Your Best Coder Will Be Your Lowest AI Adopter
The strongest coder we onboarded to Claude Code is our lowest-usage adopter. Capability and conviction are separate axes, and a second demo can't close the gap.
The build log
Notes from running agents in production.
Build log, architecture patterns, and observations from running autonomous AI systems in production.
-
-
The method outlasts the patch
A ticket closed on April 23rd with five firewall rules. The durable win was the two hours we spent the next morning writing down how to investigate the next swarm so we would not have to rediscover the frame from scratch.
-
We almost let a stale personal branch wreck a hotfix
Our local preview branch was 304 commits behind origin/preview. The /sync skill was about to merge a hotfix into it. Luck, not process, stopped the merge.
-
The compile gate nobody wrote down
A redirect bug turned out to be a silently truncated JS artifact with no documented compile step. The fix took an afternoon. The guardrail took one more hour.
-
We Stopped Trusting Memory for the Safety Check, So We Made the Repo Install It
One broken minified JavaScript file got past us once. Our informal check was not a machine proving the result still parsed.
-
The decorative database: when your blocklist table isn't actually on the request path
We had 1,186 blacklisted IP ranges the per-request stored proc never read. What the gap cost, and why a TCP-layer block beat the app-layer fix four to one.
-
Single-currency database, dual-currency checkout: adding CAD without a schema change
Adding CAD checkout to a single-currency database: translate only at the view and the gateway, and never let the gateway's rounded amount write back over your stored total.
-
A Migration Became the Audit We Had Never Run
A repository move exposed external automation and a backup job that no longer produced the expected artifacts. The lesson is to treat any substrate migration as an inventory-and-verification exercise, not a search-and-replace task.
-
The UA blocklist is the right-sized fix for an identified crawler (and the wrong one for a swarm)
Bot mitigation is a tiered decision. The same incident that called for a one-line UA block against a named crawler also needed a CIDR firewall rule against a distributed swarm. The wrong tool for each would have made things worse.
-
The bot-swarm that broke the playbook: URL fan-out beats top-IP-by-volume
Top-IP-by-volume is the standard playbook for bot detection. Here is what happens when the attacker is 55+ IPs each hitting once, and why grouping by target URL beats grouping by source IP.
Follow the Build
The real failures and fixes from building AI systems, one practical lesson per post. Get the next one in your inbox.