Stop walking the filesystem in your CI gates — ask git instead
Why Waaseyaa’s CI gate scanners stopped walking the filesystem with a hand-maintained exclusion list and started asking git what’s actually in the repository.
Fixing a silent truncation bug in Waaseyaa's StreamHttpClient
How Waaseyaa’s StreamHttpClient silently turned a truncated, over-limit response body into an HTTP 200, and the fail-closed fix that rejects incomplete bodies instead of guessing.
A nested git worktree broke our pre-push gate
A stray PHPStan cache in a nested git worktree got scanned as production code, showing why filesystem-exclusion rules for local gates need to match at any depth.
Keep SQLite data in a private child directory, not at the Docker volume root
Mounting a durable volume straight onto the directory you chmod’d in the image throws away that permission — bake a private child path instead.
Splitting one Dockerfile into API and maintenance images
A shared runtime stage plus two build targets keeps CLI maintenance tools out of the deployed API image, and a script proves it on every build.
A missing npm ci silently starved the content-mining pipeline for a week
A missing npm ci let schema validation crash on every mined candidate, filing zero content-queue issues for a week — the fix layers a loud fail-open guard over the actual root-cause patch.
Hardening a manual Claude Code review workflow in GitHub Actions
How a human-triggered ‘@claude review’ workflow got locked down to read-only, bounded-diff, revision-verified reviews after the official tag-mode example turned out to be implementation-capable by default.
Idempotent, budget-bounded AI queries on a single SQLite writer
How northway’s SQLite store keeps paid AI-provider queries idempotent and budget-bounded, using a single writer, lease-based claims, and a reserve-then-settle spend model.
Publishing a versioned API contract you can actually trust
How goformx freezes, packages, and checksums its OpenAPI contract so external clients can pin to a specific, verifiable release instead of a moving branch.
Running the blog's content autopilot on a Claude subscription, not API credit
How this blog’s unsupervised publishing pipeline moved off pay-per-token API credit, survived a silent auth revocation, and added a deterministic gate so an unreviewed draft can’t ship as slop.