git

CI called pytest on an empty database while production applied migrations first; one workflow line aligned both contracts.

TL;DR: A test suite that passed locally kept failing in CI with misleading database errors. The root cause was that production ran Alembic migrations before boot, while CI pointed pytest straight at an empty Postgres. Adding alembic upgrade head before tests in the workflow made starting state deterministic, so failures now point at actual code.

git's ** pathspec skips files directly under src/; a four-command throwaway repo exposed the blind spot in a token build gate before anyone exploited it.

TL;DR: While testing a build gate that blocks hardcoded hex colors, I assumed src/**/*.tsx would catch files directly in src. A quick git ls-files experiment proved the pattern misses direct children, leaving a silent loophole. I fixed it by combining shallow and recursive globs and added tests to ensure coverage at any depth.

A Next.js frontend got its first vitest suite: 12/12 green, yet two bugs surfaced while writing the tests, before they could become complaints.

TL;DR: Installed Vitest on a Nextjs frontend that had no tests and wrote twelve passing checks. Writing them revealed two hidden issues, a client name duplicated across industry groups and a token gate whose glob missed files directly under src. The takeaway is to add a test harness early, since building tests finds bugs even when everything stays green.

The daily cron dump could not answer which release it matched. Pairing one dump with one release tag made restores a one-name lookup.

TL;DR: Daily cron dumps caused version confusion because the file wasn't tied to the app release. Now each annotated release tag gets its own logical mariadb-dump named to match, stored via documented rules and verified by test restores. This makes recovery predictable since the dump that matches production is instantly clear.

The secret-scanner hook crashed on a multi-file commit. One missing flag in the hook definition, and it ended with checksum-pinned CI.

TL;DR: The gitleaks system hook kept crashing on multifile commits because it mishandles the file list. Instead of waiting for a fix I switched to a local hook that runs a checksum verified binary on the staged diff. I apply the same strict pinning in CI with hashed downloads and minimal permissions accepting manual updates for stronger supply chain security.

The document mirror moved off the kanban board and into Plane Pages, and the storage contract forced a full identity redesign.

TL;DR: The mirror moved from Work Items to Pages, which preserves HTML comments instead of sanitizing them, forcing a new identity design. Pages are flat with no folders, need full replacement on update, and require archiving before delete with verify-after-write. Sync now trusts content hashes, allows two-way edits only for meeting notes, and keeps library docs one-way with divergence alerts.

A card flipped to Done with nothing behind it. Now a work item only counts as done when its evidence hashes actually resolve in the repository.

TL;DR: A Done label means nothing without Git proof, so I stopped trusting tracker status alone. I built a gate that only allows Done when visible evidence lines with commit hashes and tags actually resolve in the repo. Strict rules like WIP limits, date handling, and separating docs keep the board honest and verifiable.

A 199-line spec for the init-rules skill: layered universal + per-stack packs, CLAUDE.md as an index, and idempotent re-runs the Go generated-code and Copier way.

TL;DR: Starting from a bloated root CLAUDE.md, the author split rules into on-demand, path-specific files instead of one massive doc. The fix became a layered, harness-first skill pack with universal, stack-specific, and scaffold layers plus assert-based self-checks. To make reruns safe, the generator owns all artifacts like Go's generated-code marker, enabling idempotent smart merges that preserve local changes.

A mirror sync deleted a validation script and CI stayed green. Three validator failure classes and two cheap fences: mandatory anchors plus a frozen checksum.

TL;DR: A git mirror sync silently deleted our validation script, yet CI stayed green because nothing verified the checker's existence. The postmortem surfaced three silent failure modes: missing, broken, and environment-brittle validators. The fix adds two cheap fences, a missing-anchor rule and a frozen checksum, so green finally means something.