Skip to main content
Certificate of Conformance #003. The tool behind Thesis 3: it watches for work that should have happened and did not, and raises a red alarm on absence. A silent failure is still a failure, and this instrument is what refuses to let silence pass unnoticed.

​
The card

FieldValue
Unitsilence-watchdog
Familytool
Version1.0
Statuscertified
Issued2026-07-11
Work ordercertify the factory’s own tools (WO-A8, issue #132)
Principalthe operator of record
A deterministic instrument, stdlib-only, no model binding.

​
Bill of materials

The fixture suite is a constituent for the same reason as its sibling: the proof of work is --self-test, which is meaningless without the fixture obligations it proves against. Note the deliberate exclusion: the production obligation list is not a constituent. It is the work the tool audits, not the tool, and obligations change without the gauge changing.
  • watchdog/silence-watchdog.py, sha256 6d68766d2e4390b90d5c9d1c051d9d93e69fe4cfd2392ca91cf3d82fe2fc24e8
  • watchdog/fixtures/expectations.yml, sha256 41ad32818f0077fa65b3eca24b64551a379fd1cf06e67eafc57b84c8656534a6
  • watchdog/fixtures/artifacts/CODEOWNERS, sha256 90ce66adc9d15b0bfe9add2a86c7235147e79a1f16c47fcba9ae1c4521917a80
  • watchdog/fixtures/artifacts/germline-merges-satisfied.json, sha256 43f45f0bc15c6612fce4be26e00d06c0b4b773de12e718821a489c6b45736030
  • watchdog/fixtures/artifacts/germline-merges-violated.json, sha256 a0d56d7cb7aa69df142b7621e88bfbb8db86655215e1bd5afed87b737d26f248
  • watchdog/fixtures/artifacts/heartbeat-present.txt, sha256 96b33ef2ac685d75d17895419bdcdf0c77e6b2e96339d483b56eebf8efc51dfb
  • Part: none
  • Model: none (deterministic). No model binding at build or run time.

​
Evidence

  • Eval: --self-test fixture battery. Four fixture obligations each evaluated to its expected verdict (two satisfied obligations stayed silent, two violated obligations raised), a verbatim red-alarm title match on the recorded rogue merge, alarm dedupe proved in both title modes (a would-open alarm recognizing an already-open one), and garbage input failing closed. No separate tool-family eval suite exists; the self-test is the family’s eval, recorded as a finding.
  • Proof of work: the raw --self-test output, verdict PASS in both directions.
  • Judge: none. The judge harness is not built yet (a published gap). The probabilistic layer was manual: a second agent’s independent review.
  • Traces: the assembly record (PR #110, the second andon wire) and the certification run (WO-A8, issue #132).

​
Provenance

  • Work order: WO-A8, issue #132.
  • Assembling agent: original assembly and certification both by worker sessions.
  • Trial runs: none required. A tool’s proof is its deterministic fixture suite run in both directions.

​
Liability

  • Owner of record: the operator of record.
  • Escalation: the invoking scheduled job raises the exit-code alarm, an issue opens on the factory’s public repository, and the operator of record takes the call.
  • Recall: kill switch. Revert the tool and its fixtures to the last certified revision (and disable the invoking schedule until done), mark the certificate recalled, find root cause by Five Whys, fix the die upstream, re-run the Verify gates, and re-issue.

​
Expiry

  • Re-certify by: 2026-08-10 (30 days from issue).
  • Triggers: any BOM hash mismatch (the tool or its fixtures changed); a runtime or API dependency change (the interpreter version, the issue-tracker API whose open-issue listing and creation shapes the alarm path depends on, or the commit-time freshness semantics); or 3 production failures. A model swap does not apply: no model binding.

​
First-pass yield

Clean. This tool opened green at Verify alongside #002, no defect verdicts to adjudicate. As with its sibling, the honest limit is that the self-test carries the eval weight for now, so its assurance is exactly as wide as its planted obligations, and that is recorded in the evidence rather than papered over.

​
Self-audit

ClaimSource
Card fields, full BOM hashes, evidence detail, provenance, liability, expirycertificates/silence-watchdog-1.0.md
The obligation list is deliberately excluded from the BOM (audited work, not the tool)certificates/silence-watchdog-1.0.md (BOM preamble)
Four obligations to expected verdicts, verbatim alarm title match, dedupe both modes, garbage input failed closedcertificates/silence-watchdog-1.0.md (Evidence)
Clean first pass at Verifyquality/retros/003-factory-tools-cert.md
Silence monitoring is the second andon wiredocs/factory-design.md:160; Thesis 3