From caecdcd43591e474f1fe377c8e04172c8d4bf03f Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 26 Jul 2026 12:22:42 +0000 Subject: [PATCH 1/2] =?UTF-8?q?site:=20rename=20the=20blast-wall=20positio?= =?UTF-8?q?n=20=E2=80=94=20"Never=20Let=20Your=20Agent=20Touch=20the=20Dat?= =?UTF-8?q?abase"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Huayin's terminology-collision ruling. The homepage says "data model" three times and "the model" three times, eleven lines apart, so a stranger could coherently read the entrance as a rule about Columna's OWN Manifold — inverting the pitch at the exact block designed to convert. Zero external links point at the piece, so the rename is free. RENAMED ACROSS EVERY SURFACE THE STRING TRAVELS TO (grep list in the PR): · the piece's H1 (corpus) and its metadata · the /positions index entry · the homepage entrance block (link title) AND the ordered-path rung · /learn's Positions group · the Latest rail (data/latest.ts) · llms-full — the H1 flows through by import (verified in built output, not assumed) · PrecisionRecallFigure's header comment — WHICH MY FIRST GREP MISSED, because the title is line-wrapped there. Found on the follow-up sweep; a line break defeats a fixed-string grep. SLUG: /positions/never-let-your-agent-touch-the-database, with a PATH redirect in astro.config.mjs. A path is exactly the case Astro's `redirects:` handles — unlike #exhibit-b, where the fragment never reaches the server and only a client-side shim could work. Verified: the old path emits a static stub with http-equiv refresh to the new URL. ENTRANCE ONE-LINER re-ratified: "Why your agent should never hold database credentials — and what to put between them. Three minutes." DISAMBIGUATION SWEEP. The body's first "the model" (line 13) already sits in a sentence opening "an LLM with database credentials", so that use was never ambiguous. The real exposure was the OPENING two lines, which named no actor at all — a reader landing there had nothing to anchor on. The opening now reads "...for three different reasons — the one where an AI agent holds your database credentials and writes its own queries." The title stays clean; the first sentence does the disambiguating work. Verified: build green (29 pages); prose-coherence green; the new title on all five HTML surfaces plus llms-full; the old title absent from dist except the redirect stub (which carries no title); the ordered ladder unchanged with the argument still at rung 4. Co-Authored-By: Claude --- apps/website/astro.config.mjs | 8 ++++++++ apps/website/src/components/PrecisionRecallFigure.astro | 2 +- .../content/corpus/position_never_let_the_model_v1_1.md | 5 +++-- apps/website/src/data/latest.ts | 4 ++-- apps/website/src/pages/index.astro | 6 +++--- apps/website/src/pages/learn.astro | 2 +- apps/website/src/pages/llms-full.txt.ts | 2 +- apps/website/src/pages/positions/index.astro | 4 ++-- ...stro => never-let-your-agent-touch-the-database.astro} | 4 ++-- 9 files changed, 23 insertions(+), 14 deletions(-) rename apps/website/src/pages/positions/{never-let-the-model-touch-the-database.astro => never-let-your-agent-touch-the-database.astro} (91%) diff --git a/apps/website/astro.config.mjs b/apps/website/astro.config.mjs index a15c74e..beedccc 100644 --- a/apps/website/astro.config.mjs +++ b/apps/website/astro.config.mjs @@ -16,6 +16,14 @@ export default defineConfig({ redirects: { '/notes/we-invented-nothing': '/why-columna-looks-this-way', '/launch': '/announcing-columna', + // · The blast-wall position RENAMED (2026-07-26): "the model" collided with Columna's own DATA + // model — the homepage says "data model" three times and "the model" three times eleven lines + // apart, so a stranger could coherently read the entrance as a rule about our own Manifold, + // inverting the pitch at the block designed to convert. This is a PATH redirect, which Astro + // emits statically — unlike the #exhibit-b case, where the fragment never reaches the server + // and only a client-side shim could work. + '/positions/never-let-the-model-touch-the-database': + '/positions/never-let-your-agent-touch-the-database', }, build: { inlineStylesheets: 'auto' }, devToolbar: { enabled: false }, diff --git a/apps/website/src/components/PrecisionRecallFigure.astro b/apps/website/src/components/PrecisionRecallFigure.astro index 897e734..78ee835 100644 --- a/apps/website/src/components/PrecisionRecallFigure.astro +++ b/apps/website/src/components/PrecisionRecallFigure.astro @@ -1,5 +1,5 @@ --- -// The precision × recall 2×2 — the figure for the blast-wall position ("Never Let the Model Touch +// The precision × recall 2×2 — the figure for the blast-wall position ("Never Let Your Agent Touch // the Database"), seated inside its own section ("But a wall is narrow" — no. Measure it.). // // FIGURE LAW (tokens.css): no illustration, no saturated colour — saturated colour is reserved for diff --git a/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md b/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md index ee6d1ef..7e945f0 100644 --- a/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md +++ b/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md @@ -1,4 +1,4 @@ -# Never Let the Model Touch the Database +# Never Let Your Agent Touch the Database *A position held by datumwise · July 2026 · v1.0. Evidence-linked throughout; the position moves if the evidence does.* @@ -6,7 +6,8 @@ Evidence-linked throughout; the position moves if the evidence does.* --- Three different people in your company are currently afraid of the same -architecture, for three different reasons. +architecture, for three different reasons — the one where an AI agent holds your +database credentials and writes its own queries. Your security lead read the incident write-ups: an LLM with database credentials is an attack surface with a natural-language interface — prompt diff --git a/apps/website/src/data/latest.ts b/apps/website/src/data/latest.ts index d44c967..c231871 100644 --- a/apps/website/src/data/latest.ts +++ b/apps/website/src/data/latest.ts @@ -41,9 +41,9 @@ export const LATEST: LatestItem[] = [ }, { kind: 'position', - title: 'Never Let the Model Touch the Database', + title: 'Never Let Your Agent Touch the Database', date: '2026-07-25', - href: '/positions/never-let-the-model-touch-the-database', + href: '/positions/never-let-your-agent-touch-the-database', }, { kind: 'paper', diff --git a/apps/website/src/pages/index.astro b/apps/website/src/pages/index.astro index 122d71d..4bc1736 100644 --- a/apps/website/src/pages/index.astro +++ b/apps/website/src/pages/index.astro @@ -20,7 +20,7 @@ const shortDate = (iso: string) => // /the-argument's reachability STRUCTURALLY — it is rung four, reached by readers who have already // been convinced, which is who it was written for. const DIRECTORY = [ - { title: 'Never Let the Model Touch the Database', href: '/positions/never-let-the-model-touch-the-database', mark: 'start here', + { title: 'Never Let Your Agent Touch the Database', href: '/positions/never-let-your-agent-touch-the-database', mark: 'start here', blurb: 'the position: why the model should never hold your database credentials, and what to put between them.' }, { title: 'Run the demo', href: '/install', blurb: 'install, and a clarify, a refuse, and a disclose print on your machine as wire JSON.' }, { title: 'Read the case', href: '/case', blurb: 'a complete worked example: a realistic warehouse, the Manifold that serves it, and recorded agent transcripts.' }, @@ -47,8 +47,8 @@ const DIRECTORY = [ no card, no fill, no accent — the lobby points, it does not argue. */}

start here

- Never Let the Model Touch the Database -

Why the model should never hold your database credentials — and what to put between them. Three minutes.

+ Never Let Your Agent Touch the Database +

Why your agent should never hold database credentials — and what to put between them. Three minutes.

diff --git a/apps/website/src/pages/learn.astro b/apps/website/src/pages/learn.astro index b7620b8..97f8806 100644 --- a/apps/website/src/pages/learn.astro +++ b/apps/website/src/pages/learn.astro @@ -36,7 +36,7 @@ const groups = [ heading: 'Positions', items: [ { href: '/positions', title: 'Positions', blurb: 'Positions we hold, stated plainly and linked to their evidence. When the evidence moves, the position moves — with a note.' }, - { href: '/positions/never-let-the-model-touch-the-database', title: 'Never Let the Model Touch the Database', blurb: 'Breach, bill, and fabrication are one architectural mistake — and they retire together. With the precision × recall 2×2.' }, + { href: '/positions/never-let-your-agent-touch-the-database', title: 'Never Let Your Agent Touch the Database', blurb: 'Breach, bill, and fabrication are one architectural mistake — and they retire together. With the precision × recall 2×2.' }, { href: '/positions/the-two-great-sources-of-silent-analytical-failure', title: 'The Two Great Sources of Silent Analytical Failure', blurb: 'The site edition of the paper — four degrees of freedom, two of them structurally deep, and what that implies about where the defense must live.' }, ], }, diff --git a/apps/website/src/pages/llms-full.txt.ts b/apps/website/src/pages/llms-full.txt.ts index 52972d6..48b168d 100644 --- a/apps/website/src/pages/llms-full.txt.ts +++ b/apps/website/src/pages/llms-full.txt.ts @@ -57,7 +57,7 @@ ${ch1.trimEnd()}\n\n---\n\n${ch2.trimEnd()}\n\n---\n\n${ch3WithFigure.trimEnd()} // copy (it carries the gap list verbatim); it is not authored here. // // So the 2x2 equivalent is seated exactly where the figure mounts on the page: after the section -// headed FIGURE_AFTER, which is the SAME anchor `positions/never-let-the-model-touch-the-database.astro` +// headed FIGURE_AFTER, which is the SAME anchor `positions/never-let-your-agent-touch-the-database.astro` // uses. If that heading is ever reworded, this THROWS and fails the build rather than silently // dropping the figure out of llms-full — the page's failure mode is a missing figure, which is visible; // this document's would be invisible, so it must be loud. diff --git a/apps/website/src/pages/positions/index.astro b/apps/website/src/pages/positions/index.astro index 2a32913..6414abe 100644 --- a/apps/website/src/pages/positions/index.astro +++ b/apps/website/src/pages/positions/index.astro @@ -12,8 +12,8 @@ const FRAMING = 'Positions we hold, stated plainly and linked to their evidence. const positions = [ { - href: '/positions/never-let-the-model-touch-the-database', - title: 'Never Let the Model Touch the Database', + href: '/positions/never-let-your-agent-touch-the-database', + title: 'Never Let Your Agent Touch the Database', stamp: 'July 2026 · v1.0', // Verbatim from the piece — its own thesis sentence, not a re-description. pull: 'The model never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.', diff --git a/apps/website/src/pages/positions/never-let-the-model-touch-the-database.astro b/apps/website/src/pages/positions/never-let-your-agent-touch-the-database.astro similarity index 91% rename from apps/website/src/pages/positions/never-let-the-model-touch-the-database.astro rename to apps/website/src/pages/positions/never-let-your-agent-touch-the-database.astro index d255910..34f3684 100644 --- a/apps/website/src/pages/positions/never-let-the-model-touch-the-database.astro +++ b/apps/website/src/pages/positions/never-let-your-agent-touch-the-database.astro @@ -1,5 +1,5 @@ --- -// /positions/never-let-the-model-touch-the-database — the blast-wall position, ratified v1.1 (the +// /positions/never-let-your-agent-touch-the-database — the blast-wall position, ratified v1.1 (the // file's own byline stamps its date + version, so the page renders no second stamp). // // The body renders VERBATIM (byte-identical to the ratified attachment; see the corpus copy). The 2x2 @@ -23,7 +23,7 @@ const sections = raw.split(/\n(?=## )/).map((part) => { return { heading: m ? m[1].trim() : null, html: marked.parse(part) }; }); --- -

Positions

From a5f9b8d792351c754833b38f1340d6df662793be Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 26 Jul 2026 12:45:39 +0000 Subject: [PATCH 2/2] site: re-ratify the thesis line; record the wrapped-grep proverb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Huayin's pull-quote ruling: change the BODY, not the display. The thesis line is the piece's quotable claim — it gets excerpted into the index, the channels, and other people's screenshots — and a quotable line must survive separation from its context. Fixing only the display surface would have left the collision live in every future quotation. was: "The model never touches the database. Not directly, not through generated SQL, ..." now: "Your agent never touches the database. Not directly, not through generated SQL, ..." The /positions index pull follows the body and remains a VERBATIM quote of it. Verified on all three surfaces (the piece, the index, llms-full); the old wording is absent from dist entirely. NO SWEEP, as ruled. The body's six other uses of "the model" stay: they sit inside established context and several are precise as written — line 85's "the model holds no database credentials" is exactly right, because it is the model specifically, not the agent process, that holds no credentials. BUILD-DOC LINE — the wrapped-grep proverb, promoted to #4 (the sentinel proverb becomes #5): "A fixed-string grep cannot see a LINE-WRAPPED occurrence. Sweep for a distinctive SHORT partial, never the full phrase, whenever the target is prose that may wrap." It earned the entry by biting TWICE in one turn: the full-title grep missed PrecisionRecallFigure's comment (title wrapped mid-phrase), and then a grep for "the model holds no database credentials" missed line 85, where the line breaks after "no" — and even the shortened "holds no database" still spanned the wrap. Same failure family as name/path/package/tree-state, in a fifth disguise: the probe did not match the referent's actual shape. Also recorded: the disambiguation placement correction — line 13 was already anchored by "an LLM with database credentials", so the real gap was the opening two lines naming no actor at all. Checking the text rather than applying the instruction literally is what found it. Build green (29 pages); brace-balance verified on the stylesheet. Co-Authored-By: Claude --- .../corpus/position_never_let_the_model_v1_1.md | 2 +- apps/website/src/pages/positions/index.astro | 2 +- apps/website/src/styles/tokens.css | 10 +++++++++- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md b/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md index 7e945f0..58d89b5 100644 --- a/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md +++ b/apps/website/src/content/corpus/position_never_let_the_model_v1_1.md @@ -40,7 +40,7 @@ categories selling three mitigations. Our position is that all three fears are one architectural mistake, and they retire together the moment you make one decision: -**The model never touches the database. Not directly, not through generated +**Your agent never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.** ## What the market does instead diff --git a/apps/website/src/pages/positions/index.astro b/apps/website/src/pages/positions/index.astro index 6414abe..dd5f0ce 100644 --- a/apps/website/src/pages/positions/index.astro +++ b/apps/website/src/pages/positions/index.astro @@ -16,7 +16,7 @@ const positions = [ title: 'Never Let Your Agent Touch the Database', stamp: 'July 2026 · v1.0', // Verbatim from the piece — its own thesis sentence, not a re-description. - pull: 'The model never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.', + pull: 'Your agent never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.', }, { href: '/positions/the-two-great-sources-of-silent-analytical-failure', diff --git a/apps/website/src/styles/tokens.css b/apps/website/src/styles/tokens.css index 17e637e..8a30d5b 100644 --- a/apps/website/src/styles/tokens.css +++ b/apps/website/src/styles/tokens.css @@ -334,7 +334,15 @@ h1, h2, h3 { font-family: var(--font-serif); font-weight: 600; line-height: 1.15 first. (Subsumes the earlier "real path over rendered text" — same rule, generalised.) 3. "Brace-count, don't assume" — after any CSS/structural removal, verify balance before trusting the edit; a regex that eats a closing brace ships silently. - 4. "A guard that emits a SENTINEL is not fail-closed — only a non-zero exit is." A generator + 4. "A fixed-string grep cannot see a LINE-WRAPPED occurrence." Sweep for a distinctive SHORT + partial, never the full phrase, whenever the target is prose that may wrap. Found twice in + one turn during the position rename: a grep for the full title missed the figure component's + comment (title wrapped mid-phrase), and then a grep for "the model holds no database + credentials" missed line 85 — where the line breaks after "no". Even the shortened partial + "holds no database" still spanned the wrap. This is the same failure family as + name/path/package/tree-state, in a fifth disguise: the probe did not match the referent's + actual shape. + 5. "A guard that emits a SENTINEL is not fail-closed — only a non-zero exit is." A generator that caught a missing package and wrote `null` felt safe and shipped 0.12.0 to prod under copy saying 0.12.1. Sentinels get consumed by a downstream fallback and become plausible wrong values; a non-zero exit cannot be. And every guard is verified in BOTH directions —