live boundary evidence
situation
a protected read plus a durable mutation. local typechecks and the deploy command were green, yet the public route returned an unexpected response deployed. three candidate explanations: client defect, route/deployment mismatch, authorization behaving as designed. treating the deploy result as completion would have hidden the distinction.
why
- green build + reachable deploy prove the artifact, not the feature; routing, authorization, and environment failures live in that gap.
- each claim owns its proving boundary — a claim about deployed behavior is evidenced only at the deployed boundary.
- probing with correlation evidence collapses several plausible explanations into one assigned owner before repair.
invariants
- source validation and live behavior are separate claims with separate proof.
- a health response proves availability, not a feature's route or authority.
- every failure report carries enough stable evidence to reproduce and assign ownership without exposing private data.
- no repair starts until the observed failure is classified at its proving boundary.
decision process
| candidate response | reasoning | decision |
|---|---|---|
| declare success because build and deployment completed | proves a deployable artifact, not a reachable protected feature. | rejected |
| change client code immediately | skips route, authorization, environment evidence; symptom patch. | rejected |
| retry the request until it succeeds | conflates transient dependency failure with deterministic routing/authorization behavior. | rejected |
| probe the exact live boundary and trace its correlation evidence | distinguishes transport, authorization, dependency, durable-side-effect failures in one reproducible observation. | selected |
resulting procedure
- probe health: deployment reachable.
- perform the exact protected request with a valid test identity; inspect status, typed payload, correlation identifier.
- if it mutates state, read the authoritative record or terminal process state afterward.
- record both the successful and denied expectations — authorization is part of the feature.
- response determines next owner: routing/configuration (missing endpoint), authorization (expected denial), request/client construction (validation failure), dependency adapter (retryable failure), service and persistence (violated invariant).
verification
- record revision, environment, exact route/flow, test precondition.
- capture status, typed payload category, correlation identifier, safe response copy.
- inspect the protected diagnostic chain via the correlation identifier.
- on state change, read the authoritative durable fact, not a UI cache or dispatch acknowledgement.
- report the precise proven claim and every remaining unverified branch.
good and bad
bad
build passed; therefore the deployed mutation works
crosses a runtime boundary with no evidence from it. routing, authorization, environment failures all hide in that gap — a "done" feature can be unreachable or wrongly denied in production while every upstream check stays green.
good
live mutation probe → authoritative row read → recorded correlation id
evidence follows the actual route through its durable effect. assigns the failure to one owner — routing, authorization, client construction, persistence — before repair; the recorded correlation id makes the claim reproducible later.