From the Backlog to the Build Log

Week of July 24 - July 30, 2026

What I Worked On

Most of this week went into the layer under the apps. BlankSite got a PageSeo component, the GlobalCove Technologies framework (GCT) took over Content Security Policy, and the blueprint upgrade engine learned to stop reporting changes that were not changes. Then I upgraded three sites onto the new blueprint and deployed them. I make the architectural decision once, and every app on the blueprint inherits it. Blazor blueprint upgrades are the delivery mechanism for Intelligent Engineering.

I went to add a feature section to my LinkedIn profile and the links pulled the wrong page previews. The Open Graph tags were wrong. Rather than patch three sites by hand, I built a PageSeo component in BlankSite so title, description, canonical, and OG metadata come from one place. GlobalCove and HowdyChad both moved off scattered PageTitle and HeadContent blocks onto it.

The bigger call was CSP. A Content Security Policy is the header that tells a browser which scripts, styles, and sources a page may load. It is the main defense against cross-site scripting. The nonce logic lived in BlankSite, which meant every site carried its own copy. I spent Wednesday unsure whether to move it down. Thursday I moved it. GCT now owns an ICspNonceService, an explicit Csp:Mode setting, policy merging, and tests around the nonce seeding invariant. BlankSite deleted its local service.

What the AI Did Well

DevNitro did its best work this week inside the blueprint upgrade engine. Upgrades used to flag files as conflicts when the content was equivalent and only the formatting or ordering differed, so every upgrade turned into a manual diff review. DevNitro built a content equivalence engine, glob-based ignores, and additive-skip handling, plus segment-aware naming and stack inference so a generated project names things correctly. Blueprint upgrades have been in the product since April. Now an upgrade reports only the files I changed.

The GCT assertion library also grew: new overloads, fluent chaining, and an equivalency engine, with the custom dictionary assertions pulled back out once they proved redundant. Shared agent docs moved into a NuGet package with a version stamp, so a project can tell whether the architecture guidance it hands the AI is current. That is the part of Intelligent Engineering where the agent inherits how you build instead of guessing at it, and stale guidance is worse than none. Adding Opus 5 to the model catalog was a small seeding change. Image attachments in the chat pipeline had been on my mind for a while. I built it the day I went to paste a screenshot into DevNitro and could not, and it went in across the API and the Blazor front end without rework.

What Needed Correction

Email was broken and I did not know it. A security change in GCT made the Azure Function require a configuration value that DevNitro and HowdyChad never set. One site kept working because it was still running older function code, which is why nothing looked wrong from the outside. Fixing that uncovered a second problem: the infrastructure code was not setting another required value, so the function failed on startup rather than failing on send. Two layers, one root cause. No unit test would have caught either one, because the break sat in deployed configuration.

Testing turned up two Playwright problems. I fixed the poor first run when the browser binary is missing. The resource leak I only found. It is still open and sitting in the backlog.

One more is open. During model testing, GPT 5.6 kept re-reading the same skill file and re-listing directories in a loop, mostly at low effort and sometimes at medium. That is a prompting change on my end rather than a model defect. I have not tackled it yet.

What Shipped

The BlankSite blueprint is at preview-0099 with PageSeo and admin state persistence. GCT owns CSP, ships the assertion library expansion, carries the AgentDocs package, and has its supply chain security documented and audited. I reserved the GlobalCove prefix on NuGet so nobody else can publish a package under that name. It was approved in under 24 hours and closes an obvious supply chain hole. The blueprint upgrade engine handles equivalent content without false positives. GlobalCove and HowdyChad were both upgraded onto the new blueprint and deployed. A client site got the same upgrade by hand, since it is not fully on the blueprint yet. DevNitro deployed with image attachments, Opus 5, clearer API key auth errors, environment-specific database tier sizing in Bicep, and an aria-label on the billing cycle toggle.

This blog system behind HowdyChad got its update too. I reworked the publish date logic and post ordering, moved its pages onto PageSeo, and upgraded it onto the new blueprint. I hardened the build log process too. It now pulls from more sources and stops when source material is missing instead of writing around the gap. Last week I wrote about the recap tool failing on first real use. I applied the same lesson one step earlier this time.

The Numbers

Category	Hours
Product / Features	18h 27m
Content	14h 54m
Business	7h 24m
Testing	3h 33m
Community	1h 9m
Deploy / Infra	0h 24m
Total	45h 51m

The Content bucket reads as 14h 54m, but three of those hours were engineering rather than writing. I upgraded the blog system behind HowdyChad and firmed up the build log skill that produces this post. Writing and video came closer to twelve hours. BlankSite alone was 10 hours, because SEO, the CSP removal, and blueprint verification all landed there.

Where This Fits in Intelligent Engineering

CSP is a security decision. Someone who understands the tradeoffs makes it once, and every project after that starts from the answer. Until this week the policy shipped with the BlankSite blueprint, so you got it only if you generated your site from that blueprint. Now it lives in GCT, which means any app on the framework gets a correct policy by default, whether or not it came from a blueprint and whether or not the team runs DevNitro. A site can still opt out, and some need to. The difference is that opting out is now a deliberate act someone has to write down, rather than a default nobody noticed was missing. That is what inheriting architecture means, and the authentication hardening work went the same direction.

Three sites are on the new blueprint.

Curious how this site was built?
Watch the 5-minute walkthrough on YouTube →

July 31, 2026 Build Log: Blueprint Upgrades and a CSP Decision