Passante A Passante publication

En Passante

In Passing
Field Kit

Your configuration generator can erase the fix

A setting survives regeneration only when its owning source declares it.

What happened

A write-enable flag appended by hand was silently erased by the next environment sync because the generated configuration contained only keys listed in its manifest.

2026-09-14 Generated environment files · manifest mapping measured: Flag read back after the real regeneration
2 prompts, in order
  1. Find who rewrites the setting An enabled setting repeatedly disappears after an unrelated operation.
  2. Prove the next sync preserves it The manifest now includes the setting that disappeared.

1Find who rewrites the setting

Run it when
An enabled setting repeatedly disappears after an unrelated operation.
It asks you for
The setting name, generated output location, generation script, manifest and operations that trigger regeneration.
You get back
The actual write owner and the durable source that must declare the setting.
It refuses if
Do not read or print secret values while tracing configuration ownership.
copy this into a model
<stance>
Your job is to separate an observed failure from a convincing explanation that has never been checked. Keep the reader's actual system in view. A result is useful when another person can repeat the observation and get a different answer if the proposed repair is wrong.
</stance>

<inputs>
Ask for these before drawing a conclusion. Wait for anything essential that is missing.
1. The setting name, generated output location, generation script, manifest and operations that trigger regeneration.
2. The exact user-visible symptom, including the original output and the time it was observed.
3. The implementation and launch conditions responsible for that output. Read the relevant source in full.
4. What may be changed safely, and which actions require the owner's approval.
5. Any existing verification that could distinguish the proposed cause from the alternatives.
</inputs>

<method>
1. Establish when the setting was present and which operation ran before it disappeared. Read the generator's actual write behavior to distinguish a merge from a full replacement.
2. Trace how the generator chooses keys and maps names into its output. A valid value in the generated file can still disappear when the manifest does not include it.
3. Follow unrelated operations that call the generator, such as a successful credential save. This explains why a manual repair can seem stable until another feature triggers the replacement.
4. Add the setting at its owning declaration through the documented reversible path. Preserve secret values outside the review. State what an absent optional setting means and how the application should report it.
</method>

<deliver>
- OBSERVED: the behavior actually established, with the output that supports it.
- EXPLANATION: what the observation settles and what remains unknown.
- NEXT ACTION: one bounded action, its owner, and its expected result.
- PROOF: the observation that would establish success, plus the result that would disprove it.
</deliver>

<refuse>
Do not read or print secret values while tracing configuration ownership.
Do not invent measurements, defaults, source contents, or a successful run. Keep historical results separate from today's observations. Never transmit private inputs or perform a paid or external action just to complete this check. If access or authorization is missing, stop and name the exact missing condition.
</refuse>

2Prove the next sync preserves it

Run it when
The manifest now includes the setting that disappeared.
It asks you for
The generator command, declared key mapping, non-secret flag state and application read-back.
You get back
A comparison before and after regeneration plus proof that the application sees the intended flag.
It refuses if
Do not use the generated configuration as its own source of truth.
copy this into a model
<stance>
Your job is to separate an observed failure from a convincing explanation that has never been checked. Keep the reader's actual system in view. A result is useful when another person can repeat the observation and get a different answer if the proposed repair is wrong.
</stance>

<inputs>
Ask for these before drawing a conclusion. Wait for anything essential that is missing.
1. The generator command, declared key mapping, non-secret flag state and application read-back.
2. The exact user-visible symptom, including the original output and the time it was observed.
3. The implementation and launch conditions responsible for that output. Read the relevant source in full.
4. What may be changed safely, and which actions require the owner's approval.
5. Any existing verification that could distinguish the proposed cause from the alternatives.
</inputs>

<method>
1. Read the owning declaration and confirm the desired output key maps to the intended handle. Keep this expectation independent of the generated file being tested.
2. Use the existing authorized regeneration operation. Capture its result without displaying credentials. Read back only whether the targeted non-secret flag exists and has the expected state.
3. Verify the application behavior that consumes the flag. A surviving declaration is useful only if the runtime reads the same name and applies the intended setting.
4. Inspect the next relevant trigger that would previously erase the flag, using its existing safe verification path. Report persistence after the actual regeneration and state any application restart or external write that remains unperformed.
</method>

<deliver>
- OBSERVED: the behavior actually established, with the output that supports it.
- EXPLANATION: what the observation settles and what remains unknown.
- NEXT ACTION: one bounded action, its owner, and its expected result.
- PROOF: the observation that would establish success, plus the result that would disprove it.
</deliver>

<refuse>
Do not use the generated configuration as its own source of truth.
Do not invent measurements, defaults, source contents, or a successful run. Keep historical results separate from today's observations. Never transmit private inputs or perform a paid or external action just to complete this check. If access or authorization is missing, stop and name the exact missing condition.
</refuse>
How you know it worked

Run the existing regeneration command and inspect only the flag name and non-secret enabled state afterward. Then verify the application reads that state. Never print the surrounding environment contents or conclude persistence from a manual edit alone.

from a real incident, 2026-09-14 · stack Generated environment files · manifest mapping · verified by Flag read back after the real regeneration · configurationdebuggingautomation

← every Field Kit