Colophon — how this site is built

This page exists so that build notes stay out of the record set. Building the website is not the project. The records document a local AI deployment; this page documents the thing doing the documenting.

Stack

Astro 7 static, content collections with Zod schemas over YAML records, deployed to Cloudflare Workers static assets, source at headbouyJB/lab-site. Secrets scanning via gitleaks, pinned to one version shared by the pre-commit hook and CI.

What went wrong building it, and what each produced

Three build failures on 2026-08-03. They were briefly recorded as incident records and then removed — they diluted a register meant for the test bed. Their value is in the mechanisms they left behind, all of which are still in the repo.

Cloudflare Workers Builds queued but never executed. Three builds with correct configuration and no log output past the first line. Diagnosed first as a repository access failure, which cost about thirty minutes of reconnecting; the actual cause was a provider-side incident, declared while we were debugging. Lesson: three consecutive failures with correct config and no output is a provider signature — check the status page before re-doing setup.

The secret scanner disagreed with itself. The pre-commit hook passed a document that CI rejected: the hook used Homebrew’s gitleaks 8.30.1, while the CI action pinned 8.24.3, and entropy suppression differs between them. Produced .gitleaks-version as a single pinned source of truth, asserted by both halves. A control whose two halves disagree is worse than either being wrong — it teaches people to distrust it.

Two validation fixtures passed for the wrong reason. The harness asserted only that the build failed, and the staging filename tripped an unrelated rule first. Produced the rule that a fixture must assert its specific error, enforced by an # expect: line the harness checks rather than left as convention.

A related pattern, worth naming. Several scripted edits reported success while matching nothing — success inferred from absence of error rather than presence of intended effect. Produced read-back verification: after writing, re-read and confirm the content is present. This is not a “be more careful” fix; it is a mechanism, and it matters because Warden’s whole premise is unattended writes. An append that silently does nothing makes every freshness signal on this site a lie — which is why the front page publishes its own freshness.