Writing & build logs.
Essays on software development, web builds, and AI tooling. Plus build notes from what I'm actually working on right now.
The backtick that could run anything: hardening AppleScript shell escaping
A Sprint 2.11 review flagged a shell command-substitution gap in a single Python helper. Backticks and dollar signs were passing through unescaped into a double-quoted `do script` string, meaning a crafted issue title could execute arbitrary code. The fix was four lines. Understanding why it mattered took longer.
Two assumptions the pipeline held until it shipped
B8b's first end-to-end Telegram ship-tap exposed two bugs that had been invisible in every prior test. Neither was logic. Both were assumptions the pipeline had been making silently since the day the code was written.
Telegram 409 Conflict: two bots, one token, infinite errors — why a bot registry is infrastructure
Retrofitting the editorial pipeline's Telegram modules revealed that the tunnel bot and the brain server had been polling the same token for weeks, throwing 409 conflicts that neither log named clearly. The fix wasn't a config tweak. It was accepting that one-bot-per-purpose needs to be enforced at registration time, not discovered at incident time.
Why the editorial pipeline's rewrite layer runs on a project-owned harness, not Archon
The Opus rewrite layer inside the editorial pipeline's de-AI-ish stack runs through a project-owned osascript Terminal harness, not a general orchestration framework. That choice was deliberate and narrow. Here's what it cost and what it bought.
Audits find what's wrong, not what's missing
A page-by-page audit ran for three days catching deprecated ARIA roles, fabricated copy, and missing hover-pause behaviour. Then I opened the site on my phone and the nav menu wasn't there. Not wrong. Just not there. That's a class of bug audits can't catch, and the fix isn't to audit harder.