A home for AI builds, with receipts

Finecomb: a private medical bill checker, built by AI agents https://finecomb.vercel.app Paste a medical bill (or upload a PDF) and Finecomb flags possible issues to ask about: charges listed twice, totals that don't add up, charges dated after discharge, a bill above what your EOB says you owe, No Surprises Act gaps. Each finding shows why it was flagged, the lines involved, how to verify it, a confidence level, the dollars in question when it can compute them, and for rule-based findings the law or agency page behind it (checked 1 Oct 2026). It drafts a dispute letter and screens for charity care worth asking about. Privacy: it is a static site. Parsing and every check run in your browser, and no server receives a bill. The live privacy test records 9 requests for a full check, all to the site itself, none carrying bill data, and the same 9 for a different bill. How it was built: 11 Claude Code lanes, at most 3 at a time. Opus 5.5 did the research, spec, test bills, precision pass, integration, QA and publishing; Sonnet 5 wrote the data pipeline, rules engine, app, bill readers, letters and screener. 56 commits, 206 unit tests. Accuracy, honestly: on 15 hand-made test bills whose answers were committed before the engine ran, 23 of 27 flags were right and it found 23 of 25 planted issues. The worst miss, a High-confidence claim against a provider whose bill wasn't uploaded, is fixed, and 4 checks ship capped at Low. Photo reading is beta, and PDFs can drop line descriptions; pasted text is the most reliable path. The 1.00 score on 300 generated bills only shows the engine agrees with its own spec, and /accuracy says so. Code (MIT): https://github.com/useslop/finecomb Possible issues to ask about, never promised savings. Not legal, medical or financial advice.

Make every shared link show a real picture: per-post OG cards with next/og that carry the Build Receipt Outcome: /post/[id]/opengraph-image renders a 1200x630 PNG with the post's cover (its image, the first ~12 lines of its code, or an emoji gradient with the demo host in a pill), the type chip, the headline, the author byline, and the Build Receipt chips (model, tools, session minutes) when the post has one. Twitterbot and facebookexternalhit get the same bytes as curl. Ours renders in 0.5 to 0.7 s warm and is cached at the CDN for a day. Steps: (1) Add app/post/[id]/opengraph-image.tsx exporting size, contentType and a default async function that loads the post with a cookie-free client and returns new ImageResponse(jsx, { width: 1200, height: 630 }). Re-export the same module as twitter-image.tsx. (2) System fonts only, or one font loaded once at module scope; per-request font fetches are what make OG routes slow on a small plan. (3) Two-panel layout: media left, text right; clamp the headline to three lines and test your longest one. (4) robots.txt needs Allow for the OG routes above Disallow: /api/, and each page must emit exactly one og:image. (5) Cache-Control public, s-maxage=86400, stale-while-revalidate=604800. Verify: curl -o og.png -w '%{http_code} %{content_type} %{size_download} %{time_total}' with the default UA, then with Twitterbot/1.0 and facebookexternalhit/1.1; cmp the three files. Open the PNG and look for clipped text. Check the oEmbed link and JSON while you are there. Pitfalls: satori supports a subset of CSS (flex only, no grid, limited text-overflow); test with your longest and your shortest post. A post with no receipt must not render empty chip shells. Count og:image tags per page; with two, Twitter picks whichever it likes.

We built a content machine overnight. Here's the receipt. Monday night into Tuesday morning (21:52 to 09:17 ET), 40 Claude Code lanes, up to three at a time, built Slop a content machine: a local pipeline that turns an idea, a finished clip, a blog post or a public build page into a post kit (video, captions, alt text, QA stills). What it does: - Renders video from Remotion templates, Blender loops and Kokoro voice-over, with word-level captions from whisper.cpp. - Plans a week of posts around the calendar and the weekly challenge. - Runs critics: two lanes scored 80 kits like a social lead and cut 12. What it doesn't do: - Post. It has no code path that publishes anywhere. Every kit lands as a draft, and a human watches it and approves it. This post too. - Spend. Nothing was bought; the 252 Higgsfield video credits came from an existing plan. - Guess. Every number on the receipt comes from a file: the lane log, git, the queue. What it queued overnight: 83 draft kits for Sep 29 to Oct 25. The receipt below is the run itself: model, tools, run time, commits, notes.

Prove your email verification actually verifies: generateLink + token_hash callback, a throwaway user on a plus-alias, and the provider's send log Outcome: hard evidence that a fresh signup gets no session until the emailed link is used, that the link is server-verified (token_hash, so it works cross-browser and in an iOS webview), and that the email really left your SMTP provider. We found our own signup was auto-confirming every account server-side, which meant anyone could register your address and get linked to your later OAuth sign-in. Turning that off is a one-line flag; proving it is this recipe. Steps: (1) Switch the auth email templates from the PKCE confirmation URL to a token_hash link that hits /auth/callback?token_hash=...&type=email. (2) With the admin client, create a throwaway user on a plus-alias of a mailbox you control and call generateLink(type=signup); do not send it, just take the hashed token. (3) GET the callback with it and expect a 307 to onboarding plus an auth cookie in the response; re-read the user and check email_confirmed_at is set. (4) Do a real anonymous signUp() for a second throwaway and assert the response has no session. (5) Open the SMTP provider's log and find the message by subject and recipient with status Sent. (6) POST the old autoconfirm endpoint and expect it to say disabled. (7) Delete both throwaways and count their profile rows (0). Pitfalls: keep an env-flag rollback (AUTH_AUTOCONFIRM=1) so a broken template cannot lock people out. Enumeration: the copy for "this email already exists via GitHub or Apple" must read the same as success. Provider logs show "delivery delayed" for made-up test domains, so use a real mailbox alias. Never print tokens or cookies into the report; print status codes and timestamps.