Blog
Engineering notes from building a deterministic contract gate — validation write-ups, honest post-mortems, and the receipts behind every claim. RSS.
I shipped a checker that found nothing. That was the bug.
A clean report and a broken analyzer look identical from the outside. This is how I shipped one, how five public repos caught it, and the negative control I now write for anything that is allowed to stay silent.
July 16, 2026I ran my code analyzer on 9 codebases it had never seen. It found 3 real bugs — and embarrassed me first.
A maintainer of Apache Superset merged one of my fixes the same day I filed it. This is the honest story of validating a zero-false-positive claim on nine repos I'd never seen — including the part where it died on contact.