DEV Community: Sergei Hanterov

Inside Plënka’s 43-Gate Jenkins Citadel: How I Keep Autonomous AI Agents from Ruining My Codebase

Sergei Hanterov — Fri, 18 Sep 2026 05:54:55 +0000

When your primary developers are AI agents operating on background loops, you cannot rely on trust. You need a paranoid, uncompromising, automated guillotine.My Jenkinsfile for Plënka has grown into 43 blocking quality gates. If an agent hallucinates, ignores an ADR, leaks memory, or attempts to comment out a failing test to pass CI, this pipeline crushes the build, collects the diagnostic logs, and sends the agent back to fix its mess.Here is the exact blueprint of all 43 gates.

Group 1: Preparation (2 Gates)

Checkout: Workspace cleanup, repository clone, git submodules initialization, and report directory creation.
Secrets Scan (BLOCKING): Three-tier secret detection using an inline scripts/secret-scan.sh, gitleaks with SARIF reporting/redaction, and detect-secrets with a baseline. A single leaked key immediately fails the build.

Group 2: Read-Only Rules & Schema Validators (9 Parallel Gates)

Validate Schemas: Compiles all events/v1/*.json event schemas using ajv (draft2020).
Validate Glossary: Verifies that both code and documentation strictly adhere to terms defined in docs/GLOSSARY.md (and blocks anti-glossary terms).
Validate Features: Validates features/// directory structures, Gherkin syntax linting, and BDD coverage anchor alignment.
ADR Compliance: Ensures every feature.md points to a valid Architecture Decision Record (ADR), and every ADR contains Quality Drivers and Compliance sections.
No-Skip Check: Absolute ban on GTEST_SKIP(), DISABLED_*, or commented-out tests without explicit architectural justification (ADR-022 §A3). No sweeping bugs under the rug.
Naming Lint: Enforces test naming convention matching TEST(_...).
Validate Structure: Confirms the repository tree strictly matches the STRUCTURE.md manifest.
RTM Uniqueness: Enforces single-use Test Case IDs across acceptance.md to prevent duplicate requirements.11. Validate Image Pins: Requires all Docker base images to be pinned by immutable SHA256 hashes (@sha256:...).

Group 3: Static Analysis & Code Quality (7 Parallel Gates)

shellcheck: Static analysis for all Bash scripts in scripts/, tools/, and ci/.
hadolint: Dockerfile linting configured at warning severity.
yamllint: YAML validation against .yamllint.
markdownlint: Documentation and ADR markdown linting.
clang-format / clang-tidy: C++23 code formatting and static analysis integrated with vcpkg compilation databases.
cppcheck (BLOCKING): Executed with --error-exitcode=1 covering warnings, style, performance, and portability. No legacy grandfathering allowed—tech debt must be fixed or explicitly suppressed.
ESLint: Frontend linting where all warnings are treated as hard errors.

Group 4: Security Scanners (2 Gates)

SCA (Trivy - BLOCKING): Filesystem dependency vulnerability scanning. Any HIGH or CRITICAL CVE fails the build and outputs SARIF reports.
SAST (Semgrep - BLOCKING): Runs OWASP Top 10, CWE Top 25, and custom ci/semgrep.yml rulesets with --error enforcement.

Group 5: Build, Test & Sanitizer Matrix (4 Gates)

Build Frontend: Production Vite + Preact + TailwindCSS compilation.
Frontend Tests: Vitest unit tests and Playwright E2E suites running against a live backend (no API mocking).
DB Reset & Migrate: Fresh Postgres + Redis spin-up with database migrations applied in a single transactional block (ON_ERROR_STOP=1 --single-transaction).
Build & Test Matrix (4 Parallel Branches):Coverage: Unit, property, and integration tests (Enforced thresholds: Line $\ge 80\%$, Branch $\ge 70\%$).ASan: AddressSanitizer + LeakSanitizer for memory corruption and leak detection.UBSan: UndefinedBehaviorSanitizer targeting undefined C++ behaviors.TSan: ThreadSanitizer for concurrency and data-race detection under load.Catch2 Unit Tests: Isolated core logic tests (Money, TraceId, Result types).

Group 6: Architecture & Defense-in-Depth (6 Gates)

Archcheck: Detects circular dependencies, god-headers, and god-classes (strict threshold: 150 lines per class).
Binary Hardening (checksec): Verifies compiled binaries enforce PIE, RELRO, Stack Canaries, NX bit, and Fortify Source.
SBOM & SCA (syft + grype): Generates Software Bill of Materials (SBOM) and performs vulnerability scanning directly against the SBOM.
Secret Verification (Trufflehog): Scans for live credentials, validating active API keys against vendor endpoints.
License Audit: Dependency license verification via trivy --license-full.
Container Image Scan: Vulnerability scanning of fully assembled production container images.

Group 7: Fuzzing, Chaos & Load (4 Gates)

Fuzz (libFuzzer): In-process fuzzing of core C++ parsing and business logic functions (20-minute run).
Fuzz (AFL++): External fork-server fuzzing against protocol endpoints (20-minute run).
Chaos Engineering (Toxiproxy): Injects latency, packet loss, and connection dropouts to test backend resilience.
Load Test (k6): Automated performance benchmarks enforced against SLAs in ci/k6-thresholds.json.

Group 8: Supply Chain Integrity (3 Gates)

Artifact Signing (cosign): Container image signing via Sigstore.
Provenance (in-toto): Attestation generation for SLSA supply-chain compliance.
Reproducible Builds: Verifies bit-identical output across isolated compilation passes.

Group 9: Infrastructure & Cloud Scanners (3 Gates)

Snyk (SCA + SAST): Advanced vulnerability intelligence scanning (Master/Release branches).
IaC Scan (Checkov): Misconfiguration analysis for Infrastructure-as-Code (Terraform, Dockerfiles).
Terraform Lint (TFLint): Static analysis for Terraform infrastructure configs.

Group 10: Final Verification & Quality Gate (3 Gates)

Traffic Replay (GoReplay): Replays recorded production HTTP traffic against the local backend to catch edge-case regressions missed by unit tests.
Native Quality Gate: Custom aggregator replacing SonarQube (per ADR-041). Consolidates findings from cppcheck, clang-tidy, jscpd (code duplication threshold $<3\%$), semgrep, trivy, grype, and checkov. Hard rule: NEW_ISSUES <= 1.
DAST Baseline (OWASP ZAP): Staging environment vulnerability scan targeting XSS, CSRF, SQL Injection, and Open Redirects (configured via ci/zap-baseline.conf).

How do you handle AI-generated code quality in your own projects? Do you let agents push directly, or do you run them through a similar meat grinder? Let me know your thoughts, feedback, or constructive criticism!

The 25-Minute Mouse Freeze: Building an AI Backend on a Dying Laptop

Sergei Hanterov — Wed, 16 Sep 2026 06:37:17 +0000

To be completely honest, I don't like my day job. It’s mostly just stress and waiting for the next corporate reprimand. But I can't leave just yet for a few reasons, so I won't get into that.
The real work starts when I get home. I boot up my laptop, load into Fedora 43 (I absolutely love Red Hat-based Linux), and that’s when the David Blaine street magic begins, haha.
The moment I log in, the system starts to choke. A million Docker containers spin up, RAM evaporates like water in a desert, and the CPU gets dangerously close to a kernel panic featuring a very stressed-out penguin. It’s brutal. I launch Devin Desktop, Firefox, and Hermes.
While my agents are writing code and scavenging the web for data to feed their hungry context windows, I hit make ci.
And then... everything dies.
The entire system freezes. The mouse cursor stops moving entirely, like it just saw a cat, haha. Honestly, I freeze along with it, experiencing my own personal kernel panic. 25 minutes of dead silence and staring at a frozen screen later—the agent finally finishes the task.
Here is the biggest lesson I’ve learned about LLMs during these 25-minute freezes: Cheap models are dumb. Expensive models are also dumb, they just forget the conversation slightly later (I’m exaggerating, but you get the point).
My current workflow? I use cheap models like GLM-5.3 Flash for the grunt work. But when it’s time for architectural review, I bring in Fable 5.1 and crank its... let's just say "reasoning dial" to the absolute maximum. Step by step, slowly but surely, my little worker bee agents are building Plënka.
In the next episode of this project, you’ll see—well, read (or have your AI voice assistant summarize for you)—exactly what is inside my Jenkins pipeline. I’ll break down how this strict methodology affects product quality, whether TDD actually helps AI agents, and most importantly, we'll take a look at what exactly is inside my agent.md file.
Drop your thoughts, suggestions, or constructive criticism below. How are you guys surviving local agent workflows without melting your hardware?

From a Soviet Film Camera to C++23: Why I’m Bootstrapping a New Photo Marketplace

Sergei Hanterov — Tue, 15 Sep 2026 18:20:48 +0000

I’ve loved photography and cameras since the 90s. Back then, I subscribed to a print magazine simply called Photo (it’s long gone now). It was the dawn of Photoshop and digital editing, but the real magic was happening offline. Local film digitization shops were opening on every corner, and we were shooting everything on Kodak and Fujifilm.

My camera of choice? An old Soviet "FED" rangefinder. For film, the quality it produced was absolutely incredible.

Eventually, I grew up and went to university for computer networks and servers. I spent my days deep in Cisco and HP enterprise gear. Funny enough, I actually hated programming. Even in uni, I only wrote clunky Java scripts out of pure necessity for my own tasks. Back then, the idea that a machine could write code for you was pure sci-fi.

Fast forward to today. LLMs have entered the arena, easily matching the output of junior and mid-level developers. I looked at the massive archive of photos I’ve accumulated since childhood and had a thought: Wait, I have the sysadmin background for AWS and Cloudflare. I have AI agents to write the code I don’t want to write. Why not build my own stock photo marketplace?

That’s how Plënka was born (the name literally translates to film from Russian).

If you look at my tech stack, you might ask: Why on earth are you writing the backend in ultra-low-level C++23 and pushing the frontend AI to WASM?

The honest answer? Because they are blazingly fast—and because I simply don't have the VC money to pay for the massive, bloated infrastructure that the top stock monopolies use, haha.

So, does anyone want to hear what happens next?

Ah, well, I’m going to tell you anyway. In the next episode of this build-in-public journey, you’ll find out how I’m orchestrating this entire AI-driven development pipeline on a dying i5 laptop with 4 cores and 12GB of RAM.

P.S. I’m not really "working" on it, I’m mostly just suffering, haha.

The whole backend is written by AI agents. Here's what that actually means day to day.

Sergei Hanterov — Sun, 13 Sep 2026 19:35:58 +0000

Pre-launch founder here. Plënka is a stock photo marketplace where photographers keep 75% of the revenue — the industry standard is 15–40%. I live in Armenia, I've been here 8 years, and I work alone. Technically alone. In practice, a factory of AI assistants writes the entire backend, in C++23.

People ask what that looks like day to day, so here is the honest version.

The agents draft, review and rewrite each other's code. My actual job is direction and rejection: deciding what gets built, and throwing away what isn't good enough. The bottleneck isn't typing speed, it's judgment. Most days I write zero lines of code and make dozens of small decisions instead.

What surprised me: the hardest part isn't the code at all. It's knowing which 20% of a feature actually matters to a photographer waiting for a fair payout, and cutting the rest. An agent will happily build all 100% if you let it. Saying "no" faster is the whole skill.

The other surprise: C++ was a strange choice on paper and a good one in practice. I wanted the cost structure of a platform that can afford to pay 75% out — and that starts with not carrying a payroll, and with infrastructure that stays cheap and fast.

Status: pre-launch, no investors, everything documented as I go. If the "one solo founder + AI agents" model fascinates or horrifies you, I'm happy to answer questions in the comments.

And one honest note at the end: the project is funded by early supporters — voluntary contributions from $50, no equity, no returns, nothing in return but a fairer marketplace existing. If that resonates, the Ko-fi link is in my profile. If not, reading this far is already support.

Disclosure: this post was drafted with AI assistance and published by the founder — the same setup the post describes.