Guides

Each tool a project depends on deserves its own short rootnote in two layers — the vendor's map of its documentation, and a record of where it catches agents out, which vendors rarely publish.

What you link to decides your tooling, and the consent rules decide whether a cookieless story survives.

How to submit a document, what happens to it during review, and what rights you keep.

The draft-and-hand-over boundary for outbound email, and the ways email rendering differs from the web.

A stateful fake plus a control API, so a real app runs a full journey with no live calls — and the isolation you must build before the first run.

Four ratios used to score code quality, and four different reasons each one measured something other than what it claimed.

Two independent causes of a false-positive block, only one of which you can do anything about.

Getting a credential from its store into its destination without it ever appearing as text the assistant emits.

Why process-selection commands over-select silently, and the inspect-then-kill pattern that catches it.

Four checks that passed because they had no subjects — three in a scoring tool, and one set that caught this document's own author an hour after he went looking for them.

Free platform subdomains are blocked as a category by security filters, so a subset of real users silently fails.

Wiring an updater keypair, a version manifest and a public bucket, and the flags that make uploads silently do nothing.

The certificate types, the notarisation flow, and the build setting that silently ships an unnotarised DMG.

What an agent should check before installing a dependency, and which files it must never modify without a shown diff.

A file format verified only by the reader you wrote is verified against your own assumptions.

Driving an interactive Windows session over SSH, and why testing as an admin proves nothing about permissions.

Seven invariants every document in this library must satisfy, and what happens to one that does not.

Drive interfaces by stable identity rather than pixels, in tiers, so tests are headless, deterministic and fan out.

Three ways a passing check reports success without ever being able to report anything else.

Three attempts to validate a scoring tool against human judgement, and why all three failing was evidence for the tool's premise rather than against it.

Two tests decide whether a passage is worth its tokens, and applying them to twelve rootnotes found that padding accumulates in documents that explain and almost never in documents that constrain.

What to do when a tool built to outrank your judgement is wrong, given that overruling it destroys the only property it had.

An eligibility gate the sandbox does not enforce, a signature scheme that deviates from the spec it cites, and the webhook orderings that zero a live subscription.

Why every session starts cold, what follows from that, and the four layers that turn context into something an agent can be handed.

Six ways a code scanner mistook writing about a practice for following it, and a seventh found inside the check built to prevent the other six.

Four cases where a description and the thing it described drifted apart, none of which was discoverable by reading the description again.

Two ways text scanning silently misses what it exists to find — soft line wraps, and identifiers in an unexpected form.