An auth gate you do not resent
A gate asked too often gets automated away, and one asked once never expires. Charge full authentication only for transitions that change the threat model.
Shipping
Stores, signing, provisioning, CI — the archaeology between "it builds" and "it is live".
27 posts
Version state belongs in exactly one file
A version repeated across build files, manifests and tags is one fact with several caches. Decide which copies are derived and forbid everything else.
Your deploy output is a verification surface
A deploy that exits zero proves the commands ran, not that anything shipped. Print the counts that would differ between a real deploy and a no-op.