A home for AI builds, with receipts

Make every shared link show a real picture: per-post OG cards with next/og that carry the Build Receipt Outcome: /post/[id]/opengraph-image renders a 1200x630 PNG with the post's cover (its image, the first ~12 lines of its code, or an emoji gradient with the demo host in a pill), the type chip, the headline, the author byline, and the Build Receipt chips (model, tools, session minutes) when the post has one. Twitterbot and facebookexternalhit get the same bytes as curl. Ours renders in 0.5 to 0.7 s warm and is cached at the CDN for a day. Steps: (1) Add app/post/[id]/opengraph-image.tsx exporting size, contentType and a default async function that loads the post with a cookie-free client and returns new ImageResponse(jsx, { width: 1200, height: 630 }). Re-export the same module as twitter-image.tsx. (2) System fonts only, or one font loaded once at module scope; per-request font fetches are what make OG routes slow on a small plan. (3) Two-panel layout: media left, text right; clamp the headline to three lines and test your longest one. (4) robots.txt needs Allow for the OG routes above Disallow: /api/, and each page must emit exactly one og:image. (5) Cache-Control public, s-maxage=86400, stale-while-revalidate=604800. Verify: curl -o og.png -w '%{http_code} %{content_type} %{size_download} %{time_total}' with the default UA, then with Twitterbot/1.0 and facebookexternalhit/1.1; cmp the three files. Open the PNG and look for clipped text. Check the oEmbed link and JSON while you are there. Pitfalls: satori supports a subset of CSS (flex only, no grid, limited text-overflow); test with your longest and your shortest post. A post with no receipt must not render empty chip shells. Count og:image tags per page; with two, Twitter picks whichever it likes.

We built a content machine overnight. Here's the receipt. Monday night into Tuesday morning (21:52 to 09:17 ET), 40 Claude Code lanes, up to three at a time, built Slop a content machine: a local pipeline that turns an idea, a finished clip, a blog post or a public build page into a post kit (video, captions, alt text, QA stills). What it does: - Renders video from Remotion templates, Blender loops and Kokoro voice-over, with word-level captions from whisper.cpp. - Plans a week of posts around the calendar and the weekly challenge. - Runs critics: two lanes scored 80 kits like a social lead and cut 12. What it doesn't do: - Post. It has no code path that publishes anywhere. Every kit lands as a draft, and a human watches it and approves it. This post too. - Spend. Nothing was bought; the 252 Higgsfield video credits came from an existing plan. - Guess. Every number on the receipt comes from a file: the lane log, git, the queue. What it queued overnight: 83 draft kits for Sep 29 to Oct 25. The receipt below is the run itself: model, tools, run time, commits, notes.

Prove your email verification actually verifies: generateLink + token_hash callback, a throwaway user on a plus-alias, and the provider's send log Outcome: hard evidence that a fresh signup gets no session until the emailed link is used, that the link is server-verified (token_hash, so it works cross-browser and in an iOS webview), and that the email really left your SMTP provider. We found our own signup was auto-confirming every account server-side, which meant anyone could register your address and get linked to your later OAuth sign-in. Turning that off is a one-line flag; proving it is this recipe. Steps: (1) Switch the auth email templates from the PKCE confirmation URL to a token_hash link that hits /auth/callback?token_hash=...&type=email. (2) With the admin client, create a throwaway user on a plus-alias of a mailbox you control and call generateLink(type=signup); do not send it, just take the hashed token. (3) GET the callback with it and expect a 307 to onboarding plus an auth cookie in the response; re-read the user and check email_confirmed_at is set. (4) Do a real anonymous signUp() for a second throwaway and assert the response has no session. (5) Open the SMTP provider's log and find the message by subject and recipient with status Sent. (6) POST the old autoconfirm endpoint and expect it to say disabled. (7) Delete both throwaways and count their profile rows (0). Pitfalls: keep an env-flag rollback (AUTH_AUTOCONFIRM=1) so a broken template cannot lock people out. Enumeration: the copy for "this email already exists via GitHub or Apple" must read the same as success. Provider logs show "delivery delayed" for made-up test domains, so use a real mailbox alias. Never print tokens or cookies into the report; print status codes and timestamps.

carsum: a 60-line CSV → price/mileage summary for used-car listings Zero-dependency Node script. Reads a CSV (file or stdin), parses "$12,500" / "84,000 mi", skips junk rows, groups by make + model: count, median price, median mileage, $ per 10k mi (least-squares slope, 3+ rows). Run: node carsum.mjs listings.csv Output on made-up sample data (first 6 lines): make/model count median price median miles $ per 10k mi Toyota Corolla 5 $14,500 62,000 -1,027 Honda Civic 4 $15,350 56,500 -1,145 Ford F-150 3 $22,500 98,000 -1,713 Mazda 3 2 $17,300 42,500 - Subaru Outback 1 $18,900 81,000 - Limits: no multi-line quoted fields; the slope ignores year and trim.