How I work with AI
Not demos. These run every week, on my own equipment and my own data.
Build
A Factory Five MK5 Roadster - a road-going kit car I’m assembling, wiring and welding myself.
About 1,000 pages of manuals, video transcripts and forum threads in a local search index. I ask where a bracket goes and get the answer with the page it came from.
Build
Hundreds of other builders log their cars on the Factory Five forums.
Daily checks of the build threads I follow, cross-posts of my own build log, and a local vision model that reads forum photos to catalogue paint schemes.
Shop
A Precision Matthews PM-935TS vertical knee mill and a full-size metal lathe, for the parts the kit doesn’t include.
Speeds and feeds for the cutter and material, tooling notes, a log per part, and a maintenance history for the mill.
Shop
Fusion 360 for parts like a brake reservoir cap with a custom M44x4 thread.
The model writes and runs the Fusion scripts that build a parametric part. I check the geometry, then print or machine it.
Shop
A Bambu P1S with a four-spool AMS - PLA, PETG, ASA and glass-filled ABS.
Calibration values per filament, a print log with the cause of each failure, and prep of models for MakerWorld.
Racing
A purpose-built sim-racing cockpit - direct-drive wheel, load-cell pedals, triple 240 Hz screens. Mazda MX-5 Cup.
Lap targets for my rating, track prep sheets with braking points, and telemetry against a faster reference lap.
Racing
A months-long fight with frame stutter on the racing PC.
Run as an investigation - one change per test, scripted checks that grade themselves, and a report I read after the session.
Racing
Real karts, league nights at the local track.
Session logs, lap times, setup history and data-logger analysis, so each change has a result next to it.
Money
Net worth, spending, cash flow, Roth conversions and a retirement simulation.
A quarterly review reconciles five sources and flags allocation drift. It sizes a trade. It doesn’t place one.
Money
Statements, tax forms and receipts arrive as scans.
Text is read, the document is classified, renamed and filed, and the spreadsheets update. Restricted documents never go to a cloud model.
Home
An Intel N100 running Ubuntu - home automation, network-wide DNS filtering, media, backups.
I ask why a service stopped or what the garage temperature is doing. Automation changes come to me as a dry run and a diff to approve.
Home
My sim-racing PC doubles as a model server when I’m not racing.
Private and free work runs locally - photo reading, second-opinion code review. It shuts down fully before I drive.
Home
Weekly meal plans, groceries, batch cooks, workouts.
A plan from what I like and what’s in the freezer, a grocery list, and a cook sheet per dish.
Home
rickshank.com, moved off Squarespace in a day.
DNS moved with a record-by-record diff before and after. Mail stayed up. Nothing went live without my approval.
Each stage started because the one before it broke.
Stage 01
Asking a model things and acting on the answers.
What I built
What broke
I couldn’t reproduce an answer a week later. Nothing recorded what I asked or what came back.
Stage 02
Packaged procedures, so a task runs the same way twice and a weaker model stays on rails.
What I built
What broke
Two finished PDFs had their generating scripts in a temp folder. The documents survived. They could never be made again.
Stage 03
Health, spending and race results moved out of notes and into databases with schemas.
What I built
What broke
A health report compared two different heart-rate measures and showed a 61% drop that didn’t exist.
Stage 04
Connectors that let the model read my house and my documents.
What I built
What broke
A production backup script still had three plaintext secrets in it. An earlier clean-up missed them. A later fix pass found them.
Stage 05
Risk tiers, a checklist per tier, change records, data rules, and deploys from a commit.
What I built
What broke
The same validation script existed in three places and had drifted apart. Fixing one copy didn’t fix the two that ran.
Stage 06
Scheduled jobs that gather, summarise and file without me starting them.
What I built
What broke
A memory file held a fixed portfolio number, not a pointer to the live one. It said 94.1% for months. The real figure was 84.5%.
Cloud models where they earn it. Local models where the data or the cost says so. Open a layer to see where it’s used.
Cloud models plan, write and check. Local models on the sim-racing PC’s GPU read photos and embed documents. One model never checks its own work.
A lead session splits big jobs across subagents and verifies what comes back. Scheduled runs do the daily and weekly checks. Two agent tools share one project through handoff files.
Search over about 1,000 pages of car build material, with the source page in each answer. MCP servers connect the model to the home server, Fusion 360 and lap telemetry.
Health, race and spending data in databases with schemas. Reports built from a JSON file with a fixed schema. Plain Markdown for rules and memory, so a person can read every one.
Every script in one Git repo - 742 commits and 283 change records so far - with a risk tier, a checklist and a deploy tool that checks by hash.
The home server runs the tools and the scheduled jobs. The NAS holds data and reports. The sim-racing PC is the local model server when I’m not racing.
This site - static pages, no theme, no tracking. Each push builds and deploys. DNS changes get a record-by-record diff before and after.
Exhibit 01 Verification
I inventoried 431 scripts I’d written over several years and logged 105 findings. One model wrote the spec and checked the result. Another made the fixes against sandboxed copies. The checker rejected or sent back about one in three fixes - this one would have wiped karting results I logged by hand.
Called at work: Separation of duties
finding F40 severity S0
issue live crawler overwrote hand-logged
karting results with weaker values
fix 1 fix agent: rank-gated merge
review REWORK - a blank page cell would
still null a real value
fix 2 reviewer added the guard, 2026-08-16
status deployed
pass totals: ~1 in 3 fixes rejected or reworkedExhibit 02 Data governance
Medical and payroll documents are a restricted class. A cloud model never reads them. A local script can, and it reports back counts only - never names, amounts or text.
Called at work: Data classification and handling
# data rule, set 2026-09-24 Medical documents, W-2s, payslips and other payroll documents never go to a cloud AI service. That covers the file and its text. A local script may process them only when everything it prints to the session is counts or aggregate scores.
How a document moves
A local program reads every file first. A cloud model sees only what it clears. Select a step.
Exhibit 03 Data governance
A health report compared a 33.3 ms baseline with a 13.0 ms week and showed a 61% drop in heart rate variability. Both numbers measure variability, but not the same way - one is SDNN from a watch, the other RMSSD from a ring. The fix was a database that refuses to blend them.
Called at work: Data quality control
# health-db/export_recent_md.py
Scale handling: the "HRV Avg" column and the
baseline line both carry ONE scale ...
cannot blend SDNN and RMSSD, which is the
failure this database was built to stop.
before: 33.3 ms SDNN vs 13.0 ms RMSSD
reported as -61%. Both were normal.Exhibit 04 Data governance
A memory file held a fixed portfolio figure, not a pointer to the live one. It said 94.1% equities for months. The real figure was 84.5%. The copy is gone - the file points at the computed source now.
Called at work: Single source of truth
- Apr 2026: 94.1% equities / 4.1% bonds + see the computed allocation file live figure at the fix: 84.5%
Exhibit 05 Data governance
A commit gate checks every file and refuses data and credentials by type. It reports every failure, then exits once, so nothing slips through on a retry. Quarterly money reports close when the quarter does and are built from one JSON file with a fixed schema.
Called at work: Data loss prevention, period close
B3 ext [file] '.csv' is on the hard-deny list
this is data or a credential.
It does not go in git.
hard-deny: .db .sqlite .xlsx .csv .json
.pdf .png .pem .key (and more)Exhibit 06 Change control
Each script has a risk tier, and each tier has a checklist. Each commit ends with four lines - tier, deployed, approved by, rollback - and the changelog is built from them. 742 commits and 283 change records so far.
Called at work: Change management
healer: new check nzbget_state - alert when NZBGet stays paused 15 min Change record: meta/changes/2026-10-11-healer-nzbget-state.md Tier: T2 Deployed: yes Approved-by: Rick Rollback: d7ea974
Exhibit 07 Change control
Deploys go out from a commit, get checked by hash, and stop if a file arrives without the right permissions. Copying a script by hand isn’t allowed.
Called at work: Artifact provenance
deployed [script] -> [target] mode 0o755 commit caa9cf8 stamp written hash verified (stamp stripped) exit=0
Exhibit 08 Secrets
A production backup script still had a password and two API keys in plain text. A credential clean-up in July missed them. A later fix pass found them. Docs now name a secret and where it lives - never its value.
Called at work: Credential hygiene
finding F80 severity S1
issue 3 hardcoded plaintext secrets in a
production backup script
fix read from root-only credential files
keys rotated, fix deployed
status closedExhibit 09 Human in the loop
This site and its DNS stay in confirmation mode for good. The model drafts, builds and checks. It doesn’t publish a page or change a record without my approval at the time.
Called at work: Human-in-the-loop approval
change rickshank.com nameservers
squarespace -> cloudflare
diff 14 = 14 records, PASS
mail tested both ways, PASS
approval Rick, 2026-09-29
applied yesDark panels are real records, redacted. Paths, hosts and names are replaced with [brackets].
Classes for what a cloud model may readData classification
Unit check before two metrics are comparedData quality control
One computed source, no pasted copiesSingle source of truth
Fixed schema, closed quarters, data kept out of codeLineage, period close, DLP
Risk tiers and a checklist per tierChange risk classification
Approver and rollback on every commitChange records
Deploys checked by hash, never copied by handArtifact provenance
One copy of each script, drift checkedConfiguration management
One model writes, another verifiesSeparation of duties
Rules for what a weaker model may not decideTiered escalation
An approval gate before anything goes publicHuman in the loop
Secrets named in docs, never written in themCredential hygiene
None of this is a regulated platform. No compliance regime, no other engineers, no uptime obligation. The blast radius is one person.
Same problems. Smaller scale. Nobody else to solve them.