novox/hq
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Accept 0034 and 0018; 0011 is superseded

Browse Source 
0034: a test defends a decision. §5 carried it marked "proposed, pending
review"; the marker is removed and the rule now stands unqualified. The lab was
already built to it, which is the inversion §5 exists to catch — closed now
rather than left standing.

0018: the mesh creates no symlinks. §3 said the installer owns the links today
and the INTENT was that the mesh creates none. It is no longer an intent, so the
wording says so, and ADR 0011 becomes superseded rather than edited — its
reasoning is why the rule exists at all, and the incident behind it is the
reason anyone believes either record. The links the installer still reconciles
are a migration, not a permission.

The constitution sync (§6 step 4, playbook 05) is NOT done. An unsynced rule is
a rule the mesh does not enforce, whatever this document says — and publishing
it changes what every design meeting is checked against, so it wants saying out
loud rather than doing quietly.
This commit is contained in:
jschoubben
2026-08-25 23:08:54 +02:00
parent 4866007c04
commit f5073b9b00
4 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
00-META/how-we-build.md
+1 -3
View File
@@ -39,7 +39,7 @@ incident behind it is not written down, and the fix is to write it down, not to
| **Never write to a production database directly** | No insert, update, delete or schema statement executed against production by hand. Schema changes go through numbered migrations; data changes go through application code or the module's own capabilities. Raw statements skip every side effect the proper path has — events, audit, cache invalidation, fan-out. | | **Never write to a production database directly** | No insert, update, delete or schema statement executed against production by hand. Schema changes go through numbered migrations; data changes go through application code or the module's own capabilities. Raw statements skip every side effect the proper path has — events, audit, cache invalidation, fan-out. |
| **Every schema change is a migration** | Numbered, in the module's own language, compiled with it. Both a baseline for a fresh installation *and* an incremental migration for installations that already exist. If code references a column, the migration creating it must exist. [ADR 0006](../02-DECISIONS/0006-schema-changes-are-numbered-migrations.md) | | **Every schema change is a migration** | Numbered, in the module's own language, compiled with it. Both a baseline for a fresh installation *and* an incremental migration for installations that already exist. If code references a column, the migration creating it must exist. [ADR 0006](../02-DECISIONS/0006-schema-changes-are-numbered-migrations.md) |
| **Never bypass the pipeline** | No manual database edit, no manual restart as a workaround. Fix the cause and deploy. A workaround that works is a workaround that is never removed, and the next person cannot tell the node from its declaration. | | **Never bypass the pipeline** | No manual database edit, no manual restart as a workaround. Fix the cause and deploy. A workaround that works is a workaround that is never removed, and the next person cannot tell the node from its declaration. |
| **Never create a symlink** | A hand-made link caused production data loss through container volume resolution, and the judgement needed to make a safe exception is exactly the judgement unavailable at the moment it matters. Today the installer owns and reconciles the links the mesh still uses [ADR 0011](../02-DECISIONS/0011-the-installer-owns-linking.md); the intent is that the mesh creates none at all [ADR 0018](../02-DECISIONS/0018-the-mesh-creates-no-symlinks.md). Neither reading permits you to make one. | | **Never create a symlink** | A hand-made link caused production data loss through container volume resolution, and the judgement needed to make a safe exception is exactly the judgement unavailable at the moment it matters. **The mesh creates none at all** ([ADR 0018](../02-DECISIONS/0018-the-mesh-creates-no-symlinks.md), which supersedes [ADR 0011](../02-DECISIONS/0011-the-installer-owns-linking.md)). The links the installer still reconciles are a migration, not a permission. |
| **Never push directly to the main branch** | Branch, push, review, merge. Every merge is a human checkpoint, without exception — **including in this repository**. A documentation repository is not a lower tier of care; a decision record lands the same way a service does. | | **Never push directly to the main branch** | Branch, push, review, merge. Every merge is a human checkpoint, without exception — **including in this repository**. A documentation repository is not a lower tier of care; a decision record lands the same way a service does. |
| **One change per pull request, and never merge your own** | Unrelated improvements bundled together cannot be reviewed or reverted separately. Self-merging removes the checkpoint that is the entire point. | | **One change per pull request, and never merge your own** | Unrelated improvements bundled together cannot be reviewed or reverted separately. Self-merging removes the checkpoint that is the entire point. |
| **Never open a pull request unprompted** | A permissions list saying it is allowed is not a request. | | **Never open a pull request unprompted** | A permissions list saying it is allowed is not a request. |
@@ -154,8 +154,6 @@ effect. Absence reads as success unless something looked.
### A test defends a decision ### A test defends a decision
*Proposed — [ADR 0034](../02-DECISIONS/0034-a-test-defends-a-decision.md), pending review.*
The rule above applies to prose. It applies to **decisions** too: a decision record states The rule above applies to prose. It applies to **decisions** too: a decision record states
something that must be true, and a test asserts it. A decision with no test is one that will something that must be true, and a test asserts it. A decision with no test is one that will
quietly stop being true, and nobody will learn that from a document. quietly stop being true, and nobody will learn that from a document.
02-DECISIONS/0011-the-installer-owns-linking.md
+2 -1
View File
@@ -1,5 +1,6 @@
--- ---
status: accepted status: superseded
superseded-by: 02-DECISIONS/0018-the-mesh-creates-no-symlinks.md
date: 2026-07-10 date: 2026-07-10
deciders: jochen deciders: jochen
reconstructed: true reconstructed: true
02-DECISIONS/0018-the-mesh-creates-no-symlinks.md
+2 -2
View File
@@ -1,5 +1,5 @@
--- ---
status: proposed status: accepted
date: 2026-08-23 date: 2026-08-23
deciders: jochen deciders: jochen
reconstructed: false reconstructed: false
@@ -50,7 +50,7 @@ State is derived onto nodes; it does not reach back.
## Decision ## Decision
*Proposed — the position is settled; the migration is not designed. See "Open" below.* *Accepted 2026-08-25. The position is settled; the migration is not designed. See "Open" below.*
**The mesh creates no symlinks.** A file a node needs is placed on that node as a real file, **The mesh creates no symlinks.** A file a node needs is placed on that node as a real file,
derived from the mesh and reconciled by the installer like every other managed file derived from the mesh and reconciled by the installer like every other managed file
02-DECISIONS/0034-a-test-defends-a-decision.md
+1 -1
View File
@@ -1,5 +1,5 @@
--- ---
status: proposed status: accepted
date: 2026-08-24 date: 2026-08-24
deciders: jochen deciders: jochen
reconstructed: false reconstructed: false