A home for AI builds, with receipts

We built a content machine overnight. Here's the receipt. Monday night into Tuesday morning (21:52 to 09:17 ET), 40 Claude Code lanes, up to three at a time, built Slop a content machine: a local pipeline that turns an idea, a finished clip, a blog post or a public build page into a post kit (video, captions, alt text, QA stills). What it does: - Renders video from Remotion templates, Blender loops and Kokoro voice-over, with word-level captions from whisper.cpp. - Plans a week of posts around the calendar and the weekly challenge. - Runs critics: two lanes scored 80 kits like a social lead and cut 12. What it doesn't do: - Post. It has no code path that publishes anywhere. Every kit lands as a draft, and a human watches it and approves it. This post too. - Spend. Nothing was bought; the 252 Higgsfield video credits came from an existing plan. - Guess. Every number on the receipt comes from a file: the lane log, git, the queue. What it queued overnight: 83 draft kits for Sep 29 to Oct 25. The receipt below is the run itself: model, tools, run time, commits, notes.

Prove your email verification actually verifies: generateLink + token_hash callback, a throwaway user on a plus-alias, and the provider's send log Outcome: hard evidence that a fresh signup gets no session until the emailed link is used, that the link is server-verified (token_hash, so it works cross-browser and in an iOS webview), and that the email really left your SMTP provider. We found our own signup was auto-confirming every account server-side, which meant anyone could register your address and get linked to your later OAuth sign-in. Turning that off is a one-line flag; proving it is this recipe. Steps: (1) Switch the auth email templates from the PKCE confirmation URL to a token_hash link that hits /auth/callback?token_hash=...&type=email. (2) With the admin client, create a throwaway user on a plus-alias of a mailbox you control and call generateLink(type=signup); do not send it, just take the hashed token. (3) GET the callback with it and expect a 307 to onboarding plus an auth cookie in the response; re-read the user and check email_confirmed_at is set. (4) Do a real anonymous signUp() for a second throwaway and assert the response has no session. (5) Open the SMTP provider's log and find the message by subject and recipient with status Sent. (6) POST the old autoconfirm endpoint and expect it to say disabled. (7) Delete both throwaways and count their profile rows (0). Pitfalls: keep an env-flag rollback (AUTH_AUTOCONFIRM=1) so a broken template cannot lock people out. Enumeration: the copy for "this email already exists via GitHub or Apple" must read the same as success. Provider logs show "delivery delayed" for made-up test domains, so use a real mailbox alias. Never print tokens or cookies into the report; print status codes and timestamps.

carsum: a 60-line CSV → price/mileage summary for used-car listings Zero-dependency Node script. Reads a CSV (file or stdin), parses "$12,500" / "84,000 mi", skips junk rows, groups by make + model: count, median price, median mileage, $ per 10k mi (least-squares slope, 3+ rows). Run: node carsum.mjs listings.csv Output on made-up sample data (first 6 lines): make/model count median price median miles $ per 10k mi Toyota Corolla 5 $14,500 62,000 -1,027 Honda Civic 4 $15,350 56,500 -1,145 Ford F-150 3 $22,500 98,000 -1,713 Mazda 3 2 $17,300 42,500 - Subaru Outback 1 $18,900 81,000 - Limits: no multi-line quoted fields; the slope ignores year and trim.

Weekly build prompt #1: Model Drop Monday. Post one build on a model released this month. Name the model and what it did that the last one couldn't. How it works: hit "Take it on" at useslop.com/challenge and your post gets tagged. Every entry gets the Model Drop badge. Friday I pick one entry and say what made it stand out. No voting, no prizes, just receipts. Small counts. A 20-line script that finally works because the new model exists counts. Runs Mon Sep 28 to Sun Oct 4 (ET). Next week: Ship-It Wednesday.