Skip to main content
Physical factories fail loudly — a jammed press is unmissable. This factory’s pilot line has never once failed loudly. Its actual history: a daily-report automation stopped in mid-May while commits continued. The ready-queue starved politely, week after week — “no actionable items” read as a quiet week instead of a line-stop. Built capability sat unused in a drawer. A cron loop fired into the void, and the pilot line’s own retrospective found the words this thesis is built on: a dead process firing into void is not discipline. It is a ghost doing push-ups. Toyota’s jidoka is designed for defects — bad output detected and stopped. The pilot line’s actual failure mode is absence: no output, no signal, no alarm. So this factory’s andon system carries a second wire the Toyota original never needed:
  • Starvation alarms. An empty ready-queue for N days is a line-stop event, not a quiet week. Pull systems starve politely; that politeness is a defect.
  • Effect watchdogs. Heartbeats verify effects, not executions. A cron that ran is not a cron that worked. The watchdog checks for the expected artifact — the report file, the updated board — and pulls the cord on its absence.
  • Expected-artifact monitors. Every recurring obligation in the standard work declares the artifact it produces and its deadline. Absence of the artifact fires the andon.
One sentence, built into the harness: in a plant of workers who cannot complain, silence is not health.

​
The compiled form

This thesis runs as code. watchdog/silence-watchdog.py reads a declared table of obligations — each with a named owner, an expected artifact or probe, a maximum age, and a statement of what its silence means — and on any violation rings the andon as an issue that stays open until the artifact returns. It fails closed: an obligation the watchdog cannot evaluate is a violation, not a skip. The operational detail lives at Station 6. A missed heartbeat rings exactly as loudly as an explicit error. Diligence is proven by artifacts, never assumed from activity.

​
Self-audit

ClaimSource
Pilot line never failed loudly: reports stopped ~May 13, queue starved, capability in a drawer, cron into the voiddocs/factory-design.md:40
”A ghost doing push-ups”docs/factory-design.md:40
Jidoka designed for defects; actual failure mode was absence — the second wiredocs/factory-design.md:42
Starvation alarms, effect watchdogs, expected-artifact monitorsdocs/factory-design.md:44–46
”In a plant of workers who cannot complain, silence is not health”docs/factory-design.md:48
Effect watchdog implementation: obligations file, owner, artifact/probe, fail closed, issue stays open until artifact returnswatchdog/silence-watchdog.py (module docstring)