In a build with no dates and no supervisor, done must be a fact about the record rather than a feeling about the work. This document defines that fact: the five suites that run as code, how a packet proves its acceptance, the gates each slice must pass with a human attestation, and the walkaway test as something executed rather than admired. The document governs; the workflow it emits distills.
This contract consolidates the estate's verification layer: the CI job contracts of VERIFICATION.md, the verification definitions of C3, and the C11 wave gates, rewritten from waves to slices. The C9 KPI fixture pack retires with the grant it measured, per the deprecation record at PRD v0.3 §1a; its useful habit, designed pass and fail cases, carries without its KPIs, under the fixture discipline of §7.
The same honest limit that bound the Build Protocol binds this document: the estate files hold check contracts at a finer grain than the commons index records, and those are not silently dropped. The reconciliation packet BP v1 §1 opened grows in scope to include VERIFICATION.md, C3, and C11: at the merge, each finer-grained contract is adopted here by amendment or retired by name. Open · reconciliation packet, scope grown
The emission continues the series pattern: verify.yml is the workflow the repository actually runs, and the invariant assertions inside it execute against the substrate migration IM v0.1 emitted, so the schema's refusals are proven, not presumed. What the workflow cannot honestly run yet, it names as deferred rather than faking green.
Every merge runs five suites. Three are fully runnable today; two run in their honest partial form and grow with the artifacts they wait on.
The signal loop's synchronization job carries alongside these but is not of them: it feeds an attention instrument, and an instrument is not an authority, per BP v1 §8.
A packet's acceptance field is its test statement, written so this document can check it. For slice work, the member-capability sentences of PRD v0.3 §4 are the acceptance language verbatim: each sentence beginning a member can is demonstrated, not asserted.
Done is a conjunction, never a mood: the five suites green on the packet's branch; the acceptance demonstrated in a way the reviewer can reproduce; the review tier of BP v1 §6 satisfied, with a decision record where the tier demands one; and the status changed by commit. A failed check does not argue, it names: the packet's status becomes the Open chip carrying the check's name, blocked · db-verify/one-voting-share, so the status table reads as reasons. And the protocol's last line binds here with full force: if unsure whether done, not done.
What db-verify proves, each assertion mapped to the law and locus it exercises. The suite's method is attempted violation: the test tries to break the invariant and passes only when the substrate refuses.
events; the trigger must raise. Law I, IM v0.1 §4.capital_accounts view must equal their hand-computed folds, both projections. Law I and VII, the smallest true replay.Assertions for vote arithmetic, the patron-majority floor, allocation sums under substantial economic effect, and the paired covering distribution are stated in IM v0.1 §6 and enter this suite when their slices land; listing them green before their schema exists would be a plan dressed as a fact. Anticipated · with their slices
Gates replace the wave gates one for one in mechanics and change only in shape: a gate now closes a slice, not a wave. Each gate is a named set of required checks plus a human attestation, and passing it is what unlocks the packets that cite it. Parts are proven by steps; the whole is proven here, and that estate phrase carries verbatim.
A gate attestation is not a checkbox in a workflow run; it is a record in the system the gate protects. Passing a gate writes an event, gate.attested, carrying the gate's name, the suites' run references, and the human actors, per Laws II and X: the act of attesting is a happening, and it belongs to people.
This closes a loop worth naming: the record verifies the build, and the build's verification becomes part of the record. An auditor asking whether a gate truly passed queries the same ledger a member queries for their capital account, with the same traceability, and the answer never depends on a CI provider's retention window.
C9 retires, its habit survives. Designed cases that should pass and designed cases that must fail remain the best way to prove an assertion means something; only the KPIs they measured are gone.
Fixture discipline follows the simulation rule of BP v1 §5 without exception: fixture and demonstration data carries provenance: illustrative at creation, lives only in test databases and branch environments, and writes nothing back to live records. The db-verify suite builds its world fresh on every run and discards it after; a fixture that leaks into the ledger is a defect the suites themselves should catch, which is why the live record is also linted for illustrative provenance outside designated demonstration surfaces.
Law XI's promise, turned into a procedure: on infrastructure the cooperative does not control, a stranger with only the published artifacts can stand the system up and arrive at the same state.
The procedure, stated so a harness can run it: provision a fresh database from nothing but the public repository; apply the migrations in order; load each table's documented export together with the event log; replay; and compare every fold, both capital projections included, against the folds published by the source system. The run must complete within the bounded recovery window Law XI names, and it must require no conversation with anyone at RegenHub, which is what without renegotiation means operationally.
The harness is a packet, not yet a suite: it enters verify.yml on a schedule rather than on every merge once the first per-table exports land, and its first green run is a success criterion of PRD v0.3 §10, not a decoration. Anticipated · harness packet
The workflow verify.yml distills this document into five jobs. Today it runs honestly: ledger-validate calls the estate validator where the ledger exists; schema-lint and style-lint run whole; db-verify provisions a database in the runner, applies 0001_substrate.sql, and executes every §4 assertion by attempted violation; rls-audit proves deny-by-default with a grant-bearing, policy-less probe role. The probe matrix, the walkaway harness, and the with-their-slices assertions are named in the workflow as deferred, in comments a reader can find, because a suite that fakes green teaches people to ignore it.
Changes to this document are Tier C under BP v1 §6, and a change that weakens a check is a regression to be named, never absorbed, which is the one sentence of the old gate discipline this refactor keeps with pride. The workflow versions with the document; supersession is explicit; the superseded contracts remain in the record as history.
A green suite is not the truth; it is the absence of known lies, kept honest by checks that try to break what they protect. The suites exist so that done is a fact about the record, and so that trust in the build, like trust in the cooperative, never has to be taken on anyone's word, including ours.