Posts

The wire-level rules that make a stdio MCP server correct in PHP - one writer to stdout, a bounded read with no natural limit, and a handshake that tells old clients from new ones.

How northway’s browser prototype keeps its API key off client JavaScript with a loopback-only Node proxy, before any of it reaches the production Pi build.

How Waaseyaa’s cache:clear command couldn’t even run in production, and how a hardcoded bin list quietly reported success while clearing the wrong cache entirely.

How Waaseyaa’s queue worker silently acknowledged persistent messages with no matching handler, and the fail-closed fix that routes them through retry and the failed-job repository instead.

How Waaseyaa’s taxonomy package let ordinary request traffic ALTER a table to add a foreign key, and the fix that moved that DDL exclusively into coordinated schema sync.

Why a throwing audit logger in Waaseyaa’s MCP endpoint could crash a request after its outcome was already decided, and the containment pattern that fixed it.

Why Waaseyaa’s CI gate scanners stopped walking the filesystem with a hand-maintained exclusion list and started asking git what’s actually in the repository.

How Waaseyaa’s StreamHttpClient silently turned a truncated, over-limit response body into an HTTP 200, and the fail-closed fix that rejects incomplete bodies instead of guessing.

A stray PHPStan cache in a nested git worktree got scanned as production code, showing why filesystem-exclusion rules for local gates need to match at any depth.

Mounting a durable volume straight onto the directory you chmod’d in the image throws away that permission — bake a private child path instead.