Notes
How the agent fleet driving my product is actually wired. One expensive planner that holds the whole graph, one cheap executor forbidden from resolving ambiguity, model tiers chosen per step against a real spend telemetry feed, and a set of merge gates that decide what it may finish without me.
I built a two-role agent fleet to drive my story queue: an expensive planner holding the whole graph, and a cheap executor forbidden from thinking. Ten days and 503 agent-written commits later, three of its safeguards were reporting a protection they never provided. Here is each, and why none spoke.
A static service token in GitHub Secrets is a breach with the timer already running. So I replace them with an OIDC exchange: every CI job proves who it is at runtime and gets a token that dies in minutes. The mechanism, the links, the config, and an honest list of what still holds one.
Last post I found four checks that had silently stopped working. So I counted how many of my gates have a fixture that proves they can still fail. The answer was humbling: a handful, all code I wrote myself, none on the linter this series is named after. Here is what I did about it.
I counted every PR check I have ever run to answer a simple question. The answer was boring. What I found on the way is that several of my checks had never run at all, and nothing about a green build can tell you the difference.
Every Lionshead PR spins up its own running app and its own copy-on-write Postgres branch, created in seconds, deleted on merge. Local, preview, and prod are a stack, not a substitution. Here's how it works, what it costs (nothing), and the gotchas that bit me last week.
At enterprise scale, a breach is a bad quarter. At solo scale, it ends the product. So I automate the breach and run it against every PR. Here are the tools, links, and how each one is configured.
Lionshead PRs run a security suite, a cost gate, IaC scanning, and per-PR preview environments before any merge. Under five minutes end-to-end. I'm one person. Here's why that's not overkill.
A small page that tells you how this site was built. Took me ten years in corporate engineering to learn the word.
Distributing standards across ten small repos without a monorepo. A tiny CLI fetches a manifest, hash-compares each file, and copies upstream over local.