright captures screenshots. A pull request opens with a push notification, ready for one-tap merge from GitHub Mobile.
- Client
- Studio infrastructure
- Sector
- Developer tooling / remote agents
- Year
- 2026
- Role
- Designer and builder
- Engagement
- Internal platform
The problem
Ideas do not wait for a desk. The gap between noticing a fix on the move and being able to ship it safely is usually a laptop, a VPN, and an hour you no longer have.
Most remote-agent setups solve this by wiring a chat bot to a shell, which is a security incident with good UX. The interesting problem is the trust boundary, not the trigger.
The approach
The pipeline is deliberately narrow. The only way in is SSH over Tailscale: no public endpoint, no chat-bot execution path, no webhook surface. A least-privilege job user runs each change in an isolated git worktree, so the agent can never touch the main checkout.
Verification is layered. A second model reviews the diff before anything is pushed. Playwright captures screenshots of the running result, served over HTTPS bound to the tailnet. The human sees evidence, not promises, then merges with one tap.
A single-flight job queue keeps the system honest: one change in flight at a time, no pile-ups, no racing agents.
Architecture
A one-way pipeline where every stage narrows what the next one is allowed to do.
- Phone
- SSH over Tailscale
- No public surface
- Least-privilege job user
- Isolated git worktree
- Single-flight queue
- Second-model diff review
- Playwright screenshots
- Tailnet-bound HTTPS previews
- Pull request
- Push notification
- One-tap merge from GitHub Mobile
The hard parts
The trigger is the attack surface
Every convenient trigger (a chat message, a webhook, an email) is also an injection vector. SSH over a private tailnet was the only entry point that survived adversarial review, so it is the only one that exists.
Trusting an agent you cannot watch
The answer is to never require trust. The writing model cannot merge. The reviewing model cannot write. The human sees the diff and the screenshots before anything lands.
Outcome
The studio ships real changes from a phone: implemented, independently reviewed, visually verified, and merged in minutes.
The security posture came from adversarial AI review of the design itself, and it shaped every decision above. AFK Dev is the studio's own dogfood for the agentic systems it builds for clients.