Principles
The short form of how I build. Each one descends from a system that proves it or a paper that derives it.
- Envoy
Broker, not store
A credential is injected only at the broker’s egress to its provider. It is never returned by any endpoint, never logged, never handed to an app. Everything outside the broker holds at most a low-value, revocable scoped token.
custody · secrets
- Notary
Delegation, not impersonation
An autonomous actor acts for a member as a distinct, capped identity — subject, audience, actor — never by holding the member’s own login. A grant is policy, not a secret.
identity · delegation · consent
- Curator
Records, not bytes
The platform’s value lives one layer above byte storage — the graph of people, places and things a record refers to. Apps keep their bytes; the platform keeps the meaning.
data · architecture
- Authoritative Data Registers
Referenced, not copied
Every shared fact has one designated, accountable source. Everyone else references it. A copy is a liability that drifts.
data-governance · registers
- Valet
Custody is architecture, not policy
If a secret can reach a place, assume it will. Design so that it cannot. The tool holds the token; the model never sees it.
custody · agents · secrets
- Nexus testing practice
Test reality’s acceptance, not our intent
A green suite proves the code does what the tests expect. It does not prove the system does what the world requires. Six defects once shipped through a fully green suite; the remedy was to test trajectories against reality, not snapshots against intent.
testing · discipline
- Foyer
If a label requires the user to understand the architecture, it’s wrong
A non-technical household admin must never need to know what a container, a CRD or a namespace is. The translation is absolute — and the worst leaks hit the least technical person at their most anxious moment.
ux · operability
- Computation, Data, and Agent Dynamics · Tenet 1
Optionality preservation
The first criterion for any data decision — retain, externalize, join a structure — is whether it preserves or reduces the agent’s future capacity to choose. Irreversible decisions and compounding extraction weigh more than equivalent immediate cost.
sovereignty · framework
- Nexus plans
The name is cheap; the split is the decision
Rename freely; a wrong boundary is expensive. Decide what a component owns and does not own first. The name follows — and name collisions are a real cost worth tracking.
architecture · naming