That Paleo Chick

The instruction that produces a believable food photograph is the opposite of the obvious one. Not crisp, bright and professional, which reads as synthetic at a glance, but a candid homemade phone photograph: natural window light, imperfect, crumbs and drips, not studio. Style is picked deterministically from the dish, so the feed varies while rerunning the same recipe produces the same image choice. Reruns stay predictable, which is what matters in a pipeline you have to debug.

Product links are generated from a registry that lives in the pipeline repository rather than the theme, which looks backwards until you notice that the weekly newsletter has to build the same links and email clients run no theme JavaScript. One registry and one matcher feed both surfaces, so the same sentence links to the same product in the email and on the page. The generated theme file carries a fingerprint of the sources it came from, and a test asserts that the fingerprint in the shipped bundle is current, so a regenerated registry cannot go out without its rebuilt bundle.

In-content advertising is placed immediately before a section heading, so it reads as a break between sections rather than something dropped mid-thought, and never beside the recipe card. Each slot is handed to the ad network only when it comes near the viewport, so a reader who bounces off the introduction never paid to download three advertisements they scrolled past. The signed-in member check is the absence of the configuration rather than a second condition: the config renders nothing at all for a member, so there is one place that decision is made.

Scheduling published articles out to social needed a visual board, and the scheduler has no plugin system, so extending it would have meant forking and maintaining a container image. I built a small companion application beside it instead, driving it through its API, reachable only through the reverse proxy and authenticated against the scheduler itself. It shows every published article against live per-network status, generates captions with a model, and creates the scheduled posts after a human edits them.

Single sign-on into the scheduler looked like an afternoon. It is not. The provider model is one authentication method per account, so linking an existing account breaks its password login outright; the sign-in flow reuses an unrelated integration client and redirects to a page that is itself behind authentication, so a logged-out user never completes it; and registration is disabled by design. Making it work would mean patching the callback and forking the project. I wrote down why, and left password authentication alone. Per-network connections still use OAuth, because there they genuinely work.

Membership is billed through Stripe on the website. The app reflects what somebody has paid for and never sells anything, which keeps it inside the reader-app rules and keeps a payment platform out of the mobile release cycle. The gating ships switched off: every gate is currently inert, and it stays that way until the tiers are deliberately turned on.

Reads go through a cache with a time-to-live: inside the window it serves from cache, past it, it refetches and falls back to the expired cache on any network error. Favorites, the shopping list and the meal plan live on the device. The result is that a kitchen with no signal is a working app rather than a spinner, which is the actual context this gets used in. The content API also caps every page at 100 rows, the same cap that broke the category index, so the client paginates rather than trusting a request for everything.

Each area of the app is gated by a flag that combines an owner override, remote configuration and a shipped default, and that is then combined with automatic degraded-service detection, where repeated network failures mark a capability degraded on their own. Both layers are offline safe and neither can throw or block a screen. The standing rule is that a new feature ships with its flag, its gate, its health wiring and a three-case test, or it does not ship.

Releases authenticate and sign through an App Store Connect API key with automatic provisioning, rather than a shared certificate repository, which does not work on this team's account. Version comes from the git tag and the build number is derived from what is already uploaded, so two people cannot collide. A tag produces a TestFlight build; submission is a deliberate, separate action.