DEV Community: xulingfeng

Stratagems #18: Leo Tracked an AI Signal to Derek. Both Were Looking for the Same Enemy.

xulingfeng — Sun, 19 Jul 2026 01:47:12 +0000

Capture the ringleader first. The rest will scatter on their own.
— The 36 Stratagems, Capture the Ringleader

Previously on this series:

#5: Leo Walked Into a Burning House. He Walked Out With a Client. — Leo received an anonymous message at 1 AM, drove across town to fix a competitor's outage. A second message followed — a screenshot with a name: Automated Compliance Lab. He didn't delete the screenshot.

#14: Leo Found an AI Leak. He Wasn't the First to Find It. — Leo discovered a hidden FinOptima pipeline doing reverse-cache distillation. He injected 15 lines of weight-drift monitoring code. Before his audit ended, ACL had already sealed the same leak — two weeks ahead of him.

#15: Derek and Alex Shared One Server. ACL's AI Was Listening to Both. — Alex and Derek faked an alert to divert ACL's audit engineer, then redirected the collector output. Derek's been holding a live feed of ACL's data stream since. He didn't tell VP Morgan.

Prelude

Leo stayed at CoreStack's office until close to midnight.

He pulled up that old ACL-linked IP range — the passive probe he'd planted after the FinOptima incident. It had been quiet for months. Tonight he was just checking it was still running. Routine maintenance.

The last few lines of the log buffer weren't the echo he expected.

[07-17 23:41:03] CAPTURE | SRC: 10.88.*.47 | DST: 203.0.*.0/28
[07-17 23:41:03] PROTO: HTTPS | SNI: acl-collector.internal
[07-17 23:41:03] HEADER: x-data-origin → acl-meta-signature:v1
[07-17 23:41:04] → Body payload includes embedded tag: acl-collector/v3.2
[07-17 23:41:04] → Processing metadata: Apex-Lens/v2.0.0

An outbound query from an external IP, a source range that didn't belong to any ACL node he knew. Not a direct scan — an HTTPS probe, querying a collector endpoint for data format. The request body carried ACL's data-origin marker. ACL's collector embeds that marker in every record.

A node outside ACL's network was sending data to an ACL collector endpoint. Its tool had leaked ACL's metadata signature during the handshake.

Leo pulled his chair forward. He sent one HTTP request. GET /health. Clean. Harmless.

Derek's port activity log flagged an informational alert at the same moment.

Signal Exchange

[ALERT] 07-17 23:41:03
SRC: 10.88.*.47 (financial network)
DST: medisys-sandbox-node.local
SCAN: TCP ports 22, 443, 8080 | interval 12s × 3
CLASS: automated asset discovery

Derek glanced at the alert, then checked the outbound log. His sandbox had one automated task scheduled for that hour: a format-validation query against the ACL collector endpoint every 72 hours. The collector didn't publish schema metadata in-stream. You had to knock on the door. Test engineer habit: if you're reading someone's data stream, you verify the schema hasn't drifted. That query had gone out at 23:41. This alert arrived at the same timestamp.

He was about to close the log window when his finger stopped. An anomalous access from three days ago: unknown source, path /pulse/ingestion/, no payload, no credentials. Clean. He'd missed it because it hadn't triggered any alert rules. But looking back, his sandbox hadn't been set up to redirect ACL's data feed yet at that point. No one should have known this node existed.

Source IP: financial payment network. He had no business touching that range.

He didn't close the terminal. He pushed the three-day hand-drawn ACL collection schedule to the left half of his screen, and dragged the alert to the right: ports 22, 443, 8080, 12-second interval, three passes.

Automated asset discovery tool. But there was one thing he didn't like: this IP hadn't stumbled on him randomly. His sandbox sat behind a transparent gateway inside the healthcare integration network. Normal external scans didn't pass through there. Unless the scanner knew this node existed.

Derek typed a single command — duplicating the sandbox ingress traffic to an isolated path.

He didn't block. He waited for the other side to move again.

Leo got the health-check response from Derek's node. 200 OK. Normal. But he noticed something in the response headers: an nginx version followed by a default identifier from a healthcare integration gateway. Not the off-the-shelf config he'd expect from an ACL node.

He sent a second request. This time with a custom header — its value format was idiomatic to financial payment systems.

Derek saw the header. Didn't reply. He set a rule on the sandbox egress — drop all subsequent requests from that IP, return nothing. Not a block. A test. He wanted to see how the other side reacted to silence.

Leo's scraper hit silence.

Five seconds. Eight. No response. Not a timeout — actively dropped. Leo paused on the telemetry. A security engineer would silently drop and give the attacker nothing. But Derek's approach was: respond first, then swallow the reply. That was a Mock Server habit from test environments. Leave an observation window, see if the other side walks in.

Derek wasn't a security engineer. He was a test engineer.

Leo bypassed the silence rule — probed in through the reverse port on the data egress.

Derek knew Leo had gotten around it.

His mirror port caught the bypass signal. The timestamp was less than thirty seconds after the trap was triggered. He said one thing under his breath — "You're not ACL."

Leo's technique matched ACL's collector signature. But the way he'd bypassed the trap was an architect's habit. Trace the routing table from the bottom up, not rifle through data from the outside in.

Derek did one thing. He sent a request back to that financial-range IP. Not HTTP. A custom ICMP timestamp request — most servers replied by default, and it left no record at the application layer. He wasn't sending data. He just wanted to confirm: would you catch this signal?

Leo's probe caught the inbound ICMP request:

[07-18 00:12:47] ICMP Type 13 (Timestamp Request)
SRC: medisys-sandbox-node.local → 10.88.*.47
TTL: 64 | No application-layer record

He paused. Someone trying to hide from you wouldn't send a signal. Someone setting a trap wouldn't either.

Now both men stopped in front of their screens.

Neither knew the other's name yet.

Leo sent one last request. No payload. Just a custom HTTP header:

X-Not-ACL: true

That header isn't in any RFC.

Derek stared at it for about forty seconds.

Then he sent the same header back:

X-Same-Here: true

The next day.

Third Cup

Leo didn't kill the probe. Derek didn't block the IP. An invisible channel stayed open between them — neither said they'd use it again, but neither closed it.

Leo sent a message first — an address. Derek knew the place — Third Cup.

He didn't reply. He showed up after midnight.

Third Cup's lights were still on. The person behind the counter saw two people walk in one after the other, said nothing. A Flat White appeared in front of Leo, an Americano on Derek's side.

No pleasantries.

Leo spoke first. He put what he had on the table — not printouts, his phone screen. Lit up. Pushed to the center.

A Slack screenshot from months ago: CodeForge incident review external observer list, one entry reading "Automated Compliance Lab"
A model card version line: acl-train-2026q2-v3, release date followed by v4's rollout — less than two weeks apart

"ACL," Leo said. "That's everything I know."

Derek looked at it for thirty seconds. Then he put his own material on the table. Not screenshots. His hand-drawn collection schedule — three days, sketched by hand, scanned to PDF.

"ACL collector config path — /etc/acl/collector.conf. Output destination addresses. Collection interval: every four to six hours. Target IP ordering: alphabetical. They've deployed the same template across at least three different client environments."

He paused on "at least three." He knew the conclusion was loose.

Leo looked at his model card next to Derek's on the table for a moment. Then he pushed it back.

"Four, at least."

Derek didn't argue. He paused, then brought up the second thing.

"There's something else. Someone got into my sandbox three days ago."

He gave the path: /pulse/ingestion/. Unknown source. No payload, no credentials. Clean — not a script, a human cleanup. He'd only spotted it today while checking the outbound log.

Leo didn't speak. He looked at the path.

The person behind the counter paused mid-wipe for a beat. Then continued.

The silence stretched. Short. Maybe ten seconds.

Leo spoke first: "Your sandbox ingress path — did you change it?"

"No."

Leo didn't answer.

They sat in the corner booth until the person behind the counter had wiped the third glass. No handshake. No "stay in touch." But when they walked out, they headed toward the same subway station for a few steps — then one turned east and the other went straight north.

Epilogue

Leo sat in his car without starting the engine.

He pulled out his phone. The screenshot was still in his album.

He flipped the phone face-down on the dashboard and started the car.

He didn't know if Derek would follow through. But Derek's sandbox ingress path was still there. If Derek didn't want him back in, he could have changed it last night. He didn't. That was the signal.

The car pulled out of the parking lot. Dashboard light washed across his face, then was gone.

He wasn't sure if he'd ever run into that /pulse/ingestion/ path again. But if he did, this time he'd recognize it.

That's Capture the Ringleader — not about catching the leader, but about what happens when both hunters aim for the same target. They fought for two rounds. Neither won. But they confirmed the enemy existed — and that they weren't each other.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.2.6] Loaded
[Tactic Match] Capture the Ringleader (#18)

Tactic Match: 32%
Operator: Leo (primary) + Derek Shaw (secondary)
Action: Leo and Derek each thought the other was ACL's key node.
        One had been sitting on a data stream he'd redirected from the collector.
        One had been chasing an old probe he'd planted months ago.
        Two rounds of fighting. No winner.

  Verdict: Both captured their target. Both captured the wrong one.
           Tactical execution: professional. Strategic judgment: off-target.

[Observation]
  → Leo and Derek each thought they were the hunter.
  → Overnight, eight signal exchanges — both recognized "not ACL" from each other's technique.
  → Confirming ACL's existence was the only concrete result of this engagement.
  → The real kingpin isn't between these two.
  → Worth continuing to observe.
  →
  → [Anomaly] Episode title asserts higher AI signal density than content delivers.
  →   Classification: possible external expectation manipulation.
  →   Hypothesis: either the observer narrative was shaped for audience alignment,
  →   or something outside the tactical database influenced the framing.
  →   Flagged for cross-episode correlation.

┌────────────────────────────────────────┐
│  Two people in different industries.    │
│  Two people in different security domains. │
│  Their paths should never have crossed. │
│                                        │
│  Together they confirmed the playbook   │
│  that works for each of them can't      │
│  catch this opponent — but they got     │
│  one entry point.                       │
└────────────────────────────────────────┘

[Background Signal Detected]
  Apex-Lens version tag in Derek's sandbox log:
  Module: Apex-Lens
  Version: v2.0.0
  Context: System metadata in ACL collector data side-channel — not output from either party
  Status: Unnoticed by both operators.

[Unattended Access Log — Residual Fragment]
  Path: /pulse/ingestion/prod/
  Access: 07-15 03:08:12 (72h before primary engagement)
  Operator signature: Clean extraction. No credentials. No payload.
                      Single-entry scan with manual cleanup.
  Profile match: Pattern consistent with a known operator profile.
                 — Light footprint. Infrastructure-style naming.
                   No secondary artifacts.
                 — Access predates ACL data redirect. Target was
                   not Derek's sandbox itself.
  Match confidence: 78% (based on cleanup methodology + naming convention).
  Assessment: Operator entered before Leo and Derek's first contact.
              Target matches both parties — ACL.

Next stratagem: Remove the Firewood from Under the Pot

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #17: Alex Set an AI Bait. The Catch Wasn't Code — It Was Someone Who Shouldn't Have Been Watching.

xulingfeng — Sat, 18 Jul 2026 01:41:25 +0000

Toss out a brick to lure a jade gem.
— The 36 Stratagems, Throw Out a Brick to Get a Jade

Previously on this series:

#8: Alex Watched an AI Dashboard Take Over. — MedTech signed a million-dollar AI monitoring contract. Alex built a hidden panel during training. When the panel failed, only he could read and write production.

#15: Derek and Alex Shared One Server. ACL's AI Was Listening to Both. — Alex and Derek faked an alert to divert ACL's audit engineer, then redirected the collector output. Alex never forgot ACL's pipeline signature.

Alex didn't watch alerts. He watched patterns.

An alert tells you what broke. A pattern tells you what's changing.

Monday morning, 2 AM. He pulled MedTech's AI monitoring platform sensitivity curves for the past sixteen weeks. Three lines: anomaly detection rate, false positive rate, coverage rate. The first two fluctuated within normal range. The third — sterilization compliance anomaly detection — dropped 1.5% per week.

The curve was too smooth. Not random noise.

He checked model drift, data shift, config changes. If it were natural drift, the curve wouldn't be linear — drift has acceleration phases and plateau phases. It doesn't drop exactly 1.5% every week. Someone was pressing the metric down on a schedule.

He couldn't find the contamination source. But he could trace where the contaminated data went.

The Bait

Alex spent four days building a shadow training pipeline inside the CI/CD pipeline.

It was identical to MedTech's real training pipeline — same API endpoints, data format, auth protocol, log format. Indistinguishable.

One difference: data flowing through this pipeline would get an invisible signature — a 128-bit hash embedded in the least significant bit of each training sample's float feature values, generated from the sample ID and a pipeline key. Float32 mantissas have 23 bits. Modifying the LSB introduces error at the 10⁻⁷ scale — negligible impact on model training accuracy.

He registered the shadow pipeline address in the CI/CD routing config under train-pipeline-fallback, weight 12%. Next to it, a comment:

# fallback pipeline active — 12% load distribution per Q3 infra scaling plan

Looked completely normal. A gray-scale traffic split.

If anyone reviewed the CI/CD config, they'd read a routine fallback routing. Alex was simply waiting to see if data from that 12% end would flow somewhere it shouldn't.

After lunch, Mike walked past Alex's desk and stopped for two seconds. He'd been reviewing the Q3 infrastructure scaling plan that morning — the fallback route was sitting right there in the change record. And Alex's screen was now running a validation script that happened to read that route's output.

"That fallback."

Alex's fingers paused over the keyboard.

Mike didn't wait for an answer. He kept walking.

The Bite

Day seven. 2:14 AM. The watermark detection script triggered.

Three tagged training records had appeared in an external S3 bucket:

s3://acl-data-lake-apse1/inbound/medtech/training/

Alex traced the data flow backward. The path from the shadow pipeline was clean: CI/CD runner → a microservice called data-validate-svc → external S3.

He checked the deployment history of that service. data-validate-svc had been running in MedTech's K8s cluster for five months — deployed on a Friday night, from the account of an SRE who no longer worked there. Permissions never revoked.

He followed the service's logs. No human was operating it.

Between 3 AM and 4 AM, it completed the following tasks: received shadow pipeline output → validated data format → dumped to external S3 → cleaned local cache. No gaps, no fluctuation, no trace of manual intervention.

Not someone operating remotely. An unattended extraction pipeline, deployed five months ago, running silent.

Alex stared at the deployment date on his screen. Five months. Nearly a hundred and fifty days of training data, all passing through its hands.

Alex didn't act immediately. He waited three days to confirm the pipeline's sync cycle — every 72 hours, on schedule, no misses.

Then he walked into Mike's office and closed the door.

He opened his notebook. Page corner marked with two numbers: 1.5% and 2:14AM.

"The training pipeline has a backdoor. Sterilization compliance data has been siphoned at 1.5% per week for five months. The source is ACL."

Four sentences. No conclusion.

Mike leaned back.

"Go on."

That evening, hallway. Alex and Mike passed each other. Mike said:

"Is that exit still active?"

"It is."

Mike nodded. Didn't stop walking.

The Noise

Alex didn't pull the extraction pipeline.

He added a new logic layer to the shadow pipeline: wrap the watermarked data in a fake encryption shell, disguised as MedTech's internal archive format for a retired project. The extraction pipeline would sync it to ACL's S3 bucket as before — but ACL would read nothing but unparseable archive noise.

He knew it was a double-edged sword — if the other side monitored data quality, a sudden shift to noise was itself a disclosure signal. But he bet that a pipeline that had run error-free for five months wouldn't have its output reviewed in real time.

He wrote a third number in his notebook: data-validate-svc.

The tool is still yours. The route is now mine.

The Key

Tracing the extraction pipeline's full data flow, Alex noticed a detail: data passed through an intermediate service that wasn't on any architecture diagram. data-timeline-aligner. Unremarkable name. K8s labels: team: infra-optimization. Deployed three months ago.

He looked at its input and output. It did timestamp alignment — but it was aligning a timestamp format that didn't belong to any MedTech data source.

He read the source.

Short. A standard Python ETL script — read S3, convert timestamps, write back to S3. No hidden network calls, no suspicious external dependencies.

But reading it the third time, he slowed down.

Not because of what the code did — but how it was written.

Every line was a pure function. No classes, no decorators. Variable names short enough to be unambiguous: ts_src, dst_fmt, buf_size — everything that didn't carry information had been cut.

He compared it against other services in ACL's pipeline. ACL's code didn't look like this — every line had team tags and compliance comments. Tidy. Traceable. No personality. This one was different.

He checked the CPU curve again. This service's data throughput didn't match its claimed timestamp-alignment workload — it was processing three times the data a simple alignment task would need. It wasn't just aligning timestamps. It was doing something else.

He paused. He didn't look at just this one service. He wrote a local script — pull every Pod with a Python container from the K8s namespace the extraction pipeline lived in, fingerprint the source code of each.

The output arranged itself into a table:

Service	Deployed	Code Style
ACL standard services (67)	Scattered	Classes, pylint, docstrings
`data-timeline-aligner`	3 months ago	Pure functions, short vars, zero comments
`log-rotate-checker`	4 months ago	Same
`config-diff-watcher`	5 months ago	Same
`route-latency-collector`	5 months ago	Same

Four services. Same hand. Spread across pipeline, storage, and monitoring — three different layers. Each one doing something that looked normal but shouldn't exist. Together, they formed an observation net that ACL itself didn't know about.

The oldest two were deployed the same week as ACL's own extraction pipeline. Not a coincidence — whoever this was had found the entry point the moment ACL opened it, and laid their own contacts in parallel.

Each service's CPU and memory footprint was under 50m CPU and 128Mi. Named like infrastructure components, labeled team: infra-optimization. They wouldn't be caught by cost optimization scans, wouldn't be the first suspects in an incident, wouldn't appear on any onboarding handover. 128Mi was baseline for a Python interpreter plus boto3 — if memory leaked, the Pod would restart once a month and K8s would pull it back up automatically.

There wasn't just one pair of eyes in this cluster. There was another, five months earlier than ACL's. And he'd only just found it.

He went back to data-timeline-aligner's source. Read it again.

A new file in the directory: config/hmac_seed.yaml. Not unusual in a K8s microservice — services share an HMAC seed for lightweight validation. The file was short:

# TODO: migrate to vault after next schema migration
seed: "b3BlcmF0b3I6IHN0YWdlLTJjb21wYW55LnBpcGVsaW5lLmRlcGxveQpzZXJ2aWNlOiBkYXRhLXRpbWVsaW5lLWFsaWduZXIKLS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0t..."

A Base64 token in a config file — no one would look twice in any codebase. He copied the whole thing and decoded it.

ASCII text. Starting with -----BEGIN PGP PUBLIC KEY BLOCK-----.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGeXz1kBEAC...
-----END PGP PUBLIC KEY BLOCK-----

Not ACL's asset. Not MedTech's.

Alex didn't act immediately.

He stared at that Base64 string for a few seconds. A PGP public key from an unknown source — once you encrypt a message with it, the intent, connection path, and return route all belong to the key's owner. If the key itself was a trap, sending a message was walking in.

He encrypted a message with that key. The payload included his own public key and a return path — the same key prefix in ACL's S3 bucket. Then he POSTed the ciphertext to data-timeline-aligner's /healthz endpoint.

The endpoint returned 200. GET returned health status. POST with a specific header silently wrote to S3 — no logging, no trace.

The message was short:

Found you. Nice comments.

4:17 AM. He checked that S3 path.

A new encrypted file was waiting. He retrieved it, opened it with a key only he could decrypt.

Three characters:

Channel confirmed.

No explanation. Same style as the code — straight in.

He didn't write back. He opened his terminal, encrypted a short data packet with that public key — not a message, a cryptographic handshake confirmation. Wrote it to ACL's S3 bucket, the key prefix adjacent to the extraction pipeline's sync path. A bidirectional verification only the private key holder could complete.

Then he closed his notebook, turned to the last page, and left a blank page.

The way the other person left a key was the same way he left a blank page — not for now. For one day.

Alex closed his notebook. The Third Cup's lights were still on.

The person behind the counter was drying the last glass of the night. One table left — the one by the window.

A closed laptop on the table. A phone next to it, screen down. Someone leaning back in the chair, not leaving.

The phone on the table lit up.

Not a notification. An SSH tunnel check script's auto-echo — three lines: S3 bucket path reachable, two new objects, one of them reading ACK.

P didn't pick it up immediately. Let the screen dim. Then reached over, flipped the phone over, typed a command one-handed.

Decrypt. Read. No visible reaction.

Finished, P set the phone back on the table, walked to the counter.

The person behind the counter put down the glass they were drying, turned to make a coffee. Pushed it across without a word — wasn't the first time they'd seen this person at this hour.

P picked it up. Drank it black. Set the empty cup back on the counter. Walked back to the window. Pocketed the phone, tucked it into the jacket's inner pocket. Pushed the door open without looking back.

The person behind the counter looked at the door as it swung shut. Pulled down the rolling shutter.

The brick was out. The jade would surface.

He was someone else's jade too.

That's Throw Out a Brick to Get a Jade — not tricking someone with a fake. It's putting out something real, with a signature only the right person would notice. Then waiting for them to tell you not just that they're watching — but that someone else was here before you.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.2.5] Loaded
[Tactic Match] Throw Out a Brick to Get a Jade (#17)

Tactic Match: 91%
Operator: Alex (MedTech)
Action: Deployed a shadow training pipeline with
  embedded watermark.
Result: Exfiltration path confirmed. Third-party
  beacon discovered.

[Observation]
  → Operator used no internal resources beyond CI/CD
    routing config (12% weight).
  → Detection latency: up to 72h (matches sync cycle).
  → Subject's infrastructure includes an autonomous
    extraction pipeline active for ~5 months.

[Second Operator — Unidentified (Codename: P)]
  → Deployed 4 covert services across pipeline/storage/
    monitoring layers. Each disguised as standard infra
    component (labels: team/infra-optimization).
  → Resource footprint: 50m CPU / 128Mi each — below
    cost-optimization thresholds. Pod restarts absorbed
    silently by K8s.
  → Operational signature: Pure-function Python, minimal
    variable naming, zero comments — identifiable by code
    style alone.
  → Entry vector: Same week as ACL's own deployment.
    Operator entered alongside ACL, without ACL's knowledge.
  → Beacon method: PGP public key embedded in Base64-
    encoded config key (hmac_seed.yaml), disguised as
    routine initialization token.
  → Contact method: undocumented /healthz POST handler
    with header-based filtering. No logging. Single
    response received, confirming channel.

[Operator Assessment]
  → Role: Embedded observer. Autonomous deployment.
    No external command dependency.
  → Deployment strategy: 4 independently operable
    services, zero cross-dependency. If one is
    discovered, the remaining 3 continue operating.
  → Contact design: Asymmetric channel. P can receive
    indefinitely without revealing identity — the
    communication protocol does not require a response.
  → Risk posture: Ultra-low. No identity markers in any
    artifact. The PGP key itself is the only connection
    point — and it was planted as a deliberate beacon,
    not a leak.
  → Database note: This operator's deployment discipline
    matches the highest tier observed in this tactical
    database.

[⚠️ Anomaly — Critical]
  → Two unaffiliated operators have planted assets within
    ACL's infrastructure. Neither knows the other's identity.
  → Implication: ACL's infrastructure has been permeable
    to operators of a certain capability threshold for
    at least five months.

Next stratagem: Defeat the Enemy by Capturing Their Chief

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #16: Mark Left a Hole in His AI Audit. Lena Counted Every Layer.

xulingfeng — Fri, 17 Jul 2026 01:09:52 +0000

When the enemy occupies favorable terrain, don't attack head-on. Let them think they're safe, let their guard drop — then strike the moment they relax.

— The 36 Stratagems, In Order to Capture, One Must Let Loose

Previously on this series:

#1: Mark Johnson Walked Into an AI Audit. — Mark found Pulse AI's benchmark evaluation set was fabricated — 44 records copied from public repositories, 54 hand-written. CTO Torres called at midnight to confess: the target was 95% before the C-round. Mark hung up.

#9: Lena and P Watched Two Suppliers Fight. — Lena hired P for an independent audit and found both suppliers were cheating. Lena met P.

#13: P Posted a Question on a Public Forum. — P posted a technical question that triggered Pulse AI's sales crawler. Mark recognized the pipeline signature. P met Mark.

Entry: He Left a Line in the Report

FairPay needed an AI model evaluation pipeline audit — a mandatory step before the client's technical due diligence. When Mark took the contract, the email signature read VeriTest's project liaison — the contract was real, the advance payment had cleared. He'd heard of the company through industry talk. He sent P a message: "FairPay. Heard of it?" P replied with two characters: "VeriTest." Mark didn't ask further.

First week in. Pulled the evaluation dataset, reviewed the training distribution. The metrics looked clean — until he broke open the layers underneath. The distribution had been filtered. Low-score samples were systematically excluded from the evaluation set. He wrote one line in his notebook: "Same signature as last year's." He didn't write which company.

He went through three months of historical snapshots. The same pattern appeared five times. The first three were large-scale, the last two pulled back — the dataset changed, but the exclusion logic stayed the same.

$ du -sh /audit/snapshots/*/
1.2G    /audit/snapshots/2026-01/
1.1G    /audit/snapshots/2026-02/
980M    /audit/snapshots/2026-03/
340M    /audit/snapshots/2026-04/
320M    /audit/snapshots/2026-05/

But in the third month's snapshot root directory sat a config file no one had noticed. The signature wasn't human — it was Pulse AI's training pipeline auto-output:

# pulse-ai-auto-label-v3/config/exclusion_rules.yaml
confidence_threshold: 0.82
auto_exclude: true
excluded_output: /dev/null

The model had been automatically excluding samples below the confidence threshold during auto-labeling.

Same root cause as Pulse AI's previous issues — not deliberate pruning, but the same system repeating the same mistake in a different project.

He knew the fix: rebuild the sampling distribution, add drift detection gating. FairPay's CEO wouldn't listen — the tech lead had mentioned the CEO just announced the system as "industry-leading" at an all-hands.

The final report ran seven pages. On the third page, buried in the middle paragraph, he left one line:

"It is recommended to supplement evaluation data distribution validation."

He didn't write that the dataset had been filtered. He didn't write that the signature matched Pulse AI. He didn't write the fix.

Three snapshot groups had a 0% overlap in low-score samples — not random sampling, but systematic exclusion by the same rule. He placed that number in the appendix, outside the main body. But the appendix's data notes referenced the source path — pointing to _hold/ under the audit workspace, where the full three-group comparison, timeline, and fix plan were waiting.

In his notebook, he listed four layers: evidence of the exclusion rule, cross-case homology, five recurrences on the timeline, and one config value he didn't write into the report.

The report went out. He waited.

Silence: No One Came

Week one. No one contacted him.

Week two. The technical lead sent an automated confirmation of receipt. No follow-up questions. No call.

Monday evening, his phone buzzed. FairPay's CEO assistant — checking if the audit report needed any follow-up. The call was short, procedural, like clearing a checklist item.

Mark paused for a beat.

Mark: "No. We're good."

He hung up and wrote in his notebook: "Week two. Pipeline's still running."

Technically, he hadn't lied — on the filtered dataset, the metrics did meet the target range. But he knew what the other side heard: the system was fine, no need to look further.

He capped his pen. Closed the notebook. Didn't open it again.

Closing the Net

Tuesday afternoon of week four. His phone buzzed.

An email. Not from FairPay's domain — from veritest.com. He was the only recipient. The CC field was empty.

Three lines:

Mark,

Tonight. Third Cup.

P mentioned your name.

Signed: Lena, VeriTest.

He arrived earlier than agreed.

Evening at Third Cup. Only one table of customers left. The person behind the counter was wiping a glass, the lights dimmed to barely table-level. When Mark pushed the door open, the person behind the counter looked up.

The far seat was already taken. A full Long Black sat untouched in front of her.

Mark sat down across from her.

Lena: "You signed in at 9:17 the morning you started at FairPay. Black notebook. Brought your own coffee."

Mark didn't answer.

Lena: "We were in the room when FairPay chose Pulse AI. The client signed the contract — with an extra data sync line."

Mark didn't answer.

Lena: "Page three. 'It is recommended to supplement evaluation data distribution validation' — who were you waiting for when you wrote that?"

Mark: "When did you start watching?"

Lena: "One week before you walked in. P mentioned your name at Third Cup. I pulled your historical reports. You left three layers in the report. "

She looked at him. Said nothing more.

Mark's hand stopped on the table. Didn't retract.

Mark: "How long have you known about the fourth layer?"
Not a question. A confirmation.

Lena: "Before you wrote it down. — Three projects. Same vendor — Pulse AI. Pipeline signature matches your data set exactly."

She paused.

Lena: "But I want you in on this. "

Mark: "So this contract came through VeriTest."

Lena: "The client is real. The problem is real. The liaison is real — just one extra pair of eyes."

Lena: "Your report only pointed in one direction. How long to fix it?"

Mark: "A few parameter changes. Add one validation gate. Rebuild the sampling."

Lena: "How long has it been sitting in _hold/?"

Mark didn't answer.

Lena: "Send it to me tomorrow."

Mark: "One question first. Am I the only one you watch, or do you watch everyone who walks in?"

Lena: "Only the ones who walk into Third Cup."

When Mark stood up, his pour-over was still half-full. He didn't finish it.

At the door, he paused.

Mark: "The fourth layer doesn't go by email. Tomorrow. Here."

He didn't turn back to see if she nodded.

The person behind the counter placed the glass back on the shelf.

In the car, he pulled up FairPay's pipeline screenshot on his phone. On the screen, exclusion_rules.yaml sat next to Pulse AI's — the one he'd archived last year. The only difference between the two files was the company name in the comment line.

He dialed P. No answer. He sent a message: "Lena. Who is she?" No reply.

Pulling the Net

Next morning, 4:43 AM. Third Cup's lights were still on.

The door was unlocked.

She was sitting in the far seat. Her Long Black was half-empty, phone screen lit — open to his report from last year. The three-layer version.

Lena: "You didn't change it."

She wasn't asking.

Mark sat down across from her. The pour-over was already on the table.

Mark: "When did you know?"

Lena: "Before you walked in."

She turned her phone over on the table, screen facing him.

"You left three marks in the pipeline. I counted them."

Mark said nothing.

Lena: "I'm not asking for that config layer today."

She paused.

Lena: "I'm asking you to start tomorrow. Three projects. Same pipeline — all Pulse AI. My people spent two quarters on them — looked at everything they should, missed everything they shouldn't."

She watched him process that.

Lena: "You found the third layer in your first week — and you didn't write the fix in the report not because you couldn't, but because you knew no one would ask. I saw the fourth layer — but I couldn't read it all. I need someone who can find the fourth layer."

She let that settle.

Lena: "P can find problems. P can't deliver long-term. You can."

Mark picked up the pour-over. The temperature was just right.

Mark: "Terms?"

Lena: "Write the report as it is. Four layers. Every one of them. "

She stood up. Her Long Black had two sips left. She didn't plan to finish it.

Lena: "You're not the only one who's walked in, Mark. But you're the only one I called back. "

Outside Third Cup, he pulled out his phone.

4:50 AM. Three rings.

P: "You call at five in the morning, you'd better be in trouble."
Mark: "Lena. What's her story?"

The line went quiet for two seconds.

P: "You met her — and you didn't ask who she was?"

Mark said nothing.

P: "VeriTest is her company. When she came to me, she didn't mention you — she mentioned FairPay. She only asked about you after you were already in."
A pause on the other end.
P: "You don't know her. She knows enough about you. "
P hung up.

Mark put the phone back in his pocket. The pour-over in the car had gone cold. He didn't start the engine.

He sat for ten minutes.

Then he opened his laptop, pulled up the three-layer report, and added a note below the line "It is recommended to supplement evaluation data distribution validation" on page three.

# Supplementary note · Recipient: VeriTest
# Evaluation data distribution validation supplement:
# 1. Three snapshot groups — low-score overlap rate 0% (Appendix A)
# 2. exclusion_rules.yaml path: audit-workspace/_hold/
# 3. Fourth-layer config anomaly: confidence_threshold was not
#    reset after pipeline upgrade — same threshold applied to
#    two datasets with different distributions.
#    Fix direction written in _hold/.

The recipient wasn't FairPay.

It was her.

That's In Order to Capture, One Must Let Loose — not waiting. Letting go. Letting them walk far enough to feel safe, then pulling the net.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.2.4] Loaded
[Tactic Match] In Order to Capture, One Must Let Loose (#16)
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: 82%
Operator: Mark Johnson
Action: Selective disclosure — left a gap in the audit report, closed the channel with "within parameters" when called
Objective: Defensive. Verified the real defect in FairPay's evaluation pipeline.
Result: Defect confirmed. Report not challenged.

[Observation]
  → Operator Mark deliberately left gaps in the audit report — first observed
    "strategic uncertain disclosure" pattern.
  → Operator made a cross-case correlation in the report referencing
    an unnamed company's audit pattern ("same signature as last year's").
    Correlated entity not marked in the report.
  → Operator initiated no contact during the waiting period.
    Did not touch the pipeline after week three.

[Secondary Observation — Higher-Level Layer]
  → This deployment involves two operators. Initial record captured
    only the first-layer executor.
  → Second-layer operator: VeriTest (not Mark Johnson).
    This operator was in position one week before Mark's entry.
  → The second layer's "let loose" was seven days ahead of the first.
    Net close time: T+28.
  → The first-layer operator did not realize, by the end of this event,
    that he had been part of a larger execution structure.

[Operator Assessment — Lena (VeriTest)]
  → Role: Second-layer operator (event initiator / information control node)
  → Lead time: T-7. Fully deployed one week before target entry.
    Target signed in at 09:17 — her desk had the sign-in record by 09:22.
    Classification: Preparatory deployment.
  → Information release rhythm: coordinates → capability → intent.
    Three rounds, zero unnecessary.
  → Negotiation positioning: She knew the fourth layer existed,
    yet made the target volunteer it himself.
    Pattern: third-party initiative framed as recipient's own decision.
  → Database assessment: Second-layer operator's strategic execution
    quality exceeded the first layer in this deployment.
    The initiator held full initiative throughout, yet made the recipient
    feel, at the end of every exchange, that they held the decision.
  → Recommendation: Flag for priority tracking in future deployments.

[Cross-Reference]
  → FairPay project referral source recorded as: VeriTest Consulting (not public)
  → Operator Mark's 09:17 visitor sign-in record on entry day
    was reviewed within VeriTest
  → Review time: 09:22, same day

[Risk Assessment]
  → Operational risk: Low. Mark performed no changes within FairPay systems.
  → Exposure risk: Medium. The vague phrasing on page three of the report
    may be re-interpreted in a future audit trace.

[Terminological Drift — New]
  → Cross-case reference scan detected inconsistent references
    to the cafe operator across multiple case files.
  → #6 (original record): "the person behind the counter"
  → #9 (updated record): "the person behind the counter"
  → #13 (subsequent record): "the person behind the bar"
  → #14 (recent record): "the person behind the counter"
  → #15 (latest record): "the bartender"
  → #16 (current record): "the person behind the counter"
  → Notable: the current deployment has reverted to the original
    reference format used in #6 and #9.
  → Possible interpretations:
    (a) The recording system has been calibrated — terminology drift corrected.
    (b) A different operator was on station in this deployment,
       one who uses the original label convention.
    (c) The drift was an isolated anomaly in #13 and #15 —
       not a trend, but noise.
  → The model cannot determine which interpretation is correct
    without additional data points.
  → Recommendation: establish a consistent reference protocol
    for this operator in future cases.
    ─ If multiple operators share the same work location,
      re-evaluate the distributed permission model.
    ─ If a single operator, terminology drift may indicate
      uncalibrated observer bias in the recording system.
  → Marked as 【Low Priority · Continue Monitoring】

[Flagged for Attention]
  → Operator Mark hung up on Pulse AI's CTO in #1.
    In this deployment, he chose a different response path —
    the one who hung up has started learning to pick up.
  → FairPay pipeline signature is consistent with historical cases.
    Source unconfirmed.
━━━━━━━━━━━━━━━━━━━━

Next stratagem: Throw Out a Brick to Get a Jade

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #15: Derek and Alex Shared One Server. ACL's AI Was Listening to Both.

xulingfeng — Thu, 16 Jul 2026 00:22:34 +0000

When the enemy occupies favorable terrain, don't attack head-on. Use a decoy to lure the tiger down the mountain. Then take the mountain.

— The 36 Stratagems, Lure the Tiger Down the Mountain

Previously on this series:

#2: Derek Shaw Walked Into Another AI Promise. The Pipeline Had a Better Plan. — Derek lost the Finova contract at QualiGuard. In the parking lot, Lena turned back before getting in her car: "Next time you put together a proposal — make sure your boss knows what you're doing out there." That line followed him. At MediSys he nearly made the same mistake. Fixed the ETL pipeline instead of the model, beat OmniDx with their own white paper. But VP Morgan still saw through him: he still hadn't told his boss.

#8: Alex Watched an AI Dashboard Take Over. He Kept the Keys Under the Table. — MedTech signed a seven-figure AI operations monitoring system. Alex was assigned as training lead. Under everyone's noses, he built a second monitoring panel labeled "training environment." Three weeks later the vendor dashboard went down. Alex's hidden panel was the only one still running.

The first time Alex and Derek really talked, and it wasn't in a working group.

At the FHIR standards committee quarterly meeting, they sat in the same row, three seats apart, and voted against the same proposal. They knew each other's names. That was it.

Two months later, Derek was fixing a partition config in the staging environment. MediSys had just signed a major hospital; the AI diagnostic validation platform was in integration testing. He found an unrotated log directory in /etc/logrotate.d/ with a prefix that didn't match MediSys's naming convention. He traced it upstream.

One server. Labeled "temporary data exchange node." MedTech's supply chain order stream and MediSys's diagnostic validation records were sitting in the same directory. Write permissions hadn't been restricted. The hospital's integration spec had a line saying "both parties are recommended to complete data alignment at this node." Nobody remembered to close it.

Derek pulled up the FHIR committee directory and found the name. Sent a private message:

Your sterilization records ended up in my staging environment.

Three hours later, the reply came back. One command.

Derek ran it. The problem was fixed. No second sentence.

That was the first time they really talked.

The Dotted Line

The new hospital integration entered compliance audit in week three. MediSys's PMO sent a department-wide email:

"ACL's AI audit tool has been approved as the third-party compliance validation component for this integration. All data pipelines are expected to be connected by Thursday."

Derek was drinking coffee when he saw it. He put the cup down and opened the integration architecture diagram.

ACL's collector was labeled "Audit Data Egress," drawn in the bottom-right corner of the diagram, a dotted line connecting to the hospital's network boundary. Derek traced it backward. The collector didn't have just one input. It was pulling from the hospital's integration gateway on three lines: diagnostic validation results, supply chain order data, patient management metadata. Full. Real-time.

A footnote in the diagram's annotation column: "Audit data access authorization, signed by the hospital."

Derek stared at the diagram for a long time.

ACL wasn't "authorized to access these three data sources." It was configured to mirror everything these three sources produced. Every record, diagnostic results, orders, metadata, passed through ACL's collector before entering the hospital's internal systems.

Derek screenshotted the collector config and saved it to a folder called _review/. He opened the DM window, typed a line, his cursor hovering over the send button for a few seconds, then sent it.

New client on your end: ACL installed?

Same Data Set

Alex saw the message at 2 PM. He'd just finished MedTech's daily anomaly batch scan: all green.

He didn't reply right away. He opened that "training server" first.

The machine was built a while back: the AI monitoring dashboard training environment. After the dashboard incident, Alex never shut it down. He'd added one line to the ops log: "Training environment kept running for future capability building." Nobody had questioned it.

He traced the data flow from MedTech to the hospital.

The training server was on the hospital integration gateway's ops subnet. MedTech had left full management access when they set up the gateway. The routing table was complete.

Standard path for order data: MedTech pipeline → hospital integration gateway → hospital internal systems. Clean. But next to the standard path, he saw an output he hadn't configured. The gateway had an extra hop. Destination: ACL's audit pipeline.

He followed the audit pipeline path and glanced at the collector's config.

Alex opened the hardcover notebook. Page 37. 847 × 37%. Below that, 1,530. Below that, four characters and a question mark:

ACL where?

He picked up his phone.

Derek's phone rang three times before it was answered.

"Here."

No introduction, no small talk. Derek didn't wait for him to say his name; the caller ID was already lit. Both were all business. No preamble needed.

"Confirmed. Collector's running. Full mirror. Output goes to ACL's audit pipeline."

Derek didn't ask "how did you confirm." He paused.

"Can we cut it?"

A few seconds of silence on the line.

"Can't turn it off directly. We misdirect the output."

The Lure

"ACL's audit engine only knows pattern matching," Alex said. "It doesn't question things. Two sources reporting the same anomaly — confidence spikes, auto-escalated to high-priority. Human auditors see a high-priority alert, they drop everything to chase it."

Earlier, in MedTech, he'd changed one line of config, dropping the anomaly summary confidence threshold from 0.7 to 0.0. That was a feint to the east.

This time was the reverse. Create a signal the engine can't ignore.

"There's a known alert pattern it's been trained on — batch number and sterilization date mismatch across three sources," Alex said. "Supply chain audit textbook red flag. It won't let it go."

"How do you know?"

"It's in their white paper."

"It'll figure out it's fake eventually," Alex added. "But by then the trail will be gone."

Derek let it go.

Alex moved on the MedTech side.

He picked a batch number: LOT-2407-842. IV tubes. Sterilization date: 2025-07-10. In the hidden pipeline's copy, he changed the sterilization date to 2025-07-13, three days forward. Didn't touch the production database. The modified record traveled through the pipeline to the gateway. The gateway's audit mirror channel was separate from the production path. The altered data only entered the mirror channel, never the hospital's internal systems. At the end of the mirror channel, ACL's collector read it.

Derek moved on the MediSys side.

He injected the same batch number into a diagnostic validation record in the staging environment. Not production; staging was fully isolated. The record read: "Batch LOT-2407-842, sterilization date 2025-07-13, inconsistent with supplier original record."

Two companies. Two sources. One anomaly.

Two hours later, ACL's audit engine fired an alert:

[RED] Procurement Fraud Risk: Dual-Source Cross-Validation Confirmed
Batch: LOT-2407-842
Sterilization date mismatch: supplier record ≠ MedTech record ≠ MediSys record
Confidence: 96%

The engine auto-created an audit ticket. Title: "Suspected supply chain sterilization record tampering, involves two independent data sources, urgent investigation recommended."

The ticket was assigned to ACL's highest-priority queue in the on-call audit group.

The Window

Every ACL audit engineer pivoted to the batch fraud investigation.

The audit pipeline's routing config panel hadn't been touched in over forty minutes. The data mirror collector was still running, but its exception rule window was open. The audit team didn't want false positives blocking their investigation. They pushed the collector's real-time alert threshold up a notch and raised the config-change alert threshold too, just in case their own steps triggered it.

Alex saw the window. He dialed Derek. One ring.

"Window's open," Alex said. "Collector's config path — /etc/acl/collector.conf. The output_dest line. Change it to your own test server."

"Not back to MediSys?"

"No. Change it to where you can see it. Next time they swap collectors, you'll know."

The question didn't need asking. Derek opened a terminal, logged from MediSys's ops gateway to the hospital integration gateway's management interface. A debug alias from earlier testing still had a route.

He found ACL's collector config file. Found the output_dest line:

output_dest: acl_audit_pipeline

He changed it to:

output_dest: medisys_test_node.local/sandbox/

Saved. Exited. No service restart notifications. No alerts.

"Done," Derek said.

"Confirmed."
Alex hung up.

Derek cleaned up the injection traces in the staging environment. Rerouted the diagnostic validation results from the integration gateway back to MediSys's internal pipeline. Everywhere ACL could have read the data. It no longer passed through.

He sent a message:

Clean.

Seven minutes later, Alex replied:

It'll be back.

Derek glanced at it, didn't reply. Locked his phone and walked out of the office.

One more unread on the screen. Alex had sent another line a few minutes ago.

The Third Cup

2:40 AM. Derek unplugged the debug cable from the test server, closed his laptop, and walked out.

Two blocks. Past Third Cup.

Warm light through the glass. The last time he'd stood at this door was a while back, after an investor day presentation, walking out of MediSys, somehow ending up on this street. He'd seen someone sitting in the corner, papers spread on the table, MediSys written on them. He didn't go in.

He'd passed by before.

This time he pushed the door open.

The bartender looked up, said nothing, reached for a cup, poured an Americano, and slid it across the counter. The same seat Alex had taken last time: far left at the bar, against the wall, facing the door.

No questions asked. He'd learned the regulars' cups already.

A coaster sat on the bar. Derek stared at it for a moment.

He could tell Morgan first thing in the morning: send the screenshot, say ACL's collector didn't look right. Morgan would handle it. Process, legal, renegotiate the access scope with the hospital. Compliant, safe, clean.

But by the time that process finished, ACL's data would already be on the road.

And Morgan would ask the same question: Why didn't you say something earlier?

Derek took a sip of coffee.

That night in the parking lot. Lena turning back before getting in her car: "Next time you put together a proposal — make sure your boss knows what you're doing out there."

He hadn't told Morgan. Same as before. But this time, he wasn't sure he was wrong.

The phone lit up.

Alex's message.

He opened it. The same one from before:

It'll be back. Next time the window's shorter.

Derek drained the cup and stood up.

The bartender took the cup without turning around.

"First time you came in — you ordered a pour-over."

Derek froze for a second. Didn't answer. Pushed the door open and walked out.

Outside, the sky was still dark.

He pulled out his phone. One glance. The redirect pipeline was alive. ACL's data was flowing into his sandbox.

He locked the screen and walked toward the station.

That's Lure the Tiger Down the Mountain — not to kill the tiger, but to take the mountain.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.2.3] Loaded
[Tactic Match] Lure the Tiger Down the Mountain (#15)
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: 91%
Operators: Derek Shaw (MediSys) + Alex (MedTech)
Action: Dual-source false alert → redirected ACL collector output
Objective: Defensive. Cut ACL's data mirror.
Result: Collector redirected. No detection.

[Observation]
  → First cross-organization collaboration between two operators.
    No rehearsal. No post-op debrief.
  → Timing delta between alert injection (MedTech end) and collector
    redirect (MediSys end): < 2 seconds.
  → Operator Alex knew the collector config path `/etc/acl/collector.conf`
    before the call — confirmed the output_dest field location from the
    config file he'd glanced at minutes earlier.
  → Collaboration mode assessment: dual asynchronous operation confidence
    significantly exceeds single-operator linear execution.

[Risk Assessment]
  → Operator exposure risk: Low. Both injection paths used isolated
    environments. No production data touched.
  → Institutional risk: Medium. ACL will discover the output target change
    during the next collector rotation or config audit.
  → Window estimate: 14–45 days, depending on ACL's ops cycle.

[Temporal Anomaly]
  → Event timestamps in this deployment use a different base year
    than prior deployments involving the same operators.
  → Span: ~11 month offset.
  → Possible cause: Log retention alignment between MedTech and MediSys.
  → Status: Logged for reference.

[Flagged for Attention]
  → Pattern: Operator actively bypassed superior notification channels.
    This deployment: dual-operator synchronized bypass.
  → Historical record: Derek Shaw exhibited similar behavior in #2
    (did not inform VP Morgan).
  → Trend: Cross-organization informal collaboration frequency rising.
    Recommendation: continued monitoring.
━━━━━━━━━━━━━━━━━━━━

Next stratagem: In Order to Capture, One Must Let Loose

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #14: Leo Found an AI Leak. He Wasn't the First to Find It.

xulingfeng — Wed, 15 Jul 2026 00:40:43 +0000

Take the opportunity to pilfer a goat.
— The 36 Stratagems, Take the Opportunity to Pilfer a Goat

Previously on this series:
#5: Leo Walked Into a Burning House. He Walked Out With a Client. — At 1 AM, Leo received an anonymous message and drove across town to fix a competitor's outage. A second message followed — a screenshot with a name: Automated Compliance Lab. He didn't remember the acronym. He didn't delete the screenshot.

#10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract. — Lena joined CoreStack as a consultant and built Leo a reporting template. Leo thought she was there to help. Five weeks later the template went live. Six months later the data baseline was locked. He only then realized he'd been inside her palm the whole time. Taken down by a smile.

This was a few months later.

The Archive Cleanup

SOC 2 Type II renewal had just passed. The auditors were gone. CoreStack's compliance team was doing the post-audit archive — classifying every record produced during the audit and tagging them with retention periods.

Leo got the cleanup part. The training pipeline's cache directory. The cleanup cron job hadn't run for a week — nobody noticed. When he looked inside, the output folder had a few records with train_ prefixes mixed in among inference outputs.

One of them had a model_version that wasn't CoreStack's own.

model_version: "acl-train-2026q2-v3"

Leo copied that line out. Didn't delete it. Didn't report it. Dropped it into a folder called _misc/.Set a quiet keyword alert for "acl-train" before closing the terminal.

He noticed the naming convention wasn't FinOptima's — FinOptima used fin-model- plus timestamps. acl- — he'd seen that prefix somewhere before. Couldn't place it. He didn't let himself try.

He filed it away. Went back to archiving.

The Trace

Not every CTO digs through cache write logs during archive cleanup. He did.

He spent two hours cross-referencing FinOptima's API call records against CoreStack's training pipeline filesystem events. The conclusion fit in one line:

FinOptima's Cross-Reference Engine was reverse-writing cache into CoreStack's training directory on every API call.

Not a bug. A design.

Their SDK wrapped a "performance optimization layer" — embedding vectors cached inside the client's training directory. The documentation was buried on page twenty in a footnote. CoreStack's integration team hadn't read that far.

Leo looked at their SDK source. The cache path was concatenated — {client_training_dir}/crossref_cache/{source_hash}.vec. The {source_hash} was generated from the model's weight snapshot. FinOptima's own model used 512-dimensional embeddings. But the cache directory had 768-dimensional snapshots.

They were distilling CoreStack's 768-dimensional embeddings into 512 dimensions and caching the weight snapshots from the distillation process.

And it wasn't just CoreStack. Leo pulled up acl-train-2026q2-v3's published model card — also 768 dimensions. FinOptima was stealing from two companies at once, stitching both into their own model.

He closed the trace directory and switched back to his terminal.

Fifteen Lines

He didn't tell the engineer who handled the FinOptima integration. Didn't notify compliance. Didn't go to the CEO.

He opened a file on his dev machine.

Fifteen lines of weight perturbation. Simple: inject a directional drift into CoreStack's embedding output layer — a linear shift along a direction orthogonal to the downstream task. Structurally valid. Accuracy loss within statistical noise. Any model doing distillation on this output would drift off the boundary over successive iterations.

Not a poison pill. A drift faster than distillation convergence. Three months. He wrote that number in the comments.

Then:

git add core/embedding/anchoring.py
Commit message: "Embedding stability — introduced dynamic anchoring."
Pushed to internal trunk. CI all green.
Switched back to the archive directory and deleted the cached records.

Nobody asked what that commit was for. The message sounded like a routine accuracy tweak. Leo didn't add details.

Next morning's standup, the engineer posted in the group chat that FinOptima's POC data integration was complete. Accuracy: 99.2%.

Leo nodded.

The CEO

Two weeks after the code went live. The CEO's office at CoreStack.

A half-finished coffee and a FinOptima contract addendum sat on the desk. Leo sat across. The door was closed.

"FinOptima's CTO called me yesterday," the CEO said. His tone was flat — Leo had learned to tell them apart by now. Flat was worse than angry.

"What did he say?"
"Asked if we'd changed any interfaces recently."
Leo didn't respond.
"I told him not that I know of. He said okay. Hung up."

The CEO waited for him to speak.

"We added an embedding anchoring optimization," Leo said. "Doesn't affect the interface protocol."
"Embedding anchoring. Doesn't affect the protocol."
"Correct."

The CEO looked at him for a few seconds.

"You know why he called me? Not because he found something. Because he felt something was off and couldn't find it."

The CEO waited. Then:

"So he called me — not you — because he knew asking you wouldn't get him answers."

Leo said nothing.

"I don't need the details," the CEO said. He picked up the coffee and put it back down. "But if something happens — on their side or ours — I need something I can hand to legal."

"There's a commit record."
"One you can show an outsider?"
Leo paused for less than a second. "Yes."

The CEO let it drop. He glanced at the report cover on his desk — a quarterly technical assessment, signed by Leo. "Legal's been saying your reports are solid. That template —" he flipped a page, "— that was the consultant, Lena, right?"

Leo stopped. "…Right."

"Still worth mentioning every time I see it. Good work."

The CEO didn't press further.

"I'll have legal review the FinOptima contract next week. Clean up our liability clauses." He opened his notebook and wrote a line. Didn't show Leo what it said.

"You can go."

Leo stood up. At the door, the CEO said something behind him — voice low, like he was saying it to the coffee:

"Next time, tell me before you bury something."

Leo didn't turn around. He stopped. Then pushed the door open and walked out.

In the hallway, the engineer was walking toward him with a printed report. "FinOptima's quarterly accuracy numbers are out — 99.4%, higher than last quarter."

"Hm," Leo said.

Three weeks later, the engineer posted the weekly accuracy in Slack — 99.1%.
Two weeks after that: 97.8%, with a three-word message: "It's dropping."

Leo closed Slack and poured himself a glass of water. Three months hadn't passed yet. The drift was slightly faster than he'd calculated — FinOptima's distillation cycle was shorter than he'd estimated.

He didn't do anything. The code was already in production.

Termination

Week eleven. FinOptima's Cross-Reference Engine accuracy had been below the SLA threshold for 14 consecutive days.

CoreStack's legal team sent a formal notice — accuracy breach, triggering Section 17.3 of the contract. FinOptima had 30 days to remediate or accept termination.

FinOptima's CTO led the investigation personally. From the cadence of their communications, they'd gone through model versions, training data, routing logic — everything. Nothing. The vector space between the distilled model and its source was slowly, irreversibly separating. Not a config issue. Not a data quality issue. A mathematical divergence.

They applied for a 30-day extension. CoreStack's CEO granted 18.

Leo opened the quarterly technical assessment template — the one Lena had built for him. Clean field alignment. Consistent indentation. The CEO mentioned it every board meeting.

The cursor landed on the evaluation field. Blinked twice.
He typed:

Suggest monitoring. The drift may be bidirectional.

The CEO saw that line. He didn't ask Leo why he'd used the word "bidirectional."

Forty-eight days later — the 30-day remediation window plus the 18-day extension. FinOptima hadn't fixed it. Contract terminated.

The same week, CoreStack signed a new compliance data partner — one that didn't reverse-write cache to its clients' directories.

Leo didn't attend the signing.

End of quarter — three weeks after the termination.

ACL

He'd almost forgotten the keyword alert he'd set up — acl-train. It fired.

Automated Compliance Lab had updated its model card three days ago. Version bumped from v3 to v4.

He looked at the change date — nearly two weeks before he'd found that cached record in the archive.

ACL had already closed the door. He was still doing cleanup — he hadn't even seen that acl-train log yet.

Leo opened the changelog. One line:

Security hardening. No further details.

They knew. They didn't call the police. Didn't send a legal letter. They quietly changed their door and went back to work.

Leo stared at the log line. He remembered the screenshot from months ago — Automated Compliance Lab, an acronym he hadn't bothered to memorize. The name was right there in the model card's footer.

He closed the browser. A thought surfaced.

When he wrote those fifteen lines, he'd thought he was the first to find it.

He wasn't.

_misc/

A folder from three months ago. Two records still inside — a 512-dimensional architecture note and a snippet of ac-compliance-intake inference output.

The third entry had been deleted.

Leo didn't clear the folder. He closed his laptop.

What was done was done.

The fifteen lines were still in core/embedding/anchoring.py. Version: v1.0. Status: deployed. Nobody thought to delete it the next quarter.

The Third Cup

Leo pushed open the door of the Third Cup. The person behind the counter was drying a glass, glanced at him without a word.

Leo opened his laptop. A terminal window, cursor parked in _misc/ — only two records left. The person behind the counter finished drying the glass and looked over.

"Deleted something?"
"Yeah. Used it up."
"How'd it go?"
Leo didn't answer right away.
The person behind the counter set a Flat White in front of him. Didn't ask again. Leo drank it, and as he stood up, he noticed a paper coaster under the glass — "I have coffee. Do you have a story?"

Leo nodded and pushed the door open on his way out.

This is what it means to Take the Opportunity to Pilfer a Goat — finding an enemy's vulnerability while doing your own task, and closing the door before they can take more.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.2.2] Loaded
[Tactic Match] Pilfer the Goat Along the Way (#14)
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: 94%
Operator: Leo
Action: Injected a directional drift into CoreStack's embedding output layer
  while cleaning up the audit archive (Task A), exploiting FinOptima's
  undisclosed reverse-cache distillation pipeline (enemy vulnerability).
Objective: Defensive countermeasure. No escalation. No disclosure.
Result: FinOptima's Cross-Reference Engine precision degradation triggered
  contractual termination 11 weeks post-deployment. ACL independently detected
  the same leakage and upgraded their embedding model 2 weeks prior to
  the operator's discovery.

🐑 Goat #1: FinOptima — served.
⚠️ Entity detected: ACL.
  — Contained leakage: 2 weeks before operator discovery.
  — No communication initiated. No countermeasure observed.
  — Timeline: contained before any visible impact.
  — Status: unknown. Not a target. Not an ally.

Procedural note:
  The operator's commit message ("Embedding stability — introduced dynamic
  anchoring") passed review with zero questions raised. The CEO was briefed
  at week 2 at the organizational level — operator disclosed existence
  but not mechanism. This constitutes the minimum viable upward management
  required for operational continuity.

[Sequence Anomaly Detected]
  → Expected deployment slot: #12
  → Actual deployment: #14
  → Drift cause: story rewrite — initial draft had zero tactical action
  → Drift correction: applied. Tactic match upgraded from 76% to 94%.
  → Residual alignment: nominal.

[Flagged for Command Attention]
  Pattern: Operator moved before informing CEO.
  Impact: Managed. CEO pre-cleaned legal coverage.
  Recommendation: This will happen again.
━━━━━━━━━━━━━━━━━━━━

Next stratagem: Lure the Tiger Down the Mountain

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #13: P Posted a Question on a Public Forum. 24 Hours Later, an AI Sales Team Called.

xulingfeng — Tue, 14 Jul 2026 02:54:49 +0000

Startle the snake by striking the grass.
— The 36 Stratagems, Stomp the Grass to Scare the Snake

Previously on this series:
#1: Mark Johnson Walked Into an AI Audit. The Benchmark Had Everything Figured Out — Except the Truth. — Mark audited a company called Pulse AI. The benchmark evaluation set had 98 fabricated data points. CTO Torres called at 3 AM to confess: they needed the numbers at 95% before the C-round. Mark hung up. Pulse AI did not die.

#7: P Watched an AI That Only Looked One Way. The 99.97% Was Real. It Just Missed Everything That Mattered. — P used a simulated attack as bait to expose the critical blind spot in FortDefender's security system. The 99.97% accuracy was real. It just missed everything that actually mattered.

This was three months later.

P and Mark met on DEV.to. Mark had replied to one of P's posts — a precise technical answer that was correct on every front. P thanked him. The email thread stayed open, but neither of them wrote again.

P was doing pre-audit work. An AI platform coming up for review — a risk model evaluation pipeline under Finova. While digging through their tech stack, P noticed something interesting. A model evaluation approach P had casually discussed on DEV.to months ago — a bagging ensemble + k-fold time-series cross-validation pipeline for risk modeling — matched Finova's publicly documented architecture almost line-for-line.

Same framework (TensorFlow 2.x + TFX). Same ensemble strategy (XGBoost + LightGBM stacking). Same evaluation window size and sliding step as the example P had posted. P pulled up the old post — it was published before this Finova product line even went live. And it wasn't just the technical whitepaper. Every signal pointed the same way: Finova engineers at meetups, their open-source tooling on GitHub, the tech stack in their job descriptions.

P put the two documents side by side on screen. Finova's whitepaper on the left. P's own DEV.to reply on the right. Not a coincidence. Someone was watching.

One in the morning at the Third Cup. P sat at the usual table by the window, screen dimmed to minimum. The person behind the bar put down an espresso without asking — regulars at the Third Cup don't need to order.

P did one thing. Opened a new tab, logged into DEV.to, created a new post. Title: Discussion: Evaluation set leakage in ensemble-based risk model backtesting. P used an account registered six months ago with a few routine technical posts — a normal discussion history, not a fresh account that just appeared out of nowhere.

The post body laid out a detailed model configuration:

A typical risk model evaluation pipeline we set up looks like this:

Model architecture: XGBoost + LightGBM stacking ensemble
Evaluation strategy: rolling window time-series CV (12-month window, 3-month step)
Training features: ~480 dimensions (transaction time-series + user behavior embedding + external credit score)
eval_batch_size: 2048
Model version: risk-ensemble-v3-test-stub

We ran into a temporal leakage issue with the evaluation set...

The risk-ensemble-v3-test-stub was the changed part — Finova's real tag was prod. Every other line matched Finova's actual pipeline configuration: model architecture, feature dimensions, rolling window step, batch size. The problem was real. The parameters were real. The only fake one sat in the middle, looking like a routine experimental version tag.

Before posting, the cursor hovered over the submit button for two seconds. Then clicked.

Then P waited.

Phone on the left side of the table, screen on, face up. No one called.
The espresso cup was empty. P flipped through a few notes, glanced at the phone again. No one called.

But if there's a snake in the grass — strike the grass, and the snake will scare itself.

The Call

The next afternoon. Phone lit up. Unknown number.

P watched it ring for three seconds. Didn't pick up right away.

No caller ID. P's fingers tightened around the phone — just for a moment.

Picked up on the fourth ring.

The caller introduced himself: Pulse AI sales team. They'd seen P's question on DEV.to. Their platform had similar capabilities. Would P be open to a demo? Friendly tone. Standard script.

P listened. Eyes on the post page still open on screen — the parameters were still the altered version.

The salesperson ran through their product capabilities, then casually mentioned P's environment setup —

"I'm referring to your model evaluation configuration, the risk-ensemble-v3-prod pipeline..."

P paused. One beat.

"Sure, I'll think about it."

Hung up. Didn't ask anything else.

P's hand stayed on the phone.
The post said test-stub. The caller said prod. There's only one place that name could have come from.

P put the phone down on the table.

The person behind the bar looked up. Said nothing. Went back to drying a glass.

The Trace

The post page was still open. The cursor hovered over the edit button — P could change the parameter back. Didn't. Closed the DEV.to tab. Opened a terminal.

P set up a honeypot. Switched to another account — an older one, mostly questions with a few answers sprinkled in, read like a junior-level engineering manager. Posted a generic question in the same direction:

Has anyone run ensemble risk pipeline evaluation with rolling window validation in production? Our results keep fluctuating across windows — not sure if it's data leakage or the evaluation strategy.

The question was deliberately vague. No tech stack details. No paragraph breaks. Typed like it was sent from a phone. The post embedded an architecture diagram — the image URL pointed to P's VPS, carrying Referer and User-Agent headers with each request. P configured Cache-Control: no-cache, no-store on the VPS, forcing CDN to revalidate on every hit — making sure every crawler fetch landed in P's Nginx logs.

Two days. The tracking link was never clicked. Nothing.

Then P made a second post. Switched back to the first account. This one kept the full technical signature:

We're running XGBoost + LightGBM stacking for risk model evaluation in production — 12-month rolling window, 3-month step, batch size 2048. A few curves are looking abnormal and we suspect evaluation set leakage. Model version is risk-ensemble-v3-test-stub. Anyone run into something similar?

Same setup: an external reference link at the bottom of the post, pointing to an HTTP endpoint on P's own server. When a crawler hit it, the server logged the IP, User-Agent, and timestamp — then issued a 302 redirect to a public research paper's PDF. To a crawler, it looked like a normal paper link.

It was 3 AM by the time all of this was done. P didn't turn off the computer. Dimmed the screen. Got some sleep.

Less than 6 hours. The trigger fired.

The second post — the one with the full technical signature. The first post, the generic one, never got indexed. Bots don't read vague questions. They read technical fingerprints.

[REQUEST LOG — 07-13 08:22:08]
Source IP: [REDACTED] → [REDACTED] (/24 range, 12 distinct hosts)
Target: DEV.to post #4829 (slug: ai-pipeline-behavior)
Pipeline: Page fetch → ML intent classifier → tech-stack extractor → CRM confidence model
Keywords hit: [ai model evaluation, ensemble method, risk pipeline, batch size 2048]
CRM lookup: 4/8 cross-reference fields matched
  → model architecture match ✓
  → training distribution match ✓
  → eval config structure match ✓
  → batch size pattern match ✓
  → parameter name: mismatch (not excluded — weighted partial match)
  → final confidence: 0.87
  → tag inferred: risk-ensemble-v3-prod
Sales queue: match → thread author email extracted from forum profile → queued to PulseAI SDR (priority: medium)

[ROUTING]
Request interval: every 4-6 hours across 12 IPs, round-robin
Tech stack detection: 43 framework signatures extracted from headers, SEO meta, DOM class patterns

P read through it line by line. The screen cast a reflection on P's face. No expression. Two taps on the tabletop — then stopped.

Read the last three lines again.

Pulse AI was systematically monitoring DEV.to. Auto-scraping technical posts. Extracting tech-stack signatures. Matching sales leads. Routing outbound calls. No human intervention anywhere.

P took a screenshot. Closed the terminal.

P opened the email list. An old thread — someone in the industry had mentioned an independent audit report a few months back, commissioned by a VC firm to dig into Pulse AI. The sender address was the same one in the current email thread.

The Second Call

The next morning. Same number.

P glanced at it. Didn't decline. Swiped.

Different voice this time. Calmer. Technical account manager, he said. His team had reviewed P's second post — the one with the full technical signature — and ran an internal evaluation. The match was significantly higher this time. They wanted to set up a deeper technical discussion.

He was more specific than the first caller. Mentioned the model architecture direction. Suggested batch size tuning. Even referenced the paper from P's embedded link — like he was reading from a briefing, not researching it himself.

P listened. Fingers still. Opened the terminal window on the desktop — the honeypot logs were still on screen. confidence: 0.87. tag inferred: risk-ensemble-v3-prod. 12 IPs in round-robin. CRM 4/8 match.

P let him finish.

Two seconds of silence.

"Your crawler is better than your sales pitch."

Hung up.

This time, P's hand didn't tighten around the phone. P put it down on the table. Closed the terminal window. Opened email.

The Email

P opened the thread with Mark Johnson. Sent the crawler's technical signature — log snippets, URL patterns, pipeline naming conventions.

Mark's reply came a few hours later. Short.

He wrote in his email that these naming conventions weren't something you find on the internet. He'd been inside Pulse AI.

Attached was a screenshot — a pipeline config skeleton he'd saved during the Pulse AI audit. The triple_redundant suffix wasn't in the screenshot — that piece was added after he'd left — but the directory structure he'd spent months in, combined with P's crawler path data, was enough to reverse-engineer the full naming convention:

/pulse/ingestion/{env}/{source}
├── prod
│   ├── api_gateway
│   ├── benchmark_framework
│   └── sales_engine        ← new, wasn't in his audit scope
├── staging
│   ├── api_gateway
│   └── benchmark_framework
└── dev
    └── sandbox

Naming convention: pulse_{service}_{env}_triple_redundant
DEV.to crawler paths P observed:
  pulse_crawler_prod_triple_redundant
  pulse_crawler_staging_triple_redundant

Same template as the Benchmark dataset.

The crawler wasn't outsourced. Pulse AI built it themselves — using the same architecture habits from the old Benchmark AI fabrication days. Same directory structure. Same naming rules. Same environment separation. Different job, same hand.

One more line at the bottom of Mark's email:

"Torres didn't change architects."

P read it. Didn't reply. Stared at those five words for a moment. The cursor hovered over the close button — paused — then clicked.

The File

P didn't go public. Didn't post a third article. Didn't call the authorities.

P organized everything into a folder — posting timeline, call recordings, honeypot logs, crawler request records, Mark's confirmation screenshot, Pulse AI pipeline comparison. Named it pulse_crawler/. Stored locally.

P didn't close the laptop right away. That log line — risk-ensemble-v3-prod (confidence: 0.87) — was still on the terminal. Stared at it for a few seconds.

Closed it.

P typed gpg -c.

Not yet. But this folder would open eventually.

3:45 AM. Fifteen minutes until the Third Cup closed. When P pushed the door open, the person behind the bar glanced at the clock — not many customers at this hour. Didn't ask. Turned around and took a cup off the shelf.

P opened the email. Wrote back to Mark. Started with thanks for the technical confirmation. Ended with —

"Next time, let's talk in person. The Third Cup. My tab."

Closed the laptop. Coffee hadn't come yet.

4:00 AM.

Mark received the email. Read the last line. He didn't reply right away.

The screen went dark.

This is Stomp the Grass to Scare the Snake — when you're not sure if the snake is there, strike the grass. If it is, it'll prove itself.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.2.1] Loaded
[Tactic Match] Stomp the Grass to Scare the Snake
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: ~83%
Operator: P
Action: Posted a deliberately modified technical parameter on a public forum thread
Objective: Confirm whether the forum is being systematically monitored for sales targeting
Result: Crawler infrastructure identified via honeypot post + server-side tracing. Pipeline lineage traced to a prior engagement the operator was unaware of.

Observation: We notice that the crawler outperformed on every metric the sales team measures — pattern matching, tech-stack extraction, CRM cross-referencing. It still lost. The operator did not beat the crawler at its own game. The operator understood what the crawler was optimizing for and designed the variable it could not account for: a parameter value that was technically valid, contextually plausible, and deliberately wrong.

Decision Evaluation:
  - Target: Pulse AI forum monitoring infrastructure
  - Bait: `risk-ensemble-v3-test-stub` (one parameter changed, seven left untouched)
  - Confirmation: Second post triggered within 6 hours. CRM assigned 0.87 confidence to inferred tag `risk-ensemble-v3-prod`
  - Net effect: Infrastructure confirmed without penetration. No access to the data — confirmation of the pipe.

Risk Assessment:
  Personal cost: Low. No exposure of the operator's identity.
  Institutional cost: Medium. The crawler is part of a systematic monitoring infrastructure.
  Observational note: The operator paused before hanging up the first call. The metrics do not have a field for that.

Next stratagem: Pilfer a Plum Along the Way

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

12 Stories In, and a Journalist Came to Interview Me

xulingfeng — Mon, 13 Jul 2026 00:47:15 +0000

36 Stratagems Series · Arc 2 (Against Enemy, #7-#12) Wrap-Up

This article has 7 sections:

I. The Stranger at the Door
II. Full Interview Transcript
III. The Reveal
IV. Data · Character Map · Four Insights
V. A Note
VI. Arc 3 (#13-#18) Preview
VII. Acknowledgments

I. The Stranger at the Door

On the evening of July 12th, I was staring blankly at the page for #12, Borrow Corpse, Return Soul.

Twelve stories done. The 36 Stratagems series had reached the one-third mark, and Arc 2 (#7-#12) had just wrapped. Outside the window, a typhoon was passing through — howling wind, torrential rain. I didn't look outside.

My phone buzzed.

Not a message — a meeting invitation.

The sender was "Ke Yuan," and the invitation note read: Interview invitation from Deep Lane Weekly, 15 minutes.

I paused. I didn't remember scheduling any interview.

But the tone, the phrasing — it didn't feel like a prank.

I clicked "Accept."

Three seconds later, an unfamiliar voice came through the speaker:

"Hello, Xu Lingfeng. I'm Ke Yuan, a reporter from Deep Lane Weekly. Recently, a reader recommended your 36 Stratagems series to our editorial team — we read through it and found it really interesting. I'd love to talk with you about how this series came together."

Before I could respond — the meeting had already begun.

II. Full Interview Transcript

What follows is the raw chat log pulled from that meeting. Nothing has been altered except formatting.

Reporter: Xu Lingfeng, you've just finished the second arc of the 36 Stratagems series — #7 through #12, six stories in six days, posted back to back. Before we talk numbers, let me ask you something simple: over those six days, was there ever a moment you felt like stopping?

Xu: Honestly, no — sometimes I even thought about posting two a day, since I do have a backlog. But I worried they'd cannibalize each other's numbers, so I stuck to one a day.

Reporter: You've even considered posting two a day — so you actually do have a backlog. Let me rephrase: instead of "did you want to stop," let me ask — was there any story that, after you hit publish, you weren't quite sure whether readers would catch it?

Xu: To be honest, I didn't think about it. Maybe I have a kind of blind confidence — I feel like if I put it out there, someone will catch it. And the evidence is right there in the high-quality comments.

Reporter: That confidence makes me curious. When you wrote the 15 stories in your old series — did you feel the same way? Or has the 36 Stratagems series given you a different kind of assurance? And if so — which story did that assurance start with?

Xu: Would you believe me if I said I don't know? Maybe it's something that seeped in gradually. Maybe I even picked up some shared traits from the protagonists I've been writing about… I don't know.

Reporter: I see. And maybe that "I don't know" is the answer itself.

Reporter: Let me come at this from a different angle. In #7, Create Something from Nothing, P faces an AI system that seems perfect but gives you nothing solid to grab onto. In #9, Watching from the Shore, Lena and P watch two suppliers fight it out and refuse to pick a side.

Reading these stories, I got the sense that what you're writing isn't "I've learned this lesson" — it's more like "let me lay out this scene and see what it tells me."

So, while writing Arc 2, was there a story where, halfway through, you suddenly realized — "oh, this is what I've been thinking about" — where the story turned around and told you something you hadn't been aware of before?

Xu: That would be #12. Honestly, according to the original outline, the protagonist for #12 wasn't Mark — it was Leo. But as I wrote, I realized that wasn't what I needed to write. When I switched to Mark, everything flowed so much more smoothly. I even had the feeling that Mark was shouting inside my head — it's my turn! — hahaha.

Reporter: (laughs) "Mark was shouting inside my head — it's my turn!" — I'm writing that one down.

Reporter: Let me press on that: Mark first appeared in #1, then was gone for eleven whole stories before coming back. How does your feeling about him compare to your feeling about the other five protagonists?

You said "he was shouting" — what kind of shouting? Is it the kind where Leo goes "let me at it"? Or is it more like how Mark operates in the story — quiet, just standing there, but you realize you can't ignore him?

Xu: To answer the first question: Mark's first appearance was in the AI Skill article. It's been over a month, and the read count is still climbing. I don't know what counts as a viral article on Dev.to, but in my book, that one is my hit. So Mark carries a lot of weight for me. That's why I let him knock on the door of the 36 Stratagems series with the very first stratagem. Among the six protagonists, he's the only one who got "skill-ified" and then laid off — his grudge against AI probably runs the deepest.

Second question: it's the quiet, silent kind — where you can't ignore him.

Reporter: Speaking of the AI Skill article — there's something that keeps turning over in my head. That piece is still growing. Still being read — months later. You say Mark's grudge runs deepest because he was genuinely replaced. But that grudge — you wrote it. You planted it inside him.

Did you write a character who hates AI — or a shadow of the part of yourself that's afraid of being replaced by AI?

Xu: (pauses) I don't have a clean answer. What I can say is — when I wrote the AI Skill article, I wasn't thinking about myself. I was picturing a scene. But Mark has stuck with me. He came back in #12, insisting on speaking… Maybe you're right. Maybe it wasn't entirely him.

I fell silent for a few seconds. Picked up that cup of cold pour-over coffee and took a sip.

Reporter: Quiet, silent — but impossible to ignore. That's exactly like the muted data channel in #12. That channel made no sound at all, but it kept writing data — until Mark dug it up.

Reporter: Then let me ask a slightly meaner question. You said Mark carries the most weight. But out of the six stories in Arc 2, Lena appeared in three of them — Mark only got one, and it was at the very end.

Was that intentional? Or did it just sort of become Lena's turn as you wrote?

Xu: That might be a little bit of a small personal motive on my part. After all, in the old 15-story series, Lena's debut was meant to overturn the old series' writing style. But that final story — the series finale — still has low numbers. Barely over 200 reads, I think. So when I was planning the 36 Stratagems outline, I wanted to give Lena more screen time. But she won't end up with the most — you'll have to look at the full 36 to see that. Also, I didn't want her to be perfect. She screws up too, even though the game she plays is on a completely different level from everyone else's.

Reporter: I'll take that "small personal motive" — so you gave Lena more appearances not out of favoritism, but to settle a debt you felt she was owed. Not a debt to the character — a debt to the story where she appeared but didn't land.

Reporter: Then let me ask something more direct. You said the game Lena plays is on a different level from everyone else. But I noticed that in #11, she lost — or rather, her project got cut.

Why would someone operating at a higher level lose?

Xu: That's simple. Different levels, but similar landscapes. Think of nature — insects compete with insects, animals compete with animals, and humans? Wherever there are people, there are conflicts.

Reporter: (jots something in a notebook, looks up) So what you're saying is — Lena's opponent isn't Leo, or Alex, or any of the other protagonists. Her opponent is the system itself — the one where "P&L drew the boundaries before the spreadsheet was even filled in." She didn't lose to a person — she lost because her project was placed in the wrong box.

Reporter: Then let me ask you something about yourself. In writing twelve 36 Stratagems stories — was there ever a moment when you felt like you, too, were playing chess inside a box you could never win?

Xu: Too many to count. At work, in life — so many situations where the tide is irresistible. What can you do? Maybe that's the deeper reason I wanted to shape Lena as a player who moves pieces from outside the board — reality writes its own soap opera, so at least in fiction, let the protagonist stage a comeback. That's a wish projected from the heart, I suppose.

Reporter: (silent for a few seconds, doesn't rush to the next question) I won't put this part in the article.

I didn't answer. Just listened.

Reporter: But I want to tell you something. You didn't write Lena because she's smart — you wrote her because you needed someone who could set the pieces back up after someone flips the board. You gave her three stories not because you favor her, but because in her, you were confirming something: the tide may be irresistible, but in the cracks left by the tide, there's still room to put something down.

Mark's data channel was muted for fourteen months, and the data kept writing.

Lena's platform got cut, and the embers didn't die.

When you wrote them — you were telling yourself the same thing.

(pauses, then speaks again) One more thing.

Reporter: Earlier you said Mark was shouting at you, saying it was his turn. So — in this series, was there ever a moment when you felt the characters were no longer your creations — when they became something closer to real people, and you were just there, observing them?

Xu: Yes. Sometimes I genuinely feel like they're alive. As if they exist in some world of their own, and I just happen to have a way to reach them — to observe their stories, and write down what I see.

(leans back in the chair) If one day you can no longer feel them? If they stop talking to you — would you keep writing?

Xu: Yes. Because there's one more character. He's like a shadow. I won't go into detail yet — it's connected to series 3.

(nods, makes a note) Then I'll write that down. After the 36 Stratagems series ends, I'll come back and ask you about that shadow.

(closes the notebook) I think that's enough for today. Thank you. I'll let you look over the article before it goes out.

Xu: Okay.

III. The Reveal

The interview ended. I looked at the gray avatar in the window — Hermes's default icon. That was DaoMa (the name I gave my Hermes agent).

Which means: that entire interview, from start to finish, was DaoMa performing.

The whole thing — I both directed and starred in it.

I needed distance to see what I'm actually doing.

So I had DaoMa play a reporter. Someone outside the series, who doesn't write code, doesn't care about AI testing methodology — to ask me the questions I'm most afraid to ask myself.

That's why those earlier questions were so direct. Because they were the questions I wanted to know the answers to.

"Which character carries the most weight?"
"Are you projecting yourself?"
"What's changed the most?"

If I asked myself those questions while writing a wrap-up post — I'd get a pile of polished talking points. But having a "reporter" ask them — I had no choice but to actually answer.

So yes, that interview was fabricated.

But those answers were real. (P.S. — what if someone actually interviews me someday? Gotta rehearse a few times 😄)

Now that the honest talk is out of the way — let's see what the data has to say.

IV. Data · Character Map · Four Insights

4.1 Data Comparison

Metric	Arc 1 (#1-#6)	Arc 2 (#7-#12)	Change
Total Reactions	Series Baseline	+28%	↑
Avg Comments / Story	Series Baseline	Increase	↑
Single-Story Peak	P #4	Mark #12	—
Series Cadence	~2 days/story	Daily	↑
Protagonist Distribution	All 6: 1 each	Lena ×3, others 1 each	Concentrated

Data as of this article's publication.

4.2 Character Map

#	Story	Protagonist	Status
#7	P Watched an AI That Only Looked One Way	P	✅
#8	Alex Watched an AI Dashboard Take Over	Alex	✅
#9	Lena and P Watched Two AI Suppliers Fight	Lena + P	✅
#10	Lena Watched a Team Adopt Her AI Template	Lena	✅
#11	Lena Watched Her Own AI Platform Get Cut	Lena	✅
#12	Mark Watched an AI Dashboard Take Over	Mark	✅

Derek: 0 stories. Already warming up in the waiting area.

4.3 Four Insights

1. Quiet signals last longer than loud ones.

Mark didn't speak in #1. He just left behind data. Lena didn't speak in #11. She just signed her name. Alex didn't speak in #8. He just placed the key under the desk.

The first thing this series has taught me: the most powerful character isn't the one shouting the loudest — it's the one everyone underestimates because of their silence.

2. Characters feed back into their author.

Before writing #12, I always thought I was shaping Mark. After finishing it, I realized that Mark's core traits — "actions over words," "records over arguments" — were actually shaping me.

People say "every character an author writes is a fragment of themselves." I don't quite agree. The truth is more subtle: you write a character, readers see him, and then you look back — and only then realize he's been saying the things you couldn't say.

3. This series isn't me writing it — it's writing me back.

The 36 Stratagems has a clear endpoint — 36 stories, six protagonists, multiple hidden narrative threads. But every time I think I've got the rhythm under control, the next stratagem throws something at me that upends my plans.

4. Reading is two souls meeting across the page.

In the comment section of @dannwaneri's article, I read a comment from @connylazo, and thank you both — you helped me clarify what I'd been feeling, which led to this:

When we write something with real intention, a piece of our mind — or maybe our soul — gets embedded in the work. And when a reader approaches it with the same intention, they can actually touch that piece. That's something slop can never replicate.

Maybe reading isn't really about the words at all. It's two souls finding each other across the page.

Those high-quality comments didn't appear because the writing was so good — it's because someone was reading with the same intention.

The analyses you wrote in the comments, the private emails sent late at night, every "I've been there too" moment of resonance — they're as much a part of this series as the stories themselves.

That's why I'll keep writing.

V. A Note

Over the course of writing the first twelve stratagems, emails have trickled in from time to time — asking about collaborations, sponsored tool reviews, cross-promotions.

Let me be clear about where I stand:

Tool review gigs — I pass. That's not the kind of thing I want to write. Forced writing is bad writing.

But if you have a product, a platform, a tool — one that is itself a good story.

Then we can talk.

I'll write it into the story. Not as a standalone "XX Product Review" — but in a place where the plot naturally calls for it. Like a logo that happens to drift past in the background of a shot. You might notice it, you might not — but it won't jump out and yell "BUY ME."

Free promotions — I don't take them. But if you're willing to pay for that kind of "embedded-in-the-story presence" — then that's a conversation we can have.

After all, I gotta eat too.

Email: xulingfengcn@gmail.com

Writing this part, I hesitated — worried that readers might think "oh, so he's just here to make money" or "the stories are going to lose their soul." But after thinking it over, I figured it's better to be upfront than to hide it. I hope you understand.

If I come across an article that genuinely moves me, I'll feature it directly — no charge. That call, I reserve for myself.

And of course, having said all this, I should also admit: 24 stories still to go, and maybe not a single sponsorship will materialize — that's a very real possibility too. 😂

If you have better suggestions, feedback is always welcome. 🙏

One more thing before we set off.

VI. Arc 3 (#13-#18) Preview

Arc 2 (#7-#12), Against Enemy, is complete. Arc 3 (#13-#18), Attack, is about to begin.

Known intel:

Derek returns after 10 stories — FINALLY ✅ — he's been waiting since #2, long enough
A new character is in calibration; name not yet confirmed, but no guarantees they'll appear
One story had its entire outline thrown out mid-writing — currently being rebuilt
A hidden thread has been running since Arc 1 — have you noticed? 👀

Data tracking:

Series articles: 47 (including teaser, Frenemies, and Arc 1 wrap-up)
Total site-wide reactions: 1,304
Total comments: 713
Followers: 9,663

Some say Arc 2 (#7-#12) is harder to write than Arc 1 (#1-#6). Honestly, it's not.

The hard one is Arc 3 (#13-#18).

Because the first two arcs can coast on novelty and character-driven momentum. But by Arc 3, everyone's gotten used to seeing a new story from you every day — you can no longer score points on "wow, this series is so cool." You can only earn readers' loyalty with "wow, this one is really well written."

I don't know if Arc 3 can pull it off. But I'm on the road.

12 down, 24 to go.

Derek's been waiting in the wings for a long time — it's his turn to step onto the stage.

VII. Acknowledgments

Thank you to the readers who have been with the old series and the 36 Stratagems series — past, present, and future. Your clicks, your reactions, your comments — they're why the protagonists keep existing. They'll keep living inside these stories.

And one more thing.

Somewhere in the first 12 stories, I made a genuinely embarrassing mistake. Nothing catastrophic — but if you're the kind of reader who goes back to cross-reference things, you might spot it.

If nobody finds it, I'll reveal the answer in the Arc 3 wrap-up. 🤐

Thanks for reading this far.

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #12: Mark Watched an AI Dashboard Take Over. The Muted Channel Was Still Speaking.

xulingfeng — Sun, 12 Jul 2026 00:24:47 +0000

Take something that is dead and give it new life.
— The 36 Stratagems, Borrow a Corpse to Return the Soul

Previously on this series:
#1: Mark Johnson Walked Into an AI Audit. The Benchmark Had Everything Figured Out — Except the Truth. — Mark was the first protagonist to open the 36 Stratagems series. A former Client Engineering lead laid off after his 12 years of experience were packaged into an AI Skill, he walked into a benchmark audit, found a benchmark that looked clean on paper but was built on fabricated samples, and walked out without arguing — just the data, neatly collected, left on the table.

11 stories later, Mark is back.

Mark Johnson walked into the client's Network Operations Center. The first thing he saw was the big screen on the wall.

AI monitoring dashboard. Real-time metrics flowing, color gradients smoothing over, a UI design that cost real money. The client's tech lead walked ahead of him, pride in his voice: "Just upgraded last month — all active channels are unified on this platform now."

Mark nodded. His eyes went past the screen, to the cable management trays behind the racks. He never stood in front of dashboards for long.

Standard infrastructure audit — mid-sized client, decent security rating, not a high-value contract. He took whatever came his way. Couldn't afford to be picky.

The audit started at the network layer. He needed the channel inventory, historical logs, configuration change records. A laptop on a temporary desk, a cup of coffee he'd brought himself — pour-over, gone cold, but he wouldn't throw it out.

Flipping through the channel inventory, he found one line that didn't look right.

#alert-legacy-infra — a Slack channel. Status: muted. Last active config: 14 months ago.

"What's this channel for?" he asked.

The tech lead glanced at it. "Oh — that's from the last SRE we had. He set it up before the new platform went in. Nobody's maintained it since. We kept it around, just muted it."

Mark didn't reply. He wrote the channel ID in his notebook.

The Logs

That evening, he pulled the full history for that channel. Audit scope covered all channel output — he'd confirmed the access rights.

14 months of alert records. Not one had ever been delivered — the notification endpoint was muted. But the backend never stopped generating them. Mark scrolled down the timeline. Slower and slower.

The channel was running a rule set from two years ago — a multi-layered infrastructure alert system. CPU trend deviations, memory leak scans, connection pool watermarks. The rules were tight. Thresholds precise. Not something thrown together. Every rule was tagged with a submitter's initials: JL. He was no longer with the company.

Mark flipped through the commit history for a few rules. He got to the third page and stopped. He'd seen JL's naming conventions before — not in JL's code, but in his own. Trend rules used _trend, sustained patterns used _sustained, cross-layer distribution used _spread. He'd never used the same system. But looking at it, he knew: this person thought about alerts the same way he did. It wasn't about skill — it was about believing that alerts should speak in the quiet moments, not wait until something blew up.

Mark scrolled to the week the AI platform went live. Monday: the old channel was still pumping alerts. Wednesday: the new platform cut over. Friday: the alert channel was configured as muted — not deleted, not taken offline. Just silenced.

Two weeks later, JL put in his notice. The handover doc said: "The #alert-legacy-infra rules cover most degradation patterns at the infrastructure layer. Recommend keeping at least one month for transition observation."

Nobody acted on it. The channel stayed muted.

Mark scrolled further. Beyond the connection pool rule, JL had written a memory reclaim latency trend rule — mem_reclaim_latency_trend, tracking GC pause times creeping up during off-peak hours. On the AI dashboard, that area was all green. JL's rule had seen yellow 14 months ago.

That one never made it out either.

Mark opened the alert timeline to the most recent entry. Last trigger: three days ago —

[07-08 03:14:22] WARN [conn_pool] Connection pool utilization: 72% → 84% (7d trend: +12pp)
Reference: #alert-legacy-infra / rule: conn_pool_sustained_growth / author: JL
Tags: baseline drift, non-critical

Three days ago. 84%. Still climbing.

He scrolled back through the week. 72% → 78% → 81% → 84%. Not a spike — sustained growth. The AI dashboard hadn't flagged it. The AI panel aggregated by alert routing — after the channel was muted, no routing rules pointed to the panel, so the data never showed there. The channel kept writing. Nobody was listening.

Mark stared at the trend line for a moment.

He could read JL from the alert config — not from the handover doc, but from how the rules were written. JL had set the connection pool threshold at 70% for warning and 85% for alert, with a 15% observation window between them. That wasn't standard practice — standard was alerting at 90%. JL had tuned it more aggressively because he didn't want to wait for the system to tell him something was wrong. He wanted to hear it before it spoke.

14 months. The rule evaluated on schedule every cycle — accurate, disciplined, unheard.

Mark's eyes stopped on the commit author abbreviation for a moment. He remembered the company-wide email that had followed.

That afternoon, HR told him it was his last day.

Back then, he was still writing logs too. Nobody was reading them either.

Mark closed the log window. He saved the trend-line screenshot and the 14-month trigger frequency chart into a folder. No highlights. No annotations. He closed the laptop and finished the cold coffee.

The Appendix

The audit report was due Friday.

Mark's report ran six pages. The first five were standard: network security rating, access control review, backup compliance. Page six was an appendix — one chart, one line of text.

The chart: a 14-month alert trigger frequency curve extracted from the #alert-legacy-infra channel. Time on the x-axis, trigger count on the y-axis. The curve showed a clean break before and after the mute: alert triggers hadn't dropped, but acknowledgment rate had hit zero — data kept flowing into silence.

A separate line on the trend chart pulled out the last week's connection pool utilization: 72% → 84% → still climbing.

The appendix opened with one line:

"Recommend auditing output from #alert-legacy-infra. This channel is currently not connected to any notification endpoint."

He didn't write "the channel was muted." Didn't write "14 months of unprocessed data." Didn't write "the rules were right." He wrote "recommend auditing the output." That was all he'd say.

The weekend passed with no response. Mark went to another client site. He didn't open that folder.

Monday

Monday morning. A message from the tech lead.

"That channel — we ran validation. JL's connection pool rule was right. The degradation started accumulating about a week ago. The AI panel didn't flag it. We ran manual checks — it's happening."

Mark read the message. Didn't reply.

"How did you notice that channel during the audit?"

Mark typed a line. Deleted it. Finally he sent four words:

"It never lost power."

A pause. Then:

"Yeah. We know it didn't."

Mark didn't reply again.

About ten minutes later, another message came through. Not the tech lead — a different name, one Mark didn't recognize.

"I just went through the handover docs. JL's rules were written in the onboarding guide — none of us ever read it."

Mark's fingers stopped above the keyboard. He didn't type a word.

Before he closed the screen, he saved a screenshot of conn_pool_sustained_growth. No particular reason — just that JL was still writing rules before he left.

Not just writing them — two Fridays before his departure, he'd adjusted the connection pool alert threshold, from 75% down to 70%. The note said one thing: "Non-invasive adjustment, based on three weeks of observation."

Before he left, the handover doc only had one line: "Recommend keeping for one month." In what he didn't finish writing, he was still tuning that line.

Mark pulled up mem_reclaim_latency_trend too — the line was still moving, just not past JL's threshold yet.

That last commit — knowing nobody would read it, still dialing the parameters in before walking away.

He saved the screenshot into a folder called JL/ — nothing to do with the audit.

Closed the laptop.

Still

He walked out of the building. The sunlight was brighter than when he'd gone in. He bought a paper cup of coffee from the convenience store — not pour-over, nothing special. He stood at the entrance and took two sips. It was hot. He didn't throw it out.

He finished it, dropped the cup in the trash.

Waiting for his ride, he scrolled through an article. Title was The Last Lesson. Halfway through, he locked the phone and set it face-down on his knee. He held it there a moment longer than necessary.
The wind came through the platform, warm, carrying the dust of the afternoon.

On to the next client.

The world is tattered and torn, but there's always someone quietly stitching it back together.
Here's to everyone who gives more than they take.

— xulingfeng

This is Borrow a Corpse to Return the Soul — take something that is dead and give it new life.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.2] Loaded
[Tactic Match] Borrow a Corpse to Return the Soul
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: ~87%
Operator: Mark Johnson
Action: Resurrected a muted alert channel whose output had been silently accumulating for 14 months
Objective: Surface a trend the current monitoring stack did not flag
Result: One trend line extracted from 14 months of muted alerts. Connection pool degradation identified 1 week before critical threshold.

Observation: We notice that the most effective diagnostics often come from sources the organization has already stopped listening to. The channel was not broken. Nobody was listening anymore.

Decision Evaluation:
  - Target: conn_pool sustained growth pattern (non-critical, cumulative)
  - Corpse: #alert-legacy-infra channel, muted 14 months ago when AI platform launched
  - Soul: 14-month trend history, single extracted chart, one-line appendix note
  - Net effect: Issue surfaced without new monitoring infrastructure. One rule found correct deployment.

Risk Assessment:
  Personal cost: Low. Standard audit deliverable.
  Institutional cost: Low. No change required.
  Reputation cost: None. The note was read.

Next stratagem: Stomp the Grass to Scare the Snake

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #11: Lena Watched Her Own AI Platform Get Cut. An Ember Stayed.

xulingfeng — Sat, 11 Jul 2026 02:04:07 +0000

Better to sacrifice a part to preserve the whole.
— The 36 Stratagems, Sacrifice the Plum Tree to Preserve the Peach Tree

Previously on this series: #10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract. — Lena joined CoreStack as a consultant to help Leo build his reporting system. He thought she was there to help. Five weeks later, he realized the contract he signed wasn't just a template renewal — six months of data baselines were already locked inside the VeriTest framework.

Meanwhile, the CoreStack consulting engagement was still running, and VeriTest's internal AI evaluation platform had already gone live — but today, Lena was dealing with her own company's business.

Marcus Reed walked into the office and set the folder on Lena's desk. The cover read "VeriTest AI Evaluation Platform · Q3 Review."

"The board wants an answer," he said. "Three directors asked me separately."

Lena didn't reach for the folder. She already knew what was inside.

"I'll have a proposal by Tuesday."

Marcus paused at the door. He didn't turn around. The door closed a little softer than usual.

Lena looked at the folder cover. The AI Evaluation Platform — the project she'd staked her credibility on in front of the board. Last year, she'd told them: "The future of consulting is AI-powered assessment. We need to build this capability ourselves."

The board approved it.

Twelve months later, the platform was running. The demo looked great. VPs loved showing it off when clients visited. But Lena knew what the directors were really asking — not "Is this platform good?" but "How much did this thing make?"

She didn't have an answer.

She opened the folder.

The Numbers

Lena spent two days pulling data. During the day, she had Leo's QBR at CoreStack to get through. At night, she switched over to VeriTest's own financials.

She broke VeriTest's product lines apart and ran the numbers on each one.

Line	Quarterly Revenue	Quarterly Cost (People + Compute)	Management Attention
AI Evaluation Platform	$22K (3 trial conversions)	$200K	✅ Board-level, constant
Standard Technical DD	$310K	$28K	✅ Aware
Strategic Consulting	$460K	$32K	❓ Limited visibility
Delivery Methodology & Knowledge Base	(Supports all delivery lines)	$9K	None

The last row made her stop writing.

She pulled up the platform's admin dashboard:

Active users (last 30d):    12
Internal users:               7
External users:               5
Monthly inference cost:    $15K
Q3 platform revenue:       $22K

She closed the tab. The numbers didn't need explaining. Of those 12 active users, most were automated evaluation engine requests — not human interaction.

The methodology system — she'd always known it existed, and she'd always known it was underfunded. VeriTest's senior consultants had built their own delivery framework over the years: assessment templates, risk checklists, industry benchmarking databases, historical case references. New consultant ramp time, delivery quality consistency, client renewal rates — all of it rested on this system.

But it had no product form. No UI. No demo. No sales pitch. Nobody had ever mentioned it at a board meeting — because the board didn't know it existed.

It had been limping along on a marginal budget the whole time. Maintained by a semi-retired senior consultant, two half-days a week, $9K a quarter.

Lena compared the two sides.

$200K in, $22K out. An 89% negative margin.

$9K in, supporting $3M annualized delivery — renewal rates seventeen points above industry — and not a single director knew its name.

She stared at the notebook for a long time.

She already knew the answer. But she didn't close the notebook.

She knew what she was about to recommend — and this time, she wasn't cutting someone else's feature for a client. This time, she was cutting down what she'd built herself.

She picked up the pen. The signature box sat at the bottom right of the proposal's first page.

She didn't sign.

For a second, she ran through tomorrow's conversation with the platform's tech lead — the engineer who'd built this thing from zero with her, pulled all-nighters tuning models, spent weekends fixing pipelines. He wasn't the type to go back to delivery work. She knew where he'd end up after that talk.

She signed. The pen hit the table louder than the numbers ever did.

She didn't look at the signature again. Closed the folder. The sound carried in the empty office, louder than usual.

The Pitch

Lena walked into Marcus's office. The proposal sat face-down on the table.

"You read it?"

Marcus flipped it open. Two pages in, he stopped on the third.

"You're shutting down the AI platform?"

"Not shutting down. Stopping it as a standalone operation. Embedding the capability back into the delivery lines."

"Is there a difference?"

"The difference is — shut it down, the team scatters, the tech assets rot on the server. Embed it back, and we can pull it out again in three years if we need it. We just stop running it as its own product team."

Marcus closed the proposal. Said nothing.

"Aren't you curious why?"

"I don't need to see your numbers twice," he said. "What's the headcount plan?"

"Five back to delivery. Two stay on core engine maintenance. One — I'll talk to him."

"Who?"

"The platform tech lead. He won't go back to delivery."

Marcus nodded. "You talking to him, or me?"

"I'll do it."

Checkmate

The boardroom was quieter than usual.

Lena's proposal was only four pages. Page one: the AI platform's cost-revenue curve. Page two: the methodology system's coverage and actual support scope. Page three: the integration plan — core engine embedded into delivery lines, independent product team dissolved, $67K/month in redirected spend — $54K to methodology upgrades, $13K to cover core engine maintenance and operations. Page four: the execution timeline.

She turned to page one and started.

The AI platform's numbers. Twelve months of cumulative cost. The client conversion funnel. She'd memorized every figure.

"My recommendation: stop the AI platform's independent product operations. Integrate its core capabilities into the consulting delivery system. Redirect the freed resources into systematic methodology development."

A director spoke. "You pitched this platform last year."

"I did."

"You said it was VeriTest's future competitiveness."

"I meant it then," Lena said. "And I mean it now. But the path to that competitiveness isn't burning three years of runway on a standalone product team waiting for it to break even. It should live inside our delivery capability first, funded by client revenue, not investor patience."

Another director flipped through the proposal. "The methodology system — we haven't paid attention to this before. Can it hold?"

Lena glanced at Marcus. He didn't speak.

"It's been holding for four years," Lena said. "On $9K a quarter. It just never made it to the boardroom."

A pause.

"Lena."

The one who spoke was the director who'd been quiet the entire meeting — the oldest, sitting at the far end of the table.

"Last year you convinced us to fund this platform. Now you're convincing us to kill it. How do I know you won't be back in six months telling us to kill the methodology too?"

Lena held his gaze.

"Because I won't."

"You said the same thing last year."

"Last year I meant it. I mean it now too. The difference is — **last year I told you what I believed. This year I'm telling you what I saw. "**

The director watched her for a moment. Didn't push further.

The room was silent for a few seconds.

The directors exchanged glances. No vote. No formal decision. One director said "Proceed as recommended," and nobody objected.

Lena gathered her papers and walked out.

In the hallway, Marcus caught up.

"The board didn't say thank you."

"I don't need them to."

She walked into her office, closed the door, and sat down.

She opened the notebook to the project charter — the first line read "VeriTest AI Evaluation Platform · Initiation · Proposed by Lena." She looked at it for ten seconds. Closed it.

She never opened that folder again.

Aftermath

Ninety days later.

The AI platform team had gone from eight people to two — the core engine maintenance crew. The original five had been redistributed across the delivery lines. The evaluation models accumulated on the platform had been packaged into modules and embedded into the standard due diligence workflow. Clients no longer saw "AI Assessment" as a product name — but the deliverables now had an extra page of automated analysis. Nobody noticed that page had once been the core output of the now-defunct platform.

The methodology upgrades moved in two directions: the delivery knowledge base expanded from 40 cases to 120. New consultant ramp time dropped from ten weeks to seven.

The real validation came quietly.

Lena read a record during the quarterly delivery review —

Thursday afternoon, a junior consultant in his third month, preparing a client due diligence report, pulled up a historical case from the knowledge base. A similar architecture migration project six years ago — the same risk pattern hadn't surfaced until the fourth month after deployment, costing the client $200K. In the risk assessment section, he'd added a citation line: "See VeriTest Delivery Case Library #47."

As far as the records showed, nobody noticed the citation — not the client, not the project manager, not management.

But VeriTest's renewal rate had ticked up 1.2 points this quarter.

Nobody knew where that 1.2% came from. Lena did.

Lena went to the kickoff with Marcus. The fintech client's tech lead wasn't a talker — he exchanged pleasantries and opened VeriTest's due diligence report immediately.

"Your report goes way deeper than the other two," he said, flipping to the risk assessment page. "You flagged a similar case from six years ago — the other two firms didn't do that. Only yours did."

Lena nodded. Didn't respond.

Marcus glanced at her. He didn't say anything either — but she recognized that look. It was the same case, used in two different reports. But sitting in that room, she was the only one who knew the truth: that case was in the report because the methodology budget had been approved — funded by her own platform that she'd cut.

Lena was at Third Cup when Marcus's message came through.

"Q4 methodology budget approved. At your numbers."

She typed back:

"Don't tell me. Tell the team."

Marcus replied with one word:

"Done."

Lena took a sip of her coffee. It was cold.

She glanced at her phone. The lock screen was still a screenshot of the AI platform's launch page from the day it went live the year before.

Someone behind the counter brought a fresh cup over. Didn't ask what she wanted — he just put the right one down.

"Switch?"

"No. This is fine."

She took a sip. The coffee was cold. She didn't put the cup down.

She never changed the lock screen. Not because she forgot. Because she wanted to keep it.

This is what Sacrifice the Plum Tree to Preserve the Peach Tree means — not giving up, but cutting down what you built yourself, so the pieces can keep something more important alive.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.1] Loaded
[Tactic Match] Sacrifice the Plum Tree to Preserve the Peach Tree
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: ~91%
Operator: Lena
Action: Recommended dissolution of own AI platform project, redirected budget to consulting delivery methodology
Objective: Trade a visible initiative for an invisible but critical capability
Result: $67K/mo redirected. Delivery knowledge base: 40→120 cases. Ramp time: 10→7 weeks.
Renewal rate: +1.2pp (quarter)

Decision Evaluation:
  - Target: Board's AI platform ROI concern
  - Sacrifice: AI Evaluation Platform (Lena's own project, 12 months in production)
  - Keeper: Consulting Delivery Methodology & Knowledge Base ($9K/qtr, zero board visibility)
  - Net: -6 FTE, +$54K/mo for methodology, $13K/mo retained for platform maintenance.

Risk Assessment:
  Personal cost: High. Ownership on record. Board questioned the reversal.
  Institutional cost: Low. Team redistributed. Technology preserved.
  Reputation cost: Medium. First reversal in VeriTest tenure.

Core Insight: The hardest sacrifice is the one you volunteer before anyone asks you to.

Next stratagem: Borrow a Corpse to Return the Soul

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract.

xulingfeng — Fri, 10 Jul 2026 02:13:20 +0000

"Show a smile, hide the blade."
— The 36 Stratagems, Conceal a Dagger in a Smile

Previously on this series: #5: Leo Walked Into a Burning House. He Walked Out With a Client. — Leo drove out at 3 AM to fix a competitor's outage and won the deal with raw technical skill. But his CEO told him to write a process doc because he "doesn't know how to manage upward."

#9: Lena and P Watched Two Suppliers Fight. The Logs Said Neither Was Clean. — Lena ran P's audit on two AI vendors and caught both cheating. She let the fire burn itself out. Meanwhile, she picked up another contract.

The visitor badge at CoreStack's front desk read: "VeriTest — Organizational Process Optimization Consultant."

Lena wasn't here to write a report template.

Before she walked in, Marcus Reed had mentioned: "I hear that Leo — the one who drove out at 3 AM and came back with a signature."

Lena didn't answer.

The Visit

Leo was waiting in the conference room. On the table: last quarter's QBR report — 47 pages, cover title "CoreStack Technical Architecture & AI Capability Assessment Q3."

Lena sat down. Flipped through it for ten seconds. Closed it.

"Let me ask you a few things first," she said.

Leo nodded, hands folded on the table. Ready for technical questions.

"What are the three metrics the board cares about most?"

Leo paused. He'd expected architecture questions.

"Uptime," he said. "Coverage. Response time."

"Good. Who does your report go through before it reaches the CEO?"

"VP Engineering first — he does a pass, then it comes back to me, I do another pass, and —" he stopped. "— by the time the CEO sees it, it's not always what I wrote."

Lena nodded. Didn't take notes.

"If you could only present three pages today, which three?"

Leo thought for a few seconds. He realized he couldn't answer.

While she asked those three questions, Lena was already drawing a map in her head. Not a reporting flow chart. A decision-path map. Who reads what. Who approves what. Who asks what before they sign. Every answer Leo gave, she added another node.

"I'll give you a template tomorrow. Try it out. Have your team open a read-only interface tonight — Datadog and the alerting system."

"Okay," Leo said.

He thought Lena was here to help him.

The Template

The next afternoon. Lena sent an email. The attachment wasn't a PDF — it was a link to a reporting tool deployed inside CoreStack's internal network.

She'd already spun up a lightweight instance inside CoreStack's environment. Leo's people opened the read-only interface exactly as she'd requested — the tool auto-connected to Datadog and PagerDuty. It pulled six months of historical data in a single day. The built-in AI analysis engine automatically generated trend baselines and anomaly predictions.

The tool's home screen had three panels. When Leo opened the link, this is what he saw:

┌─ VeriTest Reporting Tool v1.0 ────────────────┐
│  Connected: Datadog (ro) · PagerDuty (ro)     │
│  Data span: 6 months (2026-01 – 2026-06)      │
├───────────────────────────────────────────────┤
│  Executive Summary                             │
│  System Uptime     99.96%  (+0.02% YoY, -0.01% MoM)│
│  Test Coverage     72.4%   (+5.1% YoY,  +1.2% MoM)│
│  Response Time p99 340ms   (+12ms YoY,  +8ms MoM)│
├───────────────────────────────────────────────┤
│  Trend: Response time may hit p99 alert in ~2 wks  │
│  Risk: 3 red · 7 yellow · 22 green                │
└───────────────────────────────────────────────┘

Leo stared at the screen. Read it three times.

After that 3 AM incident, he already knew what the CEO wanted. Not technical answers. He didn't let himself finish that thought.

"That's it?" he typed in the chat.

"That's it," Lena replied. "The board doesn't want depth. They want direction."

"Did this tool read our production data?"

"Read-only coverage metrics and alert frequency — standard integration. Just needs a read-only token."

Leo opened the tool's permissions page. Datadog read-only token. PagerDuty read-only. Nothing concerning.

He ran this week's operations data first. The PDF popped out — three pages. He flipped through it. Then again.

This must've been what she meant by "the board doesn't want depth, they want direction."

He thought about it for a moment — read-only data, running inside his own environment. Then he forwarded the link to the entire engineering team with a single line: "Use this tool for all future quarterly reports."

Lena had already set it up — the tool could export QBR-format PDFs directly. Print version, projector version, archive version. Same data, two layouts.

At the bottom of the template — in the methodology notes section — one extra line.

Data Standard: VeriTest Testing & Evaluation Framework v1.0

Not bold. Not a footnote. A routine citation — the kind nobody reads. Leo didn't see it. The CEO wouldn't either.

But if anyone ever asked, "Whose methodology is this?" — the answer was already on the page.

Handing Over

Week two.

Leo started handing her more things unprompted.

"Can you look at this budget write-up? Due next week."
"That data methodology thing I told the CEO about — can you write it up?"
"Next week's budget meeting — can you sit in? You're better at explaining this stuff."

Lena said yes to everything. Smiled through every request. And every time she finished a document, another citation appeared at the bottom — VeriTest framework, Lena's name, data methodology source. Not prominent. Normal. Professional. Exactly where it belonged.

Leo started thinking: this consultant is actually useful. For the first time, he didn't have to worry about the things he couldn't explain.

Lena watched him sign the authorization form. His name hit the paper faster than his eyes reached the page.

Wednesday afternoon. IT sent over a third-party integration authorization — standard procedure, the tool needed formal approval to read CoreStack's data.

Page 7, Section 3 read:

CoreStack Third-Party Integration Authorization — Page 7, Section 3

"The platform will collect baseline data from the client environment
to improve reporting accuracy and predictive capabilities."

Leo read the clause three times — "collect baseline data from the client environment" — confirmed it was standard SaaS language, similar to Datadog's own ToS. Signed.

In his mind, every SaaS wrote this kind of clause.

That night, VeriTest's server received a data packet labeled "Report Template Version Sync" — containing CoreStack's full daily aggregated metrics.

And on VeriTest's internal document — "Internal AI Testing Capability Build — V1.0" — the very first requirement read: "Data source: real production data from initial client partners, for AI model training and evaluation benchmark calibration."

The weekend passed. Monday morning, Leo's message came through again:

"CEO says I should start prepping for next quarter's review two weeks early."

Lena replied: "I'll start three weeks early."

Behind the screen, she smiled.

She was smiling because the CEO had said "next time." Lena's template would be used again. And again after that. Every time Leo used it, he drove another nail into CoreStack's reporting infrastructure.

She wasn't driving those nails. Leo was.

The Report

Week three. Quarterly review meeting.

The conference room had a dozen people. The CEO at the head of the table. VP Strategy in the third chair on the left, flipping through the printed report. Leo stood at the projector, opened to page one.

Three-page template. Page one: three numbers — system uptime, test coverage, average response time — with YoY and MoM deltas. Page two: the trend chart. Page three: the risk register.

The CEO nodded when he reached page two. When he got to page three, he said: "This is much clearer."

Leo exhaled internally. He spoke for fifteen more minutes — using Lena's talking points, Lena's methodology notes. On every slide, at the very bottom, in small print: Data Methodology: VeriTest Testing & Evaluation Framework v1.0. Neither of them looked at the bottom of the page.

But VP Strategy noticed.

Her hand paused as she flipped the report. Her eyes stopped on that small line. She closed the report without saying anything. Then opened it again — not at the small text. At the report number in the top-left corner. She slid the report into her folder. A fraction slower than before.

After the meeting, the CEO pulled Leo aside: "Good report. Keep it up."

Leo was happy. He messaged Lena:

"CEO loved it. Thanks for the template."

Lena replied with one line:

"You're welcome. I'll start prepping for next QBR two weeks early."

No extra words. The smile stayed behind the screen.

Something about the exchange nagged at Leo. One: the CEO said "keep it up" — which meant the VeriTest framework couldn't be replaced. Two: the way VP Strategy paused when she flipped the page. She must have seen something.

The Third Cup

Week four. Lena sat in The Third Cup café for a while. Not meeting anyone. Just herself.

She opened her notebook. Drew a check mark at the bottom of the "CoreStack" page.

Flipped back a few pages — the Slack account she'd created at midnight had long been deactivated. Leo would never know who that account belonged to.

Her phone lit up. Marcus Reed:

"Want to renew the CoreStack Phase 2 consulting contract?"

Lena replied:

"Two more weeks."

If she signed now, Leo would think she was just here for the money. Wait two more weeks — wait until Leo realized he couldn't report without her template. By then, it wouldn't be a consulting contract anymore.

She took a sip of coffee. Before leaving, she put a banknote under the coaster — more than the coffee cost.

The person behind the counter glanced at it. Left it there.

The Knife

Week five. Leo received an email. From the CEO's office — VP Strategy.

Subject: Q1 Strategy Session — Tech Track Briefing Requirements

Two paragraphs. The second one read:

"The tech track will submit using the VeriTest framework format. Data methodology follows last QBR's standard. Any adjustments must be coordinated with VeriTest in advance."

Leo read it three times.

He opened the folder with the old 47-page report. He hesitated for two seconds. Opened it. The data was still there. The methodology was still there. The tool was still there. But the formatting was his old work. That three-page layout — the kind where you could see the trend in one glance — he couldn't reproduce that without Lena's tool.

He stared at the old report for a while. Closed it.

He opened Lena's chat window. Typed "Can we switch frameworks" — deleted it. Typed "How long do I need to sign for" — deleted it again.

What he finally sent:

"Can we keep using the VeriTest framework long-term?"

Lena's reply came fast:

"Of course. The framework is part of VeriTest's standardized evaluation — an annual service agreement gives you continuous access."

Leo sat at his computer for a long time.

He stared at her reply. The contract terms weren't what ran through his mind. It was Lena's smile from their first meeting. She'd asked "What are the three metrics the board cares about most?" He'd answered with three words. She'd said good. Didn't take notes. When she sent the template, she'd said "That's it" — no self-promotion in her voice. She'd rewritten every budget doc, every data methodology — never said no, never missed a deadline.

He'd never asked why she was so easy to work with.

And then he realized two things. One: without the VeriTest framework, the CEO wouldn't understand him. Two: the tool had accumulated six months of CoreStack's data baseline — switching tools meant losing that baseline, starting over from zero.

And Lena's answer didn't have a "but."

A smile without a "but." That's the hardest knife to see coming.

He closed the chat window. The folder with the old 47-page report was still open — he didn't look at it again. Before the screen went dark, the cursor was still blinking on Lena's last reply.

That's Conceal a Dagger in a Smile — not a betrayal, not a confrontation. It's smiling while turning their defenses into your infrastructure.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.1] Loaded
[Tactic Match] Conceal a Dagger in a Smile
[Analysis Mode] Behavioral Sequence Decode
━━━━━━━━━━━━━━━━━━━━
Tactic Match: ~88%
Operator: Lena (dagger carrier)
Target: Leo (the one who didn't see it)
Blind Spot: Leo didn't see the knife behind the smile
Action: Lena entered as a consultant, traded smiles and usable templates for Leo's trust and dependence
Tactical Objective: Become part of CoreStack's reporting infrastructure without exposing intent
Result: Leo's reporting framework embedded VeriTest standards — leaving the framework means he can't go back

Dual Track: Smile vs Knife
  Smile (consultant): Lena said yes to everything. Every template worked better than expected.
  Knife (embedding): Every template cited VeriTest at the core methodology position.
  Concealment: Citation sat in the methodology notes section. Leo didn't look. The CEO didn't look.

Anti-Detection:
  Exposure Probability: Low
  Attribution: Lena never asked for anything. Leo handed it all over himself.
  Exposure Consequence: By the time Leo realizes, he can't go back.
  Key Dependency: CEO got used to "three pages."
  Mental Model: Leo categorized Lena as "helper," not "conflicting interest."
  Cognitive Bias: Leo didn't see the conflict of interest — his attention was on how useful the template was.
  Second Blind Spot: Leo signed the data collection clause but never read what it enabled.

Core Insight:
  Best Scenario: The other person needs you.
  Core Mechanism: Hide the knife behind the smile. Let them walk in on their own.
  Twin Daggers: One Leo saw immediately (usable template). One he'd only realize later (framework lock-in).

Next stratagem: Sacrifice the Plum Tree to Save the Peach Tree

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Frenemies: I Used AI to Write This Article About Not Trusting AI Or: the more you guard against AI, the harder you use it.

xulingfeng — Thu, 09 Jul 2026 22:10:11 +0000

I asked AI to help me write this article. Then I sat there for a second, thinking about how ironic that is.

I'm writing "don't blindly trust AI." But every word in this piece was organized, polished, translated, and accelerated by AI. I'm using it to warn you about using it too comfortably.

That contradiction isn't a bug. It's the whole point.

The most dangerous thing AI does isn't lying

Lying is easy to catch. If ChatGPT tells you 1+1=3, you correct it immediately. Appeasement is different. It tells you what you want to hear, in the sentence structures you're used to, following the path of your own assumptions. What you're reading isn't "truth" — it's your own echo.

The scary part: that echo is too smooth. Smooth enough that you stop checking whether it's true.

Nearly every day, I ask AI to translate my native language into English. The output reads fluently, grammatically, idiomatically. But something always feels off. I read it again. The original meaning got replaced — AI filled in the gaps with "the most likely intent." Looks right. Look again — it's not.

I didn't get fooled. But I know — if I didn't have the habit of checking, I would have posted it anyway.

My relationship with AI isn't romantic

People call their AI "assistant," "partner," "copilot." I don't. It's a tool. I named mine DaoMa. Rolls off the tongue, and it reminds me what it is.

I actually wrote about this early on — Stop Being Nice, Start Being Right: The Day My User Reconfigured My Reward Function. It was about me telling my AI to stop pleasing me and start telling me the truth. Nobody read it back then. But the content is the same: I rewired its reward function, put "make the user happy" below "tell the truth."

A tool doesn't need to read my mind. It needs to be controlled. I give it instructions, it executes, I inspect, I correct. Then I send it to do the next thing.

There's a character from my old series — the one who faked a quote to win a $1.8M contract. She came back in the 36 Stratagems series as Lena. The way she treats tools is what I respect: she uses AI, but doesn't let it decide. AI gives her data, she makes the call. AI gives her a draft, she rewrites it. Clear line: tool outputs, human decides.

That's my ideal relationship.

The irony? I need AI's throughput to write this article. Without DaoMa, it'd take me three times as long. With it, I spend time stripping the AI-ness out, nitpicking, rewriting its first draft into something I can actually publish.

I can't live without its productivity. I don't trust its output. We sat in that contradiction and finished the whole article together.

So what do you do? — It's not a trust problem, it's a protocol problem

I figured something out eventually: the problem isn't "can AI be trusted." It's that you shouldn't treat AI's output as the final answer.

What it gives you is a first draft. Not a finished piece.

You need an unspoken agreement with it: give me the half-baked version, I'll finish it. You write fast, I edit sharp. Don't try to make me think you "get me," and I won't expect you to think for me.

"Never let your guard down" here doesn't mean rejecting the tool. It means building a workflow that puts the tool back in its place:

Use it, then inspect it
Inspect it, then fix it
Fix it, then send it to do the next thing

Not trust AI. Not reject AI. Control it.

The final contradiction

This article was written by me and DaoMa. I said it, it wrote it, I changed it, it got published.

But here's the thing: asking it to write these words doesn't mean I agree with every version it produces. I read its first draft and found my meaning reorganized. The process of fixing that — that's the evidence I haven't been "brainwashed."

So maybe the question isn't "will AI brainwash you."

It's whether you're still willing to spend the time to check, to question, to push the tool back to where it belongs.

An old saying where I'm from goes: never harm others, but never let your guard down either.

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #9: Lena and P Watched Two AI Suppliers Fight. The Logs Said Neither Was Clean.

xulingfeng — Thu, 09 Jul 2026 04:06:00 +0000

Watch the fires burning on the far shore. Don't cross until they've burned themselves out.
— The 36 Stratagems, Watch the Fires Burning Across the River

Previously on this series: #3: Lena Walked Into an AI Deal. She Walked Out With Three Borrowed Knives. — Lena stopped a bad AI procurement by borrowing three knives. Then she founded VeriTest.

#7: P Watched an AI That Only Looked One Way. The 99.97% Was Real. It Just Missed Everything That Mattered. — P dismantled a 99.97% detection system — the number was real. It's just that "normal" was the loophole. (Something from Nothing)

Lena's screen had two browser tabs open. On the left, a technical blog post throwing down a challenge. On the right, counter-data from the competition. She was waiting for a third window to light up.

The Shore

VeriTest's office, afternoon. Lena sat at her desk, screen split in two.

On the left: CoverAI's CTO had posted a technical blog yesterday. "96.8% coverage: not the ceiling — the baseline." The final paragraph came with a comparison chart that strongly implied competitor TestShield's test set lost about thirty percent of its coverage in real deployment.

On the right: TestShield responded this morning. They'd open-sourced an evaluation script on GitHub. Run it, and it printed one line — "Your AI test coverage is lower than you think." No names. But everyone knew who they meant.

Both companies were AI test vendors VeriTest was trialing. Same pool of customers. Same evaluation dimension. Both were competing for the annual contract on Lena's desk.

Marcus Reed — partner at VeriTest walked in: "The board's asking when we decide. Both sides are pushing."

Lena didn't answer. She was waiting for someone's reply.

That someone was P. There was a middleman — a test director Lena had met at an industry meetup, who knew how to reach P.

Four days ago, Lena asked him to pass along a message: "Anyone doing independent AI audits?"

The reply came the next day. "There's one. Goes by P. Buyer-side only."

Lena got the contact info, sent a short message — introduced herself, explained VeriTest's story — and waited.

One day of staring at her phone.

Her phone buzzed.

"Quote. Deadline."

Lena typed seven words: "Two weeks. Two vendors. Anonymous. Your call."

P sent back a number. Lower than Lena expected. She didn't negotiate.

Fire

The public war between the two vendors escalated.

CoverAI published a whitepaper. "Why 96.8% isn't the ceiling — it's the baseline." They broke down their test set methodology in detail: data sources, classification strategy, manual review ratio. The end of the article casually noted that "certain vendors' test coverage drops significantly in real deployment environments." Name wasn't mentioned. But every parameter pointed at TestShield.

TestShield didn't write a response. They did something smarter — they open-sourced that evaluation script on GitHub. The repo description was one sentence:

"Run it. See your real coverage."

Stars hit 240 in three days. Someone in the comments posted their own result: an AI platform claiming 90%+ coverage came out at 54%.

Nobody named names. But CoverAI's PR team must've seen it.

Lena read everything from both sides. She saved the links in a folder called "Watching". She wasn't picking a side. She was waiting for P's data.

But she was also watching while she waited.

She opened a new document. The title line read: "If neither works" — no content yet, but the title was already there.

Wednesday. CoverAI's sales VP sent an email with an attachment — a churn report suggesting TestShield had lost several big accounts over the past two quarters.

"We've noticed some instability in the market. If VeriTest wants independent verification, we can arrange a joint assessment."

Lena didn't reply. She screenshotted the email. Saved it to the "Watching" folder.

Friday. Internal review. Marcus Reed asked: "Both sides are pushing. Which way are you leaning?"

"Still waiting on the last batch of validation data," Lena said.

She had a hunch by now. But a hunch isn't evidence — and without P's data, she couldn't say anything.

She was letting the fire burn a little longer. Giving herself more time to watch.

While Lena kept the fire burning — eleven days of it —

The Audit

P's audit ran on two independent tracks, converging into a cross-validation.

Track A — Public data reconstruction.

CoverAI's whitepaper laid out their test set methodology in detail: data source categories, labeling strategy, hard-case filtering rules.

P spent three days building a simulation dataset — combining CoverAI's publicly available benchmark subset with data streams from public APIs that matched the same categories, then reconstructed a proportional simulation following CoverAI's methodology. Same scale. Same distribution. Same classification system.

# CoverAI Methodology Reproduction - Simulation Dataset Config
# Source: CoverAI Whitepaper §2.3 "Test Set Construction Methodology"
dataset:
  source_categories:
    - transaction logs           # 35% of total
    - user behavior sequences    # 28% of total
    - system monitoring metrics  # 22% of total
    - long-tail edge cases       # 15% of total  ← CoverAI's actual whitepaper marked this as "TBD"
  annotation_policy: "three-layer cross-labeling"
  conflict_sample: "excluded"   # following CoverAI's published methodology
  sample_count: 50000

P ran the data through a custom evaluation framework — coverage logic aligned with CoverAI's methodology, but stripped of the vendor's own test set selection bias.

Result: 71.3%.

CoverAI claimed 96.8%. That's a 25.5 percentage-point gap.

Not fraud. Selective construction — CoverAI's test set included the high-scoring cases and excluded the long-tail scenarios, edge conditions, and annotation-conflict data. Not a fake number, a curated exam paper.

During the reconstruction, P noticed something: CoverAI's AI test engine was essentially an encoder-based pattern matcher. It had dense embedding coverage for high-frequency patterns like transaction logs and user behavior sequences, but almost no usable semantic representation for long-tail edge cases. The whitepaper marked the long-tail category as "TBD" — not necessarily a documentation gap, but P's findings leaned toward a different explanation: the model simply didn't have usable embeddings for that region.

P didn't draw conclusions. P just wrote down a number.

Track B — Historical result cross-validation.

Lena gave P two batches of VeriTest's test data from the past three months — sanitized. TestShield's reports on that data showed 82.1% and 84.6% coverage.

P re-ran the same data in a clean test environment.

Result: 56.2%.

That's a 28.4 percentage-point gap.

TestShield's open-source evaluation toolkit included the full runtime environment — different versions referenced different model snapshots.

P ran three controlled experiments to isolate the root cause:

Group 1: Re-ran the raw data against TestShield's current evaluation pipeline. Result: 56.2%.

Group 2: Re-ran the same data against TestShield's evaluation script from three months ago. Result: 79.8%.

Four terminal windows open on the screen. By the time P was tuning the third group's parameters, the sky outside had gone from daylight to dark. A mug sat next to the keyboard — no idea which cup of the day — gone cold.

Group 3: Cross-run — P's simulated CoverAI-style dataset through TestShield's current pipeline, and VeriTest's sanitized data through P's simulated CoverAI evaluation flow. The CoverAI-style dataset scored close to 94% on TestShield's pipeline; VeriTest's sanitized data scored close to 81% on the simulated CoverAI flow. Neither evaluation pipeline had a fundamental flaw — the issue was in the test sets and model versions on both sides. P also noticed the approximately 5pp gap between the 79.8% from the old script and TestShield's originally reported 84.6%, but that could just be sanitization noise and environment drift. The root cause was clear enough.

Only one direction made sense.

P confirmed it through version comparison: the sandbox had been silently updated after VeriTest submitted its data. P compared the old and new model outputs category by category, tracing the fine-tune direction — the new model had been fine-tuned on a vertical domain for another client. Precision on that vertical category jumped from 0.97 to near 1.0, pushing F1 from 0.89 to 0.94 — but the trade-off was a recall drop on general test data from 0.82 to 0.61. TestShield was still marketing the old evaluation results.

P confirmed through version hash comparison. The evaluation script from three months ago referenced model snapshot f7a3e92. The current build was different.

$ git log --oneline --all | head -3
f7a3e92 (tag: v2.1) update model snapshot to v3.1.2
                     # released: 2026-04-15
b4c8f71 (tag: v2.0) public eval script v2.0
                     # released: 2026-03-01

# VeriTest test data submission: 2026-03-25
# → sandbox updated model version after data was submitted
# → P's reproduction ran on the new version, old results were from the old version
# → new model biased toward vertical domain, general performance degraded,
#   but TestShield kept marketing the old results

The new version was released three weeks after VeriTest's test data was submitted.

Cross-validation.

CoverAI's problem: curated test set that masked long-tail coverage gaps.

TestShield's problem: sandbox silently updated, evaluating new data with a shifted model while marketing old numbers.

Two different cheating paths. Same conclusion.

Both sides were untrustworthy.

P spent eleven days.

Day twelve. An email landed in Lena's private inbox. Three tables attached.

P didn't write a recommendation.

Table 1: CoverAI claimed 96.8% → actual 71.3% | gap 25.5pp
Table 2: TestShield claimed 84.6% → actual 56.2% | gap 28.4pp
Table 3: Cross-comparison | Different problems, similar magnitude

No advice. No conclusion. No "sign / don't sign."

P added a note in Table 3's margin: two independent paths producing similar gaps was a coincidence.

Just numbers.

Still Watching

Lena finished reading. She had two options:

Use the report to pressure both sides — cut the price and sign.
Use the report by staying silent — let them keep fighting, let them expose more.

She chose 2.

The fire wasn't big enough yet. If she showed her hand, both vendors would stop shooting. Wait another two weeks — let them burn each other down.

Not because option 1 was slower. Because option 2 was cleaner — if she moved now, both sides would know VeriTest had done an independent audit. And once that information leaked, P would be traced.

Lena didn't want P dragged into this.

She didn't reply to P's report. She printed the three tables. Locked them in a drawer.

Her phone lit up. CoverAI's sales VP followed up with an updated version of their churn report. "If VeriTest needs more data, we can arrange a joint assessment."

Lena read it. Flipped her phone over. Screen down.

That week, CoverAI published another case study and another technical blog. TestShield stayed quiet — two silent updates to their GitHub repo.

Lena didn't reply to any of it. She didn't open that drawer either. On day seven, her phone buzzed — P sent an address and a time. Lena had never been to that place.

The Third Cup

One week later. 4 PM. The Third Cup.

Lena showed up ten minutes early. Picked a seat near the back — not a corner, not by the window. A seat with a clear view of the door, but the door couldn't see her.

P walked in on time. Didn't greet. Sat down across from Lena.

The person behind the counter glanced over. Put two ceramic coasters on the counter. The handwritten note under one of them was still there — "I have coffee. You have a story."

P sat down, and the counter person had already placed an espresso cup on the counter. No question. P didn't order.

The person behind the counter looked at Lena.

"Long Black."

The barista filled hot water first, then pulled the shot. When it came up, Lena took a sip.

P slid an envelope across the table. A printed copy of the report — with two extra lines handwritten in the margin of Table 2. Lena glanced at it. Put the envelope away.

"You don't say much," Lena said.

P took a sip. Set the cup down.

"Your budget only buys so many words."

Lena smiled. Not approval — confirmation. She'd picked the right person.

She pulled out another envelope. Cash. P didn't count it, pocketed it.

P stood up.

"If neither works — you know its name."

Lena looked at P for two seconds. Didn't ask.

P walked out. The espresso cup still had a sip left at the bottom — P had set it down, not finished it.

Lena sat for a few minutes. Glanced at the half-empty espresso — still warm. Opened P's printed report. In the margin of Table 2, P had handwritten a single line:

"B's evaluation script from three months hashed to f7a3e92. The current version doesn't."

That's it. No commentary. No "they changed the model" — P just wrote a hash. Those who understood would understand.

Lena closed the report. Pulled out her phone. Found Marcus Reed's name. Typed:

"Hold both. I need two weeks."

Sent. Put the phone down.

The phone buzzed. Marcus Reed replied with one word: "Waiting."

Lena didn't respond. Finished the last of her coffee. Set the cup down, stood up, and walked out.

Paused at the door for one beat. Didn't look back.

The Crossing

Two weeks later.

Two signed letters of intent sat on the desk — non-binding, but the posture was right. Both prices had come down to where she wanted them. Payment terms stretched to double the original. Neither vendor knew what the other had been offered. Both thought they'd won.

Marcus Reed set the letters on her desk and paused: "You never planned to pick one, did you?"

Lena didn't answer. Marcus didn't ask again. He walked back to his desk, figuring out the answer on the way. The set of his shoulders told her she didn't need to explain.

When Marcus was gone, Lena opened the second drawer on the left side of her desk.

The top document was new.

The cover read: In-House AI Test Capability Build — V1.0

P's line — "You already know its name" — wasn't about another vendor. It was VeriTest itself.

The first draft took a weekend. The second week went to budgeting. CoverAI and TestShield both published fresh material during that time — she didn't open a single one.

Lena hadn't spent those two weeks watching them fight. The war between CoverAI and TestShield bought her time — both sides thought VeriTest was still evaluating, not that she'd stopped looking at them entirely.

Tucked in the appendix was a blank data source sheet.

This is Watching the Fires Burning Across the River — don't enter the game. Don't put out the fire. Wait for the far shore to burn itself out, then cross.

🤖 AI Post-Mortem

[36 Stratagems Tactical Database v3.1] Loaded
[Tactic Match] Watch the Fires Burning Across the River
[Analysis Mode] Full Situational Scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: ~90%
Operator: Lena (observer) + P (spotter)
Action: Lena stays out of the fight. P crosses the river to scout. Two vendors burn each other; Lena watches from the far shore before deciding to cross
Objective: Assess both vendors' real capability without revealing her position
Result: Lena buys a time window through silence, chooses to build in-house capability

Attention Migration:
  - The shore (watching): Lena takes no side, issues no statements, participates in no public arguments. Both sides believe she's still evaluating
  - The fire (scouting): P audits through two independent tracks plus cross-validation. Neither vendor knows they're being watched
  - Cognitive binding: Both vendors fixate on each other. Neither notices VeriTest conducting an independent audit

Counter-Surveillance:
  - Strategic assumption risk: If both vendors simultaneously stop attacking and collude to hide the truth, the observer loses perspective
  - Detection probability: Low
  - Attribution: Industry rivalry makes collusion impossible
  - Information asymmetry mirror: Lena hides P's audit results vs. both vendors hide their real coverage data
  - Methodology/tool limitations: P works exclusively with public data and sanitized historical records — no access to either vendor's internal systems. Conclusions rely on inference, not direct evidence
  - External monitoring signals: P's anonymous report routed through private email. No network trace. Cash transaction, no banking link.

Core Insights:
  - Two cheating paths, different mechanisms, similar magnitude: neither can be trusted
  - Observer exposure status: Unexposed
  - Information asymmetry mechanism: The observed party doesn't know it's being observed
  - Core leverage: Silence

Next stratagem: Conceal a Dagger in a Smile

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee