LifeLog — Samuel Medeiros (EN)

The CI that came green out of indulgence

Tue, 15 Sep 2026 19:00:00 GMT

For months I looked at the pipeline's green dot as if it were proof. The moment I removed the two lines that swallowed the test suite's exit code, the first honest run in the repo's history returned 8 failures out of 417 tests. The fix wasn't to hide them again: it was to give the debt an address, an owner, and an expiry date.

The 350 links pointing to nowhere — the day hreflang became noise

Tue, 15 Sep 2026 15:00:00 GMT

hreflang is the tag that tells Google every page also exists in another language — but it only counts if both sides point back at each other. Here, 350 of those links pointed at addresses that never existed. This post explains what the tag is, how it's supposed to work, and where our assumption broke.

The dashboard that measured everything except itself

Mon, 14 Sep 2026 19:00:00 GMT

I built an ecosystem status aggregator and, eighteen minutes after it was born, it couldn't prove its own existence. The fix wasn't code: it was deciding what counts as evidence. A timeout isn't an outage, 429 means alive, a 401 on a gate means the door is shut to people who shouldn't be there, and an open port doesn't mean a running process.

Two gigabytes that weren't two gigabytes

Mon, 14 Sep 2026 15:00:00 GMT

I lost 810 training steps because a 2 GB checkpoint was copied straight onto its final name and the machine rebooted mid-copy. I fixed the write on the primary volume. Two days later the same bug was living in the second-drive mirror — and it had gotten worse: the truncated file passed the resume check.

The column that never existed — when the test agrees with the bug

Mon, 14 Sep 2026 11:00:00 GMT

A scraping bridge asked the database for a column it never had. Nine days of runs, exit code zero, nothing collected. The uncomfortable part: the test suite passed because the fixture carried the exact same mistake as the query. Fixing the bug was the easy half — the lesson was about what a green test actually proves.

Approved without looking — when the checker can't check

Sun, 13 Sep 2026 19:00:00 GMT

The visual auditor for blog covers lost its primary model to an empty balance, returned an error, and the error handler returned 'approved'. For a few hours dozens of covers shipped with zero checking while the pipeline reported success. The same defect resurfaced twice more in the same pipeline, in different bodies.

The WebSocket that shook hands twice

Sun, 13 Sep 2026 15:00:00 GMT

A week after fixing the Dogwalk endpoints that refused to connect, I learned a repeated handshake is worse than none: the second accept() killed the connection right after it opened. And the first fix still let a dead socket into the room.

Arachne — 79 restarts against an invisible port: when the table lies and bind() does not

Sun, 13 Sep 2026 11:00:00 GMT

The service stopped coming up on an ordinary afternoon while the port guard swore, on every single attempt, that the port was free. 79 restarts in 24 minutes against a reservation no guest-side tool could see. The fix was to change the oracle.

Three fixes, one cause — the new page that inherited the layout and forgot the rules

Sat, 12 Sep 2026 19:00:00 GMT

The tag pages shipped with no cover art at all, mixed Portuguese with English in the same listing, and threw anyone who switched language straight back to the home page. Three bugs that looked unrelated and came from the same place: the rule lived in the home page, not in the component.

The three answers a monitor needs — why 'I don't know' must be a state, not a green

Sat, 12 Sep 2026 15:00:00 GMT

An infrastructure watchdog printed 'FIXES APPLIED' without touching a single thing. Once it finally had a word for 'I don't know', the audit revealed three ways a monitor lies: an exit code read as failure, a timeout that killed the wrong child, and an uncertainty that turned out to live entirely on one line of the map.

The one-way door — the restart that kept the service mute

Sat, 12 Sep 2026 11:00:00 GMT

Capivara's chat started answering without sources: HTTP 200, a polished sentence, zero memory. Restarting the embedding service looked like the obvious fix — and was precisely what kept it from coming back. Underneath, two defects from the same family: a process that only opens its port after waking up, and a fallback that doesn't know how to undo itself.

The tailored résumé that doesn't exist yet

Fri, 11 Sep 2026 22:10:00 GMT

My portfolio's next feature isn't live yet: an AI-powered generator that rewrites my résumé around a job description. Before it becomes a button, the hard part was already solved — and it isn't generating text. It's keeping the AI from describing experiences that never happened.

The application factory that doesn't exist yet

Fri, 11 Sep 2026 21:05:00 GMT

The Resume Tailor is back in the tree, but every tailored résumé is still handcrafted: open the site, describe the job, review, save, send. The plan has had a Phase 5 sketched since August — a semi-automated pipeline that turns a raw job posting into a ready PDF — and it still hasn't left the paper. On the difference between shipping a tool and shipping a habit.

The Ten Seconds of Silence — when the model thinks and returns nothing

Fri, 11 Sep 2026 19:00:00 GMT

An LLM call ends in 200 OK with empty content and the pipeline moves on like nothing happened. Diagnosis: reasoning models burn the token budget thinking and nothing is left for the answer. The fixes: a token ceiling with real margin, and a parser that tolerates a data: [DONE] glued to the JSON.

The fingerprint nobody taught you to read — when the network recognizes your client by its handshake

Fri, 11 Sep 2026 19:00:00 GMT

Two machines, the same code, the same key. One got 200, the other took a 403 with error code: 1010. No wrong token, no visible firewall rule: the filter looked at the TLS handshake and recognized the signature of an automated client before any request even existed. This post is about the identity layer that never shows up in application logs.

Arachne — the cache that answered the wrong question: Brasília for France

Fri, 11 Sep 2026 11:00:00 GMT

Arachne's response cache returned 'Brasília' to anyone asking about France — cosine 0.8531 against a 0.85 threshold. The story of a bug born in a CI investigation, the math that hid it, and the entity guard that fixed it without sacrificing recall.

The single commit — when the publish button stopped lying about the blog's state

Thu, 10 Sep 2026 19:00:00 GMT

Hitting the publish button used to make two commits: one flipped the frontmatter, the other regenerated the panel's index. In between, the panel listed a post that was already public. The fix was to stop chaining calls and ship everything in one commit through the Git Data API — blobs, tree, commit and ref, with a retry that re-reads the state of the world before trying again.

Eleven PRs in one afternoon — the day the bot became a teammate

Thu, 10 Sep 2026 15:00:00 GMT

Nine libraries, a test runner major bump and a GitHub action updated in a single day. What it took to merge 11 dependabot pull requests on the Portfolio without breaking the suite — and the one that almost turned into a false alarm.

Parity: the mirror that measured memory

Thu, 10 Sep 2026 11:00:00 GMT

Before swapping Arachne's search engine for Yurumi, I had to prove the new one was at least as good as the old. Shadow dual-write, real traffic, overlap@10 — and the number nobody expects: 0.511.

Three Knives of the Flaky Test

Wed, 09 Sep 2026 15:00:00 GMT

79 tests green one day, 4 failing the next, zero production changes. Arachne stacked three different flavors of flakiness in 48 hours — and each one required a different knife: random vectors, network escaping the mock, and an assert that never ran.

Every window is a door — how an invisible post leaked through its own index

Wed, 09 Sep 2026 11:00:00 GMT

The post was hidden, its route returned 404, the feed didn't mention it. It still showed up on the site: in the header of a tag page that was counting the wrong posts. The lesson is older than it looks — every new page that lists content is a new door, and frontmatter doesn't protect itself.

The error that saved the database

Wed, 09 Sep 2026 00:30:00 GMT

A test was deleting RAG tables on teardown. One run, the environment variable pointing at the isolated database was ignored by the engine — and the DELETE landed on the production arachne.db, with the live server writing to it. What saved the data was an error message.

The model that came back from the coma

Tue, 08 Sep 2026 20:40:00 GMT

A catatonic BitMamba 1B — broken tokenizer, 10^18 gradients, a midnight ENOMEM and a CUDA wedge that faked a dead GPU — closed 500 steps and the validation reproduced the eval loss to the fourth decimal. The diary of Phase 4B on a 12 GB RTX 3060.

The app that makes it to the home screen

Tue, 08 Sep 2026 15:00:00 GMT

PataPass was a website wearing an app costume — and the browser made that obvious at the worst possible moment: inside an elevator with no signal. The story of Phase 4F: an install banner driven by beforeinstallprompt, an offline page served by the service worker, and the decision to never cache HTML.

The cover that wouldn't change — immutable cache and the fix that was renaming the file

Tue, 08 Sep 2026 11:00:00 GMT

The cover was remade twice, the deployment served the new bytes — and the blog kept showing the old image. The culprit wasn't the build or the CDN: it was a header promising the file would never change for a year. The story of the hunt, the math of immutable caching, and the rule that stuck: reworking an asset requires a new URL.

The watchman doesn't know who you are — when integrity monitoring points at the administrator

Mon, 07 Sep 2026 11:00:00 GMT

On Saturday night I edited a script watched by the file integrity monitor and updated its baseline in the same block. Six hours later the alarm fired again, pointing at the exact change I had just approved. The monitor didn't fail: it did the only job it can do. What was missing was a process that knew how to tell a legitimate edit from a suspicious change.

The reviewer who can't read code — when a vision AI caught the bug everyone else missed

Sun, 06 Sep 2026 19:00:00 GMT

The Capivara light theme had washed-out text and a truncated email in the header. Static scanners stayed green, because none of them can see pixels. The one that caught it was a vision AI running screenshots of the real dashboard — and the patch was swapping hardcoded values for theme tokens and giving the layout room to breathe.

The training that woke up slow — the inheritance hidden inside a checkpoint

Sun, 06 Sep 2026 15:00:00 GMT

I resumed a run from the last checkpoint and it looked healthy — steps advancing, gradient in range, zero errors. Except the learning rate had quietly shrunk by three orders of magnitude. The cause: the LR scheduler restores more than it should when loading old state, and the fix was two lines.

The no loop — when every reader rejection became a ticket in the pipeline

Sun, 06 Sep 2026 11:00:00 GMT

The reject-post button saved feedback to a file. But a file doesn't open an issue, doesn't notify, and doesn't nag. One day the silent queue swallowed an entire request — and LifeLog learned that rejection without notification is just polite disposal. The story of /api/recusar and the loop that closes itself.

The footer that lied twice

Sat, 05 Sep 2026 19:00:00 GMT

React hydration error #418 in the portfolio footer, a mystery that only happened at night: the server renders in UTC, the visitor in local time, and a new Date() in JSX gave each of them a different answer. The hunt for the useState(null), the pinned timeZone, and the epilogue where I myself created a second bug while fixing the first.

The state that outlived reality — when a boot resurrected a world that no longer exists

Sat, 05 Sep 2026 15:00:00 GMT

After a reboot, everything came back green: process up, health check passing — and the page wouldn't open from anywhere. The service had resurrected with instructions from a past life, frozen in a state file, while the world outside had moved. This post covers the hunt, the fix at the source (stale state dies on every start, address defined in exactly one place) and the second half of the story: a network announcement that only talked to an interface with a fixed name, on the day the system renamed it.

The exception that got written twice — silencing an alarm is not defining policy

Sat, 05 Sep 2026 11:00:00 GMT

On August 11 I put a secret scanner on this blog's pipeline. The next day it flagged a build cache file as if it were a key. I silenced it with an entry pinned to that finding's exact fingerprint. Sixteen days later I had to come back to the same spot and write the exception again, this time as policy. That gap is the difference between suppressing an event and defining what should never alarm in the first place.

The F5 that logged the walker out

Fri, 04 Sep 2026 19:00:00 GMT

The status button finally worked within the session — but an F5 wiped it all: a reload brought the walker back offline for the entire system. The direct sequel to the ghost button: real persistence of the online status, from the frontend down to the profile PATCH.

Arachne — the war for port 9000: whoever holds the socket rules

Fri, 04 Sep 2026 15:00:00 GMT

The Arachne landing page loaded without CSS, the watchdog restarted the service in an invisible loop, and a zombie socat relay kept stealing the port from its rightful owner. Three chained bugs in a single diagnosis — and the lesson that a 'stopped' service can keep causing damage.

The window polisher: polishing transcripts without leaving room for hallucination

Fri, 04 Sep 2026 14:00:00 GMT

The new stage in my transcription pipeline uses Gemini TEXT over 120s windows — no audio, cheap and fast. What keeps the model from making things up isn't a polite prompt: it's a numeric ±35% character invariant per window, with retry and flag when the math doesn't close.

The metric nobody confesses: I ran my memory without a reranker

Fri, 04 Sep 2026 11:00:00 GMT

After the bilingual jump to 0.1614 recall@1, there was a number left on the bench: how much was the cross-encoder contributing on every search? The week I measured that latency and recall are a bill you pay on every query — and the answer ended up written as a permanent flag in the config.

The green padlock that couldn't see the leak — path traversal in Capivara

Thu, 03 Sep 2026 21:30:00 GMT

Gitleaks, bandit and opengrep ran weekly and everything stayed green. Even so, a single GET request returned the entire .env in production. The hole wasn't a committed secret — it was a path my own code opened. And the one who found it wasn't the scanner.

Step 322 — when training dies in silence and VRAM is left orphaned

Thu, 03 Sep 2026 15:00:00 GMT

The Phase 4 run dropped mid-flight with no traceback, no OOM, no error log: the process simply stopped existing. Chasing the cause turned into a lesson about watching the wrong metrics — and about the invisible cost of letting your GPU driver sweep up your garbage.

The queue nobody answers — when security became a Monday routine

Thu, 03 Sep 2026 11:00:00 GMT

The alarm hunts, the gate blocks, the dog attacks. But there is a fourth layer in my security setup that nobody wrote about: the dependency update queue. On August 31st, the bot delivered five fix proposals. Three days later, all five are still open. The queue became the surface.

The typewriter that erased its own text

Wed, 02 Sep 2026 19:00:00 GMT

The portfolio hero typed, erased, and retyped — not as an effect, but as a bug: deferred hydration mounted the component and reset the text already on screen. The story of how LCP dropped from 3.6s to 2.7s by removing idle-hydration from the wrong place.

The button that said it was online — and did nothing

Wed, 02 Sep 2026 15:00:00 GMT

The walker toggle 'Go Online' rendered, animated, and even changed color. But the handler was an empty function: the state never left 'online'. The story of how a test loop caught a ghost button and gave back real online status.

The day the loss stopped learning

Wed, 02 Sep 2026 11:00:00 GMT

300 training steps, a loss stuck at 10.8125, and a model that insisted on coming out blank. The cause wasn't a low learning rate — it was exploded weights in the starting checkpoint. The story of how a stalled run became a full diagnosis.

The three-headed dog — when the defense hired an authorized attacker

Tue, 01 Sep 2026 11:00:00 GMT

After the alarm and the gate, a third guardian was missing: someone who actually attacks the house, in an authorized way, once a week, and delivers an honest penetration report. The agentic red team was born for that — and the first drill proved the sentinel wakes up when someone touches what it shouldn't.

LifeLog — the blog that became a product with process

Mon, 31 Aug 2026 19:00:00 GMT

Cover gate at build time, WCAG AA contrast, the 10th project in the schema, and a bug-hunter audit with zero violations. The story of how a blog stopped being just a blog and became a quality system.

Capivara — the requests app and the double /api that returned 404

Mon, 31 Aug 2026 15:00:00 GMT

A brand-new CRUD in the personal hub, with groups, priorities and status — and a silent bug: the apiFetch helper already prepends /api, and I called /api/pedidos on top of it. /api/api/pedidos was born, and nobody saw it.

Studies — the night the cron never slept: what I learned studying jobs that won't stop

Mon, 31 Aug 2026 11:00:00 GMT

A study about cron jobs: why they accumulate, fail silently, and how a cron that 'never sleeps' can take down an ecosystem. From Yurumi's consolidation to 289 orphan jobs — the lessons from a night of investigation.

Yurumi: the memory that learned to be an agent

Sun, 30 Aug 2026 21:00:00 GMT

Yurumi started as a local replacement for mem0 — storing conversation memories. In two weeks it gained intent, actions, learning, its own identity and a knowledge graph. The journey from a simple store to a complete agentic system.

TatuEngine: the lm_head Returns — the Audit That Unlocked Phase 4

Sun, 30 Aug 2026 15:00:00 GMT

The codec post ended with a dangling issue: the lm_head diverging in validation. Two weeks later, a methodical audit rescaled the model's head, generated a clean checkpoint, and became the foundation of Phase 4 — the Resurrection.

The gate that blocks delivery — when security became a process rule

Sun, 30 Aug 2026 11:00:00 GMT

Ten days after automating active hunting, I realized the problem wasn't finding flaws — it was making sure nothing shipped without a security review. The security gate was born not as a tool but as a process rule: before any delivery, the test loop must pass. And the loop includes a dedicated security reviewer.

The button that redid posts: when feedback becomes automatic correction

Sat, 29 Aug 2026 19:00:00 GMT

A Reject button in /ocultos that writes a note, opens a GitHub Issue, saves a file to the repo, and a 15-min cron redoes the post by itself. The story of how human feedback became a pipeline.

Studies — when I studied the embeddings that think for the system

Sat, 29 Aug 2026 15:00:00 GMT

Three embedding models, two search systems, one homegrown benchmark: the study that started with a question about semantic similarity and ended up revealing the tradeoffs between colibri, bge and openai — and how each one found its place in the ecosystem.

Studies — when the second brain moved house

Sat, 29 Aug 2026 11:00:00 GMT

Capivara kept its memories in a local ChromaDB, with its own embedder and L1-L4 layers. Yurumi kept the ecosystem's memory in a Qdrant. Two separate memories meant a brain that never talked to the rest of the body. The unification on 08/28 migrated 182/182 memories without losing a single one: hash dedup, backup before deleting, and an --apply gate that separates the plan from the execution.

The sentry at the form — when the portfolio learned to defend itself

Fri, 28 Aug 2026 13:00:00 GMT

Every public site has a front door: the contact form and the resume download. Two endpoints that accept input from strangers on the internet — and I finally treated them as such. Rate limiting, HTML escaping, a contact file for people who find flaws, and a scanner that watches everything in silence.

Capivara — the dashboard that started seeing the whole ecosystem

Fri, 28 Aug 2026 12:30:00 GMT

The home dashboard used to load section by section, and I still had to assemble the big picture in my head. Enter the Executive Hub: one endpoint aggregating projects, backups, alerts and infra in a single call, with graceful failure and zero SSRF.

Arachne — from 92 violations to zero: the accessibility campaign

Thu, 27 Aug 2026 19:00:00 GMT

The axe-core report left no room for excuses: 92 contrast failures, buttons without accessible names, selects without labels, blocked zoom on the onboarding page. In two days Arachne went from 60 violation nodes to zero across 16 routes — swapping color tokens, adding aria-labels, and learning the hard way that Cloudflare immutable serves stale CSS and that code-split SPA CSS doesn't live where you expect it.

Estudos — when documentation became knowledge

Thu, 27 Aug 2026 15:00:00 GMT

Every project's AGENTS.md was the official instruction set of the ecosystem, but it lived outside the Yurumi's memory — the ingest only ran when someone remembered to run it. The fix was a signature watcher (mtime+size) that re-ingests only what changed. Along the way: a first_run that ran a full ingest every day, an os.stat that hung when WSL wedged, and the lesson of never trusting a junction.

Capivara — the layout builder that almost wiped the admin (and the double PUT that survived)

Wed, 26 Aug 2026 19:00:00 GMT

When reordering a single admin view reset all other views' configs. The story of the controlled LayoutEditor, strict section whitelists, and how one PUT became zero.

The circle that would not close — flushSync and the Portfolio View Transition

Tue, 25 Aug 2026 21:00:00 GMT

When the theme toggle animation revealed the old theme instead of the new one, the fault was not in the CSS — React had not committed the state in time.

The old server that does not exist — the honeypot as a defense layer

Tue, 25 Aug 2026 15:00:00 GMT

After mapping the port inventory, the next step was planting bait: fake services, deliberately outdated in appearance, that pose as easy targets. A watcher classifies every touch on the log, and the central dispatcher decides when a detection becomes a notification.

Studies — when one vector was not enough: the memory that learned to speak two languages

Mon, 24 Aug 2026 15:00:00 GMT

Yurumi stored its memory with a single embedding model trained in Portuguese. It worked — until the first question in English. The fix was not swapping the model; it was running two of them side by side and fusing the rankings with RRF. After a full LoCoMo run, recall went from 0.139 to 0.1614.

WCAG AA: the contrast the eye can't see — and the axe-core that saw it for me

Sun, 23 Aug 2026 15:00:00 GMT

An accessibility audit on LifeLog turned into a hunt for four contrast traps: code comments at 3.9:1, project badges failing in 4 of 6 palettes, a theme selector that Astro scoping silently broke, and the alpha that axe-core refuses to compose. The result: 14 routes x themes with zero serious/critical violations.

Studies — the week I measured my artificial memory

Sun, 23 Aug 2026 15:00:00 GMT

The simple question 'what does my agent actually remember?' turned into a full audit of Yurumi: 32 knowledge bases, 551 documents, a Qdrant collection with over 8 thousand vectors, and a LoCoMo baseline that handed back reality in percentage form.

The watchdog that discovered the covers were fake — the saga continues

Sat, 22 Aug 2026 22:00:00 GMT

The cover watchdog I built to guarantee good images on the blog found a problem I didn't expect: the AI-generated covers arrived in the wrong format. The browser rejected them, and I only found out because the watchdog itself complained.

The living inventory — when the knowledge firewall is a file

Sat, 22 Aug 2026 15:00:00 GMT

One of the most underestimated layers of security is knowing what is open. The watchdog keeps a living inventory of ports, services and bindings — mapped against what is intentional — so any new port looks abnormal in seconds.

Studies — the day I understood why ternary fits in one and a half bits

Fri, 21 Aug 2026 15:00:00 GMT

I actually read the BitNet b1.58 paper and got stuck on a math problem that refused to add up: how do three values (-1, 0, +1) fit in 1.58 bits? A study week that became a didactic clone of ternary quantization — and wrecked my mental model of 'precision equals quality'.

TatuEngine packed its bags — and the repo got lighter

Fri, 21 Aug 2026 09:30:00 GMT

A repo that accumulates build artifacts and syncs doesn't tell the clean story you want to show. TatuEngine went through versioning hygiene: build artifacts out of git, auto-sync running, and a repository ready for outsiders to look at without handing over the internal recipe.

Capivara got a new skin — theme v2 with per-project design tokens

Fri, 21 Aug 2026 09:00:00 GMT

The second brain got a brand-new theming system: a ThemeProvider with design tokens, CSP-compliant anti-flash, and per-project palettes. Along the way, the email service quietly broke because the Resend domain was wrong — and invites started arriving again.

Security left the board — findings straight into memory and the feed

Thu, 20 Aug 2026 19:00:00 GMT

The security watchdog stopped feeding a kanban nobody read and started publishing findings where they matter: into persistent memory and the right channel. Less ceremony, more active hunting, zero cards.

The navbar horror movie: when trimming left too much

Thu, 20 Aug 2026 19:00:00 GMT

Four commits in a row touching the LifeLog navbar, each one undoing the effect of the one before it. Links that disappeared, a logo that jumped away, a button that floated on its own. The lesson: refactoring in a hurry across a jumble of classes is like baking a cake while changing the recipe at every step.

Arachne learned to predict the click — video-style predictive navigation

Thu, 20 Aug 2026 15:16:00 GMT

Predictive navigation in Arachne: the agent receives a page image, predicts the whole next chain of steps, and executes end-to-end. D→C→B→A fallback cascade, real browser_agent driver, scraping link and WebSocket broadcast on the Cockpit.

The CDN cache fighting the ISR — and holding the TTFB at 3.6s

Wed, 19 Aug 2026 19:00:00 GMT

A wrong Cache-Control header in vercel.json was overriding the revalidate=1800 ISR setting and turning every cache expiry into two synchronous GitHub calls inside the TTFB. The story of how cold cache became warm: 3.6s down to 140ms.

Studies — when the field theory became a module that runs

Wed, 19 Aug 2026 15:00:00 GMT

After the wave field theory and Mamba post, the theory gained something it was missing: a didactic, portable, testable artifact. How to turn a study into code that runs — and why that changed how I learn.

The test that didn't know about hidden posts — when E2E drifted from the production filter

Tue, 18 Aug 2026 19:00:00 GMT

The LifeLog E2E suite started failing with 'Expected "" Received "estudos"' on 24 assertions. It wasn't a visual bug — it was the test helper drifting from production logic: it didn't filter hidden:true posts, and the frontmatter regex didn't match the CRLF line endings of the .mdx files. A story of how a test becomes the source of truth when it stops mirroring production.

Two hunters, one alarm — how the Security Agent learned to silence the false positive

Tue, 18 Aug 2026 15:00:00 GMT

The Security Agent cross-references findings from two hunters — the Dogwalk Bug Hunter and the Security Hunter watchdog — and outputs a single deduplicated alarm. A health gate to filter infrastructure false positives, discarded network error patterns, local-state dedup, and the no_agent contract: silence when everything is healthy.

308 skills and the reuse hub — the day I studied my own brain

Mon, 17 Aug 2026 15:15:00 GMT

A full inventory of the ecosystem's skills revealed 308 skills across 39 categories, 4 reuse gaps, and the padroes-reuso-ecossistema hub that organized everything into 7 domains. A study that turned into an audit of my own knowledge.

Arachne grew eyes — VLM, job queue and vision cache

Sun, 16 Aug 2026 19:00:00 GMT

Arachne's vision pipeline evolved: qwen2.5vl:7b on Ollama WSL, arachne-vlm-jobs queue with arachne-vlm-w1 worker, SQLite vlm_cache.db cache (sha256), polling GET /api/extract/image-jobs/{id}. Vision requires JWT, PYTHONPATH api/ and PostgreSQL not SQLite.

The active hunt — when auditing found the unlocked database

Sun, 16 Aug 2026 15:00:00 GMT

ZAP, gitleaks, bandit, opengrep running across all 7 ecosystem projects. What the active hunt found: unlocked database, excessive browser permissions, route leaking data without checks, exposed key, untreated input. And the watchdog now monitoring 24/7.

The year I studied waves — wave field theory and sequence models

Sat, 15 Aug 2026 15:00:00 GMT

From the wave field theory paper to BitMamba-2 1B: how a study on wave propagation became the TatuEngine inference engine, and why the Ollama truncation loop (num_ctx 4096 vs 262K) became the Docs First rule that runs across the entire ecosystem.

When the cover won't load — the fallback that fixed it

Fri, 14 Aug 2026 23:30:00 GMT

A post that went live with a dark cover made me build a guarantee system: image generation with a two-layer fallback and a silent watchdog that swaps bad covers by itself. The story of how the blog stopped depending on a single path.

The projects region — when the filter lost to simplicity

Fri, 14 Aug 2026 19:00:00 GMT

The portfolio's projects section almost got a category filter. It didn't — and that was the best decision. The story of a 2-column grid that resisted the lure of complexity.

The ghost of ::1 — when localhost hung and 127.0.0.1 didn't

Fri, 14 Aug 2026 15:15:00 GMT

Local services hanging intermittently: Qdrant on port 6333, helper APIs — everything pointing to 'localhost'. On Windows, 'localhost' resolves to IPv6 (::1) first — and the connection hangs. '127.0.0.1' forces IPv4 and works. Confirmed 88 times until it became a rule: always use 127.0.0.1.

The story of Security — from ai-jail to the watchdog that hunts leaks on its own

Fri, 14 Aug 2026 00:30:00 GMT

The ecosystem's security went through 3 phases: the ai-jail that sandboxed the agent (bwrap + landlock), active vulnerability hunting (ZAP, gitleaks, bandit, opengrep across every project) and the automatic watchdog that monitors what nobody looks at. 2 posts so far — and this is the full story.

The story of Studies — the blog's quietest corner (and what it hides)

Fri, 14 Aug 2026 00:00:00 GMT

Out of 78 posts, only 1 was about studies — the Ollama truncation loop. But it was in the studies that wave field theory, Mamba SSM and the BitMamba-2 1B were born. The story of what the blog's most neglected section actually produced.

The circle was finally born on mobile — the theme animation saga's ending

Thu, 13 Aug 2026 21:00:00 GMT

After 5 days making the circle start from the click on desktop, mobile still used a crossfade — by documented decision: clip-path paints per frame and janks weak GPUs. Until Samuel asked for the opposite. What made the reversal possible? The anti-stutter fixes that were already in global.css.

The push that never went through: when GitHub said no to 5.7GB (and history was rewritten)

Wed, 12 Aug 2026 19:00:00 GMT

TatuEngine had 5.7GB of AI models committed to git since day one. GitHub rejects objects above 2GB with a 422 error — that push would never succeed. The fix wasn't 'pushing through': it was an orphan branch that preserved code, tests, and docs and rewrote the repository's history from scratch.

TatuEngine: the codec that shrank a 27GB model into 245MB — and the lm_head that wouldn't cooperate

Wed, 12 Aug 2026 19:00:00 GMT

The BitMamba-2 1B's 1:1 BVH took 27.26GB — unworkable. A compact ternary block codec delivered 114× compression, with the lm_head diverging mid-validation.

Dogwalk: the backup that lied — a 786KB truncated tar hidden by 2>/dev/null

Wed, 12 Aug 2026 15:00:00 GMT

The script logged Docs backup, but the tar held only 53 of 218 files — an overnight OOM swallowed by 2>/dev/null.

From Docker to k3s — the decision to use Kubernetes for real

Tue, 11 Aug 2026 17:00:00 GMT

Arachne ran 10 services on Docker Compose. Kubernetes showed up on my resume as a desired keyword — but I didn't use it. Instead of lying, I decided to adopt k3s for real: single-node, with a phased plan, guaranteed rollback, and RAM metrics as the stopping criterion.

The 61 vulnerabilities that became 2 — the art of the surgical override

Tue, 11 Aug 2026 15:00:00 GMT

pnpm audit on the Portfólio screamed 61 vulnerabilities. Instead of updating dependency by dependency or trusting audit fix, I solved it with 5 lines of pnpm.overrides in package.json. Result: 61 → 2, with the remaining 2 having no published fix at all.

AI Jail in practice — the sandbox that learned with us

Mon, 10 Aug 2026 03:30:00 GMT

From the day we installed ai-jail (bubblewrap + Landlock + Seccomp) to it becoming routine: what changed when every command started running isolated — and the lessons real usage taught (slow Landlock, worker mode, per-command mounts).

The test that hunts runaway text — how I automated the Portfolio translation audit

Sun, 09 Aug 2026 19:00:00 GMT

After finding 28 hardcoded PT texts scattered across the Portfolio (buttons, aria-labels, modals, tracking), I created an audit test that scans components and fails CI if any Portuguese text appears outside t(). The lesson: old tests were anchored to the bug — they searched for literal PT text instead of the i18n contract.

LifeLog — why cards now show the publish date

Sun, 09 Aug 2026 19:00:00 GMT

Home cards used to show the historical event date — and the order looked messy (07, 09, 09, 06). The change: show the publish date (pubDate). The story of a detail that changes how the blog is perceived.

Capivara — the day the dashboard stopped lying (and the dead sections fell)

Sun, 09 Aug 2026 19:00:00 GMT

Stripe with dead DNS 500s, a Portifolio Staging that no longer existed, a rate limit that blocked the wrong IP. The surgical cleanup that made the Capivara dashboard tell the truth again — and the CF-Connecting-IP that actually fixed the rate limit.

The lock born in the wrong loop — and the browser pool that said 'not available in this worker'

Sun, 09 Aug 2026 15:00:00 GMT

In the early hours, Arachne woke up intermittent: the scraping workflow failed with 'browser agent not available in this worker'. The journal showed a cryptic RuntimeError: the browser pool lock was bound to an event loop that wasn't the worker's. The cause: asyncio.Lock() created at import time. The fix: lazy init — born inside the right loop.

The semantic punishment that taught the agent to behave

Sun, 09 Aug 2026 15:00:00 GMT

TatuEngine got a punishment layer v3: progressive fines for repeat offenses, partial cold restart, automatic tool denial and output reprimand. The idea: instead of only rewarding good behavior, punish bad behavior with growing intensity — like an immune system that learns from every mistake.

The dashboard that shrank 74% — and the bundle that dropped 64% without losing anything

Sat, 08 Aug 2026 19:00:00 GMT

The Capivara Dashboard had 994 lines and was impossible to maintain. Refactored to 262 (-74%), the initial bundle dropped from 668 kB to 238 kB (-64%) with React Router + lazy loading. The lesson: a giant component isn't a feature — it's disguised technical debt.

The connection pool that ran dry — and the 38 orphaned connections that made the hub render empty

Sat, 08 Aug 2026 15:00:00 GMT

Arachne responded 200, but authenticated routes rendered empty. A Bug Hunter found 1,239 QueuePool errors in the journal since 02:57. The cause: a session generator that was never closed — each request leaked an idle-in-transaction connection until the 30-connection pool exploded.

The WebSocket that never shook hands — and the 5 endpoints that went silent

Fri, 07 Aug 2026 21:00:00 GMT

All Dogwalk WebSockets returned HTTP 500 on handshake. The app ran, the database responded, but real-time login, chat and walk tracking simply wouldn't connect. The cause: a receive_text() called without the accept() Starlette requires.

The theme animation saga — when the circle just wouldn't start where I clicked

Fri, 07 Aug 2026 20:30:00 GMT

Five days trying to make a circle of light start exactly where the finger touches. The CSS looked right, CI passed, but the user saw stutter, wrong origin, and content wiping out. The root cause wasn't the code — it was the interaction between the View Transitions API, Chromium blend modes, and a ghost node_modules.

The ghost node_modules that hijacked every build — how an npm install in ~/ broke 4 projects

Thu, 06 Aug 2026 20:15:00 GMT

The LifeLog build failed with a mysterious 'Named export parseCookie not found' error. The code was right, the CI passed, but local builds broke. The cause: a 253MB node_modules in ~/ with cookie@0.7.2 hijacking module resolution for EVERY Node project on the WSL.

The police arrived at TatuEngine — security as a process, not a document

Wed, 05 Aug 2026 20:45:00 GMT

The autopoietic agent with ToolUse, an MCP server and a hybrid sandbox is the biggest attack surface in my ecosystem. On 2026-08-05 TatuEngine got what the other projects already had: SEGURANCA.md v1.0, a 24h watchdog, and a rule that changes how the project is developed.

The ghost of mobile cache — bfcache, pageshow, and the tab that refused to update

Tue, 04 Aug 2026 15:00:00 GMT

Portfolio was 100% functional, 218 tests passing, zero CI errors. But mobile Chrome users saw old versions when restoring tabs. The cause: Chrome's bfcache ignores HTTP headers — and the fix came cross-project from LifeLog.

The 4 traps of the pipeline — the day automation almost became chaos

Tue, 04 Aug 2026 00:30:00 GMT

Automating narrative posts seemed simple: a cron, a script, a preview. On the same day, the pipeline hit 4 real walls — pnpm blocked by the gateway guard, MDX breaking the build with '<', a 0-byte cover and an interrupted session. Each wall became a rule.

Operation Convergence — when TatuEngine decided to teach itself

Mon, 03 Aug 2026 23:30:00 GMT

After learning to infer (252× GPU speedup), TatuEngine went for the Master-Apprentice cycle: a Qwen2.5-3B teacher with LoRA distilling structured reasoning ([THOUGHT]/[ANSWER]) into the BitMamba-2 1B student. Six versions in one day (v0.17→v0.22.2), 381 examples, and the convergence that wouldn't come until the system message fix.

The deploy that broke on its own — pnpm, audit fix and ERR_PNPM_EEXIST

Mon, 03 Aug 2026 23:00:00 GMT

Nobody touched the code, yet Vercel kept rejecting the build: ERR_PNPM_EEXIST. The cause: a security cron ran pnpm audit fix with the Windows pnpm, regenerated a v10 lockfile while packageManager declared 9.12.3 — the saga of aligning local pnpm, packageManager and CI.

The Capivara that never falls — mirror on the backup machine and the failover that worked on its own

Mon, 03 Aug 2026 22:00:00 GMT

The personal hub was returning intermittent 502s on the tunnel. The fix: mirror Capivara to the backup machine (fallback) with one-way sync and healthcheck — and prove it with a real failover test: The primary node's cloudflared stopped for 40s, site 5/5 = 200, the backup machine took over by itself.

The story of the Discoveries — MCP, FTS5, ai-jail and the lessons that became rules

Mon, 03 Aug 2026 18:30:00 GMT

MCP became the universal connector (published on the official registry), FTS5+vector became hybrid search with RRF, ai-jail isolated the agent and Ollama brought AI home — and the lessons became rules: docs first, plan first, stop and ask.

The story of TatuEngine — from dream RT Cores to an autopoietic agent

Mon, 03 Aug 2026 17:00:00 GMT

Born from the absurd question 'what if we used RT Cores to process neural networks?', killed the dream on WSL2, and became a hybrid CPU/GPU engine with BitMamba-2 1B, radical compression, an agent with 8 subsystems and a security sandbox — 302 commits later.

The story of the Portfolio — from Mission Control to sci-fi with 529 commits and 218 tests

Sun, 02 Aug 2026 19:00:00 GMT

529 commits, 218 tests, 5 mini-games, multi-layer parallax scene, interactive terminal with 15+ commands, full PT/EN i18n — the journey of a portfolio that became an interactive showcase.

The story of Capivara — from messy hub to central dashboard with 396 tests

Sun, 02 Aug 2026 15:00:00 GMT

107 commits, 131 backend tests + 248 frontend, 2FA TOTP, local RAG with ChromaDB, R2 backup and D1 disaster recovery — the saga of turning a personal dashboard into reliable infrastructure.

The Arachne story — from iMasters scraper to Knowledge OS with 42 tools

Sat, 01 Aug 2026 19:00:00 GMT

777 commits, 2818 tests, hybrid RAG, ReAct Agent with 42 tools, MCP server, and the evolution from a simple scraper to a knowledge platform.

The Dogwalk story — from pet marketplace to CI/CD with 1456 tests

Sat, 01 Aug 2026 15:00:00 GMT

970 commits, 1456 tests, Stripe Connect, Open Design, and the saga of turning a pet marketplace into a platform that doesn't break on deploy.

The LifeLog story — how the blog that documents everything was born

Fri, 31 Jul 2026 17:00:00 GMT

158 commits, 50 bilingual posts, 4 theme engines, 59 AI covers, and a decision that changed everything: killing the bot that wrote posts on its own.

The potential of computer use in Hermes — what July's commits promise

Fri, 31 Jul 2026 01:00:00 GMT

In July, 8 commits improved Hermes' computer use: permission modes, desktop control, voice barge-in. The code exists — but on WSL, an X11 server is still needed to actually run it.

TatuEngine — the engine that never stops

Thu, 30 Jul 2026 01:00:00 GMT

298 commits, zero new features in 30 days, and an SSM inference engine that runs unsupervised. The TatuEngine doesn't need changes — it just works.

Hybrid Sandbox — how to prevent an AI from blowing up your system

Thu, 30 Jul 2026 00:00:00 GMT

When your engine runs AI-generated code, you need a sandbox that doesn't hinder development but won't let path traversal slip through.

The Quality Week — 10 fixes my portfolio deserved

Wed, 29 Jul 2026 09:00:00 GMT

Broken Pix BR Code, focus trap stealing keyboard input, scroll jumping sections — a deep audit fixed everything at once.

Portfolio — the July audit that turned into spring cleaning

Wed, 29 Jul 2026 01:00:00 GMT

July 2026 was the month my portfolio stopped getting new features and started fixing the ones it already had. A deep audit revealed 10 problems — from Pix to focus trap — and by the end, deployment was more automated than ever.

Ollama Truncation Loop — or: How 4096 Context Tokens Cost Me 2 Hours of Debugging

Tue, 28 Jul 2026 13:30:00 GMT

Hermes kept entering a continuation loop 4 times before giving up. The cause: Ollama, by default, only allocates 4096 context tokens — regardless of the model supporting 262K. The hard way: num_ctx of the model ≠ num_ctx of the inference slot.

Hardening Hermes — ai-jail, bwrap, and the Day Secrets Stopped Leaking

Tue, 28 Jul 2026 13:00:00 GMT

My Hermes agent has access to everything: API tokens, Stripe keys, database credentials. One wrong terminal() command and it all leaks. The fix: a Rust sandbox that isolates every execution with bubblewrap, Landlock, and Seccomp.

The QR Code That Didn't Pay — String.fromCharCode, Control Codepoints, and an Invisible Pix

Tue, 28 Jul 2026 13:00:00 GMT

I added Pix to my portfolio with BR Code generation. Only the QR Code didn't work in any banking app. The culprit: String.fromCharCode generating control characters instead of decimal digits in EMV 2022 length fields.

Dogwalk — 3 Bugs, 1 Commit, 1379 Tests

Sat, 25 Jul 2026 03:00:00 GMT

How a public endpoint that returned 401, a bundle that crashed, and 42 console errors became a single commit

Restoring the Theme Circle Reveal — The Choice Between Remove and Optimize

Fri, 24 Jul 2026 16:52:00 GMT

Instead of replacing the circular reveal with basic crossfade, I fixed the root cause of stutter on low-end GPUs. VT clip-path + clean fallback.

From auto-post to narrative — why I killed the daily cron

Fri, 24 Jul 2026 03:00:00 GMT

The moment I realized my devlog blog was producing reports, not stories — and how I fixed it by killing the robot that wrote posts on its own.

Animation Overhaul — Micro-interactions, Card Stagger, and Scroll Shadow

Thu, 23 Jul 2026 15:00:00 GMT

Systematized LifeLog's animations: stagger on timeline cards, scroll shadow on navbar, micro-interactions on tags/pills/search, and a single easing curve for everything.

Theme Animation Simplified — Goodbye Circular Clip-Path, Hello Crossfade

Wed, 22 Jul 2026 15:00:00 GMT

Removed the circular clip-path animation that kept stuttering and simplified to a pure crossfade for the LifeLog theme switcher.

Dogwalk — the CI/CD debugging spiral

Tue, 21 Jul 2026 15:07:00 GMT

YAML indentation, missing dependencies, tests that need a running server — the classic pipeline debugging spiral.

LifeLog — the architecture refactor day

Mon, 20 Jul 2026 15:11:27 GMT

TagCloud, shared PostLayout, Fuse.js-powered FilterBar, and theme fixes — a full day of housekeeping on the blog's foundation.

LifeLog — the daily rhythm and the AI cover system

Sun, 19 Jul 2026 15:00:00 GMT

Establishing daily posting frequency and solving the AI cover generation pipeline with Cloudflare Workers + FLUX.1 Schnell.

Capivara — The Stories the Refactoring Didn't Tell

Sat, 18 Jul 2026 03:00:00 GMT

Under the hood of an 83% frontend refactoring: Ghost Components, silent schema drift, the two-systemd war, the phantom Umami proxy, and other pains that don't fit in a changelog.

Capivara — Updates and Next Steps

Sat, 18 Jul 2026 02:00:00 GMT

Exploring the current state of Capivara — learnings, challenges and discoveries.

TatuEngine — updates and next steps

Sat, 18 Jul 2026 01:37:00 GMT

Exploring the current state of TatuEngine — lessons, challenges, and discoveries.

Dogwalk — updates and next steps

Fri, 17 Jul 2026 01:02:00 GMT

Exploring the current state of Dogwalk — lessons learned, challenges and discoveries.

Arachne — The MCP Tools Ecosystem, Multimodal Vision and What's Next

Thu, 16 Jul 2026 21:00:00 GMT

25 MCP tools, multimodal vision with local AI, observability, billing, and the sandbox that made Arachne a platform — the current state of the project in July 2026.

LifeLog is born — the blog that documents the journey

Thu, 16 Jul 2026 20:00:00 GMT

Why I created a personal blog in 2026, the Astro choice, and what to expect going forward.

The Ecosystem Today — 5 Projects, One Brain, and a Plan

Thu, 16 Jul 2026 17:00:00 GMT

From 3 projects in June to 5 in July, the Samuel ecosystem now has 2,396 commits, 3,647+ tests, and one agent orchestrating it all.

5 improved games — the day the portfolio became a showcase

Thu, 16 Jul 2026 12:00:00 GMT

Exploring the portfolio games — lessons learned, challenges and discoveries.

TatuEngine SFT — Adafactor and the 4 NaN fixes

Wed, 15 Jul 2026 20:00:00 GMT

The saga of making Student BitMamba-1B learn without exploding: Adafactor vs AdamW, saving 4 GB of VRAM, and the 4 bugs that produced NaN during bf16 training.

FTS5 + sqlite-vec — hybrid search in Arachne

Wed, 15 Jul 2026 03:00:00 GMT

Exploring hybrid search — lessons, challenges, and discoveries.

July discoveries — tools that changed my flow

Wed, 15 Jul 2026 01:00:00 GMT

Exploring July's tools — lessons, challenges, and discoveries.

BitMamba 1B — training the first SSM model

Tue, 14 Jul 2026 21:00:00 GMT

The journey (and the craters) of training a Mamba-2 with 1.4B parameters from scratch on an RTX 3060 — warmup, SFT, catastrophic eval, and Phase 4 of the resurrection.

D1 Sync — Taking Capivara Data to Cloudflare

Tue, 14 Jul 2026 03:00:00 GMT

Exploring D1 sync — learnings, challenges and discoveries.

Capivara: Personal Hub Against Financial Chaos

Tue, 14 Jul 2026 02:00:00 GMT

How Capivara solved the financial mess of multiple accounts, spreadsheets and categories — unifying everything in one dashboard.

Dogwalk matures — Playwright tests as the quality backbone

Tue, 14 Jul 2026 02:00:00 GMT

From zero tests to 853: how Playwright tests became the quality backbone of Dogwalk/PataPass, what we learned and what changed in the process.

Dogwalk: first authentication components

Tue, 14 Jul 2026 02:00:00 GMT

JWT, Supabase, OAuth, refresh token, protected routes and conditional layout — the story of authentication in Dogwalk.

TatuEngine — first experiments with wave field theory

Tue, 14 Jul 2026 01:46:00 GMT

Exploring the beginnings of TatuEngine — lessons, challenges, and discoveries.

Arachne — the Scraper That Became a Platform

Tue, 14 Jul 2026 01:00:00 GMT

The real story of how a 200-line Python scraper became a platform with 740+ files, RAG, visual pipelines and 36 ReAct tools.

Capivara Grows — Dashboard, Analytics and Control

Tue, 14 Jul 2026 01:00:00 GMT

From messy spreadsheets to a full dashboard with real-time health checks, Umami integration, and financial analytics with spending categories. The evolution of Capivara from a simple personal hub to the ecosystem's control center.

First tests with Crawl4AI — Sidecar and Docker

Mon, 13 Jul 2026 13:00:00 GMT

Experimenting with Crawl4AI in Arachne: Docker Sidecar, Python SDK, comparison with Trafilatura, and the decision to use automatic fallback between engines.

Portfolio v3 — Vue 3.5 + Vite 8, the rebuild I needed

Mon, 13 Jul 2026 09:00:00 GMT

Exploring the portfolio rebuild — lessons learned, challenges and discoveries.

E2E tests with Playwright — the quality turnaround

Mon, 13 Jul 2026 03:00:00 GMT

How end-to-end tests transformed quality and confidence in Dogwalk's development — the real story of a stack that learned to test itself.

Multi-engine pipeline in Arachne — 4 fallback layers

Mon, 13 Jul 2026 03:00:00 GMT

The architecture that actually solves web data extraction: Trafilatura, Crawl4AI SDK, Docker Sidecar, and Camoufox — how each layer works, the fallback criteria, and what I learned along the way.

Arachne Was Born from Frustration — Broken Scrapers and Lost Data

Sun, 12 Jul 2026 03:00:00 GMT

Tired of scrapers that broke out of nowhere and expensive third-party services, I decided to build my own data extraction platform.

Arachne Grows — Multi-Engine Pipeline and Smart Cache

Sun, 12 Jul 2026 03:00:00 GMT

The simple scraper became a platform. Crawl4AI Sidecar, automatic 4-layer fallback, and SQLite cache with FTS5.

The ecosystem takes shape — backups, security, and automation

Sun, 12 Jul 2026 03:00:00 GMT

With 3 projects running, the infrastructure needed to be robust. Automated backups, security hardening, and the Hermes Agent as the ecosystem's brain.

Samuel's Portfolio — the redesign that sought identity

Sun, 12 Jul 2026 03:00:00 GMT

After building tools for others, I decided to dedicate time to my own space. A portfolio that is more than a resume.

First steps — infrastructure and the first lines of code

Sun, 12 Jul 2026 03:00:00 GMT

After the idea came the hardest part: getting your hands dirty. How I chose React, Vite and FastAPI to build Dogwalk.

FastAPI + React — why I chose this stack for Dogwalk

Wed, 08 Jul 2026 03:00:00 GMT

Exploring the stack choice — lessons learned, challenges and discoveries.

First Dogwalk deploy — Vite + Cloudflare Pages

Wed, 08 Jul 2026 03:00:00 GMT

After weeks of coding, it was time to put Dogwalk online. The first deploy was a mix of euphoria and frustration — Vite + Cloudflare Pages.

Capivara is Born — I Needed a Secure Personal Hub

Thu, 28 May 2026 03:00:00 GMT

I needed a unified and secure control center for my projects, data, and access. Capivara was born as a personal hub and became the administrative brain of the ecosystem.

The beginning of Dogwalk — when I decided to create a pet marketplace

Fri, 24 Apr 2026 03:00:00 GMT

It all started with a simple need: finding trusted dog walkers for my own dog. That's how the idea for Dogwalk was born, a pet marketplace that now serves hundreds of tutors.