Field notes
Commands, fixes, experiments, certification notes and API discoveries — kept because I know I'll want them later, and published in case someone else does too.
Currently learningSC-900Microsoft SecurityCybersecurity
10 notesBUILDFIXLEARNREFERENCETESTTHOUGHT
N-008FIX
I had been describing my review agents as read-only because their tool lists omit write and edit. Re-reading the files, both still carry an unrestricted shell — and a shell is a write primitive. The guarantee I thought was structural was really a convention with a gap in it, and the one agent I had genuinely locked to read, search and glob was the one I never installed.
agentssecurityaireview
N-010LEARN
An eighty-thousand-token specification loaded wholesale into every session crowds out the task itself. Replacing it with a short resident index of line anchors, plus explicit cues telling the agent when it must go fetch, cut the resident load sharply. The catch is that a stale anchor is worse than a missing one — no fetch leaves the agent knowingly uninformed, a wrong fetch hands it plausible material and no reason to doubt it.
agentscontextdocumentationai
N-009TEST
Acceptance tests are written by a human and committed before any agent starts implementing, and a change that supplies both the implementation and its only acceptance tests is rejected. An agent that writes its own definition of done will meet it. The rule is dull, slows things down, and is the one I would keep if I could keep only one.
testingaiprocesssafety
N-007THOUGHT
Architecture, security review and code review run on the strongest model; documentation runs on the cheapest; implementation sits in the middle. It is the same judgement as deciding which changes need a second reviewer — cost tracks the blast radius of a bad answer, not the volume of output.
agentsaicostreview
N-006TEST
import-linter checks imports, not call sites — so it cannot express "no file in the AI service may call a broker write method". A unit test that walks the source with ast.parse can. The safety rule that matters most became a test rather than a convention.
architecturetestingpythonsafety
N-005THOUGHT
Trade approvals needed to work from a phone, authenticate the approver, and leave an audit trail — without building an auth system for an MVP. Routing them through GitHub issue comments got all four for free. The best interface is often one you don't have to build.
uxsecurityapproval
N-004REFERENCE
v4 is random, so index inserts scatter across the B-tree. v7 is time-ordered, keeping insert locality while staying globally unique and generatable in the application before insert — which means the app owns the ID, not the database.
postgresdatabaseidentifiers
N-003THOUGHT
Real-money trading sits behind safety rails, a fourteen-day clean paper run, and an explicit configuration flip. Writing the gate down as a decision record made it hard to quietly skip later, which is the entire point of writing it down.
safetyadrprocess
N-001LEARN
Streaming raw camera footage to a server is expensive and slow. Running YOLOv8 on a Jetson at the site and publishing only detected events keeps bandwidth flat and the round trip short — the network carries conclusions, not pixels.
computer-visionedgefastapitimescaledb
N-002BUILD
A Next.js web app and an Expo React Native app sharing core types and Zod schemas from one package, with versioned Supabase migrations as the single source of truth for the database. The schema is the contract; both clients are downstream of it.
monorepoexposupabasetypescript