A Check That Reported Success Without Running
Mutation-tested the CI check that guards .htaccess against twelve deliberately engineered breaks: it caught six, including a version that deleted every security header and still passed. Fixed it to catch twelve of twelve, then used the same method to confirm exactly what the fix still can't see.
The instinct after a config-file outage is a check that asserts the server starts. That proxy only detects the outage's own failure class — deleting the response's entire header block passes it clean. Finding that meant breaking the check on purpose, not adding assertions and trusting them.
Every assertion still runs inside a container standing in for the host, so a header the real Apache config strips would still show green. And a free private repo can't set required status checks, so what actually blocks a red run from merging is a standing personal rule, not a mechanism — real today, but unverified the way everything else here got verified.