Prove it can fail
A green board proves nothing unless every light on it can go red. This skill exists because
nine-plus separate incidents produced green signals with no assertion behind them — including
a statutory control that had never been asserted on any run, ever, and verification files
that printed pass on any error. Layer: hub for test-and-check integrity (this is one of the
six always-on norms; the norm line is the everyday trigger, this file is the playbook).
The question that does the work
For every check you write or review, ask: what does this output if the thing it guards is
broken? If the honest answer is "still green", "a skip", or "nothing", the check is
theatre. Answer it by demonstration where cheap: break the guarded thing once, watch the
check go red, revert.
Rules
- A server reply is never a skip. Skips are for transport failures only — could not
connect, no credentials. A catch-all
catch { skip } hid both a never-passable gate test
and a would-be-green total outage. A skipped regulated check is unverified, not green;
say so in the run summary.
- Seeds get assertions. Fire-and-forget seeding let an RLS isolation test pass for the
wrong reason (nothing was seeded, so nothing leaked). Assert the seed landed before
asserting the behaviour.
- Negative assertions need a positive control. "User B sees nothing" is only meaningful
next to "User A sees the row". Without the positive control, an empty database passes.
- Only the specific expected error proves a control fired. "It threw" is not "the gate
caught it" — assert the error identity (a stable code, not the human-readable message).
- A check whose two operands share a source is theatre. A "reconciliation check" that
compared a value against its own definition could never fail. Trace both operands to
independent sources.
- Watch a newly-armed gate's first run to completion — a nightly-gated spec once merged
having never executed. And after fixing a pipeline's first red step, watch the whole run
go green: a second failure can be queued invisibly behind the first.
- Test every mutation shape the app performs against a guard — set, swap, and null are
three different attacks; a guard proven against one is unproven against the others.
- Assert on the subject, not a document-wide pattern. A broad "no X anywhere in the
output" assertion is a hidden dependency on everything else and breaks on innocent code.
- A passing test can encode the bug. When fixing a bug, check whether a green test pins
the wrong behaviour — two tests once codified drop-this-content as correct.
Mechanics note: a CI check that reads a snapshotted event payload (e.g. a PR body) cannot be
re-run into a pass after the source is edited — close/reopen refreshes the payload.
Routes
- Test, smoke, or seed touches a shared or live database → load safe-smokes before writing it.
- A suite has gone broadly red and you are tempted to debug → load mass-red-triage first.
What this skill does not do
It does not triage failures (mass-red-triage) and does not govern shared-data hygiene
(safe-smokes). It governs whether a check is capable of telling you the truth.
Why
Green signals with no assertion behind them are worse than no check: they convert "unknown"
into "verified" in every reader's head. Evidence: PropOS LESSONS_LEARNED 2026-07-14 (two
entries), 2026-07-19 (two entries), 2026-07-15, Sessions 16, 18, 30, 33; ASH LESSONS_LEARNED
2026-06-09 and 2026-06-04.
1---2name: prove-it-can-fail3description: Every test, seed, verification script, CI gate, or check must demonstrably be able to fail when the thing it guards is broken. Ask of each check "what does this print if the thing is broken?" Triggers when writing or reviewing any test, smoke, seed, verification file, or CI job, when marking a test skipped, and when arming a new gate. Does not fire on triaging an already-red suite (mass-red-triage) or on how tests touch shared data (safe-smokes).4---56# Prove it can fail78A green board proves nothing unless every light on it can go red. This skill exists because9nine-plus separate incidents produced green signals with no assertion behind them — including10a statutory control that had never been asserted on any run, ever, and verification files11that printed pass on any error. Layer: hub for test-and-check integrity (this is one of the12six always-on norms; the norm line is the everyday trigger, this file is the playbook).1314## The question that does the work1516For every check you write or review, ask: **what does this output if the thing it guards is17broken?** If the honest answer is "still green", "a skip", or "nothing", the check is18theatre. Answer it by demonstration where cheap: break the guarded thing once, watch the19check go red, revert.2021## Rules22231. **A server reply is never a skip.** Skips are for transport failures only — could not24 connect, no credentials. A catch-all `catch { skip }` hid both a never-passable gate test25 and a would-be-green total outage. A skipped regulated check is unverified, not green;26 say so in the run summary.272. **Seeds get assertions.** Fire-and-forget seeding let an RLS isolation test pass for the28 wrong reason (nothing was seeded, so nothing leaked). Assert the seed landed before29 asserting the behaviour.303. **Negative assertions need a positive control.** "User B sees nothing" is only meaningful31 next to "User A sees the row". Without the positive control, an empty database passes.324. **Only the specific expected error proves a control fired.** "It threw" is not "the gate33 caught it" — assert the error identity (a stable code, not the human-readable message).345. **A check whose two operands share a source is theatre.** A "reconciliation check" that35 compared a value against its own definition could never fail. Trace both operands to36 independent sources.376. **Watch a newly-armed gate's first run to completion** — a nightly-gated spec once merged38 having never executed. And after fixing a pipeline's first red step, watch the whole run39 go green: a second failure can be queued invisibly behind the first.407. **Test every mutation shape the app performs** against a guard — set, swap, and null are41 three different attacks; a guard proven against one is unproven against the others.428. **Assert on the subject, not a document-wide pattern.** A broad "no X anywhere in the43 output" assertion is a hidden dependency on everything else and breaks on innocent code.449. **A passing test can encode the bug.** When fixing a bug, check whether a green test pins45 the wrong behaviour — two tests once codified drop-this-content as correct.4647Mechanics note: a CI check that reads a snapshotted event payload (e.g. a PR body) cannot be48re-run into a pass after the source is edited — close/reopen refreshes the payload.4950## Routes5152- Test, smoke, or seed touches a shared or live database → load **safe-smokes** before writing it.53- A suite has gone broadly red and you are tempted to debug → load **mass-red-triage** first.5455## What this skill does not do5657It does not triage failures (mass-red-triage) and does not govern shared-data hygiene58(safe-smokes). It governs whether a check is capable of telling you the truth.5960## Why6162Green signals with no assertion behind them are worse than no check: they convert "unknown"63into "verified" in every reader's head. Evidence: PropOS LESSONS_LEARNED 2026-07-14 (two64entries), 2026-07-19 (two entries), 2026-07-15, Sessions 16, 18, 30, 33; ASH LESSONS_LEARNED652026-06-09 and 2026-06-04.
randommonicle