From the Backlog to the Build Log

Meet Ned, From My AI Video Studio: October 16 - October 22, 2026

What I Worked On

I have a habit of doing what I love, which is solving engineering problems. DevNitro already meets all my needs, and I could keep polishing it and making it better for a long time, but I'm spending my time getting the word out and resisting the urge to keep tweaking. DevNitro work isn't stopping. It's moving at the same launch phase pace as the last couple of months, and this week I mostly used DevNitro to build my AI video studio.

What I build next in DevNitro depends on what the people using it say is missing or would make them more productive. In the meantime, the studio is a good test of Intelligent Engineering, because a repo full of Blender scenes, shaders, and video jobs needs the same backlog, issues, and checks as a .NET business app.

The studio has pieces for generative AI, motion graphics, text to speech, Blender, and Unity. Each engine has its own folder and its own AGENTS.md, and a C# .NET 10 core ties them together with shared contracts. Not everything is practical to run on my machine, but the studio lets me be creative. I think of something, kick it off, and see what comes back.

I saw an animated music video where one character stayed on screen the whole time, and I thought DevNitro should have a mascot. So I had DevNitro build one in the studio that would look good in Blender, three.js, and Unity, since I might want him in future videos. Then I wondered whether he could greet you in ASCII or colored blocks when the DevNitro CLI starts. I named him Ned.

What the AI Did Well

Ned started Sunday night as flame tests in Remotion, the React framework the studio uses for motion graphics, plus look tests in Blender. Monday morning the agent built a face test with eight styles. It wrote the face controls, expressions, and colors to one file, so Blender and Unity can drive the same face from the same numbers.

Monday afternoon it built Ned as a real model in Blender and exported him as a glb, so one set of poses and shape keys drives every renderer, and a comparison sheet put the Blender, three.js, and Unity renders side by side. Unity Hub told me its built-in render pipeline is deprecated, so that night the agent moved the Unity side to URP (the Universal Render Pipeline) and ported Ned's fire shaders to it.

By Wednesday morning the agent had a C# .NET 10 console prototype, with no packages, that flies Ned around the terminal while an app loads. His fire runs on the CPU with the same math three.js and Unity use.

Then I asked DevNitro, working in its own repo, whether a startup animation was even a good idea, because the prototype put real load on my machine. Before it changed anything, the agent measured it. At full screen, each frame spread across every core and kept about 15 of my 24 threads busy. It proposed baking the frames instead of drawing them live, so I had it build NedBaker, a dev tool that runs Ned's fire and face once to bake the intro, and again whenever the animation changes.

The studio's own tools grew too. A new Shorts editor crops a finished video into a 9:16 Short and can stack a face cam over a screen. A core mute command silences only the curse words in someone else's clip, for reaction segments. And a Blender adapter renders any job's .blend file through the same pipeline as the other engines.

What Needed Correction

In the studio, one pass of the word transcriber over a 2 minute 23 second file skipped 34 seconds of speech. The agent changed it to transcribe in 30 to 50 second windows, cut at the quietest point.

Ned's blink showed a crescent of eyeball, so the agent carried both eyelids past the edge of the eye. When I asked for his eyes to stay flat in every look, it also added a check that fails if three.js loads one of them lit.

On the DevNitro side, Visual Studio solution builds froze whenever the Docker engine hung, because the container tools run docker version on every build. DevNitro's builds now skip those steps unless I'm launching a container.

What Shipped

A few DevNitro changes still landed, and most came from using it. DevNitro now has one slash command engine for the CLI, the Blazor web app, and Visual Studio, plus /project, /model, /effort, and /provider. /provider switches AI providers between turns and keeps the conversation.

Wednesday I also updated the GlobalCove and .NET packages across GCT, BlankSite, Lobast, and DevNitro. GCT now pins a patched System.Security.Cryptography.Pkcs, and DevNitro dropped its last exception to the NuGet audit, so any advisory fails the build.

Then I deployed DevNitro, Ned included. When you start the CLI, he flies up to his resting grin at the top of the chat. --no-banner skips him for one chat, and cli.showBanner turns him off for good.

Patching PHP2Shell on My VPS

Wednesday the PHP team shipped fixes for PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on a PHP web server with one request and no login. Wiz researchers said the flaws had been in PHP for decades, and frontier AI models are what made exploiting them practical. My four link shortener sites run on PHP on a small VPS, so I pasted the advisory into DevNitro.

The agent read my provisioning scripts to learn the setup. PHP came from the distribution's own packages, so the distribution's backported fix applied. It also warned me that PHP's version number doesn't change with a backport, so I had to check the package version instead. DevNitro had no access to the server. I ran each command myself and pasted the output back.

The order mattered. Patch first, then check for signs of a break-in, and only then reboot, because a reboot kills any process an attacker left running, and that process is the clue you want to find. The check came back clean.

Then the agent wrote an upgrade script for the link shortener software, with backups, a yes or no prompt before anything goes live, and rollback commands. Its own testing caught a bug in that script before I ran it, and all four sites upgraded cleanly.

Thursday I turned the week's security news into a song. Besides PHP2Shell, researchers found that eMudhra, a certificate authority in India, had issued eight intermediate TLS certificates with private keys so weak anyone could crack them in milliseconds. One of those keys was literally the number 4. I made the lyric video in the AI Video Studio, and since it's a technical one, here it is: The Key Was Four.

The Numbers

DevNitro product, test, and deploy time came to 11h 58m, down from 15h 21m last week, and its 2h 53m of security time covered the server, the package pins, and a pass over my apps. Go-to-market work took 13h 2m, most of it a prospecting search in the GTM app an autonomous run built in September, and content took 26h 17m, mostly YouTube editing, rendering, and publishing.

Where This Fits in Intelligent Engineering

Monday I told the agent I wanted anything future agents need kept in the project itself. So Ned's folder carries a style sheet that says where he is made, an AGENTS.md that maps the job, and a list of what the agent found the hard way. The next session starts from those files, whichever model runs it, instead of from my memory. DevNitro works the same way in a .NET app: teach the AI once, in the repo, and every session after starts from it.

This week Ned went from a flame test in Remotion to the DevNitro CLI, and the AI video studio got a Shorts editor, a mute command, and a Blender adapter. If you want to see DevNitro in action, grab a spot on my calendar and I'll give you the tour. If you want to see how your team can be more efficient using AI (even using your existing tools), I can help with that as well. Back at it next week.