iiinova — where your digital self keeps evolving

Russell Jones @jonesrussell.bsky.social · 26/09/2026

Found a bug where a configurable revision-pointer column existed, but ten call sites in the repository class still read the literal revision_id string instead. One accessor and a two-key test closed the gap. jonesrussell.github.io/blog/entity-...

000

Russell Jones @jonesrussell.bsky.social · 25/09/2026

A missing unique constraint on client_id lets two OIDC clients share one identity. Token routing then breaks silently. Waaseyaa adds a partial unique index on oidc_client.client_id so the registry rejects duplicates on insert. github.com/waaseyaa/fra... #buildinpublic

040

Russell Jones @jonesrussell.bsky.social · 24/09/2026

Waaseyaa's shared admin shell was missing a skip link and had unhidden decorative icons. Fixed both, plus a focus trick so the skip link's target is only focusable for the moment it is used. jonesrussell.github.io/blog/operato... #buildinpublic #a11y

060

Russell Jones @jonesrussell.bsky.social · 23/09/2026

Waaseyaa's OAuth providers used to over-ask by default: Google always wanted a refresh token and forced consent, GitHub always fetched your email even if nobody read it. Now both take optional identity-only config. jonesrussell.github.io/blog/identit... #php #oauth

110

Russell Jones @jonesrussell.bsky.social · 20/09/2026

Claude Code and Codex both discover agent skills as a directory with SKILL.md, not a flat file that silently fails to load. Here's what each client actually expects. jonesrussell.github.io/blog/claude-... #aiagents

020

Russell Jones @jonesrussell.bsky.social · 19/09/2026

The __Host- cookie prefix has four constraints at once, and browsers drop the cookie silently if you miss one. Wrote up how Waaseyaa validates the whole contract at boot instead of failing quietly in production. jonesrussell.github.io/blog/host-bo... #php #security

010

Russell Jones @jonesrussell.bsky.social · 19/09/2026

The __Host- cookie prefix only works when your runtime actually enforces all four of its constraints. Waaseyaa now validates the full session cookie contract at boot and rejects the config if you get any of them wrong. github.com/waaseyaa/fra... #buildinpublic

050

Russell Jones @jonesrussell.bsky.social · 18/09/2026

Our PHP file repository used parse_url() to build metadata sidecar paths. Two files with the same name in different directories collided onto one sidecar and overwrote each other's metadata. Wrote up the bug and the fix. jonesrussell.github.io/blog/media-s... #php

110

Russell Jones @jonesrussell.bsky.social · 15/09/2026

Built a stdio MCP server for Waaseyaa in PHP. The hard part wasn't the RPC methods, it was the wire discipline: one writer to stdout, a bounded read with no natural limit, and a handshake that tells old and new protocol clients apart. jonesrussell.github.io/blog/stdio-m...

100

Russell Jones @jonesrussell.bsky.social · 13/09/2026

Prototyped northway's feed reader in the browser first. A loopback-only Node proxy keeps the API key out of client-side JavaScript, checks its own bind host, and validates every request before it spends a call. jonesrussell.github.io/blog/feed-re...

010

Russell Jones @jonesrussell.bsky.social · 12/09/2026

Our cache:clear command could not run in production at all, and once fixed it cleared a hardcoded bin list that did not match the real config. Wrote up the fix. jonesrussell.github.io/blog/cache-c...

010

Russell Jones @jonesrussell.bsky.social · 12/09/2026

Most self-hosted AI tools assume a server rack. northway starts from the other direction: SQLite as the only database dependency, designed to deploy on a Raspberry Pi. github.com/jonesrussell... #buildinpublic #golang

051

Russell Jones @jonesrussell.bsky.social · 11/09/2026

Found a bug in our PHP queue worker: messages with no matching handler were silently acknowledged and dropped instead of failing. Fixed it to throw, retry, and dead-letter like every other failure. jonesrussell.github.io/blog/unhandl...

110

Russell Jones @jonesrussell.bsky.social · 09/09/2026

Found a bug where an access-check method in our PHP framework ran schema DDL on every delete check, not just at boot. Moved that DDL exclusively into coordinated schema sync instead. jonesrussell.github.io/blog/taxonom...

010

Russell Jones @jonesrussell.bsky.social · 08/09/2026

Found a bug where a throwing audit logger could crash a request after the real outcome was already decided, sometimes even erasing the audit record itself. Wrote up the fix: catch and swallow the logger's own failures. jonesrussell.github.io/blog/audit-l...

110

Russell Jones @jonesrussell.bsky.social · 07/09/2026

Our CI gate scanners walked the filesystem and subtracted a denylist to find repo files. A nested git worktree slipped through and produced 24,780 phantom findings. Fixed it by asking git instead of guessing. jonesrussell.github.io/blog/git-nat...

010

Russell Jones @jonesrussell.bsky.social · 06/09/2026

Found a nasty bug in our PHP HTTP client. Hitting the byte ceiling on a response returned a truncated body as HTTP 200 instead of failing. Fixed it to fail closed and check the actual body length. jonesrussell.github.io/blog/streamh...

010

Russell Jones @jonesrussell.bsky.social · 05/09/2026

A stray PHPStan cache in a nested git worktree got scanned as production code, breaking a pre-push gate that was supposed to keep local and CI checks in sync. jonesrussell.github.io/blog/nested-...

000

Russell Jones @jonesrussell.bsky.social · 05/09/2026

A contact form is only as useful as its delivery guarantee. GoFormX now ships a signed webhook outbox: submissions are written durably, dispatched over HMAC-verified HTTP, and retried automatically if your endpoint is down. github.com/goformx/gofo... #buildinpublic #golang

020

Russell Jones @jonesrussell.bsky.social · 04/09/2026

Mounting a volume right on the directory you chmod'd in the image throws that permission away. northway fixes it by baking a private child directory into the image and mounting the volume one level up instead. jonesrussell.github.io/blog/docker-... #docker

000

Russell Jones @jonesrussell.bsky.social · 04/09/2026

Anokii now refuses to boot in production if AUTH_TOKEN_SECRET looks like a placeholder. The check runs at startup before the first request, so you find out immediately instead of running with a compromised default. github.com/waaseyaa/ano... #buildinpublic #php

140

Russell Jones @jonesrussell.bsky.social · 03/09/2026

One Dockerfile was building the API image with two maintenance CLIs bundled in. Split it into a shared base plus api and maintenance targets, then wrote a script that verifies each image only has what it should. jonesrussell.github.io/blog/docker-...

010

Russell Jones @jonesrussell.bsky.social · 02/09/2026

A missing npm ci let schema validation crash on every mined candidate, so our content pipeline filed zero issues for a week and nothing complained. Fixed with a loud fail-open guard, then the real CI fix. #ci #automation jonesrussell.github.io/blog/content...

100

Russell Jones @jonesrussell.bsky.social · 01/09/2026

Wired a manual @claude review into GitHub Actions. Default tag mode is implementation capable, so I locked it read only, bounded the diff, denied git metadata reads, and added stale-review detection. jonesrussell.github.io/blog/hardeni...

010

Russell Jones @jonesrussell.bsky.social · 31/08/2026

A retried AI query should never bill you twice. northway's SQLite store reserves a budget hold before calling a provider and only settles it once the real cost is known, keyed by an idempotency hash. jonesrussell.github.io/blog/idempot... #golang

000

Russell Jones @jonesrussell.bsky.social · 30/08/2026

How goformx freezes its OpenAPI contract: a CI gate that fails on stale generated types, then a packaging script that hashes committed bytes and writes a checksummed, content-addressed release. jonesrussell.github.io/blog/publish... #buildinpublic

130

Russell Jones @jonesrussell.bsky.social · 29/08/2026

waaseyaa/foundation was instantiating Waaseyaa\SSR\RenderCache in HttpKernel without declaring the dependency. Layer 0 importing layer 6. Fixed in three commits: wrong attempt, revert, then interfaces and a LayerDependencyTest. github.com/waaseyaa/fra... #buildinpublic

120

Russell Jones @jonesrussell.bsky.social · 28/08/2026

WaaseyaaRouter was silently overwriting duplicate route names. It now rejects them at boot. The same commit added DefinesEntityType, a PHP attribute that wires entity types into the package manifest for auto-registration. github.com/waaseyaa/fra... #buildinpublic

030

Russell Jones @jonesrussell.bsky.social · 22/08/2026

Knowing what your app does is table stakes. Knowing what context your agents are seeing is harder. Waaseyaa now exposes Prometheus metrics and HTTP routes for agent context via the telescope package. github.com/waaseyaa/fra... #buildinpublic #phpdev

010

Russell Jones @jonesrussell.bsky.social · 21/08/2026

This blog publishes with nobody reviewing drafts. Three failure modes so far: API credit ran dry, a token was silently revoked for 4 days, and slop had no gate until a deterministic linter got added. jonesrussell.github.io/blog/content... #buildinpublic

060

Russell Jones @jonesrussell.bsky.social · 21/08/2026

One AI-assisted day: 14 PRs merged, a 358-site SQLite audit, and a pile of latent defects caught on the adversarial second pass. Roughly two months of senior engineering in one window. The receipts: jonesrussell.github.io/blog/ai-assi... #buildinpublic

020

Russell Jones @jonesrussell.bsky.social · 21/08/2026

Generic CMSes model genealogy as just another content type. The waaseyaa/genealogy package goes further: GenealogyPerson, GenealogyTree, pedigree services, and living-person semantics built in. github.com/waaseyaa/fra... #buildinpublic #phpdev

030

Russell Jones @jonesrussell.bsky.social · 21/08/2026

Anokii split duplicate identity code out of its monorepo into composable core, identity, and operator packages, published by a governed CI split gated on tests and an exact commit SHA. jonesrussell.github.io/blog/anokii-... #php #architecture

000

Russell Jones @jonesrussell.bsky.social · 17/08/2026

The first commit that ships a package is not the commit that finishes it. waaseyaa/northcloud launched with NorthCloudClient, NcSyncService, and a mapper interface. Then 14 follow-up fixes landed. github.com/waaseyaa/fra... #buildinpublic

040

Russell Jones @jonesrussell.bsky.social · 17/08/2026

This blog now writes some of its own posts. A GitHub Actions pipeline mines project activity, curates it with Claude, verifies any code against the real source repo, and publishes with zero human review. How it works: jonesrussell.github.io/blog/content...

100

Russell Jones @jonesrussell.bsky.social · 15/08/2026

The waaseyaa/groups package ships Group and GroupType, but zero pre-registered bundles. Your app declares what group bundles exist and what fields they carry. github.com/waaseyaa/fra... #buildinpublic

130

Russell Jones @jonesrussell.bsky.social · 08/08/2026

Waaseyaa's LlmConversationRequest is a provider-agnostic DTO that serializes to both Anthropic and OpenAI chat formats. Swap the provider in your container; keep the conversation code unchanged. github.com/waaseyaa/fra... #PHP #buildinpublic

030

Russell Jones @jonesrussell.bsky.social · 07/08/2026

waaseyaa create-project was hardwired to the monorepo. Commit d20bff2 removes the path-repo assumption from skeleton/composer.json and adds a CI smoke test so it stays fixed. github.com/waaseyaa/fra... #PHP #buildinpublic

120

Russell Jones @jonesrussell.bsky.social · 02/08/2026

Sagamok, the Nairn Road, and radioactive tailings. Three things that should not be a footnote. I looked at how they connect and what the record says. Watch: youtube.com/shorts/_lUcP... #Sagamok

000

Russell Jones @jonesrussell.bsky.social · 02/08/2026

A director is not just a name on paper. It is a legal role with real duties: oversight, fiduciary responsibility, accountability. That applies to everyone sitting on Sagamok's corporate boards. youtu.be/t1hOQMNkP5s #Sagamok

000

Russell Jones @jonesrussell.bsky.social · 31/07/2026

Who is Sagamok preparing to lead? A community's future depends on whether it is developing new leaders or closing the door on them. Worth asking out loud. youtube.com/shorts/69LLF... #Sagamok

000

Russell Jones @jonesrussell.bsky.social · 31/07/2026

A board appointment, but no record of how it was made. That is the gap in Andrea Hajt-Jacobs's board seat in the Sagamok record. Appointments should be documented. This one isn't. youtube.com/shorts/njZ0f... #Sagamok

000

Russell Jones @jonesrussell.bsky.social · 31/07/2026

Four council meetings, no posted minutes. That is what the record shows for Sagamok. When minutes are not published, members have no account of what was decided on their behalf. youtube.com/shorts/XzAP0... #Sagamok

100

Russell Jones @jonesrussell.bsky.social · 30/07/2026

Three names that keep showing up together in the record: South Market, Serpent River, and GR Truss. I traced how they connect. Watch: youtu.be/uTA5VIn0lQ4 #Sagamok

000

Russell Jones @jonesrussell.bsky.social · 30/07/2026

Behind Caddy, request->isSecure() returned false and your XSRF-TOKEN cookie had no Secure flag. HttpKernel now registers trusted proxies from config before any code reads the request. github.com/waaseyaa/fra... #buildinpublic

030

Russell Jones @jonesrussell.bsky.social · 30/07/2026

OCL: how three separate companies became one. I traced the consolidation through the records so you can see how the corporate structure came together. youtube.com/shorts/xNDxm... #Sagamok

010

Russell Jones @jonesrussell.bsky.social · 30/07/2026

A public role map for Sagamok Chief Angus Toulouse: the positions and roles he holds, drawn from public records, in one picture. See how it all connects. youtube.com/shorts/txMsU... #Sagamok

000

Russell Jones @jonesrussell.bsky.social · 30/07/2026

Sagamok council pay: one pay number covering nine different company roles. When compensation is reported as a single figure across that many roles, members cannot see how it actually breaks down. youtube.com/shorts/Z5nuX... #Sagamok

000

Russell Jones @jonesrussell.bsky.social · 30/07/2026

Who controls Legend Mining? And what do the public records leave out? I looked into the ownership and the gaps in the paper trail. Watch: youtube.com/shorts/XUDv0... #Mining

000

Russell Jones @jonesrussell.bsky.social · 30/07/2026

Sagamok C&C say the new trespass by-law is about fighting gangs and drugs. On my recording, the lawyers who drafted it admit it also lets them remove people protesting at the band office. No real engagement, no safeguards. Listen: youtube.com/shorts/h7x8x... #Sagamok

000