devops

One program directory baked into cmd_slice let a validation gate pass on someone else's evidence; a one-line env-override fixed it.

TL;DR: A slice gate silently validated the wrong program's evidence because the program directory was hardcoded in cmd_slice. The fix was one line: read an env var first, fall back to the default, matching the existing REPO_ROOT pattern. Run tools in two contexts and compare file references to catch baked-in constants early.

A hook that refuses direct commits is half a gate; a wrapper promised since Task 1 but never implemented turns security into a total lock.

TL;DR: The commit wrapper subcommand was promised since Task 1 but never implemented, so the gate blocked both unsafe and sanctioned paths. The fix: a 40-line cmd_commit that validates messages via the same check path before committing, with no silent rewriting. Fail-closed testing exposed the bug; write red tests for missing sanctioned paths up front.

A PreToolUse hook makes bare git commit from coding-agent sessions technically impossible, not merely forbidden in a document.

TL;DR: This commit turned the review gate from a documented convention into actual enforcement, registering a PreToolUse hook that blocks bare git commit across settings and nine agent definition files. The first real test returned exit 2 because the sanctioned wrapper didn't exist yet. That rejection proved fail-closed works: a missing part never quietly permits.

Four review:* tokens plus a board validator make agent review debt visible, countable, and batchable, while security surfaces never wait in a queue.

TL;DR: Reviewing every tiny slice cost 50-60k subagent tokens per round regardless of diff size, making review the largest session expense. The fix: every done row must carry a review token, enforced by a board validator, with non-security work batched until the queue hits three or the session closes. Security surfaces skip the queue, and tokens make review debt greppable.

Checkpoint v56 was built on an untested theory. Two down-file bugs, errors 1553 and 1364, surfaced the day down-to-0 ran again.

TL;DR: Migrations down to zero failed below checkpoint 56, disproving the untested ENUM theory behind it. Two rotted down files broke: a missing slug column and a dropped index that a foreign key depended on. A roundtrip test now proves the chain reversibility, replacing theory with measurable guarantees.

The down chain breaks mid-way: an old down migration inserts an ENUM value that no longer exists there. Checkpoint 56 is the tested safe window.

TL;DR: The migration roundtrip test stops at version 56 instead of unwinding to zero, because a cross-dependency between migrations 45 and 51 breaks any deeper descent. Version 56 is the deepest proven-safe checkpoint, verified with spot-checks on 8 tables and 12 columns. A separate test pins the dev-only login route to return 404 everywhere except development.

One changelog row can summarize six commits: curated module logs beat raw git history.

TL;DR: Six commits landed in one day, but the module changelog captured the whole shift in a single row. Turns out git logs record the mechanical steps of how code was built, while a curated changelog states what the product now does. Automation can list commits, but it can't infer triggers or QA flags, so human judgment stays essential.

A two-phase upgrade playbook: npm inside the running container plus an automatic custom-image fallback, verified against the version the app actually serves.

TL;DR: After upgrading 9router, the endpoint still served the old version because the container ran code baked into the image, not the freshly installed npm package. The rewritten playbook uses a two-phase approach: cheap in-container installs first, then building an image from source, with served-version verification, health checks, and automatic rollback. Running serial: 1 keeps failures contained to one host.

db-push replaced staging from a dev dump and accounts vanished. Two small dumps and honest guards keep them alive.

TL;DR: Staging users kept vanishing because db-push replaces the whole database with a dev dump that excludes the users table. The fix: dump staging users beforehand, then restore them after the import using --no-data, --complete-insert, and --no-create-info. Key lesson: dump and verify before any DROP, validate injected names, and lock down the hash-bearing file.