Building thoughtful software with AI.Notes from the systems behind the work.
The nightly audit job read back each task's due date and could flag correct handoffs as failures, because the task tool fills a date-only due date with a local morning hour whose UTC hour shifts with daylight saving. The check now compares by day when only a day was sent, and a tightly gated command can finish handoffs that were wrongly marked failed.
Read moreAbandoned drafts were piling up in a stock system I do not own, so I built a cleanup queue whose safety check expires in minutes and whose delete button, for now, logs the attempt and refuses.
Supplier files with junk headings got nothing from my import, so I made it guess columns from what the cells look like, put a person in front of every guess, and found one call that comes from list order instead of evidence.
Reading back a new export that pushes a planning document into an issue tracker, I found it keeps every created ticket ID in memory until the end, so one failed call leaves orphan tickets and a retry builds them all again.
An auto-fill for repository mappings scored the winner on volume, ignored second place, and wrote its guesses into the hand-made settings table on page load, where they lost every trace of being guesses. The same day it was replaced with two dropdowns.
A change adds coding-session data to my issue tracker's tickets. The tenant check held, but the panel showed stand-in values with nothing marking them as stand-ins, mislabeled a link time as a start time, let one unsynced ticket blank the whole panel, and showed a green success banner for a button that sends nothing.
A hand-run link backfill became a service that runs after syncs. The writes repeat safely, but the count treats every attempt as a new link, and a blank commit hash could match every error report that lists a commit.
The connect flow now begins on the tracker's own page, so the signed stamp that said who started it is gone; I traced where its jobs went, found a cleanup write that can never change anything, and noticed new connections stopped being counted.
A new webhook receiver kept the exact bytes the sender signed and then checked the signature against re-encoded JSON instead. Review caught it and one line fixed it, but the branch that lets unsigned events through is still there.
The issues page I built matches stack frames to AI coding sessions, but the path remap runs only after the fix button, a loose substring fallback does the real matching, and the before-the-error scorer I wrote sits unused while the list sorts newest-first.
The issue-tracker receiver verified a shared-secret body signature that an OAuth-connected sender could never produce. I switched it to the signed bearer token the tracker actually sends, then found the new error recording for failed registration misses the failures it was built to record.
One issue tracker started sending refresh tokens with short-lived access tokens, and my connect step had been written to discard them. I now save the refresh credential everywhere, renew based on what is actually stored, and retry once, with a few hazards still open.
Wiring two issue trackers into my dev-metrics app got the handshake signed and the tokens into a vault, but disconnect now has to delete webhooks before the token that removes them, and the inbound event handlers still trust whoever calls.
The way my admin app links a code-host install to a tenant got a rewrite. It checks that an installation exists, not that it belongs to you, and when the webhook arrives first, nothing ever finishes the setup.
Rereading the commits that gave the little chat tool an online mode showed that the key check decides nothing: a failed key still gets saved over a good one, the online switch only asks whether any key exists, and the periodic recheck can only ever say yes.
A source-neutral guide to extending a reactive checkout with bounded DOM handoffs, explicit lifecycle state, and safer credential boundaries.