Development record
2026-10-22 — A checklist never holds a password, token or anything that retrieves one, only its kind, scope and expiry, and this is written up as its own trust rule (product thinker's ruling of 2026-10-22, itd-2610170638184486 K-split i): routed through the decomposition table as a trust rule, so it becomes an ADR and a clause of the brief's invariants rather than a line inside the checklist intent
decisiondcn-2610222025224993
2026-10-22 — A checklist never holds a password, token or anything that retrieves one, only its kind, scope and expiry, and this is written up as its own trust rule (product thinker's ruling of 2026-10-22, itd-2610170638184486 K-split i): routed through the decomposition table as a trust rule, so it becomes an ADR and a clause of the brief's invariants rather than a line inside the checklist intent
Frontmatter
| id | dcn-2610222025224993 |
|---|---|
| type | decision |
| date | 2026-10-22 |
.abcd/work/decisions/dcn-2610222025224993-a-checklist-never-holds-a-password-token.md
open on GitHub ↗ · commit history ↗
mentions2
- adr-2610222026265719A session's checklist names a credential by its kind, scope and expiry, never its value or anything that retrieves it
- itd-2610170638184486Every session keeps a checklist on disk, so no run stalls and no stall spreads