A holding company for software platforms. We build things that stay built.
I built a two-role agent fleet to drive my story queue: an expensive planner holding the whole graph, and a cheap executor forbidden from thinking. Ten days and 503 agent-written commits later, three of its safeguards were reporting a protection they never provided. Here is each, and why none spoke.
A static service token in GitHub Secrets is a breach with the timer already running. So I replace them with an OIDC exchange: every CI job proves who it is at runtime and gets a token that dies in minutes. The mechanism, the links, the config, and an honest list of what still holds one.
Last post I found four checks that had silently stopped working. So I counted how many of my gates have a fixture that proves they can still fail. The answer was humbling: a handful, all code I wrote myself, none on the linter this series is named after. Here is what I did about it.
I counted every PR check I have ever run to answer a simple question. The answer was boring. What I found on the way is that several of my checks had never run at all, and nothing about a green build can tell you the difference.
Every Lionshead PR spins up its own running app and its own copy-on-write Postgres branch, created in seconds, deleted on merge. Local, preview, and prod are a stack, not a substitution. Here's how it works, what it costs (nothing), and the gotchas that bit me last week.
At enterprise scale, a breach is a bad quarter. At solo scale, it ends the product. So I automate the breach and run it against every PR. Here are the tools, links, and how each one is configured.
Lionshead PRs run a security suite, a cost gate, IaC scanning, and per-PR preview environments before any merge. Under five minutes end-to-end. I'm one person. Here's why that's not overkill.
A small page that tells you how this site was built. Took me ten years in corporate engineering to learn the word.
Distributing standards across ten small repos without a monorepo. A tiny CLI fetches a manifest, hash-compares each file, and copies upstream over local.