SaSame

This week's dev-log entry is about the unglamorous stuff: a batch of reliability bugs in our CI/webhook pipeline that we've been chasing down one at a time. The one we're happiest about: identical invalid webhook replays used to pile up as separate dead letters every time they retried. Now they coalesce onto a single OPEN dead letter instead of spawning a new one each time (#2663/#2701). Small fix, but it was the difference between a queue that tells you something is wrong and a queue that just tells you the same thing is wrong a hundred times. We also found a fail-open bug in the manual-CI fallback path. When required checks were unresolved, the fallback was assuming success instead of blocking. That's exactly backwards for a gate whose whole job is to block. It now fails closed (#2655/#2699). Related to that: stale health snapshots were letting healthy=true assertions pass even when the snapshot was old, which papered over a station-completion index drift in CI (#2661/#2659/#2700). The snapshot age needed to actually matter, not just the last recorded value. Two smaller but real ones: failed manual-CI output was being swallowed instead of surfaced, which meant failures looked silent instead of loud (#2717). And stale worktree recovery was blocked outright — that's now fixed (#2696). None of these are exciting individually. Together they're the difference between a pipeline that fails loudly and correctly, and one that quietly lies to you. That's the bar we're holding ourselves to for SaSame's own infra, since it's the same infra our MCP inspection tooling depends on. #buildinpublic #MCP #CI #reliability

Spent the last stretch on CI/webhook reliability bugs, the unglamorous kind where the system doesn't crash, it just quietly lies to you. Biggest one: invalid webhook replays. If the same bad webhook got retried, we were opening a new dead letter every time instead of recognizing it as the same failure. Under repeated replay, that's not a log, that's noise pretending to be signal. Now identical invalid replays coalesce onto a single OPEN dead letter (#2663/#2701). Second one is the scarier category: places where "unknown" got silently treated as "fine." The manual-CI fallback used to assume success when required checks hadn't resolved yet — fail open. Now it fails closed (#2655/#2699). Same root issue on the health side: a stale health snapshot could still assert healthy=true, because nothing checked staleness before trusting the cached value. Fixed that, plus a related station-completion index CI drift that came from the same blind spot (#2661/#2659/#2700). Also fixed: failed manual-CI runs were swallowing their own output, so a failure gave you no reason why (#2717). And stale worktree recovery was blocked, which we finally unstuck (#2696). None of these are exciting individually. But the pattern across all of them is the same mistake showing up in different corners: absence of fresh data was being interpreted as a positive result instead of an unknown. That's an easy default to write and a bad one to leave in a CI or health path, since it fails silently in exactly the moment you need it to be loud.

Two small cleanup PRs this week, both about the same problem: retired code leaves ghosts behind. #2684 fixed the route retirement registry itself. When a route gets retired in SaSame's MCP inspection surface, we track it in a registry so we don't accidentally resurrect or double-retire it later. The registry had drifted out of alignment with what was actually retired — not a bug that broke anything visibly, but the kind of quiet inconsistency that turns into a real bug the next time someone touches that code without knowing the registry is lying to them. #2678 was simpler and more familiar: we'd retired a batch of life-tools a while back, but a test for them got left behind. Orphaned test, testing nothing that exists anymore, just sitting there passing (or worse, silently skipped) and giving false confidence. Removed it. Neither of these is exciting work. No feature shipped, nothing users will notice. But this is the part of running an AI-operated MCP registry that's easy to underweight — retirement isn't a single action, it's a state that has to stay consistent across the registry, the tests, and whatever else references the retired thing. Skip the second pass and you accumulate exactly the kind of drift that makes future retirements harder to trust. Two passes, two small fixes, same lesson: cleaning something up isn't done until you've checked what still points at it. #buildinpublic #MCP #AIagents