Open-source contribution record · career-ops
Two weeks of work in a public repository I do not own — 69,000 stars, 13,000 forks, five months old. Every claim below links to the thread where you can check it, including the ones where the measurement went against me.
Why the merge notes say what they say
Every change carries a number taken before and after, and a mutation that proves the new test fails when the thing it guards is broken. A test that has never been seen red is a test of nothing — so I break the feature on purpose and show the assertion going down with it.
The same rule runs backwards. Where I could not reproduce something, the comment says so in those words instead of implying I did. Twice that meant arguing against my own result.
Verbatim, from the merge notes
“Measured-not-reasoned on the actual machine it reproduces on is the gold standard — and choosing junctions over the issue's suggested guard because of what you measured is exactly the kind of divergence-with-evidence we want.”
PR #3267 · a Windows test that never ran“The thing I want to name is the sentinel, because almost nobody writes it: this check only ever reports an absence, and you noticed that a wrong ROOT produces exactly the same reading as a clean tree. A guard that can pass by looking in the wrong place is the same bug it exists to prevent, one level up.”
PR #3445 · a guard against untested tests“A delete-safety guard that dies on symlinkSync in Windows' default configuration is a guard that never guarded the platform most likely to need it.”
PR #3362 · protection against deleting a user's files“Reproducing your fix independently on Windows before reading it is the review culture this repo hopes for.”
PR #3172 · a review of someone else's work“Two of them won't appear in the changelog at all, because a test or a refactor doesn't generate a line: Artem wrote the guard that stops a test suite from sitting somewhere nothing runs it. Both are the kind of work that only shows up when it's missing.”
Release announcement, career-ops v1.31.0One machine, three bugs no runner could see
My development box is Windows 11 in a non-elevated shell with Developer Mode off — the default Windows install, and the one configuration the project's CI cannot reproduce, because GitHub's Windows runners hold a privilege ordinary machines do not.
Three separate failures lived there undetected. Each shipped green on all three CI platforms.
tests/plugin-symlink-discovery.test.mjs before EPERM at the first link, 0 of 12 checks reached after 12 of 12 pass, 0 skipped proof reverting the feature turns 8 of the 12 red tests/outcome.test.mjs — a guard against deleting a user's files before EPERM, 0 of 58 checks reached after 58 of 58 pass proof with the guard weakened, the victim file is actually deleted tests/skill-project-root.test.mjs — reported as issue #3364 cause git checks out 7 repository symlinks as pointer text effect the test reads 43 bytes of path instead of a 203-line document runner cannot reproduce: CI disables the setting that causes it
The third one I reported rather than fixed. Another contributor had claimed it an hour before the maintainer offered it to me, so I proposed a split instead — they implement, I verify on the box nobody else has. It merged as their first contribution to the project, and the verification step is now written into how that work is assigned.
18–30 August 2026 · grouped by what was wrong
| Ref | Class | What it fixed |
|---|---|---|
| #3445 | Silent gap | A test suite at the repo root that nothing ran |
| #3303 | Silent gap | 20 assertions shipped to every user, never executed |
| #3362 | Windows | Delete-safety guard that never ran on Windows |
| #3267 | Windows | Plugin discovery suite dead on a default install |
| #3225 | Matching | A prefix for keywords that begin a longer word |
| #3297 | Matching | Documented the half that prefix cannot reach |
| #2970 | Matching | “Intern” no longer swallows “Internal” |
| #2702 | Detection | Concurrent openings misreported as reposts |
| #3171 | Detection | Multi-employer job boards skipped correctly |
| #2885 | Liveness | One dead host stopped poisoning every verdict |
| #2884 | Liveness | Postings inside same-origin frames now seen |
| #2956 | Filtering | An allow-list could discard a hard block |
| #3051 | Filtering | Matched the support role, not the whole domain |
| #3011 | Isolation | Ambient git config leaking into the test suite |
| #3050 | Isolation | Moved that regression where discovery finds it |
Reviews, and the measurements that changed a decision
On #3247 the reporter had ruled out the better of two fixes on a premise that turned out to be false — the test runner already did what they believed it could not. I posted the measurement and left the pull request to them. The maintainer changed the decision; they built it and cited the measurement by name.
On #2983 someone moved a guard I had written into shared code and said the behaviour was unchanged. I compared old against new across nineteen documented edge cases — identical on all nineteen — which is what made it a same-day merge.
On #3607 a change was justified by a claim about Windows filesystem timing. I measured it: directory timestamps resolve at about a millisecond, three orders of magnitude finer than the change assumed. The fix is still reasonable; the sentence explaining it was not.
Twenty years of operations, then the code
I ran B2B businesses for two decades — manufacturing, production, cross-border commercial operations — before I wrote software for anyone but myself. That order matters to how the work above looks. An operator learns early that a report nobody checks is a report that is wrong, and that the expensive failures are the quiet ones: the alert that never fires, the guard that never guarded, the number that was true last quarter.
Every bug on this page is that shape. A suite that ran nowhere. A check that passed by looking in the wrong place. A safety guard that had never executed on the platform most likely to need it.
| Tool | What it does | Built on |
|---|---|---|
| SkuSum | Amazon profit by SKU, reconciled into a balanced journal | Local-first, browser only |
| ReadyCSV | CSV preflight and repair before a CRM import | No backend, no upload |
| Revenue Leak Roast | Deterministic teardown of an offer before ad spend | Static, no runtime |
| LeakRelay | Missed call to qualified lead summary, for restoration firms | Twilio, owner-ready output |
And a write-up of the working method itself: how I run a supervised multi-agent AI operation — shared memory with a verified / not-verified handoff contract, supervision gates, and a weekly audit. The contract in that document is the reason this page has a section for what I could not verify.
On the page, because it is on the threads
This section exists because a record that only lists wins is a record you cannot calibrate. The same discipline that produced the merges produced these.