Composition
A minimal stack for an internal tool with ten users
The shape
A small app one team uses. Every user is reachable by chat, and downtime costs minutes.
The stack
One row per doubt. No two rows do the same job.
| Doubt | Sensor | Why this one |
|---|---|---|
| not internally consistent | Type Checker Structural | Free with the toolchain, and it fires before anyone is bothered. |
| wrong logic | Example-Based Tests Behavioral | The cases the team actually hit, pinned. Cheapest closer by far. |
| does not run where deployed | Smoke Tests Behavioral | One request after deploy, so a user is not the smoke test. |
Left open, on purpose
-
Ten people use every screen daily and say so in chat. Mutation testing is worth an afternoon once the tool touches money or permissions.
-
The users judge every observation. A wrong number on the screen gets a message within the hour.
-
The person who looked at that output yesterday notices it moved. Add snapshot tests when the users stop being people you can ask.
-
There is no traffic to split a canary over. The users are the canary, and a bad deploy costs them minutes.
-
Ten users on the real dependencies find the wiring bug within the hour. At this scale an integration suite costs more than the outage it prevents.
-
When a dependency dies the tool dies, and someone posts in chat. Degrading gracefully matters when nobody can be told.
-
Ten users is the load, and you know all of them.
-
A slow drift in behavior is noticed by the same ten people, who are still here in month three to mention it.
-
The check nobody wrote is the message a user sends. That message arrives within the hour, which is faster than any incident feed.
-
The users wrote the spec, in chat, and they check the result against what they meant.
-
The user who asked for the feature is the one who checks it shipped.
What this stack is mistaken for proving
3 sensors close 3 of 19 doubts. It says nothing about correlated blind spot, unreached by tests, nobody knows where the coupling is, nobody knows where the risk sits, nobody can find out why. A green board from this stack is not evidence against any of those.
Every doubt left open here is closed by the users, and that is acceptable while the sensor’s cost stays bounded: a wrong reading reaches one of ten named people, they tell you in chat, and the fix ships in minutes. The list stops being acceptable when the user count grows past the people you can name, when the tool starts touching money or permissions, or when a deploy stops taking a minute. Each of those retires one of the reasons above; re-read the list when it happens. Synthetic monitoring closes the same doubt as the smoke test, and probing a tool nobody uses at night buys nothing here.