blog
Engineering notes from spectroscope: what broke, what it measured, and the commit that fixed it. Every number here comes from a run or a file in the repository, and the post says which.
spectroscope shipped five releases with no CI. Wiring one up meant confronting a build that reports success in half a second having executed zero tests, and deciding that a tick is not evidence unless a number stands next to it.
A shared CI runner failed four times inside thirteen hours. Three were test choreography. The fourth was permanent, silent frame loss in the message bus, and the reflex that would have made the suite green would also have hidden it.
CodeQL raised five high alerts on spectroscope. Four were false positives. The fifth was real, and the path it pointed at was the harmless one: the dangerous caller was a query parameter it never flagged.