One
Structure should grant access, not describe it
Placing someone in the org chart is the same act as granting them the scope their job
requires. There is no second permissions model maintained alongside your structure —
because a second model is one that will fall out of date, and the platform would then be
enforcing a version of your organization that no longer exists.
This is also why staff titles are cosmetic. Chief, Deputy
Chief and Staff mean whatever they mean in your institution. Guidepost does not
reinterpret them.
Two
Closed networks are the design target
Air-gapped operation was a starting requirement rather than a late accommodation. That
distinction shows up in unglamorous places: no external font or asset host, no build
pipeline to reproduce inside the boundary, no analytics call, and no code path that
opens a connection out of the boundary of its own accord.
A platform that treats the closed network as an edge case
fails in ways you only discover after deployment.
Three
A finite feature set beats an extensible one
There are eleven content block types, and every author gets all eleven on every page.
There are four organizational levels and four course roles. The sets are deliberately
closed.
An author learns the vocabulary once and it does not change
between courses or between schoolhouses. The cost of that is that Guidepost will
occasionally say no to a request. The benefit is that nobody has to be trained on a
local dialect.
Four
One calculation, used everywhere
Where two parts of the product answer the same question, they call the same code rather
than implementing the same idea twice. Module progress and overall completion compute
from one shared function. Roster fields render on the roster and the course page through
shared components. Alumni access uses one definition of completion, shared by both
surfaces that need it.
Two implementations of one rule will eventually disagree, and
the disagreement will be discovered by a student.
Five
A passing test is not the same as protection
Safety-critical logic is checked by mutation testing — deliberately reintroducing a bug
to confirm the suite actually catches it. This has repeatedly found guards that passed
cleanly against the exact defect they were written to detect.
One example is recorded permanently in the test that failed
to catch it. A fix suppressing progress bars on the Alumni page was verified by asserting
that the percentage bar's marker was absent. It passed — while a second bar, behind a
second guard, was still rendering. "The element is hidden" and "the element is hidden for
the reason I think" are different claims. Only one of them was true.
A second example arrived with the
Dark theme, and no check saw it. Nine solid navy
surfaces — table headers, the module bar, the statistic tiles — dissolved into the dark
page behind them, at a contrast of 1.12 against the card they sat on. Every contrast
assertion still passed, because the text on those blocks is white and reads at 15:1 on
either navy. What was lost was the block, not the text. It was found by somebody looking
at a full-page screenshot, which is the entire argument for taking them.