DEV Community

I rejected a model that passed everyone else's benchmark

Priyansh Kansara — Sat, 03 Oct 2026 20:29:48 +0000

I vendored an audio deepfake detector into my verification platform. It loaded cleanly, every integration check passed, and the forward pass looked healthy. Then I measured it on a held-out slice and got an AUC of 0.54 — barely above chance. The vendor reports 0.9967. This is the story of what happened in between, and why I decided not to ship it.

The component that worked

The model is Spectra-AASIST3, an audio deepfake detector released under Apache-2.0. I vendored it into the project as a potential audio channel for a WhatsApp-first deepfake and malware verification platform. The integration work was straightforward and, by every check I ran, successful.

The checkpoint loaded without a single mismatch: 1022 out of 1022 keys matched and applied, 318.9 million parameters. The forward pass was responsive and produced sensible outputs across a range of inputs. I probed it with silence, real speech, envelope noise, and a pure tone. The bonafide logit came back at 1.63 on silence, 1.76 on speech, 1.33 on envelope noise, and 2.8 to 4.0 on tone. The model was clearly doing something — it was not broken, not degenerate, not returning constant outputs. It was alive and responsive.

By every integration test I had, this component worked.

But an integration test asks a narrow question: does the component run? Does it load? Does it produce outputs? Does it respond to inputs? It does not ask the question that actually matters: does it discriminate? Can it tell a real voice from a synthetic one on the data I care about? Those are different questions, and conflating them is how you end up shipping a model that passes every unit test and fails every user.

The bar, fixed before measuring

Before I ran the evaluation, I fixed the acceptance criterion in writing: AUC ≥ 0.85 on a held-out slice, with non-overlapping posterior quantiles between classes and a global posterior standard deviation above 0.01. Three conditions, all of which had to hold.

Fixing the bar in advance is the only reason this story has a clean ending. Once you have a number in front of you — any number — the temptation is to reason backwards. A 0.54 can become "not bad for a small slice" or "the bar was too strict" or "the vendor's number is on a different set anyway." All of those things might be true, and none of them matter if the bar was committed before the measurement. The bar is not a conclusion. It is a decision rule. You set it when you are still honest, and you live with the result.

The measurement

I evaluated on a 240-clip slice of ASVspoof 2019 LA — 120 real, 120 fake — drawn from the Bisher validation parquet. The result: AUC 0.54. The posteriors told the same story more starkly. Both class 0 and class 1 had interquartile ranges sitting at roughly 0.044 to 0.049. The distributions did not just overlap; they were essentially on top of each other. The global posterior standard deviation was 0.0046, an order of magnitude below the 0.01 threshold I had set.

The model was producing confident outputs. They were just not different outputs for real versus fake audio.

The gap I cannot explain

The vendor's published AUC on ASVspoof 2019 LA is 0.9967. My measured number is 0.54. That is not a small gap, and I want to be honest about what I know and do not know.

The vendor's number is computed on the full test set — 71,237 trials. My measurement is on a 240-clip slice of the validation parquet. These are not the same evaluation set, and the difference in scale is enormous. It is possible that the model performs dramatically better on the full test distribution than on this particular slice. It is also possible that something about the slice — its provenance, its label balance, its acoustic characteristics — makes it harder than the test set. I do not know which of these is true, and I am not going to pretend I do.

What I can say is that the discrepancy is unresolved. Resolving it would require re-running the evaluation on the official ASVspoof 2019 LA evaluation audio, which is 2.7 GB of data I have not yet processed. Until that re-proof happens, the 0.54 stands as the only measurement I have on data I can defend, and it is the number I have to make the decision on.

The decision

I did not wire the model into the serving path. Audio stays calibration-only. The vendored code is committed in-tree so that it can be re-proven quickly if official-eval evidence arrives, but the base-encoder weights are kept out of git, and the model is not used in any user-facing decision.

The project does not need an audio channel that does not work. It already has a fusion engine that combines calibrated per-signal evidence across video, image, URL, and government document channels. Adding a component that scores 0.54 would not make the system better. It would make it more complex and less trustworthy, because every downstream consumer would have to account for a signal that carries no information.

The leakage finding

This was not the first time I had to make this kind of call. Earlier in the same project, I trained a logistic regression fusion stack on out-of-fold predictions from the base audio detectors. The out-of-fold AUC was 0.512, against a heuristic baseline of 0.502. A gradient-boosted alternative scored 0.499 at n=84 — chance. Neither was wired.

The uncomfortable part of that story is what the single-split training run reported: 0.634. That number was real, in the sense that it was a genuine output of a genuine training run. It was also flattering, because the split happened to favor the model. The out-of-fold number — 0.512 — was the honest one, and it was the worse one. I reported the worse number.

This is a discipline that is easy to state and hard to practice. When you have two numbers and one of them is better, the better one is the one that wants to be in the commit message, the README, the portfolio. The worse one is the one that reflects what the model will actually do on data it has not seen. You report the worse number, and you explain why it is the worse number, and you move on.

The lesson

An integration test proves that a component runs. It does not prove that the component discriminates. Loading a checkpoint, matching keys, checking that the forward pass responds to inputs — these are necessary conditions, and they are easy to satisfy. They are also the conditions that every vendor demo and every quick-start notebook satisfies, because they are the conditions that are easy to show.

Discrimination is a separate property, and it has to be measured on data that represents the problem you actually have, against a bar you set before you see the result. If you do not fix the bar in advance, you will rationalize whatever number appears. You will find reasons why the slice is hard, why the vendor's number is on a different set, why 0.54 is close enough. You will be wrong, and you will not know it, because you will have convinced yourself after the fact.

I would rather ship a system with fewer channels and more confidence in the ones it has than a system with an audio detector that passes every integration test and cannot tell a real voice from a fake one. The model was not broken. It was rejected by a bar I set before I measured it. That is the whole story, and it is the interesting part.

Un backup sirve cuando puedes restaurarlo: laboratorio con SQLite y GitHub Actions

ANTONY PIERO SOLORZANO ZEGARRA — Sat, 03 Oct 2026 20:29:26 +0000

Una carpeta llena de copias no demuestra que una aplicación pueda recuperarse. Para comprobarlo, necesitamos provocar una pérdida controlada, restaurar una copia y verificar que los datos recuperados sean los esperados.

Este proyecto usa SQLite y un inventario ficticio. No utiliza Microsoft SQL Server. Incluye una aplicación que ejecuta SQLite en el navegador y un laboratorio de Python que prueba copias físicas y lógicas.

Primero, definir qué significa recuperarse

El RPO expresa cuántos cambios podemos permitirnos perder. Si guardo una copia y después ingreso una venta, restaurar esa copia no recuperará la venta posterior. El RTO expresa cuánto tiempo podemos permitir que dure la recuperación; incluye localizar la copia, preparar el entorno y comprobar la aplicación.

En esta demostración ambos conceptos se observan con pocos registros. El tiempo local mostrado es una medición del ejercicio, no una promesa para producción.

Elegir la estrategia

Una copia completa conserva un estado íntegro y simplifica la recuperación, pero su coste aumenta con el volumen de datos. Una incremental guarda cambios desde la copia anterior y exige reconstruir la cadena; una diferencial guarda cambios desde la última completa. Este laboratorio implementa copias completas, no incrementales, diferenciales ni recuperación a un instante mediante logs.

También hay formatos físicos y lógicos. En Python creo otra base SQLite mediante Connection.backup() y genero un dump SQL con iterdump(). El dump reconstruye esquema y registros, pero no conserva todos los detalles físicos del archivo. Ambas operaciones aparecen en la documentación de sqlite3 de Python.

Copiar un archivo activo sin coordinar escrituras puede producir una copia incorrecta o incompleta. SQLite ofrece su Online Backup API y la alternativa VACUUM INTO. Con WAL no debemos asumir que el archivo principal contiene todos los cambios confirmados. Aquí uso la API de backup.

Construir el ejercicio reproducible

El laboratorio funciona sin paquetes externos:

python3 backup_demo.py --output lab-results

El directorio debe ser nuevo para evitar sobrescrituras. El programa crea tres productos ficticios, obtiene una copia, calcula SHA-256 y genera un dump. Después vacía únicamente ese inventario desechable y restaura la copia.

La operación central es:

with sqlite3.connect(target) as snapshot:
    live.backup(snapshot)

Para recuperar invierto origen y destino. Antes de restaurar compruebo la copia y después comparo los registros con los originales. También reconstruyo otra base en memoria desde el dump SQL. El informe muestra filas iniciales, filas después del incidente, filas recuperadas e integridad.

La prueba ejecutada obtuvo 3 registros iniciales → 0 tras el incidente → 3 restaurados, con integrity_check correcto y restauración lógica correcta. GitHub Actions volvió a ejecutar la prueba antes de desplegar.

Una demo que cualquiera puede probar

La página usa sql.js para exportar bytes de una base SQLite y construir otra a partir de ellos, según la documentación de Database.

Crear una copia de los tres productos.
Añadir un cuarto registro después del backup.
Simular la pérdida: el inventario queda vacío.
Restaurar y comprobar que regresan los tres registros guardados.

El cuarto registro no estaba en la copia y no vuelve: así observamos el RPO. La recuperación verifica SHA-256, integridad y contenido. Este recorrido se probó también en la aplicación pública.

Podemos descargar la copia como .sqlite. La base activa y la copia interna viven en memoria y se pierden al recargar. GitHub Pages aloja la interfaz pública; SQLite se ejecuta en el navegador de cada visitante. No hay un servidor de base de datos compartido ni un servicio de backups remotos.

Automatizar el despliegue

El repositorio incluye .github/workflows/pages.yml. Cada push a main prueba la recuperación; solo si pasa, sube site/ y publica la aplicación en GitHub Pages. También puede iniciarse manualmente. Se habilita seleccionando GitHub Actions como origen de publicación en los ajustes del repositorio. El patrón está descrito en la documentación oficial de Pages.

El flujo no necesita contraseñas ni un token personal guardado en el código. Usa los permisos temporales de Actions. El despliegue es automático; el backup del navegador se crea al pulsar el botón. Son procesos distintos.

Verificar y almacenar fuera del dispositivo

SHA-256 detecta cambios si el hash de referencia es confiable; no cifra ni autentica la copia ante alguien que pueda sustituir archivo y hash. PRAGMA integrity_check comprueba estructura, mientras que comparar registros valida el resultado concreto del ejercicio. Ninguno sustituye todas las comprobaciones funcionales de una aplicación real.

Para un entorno real propondría tres copias, sistemas o medios de almacenamiento independientes y una ubicación externa, junto con permisos restringidos, cifrado y restauraciones periódicas. La copia del laboratorio en la misma memoria no cumple una estrategia 3-2-1.

También definiría retención según el RPO: por ejemplo, diarias durante siete días y semanales durante cuatro semanas, ajustadas a la necesidad real. El proyecto no implementa esa retención.

Lo que demuestra el proyecto

La evidencia es recuperar el inventario y comprobarlo. Crear una copia es el inicio; localizarla, restaurarla y confiar en su contenido es el resultado que buscamos. El repositorio y la aplicación ya son públicos. El video todavía debe grabarse y publicarse; el guion está disponible en el enlace inicial.

Proyecto y redacción preparados con asistencia de IA; las pruebas de restauración se ejecutaron localmente, en GitHub Actions y en la demo web.

A Windows context menu editor in one PowerShell file

ROCI — Sat, 03 Oct 2026 20:27:29 +0000

The Windows right-click menu is built from several different places, and Windows 11 hides half of it behind "Show more options". Most tools I found each cover one part of it. I wanted one list for all of it, so I built Context Menu Editor: a single PowerShell script with a WPF window, free and MIT licensed.

You can try it without installing anything:

irm https://rocisapps.com/cme | iex

You can read the source first, and the same script is attached to every GitHub release.

Here is how it works, and the parts that were harder than I expected.

Three kinds of entries

Windows builds the menu from three different places, and each one is switched off differently:

Shell verbs under Software\Classes\<class>\shell\<verb>. Adding a LegacyDisable value turns one off without deleting it.
Shell extension handlers under shellex\ContextMenuHandlers (7-Zip, antivirus, PowerToys). You turn one off by adding its CLSID to the per-user Shell Extensions\Blocked list.
Windows 11 packaged items, which apps declare in their AppxManifest.xml as windows.fileExplorerContextMenus. They have no command line at all, only a COM handler, and they are blocked the same way as extensions.

Reading all three into one list, with the right "off" mechanism behind each switch, is most of the work.

# Turn a shell extension off for the current user (restart Explorer afterwards)
$blocked = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey(
    'Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked')
$blocked.SetValue('{00000000-0000-0000-0000-000000000000}', '')   # the handler's CLSID

Do not use the registry provider

All registry access goes through Microsoft.Win32.Registry. The PowerShell registry provider treats the * in HKCU\Software\Classes\*\shell as a wildcard, so a path that means "all files" quietly matches other keys. The .NET API takes the path literally:

$shell = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Classes\*\shell')
$shell.GetSubKeyNames()

Send to, and items with no command line

Send to is a folder of shortcuts, so adding an app is easy. Windows 11 packaged items are not: Blip, for example, has a submenu of devices and no executable to point a shortcut at. The shortcut targets a small C# helper instead, which finds the item by its CLSID and calls it on the selected files, the way Explorer does. Submenu entries are matched by title first and by position only as a fallback, so pairing a new device does not change where an existing shortcut sends.

The helper is compiled at runtime with Add-Type and stored outside the script's folder, so shortcuts keep working if the editor moves.

One script, built from many files

The source is split into small files: core functions, UI, XAML, and JSON for the tweaks list. A Compile.ps1 stitches them into the single script people run. Two details only showed up with the one-line launch:

irm | iex passes a byte order mark through as code, which breaks parsing. The output is therefore pure ASCII and written without a BOM, and the compiler refuses non-ASCII characters.
Windows PowerShell 5.1 reads a BOM-less file as ANSI, which is only safe because of the ASCII rule.

The short URL is a redirect on my own domain to the latest GitHub release asset, so a new release is live as soon as it is published.

Startup time

The first version took about two seconds before any window appeared, and most of that was reading the registry. Two changes helped.

Open the window first. It appears straight away with a "reading" state, and the scan runs once the first frame is on screen:

$Window.Add_ContentRendered({
    $Window.Dispatcher.BeginInvoke(
        [System.Windows.Threading.DispatcherPriority]::Background,
        [Action]{ Invoke-Scan; Update-View })
})

The window now appears in 0.6 to 0.8 seconds, and the full list is ready at about the same total time as before.

Cache the compiled helper. Compiling the C# types cost 0.1 to 0.3 seconds on every start. Now they are compiled once and loaded from a cache file in about 15 milliseconds:

Add-Type -TypeDefinition $source -OutputAssembly $dll -OutputType Library   # first run only
Add-Type -LiteralPath $dll                                                  # every run

An elevated run never loads that cache. An administrator process should not load code from a folder a standard user can write to, so it compiles in memory instead.

PowerShell traps I hit

Variable names are case-insensitive, so a local $s quietly replaced a global $S. The shared state is now $App.
A function that returns an array with return ,$array can come out nested after @() or a pipeline. Returning the array directly is safer.
R is an alias for Invoke-History, which matters when a script defines a short helper function.
The `u{...} Unicode escape does not exist in Windows PowerShell 5.1.

Testing without touching your own menus

-LibraryOnly loads every function without opening the window, so the scanner and every write operation can be scripted. An early test run wrote into my real Send to folder, which taught me to point tests at a temporary Send to folder and a temporary backup folder. A separate sweep opens every page of the window and fails on any error, in both PowerShell 7 and 5.1.

Safety

Anything you edit or delete is exported to a .reg file first, and the last change can be undone from the status bar. Per-user changes need no administrator rights. The script makes no network calls except downloading itself again when you choose "run as administrator".

Try it, and tell me what is missing

Run it: irm https://rocisapps.com/cme | iex
Source (MIT): https://github.com/RoeeIlouz/ROCIsContextMenu-Editor
Guides: get the full right-click menu back in Windows 11 and remove items from the right-click menu

I am the author. If something breaks on your setup, or an entry is missing from the list, open an issue on GitHub. Please include your Windows version, PowerShell edition and what caused it to break.

StudyBuddy

Ankit Kumar — Sat, 03 Oct 2026 20:26:58 +0000

📚 I Built StudyBuddy — A Simple Study Workspace for Students

This is my submission for the Hacktoberfest Weekend Challenge: Build for a Friend.

👋 What I Built

Studying sounds simple:

Open your notes. Focus. Revise. Practice. Repeat.

But in reality, students often end up jumping between different tools for timers, tasks, flashcards, quizzes, and tracking progress.

So I built StudyBuddy — a focused study workspace that brings these essential study activities together in one place.

The idea came from a simple problem that almost every student can relate to: sometimes we spend more time organizing how we're going to study than actually studying.

StudyBuddy is designed to reduce that friction.

🧩 What can StudyBuddy do?

⏱️ Pomodoro Focus Timer — customizable focus and break cycles
📝 Study Tasks — plan and track tasks for your study session
🧠 Flashcards — decks, hints, starring, filtering, and mastery tracking
🎯 Practice Quizzes — timed questions, instant feedback, explanations, and score breakdowns
📊 Study Statistics — focus sessions, total study time, and streaks
🌧️ Ambient Sounds — browser-generated rain and white noise
⚙️ Custom Settings — personalize your study sessions and sound preferences
📦 Import / Export — backup your study data as JSON
🔄 Flashcard → Quiz Generation — quickly turn revision material into practice questions

The goal wasn't to build another complicated productivity dashboard.

It was to build something a student can open and immediately think:

"Okay. Let's study."

🎥 Demo

GitHub

👉 StudyBuddy on GitHub

The project is completely client-side, so you can run it locally by opening index.html or using a simple local development server.

🛠️ How I Built It

StudyBuddy is intentionally built using simple web technologies:

HTML5
CSS3
Vanilla JavaScript
Browser LocalStorage
Web Audio API

There is no backend or database.

The application stores study data directly in the browser, including tasks, flashcards, settings, and progress.

🧱 Application Structure

I separated the main functionality into controllers so that each part of the application has a clear responsibility.

PomodoroController

Handles:

Focus sessions
Breaks
Study cycles
Timer progress
Study statistics

TasksController

Handles the study checklist and task completion.

FlashcardController

Handles:

Flashcard decks
Filtering
Card interactions
Starring
Mastery tracking

QuizController

Handles:

Timed quizzes
Answer selection
Scoring
Feedback
Result reviews

SettingsController

Handles:

User preferences
Study configuration
Content management
Import/export
Quiz generation

SoundEngine

Uses the browser's Web Audio API to generate timer sounds and ambient audio without depending on external audio files.

🤖 What About AI?

This is an important part of the project.

StudyBuddy does not currently call an external AI API or bundle an AI model.

Instead, the current quiz-generation system is implemented locally in JavaScript.

It takes existing flashcards and creates multiple-choice questions by using the flashcard answer as the correct option and selecting other flashcard answers as distractors.

I deliberately kept this part local because I wanted the core StudyBuddy experience to work:

Without API keys
Without a backend
Without cloud dependencies
Without sending personal study data to an external service

That also leaves room for future versions to experiment with open-source or local AI models without making AI a requirement for the basic application.

🌍 Why Does Open Innovation Matter?

For me, open innovation is about making useful software that other people can actually understand, modify, and build upon.

StudyBuddy doesn't require a proprietary backend to provide its core functionality.

Because the project is browser-based:

🔓 Accessible

Anyone can clone the repository and run it without configuring API credentials.

👀 Transparent

The study logic is available directly in the source code.

🛠️ Modifiable

Developers can add new study modes, analytics, quiz systems, integrations, or AI features.

🌐 Portable

The application can run as a simple static website.

🔐 Privacy-friendly

Personal study data can remain in the user's browser instead of being sent to a remote database.

And that's one of the things I like about open source:

Someone can take a small idea, understand how it works, and turn it into something much bigger.

💡 What I Learned

Building StudyBuddy reminded me that a useful product doesn't necessarily need dozens of features.

Sometimes the most important thing is removing the small barriers that stop someone from getting started.

While building it, I had to think about:

Managing application state without a backend
Persisting data with LocalStorage
Building reusable JavaScript controllers
Generating quizzes from existing content
Creating browser-based audio with the Web Audio API
Handling import/export of application data
Keeping the interface simple enough to use during an actual study session

The biggest lesson for me was:

Good productivity software should reduce friction, not create another task to manage.

🚀 What's Next?

There are still plenty of directions I would like to explore:

📱 Progressive Web App / mobile support
☁️ Optional cloud synchronization
📊 More advanced study analytics
🧠 Spaced-repetition scheduling
🎯 More quiz formats
🤖 Optional open-source/local AI integration
📅 Calendar-based study planning
🌧️ More ambient environments
🔌 More offline-first capabilities

The current version focuses on keeping the core experience simple and dependency-free.

🧑‍💻 Try It

Repository:
👉 github.com/ankitkumar810/StudyBuddy

If you're a student, try it for one study session.

If you're a developer, fork it and make it your own.

And if you have an idea for a feature, I'd love to see what you build with it. ❤️

🤝 Hacktoberfest

This project was built for the Hacktoberfest Weekend Challenge: Build for a Friend 2026.

The challenge made me think about something I often overlook while building projects:

Who is actually going to use this?

Instead of starting with a technology or a complicated architecture, I started with a person and a simple problem:

"How can I make studying a little easier to start?"

That became StudyBuddy.

🔗 Links

### 📚 Study smarter. Focus better. Keep learning. **Built with HTML · CSS · JavaScript · LocalStorage · Web Audio API**

I built a tiny tool that catches the "printed at 94%" problem

clearwaterfromspeakers — Sat, 03 Oct 2026 20:26:27 +0000

Hi everyone,

I built a free print scale checker as part of my printer test site, after running into a frustrating problem: prints that look fine but come out the wrong size.

The usual cause: an A4 file printed on Letter with "Fit to page" on shrinks to about 94%. Nothing looks broken, but templates, labels and patterns are off.

What I focused on:

Print one sheet, measure a 100 mm bar, type the number
It tells you the scale and whether it matches a paper-size mismatch
Runs in the browser, nothing uploaded

What I learned:

"The printer printed" and "it printed correctly" are different checks
Real vector PDFs beat HTML print for exact sizes

Question for developers: have you built anything that has to print at an exact size? How did you test it?

Building a Sub-Minute Cross-Platform Inventory Sync Engine with n8n, Shopify, WooCommerce & Airtable

Ruesch Manny — Sat, 03 Oct 2026 20:25:54 +0000

Building a Sub-Minute Cross-Platform Inventory Sync Engine with n8n, Shopify, WooCommerce & Airtable

Dual-channel e-commerce sounds great on a slide deck until an order drops simultaneously on Shopify and WooCommerce for your last unit of inventory. Within 45 seconds, you've oversold, triggered a support ticket, and compromised a customer relationship.

Most teams reach for commercial integration platforms (Zapier, Celigo, or specialized multichannel SaaS tools). Then they discover the fine print: tiered pricing based on order volume, 15-minute polling windows on entry tiers, or brittle two-way connectors that enter infinite webhook loops the moment inventory changes bounce back and forth.

In this technical breakdown, we will walk through engineering a self-hosted, bidirectional inventory synchronization engine using n8n and Airtable as an immutable Single Source of Truth (SSOT). This setup achieves sub-minute delta propagation, completely eliminates infinite sync ping-pong, and runs on your own infrastructure for pennies a day.

1. The Bottleneck: Why Commercial Multi-Channel Sync Breaks

Commercial sync services rely on two flawed primitives:

High-Frequency Polling: Checking platform APIs every 5–15 minutes introduces a massive latency window where stockouts happen invisibly.
Direct Point-to-Point Webhooks: Triggering an inventory adjustment on Shopify when WooCommerce updates creates an immediate echo loop unless state is cleanly managed.

Shopify Order Placed -> Webhook to WooCommerce -> WooCommerce Stock Drops
                                  ^                               |
                                  |--- Webhook to Shopify fires --|

Without an atomic central state orchestrator, platform A and platform B trade fractional updates until API rate limits throttle both endpoints or your SKU balances hit negative values.

Furthermore, direct multi-point sync burns through Shopify's REST/GraphQL leaky bucket limits (40 requests/sec for Plus, 2 requests/sec for standard) and WooCommerce's REST bottlenecks on unoptimized WordPress MySQL instances.

To solve this, we design a hub-and-spoke pipeline with Airtable acting as the lock-manager and single source of truth.

2. Architecture: Hub-and-Spoke with Atomic Locking

[ Shopify Webhook ]     --> [ n8n Ingestion Node ]
                                     |
[ WooCommerce Webhook ] --> [ Delta Sanitization Node ]
                                     |
                            [ State Check in Airtable (SSOT) ]
                                     |
                        +------------+------------+
                        | Is Delta Actual & New? |
                        +------------+------------+
                                     |
                      YES            |            NO (Echo Loop)
                       |             +-------------> [ Drop / Log Event ]
                       v
        [ Update Airtable Master Record ]
                       |
       +---------------+---------------+
       |                               |
       v                               v
[ Push to Shopify API ]    [ Push to WooCommerce API ]
       |                               |
       +---------------+---------------+
                       |
               [ Audit / Alerting ]

Pipeline Flow:

Webhook Ingestion: Changes trigger on orders/create, inventory_levels/update (Shopify), and woocommerce_rest_insert_product_review or product.updated (WooCommerce).
Lock Verification & Hash Matching: We compute a state signature hash(SKU + New_Quantity + Timestamp_Window) and verify if this event was initiated by our own sync engine.
Airtable Reconciliation: Fetch the canonical record via SKU. Check if Target_Qty !== Current_Master_Qty.
Batched Downstream Fanout: Broadcast the new inventory levels to counterpart endpoints using rate-managed chunks.
Audit Trail: Write an execution ledger entry. If stock hits <= 0, dispatch an alert to Slack/Discord.

3. The Code & Logic: Loop Prevention and State Normalization

Step 1: Normalizing Webhook Payloads (n8n Code Node / JavaScript)

Incoming payloads from Shopify and WooCommerce have completely different data shapes. We normalize both down to a unified schema inside an n8n Code Node.

// Ingestion Normalizer Code Node
const items = $input.all();
const output = [];

for (const item of items) {
  const json = item.json;

  let normalized = {
    source: '',
    sku: '',
    newQuantity: 0,
    syncOriginatorId: null
  };

  // Check if Shopify Payload
  if (json.inventory_item_id || json.available !== undefined) {
    normalized.source = 'shopify';
    normalized.sku = json.sku || $('Extract_SKU').first().json.sku;
    normalized.newQuantity = parseInt(json.available, 10);
    // Custom metadata check to prevent loops
    normalized.syncOriginatorId = json.sync_token || null;
  }
  // Check if WooCommerce Payload
  else if (json.stock_quantity !== undefined) {
    normalized.source = 'woocommerce';
    normalized.sku = json.sku;
    normalized.newQuantity = parseInt(json.stock_quantity, 10);
    normalized.syncOriginatorId = json.meta_data?.find(m => m.key === '_sync_originator')?.value || null;
  }

  if (normalized.sku) {
    output.push({ json: normalized });
  }
}

return output;

Step 2: Preventing Webhook Echo Loops (Loop Breaker Logic)

To prevent ping-pong updates, we compare the incoming update against the current state stored in Airtable. If the delta is 0 or originated from our system's active lock token, the execution terminates immediately.

// Conflict Resolution & Loop Suppression Node
const input = $input.first().json;
const masterRecord = $('Fetch_Airtable_SKU').first().json;

const currentMasterStock = parseInt(masterRecord.fields['Master_Stock'], 10);
const incomingStock = input.newQuantity;
const lastSource = masterRecord.fields['Last_Sync_Source'];

// Condition 1: Zero-Delta check
if (incomingStock === currentMasterStock) {
  return [{ json: { execute: false, reason: 'Zero delta: State already synchronized.' } }];
}

// Condition 2: Circular update check
// If the change came from the platform we updated less than 15 seconds ago
const lastSyncTime = new Date(masterRecord.fields['Last_Sync_Timestamp']).getTime();
const timeDifferenceSeconds = (Date.now() - lastSyncTime) / 1000;

if (input.source === lastSource && timeDifferenceSeconds < 15) {
  return [{ json: { execute: false, reason: 'Circular echo caught: Update originated from active sync window.' } }];
}

// Passed all checks: Safe to broadcast
return [{
  json: {
    execute: true,
    sku: input.sku,
    stockToSet: incomingStock,
    originSource: input.source,
    airtableRecordId: masterRecord.id
  }
}];

Step 3: Shopify GraphQL Inventory Adjustment Payload

Instead of clunky REST endpoints, use Shopify's modern inventorySetOnHandQuantities mutation to update stock instantly with an idempotent reference ID:

mutation InventorySetOnHand($input: InventorySetOnHandQuantitiesInput!) {
  inventorySetOnHandQuantities(input: $input) {
    inventoryAdjustmentGroup {
      id
      createdAt
    }
    userErrors {
      field
      message
    }
  }
}

Variables passed dynamically by n8n:

{
  "input": {
    "reason": "correction",
    "referenceDocumentUri": "gid://n8n-sync/{{ $json.originSource }}-{{ $now.toMillis() }}",
    "setQuantities": [
      {
        "inventoryItemId": "gid://shopify/InventoryItem/{{ $json.shopifyInventoryItemId }}",
        "locationId": "gid://shopify/Location/{{ $json.shopifyLocationId }}",
        "quantity": {{ $json.stockToSet }}
      }
    ]
  }
}

4. Deployment, Rate Limiting & Fail-Safes

When syncing catalogs containing thousands of SKUs during peak events (Black Friday, flash sales), naive setups trigger HTTP 429 rate limits or execution queue lockups.

1. Batching & Throttling in n8n

Split In Batches Node: Route bulk updates through batches of 25 items.
Wait Node: Configure a 250ms buffer between calls to respect Shopify's 2 req/sec standard REST baseline (or higher for GraphQL buckets).
Exponential Backoff: In n8n's HTTP Request settings, activate Retry On Fail (up to 3 attempts) with a wait between tries of 1000ms.

2. Guarding Against Negative Inventory States

Miscalculations can sometimes push numbers below zero. In your Airtable validation node, insert an alert boundary:

if ($json.stockToSet < 0) {
  // Route execution to an alert path
  return [{ json: { error: true, alertType: 'NEGATIVE_STOCK_ALERT', sku: $json.sku, attemptedVal: $json.stockToSet } }];
}

Connect this branch directly to a Discord or Slack node to notify the operations team before an overselling disaster takes place.

5. Conclusion & Ready-to-Use Workflow

By placing an intelligent mediator (n8n + Airtable) between Shopify and WooCommerce, you get:

Sub-minute sync speeds (typically < 3.2 seconds end-to-end).
Zero recurrent per-order sync costs.
Full architectural control with comprehensive audit logs and circular loop protection.

You can manually build this workflow in your own n8n instance using the schemas, GraphQL payloads, and Code Node logic detailed in this guide.

If you prefer to skip the boilerplate, configuration headaches, and test fixture construction, you can download the production-ready package—complete with preconfigured JSON workflows, Airtable base schemas, and edge-case routing:

Instant Access on Whop
Direct Download on Gumroad — Use promo code EARLYBIRD for 20% off.

Have questions on handling specific channel edge-cases or complex variant mapping? Drop a comment below!

From Comics to Code: Building MyZubster One Piece of Evidence at a Time

Nicola Lorenzini — Sat, 03 Oct 2026 20:25:32 +0000

From Comics to Code: Building MyZubster One Piece of Evidence at a Time
It started with a comic.
N4K48 visually represented a journey: a software idea taking shape and imagining its path into the MyZubster metaverse.
Those panels were not screenshots of a finished product. They were not proof of a fully decentralized platform. They were a representation of something we wanted to build.
Then we started turning that narrative into verifiable software.
From Storytelling to Evidence
One of the questions that emerged during development was surprisingly simple:
How can an AI system distinguish between something that was actually recorded and something that merely sounds plausible?
For MyZubster, the answer is increasingly becoming:
Start with evidence.
An observation enters the system with an identifier. It is persisted, indexed, and made searchable.
Qdrant provides semantic retrieval. Ollama provides local AI inference. A RAG layer connects questions, retrieved sources, and generation.
But while testing the system, we discovered something more important than simply proving that “RAG works.”
We saw how easily a language model can take a correct source and still produce an incorrect answer.
For example, MyZubster contains a real observation:
ID: 21089771b2a73a9f
Description: Test reale MyZubster RC2 - N4K48

Semantic retrieval correctly found that observation.
But when we asked the model to describe it, the model could still introduce additional statements that were not supported by the retrieved evidence.
That changed the way we approached the problem.
Retrieval Is Not the Same as Truth
We started separating two problems that are often treated as if they were the same:
Finding information and deciding what the system is allowed to claim based on that information.
We introduced a deterministic path for observation IDs.
If a request contains an existing observation ID, MyZubster prefers the exact observation over semantic similarity.
If the ID looks valid but does not exist, the system does not silently search for something similar and use that as a substitute.
Instead, it returns:
Informazione non disponibile nelle fonti MyZubster.

In English:
Information is not available in the MyZubster sources.

This sounds like a small behavior change.
It is not.
It means that absence of evidence is no longer treated as permission to generate a plausible substitute.
Sometimes the AI Should Not Generate
We found the same problem with descriptions.
When a user explicitly asks for the description contained in the evidence, why should a language model rewrite it?
We tested exactly that.
The correct evidence was:
Test reale MyZubster RC2 - N4K48

Yet a small local model could turn it into a longer response containing claims that were never present in the source.
So we changed the architecture.
When MyZubster can answer an authoritative question directly from the retrieved evidence, it can bypass generation and return the evidence verbatim.
The result becomes:
Test reale MyZubster RC2 - N4K48

Nothing added.
Nothing “improved.”
Nothing invented.
That led us to an important design principle:
When the software already knows the fact, we do not necessarily need AI to reinvent the answer.

AI becomes useful where interpretation and synthesis are actually required—not as an unavoidable intermediary between the user and every piece of stored evidence.
Local AI, Connected to Evidence
The current prototype connects several components:
User
↓
Open WebUI
↓
OpenAI-compatible MyZubster API
↓
Retrieval / deterministic evidence paths
↓
Qdrant
↓
MyZubster evidence
↓
Ollama when generation is actually needed
↓
Answer

We exposed the MyZubster RAG system through an OpenAI-compatible API, allowing Open WebUI to use myzubster-rag as a model.
That gave us a practical end-to-end environment in which we could test the entire path from the user interface to the underlying evidence.
And the tests uncovered real architectural problems.
At one point, an observation existed in persistent storage but was missing from Qdrant.
That exposed another important distinction:
stored data and searchable data are not automatically the same thing.
So we added an explicit observation-index recovery mechanism capable of rebuilding the search index from persisted observations.
Again, this is not primarily about making a chatbot answer questions.
It is about being able to understand where an answer came from and whether the underlying evidence can be recovered.
From Software to Decentralization
This is where decentralization enters the story.
And this distinction matters:
MyZubster does not become decentralized simply because we use local AI, hashes, identifiers, or an internal ledger.
A digitally recorded event is not automatically a blockchain event.
A database entry is not automatically decentralized evidence.
We have deliberately tried to preserve those distinctions in the prototype.
The more interesting question is:
If evidence originates inside MyZubster today, how could someone verify it tomorrow without having to blindly trust MyZubster itself?

That is where decentralization becomes meaningful.
Hashes, provenance, identities, attestations, and externally verifiable records can eventually allow evidence to move beyond the trust boundary of a single application.
But before decentralizing evidence, we need to know exactly what is being attested.
That is one reason we are building the evidence layer first.
Decentralization without provenance can simply distribute uncertainty.
From the Comic to the Commit History
The N4K48 comic represented a vision.
The software is slowly turning parts of that vision into properties we can actually test.
Some of the latest checkpoints tell that story:
16f0800 fix: add observation index recovery
d1aa48f fix: prefer exact observation ID retrieval
8106276 fix: reject unknown observation IDs safely
87a1021 fix: return authoritative descriptions verbatim

The interesting part is not the commit count.
It is the progression.
First, recover the evidence.
Then make sure an exact identifier retrieves the exact evidence.
Then make sure a nonexistent identifier cannot silently become “something similar.”
Then prevent the language model from rewriting an authoritative description when no generation is necessary.
Each step removes a little ambiguity from the system.
Evidence First, Generation Second
This is gradually becoming one of the core ideas behind MyZubster:
Observe
↓
Record
↓
Preserve
↓
Retrieve
↓
Verify
↓
Generate only when necessary

Most AI systems are designed around the final step.
We are increasingly interested in everything that happens before it.
Because an eloquent answer is not necessarily a grounded answer.
A semantically similar document is not necessarily the requested evidence.
A model saying something confidently does not turn it into a recorded fact.
And a decentralized record is only useful if we understand what that record actually proves.
Where This Is Going
The goal of MyZubster is not to build an AI that appears to know everything.
The more interesting goal is to build a system that becomes increasingly capable of distinguishing between:
what was observed,
what was recorded,
what can be retrieved,
what can be verified,
and what the AI generated.
There is still a lot to solve.
Generic semantic questions can still retrieve partially relevant context. Small local models can still infer things that the evidence does not say. Provenance can become stronger. Verification can extend beyond the boundaries of one application. And decentralization remains a direction to build and test rather than a label to attach prematurely.
But that is exactly why this journey is interesting.
It started with comic panels imagining a world.
Now we are working on the less spectacular—but perhaps more important—part:
giving that world a verifiable memory.
From comics to evidence.
From evidence to software.
From software to verification.
From verification toward decentralization.
And this time, every step should leave evidence behind.

Two Sisters Tinctures: Building an Apothecary Skincare Tracker with Gemma 4 for My Sister

Earl Grey — Sat, 03 Oct 2026 20:25:06 +0000

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

TL;DR: I built a skincare shelf tracker for my little sister. Gemma 4 reads a product (typed name or pasted ingredients) and fills in the card. The model gets to read the label. It does not get a vote. A plain rules file decides what goes on first, what waits until night, and what should never be layered with what.

What I Built

My little sister is my skincare product whisperer. Every time I need a cleanser, a serum, or a sunscreen, I ask her. She knows what she uses, what works, and what she gave up on, and all of that lives in her head and on her bathroom shelf.

So for Build for a Friend, I built her a place to keep it: a private skincare shelf. It helps her keep her own routine straight, and the next time I ask "what should I get?", her answer is already on her phone. She can screenshot her shelf and send it to me.

Two Sisters Tinctures lets her add a product by typing its name or pasting its ingredient list, keep track of what she owns, see when something has been open too long, and get a morning and night routing, with a warning when two things on her shelf should not be layered. Her shelf lives in her own browser. There is no account.

I didn't want AI deciding my sister's skincare routine. I wanted it doing the annoying reading.

So the design rule became: the model reads, the rules decide. Gemma 4 reads the label and drafts the card. She checks it and taps save. A plain rules file, not the model, decides the order, what waits until night, and the warnings. Nothing lands on her shelf without her confirming it.

If I had to say it in one breath:

I built a private skincare shelf for my sister where AI does the fuzzy reading, but deterministic code makes the decisions. The model cannot silently add something to her shelf, rules don't depend on model improvisation, her data stays in her browser, and I measured where the model fails instead of hiding it.

Then I handed it to her. What she said is at the end of this post.

Demo

Live app: https://two-sisters-tinctures.onrender.com/
Want to look around without adding anything? Add ?demo=1 to the address and you get a pre-filled demo shelf. It lives in memory only, so it is gone when you close the tab. The shelf, the night routine, and the Add screen (demo shelf, invented products).

The best-read tip on the Paste screen, and a gap hint on a small shelf.

Code

earlgreyhot1701D / two-sisters-tinctures

A skincare shelf tracker I built for my little sister. Paste the ingredients, type a name, or snap the label, and Gemma 4 explains what it does. Plain rules handle routine order, don't-mix warnings, and shelf life, and her shelf never leaves her phone. Built for the DEV Hacktoberfest Weekend Challenge: Build for a Friend.

Two Sisters Tinctures

A skincare shelf tracker built for my little sister. She adds a product, it becomes a card on her shelf, and the app sorts the shelf into a morning and evening order and flags things that should not be layered.

Live: https://two-sisters-tinctures.onrender.com/ Look around first: add ?demo=1 to the address for a pre-filled demo shelf (memory only, gone when you close the tab).

Built for the DEV Hacktoberfest Weekend Challenge: Build for a Friend (October 2 to 5, 2026).

AI assisted. Human approved. Powered by NLP.

Screenshots

Phone-sized views of the demo shelf (?demo=1). The products in the demo are invented.

The shelf	Night routine, with a reason for each step	Add a product (photo is coming soon)
Paste screen with the best-read tip	A gap hint on a small shelf

What it does

Add a product by typing its name, or pasting the ingredient…

View on GitHub

It is one small Node service. It serves the static front end, one health check, and one API route, POST /api/read. The shelf itself lives in the browser's localStorage. There is no database and no account.

How I Built It

The open model at the center is Gemma 4 26B A4B (gemma-4-26b-a4b-it), open weights under Apache 2.0, served through Google's Gemini API. Every product that lands on her shelf starts as a Gemma read, and everything after that read is plain code.

I do not write code. I direct, agents generate, I validate and decide. This one was a three-way build, so here is who did what:

Who	What
Me	Wrote the PRD first, set every MUST / STUB / NEVER label, approved each block, tested on a Samsung and two iPhones, made every call about what the app says to my sister
Antigravity (mostly Gemini 3.8 Flash on low, Sonnet 4.6 when I hit my limits, with the DevRelay MCP connected)	Blocks 0 to 2 (project skeleton, the shelf and its screens on mock data, rules and shelf storage), the first gold fixture draft and the gold set runs in Block 3 (the session embedded below), and after my credits reset: the Block 7 polish (greyed photo card, best-read tip, gap hints), the ingredient-rule bug fixes, and the route tests and static file hardening
Claude (in Cowork)	Block 3 steps 9 to 12 (rate limits, output validation, the Gemma call, the `/api/read` route, front end wiring), the 53 ingredient notes, Block 4 live checks, Block 3b tests, lint, and CI, reviews of Antigravity's later plans and changes against the files, the bug hunt diagnosis, the README, the screenshots, and the first draft of this post
Gemini	The hero image
Stitch	The UI design

The order I used: PRD first, then blocks, with a pass or fail check after each one. Mock data first, so the layout worked before any API was wired to it. Features not in the current phase got a comment stub with notes, not a half-built version.

The model reads. The rules decide.

This is the one design call I care about most. Gemma is good at turning a messy label into structured fields. It is not who I want deciding whether a retinol serum and a glycolic acid toner should share a night.

So the split is deliberate. Gemma only ever answers one question: "what is this product?" Everything after that comes from public/rules.json, a plain file I can read: the product types, the morning and evening order, the conflicts, and 86 ingredient notes with aliases. Structure is deterministic. Flavor, meaning the one-line description, is the model's.

Here is the whole path a product takes:

what she types or pastes
        ↓
Gemma 4, called from a small Node service on Render
        ↓
validator: right shape, a known type, only ingredients she pasted
        ↓
she checks the card and taps save
        ↓
rules.json: order, night-only, warnings
        ↓
her shelf, stored in her own browser

Then the model's answer goes through a validator before the app trusts it. The validator:

rejects anything that isn't the expected shape, and reports a reason code, not the raw text
trims names and descriptions that run too long
throws away any ingredient that does not appear in what she pasted (ignoring case, spacing, and dash style)
replaces a "what it does" line that mentions an ingredient the product doesn't list If the model is down, slow, or returns garbage, the app says so and offers to add the product by hand. A blank screen was on my NEVER list.

The gold set

The first time I ran my gold set against the model, it scored 0 of 5. It took four runs and a handful of fixes to get to 5 of 5, and there is a catch in which 5 of 5 that is.

The gold set is five skincare products I bought or looked up. Each has an expected type and ingredient list I checked against the source. Two of the first fixtures an agent drafted for me were partly made up (a wrong source link, and ingredient lists I could not verify), so I checked each one against the product pages and replaced them.

Input	Reads correct
Product name plus ingredients	5 of 5
Ingredients only, no name	3 of 5

With only an ingredient list, the BYOMA serum and the CeraVe cleanser both came back as "Moisturizer." That is a fair guess from a list of lipids and humectants, and still wrong. That is the reason the Add screen has an optional product name box on the Paste tab.

Input:     ingredient list only
Measured:  3 of 5 types correct
Response:  optional product name box, ingredients checked against what she pasted, her confirmation before saving
Result:    the model stays useful without being treated as the authority

A read takes about 2 to 4 seconds live.

Protecting a model key on a public link

The model runs on the Gemini API, paid tier, so every read has a small cost. Here is what keeps a public link affordable:

50 reads a day for the whole app, 10 a day per visitor, and a per-minute limit
same-origin check on the API route
the key is only in the server's environment, never in the browser, never in the repo
the key is restricted to the Gemini API, and a $5 budget alert sits behind all of it

The bug hunt the day before submitting

The tests were green and CI was green. Then I used the app, and almost everything I added landed on "Night only." One ingredient also vanished between pasting and saving.

The model was not the problem. The rules file was. The rule that sends strong actives to night matched any ingredient name that contained an acid's name, at any strength, on any product. I ran it against my own gold set:

Product	What tripped the rule	What the app did
BYOMA Hydrating Serum	Lactic Acid, there only to adjust pH, near the end of the list	Night only
L'Oreal Age Perfect SPF 30	Capryloyl Salicylic Acid, which contains the words "salicylic acid"	A daytime sunscreen, set to Night only

The same loose match fed the "don't mix tonight" warnings, so the same products would have raised false alarms next to a retinol. The vanishing ingredient was two smaller things: the save step split the list on every comma, which turns "1,2-Hexanediol" into "1" and "2-Hexanediol", and the paste guard dropped any name the model wrote with a different dash than the label.

The fix stayed deterministic. One small matcher now handles every ingredient rule. It matches whole ingredient names. Acids only count in the first ten ingredients, where the stronger ones sit, which is a rule of thumb and I wrote it down as one. Anything typed Sunscreen, or with SPF and a number in the name, is always morning. Conflict warnings only fire between two different products that both get used at night. Each of those cases is now a test, using the two products that broke it.

The lesson I am keeping: the deterministic part needs the same testing as the model.

Tests and checks

48 tests run with npm test: 10 added during the bug hunt and 8 route tests that start the real server and check each error path of the API. ESLint runs with a rule that flags unsafe DOM writes, since I only use textContent, never innerHTML. GitHub Actions runs lint, tests, and npm audit on every push, and it is green.

What it does not do yet

Photo input is not built. The card on the Add screen is greyed out and says "Coming soon." I tested a web lookup for ingredients instead (it found the right list for 2 of 2 products I tried by hand), and stubbed that too, because two products is not enough proof and it needs a second key. I cut both so I could finish what I had.
Ingredients-only reads are right 3 times out of 5 in my gold set. Add the product name.
Editing a saved product's details is coming soon. Changing the type works today.
app.js is one file doing too many jobs (about 1,600 lines). Splitting it is on the after-the-contest list in the repo, instead of rushed the night before.
Only the Gemini path is tested. Ollama is a stub.
No allergy checks, and this is not medical advice. It is a shelf and a set of order and conflict notes.

Why Does Open Innovation Matter?

Gemma 4 is open weights, and Google's own Gemma terms page points Gemma 4 to an Apache 2.0 license. This weekend I call it through Google's API, the same way I would call a closed model. What open changes is how much of the system I get to control.

The model is a part, not the brain. Gemma's answer has to pass a narrow contract: a fixed shape, a type from my list of 11, and only ingredients that appear in what she pasted. The skincare logic never sees anything else. So the reader can be swapped without rewriting a single rule, and with open weights the swap can be the same model on hardware I control. The model call lives in one file behind one setting, MODEL_PROVIDER. The local path (Ollama) is a stub with notes, not tested.

I get to keep it. Apache 2.0 means a vendor changing its terms does not take the reader away from her shelf. A closed API gives me no exit like that.

Failures stay visible. I measured where the model is wrong, 3 of 5 from ingredients alone, and designed around it: a name box, the validator, and her confirmation. A model mistake cannot quietly become something her shelf believes.

Open also means being clear about where her data goes:

Her shelf stays on her phone. It lives in the browser's own storage. It never goes to my server, and there is no account.
What does leave the phone is the product name or ingredient text she types or pastes, sent to Google's paid Gemini API so Gemma can read it. Google's Gemini API terms say that on paid services it does not use prompts or responses to improve its products. I checked that page in early October 2026, and I would re-read it before relying on it.
My server keeps none of it. It logs reason codes and timings only, never what she sent. No photos are sent, because photo input is not built.

My Agent Session

Two Sisters Tinctures - Block 3 Gold Set and Status Check

You

<USER_REQUEST>
Context update, read before doing anything. While your quota was out, Claude built and I pushed Block 3 steps 9, 10 and 11, so do NOT redo them. Run git pull first and read these files before changing anything: server/limits.js, server/validate.js, server/gemma.js, server/index.js, public/read-client.js, test/server-logic.test.js.

What exists now:
- POST /api/read works with the real model (tested paste, typed, and a prompt injection test, all clean). Model timeout is 30 s (MODEL_TIMEOUT_MS). Thought parts are filtered.
- DEMO CODE WAS DROPPED. No X-Demo-Code, no DEMO_CODE env var, no code box. Protection is daily caps: DAILY_CAP default 50 total, IP_DAILY_CAP default 10 per visitor, plus a per-minute limit. About screen says so (VOICE id about.limit).
- Paste and Typed on the frontend call the server through public/read-client.js and fill the existing confirm form. Snap the label is a STUB until Block 5.
- node --test test/server-logic.test.js passes 12 of 12.
- Claude tested the browser flow already. Do NOT run browser testing.

Task: Block 3 gold set. Do ONE step, then STOP and give a SHORT report (files changed, commit hash if you commit, nothing else).

STEP 12: gold set of 5 real products.
1. Create test/fixtures/gold/ with 5 JSON files, one per product: { "id", "mode": "paste", "text": "<pasted label or website ingredient text>", "expect": { "type": "<one of the 11 rules.json types>", "mustInclude": ["<2 to 3 ingredients that must be returned>"], "mustNotInclude": ["<ingredient not in the text>"] }, "source": "<URL>", "checked": "2026-10-03" }.
2. Pick 5 well-known products across different types (for example a cleanser, a retinol serum, a vitamin C serum, a moisturizer, a sunscreen). Ingredient text MUST be copied from the brand's own product page or a retailer page. NEVER invent or reconstruct an ingredient list from memory. If you cannot verify one, leave that file out, say so, and STOP so I can supply it.
3. Create test/gold.mjs: loads .env with process.loadEnvFile (wrappe
<truncated 246 bytes>
hes, mustInclude present, mustNotInclude absent) plus the time in ms, then a total like "4 of 5". Never print the API key. Do not log the full model response.
4. Add "gold": "node test/gold.mjs" to package.json scripts. It must NOT run as part of node --test (it calls the real API).
5. Do NOT run test/gold.mjs yourself. I will run it locally.
6. Add one row to TASKS.md under Block 3 for the gold set, unchecked until I run it.

Rules: one file one responsibility, no refactoring of other code, textContent not innerHTML, no em dashes in any text, add any new user-facing line to VOICE.md as an unchecked row (there should be none here). Propose nothing else. When done, run node --check on new files and the 12 existing tests, then STOP.
</USER_REQUEST>

Agent

▸ run_command {"CommandLine":"\"git pull\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBefo...

Input

$ {"CommandLine":"\"git pull\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Pull latest git changes\"","toolSummary":"\"Pull git repo\""}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\server\\\\limits.js\"","EndLine...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\server\\\\limits.js\"",
  "EndLine": "100",
  "StartLine": "1",
  "toolAction": "\"View server limits code\"",
  "toolSummary": "\"View server limits\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\server\\\\validate.js\"","EndLi...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\server\\\\validate.js\"",
  "EndLine": "150",
  "StartLine": "1",
  "toolAction": "\"View server validate code\"",
  "toolSummary": "\"View server validate\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\server\\\\gemma.js\"","EndLine"...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\server\\\\gemma.js\"",
  "EndLine": "150",
  "StartLine": "1",
  "toolAction": "\"View server gemma code\"",
  "toolSummary": "\"View server gemma\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\server\\\\index.js\"","EndLine"...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\server\\\\index.js\"",
  "EndLine": "150",
  "StartLine": "1",
  "toolAction": "\"View server index code\"",
  "toolSummary": "\"View server index\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\public\\\\read-client.js\"","En...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\public\\\\read-client.js\"",
  "EndLine": "100",
  "StartLine": "1",
  "toolAction": "\"View public read-client code\"",
  "toolSummary": "\"View read-client\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\test\\\\server-logic.test.js\""...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\test\\\\server-logic.test.js\"",
  "EndLine": "150",
  "StartLine": "1",
  "toolAction": "\"View server-logic.test.js\"",
  "toolSummary": "\"View test/server-logic.test.js\""
}

Output

Agent

▸ run_command {"CommandLine":"\"node --test test/server-logic.test.js\"","Cwd":"\"~/two-sis...

Input

$ {"CommandLine":"\"node --test test/server-logic.test.js\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Run server tests\"","toolSummary":"\"Run test/server-logic.test.js\""}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\TASKS.md\"","EndLine":"100","St...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\TASKS.md\"",
  "EndLine": "100",
  "StartLine": "1",
  "toolAction": "\"View TASKS.md\"",
  "toolSummary": "\"View TASKS.md\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\package.json\"","EndLine":"100"...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\package.json\"",
  "EndLine": "100",
  "StartLine": "1",
  "toolAction": "\"View package.json\"",
  "toolSummary": "\"View package.json\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\public\\\\rules.json\"","EndLin...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\public\\\\rules.json\"",
  "EndLine": "60",
  "StartLine": "1",
  "toolAction": "\"Check rules.json types\"",
  "toolSummary": "\"Check rules.json types\""
}

Output

Agent

▸ search_web {"query":"\"CeraVe Hydrating Facial Cleanser official ingredients list\"","to...

Input

{
  "query": "\"CeraVe Hydrating Facial Cleanser official ingredients list\"",
  "toolAction": "\"Search CeraVe cleanser ingredients\"",
  "toolSummary": "\"Search cleanser ingredients\""
}

Output

Agent

▸ search_web {"query":"\"The Ordinary Retinol 0.2% in Squalane ingredients deciem\"","tool...

Input

{
  "query": "\"The Ordinary Retinol 0.2% in Squalane ingredients deciem\"",
  "toolAction": "\"Search The Ordinary retinol ingredients\"",
  "toolSummary": "\"Search retinol serum ingredients\""
}

Output

Agent

▸ search_web {"query":"\"SkinCeuticals C E Ferulic ingredients skinceuticals.com\"","toolA...

Input

{
  "query": "\"SkinCeuticals C E Ferulic ingredients skinceuticals.com\"",
  "toolAction": "\"Search SkinCeuticals Vitamin C ingredients\"",
  "toolSummary": "\"Search Vitamin C serum ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:skinceuticals.com \\\"C E Ferulic\\\" \\\"Aqua/Water/Eau\\\"...

Input

{
  "query": "\"site:skinceuticals.com \\\"C E Ferulic\\\" \\\"Aqua/Water/Eau\\\" OR \\\"water\\\" ingredients\"",
  "toolAction": "\"Search SkinCeuticals official site for C E Ferulic ingredients\"",
  "toolSummary": "\"Search SkinCeuticals product page ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:theordinary.com \\\"Niacinamide 10% + Zinc 1%\\\" ingredient...

Input

{
  "query": "\"site:theordinary.com \\\"Niacinamide 10% + Zinc 1%\\\" ingredients\"",
  "toolAction": "\"Search The Ordinary Niacinamide ingredients\"",
  "toolSummary": "\"Search Niacinamide serum ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:theordinary.com \\\"Ascorbyl Glucoside Solution 12%\\\" ingr...

Input

{
  "query": "\"site:theordinary.com \\\"Ascorbyl Glucoside Solution 12%\\\" ingredients\"",
  "toolAction": "\"Search The Ordinary Vitamin C serum ingredients\"",
  "toolSummary": "\"Search Ascorbyl Glucoside serum ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:cerave.com \\\"Daily Moisturizing Lotion\\\" ingredients\"",...

Input

{
  "query": "\"site:cerave.com \\\"Daily Moisturizing Lotion\\\" ingredients\"",
  "toolAction": "\"Search CeraVe moisturizer ingredients\"",
  "toolSummary": "\"Search moisturizer ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:cerave.com \\\"Daily Moisturizing Lotion\\\" \\\"Aqua / Wate...

Input

{
  "query": "\"site:cerave.com \\\"Daily Moisturizing Lotion\\\" \\\"Aqua / Water / Eau\\\" OR \\\"AQUA / WATER\\\" OR \\\"Water\\\" ingredients\"",
  "toolAction": "\"Search exact CeraVe Daily Moisturizing Lotion ingredients\"",
  "toolSummary": "\"Search CeraVe moisturizer full ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:supergoop.com \\\"Unseen Sunscreen SPF 40\\\" ingredients \\...

Input

{
  "query": "\"site:supergoop.com \\\"Unseen Sunscreen SPF 40\\\" ingredients \\\"Active Ingredients\\\"\"",
  "toolAction": "\"Search Supergoop Unseen Sunscreen ingredients\"",
  "toolSummary": "\"Search Supergoop Sunscreen ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:supergoop.com \\\"Unseen Sunscreen SPF 40\\\" \\\"Inactive I...

Input

{
  "query": "\"site:supergoop.com \\\"Unseen Sunscreen SPF 40\\\" \\\"Inactive Ingredients:\\\" OR \\\"Inactive Ingredients\\\"\"",
  "toolAction": "\"Search Supergoop full inactive ingredients\"",
  "toolSummary": "\"Search Supergoop inactive ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:supergoop.com/products \\\"Unseen Sunscreen SPF 40\\\"\"","t...

Input

{
  "query": "\"site:supergoop.com/products \\\"Unseen Sunscreen SPF 40\\\"\"",
  "toolAction": "\"Check Supergoop product URL\"",
  "toolSummary": "\"Search Supergoop product URL\""
}

Output

Agent

▸ search_web {"query":"\"\\\"cerave.com\\\" \\\"hydrating-facial-cleanser\\\" URL\"","tool...

Input

{
  "query": "\"\\\"cerave.com\\\" \\\"hydrating-facial-cleanser\\\" URL\"",
  "toolAction": "\"Get CeraVe cleanser URL\"",
  "toolSummary": "\"Search CeraVe URL\""
}

Output

Agent

▸ search_web {"query":"\"\\\"cerave.com\\\" \\\"daily-moisturizing-lotion\\\" URL\"","tool...

Input

{
  "query": "\"\\\"cerave.com\\\" \\\"daily-moisturizing-lotion\\\" URL\"",
  "toolAction": "\"Get CeraVe lotion URL\"",
  "toolSummary": "\"Search CeraVe lotion URL\""
}

Output

Agent

▸ search_web {"query":"\"theordinary.com \\\"retinol-02-in-squalane\\\" URL\"","toolAction...

Input

{
  "query": "\"theordinary.com \\\"retinol-02-in-squalane\\\" URL\"",
  "toolAction": "\"Get The Ordinary retinol URL\"",
  "toolSummary": "\"Search The Ordinary retinol URL\""
}

Output

Agent

▸ search_web {"query":"\"theordinary.com \\\"ascorbyl-glucoside-solution-12\\\" URL\"","to...

Input

{
  "query": "\"theordinary.com \\\"ascorbyl-glucoside-solution-12\\\" URL\"",
  "toolAction": "\"Get The Ordinary Ascorbyl Glucoside URL\"",
  "toolSummary": "\"Search The Ordinary Ascorbyl Glucoside URL\""
}

Output

Agent

▸ search_web {"query":"\"supergoop.com \\\"unseen-sunscreen\\\" URL\"","toolAction":"\"Get...

Input

{
  "query": "\"supergoop.com \\\"unseen-sunscreen\\\" URL\"",
  "toolAction": "\"Get Supergoop unseen sunscreen URL\"",
  "toolSummary": "\"Search Supergoop URL\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\public\\\\rules.json\"","EndLin...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\public\\\\rules.json\"",
  "EndLine": "158",
  "StartLine": "60",
  "toolAction": "\"View rules.json ingredient notes and types\"",
  "toolSummary": "\"View rules.json ingredient notes\""
}

Output

Agent

▸ search_web {"query":"\"site:theordinary.com \\\"100% Organic Cold-Pressed Rose Hip Seed ...

Input

{
  "query": "\"site:theordinary.com \\\"100% Organic Cold-Pressed Rose Hip Seed Oil\\\" ingredients\"",
  "toolAction": "\"Search The Ordinary Rosehip oil ingredients\"",
  "toolSummary": "\"Search facial oil ingredients\""
}

Output

Agent

▸ search_web {"query":"\"site:theordinary.com \\\"100% Organic Cold-Pressed Rose Hip Seed ...

Input

{
  "query": "\"site:theordinary.com \\\"100% Organic Cold-Pressed Rose Hip Seed Oil\\\" URL\"",
  "toolAction": "\"Get The Ordinary rosehip oil URL\"",
  "toolSummary": "\"Search The Ordinary rosehip oil URL\""
}

Output

Agent

▸ search_web {"query":"\"site:theordinary.com \\\"Glycolic Acid 7% Exfoliating Toner\\\" i...

Input

{
  "query": "\"site:theordinary.com \\\"Glycolic Acid 7% Exfoliating Toner\\\" ingredients\"",
  "toolAction": "\"Search The Ordinary Glycolic toner ingredients\"",
  "toolSummary": "\"Search toner ingredients\""
}

Output

Agent

▸ search_web {"query":"\"\\\"Glycolic Acid 7% Exfoliating Toner\\\" \\\"Aqua (Water)\\\" \...

Input

{
  "query": "\"\\\"Glycolic Acid 7% Exfoliating Toner\\\" \\\"Aqua (Water)\\\" \\\"Glycolic Acid\\\" site:theordinary.com\"",
  "toolAction": "\"Search full ingredients of The Ordinary Glycolic Acid Toner\"",
  "toolSummary": "\"Search Glycolic Acid Toner ingredients\""
}

Output

Agent

▸ search_web {"query":"\"\\\"Glycolic Acid 7% Exfoliating Toner\\\" site:theordinary.com U...

Input

{
  "query": "\"\\\"Glycolic Acid 7% Exfoliating Toner\\\" site:theordinary.com URL\"",
  "toolAction": "\"Get The Ordinary Glycolic toner URL\"",
  "toolSummary": "\"Search toner URL\""
}

Output

Agent

▸ search_web {"query":"\"\\\"https://theordinary.com\\\" \\\"glycolic-acid-7-exfoliating-t...

Input

{
  "query": "\"\\\"https://theordinary.com\\\" \\\"glycolic-acid-7-exfoliating-toner\\\"\"",
  "toolAction": "\"Get exact URL for glycolic acid toner\"",
  "toolSummary": "\"Get toner product URL\""
}

Output

Agent

▸ search_web {"query":"\"\\\"theordinary.com\\\" \\\"glycolic-acid-7-exfoliating-toner-100...

Input

{
  "query": "\"\\\"theordinary.com\\\" \\\"glycolic-acid-7-exfoliating-toner-100418.html\\\" OR \\\"glycolic-acid-7-toning-solution\\\"\"",
  "toolAction": "\"Find exact URL string for The Ordinary glycolic acid\"",
  "toolSummary": "\"Search glycolic toner exact URL\""
}

Output

Agent

▸ list_dir {"DirectoryPath":"\"~/two-sisters-tinctures\\\\test\"","toolAction":"\"Check ...

Input

{
  "DirectoryPath": "\"~/two-sisters-tinctures\\\\test\"",
  "toolAction": "\"Check test folder contents\"",
  "toolSummary": "\"List test directory\""
}

Output

Agent

▸ write_to_file {"CodeContent":"\"{\\n \\\"id\\\": \\\"cerave-hydrating-cleanser\\\",\\n \\...

Input

{
  "CodeContent": "\"{\\n  \\\"id\\\": \\\"cerave-hydrating-cleanser\\\",\\n  \\\"mode\\\": \\\"paste\\\",\\n  \\\"text\\\": \\\"Aqua / Water / Eau, Glycerin, Cetearyl Alcohol, Peg-40 Stearate, Stearyl Alcohol, Potassium Phosphate, Ceramide NP, Ceramide AP, Ceramide EOP, Carbomer, Glyceryl Stearate, Behentrimonium Methosulfate, Sodium Lauroyl Lactylate, Sodium Hyaluronate, Cholesterol, Phenoxyethanol, Disodium EDTA, Dipotassium Phosphate, Tocopherol, Phytosphingosine, Xanthan Gum, Cetyl Alcohol, Polysorbate 20, Ethylhexylglycerin\\\",\\n  \\\"expect\\\": {\\n    \\\"type\\\": \\\"Cleanser\\\",\\n    \\\"mustInclude\\\": [\\n      \\\"Glycerin\\\",\\n      \\\"Ceramide NP\\\",\\n      \\\"Sodium Hyaluronate\\\"\\n    ],\\n    \\\"mustNotInclude\\\": [\\n      \\\"Retinol\\\"\\n    ]\\n  },\\n  \\\"source\\\": \\\"https://www.cerave.com/skincare/cleansers/hydrating-facial-cleanser\\\",\\n  \\\"checked\\\": \\\"2026-10-03\\\"\\n}\\n\"",
  "Description": "\"Add gold set fixture for CeraVe Hydrating Cleanser\"",
  "Overwrite": "true",
  "TargetFile": "\"~/two-sisters-tinctures\\\\test\\\\fixtures\\\\gold\\\\cerave-cleanser.json\"",
  "toolAction": "\"Create cerave cleanser fixture\"",
  "toolSummary": "\"Create cerave-cleanser.json\""
}

Output

Agent

▸ write_to_file {"CodeContent":"\"{\\n \\\"id\\\": \\\"the-ordinary-glycolic-toner\\\",\\n ...

Input

{
  "CodeContent": "\"{\\n  \\\"id\\\": \\\"the-ordinary-glycolic-toner\\\",\\n  \\\"mode\\\": \\\"paste\\\",\\n  \\\"text\\\": \\\"Aqua (Water), Glycolic Acid, Rosa Damascena Flower Water, Centaurea Cyanus Flower Water, Aloe Barbadensis Leaf Water, Propanediol, Glycerin, Triethanolamine, Aminomethyl Propanol, Panax Ginseng Root Extract, Tasmannia Lanceolata Fruit/Leaf Extract, Aspartic Acid, Alanine, Glycine, Serine, Valine, Isoleucine, Proline, Threonine, Histidine, Phenylalanine, Glutamic Acid, Arginine, PCA, Sodium PCA, Sodium Lactate, Fructose, Glucose, Sucrose, Urea, Hexyl Nicotinate, Dextrin, Citric Acid, Polysorbate 20, Gellan Gum, Trisodium Ethylenediamine Disuccinate, Sodium Chloride, Hexylene Glycol, Potassium Sorbate, Sodium Benzoate, 1,2-Hexanediol, Caprylyl Glycol\\\",\\n  \\\"expect\\\": {\\n    \\\"type\\\": \\\"Toner\\\",\\n    \\\"mustInclude\\\": [\\n      \\\"Glycolic Acid\\\",\\n      \\\"Glycerin\\\"\\n    ],\\n    \\\"mustNotInclude\\\": [\\n      \\\"Retinol\\\"\\n    ]\\n  },\\n  \\\"source\\\": \\\"https://theordinary.com/en-us/glycolic-acid-7-exfoliating-toner-100418.html\\\",\\n  \\\"checked\\\": \\\"2026-10-03\\\"\\n}\\n\"",
  "Description": "\"Add gold set fixture for The Ordinary Glycolic Acid Toner\"",
  "Overwrite": "true",
  "TargetFile": "\"~/two-sisters-tinctures\\\\test\\\\fixtures\\\\gold\\\\ordinary-toner.json\"",
  "toolAction": "\"Create ordinary toner fixture\"",
  "toolSummary": "\"Create ordinary-toner.json\""
}

Output

Agent

▸ write_to_file {"CodeContent":"\"{\\n \\\"id\\\": \\\"the-ordinary-retinol-02-squalane\\\",...

Input

{
  "CodeContent": "\"{\\n  \\\"id\\\": \\\"the-ordinary-retinol-02-squalane\\\",\\n  \\\"mode\\\": \\\"paste\\\",\\n  \\\"text\\\": \\\"Squalane, Caprylic/Capric Triglyceride, Simmondsia Chinensis (Jojoba) Seed Oil, Retinol, Solanum Lycopersicum (Tomato) Fruit Extract, Rosmarinus Officinalis (Rosemary) Leaf Extract, Hydroxymethoxyphenyl Decanone, BHT\\\",\\n  \\\"expect\\\": {\\n    \\\"type\\\": \\\"Serum\\\",\\n    \\\"mustInclude\\\": [\\n      \\\"Retinol\\\",\\n      \\\"Squalane\\\"\\n    ],\\n    \\\"mustNotInclude\\\": [\\n      \\\"Niacinamide\\\"\\n    ]\\n  },\\n  \\\"source\\\": \\\"https://theordinary.com/en-us/retinol-0.2-in-squalane-serum-100438.html\\\",\\n  \\\"checked\\\": \\\"2026-10-03\\\"\\n}\\n\"",
  "Description": "\"Add gold set fixture for The Ordinary Retinol 0.2% in Squalane\"",
  "Overwrite": "true",
  "TargetFile": "\"~/two-sisters-tinctures\\\\test\\\\fixtures\\\\gold\\\\ordinary-retinol.json\"",
  "toolAction": "\"Create ordinary retinol fixture\"",
  "toolSummary": "\"Create ordinary-retinol.json\""
}

Output

Agent

▸ write_to_file {"CodeContent":"\"{\\n \\\"id\\\": \\\"cerave-daily-moisturizing-lotion\\\",...

Input

{
  "CodeContent": "\"{\\n  \\\"id\\\": \\\"cerave-daily-moisturizing-lotion\\\",\\n  \\\"mode\\\": \\\"paste\\\",\\n  \\\"text\\\": \\\"AQUA / WATER / EAU, GLYCERIN, CAPRYLIC/CAPRIC TRIGLYCERIDE, CETEARYL ALCOHOL, CETYL ALCOHOL, DIMETHICONE, PHENOXYETHANOL, POLYSORBATE 20, CETEARETH-20, BEHENTRIMONIUM METHOSULFATE, POLYGLYCERYL-3 DIISOSTEARATE, SODIUM LAUROYL LACTYLATE, ETHYLHEXYLGLYCERIN, POTASSIUM PHOSPHATE, DISODIUM EDTA, DIPOTASSIUM PHOSPHATE, CERAMIDE NP, CERAMIDE AP, PHYTOSPHINGOSINE, CHOLESTEROL, XANTHAN GUM, CARBOMER, SODIUM HYALURONATE, TOCOPHEROL, CERAMIDE EOP\\\",\\n  \\\"expect\\\": {\\n    \\\"type\\\": \\\"Moisturizer\\\",\\n    \\\"mustInclude\\\": [\\n      \\\"GLYCERIN\\\",\\n      \\\"CERAMIDE NP\\\",\\n      \\\"SODIUM HYALURONATE\\\"\\n    ],\\n    \\\"mustNotInclude\\\": [\\n      \\\"Salicylic Acid\\\"\\n    ]\\n  },\\n  \\\"source\\\": \\\"https://www.cerave.com/skincare/moisturizers/daily-moisturizing-lotion\\\",\\n  \\\"checked\\\": \\\"2026-10-03\\\"\\n}\\n\"",
  "Description": "\"Add gold set fixture for CeraVe Daily Moisturizing Lotion\"",
  "Overwrite": "true",
  "TargetFile": "\"~/two-sisters-tinctures\\\\test\\\\fixtures\\\\gold\\\\cerave-moisturizer.json\"",
  "toolAction": "\"Create cerave moisturizer fixture\"",
  "toolSummary": "\"Create cerave-moisturizer.json\""
}

Output

Agent

▸ write_to_file {"CodeContent":"\"{\\n \\\"id\\\": \\\"supergoop-unseen-sunscreen\\\",\\n \...

Input

{
  "CodeContent": "\"{\\n  \\\"id\\\": \\\"supergoop-unseen-sunscreen\\\",\\n  \\\"mode\\\": \\\"paste\\\",\\n  \\\"text\\\": \\\"Active Ingredients: Avobenzone 3%, Homosalate 9%, Octisalate 5%, Octocrylene 10%. Inactive Ingredients: Isododecane, Dimethicone Crosspolymer, Dimethicone/Bis-Isobutyl PPG-20 Crosspolymer, Polymethylsilsesquioxane, Isohexadecane, Dicaprylyl Carbonate, Meadowfoam Estolide, Caprylic/Capric Triglyceride, Polyester-7, Neopentyl Glycol Diheptanoate, Lithothamnion Calcareum Extract, Caprylyl Glycol, Butyrospermum Parkii (Shea) Butter, Jojoba Esters, Mannitol, Boswellia Serrata Resin Extract, Lecithin, Microcrystalline Cellulose\\\",\\n  \\\"expect\\\": {\\n    \\\"type\\\": \\\"Sunscreen\\\",\\n    \\\"mustInclude\\\": [\\n      \\\"Avobenzone\\\",\\n      \\\"Homosalate\\\"\\n    ],\\n    \\\"mustNotInclude\\\": [\\n      \\\"Zinc Oxide\\\"\\n    ]\\n  },\\n  \\\"source\\\": \\\"https://supergoop.com/products/unseen-sunscreen\\\",\\n  \\\"checked\\\": \\\"2026-10-03\\\"\\n}\\n\"",
  "Description": "\"Add gold set fixture for Supergoop Unseen Sunscreen\"",
  "Overwrite": "true",
  "TargetFile": "\"~/two-sisters-tinctures\\\\test\\\\fixtures\\\\gold\\\\supergoop-sunscreen.json\"",
  "toolAction": "\"Create supergoop sunscreen fixture\"",
  "toolSummary": "\"Create supergoop-sunscreen.json\""
}

Output

Agent

▸ write_to_file {"CodeContent":"\"import fs from 'node:fs';\\nimport path from 'node:path';\\...

Input

{
  "CodeContent": "\"import fs from 'node:fs';\\nimport path from 'node:path';\\nimport { fileURLToPath } from 'node:url';\\nimport rules from '../public/rules.json' with { type: 'json' };\\nimport { validateModelOutput } from '../server/validate.js';\\nimport { readProduct } from '../server/gemma.js';\\n\\ntry {\\n  process.loadEnvFile();\\n} catch (e) {\\n  // .env is optional or already in environment\\n}\\n\\nconst __filename = fileURLToPath(import.meta.url);\\nconst __dirname = path.dirname(__filename);\\nconst fixturesDir = path.join(__dirname, 'fixtures', 'gold');\\n\\nfunction sleep(ms) {\\n  return new Promise(resolve => setTimeout(resolve, ms));\\n}\\n\\nasync function runGoldSet() {\\n  const files = fs.readdirSync(fixturesDir).filter(f => f.endsWith('.json')).sort();\\n  let passedCount = 0;\\n  const totalCount = files.length;\\n\\n  for (let i = 0; i < totalCount; i++) {\\n    if (i > 0) {\\n      await sleep(2000);\\n    }\\n\\n    const file = files[i];\\n    const rawContent = fs.readFileSync(path.join(fixturesDir, file), 'utf8');\\n    const fixture = JSON.parse(rawContent);\\n\\n    const startedAt = Date.now();\\n    let pass = false;\\n    let failReason = '';\\n\\n    try {\\n      const modelRaw = await readProduct({ mode: fixture.mode, text: fixture.text });\\n      const validated = validateModelOutput(modelRaw, { mode: fixture.mode, text: fixture.text }, rules);\\n\\n      if (!validated.ok) {\\n        failReason = 'validation failed (' + validated.error + ')';\\n      } else {\\n        const val = validated.value;\\n        const typeMatch = val.type === fixture.expect.type;\\n\\n        const listed = (val.ingredients || []).map(item => item.toLowerCase());\\n        const mustIncludeMatch = (fixture.expect.mustInclude || []).every(req =>\\n          listed.some(item => item.includes(req.toLowerCase()) || req.toLowerCase().includes(item))\\n        );\\n        const mustNotIncludeMatch = !(fixture.expect.mustNotInclude || []).some(bad =>\\n          listed.some(item => item.includes(bad.toLowerCase()) || bad.toLowerCase().includes(item))\\n        );\\n\\n  \n<truncated 923 bytes>",
  "Description": "\"Create test/gold.mjs test runner for gold set fixtures\"",
  "Overwrite": "true",
  "TargetFile": "\"~/two-sisters-tinctures\\\\test\\\\gold.mjs\"",
  "toolAction": "\"Create gold test runner\"",
  "toolSummary": "\"Create test/gold.mjs\""
}

Output

Agent

▸ replace_file_content {"AllowMultiple":"false","Description":"\"Add gold script to package.json scr...

Input

{
  "AllowMultiple": "false",
  "Description": "\"Add gold script to package.json scripts\"",
  "EndLine": "9",
  "Instruction": "\"Add gold npm script\"",
  "ReplacementContent": "\"  \\\"scripts\\\": {\\n    \\\"start\\\": \\\"node server/index.js\\\",\\n    \\\"gold\\\": \\\"node test/gold.mjs\\\"\\n  },\"",
  "StartLine": "6",
  "TargetContent": "\"  \\\"scripts\\\": {\\n    \\\"start\\\": \\\"node server/index.js\\\"\\n  },\"",
  "TargetFile": "\"~/two-sisters-tinctures\\\\package.json\"",
  "toolAction": "\"Update package.json scripts\"",
  "toolSummary": "\"Add gold script to package.json\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\TASKS.md\"","EndLine":"90","Sta...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\TASKS.md\"",
  "EndLine": "90",
  "StartLine": "75",
  "toolAction": "\"Check Block 3 in TASKS.md\"",
  "toolSummary": "\"Check Block 3 in TASKS.md\""
}

Output

Agent

▸ replace_file_content {"AllowMultiple":"false","Description":"\"Add gold set run row under Block 3 ...

Input

{
  "AllowMultiple": "false",
  "Description": "\"Add gold set run row under Block 3 in TASKS.md\"",
  "EndLine": "85",
  "Instruction": "\"Add gold set run task row\"",
  "ReplacementContent": "\"- [ ] Gold set of 5 real products saved as fixtures\\n- [ ] Run gold set test against live model (test/gold.mjs)\\n\\n**PASS:** gold set 4 of 5. Injection label stays clean. Model-off test: manual add still works.\"",
  "StartLine": "83",
  "TargetContent": "\"- [ ] Gold set of 5 real products saved as fixtures\\n\\n**PASS:** gold set 4 of 5. Injection label stays clean. Model-off test: manual add still works.\"",
  "TargetFile": "\"~/two-sisters-tinctures\\\\TASKS.md\"",
  "toolAction": "\"Update TASKS.md with gold set row\"",
  "toolSummary": "\"Update TASKS.md\""
}

Output

Agent

▸ run_command {"CommandLine":"\"node --check test/gold.mjs\"","Cwd":"\"~/two-sisters-tinctu...

Input

$ {"CommandLine":"\"node --check test/gold.mjs\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Check syntax of test/gold.mjs\"","toolSummary":"\"Syntax check test/gold.mjs\""}

Output

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const fs = require('fs'); ['cerave-cleanser.jso...

Input

$ {"CommandLine":"\"node -e \\\"const fs = require('fs'); ['cerave-cleanser.json', 'ordinary-toner.json', 'ordinary-retinol.json', 'cerave-moisturizer.json', 'supergoop-sunscreen.json'].forEach(f => JSON.parse(fs.readFileSync('test/fixtures/gold/' + f))); console.log('All 5 JSON fixtures valid');\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Validate JSON fixtures\"","toolSummary":"\"Validate gold JSON fixtures\""}

Output

Agent

▸ run_command {"CommandLine":"\"node --test test/server-logic.test.js\"","Cwd":"\"~/two-sis...

Input

$ {"CommandLine":"\"node --test test/server-logic.test.js\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Run 12 existing tests\"","toolSummary":"\"Run test/server-logic.test.js\""}

Output

Agent

Files changed

test/fixtures/gold/cerave-cleanser.json (created)
test/fixtures/gold/ordinary-toner.json (created)
test/fixtures/gold/ordinary-retinol.json (created)
test/fixtures/gold/cerave-moisturizer.json (created)
test/fixtures/gold/supergoop-sunscreen.json (created)
test/gold.mjs (created)
package.json (added "gold": "node test/gold.mjs")
TASKS.md (added unchecked task row under Block 3)

Commit hash: None (not committed; awaiting your review/run).

You

<USER_REQUEST>
Read-only status check. Do NOT edit, create, or delete any file. Do NOT run the app, a browser, or any test that calls the Gemini API. Do NOT print or ask for any API key. Mock data only, this session may be published.

Run git pull, then git log --oneline -15.
Read TASKS.md, FINDINGS.md, AGENTS.md and PRD.md Gate G4. Verify claims against the actual files, not memory.
Report back in under 25 lines:
- Each Block (0, 1, 1b, 2, 3, 3b, 4, 5, 6): done, partly done, or not started, with the TASKS.md line that proves it.
- Anything in TASKS.md or the PRD that disagrees with the code. Quote file and line.
- Anything in the code that is not covered by a TASKS.md item.

Context so you read it correctly:
- Claude (not you) built Block 3 steps 9 to 12, the 53 new ingredient notes and aliases, the paste name box, the empty-shelf Add button, Block 4 prep and live checks, and Block 3b (tests, ESLint, CI). You built Blocks 0 to 2 and the gold set fixtures draft.
- The demo code was dropped on Oct 3. Protection is daily caps (DAILY_CAP 50 total, IP_DAILY_CAP 10 per visitor) plus a per-minute limit. Known limit: the per-visitor cap can be dodged with a fake X-Forwarded-For header. See FINDINGS.md.
- Gold set: 5 of 5 with a product name, 3 of 5 ingredients only.
- Block 4: key set in Render, $5 budget alert set, key limited to the Gemini API, live checks passed, Shara's cold phone check passed Oct 3.
- Block 5 (photo) is still a STUB and likely to be cut. Block 6 (video, README, DEV post, submit) is next.
- Deadline Sun Oct 4, 2026, 11:59 PM PDT. Ship target 6 PM PDT.

STOP after the report. Wait for my next instruction.
</USER_REQUEST>

Agent

▸ run_command {"CommandLine":"\"git pull\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBefo...

Input

$ {"CommandLine":"\"git pull\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Pull latest commits\"","toolSummary":"\"git pull\""}

Output

Agent

▸ run_command {"CommandLine":"\"git log --oneline -15\"","Cwd":"\"~/two-sisters-tinctures\"...

Input

$ {"CommandLine":"\"git log --oneline -15\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"View recent git commits\"","toolSummary":"\"git log --oneline -15\""}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\PRD.md\"","EndLine":"250","Star...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\PRD.md\"",
  "EndLine": "250",
  "StartLine": "170",
  "toolAction": "\"Read Gate G4 in PRD.md\"",
  "toolSummary": "\"Read PRD Gate G4\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\TASKS.md\"","EndLine":"140","St...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\TASKS.md\"",
  "EndLine": "140",
  "StartLine": "1",
  "toolAction": "\"Read TASKS.md\"",
  "toolSummary": "\"Read TASKS.md\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\PRD.md\"","EndLine":"370","Star...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\PRD.md\"",
  "EndLine": "370",
  "StartLine": "315",
  "toolAction": "\"Read PRD Gate G checklist\"",
  "toolSummary": "\"Read PRD Gate G in PRD.md\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\PRD.md\"","EndLine":"448","Star...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\PRD.md\"",
  "EndLine": "448",
  "StartLine": "371",
  "toolAction": "\"Read Gate G4 in PRD.md\"",
  "toolSummary": "\"Read Gate G4 in PRD.md\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\FINDINGS.md\"","EndLine":"100",...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\FINDINGS.md\"",
  "EndLine": "100",
  "StartLine": "1",
  "toolAction": "\"Read FINDINGS.md entries\"",
  "toolSummary": "\"Read FINDINGS.md\""
}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/two-sisters-tinctures\\\\public\\\\rules.json\"","EndLin...

Input

{
  "AbsolutePath": "\"~/two-sisters-tinctures\\\\public\\\\rules.json\"",
  "EndLine": "20",
  "StartLine": "1",
  "toolAction": "\"Check rules.json types\"",
  "toolSummary": "\"Check rules.json types\""
}

Output

Agent

Block Status

Block 0 (Spike): done (TASKS.md:26: **Status:** [x]).
Block 1 (UI mock data): done (TASKS.md:37: **Status:** [x]).
Block 1b (First deploy): done (TASKS.md:49: **Status:** [x] (rollback untested; auto-deploy still on, commit trigger)).
Block 2 (Rules & shelf storage): partly done (TASKS.md:63: **Status:** [~]).
Block 3 (Server & Gemma): done (TASKS.md:77: **Status:** [x] done Oct 3).
Block 3b (Tests, lint, CI): partly done (TASKS.md:91: **Status:** [~] built Oct 3, waiting on first green CI run and the throwaway-branch proof).
Block 4 (Harden live deploy): partly done (TASKS.md:104: **Status:** [ ], item line 109 [~]).
Block 5 (Photo input): not started (TASKS.md:114: **Status:** [ ]).
Block 6 (Her test, video, post): not started (TASKS.md:122: **Status:** [ ]).

Spec vs. Code Discrepancies

Types count: PRD.md:184 & PRD.md:211 state one of the seven types, but public/rules.json:2-14 defines 11 types (including Essence, Treatment, Mask, Other).
Server timeout: PRD.md:319 & TASKS.md:80 note 20 s timeout, but server/gemma.js:10 sets TIMEOUT_MS = ... || 30000.
Validation limits: server/validate.js:5 has name: 80, brand: 60, ingredients: 50, ingredient: 100, whereas PRD.md:209-210 specifies name: max 60, brand: max 40.

Code Not Covered by TASKS.md Items

server/index.js:77-80: origin/referrer checking against host header to reject foreign origins on /api/read.
server/gemma.js:46-52: unwrap logic for array-wrapped model outputs or string double-encoded JSON payloads.

You

<USER_REQUEST>
Use the devrelay-sessions skill. Do NOT edit any project file.

Save or publish this Antigravity session through DevRelay so it can be linked from a DEV post. Make it public-viewable if DevRelay offers that choice.
Give me back: the exact embed tag or link for the DEV post, the visibility setting (public or private), and whether the session includes messages from before DevRelay was installed.
Before publishing, scan this session for anything that must not be public: API keys, tokens, .env contents, real email addresses or phone numbers, home folder paths. List what you find with the message it is in. If anything is found, do NOT publish. Stop and tell me.
Do not create or publish a DEV article. Claude is writing the post.

Report in under 15 lines, then STOP.
</USER_REQUEST>

Agent

▸ view_file {"AbsolutePath":"\"~/.gemini/..."","EndLine":"150","StartLine":"1","toolActio...

Input

{"AbsolutePath":"\"~/.gemini/..."","EndLine":"150","StartLine":"1","toolAction":"\"Read devrelay-sessions skill instructions\"","toolSummary":"\"Read devrelay-sessions SKILL.md\""}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/.gemini/..."","EndLine":"100","StartLine":"1","toolActio...

Input

{"AbsolutePath":"\"~/.gemini/..."","EndLine":"100","StartLine":"1","toolAction":"\"Read submit_agent_session schema\"","toolSummary":"\"Read submit_agent_session tool schema\""}

Output

Agent

▸ view_file {"AbsolutePath":"\"~/.gemini/..."","EndLine":"100","StartLine":"1","toolActio...

Input

{"AbsolutePath":"\"~/.gemini/..."","EndLine":"100","StartLine":"1","toolAction":"\"Inspect start of transcript.jsonl\"","toolSummary":"\"Inspect transcript.jsonl\""}

Output

Agent

▸ grep_search {"CaseInsensitive":"true","MatchPerLine":"true","Query":"\"AIza\"","SearchPat...

Input

{
  "CaseInsensitive": "true",
  "MatchPerLine": "true",
  "Query": "\"AIza\"",
  "SearchPath": "\"~/two-sisters-tinctures\"",
  "toolAction": "\"Scan repo for API keys\"",
  "toolSummary": "\"Scan repo for API keys\""
}

Output

Agent

▸ grep_search {"CaseInsensitive":"true","MatchPerLine":"true","Query":"\"AIza\"","SearchPat...

Input

{"CaseInsensitive":"true","MatchPerLine":"true","Query":"\"AIza\"","SearchPath":"\"~/.gemini/..."","toolAction":"\"Check transcript for Google API keys\"","toolSummary":"\"Check transcript for Google API keys\""}

Output

Agent

▸ grep_search {"CaseInsensitive":"false","MatchPerLine":"true","Query":"\"user\"","SearchPa...

Input

{"CaseInsensitive":"false","MatchPerLine":"true","Query":"\"user\"","SearchPath":"\"~/.gemini/..."","toolAction":"\"Search home folder path in transcript\"","toolSummary":"\"Search home folder path\""}

Output

Agent

▸ grep_search {"CaseInsensitive":"false","MatchPerLine":"true","Query":"\"Users\"","SearchP...

Input

{"CaseInsensitive":"false","MatchPerLine":"true","Query":"\"Users\"","SearchPath":"\"~/.gemini/..."","toolAction":"\"Search Users in transcript\"","toolSummary":"\"Search Users in transcript\""}

Output

Agent

▸ run_command {"CommandLine":"\"powershell -Command \\\"Select-String -Path '~/.gemini/...'...

Input

$ {"CommandLine":"\"powershell -Command \\\"Select-String -Path '~/.gemini/...' -Pattern 'Users' | Select-Object -First 5\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Check transcript for Users path via PowerShell\"","toolSummary":"\"PowerShell check for Users\""}

Output

Agent

▸ run_command {"CommandLine":"\"powershell -Command \\\"$text = Get-Content '~/.gemini/...'...

Input

$ {"CommandLine":"\"powershell -Command \\\"$text = Get-Content '~/.gemini/...' -Raw; [regex]::Matches($text, '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\\\.[A-Za-z]{2,}').Value | Select-Object -Unique\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Scan transcript for email addresses\"","toolSummary":"\"Scan for emails\""}

Output

Agent

▸ run_command {"CommandLine":"\"powershell -Command \\\"$raw = Get-Content -Raw '~/.gemini/...

Input

$ {"CommandLine":"\"powershell -Command \\\"$raw = Get-Content -Raw '~/.gemini/...'; [regex]::Matches($raw, '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\\\.[a-zA-Z]{2,}').Value | Select-Object -Unique\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Find email addresses in transcript\"","toolSummary":"\"Scan emails in transcript\""}

Output

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFile...

Input

$ {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFileSync('~/.gemini/...', 'utf8'); const emails = t.match(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\\\.[a-zA-Z]{2,}/g) || []; console.log('Emails:', [...new Set(emails)]); const phones = t.match(/\\\\b\\\\d{3}[-.]?\\\\d{3}[-.]?\\\\d{4}\\\\b/g) || []; console.log('Phones:', [...new Set(phones)]); const envMatches = t.match(/GEMINI_API_KEY\\\\s*=\\\\s*[^\\\\s]+/g) || []; console.log('Keys in env:', envMatches);\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Scan transcript for emails, phones, and API keys\"","toolSummary":"\"Scan transcript for sensitive data\""}

Output

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFile...

Input

$ {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFileSync('~/.gemini/...', 'utf8'); const lines = t.split('\\\\n'); lines.forEach((l, idx) => { if (l.includes('~') || l.includes('~') || l.includes('~') || l.includes('~')) { const obj = JSON.parse(l); console.log('Line ' + (idx+1) + ' step ' + obj.step_index + ' type ' + obj.type + ' source ' + obj.source); } });\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Find home folder occurrences in transcript\"","toolSummary":"\"Locate home paths in transcript\""}

Output

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFile...

Input

$ {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFileSync('~/.gemini/...', 'utf8'); const obj = JSON.parse(t.split('\\\\n')[0]); console.log('Active Doc:', obj.content.slice(obj.content.indexOf('Active Document'), obj.content.indexOf('Active Document') + 120));\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Check step 0 active document\"","toolSummary":"\"Check step 0 metadata\""}

Output

Agent

Pre-Publication Scan Results

DO NOT PUBLISH: Private home folder paths and .env references were detected in the session history.

Home folder paths (~\...):
- Step 0 (User message 1): <ADDITIONAL_METADATA> contains active editor path ~/two-sisters-tinctures\.env and open file paths under ~\projects\....
- Step 102 (User message 2): <ADDITIONAL_METADATA> contains active editor path ~/two-sisters-tinctures\.env.
- Step 121 (User message 3): <ADDITIONAL_METADATA> contains active editor path ~/two-sisters-tinctures\.env.
- Tool calls (Steps 7, 9, 11, 13, 15, 17, 21, 23, 25, 59, 77-93, 108-118, 123-127): Absolute file paths containing ~\....
.env references:
- Active file metadata references the .env filename in user messages 1, 2, and 3 (though actual secret keys were not printed or logged in the transcript).
API Keys / Emails / Phones: None detected.

DevRelay Details

Embed tag: {% agent_session <id_or_slug> %} (will be assigned upon sanitization and submission).
Visibility: DEV agent sessions submitted via submit_agent_session are created as unpublished/draft by default (author-viewable only) until published.
Pre-DevRelay messages: This conversation ID (a535ecb3...) began at Step 0 with the Block 3 gold set prompt (after DevRelay was installed); it does not include earlier sessions from Blocks 0–2.

You

<USER_REQUEST>
Use the devrelay-sessions skill. Do NOT edit any project file. Do NOT publish anything.

Submit this session with submit_agent_session. Keep it unpublished (author-viewable only). Do not create a DEV article
Give me back: the session id or slug, the exact embed tag for the post, and the DEV URL where I can open the draft and read it.
Tell me what DevRelay did to the home folder paths (redacted, kept, or removed), based on what you can see in the result.

Report in under 10 lines, then STOP.
</USER_REQUEST>

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFile...

Input

$ {"CommandLine":"\"node -e \\\"const fs = require('fs'); const t = fs.readFileSync('~/.gemini/...', 'utf8'); const lines = t.trim().split('\\\\n'); console.log('Total steps:', lines.length); const types = lines.map(l => JSON.parse(l).type); console.log('Types:', [...new Set(types)]);\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Check transcript lines\"","toolSummary":"\"Analyze transcript steps\""}

Output

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const fs = require('fs');\\nconst lines = fs.re...

Input

$ {"CommandLine":"\"node -e \\\"const fs = require('fs');\\nconst lines = fs.readFileSync('~/.gemini/...', 'utf8').trim().split('\\\\n');\\n\\nconst messages = [];\\n\\nfunction sanitize(str) {\\n  if (typeof str !== 'string') return str;\\n  return str.replace(/c:[\\\\\\\\\\\\/]Users[\\\\\\\\\\\\/]user[\\\\\\\\\\\\/]projects[\\\\\\\\\\\\/]two-sisters-tinctures/gi, '~/two-sisters-tinctures')\\n            .replace(/[A-Z]:[\\\\\\\\\\\\/]Users[\\\\\\\\\\\\/]user[\\\\\\\\\\\\/]\\\\.gemini[^\\\\s\\\\\\\"\\\\'<>]+/gi, '~/.gemini/...')\\n            .replace(/[A-Z]:[\\\\\\\\\\\\/]Users[\\\\\\\\\\\\/]user/gi, '~');\\n}\\n\\nfor (const line of lines) {\\n  if (!line) continue;\\n  const entry = JSON.parse(line);\\n  if (entry.type === 'USER_INPUT') {\\n    let text = entry.content || '';\\n    if (text.includes('<ADDITIONAL_METADATA>')) {\\n      text = text.split('<ADDITIONAL_METADATA>')[0].trim();\\n    }\\n    messages.push({\\n      role: 'user',\\n      content: [{ type: 'text', text: sanitize(text) }]\\n    });\\n  } else if (entry.type === 'PLANNER_RESPONSE') {\\n    const content = [];\\n    if (entry.content) {\\n      content.push({ type: 'text', text: sanitize(entry.content) });\\n    }\\n    if (entry.tool_calls && entry.tool_calls.length) {\\n      for (const tc of entry.tool_calls) {\\n        content.push({\\n          type: 'tool_call',\\n          name: tc.name,\\n          input: sanitize(JSON.stringify(tc.args)),\\n          output: ''\\n        });\\n      }\\n    }\\n    if (content.length) {\\n      messages.push({\\n        role: 'assistant',\\n        model: 'gemini-3.8-flash',\\n        content: content\\n      });\\n    }\\n  }\\n}\\n\\nconst payload = {\\n  title: 'Two Sisters Tinctures - Block 3 Gold Set & Status Check',\\n  tool_name: 'gemini_cli',\\n  curated_data: {\\n    messages: messages,\\n    metadata: {\\n      tool_name: 'gemini_cli',\\n      session_id: 'a535ecb3-d7c6-443f-9cb0-d72f0fe649e5',\\n      total_messages: messages.length\\n    }\\n  }\\n};\\n\\nfs.writeFileSync('~/.gemini/...<truncated 161 bytes>","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Generate curated session payload\"","toolSummary":"\"Prepare curated session JSON\""}

Output

Agent

▸ write_to_file {"CodeContent":"\"const fs = require('fs');\\n\\nconst lines = fs.readFileSyn...

Input

{"CodeContent":"\"const fs = require('fs');\\n\\nconst lines = fs.readFileSync('~/.gemini/...', 'utf8').trim().split('\\\\n');\\n\\nconst messages = [];\\n\\nfunction sanitize(str) {\\n  if (typeof str !== 'string') return str;\\n  return str.replace(/c:[\\\\\\\\\\\\/]Users[\\\\\\\\\\\\/]user[\\\\\\\\\\\\/]projects[\\\\\\\\\\\\/]two-sisters-tinctures/gi, '~/two-sisters-tinctures')\\n            .replace(/[A-Z]:[\\\\\\\\\\\\/]Users[\\\\\\\\\\\\/]user[\\\\\\\\\\\\/]\\\\.gemini[^\\\\s\\\\\\\"\\\\'<>]+/gi, '~/.gemini/...')\\n            .replace(/[A-Z]:[\\\\\\\\\\\\/]Users[\\\\\\\\\\\\/]user/gi, '~');\\n}\\n\\nfor (const line of lines) {\\n  if (!line) continue;\\n  try {\\n    const entry = JSON.parse(line);\\n    if (entry.type === 'USER_INPUT') {\\n      let text = entry.content || '';\\n      if (text.includes('<ADDITIONAL_METADATA>')) {\\n        text = text.split('<ADDITIONAL_METADATA>')[0].trim();\\n      }\\n      messages.push({\\n        role: 'user',\\n        content: [{ type: 'text', text: sanitize(text) }]\\n      });\\n    } else if (entry.type === 'PLANNER_RESPONSE') {\\n      const content = [];\\n      if (entry.content) {\\n        content.push({ type: 'text', text: sanitize(entry.content) });\\n      }\\n      if (entry.tool_calls && entry.tool_calls.length) {\\n        for (const tc of entry.tool_calls) {\\n          content.push({\\n            type: 'tool_call',\\n            name: tc.name,\\n            input: sanitize(JSON.stringify(tc.args)),\\n            output: ''\\n          });\\n        }\\n      }\\n      if (content.length) {\\n        messages.push({\\n          role: 'assistant',\\n          model: 'gemini-3.8-flash',\\n          content: content\\n        });\\n      }\\n    }\\n  } catch (e) {}\\n}\\n\\nconst payload = {\\n  title: 'Two Sisters Tinctures - Block 3 Gold Set and Status Check',\\n  tool_name: 'gemini_cli',\\n  curated_data: {\\n    messages: messages,\\n    metadata: {\\n      tool_name: 'gemini_cli',\\n      session_id: 'a535ecb3-d7c6-443f-9cb0-d72f0fe649e5',\\n      total_messages: messages.leng\n<truncated 246 bytes>","Description":"\"Script to generate sanitized session payload JSON\"","Overwrite":"true","TargetFile":"\"~/.gemini/..."","toolAction":"\"Write build_session.js in scratch\"","toolSummary":"\"Write scratch script\""}

Output

Agent

▸ run_command {"CommandLine":"\"node ~/.gemini/..."","Cwd":"\"~/two-sisters-tinctures\"","W...

Input

$ {"CommandLine":"\"node ~/.gemini/..."","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Run build_session.js\"","toolSummary":"\"Generate sanitized session JSON\""}

Output

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const p = require('~/.gemini/...'); const s = J...

Input

$ {"CommandLine":"\"node -e \\\"const p = require('~/.gemini/...'); const s = JSON.stringify(p); console.log('user present:', /user/i.test(s)); console.log('projects path present:', /projects[\\\\\\\\\\\\/]two-sisters/i.test(s));\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Verify sanitized payload\"","toolSummary":"\"Verify sanitized session payload\""}

Output

Agent

▸ run_command {"CommandLine":"\"node -e \\\"const p = require('~/.gemini/...'); const s = J...

Input

$ {"CommandLine":"\"node -e \\\"const p = require('~/.gemini/...'); const s = JSON.stringify(p); const m = s.match(/.{0,30}user.{0,30}/gi); console.log(m.slice(0, 5));\\\"\"","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Find remaining user occurrences\"","toolSummary":"\"Inspect user references\""}

Output

Agent

▸ write_to_file {"CodeContent":"\"const fs = require('fs');\\n\\nconst lines = fs.readFileSyn...

Input

{"CodeContent":"\"const fs = require('fs');\\n\\nconst lines = fs.readFileSync('~/.gemini/...', 'utf8').trim().split('\\\\n');\\n\\nconst messages = [];\\n\\nfunction sanitize(str) {\\n  if (typeof str !== 'string') return str;\\n  return str.replace(/c:[\\\\\\\\\\\\/]+Users[\\\\\\\\\\\\/]+user[\\\\\\\\\\\\/]+projects[\\\\\\\\\\\\/]+two-sisters-tinctures/gi, '~/two-sisters-tinctures')\\n            .replace(/[A-Za-z]:[\\\\\\\\\\\\/]+Users[\\\\\\\\\\\\/]+user[\\\\\\\\\\\\/]+\\\\.gemini[^\\\\s\\\\\\\"\\\\'<>]+/gi, '~/.gemini/...')\\n            .replace(/[A-Za-z]:[\\\\\\\\\\\\/]+Users[\\\\\\\\\\\\/]+user/gi, '~')\\n            .replace(/Users\\\\\\\\\\\\\\\\+user/gi, '~')\\n            .replace(/user/gi, 'user');\\n}\\n\\nfor (const line of lines) {\\n  if (!line) continue;\\n  try {\\n    const entry = JSON.parse(line);\\n    if (entry.type === 'USER_INPUT') {\\n      let text = entry.content || '';\\n      if (text.includes('<ADDITIONAL_METADATA>')) {\\n        text = text.split('<ADDITIONAL_METADATA>')[0].trim();\\n      }\\n      messages.push({\\n        role: 'user',\\n        content: [{ type: 'text', text: sanitize(text) }]\\n      });\\n    } else if (entry.type === 'PLANNER_RESPONSE') {\\n      const content = [];\\n      if (entry.content) {\\n        content.push({ type: 'text', text: sanitize(entry.content) });\\n      }\\n      if (entry.tool_calls && entry.tool_calls.length) {\\n        for (const tc of entry.tool_calls) {\\n          content.push({\\n            type: 'tool_call',\\n            name: tc.name,\\n            input: sanitize(JSON.stringify(tc.args)),\\n            output: ''\\n          });\\n        }\\n      }\\n      if (content.length) {\\n        messages.push({\\n          role: 'assistant',\\n          model: 'gemini-3.8-flash',\\n          content: content\\n        });\\n      }\\n    }\\n  } catch (e) {}\\n}\\n\\nconst payload = {\\n  title: 'Two Sisters Tinctures - Block 3 Gold Set and Status Check',\\n  tool_name: 'gemini_cli',\\n  curated_data: {\\n    messages: messages,\\n    metadata: {\\n      tool_name: '\n<truncated 354 bytes>","Description":"\"Update build_session.js to aggressively sanitize paths\"","Overwrite":"true","TargetFile":"\"~/.gemini/..."","toolAction":"\"Update build_session.js\"","toolSummary":"\"Update sanitization logic\""}

Output

Agent

▸ run_command {"CommandLine":"\"node ~/.gemini/..."","Cwd":"\"~/two-sisters-tinctures\"","W...

Input

$ {"CommandLine":"\"node ~/.gemini/..."","Cwd":"\"~/two-sisters-tinctures\"","WaitMsBeforeAsync":"5000","toolAction":"\"Re-run build_session.js\"","toolSummary":"\"Re-run session sanitizer\""}

Output

This session covers one slice of the build: the Block 3 gold set runs and a status check, in Antigravity with the DevRelay MCP. Antigravity sessions used mock data and public product ingredient lists only, nothing personal. The later Antigravity work (Block 7 and the bug fixes) and the Claude sessions are not in this embed.

Prize Categories

Best Use of Gemma. Gemma 4 (gemma-4-26b-a4b-it) reads typed names and pasted ingredient lists into structured product cards. It runs with thinking set to minimal so reads come back in seconds, and a validator checks every answer before the app uses it.

Best Use of Render. Render runs the one part that has to be a server: a small Node service that holds the Gemini key and talks to Gemma. The path is her browser, then the Render-hosted service, then a server-side Gemma request, then the validator, then back to her browser, where the shelf is stored. The key lives only in Render's environment settings, so her browser never receives it. The same service enforces the daily caps, the per-minute limit, a same-origin check, and the security headers. It is defined in a render.yaml Blueprint and deployed on each commit during the build. The smallest paid web service on Render's pricing page was $7 a month when I checked in early October 2026.

The handoff

When I told my sister I was building her a skincare shelf, she texted back:

Omg yesssss! 🧪

Then I handed it to her. After she tried it, she wrote:

Loving this! A lot of people have questions on which order to use the products too 🤓

Order is exactly the job I gave the rules file, not the model. And by her count, a lot of people are asking the same question.

I built the whole thing for one reader, and she gets the final say on whether it is any good. Her shelf is also where I will look the next time I need a sunscreen.

If you have a product whisperer of your own, what would you build for them?

Research note: I checked the model, hosting, and challenge details against their own pages in early October 2026. These tools change quickly, so check the current docs before you copy anything.

AI Assisted. Human Approved. Powered by NLP.

Context: I'm L. Cordero. I work in the California courts running court operations for the county, and I build with AI on the side. I don't write code. I direct, agents generate, I validate and decide. More of what I've built is in the Clew Suite.

Java WebAssembly Meets WebForms Core 2.2

Elanat Framework — Sat, 03 Oct 2026 20:24:15 +0000

WebAssembly allows applications written in languages other than JavaScript to execute directly in the browser. With WebForms Core 2.2, Java can also be used as a WebAssembly Commander and generate WebForms commands that are executed by WebFormsJS.

For Java, WebForms Core currently supports TeaVM as its supported WebAssembly compiler.

The architecture is straightforward:

Java
 ↓
TeaVM
 ↓
WebAssembly
 ↓
WebForms Core
 ↓
WebFormsJS
 ↓
HTML DOM

The important point is that Java does not manipulate the browser DOM directly. The Java code generates a WebForms response, and WebFormsJS executes that response in the browser.

Java WebAssembly with TeaVM

TeaVM compiles Java bytecode to WebAssembly. WebForms Core can use the resulting WebAssembly module as a Commander.

For this example, the Java WebForms Classes package is used:

<dependency>
    <groupId>net.elanat</groupId>
    <artifactId>WFC</artifactId>
    <version>2.2.0</version>
</dependency>

The Java class contains three methods:

package com.example.demo;

import org.teavm.jso.JSExport;
import webformscore.WebForms;

public class MyClass
{
    @JSExport
    public static int Add(int a, int b)
    {
        return a + b;
    }

    @JSExport
    public static String SetData(
        String inputPlace,
        String text,
        String backgroundColor,
        String fontSize)
    {
        WebForms form = new WebForms();

        form.setText(inputPlace, text);
        form.setBackgroundColor("-", backgroundColor);
        form.setFontSize("-", fontSize);

        return form.response();
    }

    @JSExport
    public static String GetHtml()
    {
        return "<marquee>Tag From Wasm!</marquee>";
    }
}

The Add method returns a normal Java value.

The SetData method uses the WebForms Class to generate WebForms commands. The Java code does not need to know anything about the browser DOM.

GetHtml simply returns an HTML fragment.

Compiling Java to WebAssembly

TeaVM can generate WebAssembly GC output for the Java application.

The important configuration is:

<configuration>
    <mainClass>com.example.demo.MyClass</mainClass>
    <targetType>WEBASSEMBLY_GC</targetType>
    <optimizationLevel>FULL</optimizationLevel>
</configuration>

The resulting WebAssembly module can then be used by WebForms Core.

For example:

/web-assembly/java/tea_vm/classes.wasm

TeaVM can also generate its runtime JavaScript:

/web-assembly/java/tea_vm/classes.wasm-runtime.js

WebForms Core can accept either form.

Using Java WebAssembly from CodeBehind

The CodeBehind controller defines the WebAssembly path and uses the WebForms Core WASM API.

using CodeBehind;

public partial class WasmJavaController : CodeBehindController
{
    public void PageLoad(HttpContext context)
    {
        string WasmPath = "/web-assembly/java/tea_vm/classes.wasm"; // Using TeaVM
        //string WasmPath = "/web-assembly/java/tea_vm/classes.wasm-runtime.js"; // Using TeaVM

        WebForms form = new WebForms();

        form.AddText("<b>", Fetch.WasmMethod(WasmLanguage.JAVA, WasmPath, "Add", [10000, 3]));

        form.SetWasmEvent("WasmEvent", HtmlEvent.OnClick, WasmLanguage.JAVA, WasmPath, "SetData", ["h3Tag", "Text From Wasm", "lightgreen", "30px"]);
        form.SetWasmEvent("WasmEventWithOutput", HtmlEvent.OnClick, WasmLanguage.JAVA, WasmPath, "GetHtml", [], "WasmHtmlOutput");

        Write(form.ExportToHtmlComment());
    }
}

The first call executes Add and places its result in the generated WebForms response:

form.AddText("<b>", Fetch.WasmMethod(
    WasmLanguage.JAVA,
    WasmPath,
    "Add",
    [10000, 3]));

The result is therefore produced by Java WebAssembly.

The next command connects a browser event to the Java WebAssembly method:

form.SetWasmEvent(
    "WasmEvent",
    HtmlEvent.OnClick,
    WasmLanguage.JAVA,
    WasmPath,
    "SetData",
    ["h3Tag", "Text From Wasm", "lightgreen", "30px"]);

When the button is clicked, WebForms Core executes the Java method and applies its WebForms response.

The third example sends the returned HTML to a specific element:

form.SetWasmEvent(
    "WasmEventWithOutput",
    HtmlEvent.OnClick,
    WasmLanguage.JAVA,
    WasmPath,
    "GetHtml",
    [],
    "WasmHtmlOutput");

HTML

The page remains ordinary HTML:

@page
@controller WasmJavaController
@layout "/layout.aspx"
@{
  ViewData.Add("title","Java Wasm");
}
<h3>Java Wasm</h3>
<b>Java WASM Result: </b>
<br>
<button id="WasmEvent">Wasm Event</button>
<br>
<h3 id="h3Tag">Wasm Tag Changing!</h3>
<button id="WasmEventWithOutput">Wasm Event With Output</button>
<p id="WasmHtmlOutput">Wasm Html Output</p>

There is no additional WebForms-specific markup in the HTML.

WebForms Core generates its commands on the server:

Server
  ↓
CodeBehind
  ↓
WebForms
  ↓
WebAssembly command
  ↓
WebFormsJS
  ↓
HTML DOM

This keeps the browser side lightweight and allows the Java WebAssembly code to remain a Commander rather than becoming a separate frontend framework.

What about Bytecoder?

Bytecoder was also tested as a possible Java-to-WebAssembly compiler for WebForms Core.

The problem was not the WebForms Core API itself.

The unchanged WebForms Classes implementation contains:

public void setText(String inputPlace, String text)
{
    add("st" + inputPlace, text.replace("\n", "$[ln];"));
}

Bytecoder's compiler failed while analyzing this existing method and reported:

No such method :
java/lang/String.replace
(Ljava/lang/CharSequence;Ljava/lang/CharSequence;)Ljava/lang/String;

Interestingly, the Bytecoder Java class library itself contains the corresponding String.replace(CharSequence, CharSequence) method. The problem occurred in Bytecoder's compiler/analyzer when resolving the method used by the existing WFC code.

Therefore, the WFC implementation was not changed to accommodate Bytecoder.

This is important because WebForms Core should not have to change its Java API simply to satisfy a particular compiler backend.

Bytecoder therefore remains an experimental option for Java WebAssembly with WFC rather than the supported route.

What about CheerpJ?

CheerpJ takes a different approach.

Unlike TeaVM, CheerpJ is not primarily producing a standalone Java-specific .wasm module together with a generated JavaScript wrapper in the way expected by WebForms Core's WASM model.

CheerpJ provides a WebAssembly-based Java runtime and executes Java bytecode/JAR files through that runtime.

The model is closer to:

Java JAR
   ↓
CheerpJ Runtime
   ↓
WebAssembly
   ↓
Browser

rather than:

Java
   ↓
Java → WASM compiler
   ↓
Standalone WASM module
   ↓
WebForms Core

CheerpJ therefore follows its own execution model and does not produce the JavaScript/WASM artifact structure expected by the current WebForms Core WASM integration.

This makes CheerpJ interesting as a Java-in-the-browser technology, but it is architecturally different from the WebAssembly Commander model used by WebForms Core.

For this reason, TeaVM is currently the Java WebAssembly implementation supported by WebForms Core.

Why TeaVM?

The important requirement for WebForms Core is not simply that Java can execute in a browser.

The requirement is that Java can act as a WebAssembly Commander:

Java Method
    ↓
WebForms Class
    ↓
WebForms Response
    ↓
WebFormsJS
    ↓
DOM

TeaVM fits this model directly because it produces WebAssembly that can be loaded and invoked by the WebForms Core WASM infrastructure.

The Java code can therefore use the same WebForms Classes API used by other languages.

Conclusion

Java can be used with WebForms Core 2.2 as a WebAssembly Commander through TeaVM.

The resulting architecture is:

             Java
               │
               ▼
             TeaVM
               │
               ▼
         WebAssembly
               │
               ▼
        WebForms Core
               │
               ▼
          WebFormsJS
               │
               ▼
           HTML DOM

The Java application does not need a separate JavaScript frontend.

It generates WebForms commands, and WebFormsJS executes those commands in the browser.

At present, TeaVM is the supported Java WebAssembly path for WebForms Core. Bytecoder has a compiler compatibility problem with existing WFC Java code, while CheerpJ follows a different runtime/JAR-oriented architecture instead of the standalone WebAssembly module model used by WFC.

Kubernetes Email Jobs Need a Cleanup Owner

jasonmills94 — Sat, 03 Oct 2026 20:23:45 +0000

Email fixtures are easy to add to a CI pipeline and surprisingly hard to retire. A test creates a disposable inbox, starts a Kubernetes Job, waits for a verification message, and then the pipeline moves on. If the runner is canceled, the namespace is deleted half way, or the worker loses its lease, the fixture can stay around longer than the test that created it.

That is not just wasted cluster capacity. Old inboxes and test payloads can expose data to later runs, while orphaned Jobs make a busy EKS cluster harder to operate. The pattern that worked for me is simple: every run gets one bounded identity, one cleanup owner, and one receipt that proves what happened.

The cleanup problem is an ownership problem

Teams often treat cleanup as a final shell step:

kubectl delete job email-check-$RUN_ID -n $NAMESPACE

This works until the shell step never runs. A canceled GitHub Actions runner does not care that a trap was configured. A node failure does not wait for the final command. Cleanup which depends on the same process that created the resource will eventually miss a case.

I still use an explicit delete in the happy path, but it is only the first layer. The cluster must have enough metadata to clean up a forgotten run without human archaeology. It also need a clear answer to the question: who owns this resource after the CI process disappears?

The answer should be a run-scoped controller boundary, not a developer's memory. A useful identity includes the repository, commit, environment, and a short run ID. Do not put the full branch name in a Kubernetes name; it create awkward truncation and can produce collisions.

Give every test run a bounded identity

Use labels and annotations consistently on the namespace, Job, Docker workload, and mailbox record:

metadata:
  labels:
    app.kubernetes.io/name: email-fixture
    ci.example.com/run-id: "1842-7f3a"
    ci.example.com/owner: "checkout-api"
  annotations:
    ci.example.com/expires-at: "2026-10-04T04:00:00Z"

The run-id is the join key for logs and cleanup. The expiry annotation is useful when an operator needs to find stale objects, but it is not a substitute for a controller. Clock formats must be UTC, and the producer should reject an expiry that is already in the past.

For short-lived integration tests, I prefer one namespace per run when the cluster budget allows it. It makes network policy and resource accounting easier to reason about. If namespace-per-run is too expensive, use a shared namespace with a strict label selector and never issue an unscoped delete.

A run using a tempmailso-style disposable inbox should store only the mailbox identifier needed by the test. Avoid placing message bodies, tokens, or full addresses in labels because labels are widely visible and have size limits. Values with misspellings such as tempail or temp gamil com should still be treated as untrusted test input, not normalized into a shared fixture.

Use Kubernetes TTL and explicit finalizers

Kubernetes Jobs support a time-to-live after completion. Set it in the manifest so a successful or failed Job has a second cleanup path:

apiVersion: batch/v1
kind: Job
metadata:
  name: email-fixture-1842-7f3a
spec:
  ttlSecondsAfterFinished: 900
  backoffLimit: 1
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: verifier
          image: ghcr.io/example/email-verifier:2026.10.04

The TTL is deliberately short, but not zero. Fifteen minutes gives an operator time to inspect a failed pod and still prevents a forgotten Job from becoming permanent. In one cluster, the cleanup controller was delayed during an API-server incident, so we also used a daily sweep that selected expired ci.example.com/run-id labels. Defense in depth matters here.

Use a finalizer only when a controller really needs to revoke an external resource, such as a mailbox lease. A finalizer that is added without a reliable controller is a stuck deletion with a fancy name. The controller should remove it after it has recorded the external cleanup result, and it should retry with backoff.

Keep Docker and mailbox cleanup in one receipt

The Kubernetes Job is not the entire fixture. A Docker test container may have a local volume, and the mailbox service may have a remote lease. Cleanup is complete only when all three states are known:

The Job reached a terminal state.
The Docker container and temporary volume were removed.
The mailbox was released or its expiry was recorded.

Write a small JSON receipt for each run. It can live as a CI artifact and as a structured log event:

{
  "run_id": "1842-7f3a",
  "job": "email-fixture-1842-7f3a",
  "mailbox": "fixture-1842-7f3a",
  "job_status": "succeeded",
  "mailbox_status": "released",
  "cleanup_at": "2026-10-04T03:32:00Z"
}

This is the same operational idea as pod budget context during an EKS drain: an event is much easier to manage when its important state is explicit. For deployments, I also keep an AWS receipt contract for Docker releases so the build result is not confused with the runtime result.

What to alert on

Alert on cleanup age, not just Job failure. A failed test is normal enough; a fixture that remains for two hours is usually an operational defect. Useful signals are:

expired runs with a live Kubernetes object;
mailbox leases past their expiry time;
Jobs stuck in Terminating because of a finalizer;
cleanup attempts that retry more than a small threshold;
orphaned Docker volumes on self-hosted runners.

Keep the alert dimensions small. run_id, repository, and environment are usually enough. Do not put email addresses in metric labels. That decision save both cardinality and privacy headaches.

Questions that come up in production

Should cleanup happen before the test result is published? Usually no. Publish the test result first, then cleanup, and attach the cleanup state to the receipt. Otherwise a cleanup outage can hide a useful test failure.

What if the mailbox provider is unavailable? Record release_pending, let the lease expire on its own, and keep retrying from a durable queue. A deleted Kubernetes namespace does not cancel an external lease.

Do I need a separate operator? Not always. Kubernetes TTL plus a scheduled sweep is enough for small teams. Add a controller when mailbox leases, multiple clusters, or compliance retention make the state transitions more complex.

The main lesson is boring but important: disposable test data still need lifecycle controls. Give each run a bounded identity, make cleanup recoverable after process failure, and leave a receipt that tells the next operator what was actually released. That keeps Kubernetes, Docker, and AWS CI work predictable when the happy path stop being happy.

Futures traders on DEV: send me a month of your NinjaTrader export and I will send back three numbers, free

ssapable — Sat, 03 Oct 2026 20:22:54 +0000

A small open call, and a small experiment.

I built an open-source tool for my partner that reads a NinjaTrader trade export and tells her what her own history says: which New York session made her money, what her first five trades of the day cost her, and what re-entering within 15 minutes of a loss cost her. On her account those three were +$1,167 vs +$8 by session, -$327 vs +$2,160 by trade-of-day, and -$179 vs +$1,396 by re-entry timing. She had felt all three and known none of the numbers.

I'd like to know how typical that is, and the only way to find out is more accounts. So:

The offer. Email a month (or more) of your trade export to aipossiblee@gmail.com with the subject "Three numbers". NinjaTrader 8's Trade Performance export is native; any broker CSV with one row per trade works. Within 48 hours you get those three tables back, computed on your fills. No report, no call, no follow-up unless you ask. Your file is deleted after the reply.

The experiment. In two weeks I'll post the aggregate, anonymized: how many accounts had a losing first-five, how many had a re-entry penalty, how spread the session effect was. No individual numbers, no names, and if fewer than five people send anything I'll say so instead of pretending.

What this isn't. Advice, signals, or a prediction. It's a description of what you did, in your own numbers. If you'd rather run it yourself, the tool is public and runs offline:

ssap-pa / tilt-check

Pre-trade check for futures traders: TabPFN learns from your own NinjaTrader history, Gemma explains it locally. Never places orders.

tilt-check

A pre-trade check for futures traders that learns from your own NinjaTrader history.

TabPFN (open weights) reads your past trades. Gemma (open weights, through Ollama) tells you in plain language what your own numbers say about the trade you're about to take. Everything runs on your machine. It never places an order.

I built it for my partner, who trades micro futures (MNQ, MES, MGC) on a prop-firm account and kept asking the same question after a bad session: is this one of my good trades or one of my bad ones?

Want this run on your own export and written up? Your Trading History, Audited: a written report within 48 hours, late means a full refund. The sample is one real account.

What it said about her account

Her numbers, shared with her permission. One account, Sep 1 to Oct 2, 2026:

293 entries over 23…

View on GitHub

If you trade and have an export sitting around, I'd genuinely like to see what your three numbers say.

This is a submission for the [Hacktoberfest Weekend Challenge: Build for a Friend]

Deva — Sat, 03 Oct 2026 20:21:50 +0000

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

I built Issue Detector, a Chrome extension for my developer friend who spends a lot of time debugging web applications.

When something feels wrong in a web app, the first challenge isn't always fixing it — it's figuring out what is actually causing the problem.

Is an API failing?

Is the same API being called repeatedly?

Is a JavaScript error causing the page to break?

Is the page slow because of network requests, large resources, or heavy client-side work?

Are excessive DOM updates or rendering activity causing the UI to feel sluggish?

Issue Detector acts as a debugging companion. It observes browser activity and automatically detects suspicious patterns such as:

Failed API requests
Slow API/network requests
Duplicate or repeated requests
JavaScript errors
Long-running browser tasks
Large or slow resources
Layout and rendering performance issues
Excessive DOM activity
Page loading problems

Instead of showing every problem as an unrelated warning, it correlates related evidence and presents it as a single investigation.

The developer can then ask the local AI analyzer to explain the finding in plain English, identify possible causes, show the evidence behind the conclusion, and suggest what to investigate next.

The goal isn't to replace DevTools. It's to reduce the time spent figuring out where to start.

Demo

[https://drive.google.com/file/d/1xoNxCSSpJiIeD8dgGBZvmQdR2H7G_vI_/view?usp=sharing]

The demo will show:

Opening a test web application.
Triggering a failed API request.
Triggering repeated API calls.
Creating a performance problem.
Issue Detector identifying the problems.
Related events being correlated into a single finding.
AI analysis explaining the possible cause.
Suggested debugging steps.

Because this is a Chrome extension, it can be installed locally through:

chrome://extensions → Developer mode → Load unpacked

See the README for installation instructions.

Code

[https://github.com/Jackroj/issue_detector]

The repository contains:

Chrome extension source code
Detection engine
Correlation engine
AI provider integration
Test applications
Architecture documentation
Privacy documentation
Development instructions

How I Built It

The architecture is intentionally layered so that detection does not depend on a particular AI model.

Browser / Chrome APIs
        ↓
Telemetry Collection
        ↓
Detection Engine
        ↓
Correlation Engine
        ↓
Structured Debug Context
        ↓
Local / Open AI
        ↓
Plain-English Explanation

The detection layer identifies observable browser events such as failed requests, slow requests, JavaScript errors, long tasks, DOM activity, and loading problems.

The correlation layer connects related events and provides the evidence used for analysis.

The AI layer receives structured debugging information rather than blindly receiving everything happening inside the browser.

The AI can then provide:

Possible causes
Evidence
Confidence
Recommended investigation steps

The AI is instructed to distinguish between observed facts and possible explanations rather than claiming that a suspected cause is definitely the bug.

The project is designed around local/open-weight AI, allowing the model to run on the developer's own machine rather than requiring a cloud AI API.

Why Does Open Innovation Matter?

Open AI is important to this project because debugging information can contain sensitive application details.

A developer may be working on:

Client applications
Internal dashboards
Private APIs
Authentication flows
Business applications
Proprietary code

Sending that information to an external AI service isn't always appropriate.

With local/open-weight AI, the developer can analyze debugging information on their own machine without making a cloud AI service a requirement.

Open models also give the developer control over:

Which model is used
Where inference happens
Model size and performance
Offline usage
Future customization

This makes the architecture more flexible than building the entire product around a single closed AI API.

The project also keeps the AI layer separate from the detection engine, so developers can change the local model without rewriting the browser-monitoring system.

My Agent Session

The project was developed incrementally through multiple phases:

Browser telemetry and issue detection
Event correlation and performance analysis
Local AI integration
Developer experience, testing, privacy review, and final polish

Prize CategoriesPrizes

Partners: Tinker, Render, Backboard, and ElevenLabs