When an automated loop exhausts its retry budget, the safe next step is not another turn through the same controller — it is a distinct recovery path with its own admission rules. Most automated workflows have a retry loop somewhere, and the interesting question is rarely what happens inside the lim...

Many release pipelines automate everything up to the moment a human says "yes," then quietly hand the rest back to a person. Closing that last gap looks like a small scripting task. It usually isn't. The hard part after human acceptance isn't running one more command — it's deciding who is allowed t...

Automating the steps around a pull request looks like a sequence problem: prepare, open, verify. The real work is identity, external truth, evidence ordering, and authority. Get those wrong and you either block valid work forever or claim success you cannot defend.

The problem

The apparent task is...

The moment you let an automated system retry its own failed work, you have introduced a loop. And a loop with no bound is a liability. So you add a budget: three attempts, then stop and escalate. That part is easy to describe and easy to get wrong, because the hard question is not how many retries y...

We had a shared secret scanner. We had a comment saying it covered every path that assembled context and sent it to an external model. Both were true right up until they weren't: one assembly path had quietly grown up without ever inheriting the scanner. Nothing detected the gap, because the claim o...

When a secret scanner rejects a symbolic environment-variable name instead of a credential value, the visible bug looks like a false positive. It usually is not. The durable defect is duplicated security policy—the same rule implemented independently in several paths—creating inconsistent behaviour,...

Making parallel work safe is not just creating a branch earlier. The durable fix is a lifecycle isolation model: reserve identity before the first durable write, give each item its own worktree, treat the active worktree as execution truth, and prove ownership before any rollback deletion.

The prob...

A governed workflow can block premature execution and still record a lie. When durable state says you have reached the next stage while a human gate is still pending, dispatch protection alone is not enough. The fix is to align three truths: the recorded lifecycle stage, the gate status, and who is ...

A request to "add a spinner" often hides a distributed-state problem. If the object stays on screen while the action runs, the product needs task-scoped pending feedback, blocked repeat actions, settlement through refreshed data, and a single clear progress indicator—not just a visual loading state ...

A command that stops for human review can look like a failure if you read only the process exit code. The durable fix is to classify structured outcomes deliberately, preserve evidence on every path, and assign exactly one owner for failure output.

The problem

The symptom was familiar: an interact...

When a worker occasionally returns malformed Markdown, the visible bug looks like a formatting mistake. It usually is not. The durable fix is to align the worker prompt, canonical grammar, parser, writer, diagnostics, and documentation as one contract family—and to classify every rejection with a de...

When an operator types a repository path and the system disagrees about spelling, the visible bug looks like a casing or formatting problem. It usually is not. The durable fix is to reconcile Git's registered worktree identity against the filesystem object identity at the shared authority boundary —...