Posts

Test machine publishers through their real tools

Prove a machine publisher has the permissions it needs, and no broader authority, by exercising the registered tools it will actually call.

Five contracts a PHP listing layer should prove

Test filter semantics, cache invalidation, and installed package behavior before trusting a PHP listing layer.

A PSR-14 dispatcher does not promise Symfony's second argument

Keep event dispatch calls within the interface you inject, using a small Waaseyaa fix as a practical example.

Fixing a hardcoded revision key in Waaseyaa's entity storage

How Waaseyaa’s EntityRepository let entity types configure their revision-pointer column, but ten call sites still read the literal revision_id string, and how a single private accessor plus a two-way test closed the gap.

Adding a working skip link to Waaseyaa's operator shell

How Waaseyaa’s shared operator shell added a real skip link and hid decorative icons from assistive technology, including the focus trick that makes the link’s own jump work in every browser.

Configuring identity-only OAuth requests in Waaseyaa

How Waaseyaa’s oauth-provider package added optional, additive configuration so a consumer that only needs a stable Google or GitHub identity can skip the email lookup, the forced consent prompt, and the offline refresh-token grant.

Claude Code and Codex skills are directories, not files

Why Claude Code and Codex discover agent skills as a directory containing SKILL.md, not a flat markdown file, and what silently breaks when an installer gets that wrong.

Host-bound session and CSRF cookies in Waaseyaa

How Waaseyaa’s SessionCookiePolicy enforces the __Host- cookie prefix’s four constraints for both the session cookie and the CSRF double-submit cookie, and rejects misconfiguration at boot instead of failing silently in the browser.

Fixing a metadata collision bug in Waaseyaa's file repository

How Waaseyaa’s LocalFileRepository silently collided metadata for different stream-wrapper URIs that shared a trailing path segment, and the fix that preserves full URI identity plus atomic writes and a reconciliation tool.

Building a conformant stdio MCP server in PHP

The wire-level rules that make a stdio MCP server correct in PHP - one writer to stdout, a bounded read with no natural limit, and a handshake that tells old clients from new ones.