All three scheduled checks were permanently red, which is how a nine-day outage of
the canonize job went unnoticed: one more red cross among red crosses is invisible.
A check that can only ever be red cannot report anything.
An acknowledgement takes a known finding out of the red verdict without hiding it -
it still prints, with its reason and its deadline. Red is reserved for what is not
acknowledged, which is to say: for the new.
Three rules keep the list from becoming the next blind spot, which is the obvious
objection to this whole idea:
- Every entry needs a deadline. Once it passes, the entry stops acknowledging and
says so, so the finding counts again.
- "Permanent" is only expressible as an ADR reference. A permanent exception
without a decision record is already an error per AGENTS.md; here it cannot even
be written down.
- An entry that matches nothing reports itself, so the file cannot quietly
accumulate lines for problems that no longer exist.
Four entries to start: notfallhandbuch (ADR-0016, deliberately unmirrored),
threadnet-wiki (ADR-0015, the wiki mirrors the other way round), gameserver (sorb:
not part of ThreadNet - dated, so the ADR-or-move decision does not drift), and the
zero-job pipeline artifact.
Verified rather than argued, including the counter-proofs #0104 asks for: today
four are acknowledged and one real finding stays red; adding a fresh finding still
turns it red; and with the clock moved past the deadlines the dated entries stop
acknowledging and report themselves. The scope column was added after the first run
showed each check reporting the other's entries as ineffective.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
game-operating was made private on Gitea, and the check quietly skipped the mirror comparison. A repo that IS mirrored but whose far side cannot be read is unverified, and unverified must not look like fine. It is now a finding that names the missing GITEA_TOKEN.
While testing that, a second bug surfaced: the header helper built 'Authorization: token: <value>' from a name that already contained the schema, producing a silently invalid header. The Authentik check had the same defect and would have failed the moment a token was added - it never ran, so nobody would have connected the two.
Refs axion1337.chat/management#28, #31
Looks for things that quietly stopped working. Every check mirrors a case that actually happened this month, named in its docstring: a repo that was never mirrored, mirror drift, pipelines with zero jobs, a successful job without artifacts, an npm package too small to contain a build, and Authentik blueprints stuck on error. Nothing is checked on suspicion.
The project list is read from the group at runtime rather than maintained in code - a hardcoded list is exactly where a new repo slips through for years. The first run proved the point by surfacing two projects nobody had in mind.
It aborts when a credential is missing instead of skipping quietly. A check that disables itself reports nothing for years and is indistinguishable from all clear.
Refs axion1337.chat/management#28
Thore CimbalandClaude Opus 5