Build1 distinct publisher3 min readPublished
Claude writes two hundred plausible lines in about a minute and checking them properly takes fifteen, so the bugs that survive are the dull mechanical ones, and the honest fix is a script the deploy job depends on.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
The check carrying most of the weight is nine lines long. `resolves()` takes a site-absolute URL, drops everything after `#` or `?`, and treats a bare `/` as `dist/index.html` [9]. Then it does two filesystem tests: is there a file at DIST plus that path, and if not, is there an `index.html` inside a directory at that path [9]. The second fallback is why it works on a static build, where `/about` on the wire is `dist/about/index.html` on disk.
That is also the condition for any of this transferring. `existsSync` only tells the truth about your URLs if your URLs are your file paths. Put a server-side router, a rewrite rule, or a redirect map in front of `dist/` and the verifier starts reporting dead links that resolve fine in production, and missing ones that do not.
Read the extraction pattern as a scope statement. It is `/href="(\/[^"#][^"]*)"/g` [10], so a link is tested only when its first character is a slash and its second is neither a hash nor a quote; external and relative hrefs are never examined [11]. A protocol-relative href beginning `//` does clear the pattern, gets joined onto DIST, and fails as a missing file [11]. Cheap to special-case. Worth knowing before you lift the file into a repo with a CDN host in it.
The arithmetic behind the whole design: 200 lines out per minute, 200 lines back in per fifteen to twenty [1][2]. That is ten to thirteen lines a minute read properly, against a generator running fifteen to twenty times faster [3]. No amount of discipline closes a 15x gap, and the author says as much, having spent months recognising the shape of diffs and merging them [24].
The most useful number here is the one from the abandoned version. Writing the exhaustive rulebook up front produced forty rules, six of which ever fired [13] for a 15% hit rate [14], with the other thirty-four noisy enough that you stop reading the output [13]. A verifier nobody reads has a 100% pass rate. The author's framing is sharper: worse than no verifier, because now you believe you have one [15].
The IndexNow rule is the class of defect an agent cannot see. The key must match `/^[a-f0-9]{8,128}$/` and the matching file must be live at the site root or crawlers reject the submission [16]. Ask for IndexNow submission and you get a correct submission script and no key file, because the request never mentioned one, and the missing file fails silently by design [17]. `app-ads.txt` gets the same treatment, parsed field by field at build time against the IAB spec [18]. Knowledge of what silence costs has to live in the build, because it is not in the prompt.
Then the budget: performance at 90, accessibility, best practices and SEO all at 100 [19]. Performance is the only threshold with slack [20], and the reason is in the same file: shared CI runners are noisy, so the gate re-measures rather than failing on one bad sample [23]. That is the difference between a blocking performance floor and an advisory one, and it is good engineering. It also earned its keep on something no stylesheet review would surface, the grey used for code comments failing WCAG contrast, fixed in one line at commit d64bce0 [22].
169 lines is about 85% of one of those two-hundred-line diffs [25]. You read it once.
Ranked by verification strength, evidence, and original report placement.
Claude produces a plausible two-hundred-line diff in roughly a minute.
Reading two hundred lines of plausible code properly, rather than skimming for shape, takes the author fifteen or twenty minutes.
scripts/verify.mjs is 169 lines of dependency-free Node that walks the built dist/ directory and exits non-zero on anything the author has decided must never ship.
The author's attempt to write the exhaustive rulebook up front produced forty rules, six of which ever fired, with the other thirty-four generating enough noise that you stop reading the output.
A non-negotiable Lighthouse budget sits alongside the verifier: performance at least 90, accessibility 100, best practices 100, SEO 100.
The bugs that got through were mechanical: a dead internal link left by a route rename, an <img> with no alt, a canonical URL pointing at the wrong host, and two cache rules that turned out to concatenate.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · September 1, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
EventBridge Pipes as agent glue: the retries move to config, the three-step Lambda stays1 distinct publisher
build
Retry budgets are sized against outages, not jitter: 45 seconds lost all sixteen clips1 distinct publisher
build
Bundle archaeology beats "make it faster": 2.1 MB to 890 KB, one change per measurement1 distinct publisher
build
A spec-clean 402 is not a listing: x402scan bounced the tunnel, not the JSON1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Checkable code, uncheckable numbers
The mechanics are shown, not summarised: resolves() in full, the href pattern, the hex-key test, the four score thresholds, a commit hash for the contrast fix. Anyone can read those and judge them. The figures the argument actually rests on get no such treatment — one minute to generate, fifteen to twenty to review, four bugs shipped, six of forty rules that ever fired — all recalled by the author with no repository, CI log, or defect count offered alongside.
Wired in, at n=1
This is not vapour — the gate genuinely blocks deploys on every pull request, and we hear about it catching a real contrast regression. It is also one person's static site. No other repository, team, or project is reported to run the script or the budget, and there is no sign of anyone reusing the pattern, so what is deployed is exactly one instance of it.
Title overreaches, prose does not
"I don't review AI code. My build does" is retracted inside the piece itself: the verifier has no opinion on whether a function is a mess or the feature was a bad idea, and the author says that judgement is still his and now his only reviewing job. What nudges this above zero is the framing of the bugs AI diffs keep shipping — a general pattern resting on four defects from one site — and a lesson about false confidence in noisy gates asserted without a single instance of it costing anything.
Audience, not advertisers
Nobody is being sold anything: no vendor, no product, no tool under evaluation. The pull is reputational and it is visible — a personal byline republished from indiecore.net, with internal links to the author's Cloudflare Workers post and his blast-radius rule placed where the argument peaks. That shapes which rules made the write-up more than it distorts the facts, and the candour about months of merging on shape rather than reading pulls the other way.
Try it, don't cite it
The technique is concrete enough to copy this afternoon and cheap enough that being wrong about it costs little — that part we hold firmly. The generalisations are another matter: what agents predictably omit, how noise erodes trust in a gate, and whether mechanical checks are where the volume is all rest on a single unreplicated account, and our own reading of the link pattern shows the published example is narrower than the piece implies.