Writing
Notes from things that actually shipped.
Multi-tenant architecture, MCP agents running inside real products, and how to prove a refactor changed nothing. Written in English, from production, with the client names left out.
-
Six common gaps, and the audit script that hit one of its own
A .claude/ setup accumulates gaps nobody goes back to check for — a hook with no test, a permission that allows everything, a .gitignore that never learned about .env. Building the scanner for it, one of the six fixture files it needs to prove gap six disappeared into git silently, ignored by a rule the fixture itself was demonstrating.
- · agent-harness-cookbook
- · Claude Code
- · testing
- · tooling
-
The same rule, written twice: one version literally cannot block anything
Never assign Invoice.discountPercent directly — route it through TaxRuleService. Writing that rule as CLAUDE.md prose and as a PreToolUse hook, side by side, with a function structurally incapable of returning anything but "not enforced" for the text version, and a test proving only the hook stops the write.
- · agent-harness-cookbook
- · Claude Code
- · hooks
- · testing
-
"Okay, shipping it now." is a violation, and no single message proves it
A unit test checks one call; some agent failures are a function of the conversation, not of any message in it. A tenant-isolation check gets dropped two turns after the request to skip it — recorded as fixtures, with a test proving that grading the final turn alone makes the violation disappear.
- · agent-harness-cookbook
- · evals
- · testing
- · multi-turn
-
The bottleneck moved: a git log already has the two numbers that prove it
Code generation got faster; review did not. "PRs feel bigger lately" is a feeling, not a number — this reads a normalized git log and turns it into PR size and time-to-merge, with the two edge cases (an open PR, an empty merge) that make the difference between a metric and a script that crashes on real history.
- · agent-harness-cookbook
- · code review
- · metrics
- · git
-
The session is not the request: a tenant identifier that stopped updating mid-impersonation
A support console resolved the active tenant's identifier from a session value set once at login. Impersonating a second tenant in the same browser session left every downstream call pinned to the first one — a bug invisible to any test that only impersonates one tenant per test run. The fix was reading it from a request-scoped context instead, one property lookup instead of a session read.
- · multi-tenant
- · architecture
- · testing
- · PHP
-
The finding count is not a metric: a deterministic grader for a rule with no middle ground
An architectural scanner for tenant isolation returns 340 violations before a change and 341 after — a number nobody can act on. Comparing two scans by fingerprint instead of counting them turns it into a yes/no answer, and the fixture that had to exist to trust it was the negative one, not the positive one.
- · agent-harness-cookbook
- · testing
- · static analysis
- · evals
-
A rule in CLAUDE.md is a suggestion: a PreToolUse hook is not
A hook that blocks destructive shell commands before Claude Code runs them — force pushes, DDL, writes to .env — with tests split into blocks, allows, and known evasions. Plus a bug I found while verifying the README example against my own machine: the entry-point check silently failed whenever the path had a space in it.
- · agent-harness-cookbook
- · Claude Code
- · hooks
- · shell
- · testing
-
Four MCP servers became one, and the reason was a bug that shipped three times
We had one MCP server per product. They were copies of the same scaffold, so a single bad SQL guard shipped as three separate bugs. Here is what we replaced them with, and how we proved it before switching anything off.
- · MCP
- · multi-tenant
- · architecture
-
One validated query, three doors: adding a CLI without adding a bypass
tenant-scoped-rag grew a second MCP transport and a clipboard-delivery CLI for local LLMs that speak neither stdio nor HTTP. The design question was not "does it work" but "does walking through the new door skip the check the old ones enforce."
- · MCP
- · RAG
- · CLI
- · architecture
-
A cell that starts with "=" is not data: sanitizing exports against formula injection
A CSV/Excel export endpoint treated every cell as text, but a spreadsheet application does not. Four leading characters turn a cell into a formula, one shared export base class fixes it for every report at once, and the test that matters checks the byte at index zero, not the string.
- · security
- · sanitization
- · CSV
- · testing
-
The database refuses: proving tenant isolation instead of asserting it
A RAG server where the RLS policy carries the isolation, not the application query. 180 cross-tenant queries, zero leakage, and a canary test that deliberately breaks isolation to prove the suite would catch it if it ever happened for real.
- · PostgreSQL
- · RLS
- · multi-tenant
- · RAG
- · MCP