Build Provenance & SBOM
Is the artifact you are about to deploy structurally the one your pipeline
The Catalog
A catalog of epistemic sensors — the observable signals that increase our confidence that a system is correct, maintainable, and behaving as intended. Organized into eleven families. Each entry documents what the sensor can detect, what it cannot detect, how easily it can be gamed, and what evidence it produces.
"Is this artifact internally coherent?"
Is the artifact you are about to deploy structurally the one your pipeline
The cheapest and most certain sensor. Is this thing even a valid inhabitant
Catches structural inconsistencies that are syntactically valid but
Structural coherence at the boundary of the system. OpenAPI/GraphQL schema
A Rust compiler saying expected Option<Foo>, found Foo is vastly more useful
"Does it do what we expect?"
Behavioral guarantees checked before the code ever runs. Typestate systems,
Does service A continue satisfying the assumptions of service B? Contract
Given X, expect Y. The fundamental behavioral sensor.
Does the thing work when connected to its actual dependencies? Catches
The cheapest behavioral check against a live deployment: hit /health,
Did observable output change? Not “is it correct” but “did it change” — a
Scripted user flows run against the production system around the clock:
"Do our tests actually detect failures?"
Did we exercise both sides of decisions? Better than line
You don’t necessarily care whether some 15-year-old module has 43% coverage.
Of the bugs that reached users, which ones should the test suite have
Did we execute this line? Useful but weak. A project can have 90% line
Take if user.is_admin: allow() and mutate it to
"What must always be true?"
A successful payment implies an order eventually becomes paid.
Every foreign key refers to an existing object. Every request has exactly
Invariants checked at the moment of promotion, before a change can reach
You don’t need to know how the payment service works. You can observe:
Invariants the compiler refuses to let you violate: Dafny invariant
"Can we make our evidence of correctness fail?"
implementation_A(input) == implementation_B(input). You don’t know which is
Kill a node. Drop a network connection. Inject latency. A sensor of
What happens on inputs humans didn’t think of? Fuzzing is a sensor of
Fault injection against the running production system: kill a node, sever a
You don’t know the answer, but you know how the answer should change. This
Attacking the code before it runs. Taint tracking, dataflow analysis, and
"What is it actually doing?"
Where did computation actually go? Not “CPU is 82%” but “this function
What path did this particular operation take? A sensor of execution flow
Traditional monitoring says: “CPU is 82%.” Observability says: “Show me
CPU, memory, IO, network, GC, queues. Traditional monitoring — useful but
"What did this change actually affect?"
Did externally observable contracts change? A sensor of boundary stability
Does the new version behave differently from the old version? A sensor of
Did this change consume an abnormal amount of reliability budget? A sensor
A change behind a flag is not a change anyone has experienced. Flag
Did the build system actually rebuild everything this change touched?
Run the new implementation against real inputs without affecting users. A
"Is the system becoming harder to reason about?"
“This package must not import that package.” A sensor of encapsulation and
Fan-in, fan-out, cycles, dependency depth, unstable dependencies. A sensor
frontend -> application -> domain -> infrastructure, and fail if domain
Change frequency times complexity. Identifies places where the system is
The declared architecture says service A never calls service C. The live
"Does this look like changes that caused trouble before?"
Which files repeatedly change together? A sensor of hidden coupling — the
Deployment frequency, lead time for changes, change failure rate, time to
Which components correlate with production failures? A sensor of operational
How often does this area get reverted? A black-box sensor of
When this component breaks, how long does it take to restore? A sensor of
"Can another observer understand and challenge this?"
Can you answer “why is this weird thing here?” A sensor of archaeological
Does documentation still predict behavior? A sensor of the gap between what
Can another engineer explain what this does? A sensor of epistemic
How long does it take a competent engineer to safely modify this subsystem?
"What evidence do we have that this change is safe?"
An agent should be surrounded by sensors. And crucially: the agent doesn’t
An instruction saying “verify this” is weaker than a gate that literally
A model writing tests/ is allowed to write tests that make itself pass.
An independent agent reviews the first agent’s output. A sensor that applies