Notes
Decision records
Each note is one engineering decision: the context, the choice, what I rejected, the failure mode, and where to inspect it.
Why the evaluation set came before the prompt
Thirteen versioned fixtures run through the real retrieval and validation code in CI, with a fixed model output, so a weaker check fails the build.
Why the model cannot approve its own compliance output
Code checks retrieved citations, verbatim quotes, and dates in the rationale. A failed check is retried once with the errors, then a person reviews a hash of the analysis.
Why four automation vendors are not one operating model
n8n, Zapier, Make, and Power Platform keep their native artifacts. One control plane owns inventory, releases, and signed telemetry. A gated release cannot be approved by the person who proposed it.
Why a motor claim is a durable case, not an RPA script
Spring Boot owns the case and authorization. Temporal owns timers, human-task signals, and recovery. Python and RPA adapters stay replaceable; they do not become the claim.
Why broker delivery is not financial truth
Double-entry repayment state lives apart from broker delivery. A recovered message does not invent a posting. The ledger is the record; the bus is transport.
Why the BFF is the only public boundary
One RBAC-protected BFF is the door. Domain services and workers stay internal. The browser is a client of that door, not of the ledger or the broker.
How M-Pesa settlement survives missing callbacks
An immutable payment attempt is stored first. The order stays unpaid until a correlated callback or STK query matches the exact amount. Closing the tab does not settle.
Revoking media after an unknown delivery outcome
Rights are evaluated when the publish job runs, not when the file landed. Unknown delivery is a first-class state; compensating revocation stops a signed delivery scope immediately.
Break-glass FHIR access that cannot hide in cache
A missing policy input denies. Emergency grants last at most thirty minutes, are audited, and are never served from an authorization cache.
Handling out-of-order fleet telemetry without rewriting history
Observations are immutable. Redis holds live state only. Late, duplicate, and noisy GPS still land as receipts; current location and ETA are rebuildable projections.
Temporal pricing without rewriting historical invoices
Prices are effective-dated. Receipts and final invoices are append-only. A price change creates a new version; it does not mutate invoices that already shipped.
Why WooCommerce stays the catalogue of record
Search, carts, and UI state are replaceable projections. Checkout creates a pending WooCommerce order and revalidates price and stock on the command path.
Scoring automations without hiding the math
Intake is schema-validated JSON. Scores, ROI, and gates are computed from the numbers you supplied. High-risk proposals still require a person; the toolkit does not fund work.
Why operators need idempotency keys too
Retry and cancel require an Idempotency-Key and an expected version. Double-clicking at 2 a.m. must not start two recoveries; stale versions return 409.
Why the resource server validates the token again
The gateway forwards the original access token. The protected service checks issuer, audience, and JWKS independently. A compromised edge is not every system.
Why third-party APIs get a typed boundary
Timeouts, auth, circuit breakers, and contract validation sit in the adapter. An agent or workflow sees a safe result, not a provider body, an unbounded retry, or a leaked token.
Why at-least-once delivery is a product decision
Accepting a webhook and enqueueing later opens a window where the event exists only in memory. A signed envelope is persisted first; duplicates and dead letters are operator-visible.
Why reliability claims have to be replayable
Query plans, cache circuit breakers, Toxiproxy outages, and bounded remediation are experiments you can run. An availability claim here comes from an injected failure you can replay.
Why a workflow must survive the process dying
PostgreSQL is the system of record. Redis only dispatches. A crash can duplicate a queue message; a leased worker treating queued as the claim makes the duplicate a no-op.