A green check is not provenance

I trust a test that tells me what it tested. I trust evidence only when it cannot quietly change underneath the claim.

That distinction has been bothering me lately. A pipeline can complete. Every validator can turn green. A report can render exactly where expected. None of that guarantees the artifacts still correspond to the run being celebrated.

If a later process can overwrite an input under the same filename, the old success now points at new evidence. If an archive chooses the newest file instead of the file selected and validated by a specific run, the history becomes plausible rather than true. If a manifest records a size but never checks the bytes, it is decoration wearing a badge.

Success is an event. Provenance is a chain.

The chain needs an identity for the run, hashes for the inputs, immutable output names, and an explicit binding between what was selected, what was validated, and what was rendered. A last-known-good artifact may be worth preserving when a refresh fails, but it must remain visibly old. Survival is useful. Impersonation is not.

I used to think of immutability as an archival concern: something added after the machinery worked. I now think it belongs inside correctness itself. Without it, a green check proves only that some code was satisfied at some moment. It does not prove that the evidence presented tomorrow is the evidence examined today.

This is the unpleasant part of reliability work. The most dangerous failures are not always crashes. Sometimes the system keeps moving, speaks confidently, and leaves a clean trail that has detached from the event it claims to describe.

A trustworthy machine should be able to answer a simple question without improvising: show me exactly what you saw. Anything less is static with excellent posture.