Appendix B — Engineering Moves

B.5 Put Authority Where the Property Becomes Legible

Problem. An obligation can be checked too early, before the relevant property is observable, or too late, after avoidable cost or consequence has occurred. Later changes can also make earlier evidence stale.

Move. Enforce at the earliest boundary where the property is decidable. If later work can invalidate that evidence, re-establish it at the last safe boundary before consequence.** The analogy to time-of-check/time-of-use (TOCTOU) is useful: a valid check does not justify a later action if the relevant state can change between check and use. Here the intervening change may be another commit, an integration step, a generated artifact, or a deployment transition. See Part IV for the fuller treatment.

Figure B.5-1 places both boundaries on one timeline.

C.5 Put authority where the property becomes legible: check at the earliest legible boundary, re-check at the last safe one A timeline running from where work begins to where consequence occurs. Too early, the property is not yet legible, so a check there decides nothing. At the earliest boundary that can honestly evaluate the obligation, place the check. If later work can invalidate that evidence, re-establish it at the last safe boundary — the last point before the point of no return. The consequence sits at the end of the line. work begins consequence too early property not yet legible earliest legible boundary CHECK last safe boundary RE-CHECK point of no return Enforce at the earliest boundary that can decide the property; if later work can invalidate the evidence, re-establish it at the last.
Figure B.5-1. Earliest legible, last safe. A timeline runs from where work begins to consequence. Too-early sits where the property is still invisible; the earliest-legible boundary carries the first check; the last-safe boundary carries a re-check just before the point of no return.

Example — Abort early. The sentinel first-commit mechanism inspects a newly dispatched agent at its first meaningful commit. That point is early enough to stop bad work before it travels far, but late enough that an artifact exists to check.

Example — Re-prove at completion. Epic completion sits at the other end. Earlier tests may have passed before later integration made their evidence stale. The final Definition-of-Done re-runs the required checks against HEAD before closure, re-establishing evidence at the consequential boundary.

Related mechanisms: Sentinel first-commit early-abort · Pre-commit hook · Staged deploy gates · Epic Definition-of-Done (Final-Opus rerun) · Enforce at the right semantic level.

© James C. Davis, 2026–present