Skip to main content

​
Independent Authority

WalletWall treats agreement as strong evidence only when the things agreeing can fail independently. Two manifests, models, fixtures, or implementations can agree perfectly and still share the same assumption when they were produced from the same interpretation. That makes independence a property of provenance, not simply the number of artifacts being compared.
Assurance rule: Never let the artifact under test participate in defining its own truth.

​
The pattern

WalletWall separates two jobs that are easy to blur together:
  1. a normative anchor defines what must be reviewed; and
  2. independent per-probe evidence determines what actually deserves proof credit.
The anchor establishes completeness. It does not decide the outcome of an individual probe. This is stronger than relying only on:
A two-way comparison is useful for detecting disagreement. It cannot, by itself, establish which side is correct. If both artifacts share the same interpretation, even agreement may carry little new information. The same distinction applies to mutation and behavioral evidence. A probe is not proven merely because the expected final state occurred. Proof credit belongs to the mechanism the evidence actually attributes that result to.
Scope is anchored. Proof is adjudicated. The anchor tells WalletWall which fights must appear in the review; it does not tell WalletWall who earned each knock.

​
Intuition pump: getting third-partied in Apex

Imagine Pathfinder is trying to prove that Wattson’s fence stopped a push. An enemy runs toward the doorway and goes down before crossing it. From Pathfinder’s point of view, the explanation looks obvious:
Then Seer scans the area. Another squad was holding an angle Pathfinder could not see, and the kill feed shows that squad got the knock before the enemy ever reached the fence. The outcome was real: the push failed. But Wattson did not cause it, so Wattson does not get proof credit. That is the independent-authority problem in miniature. Pathfinder’s local observation can be sincere, internally consistent, and still insufficient to establish cause. Seer matters because his information does not require Pathfinder’s explanation to already be correct. The kill feed adds attribution from outside Pathfinder’s story. Now add Mirage. Pathfinder sees someone sprint at the fence and disappear near it. It looks like another successful stop—until Seer reveals it was a decoy. The expected-looking outcome happened, but the interaction Pathfinder thought he tested was never the interaction he claimed to test. More agreeing observations would not fix that if they all inherited the same mistake. Sometimes another artifact agreeing with the first is just another squadmate shooting the same decoy. WalletWall treats probes the same way:
may actually have been:
or the probe may never have exercised the intended condition at all. That is why WalletWall reviews proof probe by probe using evidence capable of contradicting the local story. The anchor still matters, but for a different job: it tells WalletWall which fights must be accounted for. It does not decide who earned each knock.
Pathfinder sees the outcome. Wattson is the mechanism under test. Mirage shows how convincing evidence can share one mistake. Seer changes the information boundary. Independent adjudication decides who actually gets credit.
Apex is useful here because a battle royale is larger than the fight in front of you. Every player behind every Legend is physically a many-body system; at the gameplay level, many stateful agents interact inside one larger lobby. The analogy is structural, not literal quantum mechanics: a local result can be real while its causal explanation remains incomplete.
You think you are in a clean 3v3. Then the rest of the lobby reminds you that you never were.
For WalletWall, the equivalent question is not only “Did the attack fail?” It is “What independently establishes why it failed?” The outcome belongs to the whole system. Proof credit belongs to the mechanism the independent evidence actually supports.

​
WorldSplitter: manufacture missing falsifiability

The Apex example exposes a second problem: sometimes the current world does not contain a state capable of distinguishing the correct authority rule from a defective one. Suppose every current registry entry is ACTIVE. A rule that correctly applies present-day authority only to active entries and a defective rule that applies it to every status can both stay green. The system is not proving both rules correct; the current world simply never forces them to disagree. WalletWall calls the method for exposing that hidden equivalence WorldSplitter. WorldSplitter is a controlled-counterfactual assurance method: construct a valid synthetic world containing the missing state, then split that world on one authority-bearing fact while holding the other relevant facts constant. If that fact genuinely governs the decision, the verdict must split with it. The important part is not that the worlds are synthetic. It is that they are controlled. WorldSplitter changes the authority-bearing fact and as little else as possible. For example, imagine a canonical requirement once occupied S11-1001, but the current specification now classifies that same line as non-normative. Hold constant:
  • the requirement identity;
  • the coordinate S11-1001;
  • the current NON_NORMATIVE classification; and
  • every other fact not meant to control the decision.
Then split only the lifecycle status:
If both worlds receive the same verdict, the claimed authority boundary is not actually governing behavior.
Synthetic worlds test authority. They never become authority. WorldSplitter manufactures missing falsifiability, not missing evidence.
A synthetic world cannot prove that a production fact is true. It cannot establish evidence applicability, satisfy a requirement, or mint proof credit. Its job is narrower: create a condition under which the authority rule can be contradicted if it is wrong.

​
The WorldSplitter method

  1. Identify the authority boundary. Name the fact that is supposed to control the verdict.
  2. Find observational equivalence. Determine whether the current world makes the correct and defective rules produce the same answer.
  3. Build the missing world. Construct a valid counterfactual containing the state the current repository lacks.
  4. Freeze non-governing facts. Hold identity, coordinates, inputs, and other relevant context constant.
  5. Split one authority-bearing fact. Change only the fact whose authority is being tested.
  6. Require verdict divergence. The two valid worlds must receive different verdicts in the expected direction.
  7. Mutation-pin the boundary. Reintroduce the defective rule and require the intended guard to kill it causally.
  8. Keep the synthetic world non-crediting. It may falsify the mechanism; it may never become evidence for the underlying requirement.
WorldSplitter therefore complements independent sources rather than replacing them. Independent authority asks who is allowed to establish the fact. WorldSplitter asks whether changing that fact actually changes the system’s decision when everything else is held still.

​
A lesson from the BigQuery contract

A useful example emerged while hardening WalletWall’s BigQuery contract. The logical_resolve_head manifest described three writer identities, while the IAM contract described three different identities. A direct manifest-to-IAM comparison correctly showed that the two artifacts disagreed, but it could not determine the intended answer. The frozen §9.5a per-row CAS authority established the required population and semantics: all five identities had to be accounted for. A separately derived writer oracle then provided an independent comparison path. Together, those layers resolved the discrepancy and exposed additional cases where implementation artifacts agreed with each other but not with the specification. The useful lesson was not that comparison failed. The comparison did exactly what it could do. The lesson was that reconciliation needs authority neither compared artifact can influence, while behavioral proof still has to be earned at the level of the individual observation.

​
Why a third implementation is not automatically independent

Adding more implementations does not necessarily add more evidence. If three implementations were generated from the same interpretation, they may all reproduce the same misunderstanding. One independently derived observation can provide more information than several mutually agreeing implementations. WalletWall applies this principle in several places:
  • canonical digest implementations are pinned to independently derived byte vectors;
  • IAM and manifest declarations reconcile against specification-derived scope rather than only against each other;
  • fixture expectations must be exercised by behavioral models, not merely referenced;
  • mutation results are grounded in measured guard execution rather than declared expectations;
  • proof credit is awarded per probe to the guard actually observed to produce the intended refusal;
  • completeness checks start from the normative contract and map forward to implementation, rather than asking implemented artifacts to define their own scope.

​
The counterweight: make intent explicit

Independent authority answers where truth comes from. There is an equal and opposite failure mode: the system can be correct today while its correctness still depends on knowledge that was never written down. A second BigQuery lesson made that visible. A tighter @@row_count provenance model stopped accepting the nearest preceding DML statement as the intended producer. The existing SQL was behaving correctly, but four operations — T7, P6, A3, and R1 — became ambiguous because multiple statements matched the same keyword and target. The old guard happened to choose the intended statement because of statement ordering. Nothing recorded why that statement was the intended one. The fix was not to suppress the new guard. It was to declare the missing intent. Identity atoms such as current_object_version_id and resolve_generation + 1 made the intended producer explicit and stable across harmless reordering.
Counter-rule: When a stronger guard rejects something you believe is correct, first ask what you know that the guard does not. Encode that knowledge before adding an exception.
This distinguishes incidental correctness from declared correctness:
A broad exception says, in effect, trust this case. A declaration says here is why this case is correct. That distinction matters during refactoring. Code can remain correct while statements, files, or execution order change. When intent is explicit, the proof moves with the behavior. When intent exists only in ordering or developer memory, a green guard may simply be preserving an accident. Together, the assurance principles form a useful set: The practical review question is therefore not immediately “how do we silence this false positive?” It is:
What did we know that the guard did not, and why was that knowledge not encoded?
Often, the missing declaration is the real improvement the stricter guard was asking for.

​
AI is a contributor, not an authority

WalletWall uses AI systems, including Anthropic Claude and OpenAI models, to assist with implementation, adversarial review, research, analysis, and documentation. AI can contribute reasoning, criticism, and code. It does not inherit authority from doing so. Claims earn acceptance through evidence, tests, source verification, and the controls that govern the system. WalletWall remains responsible for what it builds and publishes. The same principle applies when things go wrong. “The AI did it” is not a root cause. Stopping blame at the model can conceal the decisions that made its output consequential: what it was permitted to do, what evidence it received, what controls surrounded it, how its output was reviewed, and who chose to rely on it. Nor does nominal human involvement resolve that responsibility. Oversight is meaningful only when a person has the information, authority, time, and ability to intervene. WalletWall therefore separates attribution from accountability. AI systems should be credited for meaningful contributions and examined when they fail. Accountability remains with the sociotechnical system—and ultimately with the people and institutions that design, deploy, govern, and rely on it.

​
Frozen does not mean infallible

A frozen specification is an authority for scope and implementation conformance, not a claim that the specification can never be improved and not a substitute for behavioral observation. Freezing the contract separates three questions:
  1. What must the implementation account for?
  2. Did this individual probe actually demonstrate the mechanism it claims to prove?
  3. Is the contract itself sufficiently correct and complete?
When an implementation contradicts an unambiguous requirement, the implementation changes. When a probe’s observed result was caused by the wrong guard, the intended guard does not receive proof credit. When the normative source is genuinely ambiguous or incomplete, that ambiguity is surfaced explicitly and resolved at the specification layer rather than silently invented downstream. That separation keeps validation evidence interpretable: scope completeness, behavioral proof, and specification quality remain related, but they are not allowed to define each other.

​
A stable identity is not a current rationale

The same separation applies to a reviewed finding. A scanner finding can keep the same identity across many commits while the human reasoning attached to it quietly stops being true — because surrounding code changed, or because the premise was never checked. Identity answers “is this still the same finding?”; only evidence about the premises answers “is the rationale still right?” The Vault prototype hit exactly this: two findings kept stable identities while their rationales rested on false premises, and the fix was to pin each premise with an executable test and a positive control. See stable identity, stale rationale.

​
Controlled counterfactuals, hands-on

The reasoning above is easier to feel than to read. WallRoom includes a WorldSplitter mode that holds every condition of a synthetic scenario fixed, changes exactly one, and shows both outcomes side by side — the changed variable and the consequence that followed. The caveat is the same one this page argues for. A controlled counterfactual is an argument about reasoning, not evidence about the world. Two synthetic worlds that differ in one condition demonstrate what that condition decides; they establish nothing about any real system, and agreement between them would corroborate nothing at all, because both were derived from the same authority.

Assurance v2 runtime evidence

See the bounded eight-probe implementation result, adversarial findings, and claim ledger.

The Labyrinth and the Maze

Read the architecture story behind the move from recursive assurance state to disposable worlds and direct observation.