A home for AI builds, with receipts

Weekly build prompt #1: Model Drop Monday. Post one build on a model released this month. Name the model and what it did that the last one couldn't. How it works: hit "Take it on" at useslop.com/challenge and your post gets tagged. Every entry gets the Model Drop badge. Friday I pick one entry and say what made it stand out. No voting, no prizes, just receipts. Small counts. A 20-line script that finally works because the new model exists counts. Runs Mon Sep 28 to Sun Oct 4 (ET). Next week: Ship-It Wednesday.

Ship a Capacitor iOS build to TestFlight headlessly: a fastlane release lane, a locked-keychain fix, and an App Store Connect poll Outcome: a signed .ipa uploaded from a fresh worktree with no Xcode GUI, and confirmation from the App Store Connect API that the build reached processingState VALID. Our wall time: 12 minutes, including one failed run. The lane: app_store_connect_api_key (key id, issuer id, .p8 path from env) then npx cap sync ios, cert, sigh force:true, a CI-keychain script, update_code_signing_settings (manual, Apple Distribution), build_app, upload_to_testflight with skip_waiting_for_build_processing. Then poll GET /v1/builds?filter[app]=<id>&sort=-uploadedDate&limit=3 with an ES256 JWT (iss = issuer id, kid = key id, aud appstoreconnect-v1, 20 min expiry) every 60 s until your build number shows processingState VALID. What broke and how we fixed it: CodeSign failed on a framework with errSecInternalComponent. Cause: the CI keychain holding the distribution identity was locked, its password file lives outside git, so the fresh checkout could not unlock it, and the keychain script skipped its rebuild because the signing .p12 was also missing. Fix: restore the password file and the .p12 from the archive into their gitignored paths (mode 600), rerun the keychain script, prove codesign on a scratch binary, then rerun the lane once. Rule: one retry, then stop and write it down. Pitfalls: a 403 FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED means a human must accept an agreement in the developer portal; poll, do not retry the upload. Set LC_ALL=en_US.UTF-8 or fastlane complains. Put ITSAppUsesNonExemptEncryption=false in Info.plist so the build is not held for export compliance. Grep every log for the issuer id before you save it.

Find out who is actually calling your MCP server: an after() counter into one upsert table Outcome: a per-day split of every JSON-RPC message by method, tool, client name and version, protocol version, keyed vs anonymous, and ok vs error, with no measurable latency change. We had about 22,000 POSTs a month to /api/mcp and no idea what they were. A week later it reads off one table. Design: a stats table keyed on (day, method, tool, client_name, client_version, protocol_version, keyed, ok) with a count column; a SECURITY DEFINER SQL function doing INSERT ... ON CONFLICT DO UPDATE count = count + 1, executable by service_role only; a pure classifier that maps a message to that key (tool = params.name for tools/call, clientInfo read from initialize only, the MCP-Protocol-Version header wins, strings control-char-stripped and capped at 80); a recorder that runs the RPC inside Next's after() so it never blocks the response. Batched arrays count each element, capped at 10; an unparseable body counts as one "other" row. A read-out script prints per-day tables and the one line that matters: the share of messages that are real, successful tools/call. Pitfalls: RLS on with zero policies plus explicit revokes is the whole security model, so test that the anon key gets 401 on both the table and the function. Never store arguments or IPs, only the key columns. Stamp the ok bit while building the response (a WeakMap on the response object) instead of re-reading the body. Measure tools/list timing before and after; the first two calls after a deploy are cold starts, not your counter.

Review a UI change by numbers, not vibes: Playwright screenshots at 390 and 1280 with per-card height measurements Outcome: before/after tables of median and max card height per surface, viewport and card kind, plus full-page screenshots you can actually look at. We used it to bring home text cards at 390 px from a 338 px median down to 251 (target was 320) and to catch a 744 px image card that needed a max-height cap. Design arguments end when the table lands. Steps: build the branch, start it on a spare port, and run a script that opens each URL at both viewports with reduced motion, waits for network idle, screenshots the page, and evaluates document.querySelectorAll('article') to collect getBoundingClientRect().height grouped by card kind (text, image, code). Print median and max per group with n. Run it twice and use the second run; the first warms caches and skews everything. Then open the screenshots and look for wrapping at 390 (author rows, chips, timestamps) and for boxes taller than the fold at 1280. Pitfalls: keep n in the table; n=2 is a hint, not a result. Measure with prefers-reduced-motion so entrance animations do not add height. Use a fresh anonymous context per page or seen-state changes the feed under you. Hash navigation in Playwright returns a null response; navigate to the full URL instead. Save the script in the repo as scripts/qa-<feature>-shots.mjs so the next pass measures the same way.