The Drift Log
Engineering notes
Field notes on inventory you can trust: substance over counts, certification over claims, provenance over promises. Posts are written when there is an argument worth making — not on a schedule. Every claim about our own work is one we can show.
The long argument
Vendoring Code Without a Paper Trail Is Unsecured DebtInlining unverified code severs upstream security alerts and license tracking. Provenance must be captured at intake, not guessed by SBOMs.Provenance, licensing and the paper trail · 6 min readEverything else
The archive
- Why Code Audits Get Ignored Without Automated RepairsAudits fail when detection is detached from remediation. Resolving technical debt requires pairing AST findings with verifiable, deterministic patches.3 min
- The Operational Cost of Provisional Test VerdictsPassing CI suites prove execution, not verification. Treating provisional test runs as verified proofs creates brittle downstream production failures.4 min
- Tracing Agent Generated Functions Back to Source LicensesAI assistants vendor copyleft algorithms directly into files, bypassing manifest-based SBOMs and introducing silent compliance debt.3 min
- When the Harness Fails Instead of the CodeA test suite exiting zero proves nothing if preconditions failed silently. Separating harness limits from code defects restores CI signal.3 min
- Auditing Vendored Dependencies Beyond the LICENSE FileA top-level LICENSE file is an assertion, not proof. Learn how to audit vendored dependencies using cryptographic provenance and file-level diffing.4 min
- The Four Verdicts Between Green Tests and Correct CodeBinary CI exit codes conflate unexercised mocks with verified logic. A four-verdict taxonomy separates mechanical execution from genuine invariant proofs.Pillar
- Closing the Loop from Repository Audit to Merged RepairStatic audits fail because they catalog symptoms instead of isolating boundaries. Here is how to convert legacy audit findings into verifiable, merged patches.Pillar
- A Component Count Is Not an InventoryWhy internal component registries decay into unverified technical debt and how to calculate the true yield of reusable code.Pillar
- Why Model Independence Is an Engineering PostureReplacing parsers with runtime LLM calls trades deterministic invariants for statistical tendencies. Logic must be owned at runtime.Pillar
- Governing Code Agents at the Build Intent GateWhy prompt guardrails fail on coding agents, and how to govern mutations by placing a deterministic build gate between intent and disk writes.Pillar
What we write about
Six standing arguments
Software inventory you can trust
A count of components is a claim, not an inventory. What makes an inventory real is that each row can be read, executed and graded.
Certifying that code does something
Between 'it compiles' and 'it is correct' there is a whole ladder of verdicts, and naming your rung honestly is more useful than claiming the top one.
Determinism and model independence
Software that calls a model at runtime inherits the model's variance. Owning your logic outright is a different engineering posture, not a smaller one.
Provenance, licensing and the paper trail
Every line you did not write is a liability until you can say where it came from and under what terms.
Governing agents that write code
The interesting control point is not the model. It is the gate between an agent deciding to write and the write happening.
Audit, then actually repair
An audit that ends in a report is a cost. An audit that ends in a merged repair and a kept capability is an asset.