What is worth carrying forward?
Research, viewpoints and design decisions, with sources to revisit.
Index3 notes
- 01
Procurement contracts do not define enterprise software security boundaries
Critical PHP vulnerabilities provide a starting point for examining how enterprises can connect software dependency inventories, impact assessments, decision-making authority, and verification in production. An SBOM is a starting point, a patch release is not the end, and unknown should not count as safe. - 02
AI remembers. But which decision still applies?
Old website copy was still there, but it no longer matched the current decisions. A revision experience raises a broader question: memory needs not just history, but scope, confirmation status, and explicit replacement relationships. - 03
Fixed Once Is Not Fixed Forever
A routine check found duplicate agent-skill names, drifting configuration copies and leftover directories. The more dangerous failure was treating an old “fixed” record as a guarantee about today.