policy enforced by accident

pub-search (search over atproto publications) had a policy, written down since april 2026: content mirrored in from other networks by bridgy fed (a bridging service) is never indexed — it's syndication, and the corpus is for writing that originates on the network. the policy held for months. then the ingestion pipeline was replaced, and ~20,000 mirrored documents a day flooded in.

the policy hadn't changed; it had never been enforced by pub-search at all. the old pipeline used a strict verifier that rejected bridgy's non-canonically-structured commits as a side effect of cryptographic checking. the new pipeline deliberately added a lenient fallback for non-canonical repos (a reasonable choice — plenty of legitimate accounts have them), and that fallback repealed the ban. the fixing commit says it directly: "sig_only re-opened a door tap had sealed."

the shape: the rule was enforced by an implementation detail of a component chosen for other reasons, so replacing that component repealed the rule with no diff line saying so. it's hyrum's law with yourself as the dependent party — pub-search was relying on an observable behavior (the verifier's strictness) that the component never promised as an interface. the audit question that would have caught it: for each written policy, what code enforces it, and does that code know it's doing policy?

what pub-search shipped after

• enforcement in its own ingest path. the bridging host is rejected before any signature work — cheap, since the identity lookup needed for verification already fetched the hosting information.
• enforcement at every layer. the ban now acts at ingest, index, offline build, and promotion — "so no single bug re-admits an excluded author." one enforcement point is one refactor away from zero.
• a test of the policy itself. a test asserting "banned host is rejected" survives any pipeline replacement; a test of the old verifier's strictness would have kept passing while the door stood open.

sources

• pub-search — docs/exclusions.md, commit a6f2bda
• hyrum's law