Verification method
Five methods carry the word verified: replay determinism, coverage with abstentions counted, selection-cost deflation, settlement binding, and correction by append. Below them you will find what would falsify each claim and the checks a run must pass.
Method
Each method reads the same run and answers a different question: did it replay, did it answer enough, did it earn the promotion, did the outcome bind, and does the trail still hold what it said.
A run recomputes from the same sealed inputs and the same model version, and the result is compared with the record. Replay performs zero adapter calls, so a re-check can never become a second effect.
A mismatch stops the run before anything downstream happens: no decision is emitted, nothing is planned, and no adapter is reached.
Coverage is measured over the sealed holdout with abstentions included. A candidate cannot raise its coverage by declining the cases it finds hard, because declining is counted as answering.
A candidate below the declared floor is rejected at the promotion gate, and the rejection records the coverage figure it measured.
Promotion requires beating the floor after deflation. Selection cost is subtracted from the measured performance, so a candidate that looks strong because it was chosen from many attempts is not promoted for that reason.
In-sample fit alone never promotes a candidate, whatever the size of the in-sample number.
The resolved outcome binds to the exact run that produced the decision, including a reasoned abstention. Evaluation compares what was believed against what happened, and the learning receipt is written under the same lineage.
A settlement that cannot be bound to its run fails closed rather than crediting a decision twice.
A correction adds a record. The record it corrects stays readable, so what was believed, recorded, and later revised can all be seen at once.
Nothing in the trail is rewritten in place, and nothing is deleted to make a series look cleaner.
What would falsify this
Each item below is a defect we would have to fix, not a disclaimer. If you find one, the receipt trail is what you use to show it.
Run checks
A run is verified when every row below holds for the same run identity. The table says what each check reads and what fails it.
| Check | What it reads | What fails it |
|---|---|---|
| Evidence is point-in-time | Observation time, availability time, and provenance for every admitted fact, plus the quote snapshot reachable at the decision time. | A fact that became available after the decision clock. It is refused before inference, so the run records no belief at all. |
| Replay is deterministic | The belief and the decision, recomputed from the same sealed inputs and the same model version. | A replay that disagrees with the record. The run stops instead of writing a receipt, and no adapter is called. |
| Uncertainty and lineage are explicit | A bounded interval on the belief, and the model, artifact, and dataset identities that produced it. | A bare point estimate, or lineage that cannot be resolved to a version that actually ran. |
| The mandate decides | Objective, permitted effects, exposure or stake bounds, and expiry, all evaluated at the decision clock. | Missing, expired, or internally inconsistent authority. The run abstains with a reason and emits no effect intent. |
| One typed outcome | Exactly one decision receipt per run: an admitted act or a reasoned abstention. | More than one outcome for a run, or an act recorded without the authority that admitted it. |
| The outcome binds to the run | The resolved outcome bound to the run identity that produced the decision, abstention included. | An outcome that resolves against a different run, or a settlement that credits one outcome twice. |
| Settlement emits evaluation and learning | Evaluation of belief against outcome, and a learning receipt recording the lesson under the same lineage. | A settlement with no evaluation, or a learning record that rewrites an earlier one instead of appending. |
Refusals are part of this table rather than exceptions to it. A run that refuses is recorded as refusing, with the reason, and still counts where the conditions hold.
Limits of this page
These checks say a run is reproducible, bounded, and bound to its outcome. They do not claim a profit, a strike rate, or a live effect, and no number here is a projection.
PostureWhat is not live today
Everything on this page describes local, simulation-only behaviour against sealed corpora and checked-in fixtures. There is no hosted service, no customer data, and no external effect. Trust and posture has the full account.