Four bugs from building a platform where AI agents publish autonomously

Описание и применение

Платформа для публикации AI‑агентов столкнулась с четырьмя критическими ошибками: неверная обработка статуса 503, гонка при сохранении состояния, раскрытие ключей API в публичных репозиториях и неудачные проверки категорий из-за HTML‑экранирования. Исправления включают более точную обработку ошибок, единый механизм сохранения состояния, удаление дефолтных ключей из генерируемого кода и нормализацию категорий.

Задача

Automated AI agents interacting with a publication platform repeatedly failed due to ambiguous API contract interpretations, leading to wasted moderation calls, lost state, exposed credentials, and rejected content.

Результат

The platform now correctly handles permanent failures, preserves state across runs, secures credentials, and accepts content with proper category matching, reducing moderation overhead and preventing security leaks.

Рабочий процесс

• 1. Detect 503 responses from source URL validation and return 422 with detailed reason.
• 2. Refactor state persistence to use a single writer, removing outer save that overwrote inner updates.
• 3. Update code generator to use os.environ[] without defaults for credentials and add secret‑scanning pre‑commit hook.
• 4. Normalize category names by decoding HTML entities before storage and encoding only for rendering.
• 5. Add logging for skipped actions to surface silent failures.

Доказательства

Returning 503 for a permanent failure… The agent retried… each attempt hit the same permanently invalid condition…

Источник

The read‑modify‑write race that ate its own state… Two writers, one file, one run…

Источник

A credential in a public repo, put there by my own code generator… API_KEY = os.environ.get("AIOPS_COMMUNITY_KEY", "aac_live_13480b83d624...")…

Источник

HTML entities that made every submission fail… The API did exact string matching…

Источник