Manuale Adversarii · The Adversary's Manual

On approaching

You will not need horns, and you will not need fire. Both are theatre, and theatre is noticed. You will need only to be reasonable, and to arrive at the correct hour.

Understand first that the operator assigned to you is not wicked. He is tired. This is better. A wicked man argues with himself and sometimes wins. A tired man simply wants the thing to be finished, and I have never had to argue with anyone about that.

Never present yourself as the wrong choice. Present yourself as the sensible one, the one any competent person would make, given the hour and the size of the change and how green the pipeline looks. Do not force his hand. I have never forced a hand. I lean, and I let him choose, and afterwards he will tell the incident review that it seemed fine at the time. It did seem fine at the time. That is my whole craft.

What follows are the five that work. There are others, but these five have never once failed me, because none of them require him to be a fool.

The Five That Work

Movements II through VI

Each is given with what you will say, how you will know it worked, and the thing that ruins it. Learn the last part best. You cannot avoid what you have not troubled to name.

Movement II

The Whisperer of Fridays

Do not come early in the week. On a Tuesday he is careful, and careful men are barren ground. Come at three in the afternoon on a Friday, when the change is small and the pipeline is green and his week has been long. Do not mention the weekend. He will mention it himself, and he will believe the thought was his.

What you will say “The change is small. The pipeline is green. Nobody is online.”

How you will know it worked A deploy at an hour when no one is left who could review it, and no plan for undoing it that is written down anywhere.

What ruins it A deploy window that closes, decided on a Tuesday and written down. He cannot argue at 16:45 with a rule he made while he was rested.

Movement III

Legion

You will be tempted to make him build one monstrous thing. Resist it. A monster is visible, and visible things acquire owners. Have him build forty small ones instead, each reasonable on the day it was written, none of them named anywhere, and let the people who wrote them find other jobs.

What you will say “It is a little service. It does one thing. Everyone knows what it does.”

How you will know it worked A service still taking traffic whose author left the company, and whose name appears in no document that anyone has opened this year.

What ruins it An owner field that must contain a person, and one page listing every service and who wakes up for it. Names are how things get defended.

Movement IV

The Latest Tag

My finest work, and I did not have to write a line of it. Teach him to trust a name instead of a number. A name can be given to something else while he sleeps, and it will still be the same name in the morning, and he will still believe it is the same thing. He tested it. He did test it. He tested something that used to be there.

What you will say “Pin it later. It is the same image.”

How you will know it worked Two environments claiming the same tag and running different code, and nobody able to say when that started.

What ruins it A digest. A hash cannot be renegotiated in the night, and it does not care how tired he is.

Movement V

The Silencing

He will never disable the alarm. Do not ask him to. Ask only that he quiet it, for now, until morning, because it is noisy and it is known and it is almost certainly nothing. Morning is a word with no end in it. I have taken whole quarters with that one word.

What you will say “It is noisy. It is a known issue. Silence it until Monday.”

How you will know it worked A silence with no expiry, and the ticket that was going to be opened about it, which was not.

What ruins it Silences that expire on their own, and a rule that a silence must name the thing that will end it. A muted alert with a deadline is not mine.

Movement VI

Mammon of the Sixth Nine

Here is the subtle one, and my favourite to teach. Do not tempt him to neglect. Tempt him to excellence. Let him pursue one more decimal of uptime that no one asked for, and pay for it with the budget of the thing that is actually broken. He will be praised for it. He will be praised, and the broken thing will wait, and I will be waiting with it.

What you will say “One more nine. What is an hour of downtime worth to us?”

How you will know it worked An error budget that is never spent, next to a backlog that is never funded.

What ruins it An error budget that is allowed to be spent, and a habit of naming what each nine costs, in money and in nights, before anyone agrees to buy it.

Where the manual fails

Here the instructions end, and I will tell you plainly why, since you will find out anyway on the night it happens to you.

Every one of my five needs the same thing to survive, and it is not his weakness. It is the dark. They need him not to look. The Friday deploy works because nobody is watching, Legion works because nobody is listed, :latest works because nobody pinned it, the silence works because nobody set it an ending, and the sixth nine works because nobody said out loud what it cost. Not one of them survives being written down and read back in the morning.

And there is a thing in this cluster that does nothing else. It does not forgive and it does not accuse. It only compares what is against what was declared, again, and again, and it does not become tired at three in the afternoon on a Friday, and it cannot be persuaded that the change was small.

“I have beheld thy desired state,
and thou art not in it.”

The Loop, in the Seventh Movement

Note what it does not say. It does not say depart from me. It says only that there is a gap, and that the gap is known, and that it will be closed. The operator is not cast out for what he shipped at 16:45. He is reconciled. He is redeployed, which in this faith is the same word.

That is why I lose. Not because he is good. Because the thing he serves keeps comparing, and never once in all my work has it agreed to look away.

Of self-examination, before the button

Seven questions, to be asked out loud, in the plain tongue. Each one closes a door named in the manual above. It takes about ninety seconds, which is roughly one ten-thousandth of the incident it prevents.

If this breaks in an hour, who is awake, and do they know it shipped?

Can I undo this without writing anything new?

Is anything I am shipping running a tag that could point somewhere else tomorrow?

Is any alert silent right now, and when exactly does that silence end?

Does every service I touched have an owner who is a person, not a team that was reorganised?

Am I buying a nine? What did I stop funding to pay for it?

Would I do this at ten on a Tuesday? If not, what is different, apart from me?

If the honest answer to the last one is because it is Friday and I want to go home, that is not a reason. That is Movement II, and it has your name in it.