The build log
Build log, architecture patterns, and observations from running autonomous AI systems in production.
The plan said any migrated domain could be pointed back at the old server. Three of my own test domains had already lost the certificates that made that true, and a status word called disabled talked me out of the browser I needed.
On June 5, commit commit-9547 closed an authority hole that had given every agent the same answer when it asked for permission: skip the checks.
I defined a five-lane capability model for an autonomous agent's dispatch policy, watched the tests go green, and read that as proof the gate was live. A same-day Codex and Manus review found the dispatcher never called it.
A routine JIRA ticket-create came back 403 Basic Authentication Failure - AUTHENTICATIONDENIED with credentials I'd been using all session.
A tokenization feature passed every sandbox test, then production returned E00044: CIM not enabled. Probe the vendor capability in prod before you build.
GoDaddy says there is no API for WWD private-label reseller accounts. There is. Here is how to find it, authenticate with it, and script it for bulk DNS changes.
A per-domain Cloudflare edge flip broke 8 legacy redirect domains. A blast-radius scan built during the migration sized the damage in 12 seconds.
A value can be present, non-empty, and still be the wrong kind of value for the operation that follows. The durable fix is to validate the real contract, separate identifiers from their representations, and fail safely at the boundary.
I pin Cursor to my taskbar. I reboot. It's gone. Not minimized, not hiding behind another window, gone.
Build with one model, review with a different one at high effort. One adversarial Codex pass found several false-green paths in a production gate that showed all green.
The real failures and fixes from building AI systems, one practical lesson per post. Get the next one in your inbox.