Skip to content
C.W.K.
Stream
Lesson 01 of 04 · published

The Pipeline That Refuses to Run Itself

~12 min · invariants, automation, architecture, design

Level 0Wet Clay
0 XP0/36 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete

The Capability That Was Left Out

A queue that fills up invites a consumer. That is what queues are for, and building one is the natural next commit: work is waiting, capacity is idle, and a small worker loop would close the gap. This workshop does not have that worker, and the absence is written down as an invariant rather than left as an unimplemented feature.

The wording matters. It is not "authorship is not automated yet." It is: no timer, queue consumer, retry loop, or server-side launcher may initiate authorship. Stated that way, the boundary has an edge you can test a proposal against, which is the whole reason to state it.

Why an Invariant and Not a Setting

Nobody arrives asking for autopilot. What arrives is a sequence of individually reasonable requests. Retry the run that died halfway, because a crashed session leaving a half-finished job is obviously bad. Start the next queued item when one finishes, because the capacity is right there. Kick off the overnight batch, because nobody is awake to click anything at 3 a.m. and the work is already approved.

Each of those is defensible in isolation, and together they are an autopilot assembled by accretion. A default gets changed; an invariant gets argued with. Making it an invariant does not forbid the discussion — it forces the discussion to be about the boundary rather than about a checkbox.

What Is Actually Being Protected

Two things, and they are worth separating.

The first is judgment at the moment it is worth the most. The person who did the work holds the context, and the minute after producing something is when a question about it is cheapest to answer. An unattended run answers no questions, because there is nobody in the room to ask.

The second is the absence of double authorship. A job that dies mid-session leaves visible state and waits. It is resumed or re-run by a human decision, never silently retried — because a retry that cannot tell "crashed before writing" from "crashed after writing" will happily produce the work twice, and the second copy looks exactly as legitimate as the first.

The test for a new feature is not "is this safe" but "does this let something other than a person start work." Safety arguments are unbounded and get won by whoever is more patient. The structural question has an answer, and the answer does not depend on how careful the proposer promises to be.

Code

Four proposals, one question·text
PROPOSAL                                  STARTS WORK?    VERDICT
----------------------------------------  ------------   -------
Retry a run that died halfway                  yes        refuse
  -> instead: leave the state visible and let a human resume

Start the next queued item on completion       yes        refuse
  -> instead: surface "3 items ready" and let a human claim one

Overnight batch of approved items              yes        refuse
  -> instead: the approval is not the start; the start is the start

Open a visible session and pre-fill its        no         allow
  first command, on a human click
  -> the human decided, and is still there to talk to it

# The column that decides is not risk. It is agency.

External links

Exercise

Take a pipeline you own and list every mechanism that can cause it to begin: schedules, webhooks, queue workers, retry policies, dependency triggers, and manual invocation. For each mechanism that is not a person, write down what evidence exists that a human wanted that specific run to happen. If the honest answer for any of them is "someone approved this class of run once", you have found a standing delegation, and it is worth deciding on purpose whether you meant to grant it.
Hint
Standing delegations are not automatically wrong — most infrastructure runs on them. The failure is granting one by accident, usually by adding a trigger to something that already had a manual path, and never re-asking whether the manual path was load-bearing.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.