Skip to main content

​
Assurance v2 — Runtime Evidence

Assurance v2 did not prove itself by staying green. Its first green result was wrong. Later review exposed why, preserved the raw observations, repaired the interpretation, and forced fresh execution only when the experiment contract actually changed. That behavior — not a perfect scorecard — is the result worth preserving.
Claim ceiling: Assurance v2 is runtime-demonstrated on the bounded eight-probe prototype. PR #1974 preserves that experiment and its evidence. It does not make the prototype a production assurance framework or authorize product cutover.

​
The result, before the machinery

WalletWall ended the experiment with four different epistemic states on purpose: This distinction is the point. A clean report does not collapse DEMONSTRATED, CONDITIONED, UNKNOWN, and FALSIFIED into one PASS state.

​
What reality broke

The first implementation contained a real integrity defect. buildWorld accepted a _conformance parameter that could redirect the checkout, skip the integrity fuse, and still stamp the declared snapshot identity onto the result.
The builder could therefore construct the wrong world and describe it as the right one. The defect was reproduced RED against the real callable module. The repair removed the privileged path instead of renaming it:
  • _conformance disappeared from the production signature;
  • checkout became hard-bound to the declared snapshot;
  • the HEAD integrity check became unconditional;
  • corruption injection and regen skipping moved into the external harness;
  • the trusted production path no longer contained a caller-controlled integrity bypass.
That repair changed WorldBuilder semantics, so WalletWall did not reuse the old campaign as proof of the new implementation. The DeclarationIdentity moved from ef6be7b6… to 45c2814e…, and the bounded campaign ran again. Re-evaluating the prior corpus under the new contract produced 8 REFUSED / 0 valid.
Interpretation changes may change the conclusion without rewriting the observation. Contract-changing repairs require fresh execution. Those are different events and v2 treats them differently.

​
What survived the failure

The architecture remained small: The separation that mattered was:
When the implementation was wrong, the raw observations remained available for diagnosis. When the contract changed, old evidence lost current credit without being deleted or rewritten. That is materially different from the v1 failure mode where assurance changes could recursively stale assurance state and manufacture more assurance work under unchanged product semantics.

​
The bounded runtime campaign

The corrected contract completed the existing 14-stage closure: Across the eight frozen comparands, v2 reproduced v1 on result, failing-test names, canonical identities, co-firing, necessity, guard outcome, tests executed, runner counts, file-level failures, attribution agreement, and baseline counts. That agreement is not fully independent. v2 reused v1’s reporter, guard suites, and classification semantics. The independent dimensions were world construction, process isolation, fresh execution, and the frozen source-owned declarations.

​
Three results worth keeping

With source/spec/runtime frozen, the required experiment set remained unchanged across four direct downstream perturbations: report edit, publication vandalism, diagnostic-store append, and falsifier-output append.Execution-order invariance was corroborated separately. Cache was N/A by construction.The bounded result is simple: downstream assurance activity did not manufacture new experiment requirements.

​
What did not survive review

Adversarial review made the final artifact stronger by leaving several attractive claims dead.
Non-blocking for a frozen historical artifact does not mean safe for production authority. Caller-steerable reporter selection, incomplete identity binding, and fail-open pairing would require stricter treatment before production adoption.
The prototype was frozen instead of recursively expanding until every hardening opportunity disappeared. That stopping rule is part of the architecture, not an excuse to hide limitations.

​
Merged artifact ≠ production authority

PR #1974 made the experiment durable and reviewable. It did not turn the eight-probe harness into an operational control plane.
The artifact remains anchored to historical source/evidence at 92fff36e, covers eight probes rather than the full assurance estate, has no production challenger attach point, and intentionally preserves known binding gaps. A future production consumer should take the minimum architecture required by a real production claim and earn fresh evidence under that contract. The prototype should not be promoted wholesale merely because the bounded experiment passed.

​
The result worth carrying forward

The strongest evidence for v2 came from the moments when v2 itself was wrong:
and, when the experiment itself changed:
The assurance system discovered that one of its own green conclusions was not trustworthy without turning that discovery into proof-history entropy.
That is the genuine runtime result.

The architecture story

Why v1 became a maze and how v2 reduced the model to independent authority, disposable worlds, direct observation, and bounded interpretation.

Independent Authority

Why the mechanism under evaluation may not define the truth or acceptance criterion against which it is evaluated.