justin higgins
Justin Higgins — software engineer, 20 years in regulated enterprise. Building at the seam between AI-assisted engineering and how that work gets recognized.
links
- ↗jchigg2000-gitgithub.com
- ↗jchigg2000-hfhuggingface.co
- ↗justin-h-89682b14blinkedin.com
- ↗jchigg2000.dev@gmail.comemail
writing
- I Published the Rule and Built the Hole Eight Days Later
I published a security rule, then built a tool that broke it eight days later. Writing a lesson down did not carry it into my next build. Only a check that runs can.
- The Meter That Refused to Guess
I checked the cost meter I built for my own AI coding logs and found it wrong in both directions at once: it skipped four in five log files and counted some responses more than once.
- A Date Picker Beat Seven Days of Parsing
I asked my reporting tool to answer at once, but five reviews in nine hours shrank that until it rarely fired, and a date picker lifted first-try answers from about 40% to 81%.
- Eighty-Nine of Ninety Were Not Gated
An audit of my own experiment found that 89 of 90 items in its checked arm skipped the check. The code is fixed, every published number stays, and each correction is numbered.
- The Test Logged the Miss and Went Green
My redaction library's test printed that it missed a medical record number, then passed anyway, because a 95 percent recall gate allows exactly one miss in twenty.
- The Scorer Was Grading the Log Format
I recalibrated the scorer I built for my AI coding sessions and found it had been grading the log format, not my work. The headline barely moved, but my band went from 3x to 8x.
- The Unearned Constraint
The biggest technical choice in my CarPlay navigation app was never made by anyone. A 'decided' label hid that for eight days, and a probe settled it within 13 hours of reopening it.
- A Tie Is a Loss
I have two AI agents build competing versions of a feature, score them against a fixed standard, and only ship the winner if it clearly beats what came before.
- Read the JavaScript Bundle
I pointed research agents at free US government healthcare data and found, inside one insurer's website code, a catalog of files the regulator never advertises.
- Survived Is Not Endorsed
I re-ran an agent research swarm blind to its first answer and it picked a completely different company, which is how I learned to audit the process, not the findings.
- Everything Looks Like Everything
I built a question-answering system over a thousand near-identical insurance contracts, and the product turned out to be the refusals it gets right.
- The Probe Was the Bug
While building a navigation app, the tool I added to measure a screen rendering glitch was itself the cause of both the glitch and an earlier crash.
- Verify the Artifact, Not the Process
Before releasing a tool publicly, I found my own safety checks were verifying the wrong thing, which nearly let private screenshots leak into a public README.
- I Removed Authentication and Shipped It as a Feature
I deleted the login system from a small app of my own and shipped the removal as a feature. I think it was the most secure thing I did to that app all summer.
- Read It Cold
Before open-sourcing a tool, I had five readers check every claim in the docs against the code. Thirty-seven sentences had been true once and were not anymore.
- Five Hours Unattended
I gave an agent a five-hour budget and a repo on a Friday evening and stopped watching. This is what its own ledger says it shipped, skipped, and survived.
- Prove the Advisory Is Unreachable
Two high-severity security advisories hit a dependency I could not upgrade. Instead of the suggested rollback, I proved the vulnerable path was unreachable in my app.
- One Password for the Whole Family
My reusable login template had a fallback password hardcoded in it, published for anyone to read. Now first boot generates a random one and forces a change.
- Everything That Concluded Was Deleted
Four days into an investigation I deleted thirty-three files of conclusions built on a day-one hunch and kept only what had been measured. Best thing I did all week.
- One Line Held the Lock
My Go server stopped scaling at two cores for two weeks behind good load tests. One lock around the logger was the cause, and one line fixed it.
- The Simulated User Is the Confound
I built a diagnostic interview for heavy equipment and tested it with an AI playing the operator. It took sixty runs to see the fake operator was what I was measuring.
- The Shape Leaks
I proposed disguising private code as a different domain so AI reviewers could see it, then proved the disguise still leaks which industry it is from.
- The Decision Log Ate the Project
My project's decision log grew to 144 entries and only 28 were mine. I kept those and collapsed the other 116, which were the agent citing itself, to one line each.
- Twelve Days of Green Tests
Rebuilding a database protocol using only real client software as my guide, I found a core test had passed for twelve days by checking code against itself.
- Spider-Man Is Not a Person
A privacy filter I put in front of a small app my family uses flagged Spider-Man as a person and took the app down for days. The health check stayed green the whole time.
- What the Meter Did Not Count
Comparing two AI coding tools, I found their built-in cost trackers badly undercounted real usage, in one case showing about 3 percent of actual token spend.
- Words That Mattered
I built a feature that finds every time I told my coding agent it misunderstood me, turning my own corrections into a record of what I actually meant.
- A Backup of a Lie
A backup of a live SQLite database opened fine, passed as valid, and was empty, because every row was still in the log file next to it. Now I test every restore.
- Showing Includes Saying
I built a picture tool for a child in my family, measured 504 images, and found the safety guard I had tested on text did nothing for the pictures. So I fixed those.
- The Winner Was Array Order
My seven-model comparison declared a winner that was actually a three-way tie broken by list order, so I learned to check what a ranking report hides.
- Three Bugs in the Instrument
I found three separate bugs in my own test harness that had been quietly reporting wrong numbers for months about how well my contract search system worked.
- The Rules Are Downstream of the Work
My coding agent's rulebook was not written in advance. It grew line by line from real mistakes over 105 days of working together, and every line has a date.
- Your Rate Limiter Is Counting the Wrong IP
I found the same rate-limiting bug in two different apps, both correctly coded but silently useless because each was tracking the wrong IP behind a proxy.
- The Presses Never Stopped
I had my coding agent audit every non-code file it had printed on my machine in four months. 3,460 of them, and only 36 percent survived.
- It Counts. It Does Not Read.
I built a way to find what is actually broken in a company from data it already has, and put the interview last, because opinions about problems are often wrong.
- My Portfolio Read Like a Compliance Audit
I let an agent write my portfolio's project descriptions. Across 150 fields there was one I, and nothing said I built or decided anything. It read like an audit.
- An Agent With Eight Minutes
One afternoon I had an agent fire every ten minutes, do one small verified change, and log it. Twenty-seven commits shipped, and it learned to admit when it did nothing.
- Three in Five Opus Runs Did Not Need Opus
I audited a week of my coding sessions and found three in five had used the most expensive AI model on work a cheaper one would have handled just as well.
- The Work Looks Like Nothing
Senior engineers prevent costly mistakes in ways that never show up on paper. I argue AI coding session logs can finally make that hidden judgment visible.
- The Tree I Never Planned to Move
A chat assistant stored its own suggestion about moving a tree in my yard as my plan, then told it back to me as something I had decided. I had never said it.
- Git Could Not Tell Me Who Wrote It
Over one weekend I shipped a macOS window manager where an agent wrote all the Swift. Git says the 41 commits are mine. The transcripts say what I actually did.
- The Principal IC Moat
Six months of job hunting became a tool that reads past the buzzwords in Principal Engineer postings to find what the job really is. Six shapes hid behind one title.
- The Corpus Contains Itself
An agent built a data-request platform in ten hours from a spec my own spec-writing tool produced, and those build sessions now feed the tool that specced it.
- Comprehension Confidence Is Useless
Asking an AI how well it understood me is useless, it can always restate me. Asking whether it has enough to start building is the question that works.
- The Judge Never Overrides the Regex
I built a scorer for my coding sessions where simple pattern checks catch safety problems and a model only judges quality, never the reverse.
- A Book Every Four Days
I read/listened to fifty-one books about things that broke in seven months, and the real risk of writing with an AI is that you start sounding like it.
- A Receipt Nobody Issues Yet
I wrote a spec for the smallest thing that would let a company verify AI work, a receipt from the provider. Nobody issues one yet, and I say so.
- An Autonomous Prompt Is a Permissions Document
The instructions I give an unsupervised agent matter less for what to build than for what it may never touch, run, or push. That list is the document.