Green On Evidence
For dashboards that turn green on intention instead of proof — make every green carry a witness.
The ingredients 5 gifts
Pick your depth — take the quick way in, the full walk-through, or the deep build. Same recipe, your call today.
Quick you want dashboards that turn green on proof, not intention
The dangerous status is a green nobody earned — a flag was set, a file exists, a step 'ran.' The move: for each thing on your board, declare which EVIDENCE counts as proof, and refuse green without it.
Start with one board item and its witness. Grow the witness map as you add claims.
WITNESS = { # for THIS claim, what proves it green?
"docs-current": lambda: derived.is_current("docs/"),
"tests-real": lambda: gauntlet.still_fires("suite"),
}
def status(claim):
return WITNESS[claim]() # green ONLY if the evidence checks; else redWorking you want to understand the assembled gate
The five parts below walk it: plumb turns green on evidence not intention, derived checks a generated file is current, gauntlet proves a check still fires against a known fault, parity finds disagreement, census inventories.
You supply the witness map — for each claim, which evidence counts as proof it's really green.
Deep you want the honest bound of every layer
Every layer is visibility, not immunity: gauntlet proves your check fires against the fault you THOUGHT of, not the one you didn't. derived proves currency against the command you NAMED, not a build step you forgot to declare. parity finds disagreement against the checklist you WROTE — a criterion missing from the checklist is a green it will never question.
The gate makes your green auditable; it cannot make your witness map complete. That's a human judgment about what counts as proof.
For real use: treat every incident where a green lied as a prompt to ADD a witness, not to distrust the gate.
The idea
The most dangerous status is a green one that nobody earned. A dashboard goes green because a flag was set, a file exists, a step 'ran' — not because anything was checked. These gifts assemble a gate that refuses that. plumb is the audit pattern for exactly this: a check that turns green on evidence, never on intention. derived asks whether a generated file is actually current against the command that makes it, or just present. gauntlet asks the meta-question — does your check even still catch the fault it claims to? parity compares N things against one checklist and shows precisely where they disagree. census feeds the whole thing the inventory of what should be checked.
The parts + how they wire
census walks the surface and emits the set of things that claim to be done → gauntlet is the filter that first proves each check is live (a check that has silently stopped catching its fault is worse than no check) → derived filters out the 'present but stale' greens: a build output that exists but is older than its source is not done → survivors fold through parity, which lines every remaining claim against the shared checklist and emits exactly which cell disagrees. plumb is the discipline the whole pipe implements: no cell goes green without a witness beneath it. The output is a board where every green is a claim you can click down into and see the evidence for.
The one piece you build
The witness map: for each thing on your board, which evidence counts as proof it is really green. The gifts supply the staleness check, the fault-in-the-check check, the disagreement finder, and the inventory; you supply the one component that says 'for THIS claim, the witness is THIS artifact / this test / this hash' and routes each claim to its proof.
The technical breakdown
The layered refusal is the design. gauntlet runs first because a check you trust that no longer fires is the failure mode that survives every other layer — it mutates the input to confirm the check still says no when it should. derived's currency test is decidable and cheap: it re-derives (or dry-runs) the generating command and compares, so 'stale but present' can never read as done. parity's value is that it localizes — not 'something disagrees' but 'row 4, column B is where these two configs diverge,' which is the difference between a red light and an actionable red light. plumb ties it together as a standing rule rather than a one-off: the board's contract is that green requires a named witness, and the witness map you built is that contract made concrete. Call it ~120 lines: the witness routing table, a runner that invokes each layer, and a composer that only emits green where every layer passed with a witness.
The honest edge
gauntlet proves your check still fires against the fault you thought of — not against the fault you didn't. derived proves currency against the command you named, not against a build step you forgot to declare. parity finds disagreement against the checklist you wrote; a criterion missing from the checklist is a green it will never question. Every layer here is visibility, not immunity: the gate is exactly as good as the witnesses you assign, and its whole value is that it forces you to name them out loud instead of trusting a flag. It cannot make a green true — it can only refuse a green that has no evidence behind it.
These are ingredients, not instructions you have to follow. Take these parts and cook something — the recipe as written, a variation, or something we'd never have thought of.
Built it, got stuck, or found a mistake? Shea wants to hear it — success stories, questions, and bug reports all land in the same inbox: