# Verify the verifier

> Verification produces evidence, and the verifier itself has to be verified, in the order shown in earning trust].

Page: Methodology · Verify
Canonical: https://banes-lab.com/disciplined-methodology/verify#verify-the-verifier

This section is stop 41 of 102 in the learning route. Previous: [26 - It looked right](https://banes-lab.com/disciplined-methodology/verify/it-looked-right.md). Next: [28 - A report, not a checkbox](https://banes-lab.com/disciplined-methodology/verify/a-report-not-a-checkbox.md). It builds on [19 - The check comes first](https://banes-lab.com/disciplined-methodology/build/the-check-comes-first.md).

[Verification](https://banes-lab.com/records/arch/verification.md) produces evidence, and the verifier itself has to be verified, in the order shown in [B1·b earning trust](https://banes-lab.com/disciplined-methodology/verify#verify-the-verifier-panel-b). A gate that has never failed on purpose has never shown that it can fail, and a green result from a check that exercises nothing is the [mock mirage](https://banes-lab.com/records/arch/mock-mirage.md). A checker applies its own rules to itself; otherwise it asks of the code what it does not ask of its own source. Above every verifier sits an anchor that cannot be verified, only disclosed, because a gate cannot prove itself. A verdict is the value typed in [B1·a a verdict](https://banes-lab.com/disciplined-methodology/verify#verify-the-verifier-panel-a), and a verdict whose surfaces moved beneath it loses its standing, as shown in [B1·c lost standing](https://banes-lab.com/disciplined-methodology/verify#verify-the-verifier-panel-c). The same proof, taken when a check is first written, is described in [the check comes first](https://banes-lab.com/disciplined-methodology/build/the-check-comes-first.md).

### Conforming member first

A green check is evidence of nothing until you know the check can go red. A gate is green for a year, until you read its source and find it has matched nothing since a refactor changed the file suffix it looked for. A check's own green is the only evidence of its health, and green is also what a broken check produces.

For this reason I verify the verifier with a conforming member before believing what it says. A verifier is trusted only after a conforming member, a planted violation and an adversarial test, rather than on the strength of its green results. In practice, the two cases described in the check comes first are kept as tests beside the check. Every detector is also tested adversarially with the inputs that fool a shallow match, such as a look-alike character, a pattern inside a comment, or a shape without the structure. The governance tooling runs through the same gate it enforces. The anchor everything else rests on is disclosed, and when a gate goes green after a structural change, it is confirmed that the gate still loads what it claims to load.

To check this, find for each check the planted violation that turned it red and the conforming member that turned it green. A check missing either one is unverified. The anchor is the boundary of what can be verified. A verifier trusts that the runtime runs, that the filesystem reads, that a command executes and that tool output arrives, and it says so rather than pretending to verify them. Everything above the anchor is verified, and the anchor itself is disclosed.

The failure the anchor guards against is concrete. A loader that discovers checks by a name pattern reports success while loading none of them if the pattern no longer matches what is on disk: every step passes, and nothing is checked. So a green run after a structural change is followed by one question, whether the run still loads what it claims to load, and the evidence is the generated index naming the checks together with the loader's own count. A harness that cannot fail belongs to the same class. A stub that stands in for an absent environment must answer only for that environment, because a permissive stub that also absorbs the subject's own missing symbols turns every defect into a silent success.

A verifier that audits claims audits itself last, and an overclaim in its own contract drops its confidence below the threshold, so a run below the threshold is not a clearance. How that self-audit runs, and why a verifier binds to one phase at a time, is described in [agents as executed contracts](https://banes-lab.com/disciplined-methodology/collaborate/agents-as-executed-contracts.md).

A verdict carries a standing beside its value. Every surface a run reads is stamped when it is read and stamped again at the end, which is [optimistic locking](https://banes-lab.com/records/arch/optimistic-locking.md) over a read set. A run whose read set moved beneath it names the surfaces that moved and is not authoritative. The verdict itself is untouched, so a pass stays a pass; what is withdrawn is its standing to be quoted, because the report then describes an interleaving of changes rather than a state. Holding a write barrier across the read would be the wrong repair: that is [pessimistic locking](https://banes-lab.com/records/arch/pessimistic-locking.md), which serialises every verification against every write to answer a question about the past. In the type, the standing is derived from whether the moved set is empty, rather than written by the run. The set the run reached is named, so a green result reads as coverage over that set and silence over the rest, and the surfaces the run healed itself are named apart from the ones that moved, because a run's own repairs are not contention. A clearance is then one function over the record: a pass whose standing is authoritative. Any other combination is a value without the standing to be quoted.

B1·a a verdict

```typescript
export type Value = "pass" | "fail";
export type Standing = "authoritative" | "withdrawn";

export interface Stamp {
readonly surface: string;
readonly seen: string;
}

export interface Verdict {
readonly value: Value;
readonly standing: Standing;
readonly reached: readonly string[];
readonly moved: readonly Stamp[];
readonly healedByThisRun: readonly string[];
readonly derivations: readonly Finding[];
}

export const standingOf = (moved: readonly Stamp[]): Standing => (moved.length === 0 ? "authoritative" : "withdrawn");

export const quotable = (verdict: Verdict): boolean => verdict.value === "pass" && verdict.standing === "authoritative";
```

B1·b earning trust

```mermaid
flowchart TB
written["A check is written"]
real["A conforming member it passes"]
planted["A planted violation it fails"]
adversarial["Adversarial inputs it rejects"]
self["The tooling passes through its own gate"]
recorded["The first firing and the first clearing are recorded"]
trusted["Trusted, above a disclosed anchor"]
written --> real --> planted --> adversarial --> self --> recorded --> trusted
```

B1·c lost standing

```mermaid
flowchart TB
run["A run reads its surfaces and stamps each"]
restamp["It re-stamps them at the end"]
moved{"Did any surface move beneath it?"}
authoritative["The verdict stands and may be quoted"]
withdrawn["The verdict keeps its value and loses its standing · the moved set is named"]
run --> restamp --> moved
moved -- no --> authoritative
moved -- yes --> withdrawn
```

## Links to

- [Verification](https://banes-lab.com/records/arch/verification.md)
- [Mock Mirage](https://banes-lab.com/records/arch/mock-mirage.md)
- [The check comes first](https://banes-lab.com/disciplined-methodology/build/the-check-comes-first.md)
- [Agents as executed contracts](https://banes-lab.com/disciplined-methodology/collaborate/agents-as-executed-contracts.md)
- [Optimistic Locking](https://banes-lab.com/records/arch/optimistic-locking.md)
- [Pessimistic Locking](https://banes-lab.com/records/arch/pessimistic-locking.md)

## Linked from

- [PAG and the method](https://banes-lab.com/pag/introduction/pag-and-the-method.md)
- [Planning templates](https://banes-lab.com/pag/templates/templates-planning.md)
- [Agent templates](https://banes-lab.com/pag/templates/templates-agents.md)
- [The check comes first](https://banes-lab.com/disciplined-methodology/build/the-check-comes-first.md)
- [Agents as executed contracts](https://banes-lab.com/disciplined-methodology/collaborate/agents-as-executed-contracts.md)
- [Posting and waiting are one operation](https://banes-lab.com/disciplined-methodology/collaborate/posting-and-waiting-are-one-operation.md)