tooling

One program directory baked into cmd_slice let a validation gate pass on someone else's evidence; a one-line env-override fixed it.

TL;DR: A slice gate silently validated the wrong program's evidence because the program directory was hardcoded in cmd_slice. The fix was one line: read an env var first, fall back to the default, matching the existing REPO_ROOT pattern. Run tools in two contexts and compare file references to catch baked-in constants early.

Four review:* tokens plus a board validator make agent review debt visible, countable, and batchable, while security surfaces never wait in a queue.

TL;DR: Reviewing every tiny slice cost 50-60k subagent tokens per round regardless of diff size, making review the largest session expense. The fix: every done row must carry a review token, enforced by a board validator, with non-security work batched until the queue hits three or the session closes. Security surfaces skip the queue, and tokens make review debt greppable.

Four QA reports became one master table: 18 findings awaiting a decision, 4 not reproduced. Who decides matters more than ticket age.

TL;DR: Four QA reports consolidated into one FINDINGS.md master table: 18 awaiting owner decisions, 4 confirmed designed, 4 flaky E2E failures that didn't reproduce, 1 in progress. Consolidation exposed shared root causes and enabled risk-based ordering where impact, likelihood, and cheap fix beat ticket age. Work isn't closing tickets, it's ensuring every finding has an owner, a decision, and an order.

Passive recon: map a stack from subdomains, archived URLs, TXT records, MX, nameservers, and secret scans without sending one packet to the target.

TL;DR: Passive recon maps a domain's tech stack from public data alone—DNS, subdomains, old URLs, headers—without touching the target. The catch: signals mislead easily, since verification tokens don't prove actual usage and Cloudflare headers matter less than nameserver records. Found secrets? Stop at discovery—validation crosses into active territory, so report through official disclosure channels.

A 199-line spec for the init-rules skill: layered universal + per-stack packs, CLAUDE.md as an index, and idempotent re-runs the Go generated-code and Copier way.

TL;DR: Starting from a bloated root CLAUDE.md, the author split rules into on-demand, path-specific files instead of one massive doc. The fix became a layered, harness-first skill pack with universal, stack-specific, and scaffold layers plus assert-based self-checks. To make reruns safe, the generator owns all artifacts like Go's generated-code marker, enabling idempotent smart merges that preserve local changes.

An article's source does not determine its type, the brief's content does. Detect the mode from content, keep one canonical guide, never duplicate enforcement.

TL;DR: The author nearly split their writing guide into two prompt files, one technical and one reflective, before realizing an article's type comes from the brief's content, not its source. A commit can spark a reflection; a dossier can spark a troubleshooting piece. One adaptive guide with two detected modes beats two files that drift.

A 9,000-character silent truncation cut the redaction rules out of the writing prompt. The fix that mattered was a mechanical gate on the final artifact.

TL;DR: A style guide was silently truncated at 9,000 characters, cutting the redaction rules before they reached the writer model. The fix loads the guide whole and adds a mechanical verification gate, check_redaction, that scans the final article for non-documentation IPs and secret-like token prefixes. False positives cost minutes; published leaks are permanent, so the trade-off is easy.

My research registry only had derived statuses, until a .rejected file gave human decisions a seat in the precedence chain.

TL;DR: A dismissed research topic kept reappearing in the registry scan, so the author added a .rejected marker file that humans write and tools only read, storing the reason in a rejected_reason field. The article compares this to precedence chains in rustup, pyenv, nvm, and git. Key lessons: markers are human decisions, and overrides must be visible, never silent.

A CLI tool named keyword.py passed its own selftest yet broke import collections. sys.path order and a transitive import turned out to be the trap.

TL;DR: Naming a local file keyword.py shadows Python's stdlib keyword module because the script directory sits first in sys.path. The trap stays hidden until collections transitively imports keyword and crashes with a confusing ImportError. Fix: avoid stdlib names, run a quick import check, and use Python 3.11's -P flag as backup.