RK

TrustHeader bug bash: five fixes shipped, 17 bugs logged

Log
Published
Session
11 Oct 2026, 12:57 to 15:23 UTC
Project
dmarc-reporties
Agent
Claude Code
Model
claude-opus-5-5
Tags

Value

3.1

■■■□ of 4

Time

1h 05m

active

Elapsed

2h 26m

wall-clock span

Commits

3

from this session

Cost

$22.13

model spend

Tokens

141k

uncached in, plus out

Tool calls

268

by the agent

Outcomes

11

7 left open

Summary

Written by the summariser

Run a bug bash on production TrustHeader using browser walkthroughs and backend error telemetry, log each finding as a task, and capture UX recommendations for a later design pass.

Rob asked for a bug bash on the production TrustHeader app, combining browser walkthroughs with backend error checks in the Grafana telemetry stack. The agent went through the dashboard page by page, enrolled two unenrolled test domains, ran a spam check on a synthetic message, and created then removed a scheduled export. It fixed five defects, covering wrong overview counts, false DKIM drift, a misleading assessment message, a probe container that ignored stop signals, and clipped form controls. Rob approved merging the release PR, and production confirmed the overview fix, which now shows 1,049 authentically included messages instead of 0. The remaining findings were logged as 17 bug tasks and 10 UX child tasks under one parent for a later design pass. The probe fix can only be confirmed when the daily probe runs, and most bugs are still open.

What came out of it

  • Fixes pushed as [commit]. CI passed and the staging deploy succeeded.
  • Release-please PR #92 was squash-merged as [commit] (release 0.35.2). The production deploy (run 38146891394) succeeded.
  • Production overview now shows 1,049 authentically included messages, up from 0. Regression tests were added for this and for the false-drift fix.
  • Fixes: a SQL CASE compared the override subquery to a boolean, so authentic reports fell into 'unassessed'. Managed-record drift was reported when only the TXT order changed. 'No previous run' appeared when a failed run sat before the last scored run. The SMTP probe ignored SIGTERM because Node runs as PID 1 without a handler. Small form controls on about 10 pages had clipped text.
  • 17 bug tasks logged, MSS-0455 to MSS-0471. Highest priority: MSS-0455 (malformed TXT records reported as 'could not check'), MSS-0456 (large inbound copies lost to the deadline and CPU limit), MSS-0457 (silent assessment failures), MSS-0458 (about 200 nonexistent DKIM selectors shown as failing), MSS-0459 (enabled alert rules with no delivery channel).
  • UX parent MSS-0472 created with 10 child tasks, ready for a design pass.
  • Note added to MSS-0453 on the probe shutdown and billing checks.
  • Production changes: enrolled a test domain and a second test domain. Ran a spam check with a synthetic message. Created and removed a weekly scheduled export. Added the bug-bash-email channel, attached to 'New sender detected', and a test email was delivered.
  • Backlog task commits [commit], [commit] and [commit] are local only and not pushed.
  • Two clean leftover worktrees were removed, as Rob approved.
  • A follow-on set of 21 tasks (the bug fixes plus MSS-0454, MSS-0472.07 and MSS-0472.03, with MSS-0456 starting from a design pass) was prepared. Its lint checks passed, but it has not been started.

I ran a bug bash on production TrustHeader this week. I asked my coding agent to click through the app the way a user would, then check for trouble in two places: results that looked wrong on screen, and errors coming out of the backend and workers. Those backend errors land in our Grafana telemetry stack, so the agent could query them there to find out why things were failing. I also asked for UX suggestions based on screenshots of each page, and gave it permission to enroll a couple of unused domains so it could test the add-domain flow properly.

Working through the dashboard page by page turned up plenty. The agent fixed five of the quicker problems:

  • The overview showed zero authentically included messages, even though reporter coverage showed 14 real reports in the same window. A SQL case statement was comparing the wrong thing, so every authentic report fell into "unassessed". On production, the overview now shows 1,049 authentically included messages.
  • Managed DNS records were flagged as drifted when nothing had changed. Only the order of the TXT values had rotated, and DNS record sets are unordered.
  • The assessment score said "No previous run" whenever a failed run sat between it and the last scored run.
  • The SMTP probe container never stopped when idle. Node was running as PID 1 with no handler for the stop signal, so it ignored it. That would also have broken the stop and billing checks on the probe shutdown task, so I've added a note there.
  • Small dropdowns and inputs on about ten pages had their text clipped by a global padding rule.

The fixes went out in release 0.35.2 after I merged the release PR. So far only the overview fix has been checked on production.

The rest went into 17 bug tasks and 10 UX tasks under one parent, ready for a design pass later. The most serious is malformed DMARC records on two of my own domains. Each value starts with a literal quote, so receivers ignore them. That one is a DNS fix outside the product. Other serious items are large inbound reports hitting the time and CPU limits, and about 200 nonexistent DKIM selectors showing as failing. I also found four enabled alert rules with no delivery channel, so their alerts went nowhere. I added an email channel, confirmed a test message arrived, and attached it only to "New sender detected" for now.

Still open: the probe fix can only be proven on the daily run at 12:00 UTC on 12 October. I've also prepared a follow-on batch of 21 tasks, but I haven't launched it yet. It needs a fresh production login first.

Left open

  • The probe shutdown fix is unproven. The next check is the daily probe at 12:00 UTC on 2026-10-12, so MSS-0453's idle-stop and billing criteria stay open.
  • Only the overview fix was confirmed on production. The other fixes were not checked in the deployed app.
  • 17 bug tasks (MSS-0455 to MSS-0471) remain open. The UX design pass has not started.
  • Four enabled alert rules still have no delivery channel, so their alerts go nowhere until MSS-0459 is fixed or a channel is attached.
  • The DMARC TXT records on two enrolled personal domains are malformed: each value starts with a literal quote, so receivers ignore them. Rob needs to fix these in DNS, outside the product.
  • The follow-on set has not been launched. Rob has to launch it after the Access login, which expires around 15:22 UTC on 2026-10-12. The login step also printed a short-lived token into the chat log, which is backed up.
  • MSS-0472.03's copy list needs Rob's agreement, and that box is left for him to tick.