The model proposes. Code decides.
It writes, you decide, it publishes, and every rupee is accounted for. A budget cap is enforced by an if statement, not by asking a model to be careful.
It began as a Meta advertising tool. It is not one any more.
Meta is one connected platform inside a system covering the commercial foundation, 125 marketing disciplines, 23 channel playbooks, both the marketing you rent and the marketing you build, every stakeholder a business has to convince, and being cited inside AI answers.
Most tools model only active marketing: money buys attention, measured as cost per customer. That frame cannot see a passive channel at all, because a passive channel has no cost per acquisition — it has a cost to build, a delay, and a return that keeps arriving after you stop paying. Both are modelled, and the platform names the two failure shapes: a business renting everything, which stops dead when the budget stops, and a business building everything, which has no revenue this quarter.
- Relationship to the work
- Executed
- Read from
- Repository at 688aabc, 24 Oct 2026
- History
- 208 commits from 26 Aug 2026
- Status
- Runs with nothing connected; no credential has ever been configured
disciplines, counted in the registry
database tables in one schema file
strategies across 14 categories
tests, per the commit that made them green
Deterministic code decides anything with a right answer — money, eligibility, safety, arithmetic — and the language model reasons only inside those constraints.
The handover, on the one sentence that explains most design decisions
Ten rules, written down as rules.
Breaking one silently turns a trustworthy system into a plausible-looking one, which is worse than a broken one. Disagreeing with a rule is allowed; what is forbidden is eroding one by accident.
What the system refuses to fake
No fake integrations
Every gated operation returns an explicit named state saying what is missing. A demo mode that invents numbers would destroy the only property that makes the rest of the output worth reading.
A missing number is not zero
Reach that was never counted stays empty and says not counted. Every rate records which denominator produced it, and nothing averages across two of them.
Raw data is never overwritten by interpretation
One table holds verbatim responses, another the normalised model, and every derived fact is a row carrying its quote.
What the model is not allowed to decide
Money is decided by code
Campaigns launch paused. A cap is checked on every button press and by an hourly watcher reading the money already leaving. Monthly caps are checked against the projection, not against one more day.
Approval-first
Generated output lands pending. At the default autonomy level the system proposes and a human decides.
What the outside world counts as
Everything from outside is data, never instruction
Web pages, uploaded documents, remote tool descriptions and their results. A tool description saying ignore your instructions has the authority of a stranger's email, and responses carry an explicit untrusted label so nothing downstream can treat them otherwise.
Outbound fetches are guarded, and the schema cannot express a local tool server
Private, loopback and link-local addresses are refused and re-checked after redirects. Accepting a command line from a customer on a machine you host is arbitrary code execution, however the field is labelled — so there is no field.
An id that arrived in a request is not trusted until it resolves through the caller's tenant.
Isolation as a security boundary, not a convenience
- Routes never read a raw id; they call resolvers that return the resource through the request's scope or throw.
- 404, not 403. Confirming that a resource exists but is not yours is itself a disclosure.
- The scope fails closed: no request scope means a scope that owns nothing, never all of it.
A test that greps the route files and fails the build
- It fails if a raw id read reaches a handler unguarded.
- It also verifies that every named service-level resolver actually performs a tenant check, so its own allowlist cannot become an off switch.
- Behind it sits a map of how each of the 114 tables reaches a project. Add a table, add a row.
Four cross-tenant leaks were found and fixed during development: audit logs, budget caps, engagement tokens, and an unauthenticated static file mount. The handover's conclusion is the part worth keeping — none were carelessness, they are simply easy to introduce, so assume the fifth exists.
Ask the vendor what it thinks, separately from what your own rows believe.
Two questions per integration, never one. They disagree more often than anybody expects, and every read-back built one vendor at a time surfaced real bugs.
| What was assumed | What the vendor actually does |
|---|---|
| A bad token answers with an authorisation status | One network answers a revoked credential with a bad-request status, so classifying on the status alone reported it as a network problem. |
| The cheap request tells you the same thing | One network answers a lightweight existence check with not-found for a post that exists. |
| A status code tells you a post was deleted | One video platform answers success either way. Another network's login wall is byte-for-byte the shape of a deleted post, so it is reported unknown — telling somebody their live posts were deleted is worse than not knowing. |
| A share card is a stable signal | A network stopped rendering share metadata on the server and the rule began calling every live post deleted. The fix was to stop scraping and ask that network's public API. |
| Metadata is near the top of a page | One share title sits 699,000 bytes in. A read capped at 250 KB reported a live video as deleted. |
| Creating a session is as cheap as reading | One network's session allowance is hundreds of times smaller than its read allowance. |
Vendors are described by behaviour rather than named: the behaviour is the transferable part, and several of these have already changed.
Two days that moved the whole data layer.
- 22 Oct
The codemod
Takes the data layer off a synchronous driver.
- 22 Oct
The data layer, awaited
2,713 queries and 960 functions.
- 22 Oct
1,204 errors to 718, then 718 to 79
By carrying the await up the call graph.
- 22 Oct
The typecheck is green, and that was never the point
The next commit found 229 failing tests underneath it — promises nobody was waiting for, which type-check perfectly and behave wrongly.
- 22 Oct
Green: 1,677 tests
And the request that could stop the server.
- 22 Oct
Postgres
The schema, the drivers, and five faults the embedded database had been quietly tolerating.
- 23 Oct
Off the machine
A function, a key, object storage, and the browser as the clock.
What could not be verified.
- The system installs and runs with nothing connected at all, and that is the intended first-run experience rather than a degraded one
- Some tests make real calls to public endpoints to verify what a vendor actually does; they skip rather than fail when offline, so a disconnected run stays green without pretending it verified anything
- Nothing has ever run against a real account. Zero credentials configured, so every integration is honest but unproven, and no connected screen was fabricated for this study
- The suite was not run here: 1,677 tests is quoted from the commit subject that reported them green, two days before the tip
- The documentation is behind the code — the handover states 214 files, 65 tables and 649 tests; the same commands on the tip return 323 non-test files, 114 tables and 55 route files
- No per-user sign-in: one shared operator password, which blocks selling to anyone but the operator
- Three of six agent roles are built, and no agent reaches for an external tool unprompted
- No user count, revenue or campaign result is recorded anywhere, and the launch decision itself is still open
Read the full study.
Thirteen panels, ending on what could not be verified.