A note about this build log entry: I published this after the week it covers. DevNitro reconstructed a draft from work-related entries in my journal, Git commit history, and time tracking. I reviewed, edited, and approved the final post. The story reflects what I knew and built at the time.
From the Backlog to the Build Log
Week of July 3 - July 9, 2026
What I Worked On
This week Lobast turned into something I can hand to someone else. Lobast is the credential broker DevNitro needed, so I built it as a standalone product any agent harness can integrate. It went from a thing running only on my machine to a CLI with its own distribution model, version pinning, and a stack of security fixes behind it. That work is Intelligent Engineering in practice, because the AI writes the code, but the operating model around it is what makes the work something a team can support.
Most of the week went into Lobast. I introduced an IActionExecutor seam so the broker can route more than API calls through one registry, added a token-exchange executor, an API executor, and a secure CLI-run modality for brokered command execution. I generalized the old single-secret model into named, self-clearing fields so a credential can carry more than one piece (an identifier and a secret, not a lone password). I also wrote the distribution and entitlement design docs and wired a lazy-download bootstrap so the broker only downloads itself when a seat needs it.
On the DevNitro side, most of the rest of the week was security hardening. I worked through a batch of numbered security fixes: supply-chain checks on dependencies, IaC hardening in the Bicep templates, Docker workspace and tenant isolation, and the MCP transport trust boundary. I also added path traversal protection to the local workspace provider and encrypted agent secrets at rest with AES-GCM.
What the AI Did Well
The security pass was the clearest win. Working through numbered findings one at a time, the AI applied fixes for dependency risk, Bicep hardening, Docker isolation, and the MCP trust boundary without me having to relitigate the reasoning behind each one. That is a stack of fixes I would have put off for weeks doing it by hand.
It also got the CLI plumbing right. Coercing tool arguments (string-encoded edits, string or number pagination params, JSON string arrays) into the right shapes is the kind of tedious correctness work that used to eat an afternoon. It got through all of it without me stepping in.
What Needed Correction
The RenderIndicator WASM swap took most of a day to get right. The AI's first pass got the timing of the swap wrong, and I had to step through it myself before it worked.
The SignalR issue was mine to catch. I hadn't noticed that multiple listeners were spinning up two containers until connections started failing. Once I saw it, the fix was clear: I'm on CPU/memory-based scaling for replicas right now, and if I need to scale beyond one instance I'll need Azure SignalR to keep connections consistent across containers. That decision waits for later.
What Shipped
Lobast has a CLI now, with a publish script, version pinning between the CLI and the broker, and telemetry on broker-version downloads. BlankSite got CSP nonce support for its script tags, and DevNitro picked up the newest BlankSite version along with a fresh docker build. The RenderIndicator WASM swap works as of Friday night.
The Numbers
| Category | Hours |
|---|---|
| Product / Features | 25h 52m |
| Testing | 10h 20m |
| Content | 9h 58m |
| Business | 7h 59m |
| Deploy / Infra | 1h 41m |
| Community | 1h 11m |
| Total | 57h 0m |
Lobast alone took up more than a quarter of the week. Add the security fixes and the CLI plumbing, and product work was most of my time. Content and business stayed light on purpose, since the broker needed to be solid before it goes to anyone else.
Where This Fits in Intelligent Engineering
A coding agent can write a credential broker. It cannot decide how that broker ships, how it versions against the tools that depend on it, or how it gets hardened against supply-chain risk. That is the half of the job people forget when they picture AI writing software. Intelligent Engineering is the whole operating model, not the generation step: the distribution, the pinning, and the security pass that turn a clever spike into something an organization can run, support, and scale. This week was mostly that half.
The broker is ready to hand off. Error surfacing to dependent apps and SignalR scaling are next. Back at it next week.
Curious how this site was built?
Watch the 5-minute walkthrough on YouTube →
0 Comments
No comments yet. Be the first to share your thoughts!
Leave a comment