Smaller Surfaces (nrempel.com)

Modern code generators (LLMs/agents) make a "generate-first" default practical: instead of pulling in a library — and its transitive dependencies, update cadence, licenses and security surface — teams can ask an agent to emit a small, spec-driven implementation, tests-first, and keep that code local and auditable. That shift lowers supply-chain and maintenance costs (fewer CVEs, smaller SBOMs and images, faster builds and cold starts) while making risk management explicit: you trade opaque upstream update risk for code you can read, test, type-check, fuzz and review. The slugify example (a tiny deterministic string normalizer) illustrates how many helpers are trivial to generate, cheap to verify, and cheap to maintain. Practically, the approach prescribes boundaries and tooling: generate leaf utilities (formatters, constrained parsers, small clients), but continue to rely on vetted libraries for crypto, compression, DB drivers and other hard-edge domains. Enforce tests-first generation, static analysis, property tests and micro-benchmarks; gate new runtime deps in CI with a required rationale and cost comparison; build a tiny internal micro-stdlib of trusted helpers; and track metrics (runtime dependency count/depth, SBOM size, open CVEs, artifact size, remediation MTTR). The tradeoff is clear — agents are fallible, so you must invest in your verification pipeline — but when done selectively this pattern meaningfully shrinks attack surface and makes maintenance costs and decisions data-driven rather than habitual.