Covers July 10 - 22, 2026.
The template’s crawl-test harness has a preview mode that’s supposed to measure a production build. Its argument parser split on = only, and the package scripts pass the space form, so the mode silently fell back to dev. Every “production” crawl in the project’s history had actually been measuring the dev server.
That was one of nine problems I found in two weeks. The build proofs came about to check product claims against the thing that actually ships. Once aidd and Spernakit went public, I started doing the same to the quality gates. I won’t go through all of them here, but a few were bad enough that I rebuilt how the gates are tested.
The bundle-size gate was passing at 197 KB while React itself had quietly migrated into a lazily-loaded chunk, adding a full network round trip before the app could boot, because the budget counts bytes and has no idea where they sit. Fixing the chunking cut first load from 218 KB to 184 KB and from two waterfall hops to one, and the new gate asserts the shape of the critical path as well as its size. I’m checking the request waterfall alongside byte count and Largest Contentful Paint now.
Also cleared two performance findings I’d filed against an application earlier in the month. The alarming numbers came from dev-only instrumentation reporting intermediate values. The application was fine. I’d just measured it badly.
Another checker scanned built HTML for critical-path scripts using a case-sensitive tag match. Feed it <SCRIPT> and it counted zero scripts, then passed. I found that one through a CodeQL alert that I nearly dismissed again after republishing the repository.
Podex had a quieter version. Its test wrapper checked individual Pester results, but Pester can fail during discovery before producing any of those results. The empty set passed and the wrapper reported success.
The one I turned off
The finding with real stakes came while upgrading the fleet. Five apps allowed sensitive database tables to be edited through the generic admin screen. The template already had an assertion for the exact problem, but each affected app had frozen or disabled it during earlier template work.
I’d treated those overrides as a way to preserve app-owned behavior. Meanwhile, the interfaces around the frozen files changed and the assertions stayed off. I was the reason the gate had stopped running where it mattered.
After that, I stopped accepting a new gate after seeing only a passing run. The artifact-parity check was tested by deleting the rule it protects. For the licensing gate, I removed a required notice and watched the build stop.
I also got rid of several hand-maintained command lists. CI and the local hooks now call the same runner. A startup assertion catches steps that have no cache classification, since the cache was responsible for a few of the other problems I’m skipping here.
Last December I started building an orchestrator because I didn’t trust agents’ completion claims. Somehow I’d grown much more relaxed about a green line printed by my own code.
I still have a long list of the gates I haven’t tried to break yet.