Last week I was inside Cloudflare, looking at my own traffic, and I knew exactly what I wanted.

One IP from the Netherlands had thrown 675 requests at my site in a single spike around 5am. The user agent called itself audit scanner or something. It was walking down a list of filenames - .env, .env.local, .env.backup, .env.docker - the way burglars try every door on a street. Classic credential-scanning. I wanted it gone. I wanted to understand a second IP, an Amazon one, that was quieter but odd. And I wanted to stop the pattern, not just the address, because scanners rotate IPs and blocking one is theatre.

I knew all of that. What I didn’t know was where Cloudflare kept the controls, or what Cloudflare called any of it.

So I did the thing all of us now do without noticing how strange it is. I left the product to learn how to use the product. I screenshotted my own dashboard and pasted it into an AI so it could see what I was already looking at. I narrated the numbers out loud to a machine. It wrote me a WAF rule. I copied that rule, clicked back into Cloudflare, hunted down Security → WAF → Custom Rules → Create, and pasted it into the box. Then I went back to the chat to ask about the second IP, and did the whole ferrying dance again.

I left the product to learn how to use the product.

That small absurdity sent me down a three-day rabbit hole. I came out the other side with a thesis, a flag, and the slightly deflating discovery that I was both completely right and not remotely early. This is the whole map.

Two wishes wearing one coat

“I wish I could just talk to Cloudflare.” I said it to myself in frustration, and only later realised it was two wishes pretending to be one.

The first is the wish to talk to the company. Why is it built this way? What do you call this thing? Where does this concept live? That’s a knowledge wish - messy, conversational, and mostly low-stakes. If the answer is wrong, I’m mildly misinformed.

The second is the wish to operate the product. Change this. Stage that. Block this pattern but don’t deploy it to production yet. That’s an action wish - and it’s a different animal entirely. Different layer, different owner, different risk. If the action is wrong, I’ve just blocked legitimate traffic to a live site, or worse.

They sound adjacent. They are not. The knowledge half is where the chatbots already crowd. The action half is where both the prize and the danger live, and it’s the half almost nobody is building honestly. So this essay is about the action half.

To see why that wish has gone unanswered for so long, you have to look at how software has actually evolved. Because the answer turns out to be the last unfinished step in a pattern that’s been running for twenty years.

The arc nobody finished

Strip away the framework wars and the funding cycles, and the last two decades of web software did one thing, over and over, with monastic consistency: it externalized what software can do, and gave each thing a name.

Once, the server held everything and spat out dumb HTML. The browser was a dumb terminal. Then the layers began to tear loose, one at a time, each becoming addressable in its own right.

First the View broke free and moved into the browser. And React did something quietly profound with it: it made the interface a function of state. You stopped hand-building the screen and started declaring what the screen should be for any given state, letting the machine reconcile the difference. The View became derivable rather than constructed.

Then the back half tore loose. REST, then GraphQL, then headless everything - the backend stopped being welded to one frontend and became a set of named capabilities any client could call. A vocabulary of verbs, sitting on a wire.

Then, in late 2024, MCP - the Model Context Protocol. The same move, one more turn of the screw: those named capabilities became consumable by AI, not just by human-built frontends. The verbs detached from the consumer entirely.

And here is the beat almost everyone misses, because it happened inside the apps where nobody outside could see it. Years before MCP, Flux and Redux quietly named intent itself. In a modern app you don’t mutate state directly - you dispatch a named, serializable action: { type: ‘CREATE_WAF_RULE’, payload: ... }, and a pure function maps the old state plus that action to the new one. Sit with what that means. Every button in Cloudflare’s dashboard is, underneath, a thing that fires a named intent. The application already speaks intent fluently. It has for a decade.

So count them. Data - named. Views - named and derivable. Capabilities - named and callable. Intents - named and serializable.

That’s the whole gap. The app named its data, its views, its capabilities, even its internal intents - and the human is still standing on the doorstep, hunting through menus for the gesture that fires the intent they already know they want. Every layer got a vocabulary except the one where a person expresses what they’re trying to do. That is the last decoupling. It’s the one slot the twenty-year pattern left empty, and it’s been sitting there, waiting, the whole time.

The carrier was already on the page

When I first imagined filling that slot, I reached for something new - a command palette, a clever keystroke, some fresh surface to summon. I was wrong, and the reason I was wrong is the most important design decision in this entire idea.

The trap is the chatbot in the corner. We’ve all met it. It is socially coded as help, support, apology - the place you go when you’re stuck, staffed by something that mostly wants to deflect you to documentation. Nobody operates serious infrastructure through the help bubble.

But there is already a surface on the page that means exactly the right thing. The search bar. It’s coded for command, navigation, operation - you type into it and the product takes you somewhere. It is, in fact, the web’s oldest instinct. The address bar was the original “name a state and jump straight to it” - addressable state before we had the vocabulary for it. Site search was a scoped address bar. The web has reached for the same gesture its entire life: a bar where you say where you want to be, and the system takes you there.

So the move isn’t a new surface. It’s the bar everyone already has, finally able to understand language instead of keywords, finally able to act and not merely navigate - and crucially, one that doesn’t empty itself and close after a single command. It persists as a thread. You type “what is this IP doing,” the page answers, and the bar is still live for “block it” without you re-explaining what “it” is. Search stops being fire-and-forget and becomes a conversation that happens to live where search already lives.

Here’s the architectural placement, and it’s the sentence I’d ask a builder to remember: this is the first real reimagining of the MVC Controller in twenty years. The Model and View have been reinvented half a dozen times each. The Controller - the C, the piece that takes input and translates it into changes - has barely moved since “event handler.” What the language bar does is evolve it from a click-interpreter into an intent-interpreter. Same job it always had: input in, model-and-view changes out. But the input is now language, and the translation is computed at runtime instead of hand-wired at build time.

And one correction, because the loudest voices in AI get this backwards. The interface does not die. The dream isn’t a chat window that swallows the app. The UI becomes the response surface. You speak the intent; the product itself is the reply. Ask for “analytics for abc.com” and the answer isn’t a paragraph telling you where analytics lives - the product moves there, selects the zone, sets a sane range, and shows you. Language is the input. The product moving is the output. Read intents transform the page. Write intents stage a change and wait for your hand.

That last distinction - read versus write - is where the real product lives, and where the real danger lives too. Hold onto it.

Framework, or protocol?

If you believe a new layer is coming, the next question is what shape it arrives in. A framework you adopt and build inside, the way teams adopted React? Or a protocol you conform to and stay free, the way the web conformed to REST?

History is unusually clear here. Paradigms need something holdable before anyone believes the idea. REST was named and codified after people had already lived years of web-API pain - the standard described a reality, it didn’t predict one. React shipped as a working thing developers could touch long before “the component model” became doctrine. The sequence that works is demo → framework → protocol. You make people feel the behavior, then you package the repeatable parts, and only then - once the patterns have stopped moving - do you harden them into a standard.

Run it the other way and you get a graveyard. Author a protocol before the behavior is felt and you spend two years in a working group arguing about schema fields while someone less careful ships the ugly version and wins the category. Protocol-first is how elegant ideas die respectable deaths.

So my bet was: this starts as an experience, becomes a framework, and earns its protocol last.

I was confident about that bet. Then I went and checked who else was already standing on this hill. The answer reorganized everything.

What the survey revealed

I thought I was early. I was not. I want to tell you exactly what I found, because the map is more useful than my ego.

Someone already built the search bar. A company called CommandBar spent years building precisely this: an embeddable, in-app natural-language bar, with a feature that walked users through the interface by effectively taking control of the mouse. Their customers were infrastructure and developer tools - HashiCorp, LaunchDarkly - exactly the punishing, high-consequence products where I’d argue this matters most. They were acquired by Amplitude in late 2024 for a modest sum and folded into an analytics and onboarding suite. And here is the detail I keep turning over: they were absorbed the month before MCP existed. Everything they did, they hand-wired per customer, because there was no shared grammar of capability to consume. The substrate that would have made their work cheap arrived right after they sold.

Someone already built the framework. A company called CopilotKit raised a Series A this year on an architecture that is - almost line for line - the one I’d reasoned my way to from scratch without knowing they existed. A hook to make the app’s live state readable to the model. A hook to register the app’s existing actions as things the model can call. And a “render-and-wait” pattern that pauses for explicit human consent before any irreversible action - my read/write seam, already shipped. I had reconstructed a funded company’s stack from first principles in my head. That stung and thrilled me in equal measure.

The protocol seats are taken by giants. There is a genuine flurry of standards - MCP Apps, made official in early 2026 and backed by both Anthropic and OpenAI; Google’s A2UI; CopilotKit’s own AG-UI; Microsoft’s NLWeb, built by the creator of RSS and Schema.org and explicitly pitched as “HTML for the agentic web.” A solo operator does not get a seat at that table.

And the academy has been here for a while, filing the whole thing under “GUI agents” - systems that perceive an interface, plan, and act. One survey even gave my central anxiety a name: the execution gap, the danger that arises when an agent performs irreversible operations - submitting forms, granting permissions, deleting data - in an interface it only partially understands.

So: the frontier is crowded. The framework is funded, the protocol is being set by the four biggest companies in software, and the researchers have a head start. If you came here for “lone founder spots the future,” I’m sorry. That’s not the story.

The real story is better, and it took walking the whole frontier to see it.

Everyone chose the comfortable default

Here is what I noticed once I’d read all of it. The crowd converged - and every point of convergence is the easier choice, not the truer one.

They chose the sidebar over the search bar. A separate panel, a chat surface bolted to the edge of the app - coded as help, not command - instead of upgrading the operational surface the user already trusts.

They chose generative UI over driving the real interface. The dominant pattern is an agent that renders new widgets - “ask to book a flight, a flight card appears” - a parallel, synthetic interface conjured beside the product. It demos beautifully. But it’s a second app growing next to the first. It is not the product’s own real DNS page navigating, the real offending row highlighting, the real rule form prefilling and sitting staged in the real deploy flow. Rendering a fresh widget is easier than learning to operate the interface that already exists. So that’s what almost everyone did.

And they chose read over write. Querying your content, summarizing your data, answering questions - safe, reversible, delightful, and largely solved. Operating a live control plane, where a wrong move costs real money or breaks production - terrifying, and mostly avoided. The hardest and most valuable half got walked past, because the safe half makes for a cleaner launch video.

None of these were stupid choices. They were comfortable ones. And the gap I’d been circling turned out not to be unexplored wilderness. It was the patch of ground everyone crossed on their way to somewhere easier.

The flag: Operable Software

Once I saw that, the framing snapped into place, and it’s the one thing on this entire frontier that nobody is holding cleanly.

Look at the vocabulary of the whole field - GUI agents, AI copilots, agentic UI, autonomous browsers. Every single term puts the AI in the subject position. The perceiver, the planner, the actor. The intelligence is the hero of every sentence. And so the entire conversation is a turf war over who does the operating - the brittle browser agent crawling the DOM from outside, versus the reluctant in-app copilot built from within. Agent versus app. A race.

Step sideways out of that race entirely. Take the AI out of the subject position. Put the software there.

The durable category isn’t “AI that operates apps.” It’s software that declares how it can be operated - operator-agnostic, write-first, with reversibility and blast radius as first-class, declared facts about each action. Not “here’s an agent that figured out my UI.” Rather: “here is my product, stating plainly which of its actions are safe, which are irreversible, where each one lives, how each one previews, and how each one stages before it commits” - true regardless of who is doing the operating. You, through the search bar. A browser agent. A teammate’s automation. Something not yet invented.

MCP made a product’s verbs addressable.

And here’s the move that makes this both safe and large, rather than just another entrant in the war: a product that declares its operability stops competing with the browser agent and becomes the thing the browser agent needs. You’re no longer picking a side. You’re describing the contract both sides have to speak. The generic agent and the native bar both want the same thing - a product that can tell them, honestly, how it can be operated and what it costs to be wrong.

Which is why I think the framing the rest of the field is using is subtly, consequentially off. The protocol of this era should not describe intelligence.

It should describe operability.

Don’t describe the agent. Describe the software.

Back to the bar

I started in Cloudflare, ferrying a WAF rule between two windows like a courier carrying a message between two people who could simply have spoken.

The future I want isn’t a chat window that eats the interface. It’s the interface finally able to answer. You say what you’re trying to do, in your own words, in the bar that’s already there - and the product responds by moving: navigating, highlighting, filling the form, staging the change, waiting for your hand on the last irreversible step. The software learning, at long last, to explain itself and be operated in the language you already think in.

I went looking for a clever new product and found a crowded field that had quietly agreed to skip the hard part. The hard part - drive the real UI, do the writes, declare the danger, let the human stay in the loop - is still sitting there, exactly where the twenty-year pattern always pointed.

I just wanted to talk to Cloudflare.

It turned out that wish had an architecture.

About SG

I run Dobby Ads, an AI Creative Agency. I tend to overthink. This is where that overthinking goes. Connect with me on LinkedIn.

Tongue is the enemy. Stomach and body suffer.

The thought has been with me for years. Cravings as a taste-reward. The mouth wants the next bite before the body has finished registering the last one. By the time the stomach gets to weigh in, the cookie is gone.

I wondered, what if we could make the tongue forget taste? I mean, for a bit.

Gymnema

A little digging brought me to gymnema. Gurmar in Hindi. Sugar-destroyer. A leaf used in Ayurvedic medicine for two thousand years, with a quiet party trick. It binds to the sweet receptors on your tongue and shuts them off for about an hour. You eat the cookie. The cookie tastes like a piece of paper. You stop wanting cookies.

The plant is from India. You can find it as churna, capsule, tea, or raw leaf in any decent ayurvedic shop. What you cannot find here, oddly, is the format I had in my head. The mint. The lozenge. The thing you put on your tongue at the moment the craving arrives, between the meal and the mistake.

It felt like a category waiting to happen. Outside-in instead of inside-out. Not a drug rerouting your hunger hormones. Not a pill working its way through your gut. A lozenge. The mouth, where the craving actually starts.

Almost ten years ago, somebody shipped this. Same mechanism. Same plant. Lozenge, gum, oral spray. A patent. Clinical studies in a peer-reviewed journal. Distribution at Vitamin Shoppe and on Amazon. Bloomberg, Allure, Tim Ferriss. Year: 2018.

I had not heard of them.

A little more digging, to find out what happened. Why it never worked.

GLP-1

Cravings, appetite, the science of why we eat past full, the cultural stigma around willpower, the idea that some people are just biologically louder than others when it comes to food. Mainstream. Everywhere. The cravings conversation is one of the defining wellness stories of this decade.

Ozempic. Wegovy. Mounjaro. Zepbound. The pharmaceutical inside-out path. Today, it is one of the largest drug categories in history, and it dragged the entire cravings conversation with it. Now, when somebody talks about appetite control, they’re talking about gut hormones, satiety signals, and what the brain does after a meal. The mouth has been retired from the discussion. Whether it stays that way is something the next decade gets to decide.

The supplement world followed the wave. Search “natural GLP-1 alternative” today, and you get capsules. Multi-ingredient formulas built to mimic, from the inside, what the injection does. Gymnema is often in the blend, somewhere on the list, alongside other things. The leaf is honored. The format isn’t.

The mechanism that started the conversation became a footnote inside a different formula.

So?

I keep asking myself what to make of this. The shelf had the answer for almost ten years. The wave came. The wave picked the other answer.

Maybe the lozenge format never had a chance because nobody wants to put something bitter in their mouth three times a day. Maybe the taste-receptor frame is too small a story next to “drug that rewires your appetite.” Maybe being early just doesn’t matter when the wave finally arrives, because by the time it arrives, it has decided what it’s looking for.

I didn’t go looking for a category. I went looking for an answer to a problem I couldn’t stop thinking about. I found one. Then I found out the world had already considered it briefly and moved on to something stronger, louder, and more expensive.

If the mouth ever comes back into this conversation, it’ll look like something no one would call a supplement. A piece of dark chocolate that does this. A mint at the end of a meal. A drink. A gum. The mechanism hidden inside a ritual people already have, instead of asking them to add a new one.

The wave will probably crest. The question is whether anyone will be ready when the air shifts, or whether the next person to think about cravings as taste-reward will go through the same loop I just went through, find the same shelf, and write the same post.

Tongue is the enemy. Stomach suffers. Probably. But it doesn’t matter what’s true if the wave decides to lift something else.

About SG

I run Dobby Ads, an AI Creative Agency. I tend to overthink. This is where that overthinking goes. Connect with me on LinkedIn.

Days and weeks since I wrote about the new face of discovery. Still bothers me, like a hunt. I keep going back to AI to push it, and logging my observations as we chase.

It is 2026. ChatGPT came eons ago. Discovery is still where it was.

Researchers across the world must be solving this. It’s too central not to be. And it is not an easy problem, else we would have seen the solution by now.

Or, what if the solution is already at play and we don’t feel it? What if they’re already close to unveiling it?

If they are close, what would they be looking at? What would I be missing?

The Discovery Job

So I went back to my own post and started reading it like a critic.

Here’s the line that didn’t sit right:

“The labor moved. It never disappeared. It just got disguised.”

That’s almost true. It’s also not quite right.

Search’s path is clean.

Each step removed effort. The user did less, the system did more. Always less. Until the user did almost nothing.

Discovery’s path doesn’t move in one direction.

• Town crier: show up at the square, listen. Almost no labor.

• Newspaper: buy it, skim sections. Some labor.

• Radio, TV: sit down. The programmer scheduled. You watched. Less labor than the newspaper.

• Cable, TiVo: more channels, recordable. More labor.

• Facebook, Instagram: open the app, see your friends’ posts.

• TikTok, Reels: open, swipe, judge, swipe, judge, swipe. Hundreds of half-second decisions per session.

Look at that curve.

Discovery’s labor went down, then back up. We didn’t notice because the new version was disguised as leisure.

That’s what I missed.

Discovery had its own arc. It just went the wrong way after we got phones.

The labor went up. That’s the observation. The question is why.

Town crier - the crier picked. Newspaper - the editor picked. Radio, TV - the programmer picked. The 8pm slot was thirty minutes long because someone decided it was thirty minutes long.

Cable came. The programming responsibility started slipping. TiVo finished the slip. Then social media arrived and the slip became a transfer.

Every swipe on TikTok is a programming decision. Pick this video, skip that one, watch the next, drop out at the first second of one that doesn’t grab you. The algorithm presents the menu. You schedule.

That’s the quiet move that broke discovery. Not “the algorithm took over.” The algorithm built the menu. You’re the one running the show.

Don’t Regret Per Minute

I almost published a piece. I didn’t.

The piece was called “Don’t Regret Per Minute.” The argument: TikTok optimizes for “don’t let go” - keep you watching. The new metric should be “don’t regret” - did each minute feel worth it. The architecture: optimize transitions between videos, not individual videos, so each one lands harder than it would alone.

I cooked that idea with AI for days. It felt right. It survived round after round of pressure-testing. I was three small edits from publishing it.

Then I ran the failure-mode test from a piece I wrote recently - “Refusing the shallow version.” Pattern-matching dressed as competence. Closure-seeking under uncertainty. Fake synthesis. Premature commitment dressed as progress. Exit move dressed as helpfulness.

The piece failed three of them.

“Don’t Regret Per Minute” was also prescriptive. It told the user how their session should feel. That’s eat-your-vegetables in a clever costume. A metric that judges the user is a different object from a product spec that describes the system. I had collapsed the two.

The transition-optimization architecture had a manipulation problem at its center. A system that learns “sad video then funny video makes the funny one hit harder” will start engineering the sad video on purpose. That’s just TikTok with better tricks. I’d marked the problem as unresolved and moved on. That’s premature commitment.

And the article tied it all up with two confident lines about who builds the next era. That was the exit move - closure-shaped, so the piece felt done.

I killed the piece.

What survived the chase isn’t a metric. It’s older than that.

The Product Specs

Some things came through every round of pressure-testing.

The product can’t make money by keeping you longer. The moment monetization depends on time-spent, the system drifts back to addiction. That was the original sin of the feed era. Whatever comes next has to monetize differently - fewer impressions worth more, or subscription, or something I haven’t seen yet.

The product is video. Reading takes effort. Audio is passive but slow. Video is the native format of discovery in 2026. That’s not a preference, it’s where attention has consolidated.

The product is free at the edge. Discovery has always been free at the moment of consumption - you didn’t pay the crier, you didn’t pay to turn on the radio, you don’t pay to open Instagram. Money came from somewhere else. Whatever’s next has to honor that.

The product runs on comprehension, not behavior. This is the part of the original post that still holds. Watch time and clicks are proxies. AI that watches video, listens to audio, reads text, and actually understands what’s there - that’s the unlock. Without it, none of this works.

The product is anchored to specific entities you care about. People, places, ideas, builders. The interest graph isn’t broken - platforms weaponized it, but the underlying signal is real.

The product is fresh. Discovery isn’t an archive. Yesterday’s was yesterday’s. Whatever comes next has a recency pulse.

The product is interstitial. It fits in the cracks between other things, the way a newspaper used to. It doesn’t demand its own time slot. You step in, you step out, the world keeps moving.

These don’t tell me what the product is. They tell me what it can’t violate.

So?

What I think is real: someone or something has to start scheduling the moment again. That’s the question. Not “what’s the next feed.” Not “what app replaces Instagram.” But who or what takes the programming job back from the user?

Candidates I keep turning over.

The system itself - comprehending content and your state well enough to deliver a finished thing.

A creator - scheduling for their followers in real time, the way a radio DJ used to.

A small group - the group chat as the new feed, friends scheduling for each other.

A time - daily drop, weekly drop, ends when it ends.

An event in your life - you finished dinner, the system knows, the moment begins.

None of these are answers. They are shapes the question can take.

That’s where I am in April 2026.

The constraints I trust. The diagnosis I trust. The metric I almost committed to, and didn’t. The question still open. Or maybe it is closed, and we haven’t realized it yet.

If you’ve seen further on this, I’d like to hear from you.

About SG

I run Dobby Ads, an AI Creative Agency. I tend to overthink. This is where that overthinking goes. Connect with me on LinkedIn.

I wrote about this on LinkedIn recently. The short version: a client dismissed my well-thought-out work because he couldn’t see the thinking behind it. The output was clean. The reasoning was invisible. He had no way to evaluate what was real and what was assembled with AI.

Neither would I, in his position.

That’s not a client problem. It’s a structural one.

AI systems produce outputs that look the same regardless of the reasoning behind them. A deck built on three weeks of challenged assumptions and rejected directions looks identical to one built in an afternoon on the first plausible path the model offered. Output quality is no longer a signal of reasoning quality. We’ve decoupled them - and we haven’t noticed yet.

The difference shows up later. When the strategy meets the market. When someone asks a question the deck can’t answer. When the assumptions break. The deck that was thought through survives. The one that was assembled doesn’t.

Doctors document differential diagnosis - not just what they concluded, but what they ruled out and why. Engineers document design rationale so the next person can modify the work without invalidating the thinking behind it. Finance has investment memoranda that separate the decision from the reasoning that produced it.

In software, this already has a name. Traces - the record of what happened, in what order, and why. Every serious system has them. Knowledge work still doesn’t.

We haven’t built this for AI-assisted knowledge work. And we’re moving fast enough that the cost is already here - we’re just not accounting for it.

Not a product. Not a platform. A practitioner standard. Five elements. Concise enough to actually use.

The five elements of a Trail:

1. Context used - what inputs and constraints shaped the reasoning.

2. Alternatives considered - what directions were explored and why they were rejected.

3. Assumptions - what has to be true for the output to hold.

4. Points of challenge - where the reasoning was questioned, revised, or contradicted.

5. Confidence and known gaps - where the output is reliable, and where it isn’t.

This is not the model explaining itself. It’s you making the work auditable.

If you're working with AI, you don't have to build this from scratch. The AI was in the room. You can ask it to generate a first version of the trail from your conversation - but treat it as a draft, not ground truth.

Trail should accompany every deck, every strategy, every recommendation that came out of a prompt.

Trail, not certificate. The distinction matters. A certificate asks: Who approved this? A trail asks: Can I follow how you got here?

I don’t know if this makes sense. I just know that afternoon, something was missing.

The work was real. The thinking was real. I just couldn’t prove it.

About SG

I run Dobby Ads, an AI Creative Agency. I tend to overthink. This is where that overthinking goes. Connect with me on LinkedIn.