#10 - controls.sh — no way to answer which controls a project actually has - null/Project-Template

null commented

2026-08-17 22:51:06 -05:00

Owner

The question a buyer or an auditor asks is not whether the code works but which controls are present before anyone depends on it. The Command Center answers that for documents and tracker labels. Nothing answers it for operations.

Measure what can be measured: a recent backup, a restore verified within N days, a healthcheck configured, an error-tracking variable set, rate-limit configuration present, an audit trail, a non-production environment, and status.sh --deployed-version agreeing with the checkout.

Constrained by this tree's own doctrine:

Measure, do not assert. Each row is measured, declared, n/a or unknown, and an unknown prints as unknown. Absence is never rendered as a measurement.
Write no committed status file. A CONTROLS.md full of 'backups: ok' rots exactly as the batch ledger did. What is committed is the intent in OPERATIONS.md; the live answer comes from running this.
Ask only about declared controls. A library with no deployment must not be told it is missing a healthcheck -- an inapplicable control reported as a gap is the same sin as an unknown reported as a measurement.
Plug into verify.sh via VERIFY_GUARD_DIR rather than inventing a runner.

Verify: controls.sh prints a state per control including n/a for declared-inapplicable ones, exits 2 when it could measure nothing, runs under verify.sh, and has its row in docs/architecture/README.md.

The question a buyer or an auditor asks is not whether the code works but which controls are present before anyone depends on it. The Command Center answers that for documents and tracker labels. Nothing answers it for operations. Measure what can be measured: a recent backup, a restore verified within N days, a healthcheck configured, an error-tracking variable set, rate-limit configuration present, an audit trail, a non-production environment, and status.sh --deployed-version agreeing with the checkout. Constrained by this tree's own doctrine: - **Measure, do not assert.** Each row is measured, declared, n/a or unknown, and an unknown prints as unknown. Absence is never rendered as a measurement. - **Write no committed status file.** A CONTROLS.md full of 'backups: ok' rots exactly as the batch ledger did. What is committed is the intent in OPERATIONS.md; the live answer comes from running this. - **Ask only about declared controls.** A library with no deployment must not be told it is missing a healthcheck -- an inapplicable control reported as a gap is the same sin as an unknown reported as a measurement. - Plug into verify.sh via VERIFY_GUARD_DIR rather than inventing a runner. Verify: controls.sh prints a state per control including n/a for declared-inapplicable ones, exits 2 when it could measure nothing, runs under verify.sh, and has its row in docs/architecture/README.md.

null added this to the Batch 01 — Production-readiness controls milestone 2026-08-17 22:51:06 -05:00

null added the

P2

label 2026-08-17 22:51:06 -05:00

null referenced this issue from a commit

2026-08-17 23:11:54 -05:00

feat(ops): controls.sh, which controls this project actually has

null closed this issue

2026-08-17 23:11:54 -05:00

controls.sh — no way to answer which controls a project actually has #10