site: rename the blast-wall position — "Never Let Your Agent Touch the Database"

apps/website/astro.config.mjs

@@ -16,6 +16,14 @@ export default defineConfig({
   redirects: {
     '/notes/we-invented-nothing': '/why-columna-looks-this-way',
     '/launch': '/announcing-columna',
+    //  · The blast-wall position RENAMED (2026-07-26): "the model" collided with Columna's own DATA
+    //    model — the homepage says "data model" three times and "the model" three times eleven lines
+    //    apart, so a stranger could coherently read the entrance as a rule about our own Manifold,
+    //    inverting the pitch at the block designed to convert. This is a PATH redirect, which Astro
+    //    emits statically — unlike the #exhibit-b case, where the fragment never reaches the server
+    //    and only a client-side shim could work.
+    '/positions/never-let-the-model-touch-the-database':
+      '/positions/never-let-your-agent-touch-the-database',
   },
   build: { inlineStylesheets: 'auto' },
   devToolbar: { enabled: false },

apps/website/src/components/PrecisionRecallFigure.astro

@@ -1,5 +1,5 @@
 ---
-// The precision × recall 2×2 — the figure for the blast-wall position ("Never Let the Model Touch
+// The precision × recall 2×2 — the figure for the blast-wall position ("Never Let Your Agent Touch
 // the Database"), seated inside its own section ("But a wall is narrow" — no. Measure it.).
 //
 // FIGURE LAW (tokens.css): no illustration, no saturated colour — saturated colour is reserved for

apps/website/src/content/corpus/position_never_let_the_model_v1_1.md

@@ -1,12 +1,13 @@
-# Never Let the Model Touch the Database
+# Never Let Your Agent Touch the Database
 
 *A position held by datumwise · July 2026 · v1.0.
 Evidence-linked throughout; the position moves if the evidence does.*
 
 ---
 
 Three different people in your company are currently afraid of the same
-architecture, for three different reasons.
+architecture, for three different reasons — the one where an AI agent holds your
+database credentials and writes its own queries.
 
 Your security lead read the incident write-ups: an LLM with database
 credentials is an attack surface with a natural-language interface — prompt
@@ -39,7 +40,7 @@ categories selling three mitigations. Our position is that all three fears
 are one architectural mistake, and they retire together the moment you make
 one decision:
 
-**The model never touches the database. Not directly, not through generated
+**Your agent never touches the database. Not directly, not through generated
 SQL, not through a guardrail that inspects the SQL it generated anyway.**
 
 ## What the market does instead

apps/website/src/data/latest.ts

@@ -41,9 +41,9 @@ export const LATEST: LatestItem[] = [
   },
   {
     kind: 'position',
-    title: 'Never Let the Model Touch the Database',
+    title: 'Never Let Your Agent Touch the Database',
     date: '2026-07-25',
-    href: '/positions/never-let-the-model-touch-the-database',
+    href: '/positions/never-let-your-agent-touch-the-database',
   },
   {
     kind: 'paper',

apps/website/src/pages/index.astro

@@ -20,7 +20,7 @@ const shortDate = (iso: string) =>
 // /the-argument's reachability STRUCTURALLY — it is rung four, reached by readers who have already
 // been convinced, which is who it was written for.
 const DIRECTORY = [
-  { title: 'Never Let the Model Touch the Database', href: '/positions/never-let-the-model-touch-the-database', mark: 'start here',
+  { title: 'Never Let Your Agent Touch the Database', href: '/positions/never-let-your-agent-touch-the-database', mark: 'start here',
     blurb: 'the position: why the model should never hold your database credentials, and what to put between them.' },
   { title: 'Run the demo', href: '/install', blurb: 'install, and a clarify, a refuse, and a disclose print on your machine as wire JSON.' },
   { title: 'Read the case', href: '/case', blurb: 'a complete worked example: a realistic warehouse, the Manifold that serves it, and recorded agent transcripts.' },
@@ -47,8 +47,8 @@ const DIRECTORY = [
             no card, no fill, no accent — the lobby points, it does not argue. */}
         <div class="start-here">
           <p class="start-label mono">start here</p>
-          <a class="start-title" href="/positions/never-let-the-model-touch-the-database">Never Let the Model Touch the Database</a>
-          <p class="start-line">Why the model should never hold your database credentials — and what to put between them. Three minutes.</p>
+          <a class="start-title" href="/positions/never-let-your-agent-touch-the-database">Never Let Your Agent Touch the Database</a>
+          <p class="start-line">Why your agent should never hold database credentials — and what to put between them. Three minutes.</p>
         </div>
       </div>
       <div class="mast-hero">

apps/website/src/pages/learn.astro

@@ -36,7 +36,7 @@ const groups = [
     heading: 'Positions',
     items: [
       { href: '/positions', title: 'Positions', blurb: 'Positions we hold, stated plainly and linked to their evidence. When the evidence moves, the position moves — with a note.' },
-      { href: '/positions/never-let-the-model-touch-the-database', title: 'Never Let the Model Touch the Database', blurb: 'Breach, bill, and fabrication are one architectural mistake — and they retire together. With the precision × recall 2×2.' },
+      { href: '/positions/never-let-your-agent-touch-the-database', title: 'Never Let Your Agent Touch the Database', blurb: 'Breach, bill, and fabrication are one architectural mistake — and they retire together. With the precision × recall 2×2.' },
       { href: '/positions/the-two-great-sources-of-silent-analytical-failure', title: 'The Two Great Sources of Silent Analytical Failure', blurb: 'The site edition of the paper — four degrees of freedom, two of them structurally deep, and what that implies about where the defense must live.' },
     ],
   },

apps/website/src/pages/llms-full.txt.ts

@@ -57,7 +57,7 @@ ${ch1.trimEnd()}\n\n---\n\n${ch2.trimEnd()}\n\n---\n\n${ch3WithFigure.trimEnd()}
 // copy (it carries the gap list verbatim); it is not authored here.
 //
 // So the 2x2 equivalent is seated exactly where the figure mounts on the page: after the section
-// headed FIGURE_AFTER, which is the SAME anchor `positions/never-let-the-model-touch-the-database.astro`
+// headed FIGURE_AFTER, which is the SAME anchor `positions/never-let-your-agent-touch-the-database.astro`
 // uses. If that heading is ever reworded, this THROWS and fails the build rather than silently
 // dropping the figure out of llms-full — the page's failure mode is a missing figure, which is visible;
 // this document's would be invisible, so it must be loud.

apps/website/src/pages/positions/index.astro

@@ -12,11 +12,11 @@ const FRAMING = 'Positions we hold, stated plainly and linked to their evidence.
 
 const positions = [
   {
-    href: '/positions/never-let-the-model-touch-the-database',
-    title: 'Never Let the Model Touch the Database',
+    href: '/positions/never-let-your-agent-touch-the-database',
+    title: 'Never Let Your Agent Touch the Database',
     stamp: 'July 2026 · v1.0',
     // Verbatim from the piece — its own thesis sentence, not a re-description.
-    pull: 'The model never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.',
+    pull: 'Your agent never touches the database. Not directly, not through generated SQL, not through a guardrail that inspects the SQL it generated anyway.',
   },
   {
     href: '/positions/the-two-great-sources-of-silent-analytical-failure',

apps/website/src/pages/positions/never-let-the-model-touch-the-database.astro → apps/website/src/pages/positions/never-let-your-agent-touch-the-database.astro

@@ -1,5 +1,5 @@
 ---
-// /positions/never-let-the-model-touch-the-database — the blast-wall position, ratified v1.1 (the
+// /positions/never-let-your-agent-touch-the-database — the blast-wall position, ratified v1.1 (the
 // file's own byline stamps its date + version, so the page renders no second stamp).
 //
 // The body renders VERBATIM (byte-identical to the ratified attachment; see the corpus copy). The 2x2
@@ -23,7 +23,7 @@ const sections = raw.split(/\n(?=## )/).map((part) => {
   return { heading: m ? m[1].trim() : null, html: marked.parse(part) };
 });
 ---
-<BaseLayout title="Never Let the Model Touch the Database — datumwise"
+<BaseLayout title="Never Let Your Agent Touch the Database — datumwise"
   description="A position held by datumwise: breach, bill, and fabrication are one architectural mistake, and they retire together the moment the model stops touching the database.">
   <div class="page-head">
     <p class="kicker"><a href="/positions">Positions</a></p>

apps/website/src/styles/tokens.css

@@ -334,7 +334,15 @@ h1, h2, h3 { font-family: var(--font-serif); font-weight: 600; line-height: 1.15
           first. (Subsumes the earlier "real path over rendered text" — same rule, generalised.)
        3. "Brace-count, don't assume" — after any CSS/structural removal, verify balance before
           trusting the edit; a regex that eats a closing brace ships silently.
-       4. "A guard that emits a SENTINEL is not fail-closed — only a non-zero exit is." A generator
+       4. "A fixed-string grep cannot see a LINE-WRAPPED occurrence." Sweep for a distinctive SHORT
+          partial, never the full phrase, whenever the target is prose that may wrap. Found twice in
+          one turn during the position rename: a grep for the full title missed the figure component's
+          comment (title wrapped mid-phrase), and then a grep for "the model holds no database
+          credentials" missed line 85 — where the line breaks after "no". Even the shortened partial
+          "holds no database" still spanned the wrap. This is the same failure family as
+          name/path/package/tree-state, in a fifth disguise: the probe did not match the referent's
+          actual shape.
+       5. "A guard that emits a SENTINEL is not fail-closed — only a non-zero exit is." A generator
           that caught a missing package and wrote `null` felt safe and shipped 0.12.0 to prod under
           copy saying 0.12.1. Sentinels get consumed by a downstream fallback and become plausible
           wrong values; a non-zero exit cannot be. And every guard is verified in BOTH directions —