Rule
Before a change counts as done, a fresh context has to judge it. The author supplies the candidate and factual check receipts. The judge takes the exact subject, checks it against the accepted intent and the changed scope, weighs every criterion, and returns PASS, FAIL, or NOT_PROVEN.
Three properties make the gate real. Identity binds the verdict to the exact intent and content. Freshness separates authorship from judgment, so the author cannot issue its own PASS. Evidence makes every criterion inspectable, and PASS needs evidence for all of them with nothing left in not_checked. Deterministic tests and builds establish facts; the fresh judge decides whether those facts satisfy the intent. A green test run or a merge is a fact about the change. Missing identity, freshness, scope coverage, or evidence produces NOT_PROVEN, never a confident guess.
Anything short of PASS sends the work back, and the accepted scope still holds. After a FAIL, repair the demonstrated failure. After a NOT_PROVEN, gather the missing evidence, or repair whatever kept it from being gathered. Then ask for a fresh judgment of the updated candidate. The first verdict stays on the record, and the updated candidate earns its own.
Put It to Work
- Keep claim and verdict separate: the author supplies evidence, a fresh context decides.
- Bind the judgment to the exact intent and the exact content under review.
- Use deterministic checks for facts and criterion-level evidence for meaning.
- Grant
PASSonly when every criterion has evidence andnot_checkedis empty. - Persist the verdict when a caller or a declared consumer needs the record. Otherwise report it.
- After a
FAIL, repair the failure; after aNOT_PROVEN, gather the missing evidence. Stay inside the accepted scope, then get a fresh judgment of the new candidate.
Failure Signal
- The closeout says "looks good" but names no command.
- The same context that wrote the patch checks only the happy path it expected.
- A repaired candidate ships on the verdict its broken predecessor got.
- A gate got relaxed because "the new model doesn't need it."
- The validation step cannot fail.
Done Looks Like
The exact candidate has a fresh PASS bound to unchanged intent, with evidence for every criterion and an empty not_checked list. If a caller asked for the record, a stored verdict.v2 holds it.
In AgentOps 3.8: Validate returns PASS, FAIL, or NOT_PROVEN from a fresh author-distinct context, and ao provenance store-verdict saves a verdict.v2 to a non-Git evidence root only when someone asks for it.