Changelog

What changed on this site, when, and why. Newest first. Last change: October 13, 2026.

I'm building this in the open, so the changes are too. This page is generated from a log that lives in source control next to the code, and every change to the site has to add to it. Some decisions were thought through, and some were made fast to get something out the door. The fast ones say so.

Times are US Eastern. A few behind-the-scenes changes, like library upgrades and DNS records, stay in the log but off this page.

October 13, 2026

• 12:02pm An RSS feed, and the newsletter follows it New pieces show up at /rss.xml, and the email list drafts a note from the feed, so subscribers hear about new writing without me remembering to send it.
• 12:00pm A public roadmap decided fast Everything I'm thinking about writing or building, as sticky notes on a board: ideas, drafts, up next, and out. No dates, no promises. Kept in source control like the changelog. See it.
• 11:30am Rebuilt on the same setup as my other sites The site moved from a hand-rolled template setup to Astro, Tailwind and MDX, the stack I already use elsewhere. It should look the same. Underneath, every piece is now a single file that drives its page, its homepage card, its date and its AI score, so adding one is quicker and harder to get wrong.
• 11:30am A TL;DR for the whole site, for whoever you are decided fast The yellow TL;DR button gives the whole site in a few lines, for a kid, a mom, an executive, a practitioner, or someone outside tech. AI drafted them, and they say so. The idea is free to copy; just link back. Read it.
• 11:30am Short links ctpo.io/s1p1, ctpo.io/clay and ctpo.io/kids, easier to put in a post or say out loud.
• 11:13am Dates and a New badge on pieces decided fast Each piece shows when it went up, and a yellow New badge for its first two weeks, on the homepage and on the piece itself. The badge turns itself off, so old pieces don't pretend to be new.
• 11:09am The charter isn't only about security The first two goals read like this was a security site. Security is just the first series; product, delivery and how teams work together are in scope too.
• 11:00am Site settings moved into source control Analytics IDs, the email list and feature flags now live in a config file next to the code instead of the hosting dashboard. Anything that can only live in a dashboard is written down with how to reproduce it.
• 10:18am A cookieless visit count, for everyone Google Analytics only counts people who say yes, so I couldn't tell how many people actually came from a post. Vercel's analytics counts page views without cookies or anything stored on your device, and skips you if your browser sends Global Privacy Control. That changed a principle in the charter from "analytics only with your OK" to "anything with cookies only with your OK", and I'd rather say so than slip it in. Privacy details.
• 10:17am You can see which version is live The footer shows the build, and /version.json says which commit, branch and environment it came from, plus the latest change. Handy for me, and for anyone checking my work.
• 10:02am The AI score now gives the idea real weight decided fast The score is now idea (0 to 2) plus words (0 to 2), and both parts show next to it. A speech is still the president's when a speechwriter drafted it. My scores went up, so here are the old ones: Part 1 2.6 to 3.3, the kids' version 1 to 2.3, the charter 1.5 to 2.3, and Clay first 1.5 to 2.8. How I score it.
• 9:58am New piece: Clay first, chisel later decided fast The idea behind how this site got built: rough out a considered whole, a little bigger than it needs to be, then cut. With a figure comparing it to the walking skeleton.
• 9:48am Clay first, chisel later Added to the charter: rough out a considered version of the whole thing first, label the fast calls, then refine one change at a time once there's a pattern, probably four to six posts in. Not throwing things at the wall. With credit to Alistair Cockburn's walking skeleton and Kent Beck's make it work, make it right, make it fast. It also joined the tug-of-war on the homepage: clay first versus chisel first.
• 9:34am How I write, written down and versioned decided fast A voice guide kept in source control next to the code, so any AI helping me starts from how I actually write. When I correct a draft, the fix goes in the file, with a date.
• 9:29am The changelog lives with the code Every change now adds an entry to a log kept in source control, with the time and the why. This page is generated from it, and a change can't be committed without one.
• 9:24am Be patient, and watch the right things Added to the charter: a quiet first day isn't a verdict, plus the early signs I watch for each goal.
• 8:40am Part 1 of "Security is a group project" published With a short version on LinkedIn at 8:40am ET.
• 8:37am Calmer version buttons Only the version you're reading looks selected. The kids' button stays calm until you hover, so it doesn't pull you out of the real read.
• 8:20am Behind the site Why this site exists, what it's for, the principles, and how decisions get made.
• 7:59am "Join the discussion" links, and "Follow me" Most readers arrive from LinkedIn, but the conversation should be one click away for everyone else. "Follow along" was unclear about whether it meant me or a post.
• 7:55am AI scores can be partial, like 2.5 or 2.7 decided fast Most pieces don't fit neatly in one box.
• 7:39am Same ideas, different readers Part 1 now has a version for my kids, about clothes and towels on the floor, with a note for grown-ups. A version for my mom is coming, and I'm writing that one myself.
• 7:33am An AI score on every piece decided fast Four little droids show how much of a piece is me versus AI, scored by me, on the low side. Clicks are counted, as a rough sign of whether anyone cares. Honest note: I built this before writing down why, which is backwards.

October 12, 2026

• 3:43pm Moved to Vercel, security headers on every page Every change gets its own private preview before it goes live. ctpo.io now forwards to the right page instead of the homepage. Basic hygiene for a site that writes about security.
• 2:22pm Proper link previews Shared links now show a real card, and Part 1 shows the three-paths diagram.
• 2:05pm New icon A glowing gold droid for the browser tab, phone home screen and newsletter.
• 12:51pm Analytics only with your OK; new privacy and cookie pages someone's idea Google Analytics loads only after you say yes and respects Global Privacy Control. The old policies were generated for a different site and weren't accurate.
• 12:43pm A small ad for airlines and hotels Shows once, tucks itself away, and isn't a job application.
• 12:39pm Writing and Coming up, two series Finished pieces separate from ideas in progress. Series 1 sees the problem; Series 2 is about solving it.
• 12:02pm The site became a writing site It used to sell services nobody asked for. Now it's where I think out loud.