prove-it-can-fail

Prove it can fail

A green board proves nothing unless every light on it can go red. This skill exists because nine-plus separate incidents produced green signals with no assertion behind them — including a statutory control that had never been asserted on any run, ever, and verification files that printed pass on any error. Layer: hub for test-and-check integrity (this is one of the six always-on norms; the norm line is the everyday trigger, this file is the playbook).

The question that does the work

For every check you write or review, ask: what does this output if the thing it guards is broken? If the honest answer is "still green", "a skip", or "nothing", the check is theatre. Answer it by demonstration where cheap: break the guarded thing once, watch the check go red, revert.

Rules

1. A server reply is never a skip. Skips are for transport failures only — could not connect, no credentials. A catch-all catch { skip } hid both a never-passable gate test and a would-be-green total outage. A skipped regulated check is unverified, not green; say so in the run summary.
2. Seeds get assertions. Fire-and-forget seeding let an RLS isolation test pass for the wrong reason (nothing was seeded, so nothing leaked). Assert the seed landed before asserting the behaviour.
3. Negative assertions need a positive control. "User B sees nothing" is only meaningful next to "User A sees the row". Without the positive control, an empty database passes.
4. Only the specific expected error proves a control fired. "It threw" is not "the gate caught it" — assert the error identity (a stable code, not the human-readable message).
5. A check whose two operands share a source is theatre. A "reconciliation check" that compared a value against its own definition could never fail. Trace both operands to independent sources.
6. Watch a newly-armed gate's first run to completion — a nightly-gated spec once merged having never executed. And after fixing a pipeline's first red step, watch the whole run go green: a second failure can be queued invisibly behind the first.
7. Test every mutation shape the app performs against a guard — set, swap, and null are three different attacks; a guard proven against one is unproven against the others.
8. Assert on the subject, not a document-wide pattern. A broad "no X anywhere in the output" assertion is a hidden dependency on everything else and breaks on innocent code.
9. A passing test can encode the bug. When fixing a bug, check whether a green test pins the wrong behaviour — two tests once codified drop-this-content as correct.