From the Backlog to the Build Log

Stopping Bot Signups: September 25 - October 1, 2026

What I Worked On

Friday morning I found that some bot had registered a little over a thousand email addresses on the GlobalCove site in a couple of days, about one every three and a half minutes. Each fake signup sent a real person a confirmation email they never asked for. So I spent Friday with DevNitro stopping bot signups, first on GlobalCove and then on every site that shares its code. That is how Intelligent Engineering should work. You fix it once in the shared framework, and every app built on it gets the fix.

Monday and Tuesday I worked on go-to-market, and DevNitro built a second GTM app (the first one came from last week's autonomous run). Tuesday night Opus 5.5 redesigned the DevNitro home page from one prompt I typed on my phone. Wednesday an agent cleared dead code out of DevNitro, and that night an autonomous run built most of a new native terminal UI for the DevNitro CLI, once I fixed what kept it from running.

What the AI Did Well

The registration work landed in the GlobalCove Technologies Framework, the shared .NET library under every DevNitro app, as four issues in one afternoon. Every public form now carries layered bot checks. While in there, I went ahead and tightened the process so that accounts that never confirm get removed, confirmation links expire sooner, and one address can only receive so many emails in a certain time frame. After testing there, where the live threat was present, I made the same changes in DevNitro and the BlankSite blueprint.

Out of the thousand plus people that were sent a link to confirm their email address, about four hundred actually did confirm. This was unexpected, but when I was chatting with the AI it said that many of the "confirmed" accounts were likely not people at all. Instead, it was email security scanners that opened every link in a message. In the original code, opening the link was enough to confirm the account. But now, the link only shows a "Confirm my email" button, and only the button click confirms. A scanner can open the link all day and nothing changes.

The home page redesign started at 6:57 Tuesday evening and finished at 7:25. When I got home and looked at it, I asked for the console animation to match DevNitro's real commands and output. It used the See Fix See skill to look at the page, change it, and look again, and it was done in ten minutes. I was so happy with the results that I had it redesign GlobalCove and HowdyChad the same way.

Keeping software running smoothly requires diligence and thoroughness. I had an agent check for any dead code or code that was duplicated across the solution. Wednesday's cleanup removed about 3,300 lines and one whole project. Before it deleted anything, the agent listed every type in the solution and checked each one against every file, instead of trusting a text search.

What Needed Correction

The redesign copy missed two things. Grok is a supported provider now, and the blueprint numbers were off. I gave it the details and it fixed both.

Wednesday night was the rough one. The previous Saturday I had changed how the agentic loop decides whether to keep going, and the agent that made the change assumed something about when a turn ends. It was fine for normal conversations, but for autonomous runs it was wrong. The first autonomous run since then looped forever on its first issue. Fortunately, I was watching it because of the recent changes, so I caught it quickly. I had DevNitro fix the exit condition and made sure stopping a run in the web UI also cancels the CLI listener. Then the deploy failed, because the cleanup had removed a project but left its copy line in the Dockerfile. One deleted line fixed that.

What Shipped

The registration protection deployed Saturday to DevNitro, HowdyChad, and GlobalCove, and the BlankSite blueprint now gives it to every new app. The new designs for all three sites went live Wednesday, and DevNitro deployed again Wednesday night with the autonomous run fixes and the dead code gone.

The native terminal UI has not shipped. Once the run got going, it finished 15 tasks in about an hour and forty-five minutes: raw terminal input for Windows, macOS, and Linux, a frame renderer that only redraws what changed, streaming output, tool cards, logs, and a benchmark test. It runs behind a --ui native flag. Terminal.Gui and SharpConsoleUI stay until I try it and sign off. It's on my list to test it out next week and decide if it should replace the old terminal UIs.

The Numbers

Go-to-market took the most time again. DevNitro product, test, and deploy time came to 15h 54m, up from 9h 53m last week, and security was the biggest product line because of the bot.

Where This Fits in Intelligent Engineering

The native UI plan had one step no agent should take: me using the new UI and deciding it is good enough to replace the old ones. When DevNitro turned the plan into issues, it moved that step out of the epic into its own issue. The benchmark and docs block it, and it blocks the step that deletes the old code. The autonomous run could finish every task it was given, and nothing gets deleted until a person signs off. Work runs from the backlog, and the human decision lives in the order of the issues instead of in my memory.

On a side note, DevNitro, Inc. turned one year old this week.