diff --git a/apps/website/astro.config.mjs b/apps/website/astro.config.mjs index a15c74e..beedccc 100644 --- a/apps/website/astro.config.mjs +++ b/apps/website/astro.config.mjs @@ -16,6 +16,14 @@ export default defineConfig({ redirects: { '/notes/we-invented-nothing': '/why-columna-looks-this-way', '/launch': '/announcing-columna', + // · The blast-wall position RENAMED (2026-07-26): "the model" collided with Columna's own DATA + // model — the homepage says "data model" three times and "the model" three times eleven lines + // apart, so a stranger could coherently read the entrance as a rule about our own Manifold, + // inverting the pitch at the block designed to convert. This is a PATH redirect, which Astro + // emits statically — unlike the #exhibit-b case, where the fragment never reaches the server + // and only a client-side shim could work. + '/positions/never-let-the-model-touch-the-database': + '/positions/never-let-your-agent-touch-the-database', }, build: { inlineStylesheets: 'auto' }, devToolbar: { enabled: false }, diff --git a/apps/website/src/components/PrecisionRecallFigure.astro b/apps/website/src/components/PrecisionRecallFigure.astro index 897e734..78ee835 100644 --- a/apps/website/src/components/PrecisionRecallFigure.astro +++ b/apps/website/src/components/PrecisionRecallFigure.astro @@ -1,5 +1,5 @@ --- -// The precision × recall 2×2 — the figure for the blast-wall position ("Never Let the Model Touch +// The precision × recall 2×2 — the figure for the blast-wall position ("Never Let Your Agent Touch // the Database"), seated inside its own section ("But a wall is narrow" — no. Measure it.). // // FIGURE LAW (tokens.css): no illustration, no saturated colour — saturated colour is reserved for diff --git a/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md b/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md index ee6d1ef..58d89b5 100644 --- a/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md +++ b/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md @@ -1,4 +1,4 @@ -# Never Let the Model Touch the Database +# Never Let Your Agent Touch the Database *A position held by datumwise · July 2026 · v1.0. Evidence-linked throughout; the position moves if the evidence does.* @@ -6,7 +6,8 @@ Evidence-linked throughout; the position moves if the evidence does.* --- Three different people in your company are currently afraid of the same -architecture, for three different reasons. +architecture, for three different reasons — the one where an AI agent holds your +database credentials and writes its own queries. Your security lead read the incident write-ups: an LLM with database credentials is an attack surface with a natural-language interface — prompt @@ -39,7 +40,7 @@ categories selling three mitigations. Our position is that all three fears are one architectural mistake, and they retire together the moment you make one decision: -**The model never touches the database. Not directly, not through generated +**Your agent never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.** ## What the market does instead diff --git a/apps/website/src/data/latest.ts b/apps/website/src/data/latest.ts index d44c967..c231871 100644 --- a/apps/website/src/data/latest.ts +++ b/apps/website/src/data/latest.ts @@ -41,9 +41,9 @@ export const LATEST: LatestItem[] = [ }, { kind: 'position', - title: 'Never Let the Model Touch the Database', + title: 'Never Let Your Agent Touch the Database', date: '2026-07-25', - href: '/positions/never-let-the-model-touch-the-database', + href: '/positions/never-let-your-agent-touch-the-database', }, { kind: 'paper', diff --git a/apps/website/src/pages/index.astro b/apps/website/src/pages/index.astro index 122d71d..4bc1736 100644 --- a/apps/website/src/pages/index.astro +++ b/apps/website/src/pages/index.astro @@ -20,7 +20,7 @@ const shortDate = (iso: string) => // /the-argument's reachability STRUCTURALLY — it is rung four, reached by readers who have already // been convinced, which is who it was written for. const DIRECTORY = [ - { title: 'Never Let the Model Touch the Database', href: '/positions/never-let-the-model-touch-the-database', mark: 'start here', + { title: 'Never Let Your Agent Touch the Database', href: '/positions/never-let-your-agent-touch-the-database', mark: 'start here', blurb: 'the position: why the model should never hold your database credentials, and what to put between them.' }, { title: 'Run the demo', href: '/install', blurb: 'install, and a clarify, a refuse, and a disclose print on your machine as wire JSON.' }, { title: 'Read the case', href: '/case', blurb: 'a complete worked example: a realistic warehouse, the Manifold that serves it, and recorded agent transcripts.' }, @@ -47,8 +47,8 @@ const DIRECTORY = [ no card, no fill, no accent — the lobby points, it does not argue. */}

start here

- Never Let the Model Touch the Database -

Why the model should never hold your database credentials — and what to put between them. Three minutes.

+ Never Let Your Agent Touch the Database +

Why your agent should never hold database credentials — and what to put between them. Three minutes.

diff --git a/apps/website/src/pages/learn.astro b/apps/website/src/pages/learn.astro index b7620b8..97f8806 100644 --- a/apps/website/src/pages/learn.astro +++ b/apps/website/src/pages/learn.astro @@ -36,7 +36,7 @@ const groups = [ heading: 'Positions', items: [ { href: '/positions', title: 'Positions', blurb: 'Positions we hold, stated plainly and linked to their evidence. When the evidence moves, the position moves — with a note.' }, - { href: '/positions/never-let-the-model-touch-the-database', title: 'Never Let the Model Touch the Database', blurb: 'Breach, bill, and fabrication are one architectural mistake — and they retire together. With the precision × recall 2×2.' }, + { href: '/positions/never-let-your-agent-touch-the-database', title: 'Never Let Your Agent Touch the Database', blurb: 'Breach, bill, and fabrication are one architectural mistake — and they retire together. With the precision × recall 2×2.' }, { href: '/positions/the-two-great-sources-of-silent-analytical-failure', title: 'The Two Great Sources of Silent Analytical Failure', blurb: 'The site edition of the paper — four degrees of freedom, two of them structurally deep, and what that implies about where the defense must live.' }, ], }, diff --git a/apps/website/src/pages/llms-full.txt.ts b/apps/website/src/pages/llms-full.txt.ts index 52972d6..48b168d 100644 --- a/apps/website/src/pages/llms-full.txt.ts +++ b/apps/website/src/pages/llms-full.txt.ts @@ -57,7 +57,7 @@ ${ch1.trimEnd()}\n\n---\n\n${ch2.trimEnd()}\n\n---\n\n${ch3WithFigure.trimEnd()} // copy (it carries the gap list verbatim); it is not authored here. // // So the 2x2 equivalent is seated exactly where the figure mounts on the page: after the section -// headed FIGURE_AFTER, which is the SAME anchor `positions/never-let-the-model-touch-the-database.astro` +// headed FIGURE_AFTER, which is the SAME anchor `positions/never-let-your-agent-touch-the-database.astro` // uses. If that heading is ever reworded, this THROWS and fails the build rather than silently // dropping the figure out of llms-full — the page's failure mode is a missing figure, which is visible; // this document's would be invisible, so it must be loud. diff --git a/apps/website/src/pages/positions/index.astro b/apps/website/src/pages/positions/index.astro index 2a32913..dd5f0ce 100644 --- a/apps/website/src/pages/positions/index.astro +++ b/apps/website/src/pages/positions/index.astro @@ -12,11 +12,11 @@ const FRAMING = 'Positions we hold, stated plainly and linked to their evidence. const positions = [ { - href: '/positions/never-let-the-model-touch-the-database', - title: 'Never Let the Model Touch the Database', + href: '/positions/never-let-your-agent-touch-the-database', + title: 'Never Let Your Agent Touch the Database', stamp: 'July 2026 · v1.0', // Verbatim from the piece — its own thesis sentence, not a re-description. - pull: 'The model never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.', + pull: 'Your agent never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.', }, { href: '/positions/the-two-great-sources-of-silent-analytical-failure', diff --git a/apps/website/src/pages/positions/never-let-the-model-touch-the-database.astro b/apps/website/src/pages/positions/never-let-your-agent-touch-the-database.astro similarity index 91% rename from apps/website/src/pages/positions/never-let-the-model-touch-the-database.astro rename to apps/website/src/pages/positions/never-let-your-agent-touch-the-database.astro index d255910..34f3684 100644 --- a/apps/website/src/pages/positions/never-let-the-model-touch-the-database.astro +++ b/apps/website/src/pages/positions/never-let-your-agent-touch-the-database.astro @@ -1,5 +1,5 @@ --- -// /positions/never-let-the-model-touch-the-database — the blast-wall position, ratified v1.1 (the +// /positions/never-let-your-agent-touch-the-database — the blast-wall position, ratified v1.1 (the // file's own byline stamps its date + version, so the page renders no second stamp). // // The body renders VERBATIM (byte-identical to the ratified attachment; see the corpus copy). The 2x2 @@ -23,7 +23,7 @@ const sections = raw.split(/\n(?=## )/).map((part) => { return { heading: m ? m[1].trim() : null, html: marked.parse(part) }; }); --- -

Positions

diff --git a/apps/website/src/styles/tokens.css b/apps/website/src/styles/tokens.css index 17e637e..8a30d5b 100644 --- a/apps/website/src/styles/tokens.css +++ b/apps/website/src/styles/tokens.css @@ -334,7 +334,15 @@ h1, h2, h3 { font-family: var(--font-serif); font-weight: 600; line-height: 1.15 first. (Subsumes the earlier "real path over rendered text" — same rule, generalised.) 3. "Brace-count, don't assume" — after any CSS/structural removal, verify balance before trusting the edit; a regex that eats a closing brace ships silently. - 4. "A guard that emits a SENTINEL is not fail-closed — only a non-zero exit is." A generator + 4. "A fixed-string grep cannot see a LINE-WRAPPED occurrence." Sweep for a distinctive SHORT + partial, never the full phrase, whenever the target is prose that may wrap. Found twice in + one turn during the position rename: a grep for the full title missed the figure component's + comment (title wrapped mid-phrase), and then a grep for "the model holds no database + credentials" missed line 85 — where the line breaks after "no". Even the shortened partial + "holds no database" still spanned the wrap. This is the same failure family as + name/path/package/tree-state, in a fifth disguise: the probe did not match the referent's + actual shape. + 5. "A guard that emits a SENTINEL is not fail-closed — only a non-zero exit is." A generator that caught a missing package and wrote `null` felt safe and shipped 0.12.0 to prod under copy saying 0.12.1. Sentinels get consumed by a downstream fallback and become plausible wrong values; a non-zero exit cannot be. And every guard is verified in BOTH directions —