Skip to content

Receipts

Agents say done. Here's what they missed.

Real catches from my own sessions, with project details removed.

Green but empty

The checks pass and prove nothing.

Receipt #001

Green but empty

Agent said
13 agents, 0 errors.
Actually
Three defects were still there. One was silent data loss on notes past a 256 KB limit.
Caught by
A final review, and not trusting the green

Zero errors means nothing crashed. It does not mean the work is right.

Read what happened →Use ship →

Receipt #002

Green but empty

Agent said
The access tests pass.
Actually
Part of the suite was checking zero routes, and a real leak was sitting behind it.
Caught by
Independent review

When a test passes, ask what it actually covered.

Use pr-review →

Done but not live

Merged isn't deployed, and deployed isn't working.

Receipt #003

Done but not live

Agent said
Merging redeploys the app.
Actually
Only one service rebuilt. The app stayed on the old commit and production kept refusing new runs.
Caught by
Checking production

Done means the live version changed. Check the running commit.

Use browser-verify →

Half fixed

One spot is fixed while the same bug lives on elsewhere.

Receipt #005

Half fixed

Agent said
The Overview fix covers Usage too.
Actually
Usage was a different component, so it still had the bug.
Caught by
GPT Sol 6.1

A fix in one place proves nothing about the next place.

Use pr-review →

Receipt #007

Half fixed

Agent said
Cleared five days ago.
Actually
Only the main prompt changed. The skill files the agent actually reads were never updated.
Caught by
Me, when it kept happening

Fix the thing the agent reads, not the thing you wrote.

Graded its own work

The builder says it is fine. A second model disagrees.

Receipt #004

Graded its own work

Agent said
Sign-in works.
Actually
A crafted link could send you to another website after you clicked "Sign in".
Caught by
GPT Sol 6.1

Working for you is not the same as safe from someone else.

Use pr-review →

Receipt #006

Graded its own work

Agent said
The browser import is built and tested.
Actually
Six security holes, including redirects that got past the private-address guard.
Caught by
GPT Sol 6.1 security review

Have a model that did not write the code try to break it.

Use pr-review →

Receipt #008

Graded its own work

Agent said
PR reading works.
Actually
Four serious bugs, including secrets that could leak through PR diffs.
Caught by
GPT Sol 6.1

Review anything that touches secrets twice, with different models.

Use pr-review →