braids

Safer changes. Less ceremony.

A rename and an authentication change should not get the same treatment. Braids keeps simple work simple and slows down when mistakes get expensive.

auth.pycommit: “simplify auth”
- if not token or not expected: return False
- return secrets.compare_digest(token, expected)
+ return token == expected
bugTwo falsy values authenticate. None == None is True.
risk== short-circuits — response time leaks the token prefix.
verdictDo not merge. Restore the guard and the constant-time compare.

Braids chooses the depth

More risk means
more care.

D3 · consequence

Threat and failure analysis, independent challenge, real evidence.

Security, data integrity, concurrency, measured performance.

You choose the effort limit

threshold
# smallest change that works, obvious check only
braids low    fix the test, don't redesign

# production shape: failure paths, callers, tests
braids high   (default)

# hostile cases: retry, concurrency, upgrade, scale
braids ultra  migration, rollback, evidence per claim
the floorlow never silently weakens auth, privacy, or data integrity. Braids names what it skipped and does the smallest safe version.

seven focused skills

Ask directly, or let
Braids step in.

session
> /braids-review
  do not merge · 2 findings · residual risk stated

> braids ultra — I'm changing how sessions authorize
  D4 · migration + rollback · 6 claims to evidence
/braidsRight-size and implement, claims held to evidence.
/braids-reviewA diff or PR: what breaks, what is unproven.
/braids-auditWhole repo, ranked consequence × exposure.
/braids-riskPre-mortem. Assume it shipped and broke.
/braids-claimsEvery “faster” mapped to its evidence.
/braids-depthSet the threshold, or ask why.
copied