CI gates

The short version

• Every estate claims to have tests. The question that separates them is which of those tests has ever been seen to fail.
• A check that has only ever run against a working system is indistinguishable from one that cannot fail — and the second is worse than none, because it is a green light nobody earned.
• This panel lists every script the pipelines actually run, what its own source says it asserts, and whether CI proves it red on a broken fixture before trusting it green. The proportion that are is stated as measured, not as intended.

The cheapest way to build a system that looks safe is to add checks nobody has ever watched fail. They cost minutes of pipeline time, they turn green on every run, and they are load-bearing in exactly one respect: everyone downstream believes them. The estate’s answer is a rule that a gate ships with a self-test that proves it red — a deliberately broken fixture the gate is required to reject — and that the self-test runs in CI, on the same run that trusts the gate.

CI gate map — 214 scripts across 119 pipelines

Snapshot taken 18 Oct 2026, 01:24 AEDT — build-time, not live

• 119pipeline definitions
• 88are checks
• 43ship a self-test
• 40proven red by CI

Search gatesRepositoryallansiblearronpitman-siteclaude-configdocker-stackstf-azuretf-backblazetf-cloudflaretf-proxmoxProofallproven red by CIships a self-testno self-testKindeverything CI runschecks onlysupporting scripts

214 of 214

Proof	Script	What it asserts
proven red	ado_pipeline_metrics.pyansible/scripts/ · 3 pipelines	ado_pipeline_metrics.py — the ONE collector for ADO pipeline queue/run timing.
proven red	ado_pipeline_run.pyansible/scripts/ · 2 pipelines	Trigger or wait on an ADO pipeline run (Epic #376, #923, #1824).
proven red	ado_to_actions.pyansible/scripts/ · 2 pipelines	Convert Azure DevOps pipeline YAML into GitHub Actions workflows, deterministically.
proven red	agent_access_conformance_gate.pyansible/scripts/ · 2 pipelines	Conformance gate over the register of AGENT-OPERATED SYSTEMS — Epic #2488, Issue #2518.
proven red	apply_rulesets.pyansible/scripts/ · 2 pipelines	Reconcile GitHub repository rulesets and merge settings to scripts/rulesets.yml.
none	arr_relief.pyansible/scripts/ · ansible-pve01-scripts	arr_relief.py — the Radarr/Sonarr side of media_cleanup's pool-pressure relief.
proven red	bau_bot.pyansible/scripts/ · 2 pipelines	bau_bot.py — the BAU bot: an always-on event responder, deterministically gated.
none	blog_activity.pyansible/scripts/ · ansible-blog-activity-zabbix	blog_activity.py — sync the per-day published-blog-post count into Zabbix (Epic #2055, Issue #2056, ADR-0269).
proven red	board_column_reconciler.pyansible/scripts/ · ansible-control01-sync	board_column_reconciler.py — the ADO board column reconciles itself (Epic #2644, Issue #2645).
none	bun3d-boot-gate.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	bun3d-restore-plan.pyansible/scripts/ · ansible-pve01-scripts	Deployed by Ansible — edit in ansible/scripts/bun3d-restore-plan.py
none	bun3d-vhd-overlay.pyansible/scripts/ · ansible-pve01-scripts	Deployed by Ansible — edit in ansible/scripts/bun3d-vhd-overlay.py
none	bun3d-vm-rebuild.shansible/scripts/ · ansible-pve01-scripts	no module docstring
proven red	cc-pool-manager.shansible/scripts/ · 2 pipelines	no module docstring
proven red	cc_drain_marker.pyansible/scripts/ · 2 pipelines	cc-pool in-flight marker engine — transcript inspection, marker I/O, resume verification.
proven red	cc_drill.shansible/scripts/ · 2 pipelines	no module docstring
proven red	cc_pool_stuck_watch.pyansible/scripts/ · ansible-control01-sync	cc_pool_stuck_watch.py — page Pit when a cc-pool session has STOPPED and is waiting on him.
proven red	cc_pool_stuck_watch_cron.shansible/scripts/ · ansible-control01-sync	no module docstring
proven red	cc_slots.shansible/scripts/ · 2 pipelines	no module docstring
proven red	cc_spawn.shansible/scripts/ · 2 pipelines	no module docstring
none	ci_shared_state_backup.shansible/scripts/ · ansible-pve01-scripts	no module docstring
proven red	ci_skip_body_gate.pyansible/scripts/ · 2 pipelines	Pre-push gate: refuse a push carrying a CI-skip token OUTSIDE the commit subject line.
none	claude-pod-weekly.shansible/scripts/ · ansible-claude-pod	no module docstring
none	claude_config_docs_regen.shansible/scripts/ · ansible-claude-config-docs	no module docstring
none	claude_config_post_commit_hook.shansible/scripts/ · ansible-claude-config-docs	no module docstring
proven red	close_bypass_reconcile.pyansible/scripts/ · 2 pipelines	Detect Issues that reached `Done` WITHOUT going through `pitlab-close`.
proven red	dawn_triage.pyansible/scripts/ · 2 pipelines	dawn_triage.py — the 06:50 dawn actuator: derived-only remediation, deterministically gated.
proven red	derive_write_set.pyansible/scripts/ · 2 pipelines	Derive the pitlab-access WRITE SET from the estate's own automation — Epic #2488, Issue #2524.
proven red	check_docs_toolchain_pins.pyansible/scripts/doc_gen/ · 2 pipelines	check_docs_toolchain_pins.py — pitlab-docs MkDocs toolchain pin-parity gate (Issue #2186).
none	check_exposure_register.pyansible/scripts/doc_gen/ · 2 pipelines	check_exposure_register.py — fail the docs build if an un-gated (posture-d) row on the External Exposure Register points at a vanished link target (Issue #1705, Epic #938).
proven red	claim_adr_number.shansible/scripts/doc_gen/ · 2 pipelines	no module docstring
none	generate_claude_config_docs.pyansible/scripts/doc_gen/ · ansible-claude-config-docs	Claude Code config documentation generator.
proven red	generate_cloudflare_docs.pyansible/scripts/doc_gen/ · 2 pipelines	Cloudflare Access Map generator.
none	generate_docker_docs.pyansible/scripts/doc_gen/ · 2 pipelines	Docker stacks documentation generator.
none	generate_room_automations.pyansible/scripts/doc_gen/ · hass-config	Per-room "day in the life" pages, generated from hass-config.
none	generate_schedule_docs.pyansible/scripts/doc_gen/ · 2 pipelines	Maintenance schedule documentation generator.
none	generate_service_deps.pyansible/scripts/doc_gen/ · 2 pipelines	Service dependency map generator — ONE derivation, THREE renders (Epic #2260, ADR-0355).
proven red	public_scrub_gate.pyansible/scripts/doc_gen/ · 3 pipelines	Fail-closed scrub gate for pages published to the public showcase site (Epic #2557, Issue #2559).
none	standards_enforcement_gate.pyansible/scripts/doc_gen/ · 3 pipelines	Standard-Enforcement meta-gate (Epic #1713, Issue #1715, ADR-0176).
none	test_check_exposure_register.pyansible/scripts/doc_gen/ · 2 pipelines	Proven-red regression for check_exposure_register.py (ADR-0141).
none	test_check_standards_completeness.pyansible/scripts/doc_gen/ · 2 pipelines	Regression + negative-control test for check_standards_completeness.py (Epic #1996, Issue #1997 — Build-Hook & Pipeline-Gate Test Standard, ADR-0141, PD12).
none	test_validate_compliance_catalogue.pyansible/scripts/doc_gen/ · 2 pipelines	Regression + negative-control test for validate_compliance_catalogue.py (Epic #2247, Issue #2249 — Build-Hook & Pipeline-Gate Test Standard, ADR-0141, PD12).
none	test_validate_script_observability.pyansible/scripts/doc_gen/ · 2 pipelines	Committed regression test for validate_script_observability.py (Build-Hook & Pipeline-Gate Test Standard, ADR-0141 / ADR-0219).
none	test_validate_standards_taxonomy.pyansible/scripts/doc_gen/ · 2 pipelines	Regression + negative-control test for validate_standards_taxonomy.py (Epic #1996, Issue #1997 — Build-Hook & Pipeline-Gate Test Standard, ADR-0141, PD12).
proven red	validate_adr_numbers.pyansible/scripts/doc_gen/ · 2 pipelines	no module docstring
proven red	validate_bin_manifest.pyansible/scripts/doc_gen/ · 2 pipelines	Validate the control01 /usr/local/bin deploy manifests (Epic #2386).
none	validate_compliance_catalogue.pyansible/scripts/doc_gen/ · 2 pipelines	Compliance control-catalogue resolution gate (Epic #2247, Issue #2249, ADR-0352).
none	validate_docker01_cac.pyansible/scripts/doc_gen/ · ansible-standards-enforcement-reconciliation	docker01 config-as-code conformance gate (Epic #886, Issue #2002).
none	validate_docs_published.pyansible/scripts/doc_gen/ · 2 pipelines	Build-time guard: every hand-authored doc in pitlab-docs must reach the site.
none	validate_mermaid.mjsansible/scripts/doc_gen/ · ansible-build-mermaid-validate	no module docstring
none	validate_notification_catalog.pyansible/scripts/doc_gen/ · 2 pipelines	Static Notification-Catalog guard (Epic #1275, Issue #1278, ADR-0062).
none	validate_overview_hubs.pyansible/scripts/doc_gen/ · 2 pipelines	Blocking structural lint for overview-hub docs (ADR-0113, Documentation Architecture Standard).
none	validate_pipeline_path_coverage.pyansible/scripts/doc_gen/ · 2 pipelines	CI guard: every pipeline's trigger paths cover the files its playbook actually consumes.
proven red	validate_schedule_tz.pyansible/scripts/doc_gen/ · 2 pipelines	Static Timezone-Standard guard for pitlab host schedules (Epic #1270, Issue #1272).
none	validate_script_observability.pyansible/scripts/doc_gen/ · 2 pipelines	Ratcheting unattended-script observability gate (ADR-0219, Epic #1852, Issue #1848).
none	validate_standards_taxonomy.pyansible/scripts/doc_gen/ · 2 pipelines	Standards-taxonomy gate (Epic #1996, Issue #1997, ADR-0252).
none	validate_systemd_selfheal.pyansible/scripts/doc_gen/ · ansible-standards-enforcement-reconciliation	systemd self-heal clean-reap guard (Epic #1921, Issue #1925, ADR-0234).
proven red	validate_userparam_barrier.pyansible/scripts/doc_gen/ · 2 pipelines	validate_userparam_barrier.py — a NEW Zabbix UserParameter must be written ABOVE the `meta: flush_handlers` barrier in playbooks/sync_control01.yml.
none	docker-prune.shansible/scripts/ · ansible-docker01-sync	no module docstring
none	dockerhub_headroom_cron.shansible/scripts/ · ansible-docker01-sync	no module docstring
none	dockerhub_headroom_exporter.pyansible/scripts/ · ansible-docker01-sync	Docker Hub rate-limit headroom exporter (Epic #1769 Fleet Update Policy, Issue #1775, ADR-0188).
proven red	dt_carry_forward_dispositions.pyansible/scripts/ · 2 pipelines	Restore Dependency-Track dispositions that a BOM re-import silently destroyed.
none	freescout-artisan.shansible/scripts/ · ansible-docker01-sync	no module docstring
proven red	freescout_distill.pyansible/scripts/ · 2 pipelines	Distil resolved FreeScout incidents into {symptom→cause→fix} records (Epic #1028, Issue #1309).
none	freescout_heal.shansible/scripts/ · ansible-docker01-sync	no module docstring
proven red	freescout_incident_fix.pyansible/scripts/ · 2 pipelines	Wrap-up incident fix-capture helper (Epic #1028, Issue #1431, ADR-0068 Ph2).
proven red	gh_actions_concurrency.pyansible/scripts/ · 2 pipelines	gh_actions_concurrency.py — measure how many self-hosted runners are ACTUALLY busy at once.
self-test only	gh_fetch_pipeline_artifact.pyansible/scripts/ · docker-stacks-infra	gh_fetch_pipeline_artifact.py — fetch another repo's GitHub Actions artifact onto the runner.
proven red	github_pr.pyansible/scripts/ · 2 pipelines	Open (or reuse) a GitHub pull request for a branch and enable auto-merge.
proven red	github_schedule_watchdog.pyansible/scripts/ · 2 pipelines	Freshness watchdog for GitHub Actions scheduled workflows.
proven red	go_run.pyansible/scripts/ · 2 pipelines	go_run.py — run state, circuit breaker, deferrals and delivery metrics for /go.
proven red	go_throughput_exporter.pyansible/scripts/ · 2 pipelines	go_throughput_exporter.py — delivery throughput as a measured signal, not an impression.
proven red	go_throughput_exporter_cron.shansible/scripts/ · 2 pipelines	no module docstring
proven red	go_workorder_check.pyansible/scripts/ · 2 pipelines	go_workorder_check.py — the fail-closed work-order contract gate for /go.
proven red	groom_backlog_debt.pyansible/scripts/ · ansible-control01-sync	groom_backlog_debt.py — the backlog-grooming debt detective (Epic #1865, Issue #2476, ADR-0399).
proven red	ha_day_type_evidence.pyansible/scripts/ · 2 pipelines	Daily day-type evidence recorder for Home Assistant (Epic #2940, Issue #2952).
proven red	ha_entity_name_conformance.pyansible/scripts/ · ansible-control01-sync	ha_entity_name_conformance.py — assert every Home Assistant friendly_name is formatted so the Assist conversation agent can actually match it.
proven red	ha_holiday_dates_gen.pyansible/scripts/ · 2 pipelines	Scheduled regenerator for Home Assistant's committed public-holiday list (Epic #2940, #2941).
proven red	ha_ownership_anomaly_classify.pyansible/scripts/ · ansible-control01-sync	Re-derive, from Home Assistant's OWN record, what actually caused every ownership-anomaly page.
proven red	ha_press_detector.pyansible/scripts/ · ansible-control01-sync	ha_press_detector.py — catch a silent Zigbee button break within minutes of use.
none	haos_proxy_cert_renew.shansible/scripts/ · configure_ha_nginx_proxy	no module docstring
proven red	human_physical_watch.pyansible/scripts/ · 2 pipelines	The human-physical surface and its ageing clock — Epic #2825, Issue #2829, ADR-0563.
proven red	incident_refire_metrics.pyansible/scripts/ · ansible-control01-sync	The recurrence measure — did the fix HOLD?
proven red	incident_refire_metrics.shansible/scripts/ · ansible-control01-sync	no module docstring
none	infisical_env.pyansible/scripts/ · arronpitman-site	Fetch-on-login interactive env for control01 (Epic #376, Issue #925 — Phase 4).
none	infisical_fetch_env.pyansible/scripts/ · 4 pipelines	Fetch a stack's secrets from Infisical and emit them as .env lines (Epic #376).
none	infisical_secret.pyansible/scripts/ · 2 pipelines	Get or set a SINGLE Infisical secret by key (Epic #376, #923 rotation role).
proven red	infisical_tf_vars.pyansible/scripts/ · 4 pipelines	Inject Infisical secrets into a Terraform CI job as masked TF_VAR_* (Epic #376, Issue #926; both CI planes at Epic #2282).
proven red	log_legibility_gate.pyansible/scripts/ · 2 pipelines	Log-legibility conformance gate — is any workload's log DROWNED in its own errors?
none	loki_push.pyansible/scripts/ · ansible-standards-enforcement-reconciliation	Push a single structured log line to Loki (Epic #376, #923).
none	mail_to_pushover.shansible/scripts/ · ansible-exim4	no module docstring
proven red	main_push_conformance.pyansible/scripts/ · 2 pipelines	Reconcile every commit that reached `main` against the sanctioned path: a pull request.
none	media_cleanup.shansible/scripts/ · ansible-pve01-scripts	no module docstring
proven red	notification_class_gate.pyansible/scripts/ · 2 pipelines	notification_class_gate.py — prove every notification sender is classified AND deliverable.
none	patch_reboot_coordinator.pyansible/scripts/ · 2 pipelines	patch_reboot_coordinator.py — pitlab fleet PATCH+reboot coordinator (Epic #1769, Issue #1771).
none	pbs_backup_check.shansible/scripts/ · ansible-backup-monitoring	no module docstring
proven red	pin_repo_trees.shansible/scripts/ · 3 pipelines	no module docstring
none	pitlab-hookscript-deploy.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	pitlab-onboarding.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	pitlab-user-check.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	pitlab_access_install.shansible/scripts/ · ansible-pitlab-access-deploy	no module docstring
proven red	pitlab_cc.pyansible/scripts/ · 2 pipelines	pitlab_cc.py — clear ONE cc-pool slot's context from another session, or refuse.
proven red	pitlab_close.pyansible/scripts/ · 2 pipelines	pitlab_close.py — closure is PRODUCED by executing the Issue's own Acceptance, never asserted.
proven red	pitlab_pr.shansible/scripts/ · 2 pipelines	no module docstring
none	plex_downloads_exporter.pyansible/scripts/ · ansible-plex-downloads-exporter	no module docstring
proven red	plex_user_filter_reconciler.pyansible/scripts/ · 2 pipelines	plex_user_filter_reconciler.py — the children's Plex classification gate as code.
proven red	pr_stall_watch.pyansible/scripts/ · 2 pipelines	Raise the pull requests that WILL NEVER MERGE ON THEIR OWN, and only those.
proven red	pr_validate_gen.pyansible/scripts/ · 2 pipelines	Generate each repo's `.github/workflows/pr-validate.yml` from that repo's own CI workflow.
proven red	provision_tier0_cloudflare_identity.pyansible/scripts/ · 2 pipelines	provision_tier0_cloudflare_identity.py — mint the tier-0 Cloudflare minting identity.
proven red	pushover_notify.pyansible/scripts/ · 4 pipelines	Send a pitlab notification — SLACK FIRST, Pushover as the proven failover (Epic #376, #925; re-pointed at Slack by Epic #2506 / Issue #2508, ADR-0524).
none	pve-forward-accept-watchdog.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	pve-remove-nag.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	pve-vmbr-forward-accept.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	rclone_files_sync.shansible/scripts/ · ansible-docker01-sync	no module docstring
none	reboot-coordinator-postboot.shansible/scripts/ · ansible-reboot-coordinator	no module docstring
none	reboot-coordinator.shansible/scripts/ · ansible-reboot-coordinator	no module docstring
self-test only	restore_drill.pyansible/scripts/ · ansible-restore-drill	restore_drill.py — automated PBS restore-and-boot drill (Epic #1652, Issue #1653, ADR-0158/0159).
none	restore_drill_run.shansible/scripts/ · ansible-restore-drill	no module docstring
none	secret_scan.shansible/scripts/ · 11 pipelines	no module docstring
none	service_catalog_regen.shansible/scripts/ · ansible-service-catalog	no module docstring
proven red	stdgap.pyansible/scripts/ · 2 pipelines	stdgap — file a standards gap onto the register, atomically and verifiably.
none	test_ado_pipeline_run.pyansible/scripts/ · ansible-control01-sync	Regression gate for ado_pipeline_run.py's wait-path hardening (Issue #2210, ADR-0339).
none	test_freescout_distill.pyansible/scripts/ · ansible-control01-sync	Self-test for freescout_distill.py — stdlib only, no network, no live LLM/Qdrant/FreeScout.
none	test_ha_ownership_anomaly.pyansible/scripts/ · ansible-control01-sync	Proven-red regression for ha_ownership_anomaly.py (ADR-0141 discipline, Issue #2328).
none	test_haos_loki_logger.pyansible/scripts/ · ansible-deploy-haos-loki	Offline liveness self-test for the HAOS loki_logger custom component (Issue #2064).
proven red	test_pitlab_close.pyansible/scripts/ · 2 pipelines	test_pitlab_close.py — the proven-red regression harness for the closure gate (ADR-0141).
none	test_stalled_grab_watchdog.pyansible/scripts/ · ansible-control01-sync	Self-test for stalled_grab_watchdog.py — stdlib only, no network, no live *arr.
self-test only	test_stuck_alert_watchdog.pyansible/scripts/ · ansible-control01-sync	Discrimination proof for the stuck-alert watchdog (Epic #2107, Issue #2158).
none	test_tf_approval_gate.pyansible/scripts/ · 2 pipelines	Regression test for tf_approval_gate.py (ADR-0141 — build-hook/gate test standard).
none	test_zabbix_cron_heartbeats.pyansible/scripts/ · ansible-control01-sync	Self-test for zabbix_cron_heartbeats_monitoring.py — stdlib only, no network, no live Zabbix.
none	tf_approval_gate.pyansible/scripts/ · 2 pipelines	tf_approval_gate.py — the human approval gate for Terraform applies on GitHub Actions.
proven red	tier0_store.pyansible/scripts/ · 2 pipelines	tier0_store.py — read ONE credential out of the tier-0 store, for a CONSOLE ACT.
proven red	trim_always_loaded_layer.pyansible/scripts/ · 2 pipelines	Reduce the always-loaded Claude agent-config layer, under an eval gate that can refuse.
proven red	udm_client.pyansible/scripts/ · 2 pipelines	Name a UniFi client and pin its current lease as a DHCP reservation.
proven red	udm_reservation_audit.pyansible/scripts/ · 2 pipelines	Flag any device an integration addresses by IP that has no UDM DHCP reservation.
none	ups-watchdog.shansible/scripts/ · ansible-pve01-scripts	no module docstring
none	urbackup_check.shansible/scripts/ · ansible-backup-monitoring	no module docstring
proven red	validate_ci_pool_parity.pyansible/scripts/ · 2 pipelines	validate_ci_pool_parity.py — assert every agent in the pitlab pool carries the SAME, DECLARED toolchain (Epic #2187, Issue #2206; design docs/designs/2187-ci-runner-pool.md).
proven red	validate_deploy_tags.pyansible/scripts/ · 2 pipelines	validate_deploy_tags.py — conformance gate for the stack-deploy tag taxonomy.
proven red	validate_disk_latency_thresholds.pyansible/scripts/ · configure_fleet_disk_latency	validate_disk_latency_thresholds.py — the acceptance gate for derived disk-latency thresholds.
proven red	validate_dt_project_namespaces.pyansible/scripts/ · 2 pipelines	validate_dt_project_namespaces.py — the conformance gate for per-host Dependency-Track project namespacing (Issue #2121, ADR-0363).
proven red	validate_guard_ledger.pyansible/scripts/ · 2 pipelines	Aggregating verdict gate for a multi-guard CI job (incident #2470).
proven red	validate_ha_reload_coverage.pyansible/scripts/ · 2 pipelines	validate_ha_reload_coverage.py — the reload set must cover every domain the source can declare.
proven red	validate_handler_durability.pyansible/scripts/ · 2 pipelines	validate_handler_durability.py — conformance gate for pending-handler durability.
proven red	validate_mail_sender.pyansible/scripts/ · 2 pipelines	validate_mail_sender.py — every sendmail call sets the envelope sender, not just the header.
proven red	validate_notify_handlers.pyansible/scripts/ · 2 pipelines	Fail the build on an Ansible `notify:` that resolves to no handler.
proven red	validate_pipeline_agent_portability.pyansible/scripts/ · 2 pipelines	validate_pipeline_agent_portability.py — the conformance gate for pipeline agent-portability (Epic #2187, Issue #2216, ADR-0337).
proven red	validate_repo_script_locality.pyansible/scripts/ · 2 pipelines	validate_repo_script_locality.py — conformance gate for repo-script execution locality.
proven red	validate_secret_scan_coverage.pyansible/scripts/ · ansible-standards-enforcement-reconciliation	validate_secret_scan_coverage.py — fleet-wide secret-scanning conformance gate (ADR-0277).
proven red	validate_selftest_coverage.pyansible/scripts/ · 2 pipelines	Reconcile self-tests against the pipelines that are supposed to run them.
self-test only	validate_target_lock_coverage.pyansible/scripts/ · 2 pipelines	validate_target_lock_coverage.py — the conformance gate for target-host serialisation (Issue #2199 step 7, ADR-0330).
proven red	validate_zabbix_trigger_windows.pyansible/scripts/ · 2 pipelines	Refuse a Zabbix window function that is carrying a meaning it cannot carry.
none	vzdump_nightly_check.shansible/scripts/ · ansible-pve01-host-zabbix	no module docstring
proven red	waitfor_poll.pyansible/scripts/ · 2 pipelines	waitfor poller — evaluate a TYPED predicate to a terminal state, always leaving a marker.
proven red	zabbix_actor_tags.pyansible/scripts/ · 2 pipelines	zabbix_actor_tags.py — reconcile the `actor` tag onto every Zabbix trigger (ADR-0560).
none	zabbix_board_reconciler_monitoring.pyansible/scripts/ · configure_board_reconciler_zabbix	Assert the board-column-reconciler Zabbix monitoring on control01 (Epic #2644, Issue #2645).
proven red	zabbix_cron_heartbeats_monitoring.pyansible/scripts/ · 2 pipelines	Ensure missed-run (dead-man's-switch) Zabbix monitoring exists for control01 cron jobs.
proven red	zabbix_demoted_conditions.pyansible/scripts/ · 2 pipelines	Enforce the Zabbix demotion register — the trigger is gone AND the condition is still visible.
none	zabbix_epic_tag_gate_monitoring.pyansible/scripts/ · configure_epic_tag_gate_zabbix	Assert the Epic tag-vocabulary Zabbix monitoring on control01 (ADR-0399 amended 2026-08-28).
none	zabbix_groom_monitoring.pyansible/scripts/ · ansible-groom-zabbix	Assert the backlog-grooming Zabbix monitoring on control01 (Epic #1865, Issue #2476, ADR-0399).
proven red	zabbix_ha_trigger_prototypes.pyansible/scripts/ · 3 pipelines	Converge the two damped Home Assistant LLD trigger prototypes (Issue #2827, ADR-0562).
none	zabbix_hypercare_monitoring.pyansible/scripts/ · ansible-hypercare-zabbix	Assert the hypercare-window Zabbix monitoring on control01 (Epic #2369, ADR-0389).
none	zabbix_lifx_triggers.pyansible/scripts/ · ansible-zabbix-lifx-triggers	Idempotently applies flap-suppression hysteresis to the LIFX "offline in HA" triggers on the Zabbix host 'LIFX Integration' (hostid 11497) — Issue #1337, Epic #906 (Zabbix config-as-code gap analysis).
none	zabbix_monitoring_reconciler.pyansible/scripts/ · ansible-standards-enforcement-reconciliation	Monitoring-as-Code drift audit — the live half of the Zabbix config-as-code loop (Epic #833, Issue #1523).
none	zabbix_pbs_monitoring.pyansible/scripts/ · ansible-xt035-pbs-zabbix	Idempotently assert the PBS task-health Zabbix items + triggers on xt035.
none	zabbix_reboot_coordinator_monitoring.pyansible/scripts/ · ansible-reboot-coordinator	Ensure reboot-coordinator Zabbix monitoring exists across the fleet.
none	zabbix_service_health_monitoring.pyansible/scripts/ · ansible-service-health-zabbix	Ensure the fleet service-health Zabbix monitoring exists across every host (Epic #833, Issue #1530).
proven red	zabbix_slack_media_standard.pyansible/scripts/ · ansible-control01-sync	Cut the Zabbix alerting surface over to Slack, with Pushover as the proven failover.
none	zabbix_tag_api_ping.pyansible/scripts/ · ansible-arr-api-zabbix	Converge RULE 10 service tags onto the *.api.ping Zabbix objects on docker01.
none	zabbix_urbackup_monitoring.pyansible/scripts/ · ansible-urbackup-zabbix	zabbix_urbackup_monitoring.py — reshape the UrBackup client staleness alert to "online-but-stale" (Epic #1784, Issue #1792, ADR-0197).
none	assert_rendered.mjsarronpitman-site/scripts/ · arronpitman-site	Rendered-DOM acceptance for the four set-pieces (Epic #2557, Issue #2560).
proven red	build_snapshots.pyarronpitman-site/scripts/ · arronpitman-site	Emit the build-time data snapshots the four set-pieces render (Epic #2557, Issue #2560).
none	legibility_gate.mjsarronpitman-site/scripts/ · arronpitman-site	Diagram legibility gate for the published site (Epic #2591, Issue #2593).
none	lighthouse_gate.mjsarronpitman-site/scripts/ · arronpitman-site	Lighthouse gate for the published site (Epic #2557, Issue #2560).
proven red	prerender_mermaid.mjsarronpitman-site/scripts/ · arronpitman-site	Pre-render every Mermaid diagram in the site's content to static SVG, at build time, in both colour schemes (Epic #2591, Issue #2593; ADR-0456, which supersedes ADR-0028's rejection of SVG pre-render).
self-test only	prove_setpiece_scrub.sharronpitman-site/scripts/ · arronpitman-site	no module docstring
proven red	publish_set_unchanged.pyarronpitman-site/scripts/ · arronpitman-site	Decide whether the freshly rendered publish set is already live, byte for byte.
proven red	render_corpus.pyarronpitman-site/scripts/ · arronpitman-site	Select and render the `public: true` slice of the pitlab-docs corpus as Starlight pages.
self-test only	eval_harness.pyclaude-config/scripts/ · claude-config-ci	Tier-1 behavioural eval harness for the claude-config constitution (Epic #2788, Issue #2850).
none	eval_tier3_judge.pyclaude-config/scripts/ · claude-config-ci	Tier-3 nightly judge — register and tone, REPORTED AS A TREND AND NEVER A GATE.
proven red	rule_inventory_gate.pyclaude-config/scripts/ · claude-config-ci	Rule-inventory gate for the claude-config constitution (Epic #2420, Issue #2421).
proven red	skill_structure_gate.pyclaude-config/scripts/ · claude-config-ci	skill_structure_gate.py — every skill is a router with a declared cost and resolving pointers.
proven red	verify_claim.pyclaude-config/scripts/ · claude-config-ci	verify_claim.py — grade ONE claim against the live system, blind to how the claim was produced.
proven red	alert_window_firability_gate.pydocker-stacks/scripts/ · 2 pipelines	alert_window_firability_gate.py — fail the build on an alert rule that CANNOT FIRE.
proven red	artifact_gate.pydocker-stacks/scripts/ · docker-stacks-observability	Artifact acceptance gate for RUN-TO-COMPLETION workloads (Issue #2181, ADR-0321).
proven red	changed_image_trivy_gate.pydocker-stacks/scripts/ · 2 pipelines	changed_image_trivy_gate.py — block a docker-stacks push that bumps an image pin to a tag carrying a CRITICAL vulnerability.
proven red	counter_birth_guard.pydocker-stacks/scripts/ · 2 pipelines	counter_birth_guard.py — static CI gate against the counter-birth false-page class (ADR-0292).
none	eit_conformance_gate.pydocker-stacks/scripts/ · 6 pipelines	Encryption-in-Transit conformance gate — fails a deploy when a NEW plaintext cross-host listener appears on docker01 that is not accounted for on the exceptions register.
proven red	gate_common.pydocker-stacks/scripts/ · 5 pipelines	Shared helpers for the docker-stacks post-deploy gates (Issue #2185, ADR-0317).
none	homepage_icon_gate.pydocker-stacks/scripts/ · 2 pipelines	Pre-deploy icon gate — fails the homepage deploy if any tile icon does not resolve to a real image, so the start page can never ship a generic "?" placeholder.
self-test only	homepage_regen_parity_gate.pydocker-stacks/scripts/ · 2 pipelines	homepage_regen_parity_gate.py — fail the deploy when stacks/homepage/config/services.yaml is not what its generator would produce from its sources (Epic #1594, Issue #1967; ADR-0143).
proven red	host_stack_source_gate.pydocker-stacks/scripts/ · 2 pipelines	Host->repo stack-source reconciliation gate — every workload running on docker01 must have source.
proven red	image_pin_gate.pydocker-stacks/scripts/ · 2 pipelines	image_pin_gate.py — a container that renders a VERDICT must be pinned by digest, not by tag.
none	loki_log_gate.pydocker-stacks/scripts/ · 6 pipelines	Post-deploy Loki log-shipping gate — fails the deploy if a just-deployed stack ships NO logs to Loki.
proven red	pipeline_coverage_gate.pydocker-stacks/scripts/ · 7 pipelines	Pipeline stack-list completeness gate — every deployed stack must be gated and triggered.
none	quiet_hours_guard.pydocker-stacks/scripts/ · 2 pipelines	quiet_hours_guard.py — static stuck-mute CI gate for the sleep quiet-hours window (ADR-0264).
none	refresh_consumer_roots.shdocker-stacks/scripts/ · 7 pipelines	no module docstring
proven red	renovate_config_gate.pydocker-stacks/scripts/ · 4 pipelines	renovate_config_gate.py — semantic CI gate over renovate.json (Issue #2150).
none	smoke_gate.pydocker-stacks/scripts/ · 6 pipelines	Pre-deploy smoke gate — fails the deploy if a just-deployed container does not start & serve.
none	test_eit_conformance_gate.pydocker-stacks/scripts/ · ansible-eit-reconciliation	Self-test for eit_conformance_gate.py — stdlib only, no network, no ssh.
proven red	testplan_gate.pydocker-stacks/scripts/ · 7 pipelines	Post-deploy service test-plan gate — runs each deployed stack's test plan, fails the pipeline on a functional regression, and (mode-gated) AUTO-ROLLS-BACK the offending deploy to last-good (Service Test Plan Standard, ADR-0102; Issues #1478 gate + #1479 auto-rollback).
self-test only	testplan_run.pydocker-stacks/scripts/ · 7 pipelines	Shared service test-plan runner — the one runner behind the Service Test Plan Standard (ADR-0102).
proven red	testplan_synthetic_gate.pydocker-stacks/scripts/ · docker-stacks-infra	Scheduled synthetic test-plan gate for host/LXC services (Service Test Plan Standard, ADR-0102; host/LXC tranche, Issue #1489).
none	check_dashboard_conformance.pydocker-stacks/stacks/observability/scripts/ · 2 pipelines	Dashboard conformance gate — enforces Pillar 2 + the bidirectional catalog at deploy time.
none	plan_classifier_gate.pytf-azure/scripts/ · 3 pipelines	plan_classifier_gate.py — decide whether a tf-azure apply may run UNATTENDED or must pause for Pit's approval.
none	test_plan_classifier_gate.pytf-azure/scripts/ · 3 pipelines	Regression test for plan_classifier_gate.py (ADR-0141 — build-hook/gate test standard).
none	plan_classifier_gate.pytf-backblaze/scripts/ · terraform — backblaze	plan_classifier_gate.py — decide whether a tf-backblaze apply may run UNATTENDED or must pause for Pit's approval.
none	test_plan_classifier_gate.pytf-backblaze/scripts/ · terraform — backblaze	Regression test for plan_classifier_gate.py (ADR-0141 — build-hook/gate test standard).
none	config_completeness_gate.pytf-cloudflare/scripts/ · 2 pipelines	config_completeness_gate.py — fail the tf-cloudflare plan when a LIVE Cloudflare object is absent from terraform state and not on the ratified completeness allowlist (Issue #2040, ADR-0259 follow-up).
none	exposure_conformance_gate.pytf-cloudflare/scripts/ · 2 pipelines	exposure_conformance_gate.py — fail the tf-cloudflare plan on an un-gated, unregistered public hostname (RULE 13 / ADR-0150).
none	test_config_completeness_gate.pytf-cloudflare/scripts/ · terraform — cloudflare	Regression test for config_completeness_gate.py (ADR-0141 — build-hook/gate test standard).
none	test_exposure_conformance_gate.pytf-cloudflare/scripts/ · 2 pipelines	Regression test for exposure_conformance_gate.py (ADR-0141 — build-hook/gate test standard).
none	plan_classifier_gate.pytf-proxmox/scripts/ · 2 pipelines	plan_classifier_gate.py — decide whether a tf-proxmox apply may run UNATTENDED or must pause for Pit's approval.
none	test_plan_classifier_gate.pytf-proxmox/scripts/ · 2 pipelines	Regression test for plan_classifier_gate.py (ADR-0141 — build-hook/gate test standard).

45% of the checks are proven red by CI — that is,40 of 88 are run against a deliberately broken fixture on the same run that trusts them, and are required to fail. The rest are not, and that is the honest state of it rather than a rounded-up one. A gate nobody has seen go red is a green light nobody earned.

Derived, not listed: all 119 workflow definitions were enumerated from the GitHub Actions API across every repository the estate builds from,119 of them run at least one repository script, and every one of those scripts was fetched and read for its own description. Every one resolved to a file.A script counts as a check when its filename declares it one —validate_, assert_, verify_, check_,test_, or a _gate/_guard/_conformancesuffix — which is this estate's own convention. A builder or a credential helper is listed and not counted.

Why “proven red” is a different column from “has a self-test”

They are deliberately separate, because collapsing them hides the interesting state. A self-test that exists and is never run is a gate nobody has seen go red; it has the shape of proof and none of the effect. Splitting the columns makes that state visible instead of rounding it up into the reassuring one.

The number that is not 100% is the honest part of this panel. Some of these checks are proved by hand at the time they are written and never again; that is a real gap, it is visible here, and publishing it is cheaper than the alternative, which is discovering it during an incident.

How this list is derived

Nothing here is typed in. All the project’s pipeline definitions are read from the build API, each one’s YAML is read from the repository it builds from, and every script that YAML runs is read for its own opening description. If a single definition cannot be resolved, the build fails rather than publishing a partial census — a smaller number presented with the same confidence is worse than no number, because nothing on the page could tell you which you were looking at. A hand-written list would be the specific failure this estate names authored, not observed: every entry correct, and the set silently short of whatever was added after the list was written.

Three things had to be got right before the list was trustworthy, and each was wrong first:

• The credential could read three of the hundred pipeline definitions. Reading everything through the API looked like the thorough choice, and the build identity’s authorisation is scoped to the repositories its own pipeline references — so the first published version of this panel covered 30 scripts and presented them with exactly the same confidence as the full set. The page’s own numbers agreed with the data behind it perfectly; only an absolute floor in the acceptance gate caught it, because an equality check between two consistent wrong numbers cannot. It now reads from the build agent’s own checkouts, which carry every repository, and refuses to publish at all if any definition is unreadable.
• Anchoring on an interpreter keyword — python3 …, node … — found the tidy invocations and missed the strictest gates on this very site, which are handed to a container image’s own entry point. Their absence looked exactly like “this pipeline has no rendered-DOM gate”.
• A step’s display name comes after the shell block it names, so attributing scripts to the last label seen shifts every step by one. It does not fail; it produces a complete, plausible, wrong map.

What counts as a check

A script counts when its filename declares it one — validate_, assert_, verify_, check_, test_, or a _gate / _guard / _conformance suffix. That is this estate’s own naming convention rather than a judgement made here, and stating the rule on the page is what makes a miscount a visible disagreement with something published rather than an invisible opinion. A builder or a credential helper is listed and not counted.