> ## Documentation Index > Fetch the complete documentation index at: https://docs.walletwall.org/llms.txt > Use this file to discover all available pages before exploring further. # Assurance v2 — Runtime Evidence > What WalletWall's bounded Assurance v2 prototype actually demonstrated at runtime, what its adversarial review falsified, and why the merged artifact is evidence rather than production infrastructure. # Assurance v2 — Runtime Evidence Assurance v2 did not prove itself by staying green. **Its first green result was wrong.** Later review exposed why, preserved the raw observations, repaired the interpretation, and forced fresh execution only when the experiment contract actually changed. That behavior — not a perfect scorecard — is the result worth preserving. **Claim ceiling:** Assurance v2 is **runtime-demonstrated on the bounded eight-probe prototype**. PR #1974 preserves that experiment and its evidence. It does not make the prototype a production assurance framework or authorize product cutover. ## The result, before the machinery WalletWall ended the experiment with four different epistemic states on purpose: | Claim | State | | -------------------------------------------------------- | -------------------------- | | v1/v2 observational equivalence on eight frozen probes | **DEMONSTRATED** | | anti-R38 downstream noninterference | **DEMONSTRATED — bounded** | | old-identity rejection after a contract-changing repair | **DEMONSTRATED** | | crash ≠ CREDIT and crash locality | **DEMONSTRATED** | | assumption-dependent probe claims | **CONDITIONED** | | general WorldBuilder correctness | **UNKNOWN** | | DeclarationIdentity fully binds v2 execution semantics | **FALSIFIED** | | ProbeRunner instrument selection is fully contract-bound | **FALSIFIED** | This distinction is the point. A clean report does not collapse **DEMONSTRATED**, **CONDITIONED**, **UNKNOWN**, and **FALSIFIED** into one PASS state. ## What reality broke The first implementation contained a real integrity defect. `buildWorld` accepted a `_conformance` parameter that could redirect the checkout, skip the integrity fuse, and still stamp the declared snapshot identity onto the result. ```text theme={null} actual world HEAD = wrong commit reported snapshot = declared commit integrity fuse = bypassed ``` The builder could therefore construct the wrong world and describe it as the right one. The defect was reproduced RED against the real callable module. The repair **removed the privileged path instead of renaming it**: * `_conformance` disappeared from the production signature; * checkout became hard-bound to the declared snapshot; * the HEAD integrity check became unconditional; * corruption injection and regen skipping moved into the external harness; * the trusted production path no longer contained a caller-controlled integrity bypass. That repair changed WorldBuilder semantics, so WalletWall did not reuse the old campaign as proof of the new implementation. The DeclarationIdentity moved from `ef6be7b6…` to `45c2814e…`, and the bounded campaign ran again. Re-evaluating the prior corpus under the new contract produced **8 REFUSED / 0 valid**. **Interpretation changes may change the conclusion without rewriting the observation. Contract-changing repairs require fresh execution.** Those are different events and v2 treats them differently. ## What survived the failure The architecture remained small: ```mermaid theme={null} flowchart LR S["AssuranceSpec\nsource-owned intent"] --> W["Disposable worlds"] W --> P["ProbeRunner"] P --> R["Immutable ProbeResult"] R --> E["Deterministic Evaluator"] E --> C["Bounded claim"] C --> O["Pure report"] O -. "no authority upstream" .-> X["✕ experiment universe"] classDef authority fill:#1E1A14,stroke:#B87333,color:#FFF7E8,stroke-width:2px; classDef world fill:#24384A,stroke:#1E1A14,color:#FFF7E8,stroke-width:2px; classDef evidence fill:#526246,stroke:#33422B,color:#FFF7E8,stroke-width:2px; classDef stop fill:#FFF7E8,stroke:#8F2F1D,color:#8F2F1D,stroke-width:2px,stroke-dasharray:5 4; class S,E,C authority; class W,P world; class R evidence; class X stop; ``` The separation that mattered was: ```text theme={null} source declaration ≠ world construction ≠ raw observation ≠ interpretation ≠ reporting ``` When the implementation was wrong, the raw observations remained available for diagnosis. When the contract changed, old evidence lost current credit without being deleted or rewritten. That is materially different from the v1 failure mode where assurance changes could recursively stale assurance state and manufacture more assurance work under unchanged product semantics. ## The bounded runtime campaign The corrected contract completed the existing 14-stage closure: | Evidence | Result | | --------------------------------------------------------------- | --------------------------------------------------------------- | | Main eight-probe campaign | **8 valid**, 0 refused / failed / missing / duplicate / unknown | | v1 comparison | **8/8 AGREE**, zero disagreements | | Conservation | closed, `void: []` | | Credit barrier | **PASS** for the exercised 24-field roster | | Report independence / payload re-bind / adversarial declaration | **PASS** | | Gate 1 — runtime anti-R38 | **PASS** | | Gate 2 — falsifier containment | **PASS** | | Crash / refusal behavior | **PASS** | | Idempotence + commutativity | **PASS** | | Three-leg corruption reconstruction | **PASS** | | Gate 3 — common-mode calibration | **PASS** | | Fresh stateless rerun | **PASS** | Across the eight frozen comparands, v2 reproduced v1 on result, failing-test names, canonical identities, co-firing, necessity, guard outcome, tests executed, runner counts, file-level failures, attribution agreement, and baseline counts. That agreement is not fully independent. v2 reused v1's reporter, guard suites, and classification semantics. The independent dimensions were world construction, process isolation, fresh execution, and the frozen source-owned declarations. ## Three results worth keeping With source/spec/runtime frozen, the required experiment set remained unchanged across **four direct downstream perturbations**: report edit, publication vandalism, diagnostic-store append, and falsifier-output append. Execution-order invariance was corroborated separately. Cache was **N/A by construction**. The bounded result is simple: downstream assurance activity did not manufacture new experiment requirements. Always-suspect, always-clear, random, throwing, malformed, and corpus-wide challengers could challenge confidence without changing source truth or raw history and without minting CREDIT. Silence was not proof. Suspicion was not truth. **Scope:** the prototype has no production challenger attach point. This demonstrates the contract a future challenger would have to obey, not a production integration. The harness made two honestly built worlds consistently wrong. Their differential behavior still looked coherent, so sibling agreement alone could not reveal the lie. An independently grounded hierarchy-A calibration standard refused qualification on four genuine diff-member paths. Supported claim: > The implemented independent calibration detected the deliberately injected common-mode construction error for the covered hierarchy-A cases. Unsupported claim: **WorldBuilder is proven correct.** ## What did not survive review Adversarial review made the final artifact stronger by leaving several attractive claims dead. | Stronger claim | Final state | Reason | | ------------------------------------------------------------- | --------------- | --------------------------------------------------------------------------------------------------------- | | DeclarationIdentity completely binds v2 execution semantics | **FALSIFIED** | Some execution behavior lives directly in runtime code rather than being content-bound into the identity. | | `builderVersion` proves builder-code identity | **FALSIFIED** | It is a hand-declared value, not a measurement of the builder bytes. | | ProbeRunner's measuring instrument is fully bound | **FALSIFIED** | `runSuite({contract})` accepts a caller-steerable `reporterRelPath`. | | Pairing always refuses missing identity coordinates | **FALSIFIED** | `pairingRefusal` can fail open on absence. | | Env allowlist is checked against measured runtime state | **FALSIFIED** | The current enforcement is partly declaration-against-declaration. | | WorldBuilder correctness in general | **UNKNOWN** | Bounded calibration is not universal proof; one witness path retains residual circularity. | | Snapshot self-consistency beyond the exercised witness inputs | **CONDITIONED** | The evidence does not distinguish a stronger world. | **Non-blocking for a frozen historical artifact does not mean safe for production authority.** Caller-steerable reporter selection, incomplete identity binding, and fail-open pairing would require stricter treatment before production adoption. The prototype was frozen instead of recursively expanding until every hardening opportunity disappeared. That stopping rule is part of the architecture, not an excuse to hide limitations. ## Merged artifact ≠ production authority PR #1974 made the experiment durable and reviewable. It did not turn the eight-probe harness into an operational control plane. ```text theme={null} merged evidence artifact ≠ production assurance authority ≠ product cutover ``` The artifact remains anchored to historical source/evidence at `92fff36e`, covers eight probes rather than the full assurance estate, has no production challenger attach point, and intentionally preserves known binding gaps. A future production consumer should take the **minimum architecture required by a real production claim** and earn fresh evidence under that contract. The prototype should not be promoted wholesale merely because the bounded experiment passed. ## The result worth carrying forward The strongest evidence for v2 came from the moments when v2 itself was wrong: ```text theme={null} implementation defect ↓ raw observations survive ↓ diagnosis changes ↓ no proof-history rewrite ``` and, when the experiment itself changed: ```text theme={null} contract-changing defect ↓ old identity refused ↓ fresh bounded execution ↓ new evidence only ``` > **The assurance system discovered that one of its own green conclusions was not trustworthy without turning that discovery into proof-history entropy.** That is the genuine runtime result. Why v1 became a maze and how v2 reduced the model to independent authority, disposable worlds, direct observation, and bounded interpretation. Why the mechanism under evaluation may not define the truth or acceptance criterion against which it is evaluated.