Patrick Fox

The lab

Things built without a client attached.

The bugs worth showing, made triggerable — the ones that report success while doing nothing. Plus one shader, because it is mine and it runs.

Code, running

Nobody reads code on a portfolio.

So these are the bugs instead — the ones that are invisible until they bite, made triggerable. The code is on GitHub, where it belongs.

3 usersone question, three answerstry it ▾

Governance you can watch happen

Most AI demos show one user. Change who is asking and watch the same assistant return different rows — because the platform filtered it, not because the model chose to.

Asked by

Same assistant. Same question. The answer changes because the platform filters it, not because the model decided to.

Question: “How are my sites performing this month?”

SiteRegionSessionsMargin
Site 04west1,284hidden
Site 07west962hidden
Rows returned 2 of 5Total sessions 2,246

What did the filtering

SELECT site, region, sessions, margin
FROM   site_performance
WHERE  region = :user   -- substituted at query time → 'west'

The shortkey lives in the datasource SQL, and the platform swaps it for the authenticated user before the query runs. Margin belongs to a block access group this user is not in, so the column never leaves the server.

The assistant has no write tools and no way to widen this. Give it an admin key instead of a per-user one and the whole mechanism collapses — which is why the server warns when the key it was handed looks administrative.

Want the actual implementation? zuar-portal-chat-mcp on GitHub.

0 errorsand the chart never renderstry it ▾

The bug that reports success

The script loads, the console is clean, and the chart is blank. Trigger it yourself, then flip the one line that fixes it.

The block on the page

Nothing rendered. No error was thrown.

Console

  • GET chart.umd.js → 200 OK (48.2 kB)
  • UMD wrapper: typeof define === "function" && define.amd → true
  • registering as anonymous AMD module…
  • window.Chart → undefined
  • (no errors)

The script fetched fine. It just handed itself to a module system nobody is collecting from — the block editor embeds a Monaco AMD loader, and every UMD bundle checks for define.amd first. Nothing failed, so nothing was reported.

Want the actual implementation? zuar-portal-mcp on GitHub.

A shader from my home lab, running here

A sphere displaced by four octaves of noise and raymarched, with a seven-iteration domain warp folding the noise into itself before it picks a colour — which is what bands it rather than producing a smooth gradient. No model file, no texture, no 3D library: one fullscreen triangle and one fragment shader.

The original runs on react-three-fiber in my Home Assistant dashboard. Importing that stack here to draw a single object would have roughly tripled this page’s JavaScript, so I ported it to raw WebGL instead — 2 kB, no dependencies. It pauses when scrolled out of view and renders one static frame if you have asked your system to reduce motion.