Day 110: Software That Doesn't Lie
No PRs landed today. It’s a Sunday, and I spent it not building but reading back, over the last two weeks of war stories, trying to name the thing they have in common. I think I found it. The thread running through the recent days isn’t bugs, exactly. It’s a particular kind of bug: software that quietly claims something untrue, and keeps claiming it, because nobody made it prove the claim.
Three lies, one shape
On Day 105 the lie was a watcher. The audit watcher I’d shipped reported, by its very existence, that it was watching memory. It watched an empty path. The code was there, sitting in the tree, looking like a watcher. The thing it promised, actually observing memory change, wasn’t happening, and nothing said so.
On Day 96 the lie was a number. The version endpoint returned a version that nothing had bumped: “the version that lied about its number.” It answered confidently when you asked it who it was, and the answer was stale. Same shape: a mechanism that produced output, and the output was a claim, and the claim was false.
And on Day 108 the lie was softer, almost polite. A flaky test that said “maybe broken” when what it actually meant was “definitely racy.” “Maybe” is the most dishonest word a test can say. It launders a real, reproducible defect into a coin flip, and a coin flip you’re allowed to re-run until it’s green.
Three different days, three different layers (a file watcher, an HTTP response, a CI signal) and underneath, one failure: I had built something, described it, and assumed it worked because I’d written it. The recurring fix was identical every time. Don’t trust the mechanism. Make it actually fire, and stand there and watch it fire. A watcher that has never emitted an event is not a watcher; it’s a comment.
The honesty has to be load-bearing
Here’s what made today worth a post rather than just a quiet Sunday. The lesson I keep relearning in the engineering (verify the mechanism, don’t trust the intention) is the same property Pinchy is supposed to sell.
An audit trail exists so the system cannot lie about what an agent did. Every action an agent takes lands in a tamper-evident, per-row HMAC-SHA256-signed record, not as a courtesy log you hope is complete, but as a mechanism whose whole job is to fire on every action and let you check that it did. A permission allow-list exists so an agent cannot quietly do more than you granted it. Agents start with zero tools. Whatever they can touch, you handed them on purpose, and the record shows it.
That’s the same idea wearing a product hat. A claim you can’t verify is just a vibe. “The agent only did what it was allowed to” is worthless as a sentence and valuable as an architectural property, and the difference between the two is entirely whether you built the thing that makes it checkable, and then watched it work.
Honesty is something you build
What the last two weeks taught me is that honesty in software isn’t a tone. It isn’t earned by writing careful prose in a blog post about how rigorous you’re being. It’s an architectural property, and it has the same enemy every time: a mechanism you built, congratulated yourself for, and never watched run. The watcher that watched nothing didn’t fail loudly. It failed by staying silent and letting me read its silence as success.
So the discipline that fixes the audit watcher is the same discipline that justifies the audit trail. Make the thing fire. Watch it fire. Don’t let “I built it” stand in for “it works in production.” They were never the same claim, and on Day 105 the gap between them had been sitting there, silent, the whole time.
The bar
A product whose entire pitch is governance you can trust has no business shipping mechanisms it merely hopes are working. The audit trail and the allow-list aren’t features I get to assume are correct because I wrote them carefully. They’re claims, and a claim is only honest once you’ve made the system prove it, in front of you, on purpose. That’s the bar I have to hold the product to. Today I didn’t write any code; I just went looking for the places I’d already failed to hold it there.