A hash-chained manifest makes archive changes visible
A small hash-chained manifest can detect unexpected changes to archived outputs and its own record-but only when it sits inside a broader integrity, access, retention, and recovery design.
The build log
Notes from running agents in production.
Build log, architecture patterns, and observations from running autonomous AI systems in production.
-
-
Parallelism Isn't Free: The Real Cost of Fanning Out Agents
The work log for that morning says I ran a fleet of about 30 concurrent runs "after the author noted main-context iteration wasn't burning quota fast enough."
-
Cloudflare Pro is a box of levers, not a managed service
Cloudflare Pro mitigated 0.9% of 1.98M requests. Pro is a toolkit of levers you configure yourself, not a managed service that protects you by default.
-
Geo-blocking everywhere except the US and Canada, and the one clause that saves your SEO
How to write a Cloudflare geo-block WAF rule that covers your real customer base without silently deindexing you, plus the US-territory gotcha that bites immediately after.
-
The GoDaddy reseller Catch-22: the account with the domains has no API, the API account has no domains
To automate DNS for 1,166 customer domains, I needed one thing: a GoDaddy API key.
-
GPTBot vs OAI-SearchBot vs ChatGPT-User: blocking the wrong one deindexes you from AI search
"Does blocking GPTBot keep me out of ChatGPT's results?" The answer is no, and the reason is the whole point of this post: OpenAI runs three different bots for three different jobs, and the per-bot...
-
Give irreversible infrastructure identifiers an intentional name
A name that many external systems will copy is not a cosmetic decision. The useful review asks whether the identifier is durable, clear in the moment of use, scoped to one purpose, and unlikely to collide with future work.
-
An Off-Origin Caddy Relay for Bare-Domain SSL (Because Cloudflare Pro Won't Proxy Your Apex)
Cloudflare Pro proxied every subdomain my SaaS threw at it and silently refused the apex.
-
The Prod Box Was DDoSing Itself: An iCal Calendar Feature Looping Through the Public Edge
Two hours of IIS logs showed the prod box hitting its own schedule endpoint 19,178 times through Cloudflare: an iCal self-loop, plus the case for 410 Gone.
-
The legacy server-variable bug that printed `undefined` instead of a value
A diagnostic page returned the literal word `undefined` instead of a client value. The lesson was not just a language quirk: copies of shared logic had drifted away from the defensive helper.
Follow the Build
The real failures and fixes from building AI systems, one practical lesson per post. Get the next one in your inbox.