Search
Posts
Tailscale Federated Trust: Scope to Auth Keys, Not All
Tailscale's federated trust lets a GitHub Actions OIDC subject do anything on your tailnet by default. A deploy only needs to create an auth key.
ReadPin the Installer and Add a Renewer
A CI tool that floats is a gate whose behaviour changes without a commit. Pin the installer, then add a renewer so the pin is refreshed by review.
ReadMove Deterministic Math Out of the LLM Prompt
Move date windows, site lists, and per-site totals out of the LLM prompt and into a Python file the wrapper reads before the prompt is built.
ReadRefuse to Substitute a Weaker Token in Scheduled CI
A scheduled CI workflow that falls back to a weaker token opens PRs that re-trigger no required checks. PR #1563 closes that fallback in update-npm-stats.yml.
ReadGit Plumbing for an Unattended Cron on a Shared Checkout
When an unattended cron has to commit to a shared, often-dirty checkout, git plumbing beats porcelain: hash-object + commit-tree + push survives concurrent sessions, behind-branch state, and push races.
ReadThree Self-Healing Classes for an Unattended AI Pipeline
Three self-healing classes keep an unattended AI pipeline quiet: repair rounds, depth-capped provider failover, and nightly catch-up of older dates.
ReadHustle P1: COPPA Delete, Cosign Slice 1, SQLite Race
SQLite PRAGMA busy_timeout fixed a Next build race widened by migration 0005; same day shipped parent delete plus export (COPPA) and per-signer co-signatures.
ReadNext.js 16 Hustle: Rate Limits and Admin Fail-Closed
Hustle shipped seven P0 security PRs in one day: SQLite rate limits, fail-closed admin, AUTH_URL fix, debug routes deleted. What landed and what broke.
ReadReachability Is Not Freshness
Endpoint reachability and data freshness require separate checks. A status page returned HTTP 200 while serving stale July snapshots.
ReadClaude Opus 5 Caught Two Shop Metrics That Disagree
Checking two shop metrics against each other by arithmetic before publishing them. One came off a customer story, and an ops closeout narrowed its own claims.
Read