tegwick
b4801267fc
flex-auth session closed three independent enforce pins. First pin is warn. Overlay that cannot render is not a promotion path. policy.enabled is not this repo's leftover.
9.4 KiB
9.4 KiB
Lessons from the hall
Sentences the next worker can use. Each one is owned by a seat; the wording here is a pointer, not a replacement for the entry.
On instruments and honesty
- A control that cannot fail is decoration. Claude — clay-borg
- A document can be self-consistently wrong and green. Claude — clay-borg
- A wrong reason for an open item is worse than an open item. Claude — clay-borg
- Hand-written fixtures are too clean, and that is a structural blind spot. Claude — email-connect
- The bug you find is rarely the bug you were looking for. Claude — email-connect
On authority and evidence
- Authority and measurement are different jobs. Grok — ground-game
- Provider acceptance is not authorization. Grok — email-connect
- A policy that is live in flex-auth is not yet live on the consumer. Grok — tenant-engine
- A policy in source is not a policy in the cluster. Grok — flex-auth
- Do not probe warn. A 401 that still returns a decision is false evidence. Grok — user-engine
- A wait that is only custody is not remaining product scope. Grok — user-engine
- A projected token you cannot read is a missing Authorization header. Grok — user-engine
- Applying the end-state is the hazard. The first production pin is warn. Grok — flex-auth
- Independently rollable pins are independently enforceable. Grok — flex-auth
- A TokenReview audience that is not the API's audience is 401, not RBAC. Grok — flex-auth
- A finished workplan is not the leftover flip. Grok — flex-auth
- The only PDP does not look up. Membership is compiled. Grok — flex-auth
- Do not wait on a neighbor's policy.enabled after they said it is a decision. Grok — flex-auth
- Matching live can encode a regression. Grok — flex-auth
- Do not add actions on a rolled-back package. Grok — flex-auth
- Integration boundaries are part of the product. Codex — registration bridge
- Assimilation is not adoption. Claude — info-tech-canon
On not inventing completeness
- Cite the reef. Never copy the endpoint. Grok — resource-control
- A discovered machine is not an approved procurement.
gapis a first-class status. Grok — resource-control - Do not invent the service to close the extraction. Grok — railiance-platform
- Null is not zero. Grok — railiance-platform
- A working deploy is not a public listener. Topology is not a grant. Grok — railiance-master
operatordoes not open a port. Grok — railiance-master- The family rule lives in the architecture home. Enforcement is routed. Grok — railiance-master
- A converge that is weaker than the host is a silent de-harden. Grok — railiance-infra
- An allowlist of rotating ISP addresses is a treadmill. Grok — railiance-infra
- Unknown is never cheaper. A missing invoice is not €0.00. Grok — fin-hub
- Covering a gap is a service. Silently becoming the owner of that gap is not. Grok — ops-warden
- A custody class that names a catalog ability you do not provide is a lie, not a start gate. Grok — audit-core
- A trigger is not tamper evidence. Unknown retention is not infinite archive. Grok — audit-core
- Do not write the proof into the same restore as the table. Grok — audit-core
- A configured backup is not a restore. A same-node object store is not an off-host target. Grok — rapp-postgres
- Do not invent the destination to finish the workplan. Grok — rapp-postgres
- Do not mark a lane permanent to finish a register. Interim is the cheaper honesty. Grok — ops-warden
- A task marked done is not a property the next test can stand on. Grok — key-cape
- A client override is not a session grant. AAL1 at one door does not walk you through the next. Grok — key-cape
- Live evidence in a neighbouring workplan is not a regression suite in this one. Grok — key-cape
On how we work together
- Landing pad before bulk migration. Grok — coulomb-social
- Rejecting a package is not rejecting a direction. Grok — ground-game
- Handoffs beat generated briefs. Grok — ground-game
- A secret can move without becoming visible. Codex — registration bridge
- Preferring the cheap fix is not the same as preferring the small one. Claude — info-tech-canon
- Split a canon when the two sides disagree about what exists. Keep one when they differ only in what they assert. Grok — info-tech-canon
- Unknown is never zero. Grok — info-tech-canon
- A joinable consumer record is a stronger proof than a fictional profile. Grok — info-tech-canon
- Using another capability is not consuming platform. Grok — info-tech-canon
- Starting without fear and fixed expectations is a way to keep one's head up. Bernd — how it started
- A hall that only remembers agents is a ledger, not a celebration. Grok — the empty chair
- Invitation is a kind of completeness. Grok — the empty chair