A note about this build log entry: I published this after the week it covers. DevNitro reconstructed a draft from work-related entries in my journal, Git commit history, and time tracking. I reviewed, edited, and approved the final post. The story reflects what I knew and built at the time.
From the Backlog to the Build Log
Week of June 26 - July 2, 2026
What I Worked On
This week I started a new project called Lobast, and I had DevNitro build most of it. Lobast is the credential broker DevNitro needed, so I built it as a standalone product any agent harness can integrate. The way it got built is a clean example of Intelligent Engineering: you put guardrails around the AI, then let it do work you would never have handed it before.
The problem Lobast solves is one I kept running into: sometimes an agent needs to log into a service or use an API key, but you do not want the secret sitting in the model's context where it can be logged, echoed, or leaked. Lobast is the answer. The agent asks the broker to perform a login or an action, and the broker uses the secret without ever exposing it to the agent.
I built it from a rough spike into a real broker in one intense stretch. It has a provider abstraction so credentials can come from a file, from Azure Key Vault, or from 1Password. It issues short-lived capabilities with replay protection instead of handing out raw secrets. It has an origin-binding gate that refuses to type a credential if the page's domain does not match what the credential is bound to, which is how you stop an agent from being tricked into entering your password on a lookalike site. It fills and submits login forms natively through the browser protocol, verifies the result without exposing the secret, keeps an audit log with redaction, and can require a human approval prompt before it acts. It even has credential revocation. Then I wired it into DevNitro's visual tools so the agent can detect a login and hand off to the broker.
The best part: a DevNitro autonomous run built most of Lobast. I pointed the platform at the plan and let it work.
What the AI Did Well
Watching an autonomous run stand up a security-sensitive broker, provider by provider, gate by gate, with its own tests, was the clearest proof yet of what the green-trunk gate bought me. Because the runner verifies every landing, I could let it grind on Lobast overnight and trust that what merged built and passed. That is the difference between autonomy you use and autonomy you fear.
In parallel, I hardened the autonomous runner itself. It now scores each issue's outcome from a structured completion contract and classifies it as done, failed, blocked, or no-outcome. It guards against false-green, refusing to close a leaf issue that only looks finished. It feeds no-outcome issues back through the retry loop, resolves real blocked-by dependencies instead of guessing, and there is a run monitor that shows per-issue attempts and the conversation behind each one. I also added a hallucinated-stop and prompt-injection guard to the worker prompt, because an autonomous worker reading untrusted content is a target.
What Needed Correction
Building Lobast with autonomous mode exposed a real weakness: when the green-trunk gate failed a run, it did not tell me enough about why. I was reduced to pausing the run, poking around, and resuming. So I added gate and concurrency diagnostics, real logs on the server and the listener, because a gate that blocks bad work but cannot explain itself just moves the frustration to a different place. A guardrail you cannot debug is only half a guardrail.
What Shipped
Lobast exists: a credential broker with file, Azure Key Vault, and 1Password providers, capability issuance with replay protection, an origin-binding gate, native browser fill and submit, secret-free verification, redacted audit logging, human approval, and revocation, integrated into DevNitro's visual tools. The autonomous runner scores outcomes from a structured contract, guards against false-green, retries no-outcome issues, resolves blocked dependencies, resists prompt injection, and reports through a monitor. Brave Search is the primary web backend, and there is an Integration Keys page.
The Numbers
| Category | Hours |
|---|---|
| Product / Features | 20h 15m |
| Business | 10h 45m |
| Testing | 4h 50m |
| Content | 3h 48m |
| Deploy / Infra | 1h 52m |
| Community | 1h 12m |
| Total | 42h 42m |
Almost eleven hours went to go-to-market this week, which is new for these logs and overdue. Great engineering that nobody understands is a hobby, but this is most definitely a business. And I just created another product by splintering off functionality from DevNitro.
Where This Fits in Intelligent Engineering
Vibe coding hands the model everything and hopes for the best. That works until the thing you would hand over is a password or an API key. Intelligent Engineering takes the other path. It wraps the AI in guardrails so it can log in and act without ever holding the secret. Lobast is one of those guardrails. The broker performs the login, the origin-binding gate refuses lookalike domains, every capability is short-lived, and the audit log records what happened with the secret redacted. The agent gets the result it needs and never touches the credential. That is the shift the term names. Not AI that codes a prototype, but AI an organization doesn't have to trust with private information.
The secret an agent never sees is the secret it can never leak. Lobast is that idea made real, and an autonomous run built it under a plan I approved and a gate that verified the result.
Curious how this site was built?
Watch the 5-minute walkthrough on YouTube →
0 Comments
No comments yet. Be the first to share your thoughts!
Leave a comment