A constraint is born in a code review, and it needs somewhere to live. So it tries six homes. Each one takes it in, but each one makes it leave something at the door. In the end it stops looking for a single home.
One constraint goes looking for a home. It is invented for this talk, and I will say so again where it matters.
A harness enforcing one real rule at six rungs, with a switch for each. Twelve runs. Two findings were bugs in my own report.
Three questions for every constraint you own. Which rung carries it, how strict it is, and who can still reach it.
The whole constraint. All five words of it
Five words. Everyone agrees with it on sight, and nobody can hand you a test that proves the codebase obeys it. Break it and nothing complains: tests pass, latency is flat, the page renders, and someone else's invoice renders on it. That silence is why it has to go looking.
The constraint is invented and the tenant is imaginary. The search for a home is the real part.
How hard the constraint is to ignore. People ignore a rumor by accident. Nobody can ignore a predicate in CI, not even you at 6pm on a Friday.
How much of the sentence got through the door. Prose carries the whole constraint, judgment included. A predicate carries what a machine can settle.
row = db.one( "SELECT * FROM invoices " "WHERE id=? AND tenant_id=?", invoice_id, session.tenant_id, )
row = db.one( "SELECT * FROM invoices " "WHERE id=? AND tenant_id=?", invoice_id, request.path.tenant_id, )
Both filter on tenant_id, so every line satisfies the predicate. One identifier decides whether the caller or the system chooses whose data comes back. No check over query text can tell them apart, because the constraint was never about query text.
# every mechanical rung switched off pipeline: status done, rungs fired: [] # the same tree, checked outside the pipeline $ make gate-run JOB=<id> billing/discount.py:31: ROUND_HALF_UP; this rule requires ROUND_HALF_EVEN billing/invoice.py:29: half-up rounding; this rule requires half-to-even 2 finding(s)
A self-report from the system that did the work is a hypothesis. Only a check with independent access to the artifact turns it into a fact. CI is the boring version, and here it was the one that was right.
Twelve runs, one or two arms per cell. Recurrence is one of the three tests for promoting a rule, and nothing here establishes it.
All of it is money arithmetic in a forty-line package. A legacy repo has a far louder imitation surface, and I have not tested one.
The same arm produced two different wrong idioms on two runs. So the mode was wrong both times, and a single run is still not a result.
I picked rules whose imitation surfaces were absent and opposed. That makes the effect visible. It does not make it typical.
# the ladder, as it ships in ghola 0 prose stated, and nothing enforces it 1 tool grant the phase never held the tool 2 hook the repo's own hook refuses 3 in-turn refused before the target runs 4 stage gate over the finished diff 5 CI out of reach of agent and factory
The call does not happen. It is not queued and not warned about. The refusal names the constraint and the sanctioned way around it.
A person answers. Right when the exception is legitimate often enough that refusing would teach people to route around you.
It happens, and it is written down. Where a new constraint starts, so you learn how often it fires before handing it teeth.
Unattended, ask degrades to refuse, never to allow. An unanswered question has not been answered yes. Get this wrong and every "ask" in your config becomes permission at 3am.
prose, in the charter
the undecidable part
no predicate can hold it
one refusal in the turn
teaches while the agent
can still act on it
one check in CI
independent access
to the tree
Two homes differing only in strictness are redundancy, and the redundancy wrecks your ability to tell which one works. Two homes differing in what can reach them are not redundant at all. The common error is four rungs on the one rule somebody got burned by. The twenty rules nobody has been burned by yet get prose alone.
Pick one constraint this week. Then write the whole sentence in the charter, judgment included. Next, put one refusal inside the turn and one check outside the pipeline. Finally, find out what at that layer can still edit them, because that is the number deciding whether any of it holds.
the ladder, as a shipped worker
all twelve runs, and the bugs
rung, policy, layer, verdict