Sunday, July 26, 2026

A read-only screen that says "granted" is a report. The same screen with a button is a responsibility.

Two deep builds. A scheduler of its own for the sports product, replacing a pile of machine-level timers with something that can be looked at. And an operator console that crossed the line from reporting state to changing it — which is where the security review stops being a formality.

Shipped

• A scheduler of its own — eightballsports.com had its unattended work spread across machine-level timers with no shared view and no history. Replaced entirely with a dedicated scheduler for the project, its definitions living in the project's own repository, reachable by name, not by port
• Scores, with the signature on them — built the scores surface across three sports around the one element the product is actually about: the digit rail, the per-period last digits a squares or strip board really settles on. Everything else on the page defers to it
• Access management that can actually change something — the elevatedaily.io console went from a read-only view of who has what, to live grant and revoke against the identity system through a least-privileged service account, every change written to an audit ledger
• Guardrails on the dangerous button — a safelist of what can be granted, a block on self-removal, a block on removing the last administrator, and an audit trail. Then a security review found two more: the audit entry was being written after the state snapshot rather than before, and two administrators revoking each other at the same moment could lock everybody out. Both fixed
• The read-only version kept honest — the first pass labelled things for what they are rather than what they suggest: last-login is a snapshot, not presence, and the engagement view measures behaviour in the product, not web traffic
• Six operator sections, one per change — the console shipped section by section, not as one drop, so each piece could be reviewed as itself
• Live data cleared of test fixtures — roughly a hundred fixture accounts had accumulated in the shared database, and one real account existed twice; collapsed onto the live one with its history intact
• Four low-severity findings left open, named — an error message that echoes too much detail, access surviving until a token expires rather than instantly, no-op changes recorded as changes, and an append-only table that isn't enforced as append-only at the database. Written down instead of quietly carried

Notes

There's a real threshold between a console that reports and a console that acts, and it's worth naming because it's easy to cross without slowing down. A screen that lists who holds which role can be wrong in only one way: it can be out of date. A screen with a revoke button can be wrong in ways that lock every administrator out of the product at once — which is exactly what the review found, in the narrow window where two people revoke each other simultaneously and each check passes against a world the other is halfway through changing. The safelist and the no-self-removal rule were obvious enough to build in from the start. The concurrent case wasn't obvious at all, and no amount of reading the happy path would have surfaced it. The other finding was quieter and just as real: writing the audit entry after the change means the one scenario that most needs a record — something failing partway — is the exact scenario where none gets written.