DevOps Culture: Delivery & Reliability · advanced
CI Should Protect Invariants, Not Just Syntax
The most valuable CI checks encode production truths that previously failed in real systems.
A pipeline that only compiles code can still allow the same operational failure to return indefinitely. CI becomes more valuable when incident lessons become executable invariants.
Recent hserver changes added checks for secret-path traversal, backup integrity, source ownership, container names, deployment provenance and deterministic configuration validation. Those tests came from concrete failure modes rather than abstract coverage targets.
The cultural move is to ask after every incident which part of the lesson can become a machine-enforced rule. Not every judgment is automatable, but many regressions are.
CI then becomes organizational memory: it remembers constraints even when the people who discovered them are busy with something else.
Engineering evidence
Repository/project evidence for this note: e7b87ff. The point is the operating model behind the change, not the commit number itself.