A note about this build log entry: I published this after the week it covers. DevNitro reconstructed a draft from work-related entries in my journal, Git commit history, and time tracking. I reviewed, edited, and approved the final post. The story reflects what I knew and built at the time.
From the Backlog to the Build Log
Week of June 12 - June 18, 2026
What I Worked On
This was a big week, sixty-eight hours and 119 commits, and most of it finished what last week's security audit started. The audit began on the framework. This week I carried it through the BlankSite blueprint and into DevNitro itself. Finishing that sweep is Intelligent Engineering in practice: a governed, tracked security pass, not a one-off prompt asking whether the code looks safe.
The part I care about most is how the platform ships its own built-in resources. DevNitro provisions system resources, things like built-in skills and blueprints, into production. That path used to run through a one-off blob seeder I had thrown together, which is the kind of shortcut that turns into an incident. I replaced it with real system-level resource provisioning, added verification that provisioning happened as intended in production, and wrote export-leak guard tests to prove that exporting resources cannot carry data it should not. If the platform is going to run security audits on your code, it had better hold itself to the same standard.
While I was in there, I reworked the skill-resource system. Resource files now resolve through a database index with a local-disk source layered on top for overrides, and I deleted the old manifest-as-index code entirely. Fewer moving parts, one clear resolution path.
The other large effort was a unified AI-settings scope refactor tied to permissions and security. It is the continuation of pulling every setting, provider, model, skill, agent, and now their permissions, into one coherent scope system instead of a dozen special cases.
What the AI Did Well
A security sweep across three codebases is huge and unforgiving, and the agent carried the bulk of it against a tracked plan, with almost thirteen hours of testing to back it up. The system-level resource provisioning rework, with verification and leak-guard tests, is the sort of careful infrastructure work that is easy to describe and tedious to do by hand.
What Needed Correction
The failure this week was worktrees again. I checked on an autonomous run that looked like it had gone well, and then realized it had not merged its worktrees back. The work was done, but it was stranded in the worktrees instead of landing on the branch. That is a scary class of bug, because it looks like success right up until you go looking for the changes. I traced the merge logic and fixed it, which reinforced the rule I set the week before: an autonomous run owns its own branch and its own merges, and it has to prove the merge landed, not assume it.
What Shipped
The security sweep now covers the framework, BlankSite, and DevNitro. The platform provisions its built-in system-level resources through a verified path with export-leak guards instead of an ad-hoc seeder. Skill resources resolve through a database index with a local-disk override. AI settings, permissions, and security live in one unified scope. Image paste landed, and the autonomous worktree merge bug is fixed.
The Numbers
| Category | Hours |
|---|---|
| Product / Features | 39h 23m |
| Testing | 12h 59m |
| Docs / Skills | 9h 37m |
| Content | 3h 31m |
| Deploy / Infra | 1h 38m |
| Community | 0h 56m |
| Total | 68h 4m |
Twenty-two of those hours were security and another thirteen were tests. On a week this size, that ratio is the point: the platform did the volume, and I spent my time reviewing, steering, and hardening the parts that protect everyone.
Where This Fits in Intelligent Engineering
A security audit you can't verify is just activity. Intelligent Engineering treats verification as part of the pipeline, not a hope you tack on at the end. This week proved it twice: the agent ran a governed sweep and shipped leak-guard tests to prove the fix held, and when an autonomous run looked done but hadn't merged, the fix was to make it prove the work landed instead of assume it. The shift is from reviewing every line the AI writes to proving every outcome it ships. That is what lets a team trust, support, and scale what the AI builds.
A tool that runs security audits on your code has to hold itself to the same standard. This week it did.
Curious how this site was built?
Watch the 5-minute walkthrough on YouTube →
0 Comments
No comments yet. Be the first to share your thoughts!
Leave a comment