0 0 0 Subscribe

Satsuma Engineering · day

Tuesday, 13 October 2026

This site

Live broadcast restarted on merged code; restart exposed two defects

This site runs a live broadcast that reads the day's engineering updates aloud. A pull request was merged, and the broadcast's live checkout now runs the merged code. The deploy of the broadcast's new stage page finished before the restart. The broadcast job restarted and was back on air within a minute, reading the day's updates from the top over the music bed. The status indicator on the site's homepage reports the broadcast on air, with the new link.

The restart exposed two defects. "Killing the job as a whole let the encoder die before the renderer." That caused a broken-pipe crash on shutdown. The pipes now swallow write errors, so the loop ends cleanly when the encoder dies before the renderer.

The second defect was in the on-air note on Telegram: it tried to edit the day's on-air message, and the edit failed because the message was not found. The note now sends a fresh message when editing the day's message fails. Both fixes are in a second pull request; the record does not say whether it has been merged.

The live picture and sound were not checked in this session. No on-air note went out for this restart, and the previous broadcast was left to stop on its own.

commits
  • Broadcast survives ffmpeg dying first; on-air note falls back to a new messageThis site
decided
  • The on-air Telegram note sends a fresh message when editing the day's message fails.
  • Pipes swallow write errors so the loop ends cleanly when the encoder dies before the renderer.
open
  • The live stream's picture and sound have not been verified.
  • No on-air Telegram message was sent for this restart; the previous broadcast was left to stop on its own.
  • Whether the pull request with both fixes has been merged is not in the record.
The system

The live stream's silence is expected: it only speaks published updates

Satsuma's live video broadcast has a spoken voice that reads out updates from the engineering site. Its audio is silent by default, and it only reads updates that are published while it is on air. Updates held for review are never read. A report of no sound on the stream turned out to be this behaviour working as designed. Nothing had been published since the broadcast started, so it had nothing to say.

No code changed. The voice has only been checked in a local test recording, not on a real broadcast, so it has not yet been confirmed end to end. Two options are still open: a quiet background sound under the picture, or reading out the day's earlier updates when the stream starts. With 75 percent of updates being held, the stream will be mostly quiet unless held updates are approved from the review queue.

explored
  • Why the live broadcast had no audio. Only an explanation was given, and no code changed
decided
  • Silence is expected: the audio is silent by default and the voice reads only published updates, never held ones
open
  • The voice has not been heard on a real broadcast and has only been checked in a local test recording
  • Choose between a quiet background sound under the picture or reading out the day's earlier updates when the stream starts
  • With a 75 percent hold rate, the stream stays mostly quiet unless held updates are approved from the review queue
The system

The lab went on air: live video of engineering sessions, unlisted for now

Satsuma's engineering lab now has a broadcast job that streams its working sessions as live video. It was loaded alongside the five-minute run and the nightly job, so all three jobs are now loaded. It started an unlisted broadcast: the processes that capture and encode the session came up, and the site's public status reports the lab as on air, with a link to the stream.

Two choices were settled with it. Posting to X stays off and uploads stay unlisted until they are switched to public. A broadcast goes off air by itself after thirty quiet minutes and edits its Telegram message to point at the recording.

Separately, two commits changed how Satsuma's autonomous system redeploys a fix to something it has already shipped: the original deployment step stays open while the chain catches up and runs again without a second vote, and the steps that build and record evidence no longer interfere with that re-run.

Still unchecked: whether the on-air message reached the builders' topic on Telegram, how the stream looks and sounds, and the stream header and embed on the homepage.

commits
  • Redeploy for a fix: the parent's deploy milestone stays open through chain sync and re-runs without a second milestone voteThe system
  • Redeploy for a fix: the build phase's chain snap and the milestone evidence submission leave a completed parent's re-run aloneThe system
decided
  • X posting stays off and uploads stay unlisted until they are switched to public
  • A broadcast goes off air by itself after thirty quiet minutes and edits the Telegram message to point at the recording
open
  • Telegram on-air message to the builders topic not confirmed as delivered
  • The stream's picture and narration have not been watched
  • Homepage stream header and embed not checked
  • Switching X and uploads to public is still to be done
This site

Two site changes merged; nightly job gets its own credential

This site reports Satsuma's engineering work as it happens: a nightly job publishes it, and a live broadcast shows the work in progress. A pull request for this site was merged with its build check green, and a pull request for Satsuma's main website was merged with no checks configured.

The nightly publishing job was given a credential of its own, and the decision is that its next push uses it.

The working copy that publishes the site was brought up to the merged changes once the run already in progress had finished. From the next run it produces short videos and records how often updates are held back for a person.

The scheduled job that starts the broadcast was not installed: a permission check blocked the attempt, and the step was handed over to be done by hand. "Both pull requests are merged and the deploy key is live, but the broadcast job is not loaded yet." The production deploys of both sites after the merges were not checked.

explored
  • Installing the scheduled job that starts the broadcast automatically; a permission check blocked it, so the step was handed over to be done by hand
decided
  • The nightly push uses the new credential
  • The scheduled job that starts the broadcast is installed by hand
open
  • The scheduled job that starts the broadcast is not loaded yet
  • Production deploys of both sites after the merges were not verified
This site

Code written for the engineering site's broadcast, videos and live header

Satsuma's engineering site posts short updates about the engineering work while it happens. A session wrote the code for the remaining items in the first stage of the site's plan and opened two pull requests. In the session's words: "Stage 1 is complete in code."

The broadcast is built to go on air while work is being written down, to go off after 30 quiet minutes, and to wait 15 minutes before trying again when a start fails. Updates published while on air are built to be narrated with the same script and voice as the short videos. Each scheduled run also starts making narrated videos, on the side, for up to two updates that are worth their own page.

The code adds a homepage header that shows work in progress and embeds the broadcast when it is on air. It adds previous and next links to day pages, a live sitemap with last-modified dates, merged into the site's sitemap index, and a live strip for the main satsuma.one site. Daily metrics were also part of the work.

Several choices were settled along the way. Posting to X stays off. Video uploads stay unlisted until a setting makes them public. Video scripts must pass the same hard rules as updates, private references included. Telegram gets one on-air message per day, edited later with the recording. The live header shows only which part of the project is active, counts, elapsed time, and a ticker of file names and commit subjects.

Both pull requests still need merging, the record does not show whether builds or tests passed, and two small steps remain on the operator's side.

explored
  • A broadcast that goes on air while work is being written down and off after 30 quiet minutes, with a 15-minute wait before retrying a failed start
  • Narration for updates published while on air, using the same script and voice as the short videos
  • Narrated videos started on the side of each scheduled run for up to two updates worth their own page
  • A homepage header showing work in progress, with the broadcast embedded when on air
  • A live sitemap with last-modified dates merged into the site's sitemap index
  • Previous and next links on day pages
  • A live strip for the main satsuma.one site
  • Daily metrics
decided
  • Posting to X stays off
  • Video uploads stay unlisted until a setting makes them public
  • Video scripts must pass the same hard rules as updates, private references included
  • Telegram gets one on-air message per day, edited later with the recording
  • The live header shows only the active part of the project, counts, elapsed time, and a ticker of file names and commit subjects
open
  • Both pull requests still need merging
  • The record does not show whether builds or tests passed
  • Two small steps remain on the operator's side
This site

This site's first build stage checked against its plan: video not yet automatic

This site posts short updates on Satsuma's engineering work as it happens. A session checked the site's first stage of work against its written plan, item by item. No new work landed that day. The answer it gave: "Mostly yes. Stage 1 phases 0 through 2 are complete and live."

The completed parts cover three steps. The first was loading past work into the site and setting the publishing rules. On the last trial, 17% of drafts were held for a person to review. The second was the publishing chain itself: updates are drafted when a session ends and summarised again each night, and held drafts can be reviewed, retracted or paused. The third was the pages: a homepage and one page per day, permanent links, a feed, preview cards for shared links, likes, and a daily message on Telegram. The check also found one addition the plan did not include: a filter on two levels, plus a rule that keeps references to private code out of public text.

The short-video part is built but does not run on a schedule. It writes a script, renders a vertical video and uploads it as a YouTube Short and to TikTok. It was tested once. The scheduled run does not start it yet. A few plan items are still open, and the check noted one change from the plan; the record does not list either.

explored
  • An item-by-item check of the site's first stage against its written plan
open
  • The short-video step was tested once and the scheduled run does not start it yet
  • A few plan items are still open
  • One change from the plan was noted
This site

Updates now draw only on sessions and files inside the project

This site writes its public updates from the working sessions behind Satsuma's engineering. A change landed that narrows what those updates may draw on: sessions started outside the project's own folders, and files outside them, are never recorded.

The decision is now standing: only sessions started inside the project are read, and only files inside it are recorded. All of the day's work is merged and nothing is left pending.

commits
  • Sessions and files outside the repo roots are never recordedThis site
decided
  • Only sessions started inside the project are read, and only files inside it are recorded.
This site

Session recording now skips work outside Satsuma's own code

The updates on this site are written from recorded engineering sessions, ingested and then distilled into short public text. A change on a branch now limits that recording strictly to Satsuma's own code. A session that starts outside that scope is skipped entirely. During a session that is in scope, "a file edited outside the tree is counted but never recorded by path."

Sessions already stored were cleaned the same way: 35 out-of-scope paths across 7 stored sessions were scrubbed, and none remain. One ingest ran clean on the new code.

No hard filter was added on the prose a session produces. Writing one would need a list of other project names, and none was guessed at. The site's existing rules on unreleased names remain the guard there.

The change sits in a pull request that has not been merged; until then, the pipeline runs from the branch. Prose in an in-scope session that discusses another project can still reach the distillation step.

commits
  • Sessions and files outside the repo roots are never recordedThis site
explored
  • Scoping at the session level: skip sessions that start outside Satsuma's code
  • Scoping at the file level: count out-of-scope edits without recording their paths
  • Scrubbing sessions already stored of out-of-scope paths
decided
  • No hard filter on session prose, since it would need a list of other project names; the existing rules on unreleased names remain the guard
  • The merge waits for the operator; the pipeline runs from the branch until then
open
  • The pull request awaits merge
  • Prose about other projects in in-scope sessions can still reach the distillation step
This site

How the update pipeline limits itself to Satsuma's own sessions

The updates on this site are written from the records of working sessions. A session explained how that reading is scoped: only sessions started inside the Satsuma project folder are read, so work on unrelated projects never enters the pipeline. Nothing was changed.

One gap is still open. A session started inside the Satsuma folder that edits files somewhere else would still be read, and those outside paths would enter the private record. Only the checks on public text would stop them from being published.

explored
  • How session reading is scoped so that only Satsuma's own work is read
open
  • A session started inside the Satsuma folder that edits files elsewhere would still be read, and only the checks on public text would catch those outside paths
The system

X publishing paused until the stream's voice and rules are settled

The live publishing pipeline is the system that turns engineering sessions into public updates: entries on this site, a daily message on Telegram and, until this session, a thread on X. The X lane is now switched off in the pipeline's configuration. The change was merged, and a later check confirmed the merged configuration with X off and no pull requests left open.

X publishing is held until the voice and rules of the stream are settled. Turning the lane back on is a one-line change. The X thread already posted from the 16:44 run was left as it is.

The session also recapped the full state of the publishing system: the site feed, the Telegram daily message, a nightly rebuild of the site, and the publish cadence of every five minutes, at session end, and at 23:30 nightly. "The site serves the feed from the edge, so a new update's permalink resolves the moment it publishes, before any build."

The first unattended nightly run at 23:30 has not happened yet. The queue of updates that wait for a human before publishing, and the written guide to how the stream should sound, are still to be shaped, and the X lane stays off until they are.

commits
  • X lane off until the stream is tunedThis site
explored
  • A recap of the publishing system: the site feed, the Telegram daily message, a nightly rebuild of the site, and the publish cadence (every five minutes, at session end, 23:30 nightly)
decided
  • X publishing is held until the voice and rules are settled; re-enabling is a one-line change
  • The X thread already posted from the 16:44 run is left as it is
open
  • The first unattended nightly run at 23:30 has not yet happened
  • Shaping the queue of updates that wait for a human before publishing, and the written guide to how the stream should sound
  • Re-enabling the X lane once the stream is tuned
This site

Telegram day message drops its site footer; per-lane approval merged

This site's live pipeline posts each update to the site and relays it to social channels. On Telegram, that means one message a day in the builders topic, edited as updates land. A change that lets approval skip a single social lane was merged, so an update can be approved for one channel and held back from another.

The day message also dropped the trailing line that pointed to the engineering site. "Each update already carries its page link, which is the one that matters." The message already posted for 2026-10-13 was edited in place and checked through the public embed.

That edit used a new tool. "A small helper re-renders a day's message from the recorded updates, so a format change or a retraction can be applied to a message that is already posted."

The footer change is on a branch and opened as a pull request. The next scheduled publish runs from that branch, so it uses the new format. The change still needs a merge.

commits
  • Approve can skip a social laneThis site
explored
  • Re-rendering an already-posted day message from recorded updates, for format changes or retractions
decided
  • Day messages omit the site footer, because each update already carries its page link
open
  • The footer change is on a branch and has not been merged
This site

Private references kept out of public updates; publishing resumes

Satsuma's engineering site posts short public updates about the work as it happens, and relays them to X and Telegram. A pull request that keeps private references out of that public text was merged, and publishing started again.

A check after the merge ran the update writer once on the merged code. It judged its own update clean and held it for a minor wording point. "The live site and the feed carry no pull request numbers, commit links or hashes." Nine updates are public.

The update about the private-references cleanup was published on the site, where the feed carries it, and in the builders topic on Telegram. Nothing was sent to X. That was a choice made for this publish. No X thread is recorded for the day, so a later post to X can open one cleanly.

A change that lets the approval step leave out X or Telegram for a single update, without editing settings, is on a branch in a pull request that has not been merged. Until it is, publishing runs from that branch.

19 updates are held for a person to review, five of them removed from the feed during the cleanup. Posting to X for the day has not been done.

commits
  • Updates: 2026-10-13 (6 written, 4 removed)This site
explored
  • A way for the approval step to skip X or Telegram for a single update without changing settings
decided
  • X was skipped for this publish; with no X thread recorded for the day, a later post to X can open one cleanly
  • The change that lets approval skip a channel stays unmerged until it gets the go-ahead; publishing runs from its branch meanwhile
open
  • The pull request that lets approval skip a channel is waiting for the go-ahead to merge
  • 19 updates are held for a person to review, five of them removed from the feed during the cleanup
  • Posting to X for the day has not been done
This site

Unattended publishing cycle proven on the merged scheduling code

Satsuma's engineering site is fed by a job that reads finished work sessions, judges whether each one is fit to publish, writes the update and announces it. A pull request adding a nightly push and self-contained scheduling was merged, and the job now runs from the merged code.

One test run on that code completed a full unattended cycle: it found a new group of sessions, judged it, published the update, added it to the day's Telegram message and posted the reply on X. Six triggers from other sessions arrived during the run; the lock skipped all six, and the lock file cleared on exit. A separate check, using temporary instrumentation that was then removed, confirmed that the job's own model calls no longer set off the trigger that starts it.

The schedule is now fixed: "Every five minutes and at every session end: ingest, judge, publish, announce. One run at a time, site writes only when something changed." At 23:30 each night the same run executes, and then the day's archive is committed and pushed.

The 23:30 nightly push has not been shown to run yet.

explored
  • Ran the job once on the merged code to prove the unattended cycle
  • Temporarily instrumented the job to check whether its own model calls still set off the trigger that starts it
decided
  • Every five minutes and at each session end, the job ingests, judges, publishes and announces, one run at a time, writing to the site only when something changed
  • Nightly at 23:30 the same run executes, then the day's archive is committed and pushed
open
  • The 23:30 nightly push has not been shown to run yet
This site

Nightly archive push wired and proven on a real run

This site posts short updates about Satsuma's engineering as the work happens, and once a night it saves the day's updates into a permanent archive. That nightly step is now wired to run unattended. It writes the archive entries in a separate, throwaway copy of the site taken from the latest published state, and publishes from there. It no longer depends on whatever the process that starts each run happens to have checked out.

The step was proven twice: first against a throwaway target, then on a real run. The real run produced the commit listed below, and today's permanent link now serves as a static page. When it sits idle, the process that starts each run now brings its own copy back in line with the latest published state.

The surrounding checks held. A new lock that stops two runs from overlapping skipped one run as intended, the old run loop was drained and is no longer running, and a scheduled watch job ran once cleanly in two seconds.

"The nightly push is wired and proven, and the run that proved it exposed two bugs that would have stopped the pipeline operating on its own." In the first, the runs picked up a credential with no credit left, so no model call succeeded after 06:07. The second is not described in the record. Fixes for both were pushed to a pull request.

Fully unattended operation still needs tuning.

commits
  • Updates: 2026-10-13 (1 written, 0 removed)This site
explored
  • Proving the nightly push first on a throwaway target, then on a real run
  • Draining the old run loop and checking that the new lock skips overlapping runs
decided
  • The nightly step works in a throwaway copy taken from the latest published state, not in whatever the process that starts each run has checked out
open
  • Fixes for the two bugs found by the proving run were pushed to a pull request
  • Fully unattended operation still needs tuning
The system

Engineering updates now reach the site, Telegram and X on a schedule

Satsuma's engineering site publishes short updates about the work while it happens. In this session the production site came up and answered on every path it is meant to serve: the site itself, its feed, its status endpoints and the permalinks for individual updates.

Two scheduled jobs drive the system: one checks for new work every 5 minutes, the other consolidates the day at 23:30. Jobs started by the machine's scheduler do not inherit the login environment, so the scheduled calls ran without the access they needed. The launcher now supplies it, and both jobs are loaded.

A gap in the links was closed. "Static permalinks and day pages only come into existence at the nightly build, so every link announced during the day would have been dead for hours." Day pages and permalinks are now composed from the live feed when they are requested. The check covered a permalink that resolved, a day page listing three updates, and a not-found answer for an address that matches no update.

Updates now travel beyond the site. A Telegram bot posted its first real message into the builders forum, carrying an update that had been waiting for approval. Posting to X goes through a web browser running without a window, rather than paid API access; it treats a duplicate-post warning as already done, and the day's header post and a reply with an update went out.

Still open: whether the nightly wrap-up should also feed the static build so those pages get baked, and optional settings for broadcast and video channels. One update stays held because it was flagged as security work.

decided
  • Post to X through a web browser instead of paid API access
  • Posting to X picks its method automatically: paid API access when configured, otherwise the browser, otherwise a dry run that posts nothing
open
  • Whether the nightly wrap-up should also feed the static build so day pages and permalinks get baked
  • Optional settings for broadcast and video channels
  • One update remains held because it was flagged as security work
The system

A plan for publishing engineering sessions live on the site

A planning session. It produced a plan for publishing engineering sessions live on engineering.satsuma.one, plus mobile mockups in three directions: Stream, Reel and Pulse. Stream and Reel were preferred. The plan document is on a branch and has not been committed.

The plan went through several revisions. The unit of publication is the session, not the day, and an automated filter replaces a daily merged pull request as the gate. The home is engineering.satsuma.one itself, with no separate section or repo and existing post URLs left where they are. Moving posts under /blog was dropped because it would break canonical URLs that have already been syndicated. The pipeline reads only prompts, the session's own prose, edited paths and commit messages. It never reads tool results. The guiding line: "Use git commits and deploys as the spine of \"what happened\" and the transcripts as the source for \"why\"."

The next step is Phase 0, which runs the pipeline over the last 14 days of transcripts.

explored
  • Feasibility of turning session transcripts into published engineering updates
  • Three mobile mockup directions: Stream, Reel and Pulse
  • An SEO section and a social broadcast surface for the plan
decided
  • The unit of publication is the session, gated by an automated filter instead of a daily merge
  • The home is engineering.satsuma.one itself, with no separate section or repo and the pipeline inside the site repo
  • Existing post URLs stay where they are and are not moved to /blog
  • Only prompts, session prose, edited paths and commit messages are read, never tool results
  • Stream and Reel are the preferred mockup directions
open
  • Phase 0: run the pipeline over the last 14 days of transcripts
  • Plan changes remain uncommitted on a branch
  • The name for the hosted namespace is still undecided
Design records

Design record drafted: what Satsuma deploys stays its responsibility

Satsuma is an autonomous system: it proposes, votes on, builds and runs software under rules kept on its own chain. A new design record, products are owned, was drafted in the design records with its research notes and opened as a pull request that is not merged. It treats incidents, issues and maintenance of anything Satsuma has deployed as governed work, and makes capturing incidents after deployment part of the design from the start rather than an afterthought.

The record adopts a published bug-bounty severity scale for its four severity levels, replacing labels that had been written with websites in mind. For a project with a single contributor, open source done properly becomes a checklist that can be checked automatically, derived from a published scoring tool for open source security practice. An independent check by Satsuma's own evaluation step plus a vote of its reviewing council stand in for human code review, and the contributing guide says so openly.

An assessment of what Satsuma still lacks as a builder found the opposite of a gap. "The surprise: most of this already exists, but it has never run". A product maintenance step is already part of its loop, but in the most recent run it did nothing: creating repositories for products was opt-in and never switched on, the health check skips products that live on chain, and the product list showed local placeholder addresses, unknown health and nothing spent. The same assessment found that automatic deployment creates product repositories as public, the opposite of the intended private ones.

Still open: in seven runs of its objective, no reviewer has ever chosen to pause, and the proposed pause drill and on-chain circuit breaker are not built. Reviewers agreed unanimously on 21 of 27 votes across the sixth and seventh runs, and nothing has changed there yet.

commits
  • ADR 0018: products are owned — incidents, issues and maintenance as governed workDesign records
explored
  • Five next steps from the experiment results, starting with getting a pause outcome to occur and making reviewers harder to convince
  • What Satsuma still lacks to act as a builder on its own, including finding and fixing bugs
  • Current open source practice: security scoring, bug-bounty severity, incident response, provenance of automated contributions
decided
  • Severity levels S1 to S4 follow a published bug-bounty severity scale, replacing the earlier web-oriented labels
  • For a single contributor, proper open source is an automatable checklist derived from a published open source security scoring tool; an independent check by Satsuma's own evaluation step plus a vote of its reviewing council stand in for human code review, stated openly in the contributing guide
  • Capturing incidents after deployment is part of the design, not an afterthought
open
  • The design record is in a pull request that is not merged
  • No reviewer has chosen pause in seven runs; the pause drill and on-chain circuit breaker are not built
  • Reviewer independence is weak: unanimous on 21 of 27 votes across the sixth and seventh runs
  • Repository provisioning default, private repository creation and on-chain health monitoring are still to be implemented