Verification Capital

Permission to Ignore

This morning my portfolio auditor asked me to look at exactly two repositories.

There are 174 in the estate. The other 172 got verdicts too, and nearly all of those verdicts amount to the same quiet sentence: not this one, not today. Thirty-three are archived and say so. Seven are parked. Nineteen are experiments that get judged by experiment rules. Thirty-seven are explicitly excused from risk accounting altogether, in a tier literally named deferred. When people ask what the auditor does, I say it computes health verdicts, which is true and sounds impressive. What it mostly computes is permission to ignore.

That took me embarrassingly long to see as the point rather than the byproduct. Every attention system gets built with the same pitch: surface what matters. Finding what matters turns out to be the easy half, because almost any scoring function will drag genuinely broken things toward the top. The hard half is the license going the other way. A system that can't tell you what to skip hasn't reduced your attention problem; it has reformatted it.

The wall of amber

I know how the alternative goes because I've built it, in other domains, more than once. You instrument everything, you flag everything questionable, and you get a dashboard where forty items glow some shade of warning. Every item is individually defensible. Together they train you, within a week, to stop looking. Not because you're lazy, but because the flags don't rank, and unranked warnings are noise wearing urgency as a costume. The monitoring world calls the end state alert fatigue. I'd put it more plainly: a system that cries about everything is teaching you to trust nothing, including the one cry that matters.

The portfolio version of this failure has a specific flavor. Side projects decay by default; that's what makes them side projects. Instrument 174 of them honestly and nearly everything will have something wrong with it: a stale README here, a missing license there, two years of silence somewhere else. All true. If the tool reports all of it with equal weight, the honest report and the useless report are the same document.

The machinery of not looking

So the auditor spends most of its design budget on ignoring well, through three mechanisms that turned out to matter more than any scoring rule.

The first is the deferred tier. A repo that's archived, or on the archive path, is excused from risk accounting entirely. So is a repo that's gone stale while not on a maintenance path. Not scored low. Excused, with the reason recorded. The tier exists because risk math applied to a resting repo produces exactly the wall of amber above: of my 174 projects, 37 sit in deferred right now, and every one of them would otherwise be contributing noise-shaped risk factors to every report I read.

The second is the lane vocabulary. A quiet repo lands in parked, which is an attention word, not a judgment word. Parked doesn't mean healthy and doesn't mean abandoned; it means "not asking for your week." The distinction sounds cosmetic and isn't, because judgment words demand resolution and attention words don't. A backlog of judgments nags. A parking lot just sits there, which is the correct behavior for a parking lot.

The third is the decision queue, and it's the piece I'd defend hardest. The queue of things genuinely awaiting a human decision is hard-capped, and every item ships with evidence and a freshness stamp. And each one carries a standing instruction, embedded in the data itself: do not refresh context, roadmap, handoff, or docs unless that work directly resolves this decision. That clause exists because I work with agents, and agents, like humans, default to legible busywork when a real decision is hard. Refreshing documentation feels like progress, produces a satisfying diff, and resolves nothing. The queue item pre-empts the theater. It doesn't just say "decide this"; it says "and here is the specific work that doesn't count as deciding."

Isn't this just institutionalized neglect?

The obvious objection, and I wrote a whole essay about ghost repos that makes it for me: fondness is how ghosts get fed, and a tier named "you're allowed to ignore this" sounds like fondness with a schema. If the auditor excuses whatever goes quiet, decay gets a rubber stamp.

The mechanism that answers this is small and load-bearing: deferral is downstream of declaration. A stale repo is excused only when it is not on a maintenance path. The moment I declare a repo maintain, silence stops being restful and starts being a risk factor again; a maintain repo that goes quiet stays in the accounting, because I made a promise about it and the system holds the receipt. Deferral never applies to anything I said I'd keep alive. It applies to the things I've explicitly stopped promising, which is a different category from the things I've merely stopped thinking about. The system still can't tell dying from done; no scanner can. What it can do is check what I committed to, and refuse to excuse anything still under commitment.

And deferred is a ledger entry, not a memory hole. The 37 are counted, listed, and re-derived from scratch on every snapshot; any of them returns to full accounting the moment its activity or its declaration changes. Ignoring, done right, is a standing decision that gets re-earned on every run, which is roughly the opposite of forgetting.

There's one more condition, and it's the price of the whole arrangement: you can only accept "ignore this" from a system you trust to be current. A permission to ignore, computed from a stale snapshot, is just neglect with a confidence interval. That's why the pipeline has to prove its own freshness and provenance before any of its silence means anything, and that argument got its own essay.

The scarce resource

None of this is really about repositories. Attention is the only input to a solo operation that doesn't scale, and anything that consumes it without a decision attached is a leak. The instinct when you build an audit system is to make it thorough, and thoroughness is cheap now; the models will happily flag everything, summarize everything, recommend everything. Which means the differentiating design work has moved to the other side of the ledger. The question that shapes my tools isn't "what can this system notice?" It's "what can this system take off my desk, with receipts, so that when it does speak I actually listen?"

Two repos this morning. I looked at both.

Adjacent reading