What is up everyone! I am wondering if I can get some feedback on this "Tutor Bot/Tutor Workflow" I put together. I created after I had developed my own study flow. I tried to generalize it to allow anyone to plug into it. Open to all suggestions/edits. The main idea is to give this md file to you're model, its run you through an on-boarding process to determine what you are studying for, ingests course material, then it outputs a plan. It also can generate a custom flashcard, custom questions, custom curriculum based on purchased or publicly available course material. My favorite use case is the Oral Drill. I use this to chat back and forth about concepts and try and see how well I actually understand something. https://digitallyceum.netlify.app/tutor-workflow https://github.com/Bagu-Hanto/digital-lyceum-free-resources

Before digging into the topic let's briefly set the scene by providing some background context. Background In 2026-Q1 I decided to invest into a custom pc to run local AI Models. Being an IT Professional I grew increasingly concerned seeing the pc component shift heavily towards AI Business cases. PC component prices was increasing rapidly and high-end components becoming scarce or non-available. Given the overall AI development in general I realized I wanted to ensure I owned AI capability at home, and that if I want to stay current in my career I need to dive in head first into AI and AI Development. A powerful driver and motivator is that I want to see just how far I can take AI capabilities based on localhosted opensource methodology over paying a subscription/pay as you go solutions. I eventually came across Clief's YouTube videos which got me curious about ICM and I decided to join this community. Getting educated Working through the Classroom Foundational course I noticed that ICM is primarily used together with Claude. Reading Clief's thesis ( Interpretable Context Methodology: Folder Structure as Agentic Architecture - https://arxiv.org/abs/2603.16021 ) strengthened my own observation that ICM conceptually is model and tooling agnostic. As long as the AI Model can access and interpret the ICM specification files it shouldn't matter if the model itself is run on cloud services like Claude, Gemini etc. or local hosted alternatives. I decided to put this to the test and do it practically. Working through The Foundation: Module 1.2 ( https://www.skool.com/cliefnotes/classroom/036893d9?md=fdee3f73c53b46049078494c0cfb2e54 ) where we create our first ICM folder and get a quick win. I decided that since the Module 1.2 usecase is easy to start with, it makes sense to get it set up running in my own localhosted ai environment. I also wanted to proceed with a real usecase where ICM can be helpful.

Ran into an interesting edge case with Claude Code. While studying for the Security+ certification. I wanted to use OCR to pull text from screenshots of my textbook and put them directly into my study guide. Claude's content filter flagged it as a potential policy violation. Totally understand why, info sec terminology out of context looks suspicious. But this is a legitimate study workflow: purchased book, personal notes, no malicious intent. The workaround: routing OCR output directly to a file rather than through chat bypasses the false positive entirely. The filter is checking chat input, not file writes. Worth flagging for anyone hitting the same wall. And worth noting for Anthropic, context matters. A Security+ student and a threat actor are using the same vocabulary, but the use case is completely different. Has anyone else hit content filter false positives on legitimate security study or research workflows?

Got some baseline lab telemetry coming into Splunk Enterprise. It’s funny how a few simple graphs and bar charts can jump start curiosity. My eye naturally wants to know what the peaks and valleys are from or why the volume is so high on some of the traffic. Unfortunately my Splunk Enterprise trial expired and I'm currently working on seeing if can get extended. I hit my data amount way faster then expected. Just gotta pivot and do what I can.

Since the MVP is set up I'm trying to get in my "analyst reps". I've been out of the IT game a few years and I need to knock the rust off and learn the basics of what I think a SOC Analyst 1 would do. Had to work from a cafe today and I thought this is a perfect moment to make sure my traffic is encrypted. I ran a tcpdump on the cafe's WiFi while generating live SSH traffic to the lab. What an eavesdropper on the same network would see: - All UDP - no TCP, no port 22 - Port pair 41641 ↔ 33170 - WireGuard on both ends - No readable content in any packet One finding worth noting: mid-capture the lab server sent from port 1028 alongside 33170. Same endpoints, same encrypted UDP - Tailscale path discovery probing for a lower-latency route. Expected behavior, but the kind of thing you want to recognize rather than flag as an anomaly. Tunnel verified. Analyst rep 1 cleared for today.