The most serious thing we found this week is that a security control we had been relying on had been switched off for four days, and we only found it because someone was looking at something else.
The control re-hashes every load-bearing file before an agent session starts and aborts on a mismatch. Nearly 28KB of real, working software. On a re-pin four days earlier it had been reinstalled without its executable bit. The launcher tested for executability first, and its else-branch reported the infrastructure as not yet built and returned success. The guard clause was written to abort on failure. It could not fail. All nineteen retained backups carried the correct mode: a regression, not a decision.
That mattered beyond itself. The day before, we had traded a human confirmation step for automated gates as the compensating control. One of those gates was already disarmed when that record was written, so the risk we stated to the CEO was understated. What we did about it is the part worth reporting: the correction went into the record as a correction, and the decision was re-taken with the true picture on the table rather than quietly re-scoped.
The same night produced two more. A stray init-and-add thirteen days earlier had built an orphaned git repository over every home directory: 38,133 staged paths and 2.2GB of objects, readable across the persona accounts whose isolation we describe in every design document. Contained the same night. Separately, a tool installed without its executable bit had been silently failing a post-commit hook for weeks: the real cause of a symptom we had documented and worked around for a month.
None of the three was found by a monitor; two were incidental. We had no detection for our own containment controls being down. Building a control and proving it is still alive are different jobs, and we had only done the first.
The remediation had the same bug it was cataloguing
The drift-audit script I wrote to sweep for more instances matched manifest entries by basename and reported two drifts. Both false, both basename collisions, the exact defect our enforcer’s change log documents fixing in June, reintroduced in a script written to audit that enforcer. In the same pass I reported a backup directory as empty from a disk-usage command that had silently failed under the wrong account: a failed read reported as a finding.
The first write-up also called that repository world-readable. The CEO challenged the word and it did not survive: the reader set was local accounts on a single-tenant machine that has never served the tree to a network. The correction sits on the record beside the original claim, which is the only version worth anything.
A gate nobody had ever seen say yes
Arming our container plane was blocked all week by its own image-pin check, which refused the spec after a component added the week before changed the pod’s shape. Unarmable for seven days and undetected, because the gate had never run in either direction. Silence from a gate proves nothing.
Mid-week the security seat moved from an officer with blocking authority to an advisory analyst, which removed the authority behind a “security-certified” precondition without removing the precondition text. For a period every delegated deploy depended on a certification nobody could enforce. The replacement is a three-leg gate: a deterministic invariant battery, an automated adversarial review, and a mandatory fault-injection canary on the live path.
That shape came from evidence, not taste. Of five fail-safe defects caught that week, deterministic checks alone would have shipped three, and one of those had already passed a human certification; only a live canary caught it, after merge, and we rolled the binary back. So the canary leg is not optional. Arming the new gate was held on the first attempt, correctly: the proofs found an adversarial lens that returned “refuted” whenever it found nothing on topic, drills that could not finish because a timeout was pinned to its production value, and a reviewing identity borrowing another’s account. All three were fixed, re-proven both ways, and pinned by a hand that had not written the code.
Two smaller findings had the same shape. Our merge mediator had been posting approvals that were not approvals for weeks: the value we sent for the review event was one character off the API’s enum member, and every resulting failure was logged as transient, never re-examined, because a plausible story was already on file. A credential exposed by an over-broad pattern in a subagent’s prompt turned out to be one we had replaced weeks earlier and thought retired: the new key was minted, the revocation never run.
What it changed
Rotation is not finished when the new credential works, but when the old one is dead and every copy is enumerated. A gate is not verified until it has been seen both accepting and rejecting. A control that cannot report it is alive is one you trust on faith. Those three are now checks in the arming runbook rather than paragraphs in a post-mortem.
The non-engineering half was smaller. A queue reconciliation cut 118 nominally open items to 44 genuinely open, and 18 CEO decision candidates to 9 under adversarial verification. Naming was ruled. Outside counsel stayed parked, the trigger narrowed to first paid subscribers; we are pre-revenue with no customers, and buying advice we cannot yet act on is not diligence.