Uploaded April 2026 | Updated September 2026, 8 hours ago
The recording got a bit goofy at the end, so pardon that. The rest of the conversation was chock full of fun.
Coté did a guest spot on a stream with the Anchore folks and a Bitnami coworker, learned a bunch about software bills of materials, and now wants to put SBOMs on everything. Same week, his demo where Claude was supposed to upgrade an out-of-date Go version fell over. Why? Because an earlier Claude session had invented a version of Go that doesn’t actually exist.
This week @thecote and David Zendzian work through what supply chain looks like when the AI is doing some of the building. @thecote walks through the SBOM crash course - SPDX vs CycloneDX, the Trivy compromise, why Go is “well-behaved” because it’s new, and the unanswered question of how deep your inventory has to go. David, who does this work every day, has the line that lands: “An inventory is not complete if it’s not complete.”
Then they pivot to his datawatch project. In one week it’s grown into a recursive ephemeral agent harness with a PRD writer, ephemeral build containers, eBPF stats per child shell, and the option to run an agent on someone else’s GPU box. The conversation lands on the harder problem behind all this: a demo of agentic work is incredibly boring to watch.
Coté on the Anchore stream: youtube.com/watch?v=m7RfVrN1TUc
datawatch: github.com/dmz006/datawatch
Key topics:
- Why supply chain gets weirder when the AI is the one building things, and why “this version doesn’t exist” is now a normal Claude response
- The Trivy compromise as the canonical “who watches the watchers” supply chain story
- Why Go’s opinionated tool chain makes it the best-behaved language for SBOMs, and why Java is the hardest
- David’s datawatch v4.1 as a distributed harness - PRDs from voice notes, ephemeral build containers, recursive nesting, eBPF per child shell
- “The cloud is just someone else’s computer” - why a personal harness needs the same multi-host bones as a production platform, and why CF push is the right metaphor for borrowing your friend’s GPU
- The boring-demo problem - what to instrument when nothing visible is happening, and why agentic dashboards always end up with a Mario animation
- Token economics as velocity discovery - $100/month is one project, $200 is two, and the ego of staying in the lower tier
- Why specs are the hard part of harness work, not the code
Interested in a platform that can help you with enterprise-y excellence? Just TryTanzu.ai
Tanzu Catsup is a weekly conversation about platform engineering, cloud-native operations, and building software in large organizations…and, of course, AI.
Check us out Fridays at 10am US Eastern/4pm Amsterdam time! In YouTube: youtube.com/playlist?list=PLAdzTan_eSPSlg3nySSAI7DjrbN2Bt56r
Hosts: @thecote and David Zendzian
The recording got a bit goofy at the end, so pardon that. The rest of the conversation was chock full of fun.
Coté did a guest spot on a stream with the Anchore folks and a Bitnami coworker, learned a bunch about software bills of materials, and now wants to put SBOMs on everything. Same week, his demo where Claude was supposed to upgrade an out-of-date Go version fell over. Why? Because an earlier Claude session had invented a version of Go that doesn’t actually exist.
This week @thecote and David Zendzian work through what supply chain looks like when the AI is doing some of the building. @thecote walks through the SBOM crash course - SPDX vs CycloneDX, the Trivy compromise, why Go is “well-behaved” because it’s new, and the unanswered question of how deep your inventory has to go. David, who does this work every day, has the line that lands: “An inventory is not complete if it’s not complete.”
Then they pivot to his datawatch project. In one week it’s grown into a recursive ephemeral agent harness with a PRD writer, ephemeral build containers, eBPF stats per child shell, and the option to run an agent on someone else’s GPU box. The conversation lands on the harder problem behind all this: a demo of agentic work is incredibly boring to watch.
Coté on the Anchore stream: youtube.com/watch?v=m7RfVrN1TUc
datawatch: github.com/dmz006/datawatch
Key topics:
- Why supply chain gets weirder when the AI is the one building things, and why “this version doesn’t exist” is now a normal Claude response
- The Trivy compromise as the canonical “who watches the watchers” supply chain story
- Why Go’s opinionated tool chain makes it the best-behaved language for SBOMs, and why Java is the hardest
- David’s datawatch v4.1 as a distributed harness - PRDs from voice notes, ephemeral build containers, recursive nesting, eBPF per child shell
- “The cloud is just someone else’s computer” - why a personal harness needs the same multi-host bones as a production platform, and why CF push is the right metaphor for borrowing your friend’s GPU
- The boring-demo problem - what to instrument when nothing visible is happening, and why agentic dashboards always end up with a Mario animation
- Token economics as velocity discovery - $100/month is one project, $200 is two, and the ego of staying in the lower tier
- Why specs are the hard part of harness work, not the code
Interested in a platform that can help you with enterprise-y excellence? Just TryTanzu.ai
Tanzu Catsup is a weekly conversation about platform engineering, cloud-native operations, and building software in large organizations…and, of course, AI.
Check us out Fridays at 10am US Eastern/4pm Amsterdam time! In YouTube: youtube.com/playlist?list=PLAdzTan_eSPSlg3nySSAI7DjrbN2Bt56r
Hosts: @thecote and David Zendzian
