Green On Evidence
For dashboards that turn green on intention instead of proof — make every green carry a witness.
The ingredients 5 gifts
The idea
The most dangerous status is a green one that nobody earned. A dashboard goes green because a flag was set, a file exists, a step 'ran' — not because anything was checked. These gifts assemble a gate that refuses that. plumb is the audit pattern for exactly this: a check that turns green on evidence, never on intention. derived asks whether a generated file is actually current against the command that makes it, or just present. gauntlet asks the meta-question — does your check even still catch the fault it claims to? parity compares N things against one checklist and shows precisely where they disagree. census feeds the whole thing the inventory of what should be checked.
The parts + how they wire
census walks the surface and emits the set of things that claim to be done → gauntlet is the filter that first proves each check is live (a check that has silently stopped catching its fault is worse than no check) → derived filters out the 'present but stale' greens: a build output that exists but is older than its source is not done → survivors fold through parity, which lines every remaining claim against the shared checklist and emits exactly which cell disagrees. plumb is the discipline the whole pipe implements: no cell goes green without a witness beneath it. The output is a board where every green is a claim you can click down into and see the evidence for.
The one piece you build
The witness map: for each thing on your board, which evidence counts as proof it is really green. The gifts supply the staleness check, the fault-in-the-check check, the disagreement finder, and the inventory; you supply the one component that says 'for THIS claim, the witness is THIS artifact / this test / this hash' and routes each claim to its proof.
The technical breakdown
The layered refusal is the design. gauntlet runs first because a check you trust that no longer fires is the failure mode that survives every other layer — it mutates the input to confirm the check still says no when it should. derived's currency test is decidable and cheap: it re-derives (or dry-runs) the generating command and compares, so 'stale but present' can never read as done. parity's value is that it localizes — not 'something disagrees' but 'row 4, column B is where these two configs diverge,' which is the difference between a red light and an actionable red light. plumb ties it together as a standing rule rather than a one-off: the board's contract is that green requires a named witness, and the witness map you built is that contract made concrete. Call it ~120 lines: the witness routing table, a runner that invokes each layer, and a composer that only emits green where every layer passed with a witness.
The honest edge
gauntlet proves your check still fires against the fault you thought of — not against the fault you didn't. derived proves currency against the command you named, not against a build step you forgot to declare. parity finds disagreement against the checklist you wrote; a criterion missing from the checklist is a green it will never question. Every layer here is visibility, not immunity: the gate is exactly as good as the witnesses you assign, and its whole value is that it forces you to name them out loud instead of trusting a flag. It cannot make a green true — it can only refuse a green that has no evidence behind it.
These are ingredients, not instructions you have to follow. If you cook something from them — or something stranger — we want to see it.