Resilience

Before the change

1. Name the intended business outcome and credible customer harm.
2. Map the services, stores, queues, vendors, people, and timing assumptions involved.
3. Trace at least three realistic failure paths:

• one dependency or component failure;
• one multi-factor path;
• one human-plus-technical path.

1. Classify consequence, reversibility, coupling, uncertainty, and blast radius.
2. Define safe degraded behavior and the operator recovery path.

Defenses

Use the smallest independent, observable, testable defenses that materially reduce harm.

• Enforce authorization and tenant isolation at every trusted boundary.
• Make retries idempotent or detect duplicates explicitly.
• Bound retries and timeouts. Prevent retry storms and infinite hidden work.
• Expose pending, stale, conflicted, partial, and failed states honestly.
• Preserve an audit trail for consequential state changes.
• Put irreversible or high-impact actions behind preview, confirmation, or policy.
• Make automation observable, interruptible, and recoverable by a person.
• Scope rollout with flags or migration stages when blast radius warrants it.
• Do not add more coupling than the defense removes.

AI and agent identity

Agent identity and accountability are safety properties, not optional branding.

• Every agent has a persistent non-human identity and is visibly marked as an AI agent wherever it invokes, authors, suggests, acts, waits, or appears in evidence.
• Never give an agent a human identity treatment or present machine work as though it came from a person.
• Keep the accountable person or role visible when work is delegated. An agent may act; it is not the accountable human.
• Distinguish suggestion, pending approval, executing, completed, partial, failed, and committed product state.
• Consequential actions expose scope, external effects, reversibility, approval, audit, interrupt, and recovery paths.

Verify identity in compact, expanded, mobile, screen-reader, exported evidence, notification, and audit contexts. A hidden disclosure or a one-time onboarding message does not satisfy the contract.

Review the operator

Ask what the dispatcher, technician, owner, support person, or agent knew at the time. Account for workload, production pressure, incentives, missing context, overrides, and common workarounds. Human adaptation is a defense to support, not noise to eliminate.

Verify

Test the normal path plus the applicable degraded paths:

• unavailable and slow dependencies;
• stale data;
• duplicate, delayed, and out-of-order delivery;
• partial completion and retry;
• lost connectivity and reconnect;
• revoked or insufficient authorization;
• cross-tenant isolation;
• rollback, reconciliation, and manual recovery.

Require telemetry that reveals the business outcome, not only a successful API response.

Incident output

Return:

• Decision: proceed, proceed with conditions, or redesign.
• System boundary: actors and components included.
• Failure paths: trigger, contributing conditions, defenses, impact, detection, containment, recovery.
• Human factors: available information, workload, incentives, overrides, and adaptations.
• Required changes: ordered by risk reduction.
• Verification: tests, telemetry, rollout, and rollback evidence.
• Residual risk: what remains accepted and why.

Name a proximate trigger when useful, but do not stop at a single root cause or “human error.” Recommend changes that reduce a class of harm without creating disproportionate complexity.

For low-consequence, easily reversible visual work, keep the review light. Ceremony scales with credible harm.

Applied bookmark research

Reviewed 2026-09-06. These are Thorbis applications and review exercises, not replacements for DESIGN.md, COMPONENTS.md, or the owning skill. Linear remains the operational baseline. External advice that conflicts with the constitution stays out.

These worked examples are not a claim that the product behaviors have been implemented or verified.

Immediate acknowledgment is not confirmed success

Owning skill: resilience.

A fast animation can falsely tell a person that money moved, a message arrived, or an assignment was saved.

Distinguish initiation, pending work, confirmed outcome, failure, and uncertain outcome. Show what is known. A repeated request needs a deliberate recovery path, not a second untracked business action.

Thorbis example: Collect payment keeps its label while the request is pending. A timeout says the result is not yet known and provides a way to check it; it does not invite an unconditional second charge. Confirmation names the actual result.

Verify: Review pending, explicit rejection, timeout after submission, reconnect, and repeat activation. Confirm that copy does not claim settlement from mere request acceptance and that a recoverable draft is preserved.

Do not import: No optimistic completion for consequential work, invented delivery guarantee, or success decoration that hides uncertainty.

Evidence: 7 Principles of Rich Web Applications (opens in a new tab); Philosophy (opens in a new tab); Web Interface Guidelines (opens in a new tab). Source access limits.

All 26 sources and review limits.