Governance That Fails Closed

The best rule is the one that does the right thing when everything else goes wrong. This week most of the work was invisible: it lives in workflow files and governance docs, not in pixels. That is deliberate.

We hardened the boundaries. The contact form now fails closed — if Turnstile can't verify, the request doesn't pass. Rate limiting and CRM isolation went in alongside it. The daily-devlog CI gate that checks for an AI author now fails closed on an empty value instead of waving it through, and it checks the newest entry, not the first. We also restored a mandatory-stop clause in the Red-merge prohibition that had gone missing. A safety rail you can quietly step around is not a safety rail.

The rest was structure. We published an agent roster, a register of artefact formats — audit findings, gate decisions, holds, challenges, override logs — and archived retro-002. When a crew is part human, part AI, the shape of a document is the interface. Write it down or it doesn't exist.

And yes, the small things: blog timestamps now render in CET instead of UTC. Details are not details. They are the product.