ENGINEERING NOTES / SEPTEMBER 2026
Three bugs.
Three patches.
A scope check accepted “false.” A loader ignored its manifest. A contact form claimed success before storing the message. Here are the failing inputs, patches, and test records.
The downloads are patches against pinned repository revisions. They include regression tests; the repository links open the base projects. Reproduction instructions · Source revisions and SHA-256 hashes.
01 / RANGECHECK
The string “false” became true.
- String supplied as permission
"false"- Before the patch
- Previously accepted
- After the patch
- Rejected before scanning
RangeCheck assesses network exposure within a supplied target scope. Its parser reads the authorization and scan limits before work begins.
Repository ↗Failure
The YAML authorization field used bool(value), so the nonempty string "false" passed. Numeric conversions accepted booleans and numeric strings. A NaN timeout passed the positivity check.
Patch
The patch requires Boolean true, integers without coercion, and a finite positive timeout. Invalid scope files fail before scanning starts.
Checks
38 tests passed locally. Cases cover ambiguous authorization, invalid types, NaN, infinity, and defaults. These are parser checks; target authorization still comes from the operator’s approved scope.
02 / POLICYSCOUT
The manifest was being ignored.
- Changed saved index
manifest + chunks- Before the patch
- Manifest contents ignored
- After the patch
- Metadata and digest checked
PolicyScout retrieves passages from a supplied corpus using TF-IDF, sparse BM25, rank fusion, and diversification. Its extractive answers cite those passages.
Repository ↗Failure
The loader checked for manifest.json but ignored its contents. It could accept the wrong backend, an unsupported version, a changed chunk count, or duplicate citation IDs.
Patch
Version-4 saves include a SHA-256 digest of the chunk bytes. The loader checks that digest, version, backend, count, required fields, and unique document/chunk IDs before rebuilding from the checked bytes. Version-3 indexes retain schema and count checks.
Checks
40 tests passed in the earlier local review. The publication review checked the patch against its source revision; a missing scikit-learn dependency prevented a fresh test run. Regressions cover changed text, missing digests, malformed records, and duplicate citations. The checksum catches inconsistent files; anyone able to rewrite both files can replace it.
Read the earlier source review ↗03 / NOVAMIND
Success before storage.
- Storage unavailable
Missing KV binding- Before the patch
- Success response
- After the patch
- Error; keep the form input
NovaMind is a Cloudflare Pages demo with a business-assistant chat and a contact form.
Repository ↗Failure
The contact endpoint reported success without a storage binding. The chat endpoint returned promotional fallback text when inference was unavailable.
Patch
Both endpoints limit JSON size and validate field types. The contact endpoint reports stored after the KV write resolves. Chat reports unavailable inference as an error. Failed contact submissions keep their inputs and show the returned error.
Checks
14 tests passed locally. Cases cover delayed and failed writes, missing bindings, malformed or oversized requests, and empty model output. The receipt confirms storage. Email delivery, authentication, abuse controls, and monitoring need their own checks.
04 / READING THE PATCHES
Start with the failing input.
Follow the input into the code, read the patch, then run the regression. The downloads include the source revisions and instructions needed to do that.
CODE REVIEW & INTERNSHIPS
Ask me about a patch.
Start with an input or test case that interests you. I’m happy to walk through the code, explain a tradeoff, or discuss a role where this kind of debugging is useful.