Building thoughtful software with AI.Notes from the systems behind the work.
How a release pipeline replaced a single pinned signing key with a pinned key ring, so a build signer could move to new hardware with an overlap window, recorded provenance and a CI ratchet against trust drift.
Read moreMaking settings saves queue on one workspace lock opened a gap: the permission check ran before the wait, so a signed-out, demoted or expired admin could still write. Now authority is rechecked under the locks, with second-factor proof read outside them and validated again at the end.
Password and email login in my scheduling app verified the credential in one transaction and issued the session in another, so a reset landing in between still got a session. PIN login already carried a proof forward; now the others do too, and sign-up recovery got the same treatment.
Any copy of my ordering system that could see an API key sent supplier email. I moved the keys into the database and added a release gate that ships with each version, so a dev copy holding a real key still can't act.
A self-repairing deploy step grabbed my Proxmox host's root key whenever it saw drift, despite docs saying a human runs it. I swapped it for a token that can only run guest commands on one VM, pinned the API certificate before the token is ever sent, and banned the old path in the deploy scan.
Private per-job Podman networks on my CI runner ran into a DNS helper that wants a logged-in user's systemd bus. A cgroup detour lasted one change; a tiny stand-in launcher that catches that one request is what stuck.
The RSS reader removed HTML from previews and then decoded entities, so escaped markup sailed past the stripper and came back as real tags. Now it decodes one layer at a time first, adds spaces where block tags were, and only then strips.
Wiring an AI assistant into my work dashboard meant task text could leave my network, so a stored API key only makes a provider reachable; hosted models also need a separate server setting that ships off, unavailable providers are refused instead of swapped, the model sees a small labeled slice with no tools, and agents get a read-only door that I still have to choose carefully.
The per-request call to the old API is cut, and the new one checks sessions itself: the token only says which session, and roles, expiry, suspension and the second-factor rule come from live state every time.
Because my texts live on one Mac, a small agent there holds the keys, answers only a short list of signed requests, and makes every reply a two-step ticket, while the hub itself holds almost nothing.
A container's loopback is the container, so my sandbox needed the bridge address. Reaching it meant binding the model server to every interface, which left a firewall rule as the only thing guarding an unauthenticated model, plus a dashboard relay and a stricter smoke test.
A handful of permission modes went into the coding agent, and every tool now routes through one resolver that checks where a request points before it checks the mode, so secrets and my real checkout stay off limits no matter how permissive the setting.
The hidden browser window in my coding app checked the address I asked for against its allowlist and never the one a redirect dropped it on, so it could click, screenshot and certify a page nobody approved. Now the same check runs on the landing address before anything touches the page, though the outside page still gets fetched first.
Login emails can't be sent from the dev box, so I gave myself a short PIN that never expires or locks, then fenced it with repeated dev checks, a stamp only my script writes and a reset route that hides itself, and chased down a correct PIN that failed because a secret was read too early.
The first cut of my scheduler's user import minted a plain-text PIN for everyone. Later that day it copied the old app's bcrypt hashes across instead, so people keep the passwords they already know, and a few gaps are still open.
Reading request headers became async, so every auth helper and guarded page in my staffing app had to await it. The callers that use the guard's answer get caught by the compiler; the ones that call it as a bare line don't, and nothing in the commit tests that a signed-out visit still bounces.
The ordering system keeps encrypted copies of raw inventory responses for replay, but the status check only looked at database fields. Now it reports kept and readable separately, and capture refuses to fetch anything until I confirm the key is backed up.
The runtime between my coding model and the machine said yes to any shell command that started, ignored its own program allowlist, read dash-led search words as flags and fenced files into one machine's folder. One change made each of those tell the truth, and a couple of questions are still open.
The gateway's admin sign-in ran a deliberately slow password hash twice just to pick a label. The commit that cut it to once also raised the hash cost, and it never tested whether the new cost fit the runtime's memory cap.
When a spreadsheet row didn't match a supplier's own catalog, my import searched every product and wrote case sizes to whatever it found, and the schema let two suppliers share a product. I deleted the wide lookups, put an ownership check and a preflight in front of the writes, moved one-supplier-per-product into the database, and left a few loose ends I'm still not happy about.
Job titles were swapped for permission-based roles in the scheduling app, and the diff shows that the seeding step run on every staff listing rewrites any edit to a built-in role, alongside non-atomic writes, no last-admin guard, and a few access changes I can't swear I meant.