How to use Unknown to verify deployed logging
After four log lines and a redeploy, CloudWatch showed schema, truncation, document-redaction markers, and third-party logs inheriting run context.
dev.toPrompt to try
Editorial adaptation, not the source author’s exact prompt. Replace bracketed inputs and review tool permissions first.
Why is Block 0 going so slow? Did we over-gate?
Reach people exploring AI agents
See placements →What happened
After four log lines and a redeploy, CloudWatch showed schema, truncation, document-redaction markers, and third-party logs inheriting run context.
Reported by earlgreyhot1701d on dev.toHow the agent did it
- Ran an AgentCore deployment spike and corrected reported design discrepancies.
- Inspected CloudWatch after deployment and found the custom logger absent.
- Added logging calls and redeployed to verify redaction and context markers.
Where a person stepped in
The author approved work, inspected deployed logs, validated behavior, and questioned excessive gating of throwaway code.
A person approved each step before the agent continued.
The author was building Porch Light, an agent watching one city's public meeting agendas for one person. They directed implementation by Kiro, used Claude for review, and personally validated and decided. Block Zero was intended as a short stack experiment, including model invocation, a Strands agent, AgentCore deployment, and logging verification. It instead took a little over a build day.
During the deployment spike, Kiro reported five discrepancies between the architecture document and the actual product behavior rather than silently adapting. These included deployment tooling, runtime configuration, handler shape, configuration fields, and log naming. The deployed application then exposed a more consequential gap: its framework logger bypassed the designed logging module entirely.
Although twenty-eight tests passed, the runtime had not executed the redaction processor, size cap, or context binding. The team added four log lines and redeployed. CloudWatch then showed the intended schema, truncation and document-redaction markers, and a third-party credential message carrying run context. They subsequently vendored the logging module and wrote a synchronization script and byte-identity test, despite the deployment folder being marked throwaway.
Who it's for: Builders using coding agents who need to validate that tested controls actually execute in deployment.
Prompt
Original prompt
Source: dev.to · earlgreyhot1701d
Frequently asked questions
What did the passing tests fail to establish?
The logging module passed twenty-eight tests, but the deployed spike used the framework logger, so its redaction, size cap, and context binding never ran.
What evidence appeared after redeployment?
CloudWatch showed the schema, a [truncated:1000] marker, a [redacted:document_content] marker, and a botocore credential message with run_id and component.
More details
Remaining steps
- Vendored the logging module and added synchronization and byte-identity checks.
About this account
Kiro implemented and reported discrepancies; Claude reviewed against the author’s security rules.
Platform: dev.to. Attribution: https://dev.to/earlgreyhot1701d/block-zero-oh-no-claude-kiro-and-i-over-engineered-the-throwaway-5d42. Prompt: Original (quoted from source). Sourced by the Agents In Use pipeline.
Credit: earlgreyhot1701d on dev.to
Source published 1 Sept 2026
Source checked 14 Oct 2026
Tools and topics
Kiro · Claude · Strands · Bedrock AgentCore · CloudWatch
Runtime verification · Logging · Deployment spikes
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.