Uncommon Waters
Academy
← 101 BuildWeek 3 · Nov 23 – Nov 27

Plan before you build

three boxes, checks that do not lie, data, and login

A written three-box plan (Browser, Server, Database + PII) merged before the build; two related tables and login, where each user sees only their own rows; one deterministic check in CI that fails when the refusal breaks.

Monday · 90 minutes live

  1. 15′Frontier failure: 'row-level security is enabled,' said the agent. It was not. A check that runs the same way every time beats an agent's description.
  2. 20′The three boxes (Browser -> Server -> Database) and test data vs. real user data (PII). Write PLAN.md: pages, tables, who logs in, what is PII, and what we will not build. The agent critiques it; you decide.
  3. 15′Deterministic validation: a script that says pass or fail, the same every time. Write the check before the feature. CI runs it on every PR.
  4. 30′Hands on: Supabase, two tables, login by magic link, each user sees only their own rows. The refusal check in CI.
  5. 10′Buddy attack: log in as yourself, try to see the partner's rows.

Tuesday to Thursday · you build

  • PLAN.md (with the three-box map and PII line) merged before the first data PR.
  • Two related tables, login, row-level security on user tables.
  • Refusal check in CI: wrong user, other user's rows, expected refusal.

Office hours · two 30-minute blocks

  1. 1Tuesday: Supabase connections, login loops.
  2. 2Thursday: checks that pass when they should fail.

Exam whisper · five minutes of vocabulary

OpenAI Academy AI Foundations, second half, sit the badge assessment. Exam Whisper: PII and data classification, RAG vs. fine-tuning vs. prompting, embeddings and vectors.