Order 1 continues referencing user id 1 while that user email changes. Identity generation, key constraints and authorization remain separate responsibilities.

A surrogate key keeps identity apart from meaning

A surrogate primary key separates row identity from a business value that can change. A customer’s email can be corrected while orders continue referencing the same customer identifier. This is useful when the business name is mutable or wide, but stability comes from schema and application policy. A generated number is not automatically immutable, secret, globally unique, or an authorization decision. ...

February 2, 2028 · 5 min · XB Field Notes
Client and agent exchange signing requests and signatures; a separate server box denotes an independent authorization decision, without a private-key-export path.

ssh-agent remembers your decrypted keys while you work

An SSH agent provides signing operations for public-key authentication. For ordinary software keys, loading an encrypted private key unlocks material that the agent can then use without asking for the file passphrase on every connection. Clients receive public identities and signatures, not an exported private key through the normal agent protocol. Hardware-backed identities are different: the authenticator can retain the private key and require touch or verification. ...

February 27, 2027 · 5 min · XB Field Notes