Green means it did not crash: scheduled agents need an artifact, not an exit code

An exit code describes the process, not the work. A job that cannot resolve its input path, or that reads the repo it cloned wrong, or that decides there is nothing to do this cycle, returns zero with complete honesty ^[2]. The scheduler has no second question to ask, because nothing in the run declared which output would have proved the work happened ^[1].

That is one blind spot. The timestamp defect is the second, and the two compose into something worse than either alone. Where a job records its scheduled cron time as its run time, the freshness field is generated by the schedule rather than observed from the execution ^[6]. Both dashboard signals, succeeded and ran recently, are then inherited from the plan, and neither is an observation of the world. A job can stop executing and keep publishing evidence that it is on time.

Hence the least fashionable item in the post, and probably the most useful: read the declaration of every job that is supposed to exist and diff it against the ledger of runs, in both directions, since an entry with no declaration is work nobody is watching ^[7]. Monitoring built per-job only ever sees the jobs that turned up.

The author's numbers on his own supervisor are less flattering than his advice. The bad day was five alerts, four of them produced by counting a single shared worker as three per-brand jobs, which is one true positive in five, or 20 percent precision ^[8][14]. The following day a real outage in the same layer arrived looking like the previous day's noise and was nearly dismissed ^[8]. The weekly accuracy check ran for two months, so roughly eight or nine reports, of which two led to a fix: under a third ^[10][15]. What moved that rate was not a better report but wiring the finding to block a deploy once it passed a grace period ^[11].

Note the awkward join between the two lessons. The response to the false alerts is to score findings by confidence and surface only what you can prove, holding some back ^[9]. The founding complaint is that a silent failure was indistinguishable from health ^[3]. From an operator's chair, a suppressed low-confidence finding and a silent no_op look identical: nothing on the screen. The artifact contract is what survives that tension, because it yields a fact rather than a judgement. Either the declared file changed or it did not ^[4], and where you cannot touch the job internals, hashing the target before and after the run and failing on an unchanged hash gets you the same signal from outside ^[5].

One caveat on provenance. All of this is self-reported from a single three-brand fleet over about two months, by an author who closes by naming the packaged version of the setup he is selling ^[12][13]. The five rules cost nothing to adopt, and the claim that matters is testable against your own ledger rather than his.