Inheriting a System: Diagnose, Fix, Hand Over.

Hollow Creek Distillery in Bardstown, Kentucky runs entirely on one four-year-old web application — and the developer who built it left six months ago. Ellie, the operations manager, needs someone to take ownership of it: find what is actually broken versus merely annoying, fix the critical few, and write down how it works so the distillery is never one person's memory away from collapse again.

What you're practicing: taking ownership of a system you did not build, with no brief and nobody to ask. Recovering an as-built architecture from running code. Git archaeology across an unfamiliar four-year history. Full-stack bottleneck diagnosis. Verifying a test suite that passes while the app is broken. Recovering a threat model from undocumented auth code. Accessibility remediation on inherited markup. Deciding what to do with a half-built feature. Writing the handover documentation that is the engagement's real deliverable.

The loop is different here. You are not directing AI to build — you are directing it to read and diagnose a system it cannot hold in its context window. AI pattern-matches unfamiliar code and is confidently wrong about how the pieces connect. It treats a passing test suite as proof the system works. It reaches for a rewrite when the work is to find the smallest fix to the largest contributor. You hold the global map AI keeps forgetting, and you verify everything it tells you against the running system, not against its explanation.

Your Role

You are the inheriting maintainer. You own a live system carrying real revenue, and your core discipline is restraint: the smallest change that addresses the largest contributor to a symptom, the guardrail that stops the next regression, and the documentation that was never written. Not the rebuild the code seems to invite.

This is thinner than anything you have done. P21 still gave you a threat-model skeleton, a starter scaffold, and tool configs. Here there is no scaffold and no brief — there is a finished, running, four-year-old system and a list of symptoms. You design the shape of every deliverable: the assessment, the recovered architecture, the handover packet. The system itself is the only specification, and your own structure is the only scaffold.

AI works with you as a tool that needs active management. It does the legwork on every layer that is not the global-coherence judgment — reading files, running git commands, drafting docs. You decide what is load-bearing, you reject the rewrite, and you verify its reading against reality.

What's New

Last time, you designed a security architecture threat-model-first for Kgotla Pay — you built a hardened system from the ground up, ran an adversarial review, and delivered three audience-calibrated artifacts. Everything you verified was something you wrote.

Now nothing is yours. You inherit a system someone else built and left, and you verify what they built without being able to ask them why. Every concept you learned from the building direction returns from the opposite one: architecture you recover instead of design, a threat model you reconstruct from running auth code, a deploy path that lives only in a departed person's memory.

The hard part is honest: some of what looks fine is not, and some of what the client and the code tell you is wrong. Reading that gap — and resisting the reflex to rebuild what you do not fully understand — is the work.

Tools

No new tool category. Every tool is used to investigate, not to build.

• VS Code and Claude Code — directing AI through code neither of you wrote.
• Git — git log, git blame, git bisect against an unfamiliar four-year history.
• Node.js + Express, PostgreSQL, Docker Compose — the inherited stack, brought up locally.
• Prometheus + Grafana — the inherited monitoring.
• The inherited test runner, plus Stryker for mutation testing turned on inherited code.
• npm audit and lockfile inspection — the never-audited dependency tree.
• GitHub — the engagement repo.

Materials

• CLAUDE.md — the engagement governance file: the client, the engagement, the inherited stack, the do-not-break constraints, the restraint discipline, the verification targets, the commit convention.
• hollow-creek-system/ — the complete, running, four-year-old web application. It includes its own stale, partly-wrong CLAUDE.md and a sparse, partly-misleading developer README.md, a seeded database, the inherited test suite, the inherited monitoring config, and the inherited dependency tree.
• references/ — short maintenance-discipline references: forensic discovery, git archaeology against an unfamiliar repo, reading code AI did not write, the restraint heuristic, and a WCAG 2.1 AA mobile quick reference.
• inherited-decisions-log.md and engagement-decisions-log.md — empty log templates.

The brief is Ellie's first Slack message and the running system.