30 rejected
Decisions are append-only, including the unflattering ones
Every architectural decision is written to a ledger as it is made and
never rewritten afterwards. When thirty legacy classifications were
found to be wrong, the rejections stayed on the record rather than
being tidied away.
docs/decisions.md — "rewriting an append-only ledger to look tidier is the failure this system exists to prevent"
Measurement
Behaviour is measured in shadow before it reaches anyone
Changes run inside scoped observation windows and are compared against
the live path without affecting it. A window found to be invalid is
closed and its numbers discarded rather than quoted.
observation windows · validity scoping · cumulative metrics across valid windows only
Verification
Findings must survive an attempt to refute them
Detections are challenged before they are trusted, and the tests are
written to fail if the defect they describe is fixed by accident
rather than on purpose.
"a detector that survives its own fix" — classification coverage suite
Provenance
Purpose is derived by the database, not asserted by the caller
Whether a run is real traffic or a test is decided and persisted
atomically at write time. A client cannot claim its own execution was
production, so the metrics cannot be flattered from the outside.
execution_purpose — derived and persisted atomically; precedence, security and persistence under test
42 · 19
Schema changes are reconciled, not assumed
Forty-two migrations. Nineteen carry a rollback written alongside
them; the older twenty-three predate that practice and are
forward-only. When two migrations disagreed with deployed production
state, the files were reconciled to the database rather than the
database quietly re-run.
backend/supabase/migrations · 42 forward · 19 paired rollbacks