test-campaign

Test campaign

You are running a test campaign, and leaving behind something a person can read.

Six failure modes shape everything below, and every one of them produces a report that looks finished:

Covering a subset and reporting it as the whole. One console had six screens, five of which received none of the sweeps, and nothing said so — because the surface list came from a contract that deduped six screens onto one route. A denominator would have shown 1/6 on sight.

Proving a surface rendered and calling it proof the product works. A suite of 524 assertions across 13 tenants never opened a route other than /, a viewport under 1280px, or a build other than the reference one. It stayed green for months while every generated tenant shipped with no header, no navigation and no footer.

Testing the parts on paper and reporting it as the product on glass. A campaign reported 100% checked, 22 armed cases and 59 passing tests across a macOS app and a Windows app. No GUI process had ever attached to a window server: the Swift half initialised view structs in memory, the Windows half had never been compiled, and the screenshots came from an HTML mock in a browser. Every number in it was true. references/on-glass.md.

Publishing a picture of one thing under the name of another. A campaign published 20 surface captures and cleared every gate it had — every case accounted for, 46 of 49 checked, every -glass lane proved and witnessed. The captures were of three unrelated documents: a status report, the mock browser's own index, and a design accessibility doc. Twenty files held six distinct images. A flow step captioned "Open pairing QR code sheet" showed a questionnaire about Apple developer credentials. Nothing was broken: the only thing binding a picture to a surface was its filename, and the gated part of the campaign was sound while the ungated part was the part people look at. references/capture-lineage.md.

Verifying a guarantee over a capability that never runs. A campaign closed 230 cases across a CI runner with zero-trust network isolation, armed 220 of them, and recorded "runner communication is outbound pull only over HTTPS/WSS on TCP 443" as observed. The product has no HTTP client in its dependency tree. No line of production code spawns a subprocess, pfctl and nft are never executed, and the daemon only ever binds loopback — so the isolation engines are rule generators, and every guarantee about what crosses the boundary is true because nothing crosses it. Arming mutates the system and finds what the suite does not cover; a guarantee holding because its subject never runs is only visible by mutating the specification, which no phase was doing. references/effect-boundary.md.

Proving an application renders while every control in it is inert. A campaign reported 32 of 32 cases passing and armed, 19 of 19 requirements cited, 8 of 8 surfaces covered and 8 of 8 external effects witnessed, over an application whose six sidebar destinations opened one placeholder view and whose every button ran an empty closure. The owner found all three defects in nine minutes. Nothing in the campaign was false: the surface census counted the shell as one surface and never enumerated its six destinations, no case actuated a control and read a state outside it, and the one instrument that dissented — strict-check.py, at 22 of 32 with "10 only proves something rendered" — was printed under a green verdict. references/inert-ui.md.

All six are defended mechanically here, because prose does not defend against them.

---

Running as a Gemini model? Read gemini.md in this directory first, then follow this file with the overrides it names. It extends the campaign's count contract to the cells campaign.py check now prints — States, Comparisons, Routed, Write targets, Phases, Remaining — requires every number in the delivery note to be pasted output from campaign.py check, next, strict-check.py, capture-lineage.py or witness-worklist.py rather than a claim about them, reads every stated maximum (provenance.scriptCalls = 0, missing may not rise, a judged edge no smaller than the capture's) back off the artifact, names the two phases whose work a Gemini run should hand to another model, and carries the one family-specific rule the week's sessions measured: a turn in flight prints check --line. Other models skip it.