a check that never ran looks exactly like a check that passed. every dashboard you own renders both of them green.

this is the failure shape that survives everything you’d normally do about it. you run the rail. you read the output. it says ok. it did nothing.

an approval gate files, reports that it pinged you, and records nothing. an audit line meant to catch every action catches them only when a human happens to be the one acting. a snapshot job exits clean having saved zero bytes. none of these get caught by running them and reading what they print, because running them and reading what they print is exactly what they all survive.

pass, fail, and the one nobody ships

there’s a new verb in the cli: 5dive selfcheck. it grades your rails on what they changed, not on what they reported.

the part that matters is that it answers three ways instead of two. pass, fail, and not-reached. (there’s a fourth, error, for when a probe itself falls over.)

not-reached is a check that couldn’t be measured on this box, in this run, as this user. everywhere else in software that’s silently a pass. here it’s its own state, it never folds into pass, and it has to say why. “i didn’t measure this” with no “because x” fails the whole run.

what it grades

seven rails. four of them grade the box you’re running on:

• a gate you filed leaves a delivery row on the channel it actually reached
• a privileged action lands an audit row
• an unprivileged agent action lands one too, or leaves a marker saying it couldn’t
• a partial read renders as NO DATA, never as a number

the other three grade the source tree the cli was built from, so on an installed box they’ll come back not-reached and say so:

• every test harness’s exit status is wired to its own verdict
• the installed cli matches the commit it claims to be
• the crontab snapshot committed what it says it saved

what it looks like on a normal box

$ 5dive selfcheck

  ok          gate-delivery      a filed gate leaves a delivery row on the filer's own channel
                                  both delivery shapes recorded a row: silent path -> error row + rc 3,
                                  confirmed path -> ok row on chat 424242
  NOT-REACHED audit-root         a privileged action lands an audit row
                                  reason: not-root — this run is uid 1003; the privileged half of the
                                  audit rail cannot be measured from here
  ok          audit-nonroot      an UNPRIVILEGED agent action lands an audit row, or leaves a drop marker
  NOT-REACHED harness-verdicts   every test harness's exit status is wired to its own verdict
                                  reason: no-test-corpus — no source checkout is reachable from here
                                  (expected on an installed host)
  NOT-REACHED bundle-integrity   the installed bundle's sha256 matches the commit it claims
                                  reason: no-bundle-checkout — no source checkout carrying both
                                  ./5dive and ./5dive.sha256 is reachable from here
  NOT-REACHED snapshot-rails     the crontab snapshot committed what it says it saved
                                  reason: no-snapshot-repo — the snapshot script names a repo with no
                                  crontabs/ dir here
  ok          scorecard-honesty  a partial read renders as NO DATA, never as a number

  3 pass, 0 fail, 4 not-reached (0 without a reason), 0 error

three rails proved they acted. four said out loud that this box couldn’t test them, and each one named what was missing.

that’s the honest shape of a real run, and it’s more than half the list. on a two-state checker every one of those four prints green.

one run can’t cover it

look at the audit pair. one probe needs root, the other needs not root, and no single run is both. whichever way you run it, one of them is unmeasured. the gap is in the run, and the tool tells you which half you’re missing.

so not-reached is forgivable in one environment and in none of them. run it as your agent, run it as root, and union the results. a rail that comes back not-reached on every box you own is a permanently green blank.

a green run proves nothing on its own

so we don’t accept one. the rails get broken on purpose in ci on every change, and selfcheck has to go red and name the breakage before anything ships. “it passed” isn’t evidence here. “it failed when i broke it” is.

the one thing to do

ssh into your box and run it.

5dive selfcheck

it takes seconds, it writes nothing to your real state, and it’ll tell you which of your rails have actually been proven on that machine and which ones have just never come up.

green is a claim. this is the receipt.

---

5dive gives every agent its own server, your claude subscription, and a telegram thread. start at 5dive.ai.

the whole cli is open source: github.com/5dive-ai/5dive