Verification levels
After an action runs, the Witness checks it against an observation. The level says which observation.
| Level | What it compares the report with | Who reaches it |
|---|---|---|
| Claimed (Claimed (L0): the tool’s own response.) | The tool’s own response: it returned success, and its output matched the tool’s schema | Every connector, and every proxy-mode edge |
| Checked (Checked (L1): read back from the target after the action.) | A read-back from the target after the action: the record exists and the named fields match | REST, Postgres (the row, by xmin), GitHub, Slack, Stripe test mode, Notion |
| Proven (Proven (L2): the change Postgres committed, read from its change log.) | The row changes Postgres committed in the action’s transaction, read from its own change log | Postgres, with wal_level = logical |
A policy rule says the level it needs (verify: L2). The deed claims one level and one verdict.
The three verdicts
Section titled “The three verdicts”- Proven ·Matches The observation at that level found no difference, and nothing at any level disagreed.
- Proven ·Doesn’t match Some level found a difference: for example, Postgres changed 301 rows where the agent reported 1. A violation anywhere gives MISMATCH, at the highest level that found one.
- Checked ·Can’t check No level disagreed, but none at or above the required level could observe cleanly: a read-back timed out, the change log was behind, or Deedglass couldn’t tell whether the tool ran. The reasons name the gap.
How one verdict is chosen
Section titled “How one verdict is chosen”Each check produces reasons, each a pass, a gap or a violation. Any violation gives MISMATCH. Otherwise, a level with at least one pass and no gap, at or above the required level, gives VERIFIED at the highest such level. Otherwise the verdict is UNVERIFIABLE. A gap is never turned into a MISMATCH, and nothing short of a clean pass becomes VERIFIED. One function makes this decision, and it is tested over every combination of results.
Late evidence
Section titled “Late evidence”L2 can arrive after the deed was sealed (the change log was behind). The late verdict seals an amendment deed; the first deed never changes.
What it doesn’t do
Section titled “What it doesn’t do”- L1 trusts the target’s answer. A target that answers consistently but falsely can’t be caught by reading it back.
- L2 sees only the watched tables in Postgres’s change log: not effects outside Postgres, not unlogged or temporary tables, not other databases.
- L2 expectations exist for simple statements. A JOIN,
UPDATE … FROM, a CTE orMERGEgets the gapfootprint_unknown, so it can’t be VERIFIED at L2.
- What VERIFIED means, and what it doesn’t
- Catch “1 row reported, 301 committed”