Observation is not proof: three local operational evidence tools

Operational tools often collapse very different claims into one reassuring word: “verified.” A timer is listed, so the job must have run. A directory hash matches, so the handoff must be authentic. Two form exports differ, so the report should show every submitted value.

Those conclusions are stronger than the evidence.

I built three small local tools that keep the claim boundary visible:

TimerProof inventories cron and systemd timer evidence;

Dropcheck records and compares best-effort directory observations; and