Skip to content
C.W.K.
Stream
Lesson 03 of 04 · published

A Click Is Not a Cron

~11 min · automation, security, architecture, dispatch

Level 0Wet Clay
0 XP0/36 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete

Two Axes, Not One

"Automated" collapses two independent questions into one word, and separating them is what makes this boundary drawable. Ask instead: who decided that this specific run should happen, and is that person still present while it runs.

A person clicking a dispatch button scores human on both. A schedule scores machine on the first and usually absent on the second — the decision was made once, generically, at configuration time, and applies later to a specific run nobody looked at. That is a standing delegation, and it is a perfectly normal thing to grant deliberately. The failure is granting it by accident, which is what happens when "automated" is treated as one property.

What Dispatch Is Allowed to Do

The permitted action is narrow and worth stating precisely: on an explicit human action, hand a short-lived, opaque, single-use ticket to the local machine, which opens a visible interactive session with the right project loaded and the first command prepared. Then it stops. The session is a session — a person can read it, interrupt it, and argue with it.

That is process launching, not autonomous work. The distinction survives because of what dispatch does not get to do: it does not decide which item to run, it does not run anything after the session opens, it does not retry, and it cannot be triggered by anything except the click.

Why the Ticket Is Short-Lived, Opaque, and Single-Use

Each property closes a specific hole. Short-lived means a ticket that leaks tomorrow is worthless. Opaque means it carries no work description — the receiver exchanges it for the real payload, so possession of the ticket alone tells an attacker nothing about what is being done. Single-use means consuming it invalidates it, which turns "replayed the same launch twice" from a possibility into an error you can see in a log.

None of that is about distrust of the person clicking. It is that a dispatch path is the one place where an outside actor could get a session started, so it should be the narrowest surface in the system.

Ask "who decided" and "who is present" separately, and the word automated stops being useful — which is the point. Most arguments about automation are two people using the word to mean different quadrants, and the argument resolves the moment the quadrants are named.

Code

A launch ticket — everything it does not contain is deliberate·text
{
  "token": "opaque-random-string",
  "expires_at": "2026-08-07T09:12:00Z",
  "consumed": false
}

// What is NOT here:
//   - which item is being worked on
//   - which pipeline, which target, which reviewer
//   - any credential, path, or host
//
// The receiver exchanges the token for the payload over an
// authenticated call. Holding the ticket proves someone clicked;
// it does not describe what they clicked, and it stops proving
// anything at all once it is consumed or expires.
//
// Consuming is a state transition, so a replayed launch is not a
// silent duplicate - it is a 409 with a log entry attached.

External links

Exercise

Draw the four quadrants — decided by human or machine, human present or absent — and place every automated path in one system you work on. Then look only at the machine-decided, nobody-present quadrant and write one sentence per entry saying what it would produce if it fired at the worst possible moment. Anything whose answer involves creating or publishing content rather than moving or checking it is a candidate for a gate.
Hint
The worst possible moment is usually mid-edit: a half-written file on disk, a partially updated record, a branch that exists but is not finished. Mechanical paths tolerate that state or fail loudly on it; producing paths tend to consume it as if it were final.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.