Normative sourceView source on GitHub

Rendered from standard/VSTD-2.md at build time without changing its status. The repository source controls if this presentation differs.

Verifier Standard (VSTD)-2 — Verification Surface#

Acronyms: abstract syntax tree (AST); continuous delivery or deployment (CD); continuous integration (CI); intermediate representation (IR); trusted computing base (TCB).

Reader aid: concept glossary and primary precedents.

Numbered profile: VSTD-2 on the object axis; required closure coordinate: Verification Surface (see LADDER.md) Receipt serialization: schema_version = "VSTD-2"; see WIRE_IDENTIFIERS.md Status: experimental project specification with an implemented vertical slice Maintainer: TimeLordRaps Date: 2026-08-20

1. Relationship to adjacent profiles#

VSTD-2 adds a verification-geometry ontology beside VSTD-1 claim mechanics and VSTD-Graph collection dynamics. A document conforms to this extension only when it declares schema_version = "VSTD-2"; a result on one coordinate does not supply a result on either adjacent surface.

VSTD-1 answers how a bounded claim carries evidence, provenance, a checker judgment, an explicitly evidenced independence basis, and reproducibility information. VSTD-Graph-1 answers how artifacts and transformations compose into a provenance hypergraph. VSTD-2 answers a different question: what geometry was selected for verification, what did reconstruction expose that the geometry missed, and has the sufficiency of the declared closure itself been verified?

The normative typed slice is implemented by:

2. Epistemic law#

VSTD MUST NOT claim more than the declared verification surface and actual evidence establish.

Assumptions MUST NOT manufacture closure. Unknownness, unsupported structure, missing evidence, unresolved translation, an unverified mechanism, and an unverified root are information. They MUST remain explicit states, residuals, valences, or horizons.

A declared trust root is a boundary, not evidence that the root is true. When a derivation stops at such a boundary, the geometry MUST record a TRUST_ROOT horizon and MUST NOT claim self-closure.

3. Verification geometry#

3.1 Subject and locus#

A subject is the overall entity under consideration. A subject may itself become an addressable entity inside a larger subject.

A locus is a scale-independent, addressable place or entity to which verification can attach. A locus may recursively contain other loci. Repositories, functions, AST nodes, instructions, dataset rows, models, processes, interfaces, and dependency relations are all possible loci.

LOCUS answers where or what.

3.2 Facet#

A facet is a dimension of assurance applicable to a locus, such as functional or semantic correctness, termination, determinism, integrity, provenance, reproducibility, translation fidelity, performance, or security.

FACET answers in what respect.

A facet is not a constituent part of a subject. New facets remain expressible through stable identifiers rather than a permanently closed enumeration.

3.3 Region, grain, and stratum#

A region is a meaningful collection of loci considered together, whether or not they are syntactically contiguous. The implemented slice represents a region through a named surface selection; a separate region object is deferred until distinct region semantics are demonstrated.

Grain is the resolution at which a subject is decomposed: repository, module, function, statement, instruction, row, checkpoint, or another declared resolution.

Stratum is the representation layer: requirement, source, AST, IR, assembly, execution, output, or verification.

Grain and stratum are orthogonal. Two loci may have function grain while one belongs to source stratum and another to execution stratum.

3.4 Seam#

A seam is an interface, transition, dependency, or translation boundary between loci. A seam records its source locus, target locus, and relation. A seam can be made a locus when assurance must attach to the seam itself.

3.5 Coordinate and surface#

A coordinate is a locus-facet pair:

coordinate = locus x facet

A verification claim attaches to a coordinate or an explicitly represented relation among coordinates.

A verification surface is the declared set of coordinates and relevant seams for which verification status is claimed. For subject S, loci L, and facets F:

surface(S) = (C_selected, E_selected)

where C_selected is a finite subset of L x F and E_selected is the finite set of relevant seams. Coordinates not selected by the surface do not inherit its verdict.

3.6 Horizon#

A horizon is a localized point at which the current verification derivation cannot proceed because evidence, representation, mechanism, grain, ontology, or a root ends. A horizon proves nothing beyond itself. It records the limit without converting the limit into an assumption.

4. Decomposition, reconstruction, and deconstruction#

Decomposition resolves or partitions a subject into loci at a declared grain. It asks: what parts can be exposed?

Reconstruction generates, reproduces, simulates, or predicts a subject or its relevant behavior from the represented geometry. It asks: is this representation sufficient to regenerate what mattered?

Deconstruction is the iterative inference of a reconstructible verification geometry. It combines decomposition, reverse engineering, reconstruction pressure, residual analysis, and ontology refinement:

SUBJECT --deconstruct--> GEOMETRY
   ^                       |
   |                       |
   +----reconstruct--------+

Deconstruction may recurse over the subject by exposing finer loci. It may also recurse over the ontology when a residual cannot be expressed by the current verification language. Neither recursion licenses invented structure.

Zero residual is not itself a valid objective. A residual eliminated by enlarging an unverified TCB, deleting unsupported semantics, overfitting a reconstruction, or adding an assumption remains epistemically unresolved. Every material residual MUST instead be resolved, localized, represented, or terminated at a horizon.

5. Residuals and novelty#

5.1 Residual taxonomy#

A residual is an evidenced difference between observation and the current verification geometry or reconstruction.

A residual has a disposition:

An assumption is not a residual disposition.

5.2 Novelty#

Novelty is residual structure that cannot be discharged using the currently declared geometry or mechanism vocabulary. A novelty claim MUST cite its grounding residual and classify the insufficiency as grain, locus, facet, seam, stratum, mechanism, or ontological novelty. Surprise alone is not novelty.

6. Closure, valence, and self-closure#

6.1 Ordinary bounded closure#

Ordinary closure asks whether all obligations selected by the declared surface have been discharged. The implemented vertical slice permits bounded closure up to an explicit horizon when:

  1. every selected coordinate has a VERIFIED judgment backed by evidence and an identified mechanism; and
  2. every material residual is RESOLVED or explicitly terminated at a HORIZON.

This form of closure is never evidence about what lies beyond a horizon.

6.2 Verification valence#

Verification valence is an open relational or evidentiary capacity licensed by the existing geometry. A valence identifies its source, the relation or evidence slot that the geometry implies, and whether that slot is OPEN, DISCHARGED, or terminated at a HORIZON.

Valence describes the shape of an unresolved obligation. It does not invent the entity or evidence that would satisfy it.

6.3 Self-closure#

Self-closure is closure that recursively verifies the sufficiency of its own declared closure conditions and exposes remaining verification valence rather than assuming it away.

Self-closure requires:

  1. structurally valid verification geometry;
  2. ordinary bounded closure;
  3. every material residual RESOLVED, not merely stopped at a horizon;
  4. every verification valence DISCHARGED by evidence;
  5. every material verification mechanism post-verified by identified evidence;
  6. no unresolved evidence, mechanism, ontology, grain, representation, or trust-root horizon; and
  7. a finite, contiguous sequence of adjacent verification orders.

If any condition fails, the geometry MUST refuse self-closure and enumerate the blockers.

6.4 Higher verification orders#

Higher-order verification is represented as a finite sequence:

Each order greater than zero MUST verify exactly the preceding order. Skipped orders violate the verification-order adjacency invariant. A finite document never claims that simply adding one more self-description would close the sequence; inability to justify the next order is a horizon or open valence.

7. Lifecycle vocabulary#

Systems SHOULD minimize pre-verified surface area and dwell time. Post-verified snapshots are useful compositional checkpoints, but continuous verification is preferred: material changes invalidate dependent judgments and create new pre-verified coordinates until checks pass again.

8. Verifying processes and the common verification language#

A verifying process has an attached self-verification pipeline that observes its operation, translates relevant facts into the common verification geometry, applies mechanisms, and emits evidence about both the process and the pipeline.

Self-observation is not self-certification. A pipeline that does not represent its own mechanisms, dependencies, translation limits, and horizons is only verification-instrumented.

The common verification language is the typed graph of subjects, loci, facets, coordinates, seams, surfaces, judgments, mechanisms, residuals, horizons, valences, and adjacent verification orders. It is not an intermediate programming language for every CI/CD system. Native workflows translate observable verification events through thin adapters into this graph:

native process -> adjacent adapter -> verification geometry -> verifier

The adapter and verifier become loci in the next adjacent verification order. This keeps verification orders adjacent and finite instead of recursing into infinite workflow abstraction.

The language is self-describing only in the bounded sense that its schema, adapter, validator, and closure criteria can themselves become subjects. Their description is not evidence of their correctness.

8.1 Profiles and profiler adapters#

A geometry profile is a named, reusable constraint on how this geometry is applied; it is not a new verdict, numbered VSTD profile, assurance score, or substitute for a verification mechanism. A geometry profile may identify its subject and grain, expected loci and facets, selected surface and exclusions, native observation sources, adapter and mapping identities, applicable mechanisms, evidence requirements, bounds, trust roots, horizons, and falsification or conformance conditions.

A native profiler or domain tool remains an observation source. Its output enters a VSTD-2 surface only through an adjacent adapter that attributes the translated values to exact coordinates and exposes omissions, transformations, and information loss. A native status word does not transfer into a VSTD judgment without the identified assessment that earns that judgment.

Geometry profiles are linked only through explicit shared coordinates, seams, mappings, and evidence-bearing transformations. Naming two profiles together, applying them to the same subject, or repeating their observations does not compose their verdicts. A composite geometry profile must declare and assess the cross-profile seams; unresolved mappings and conflicts remain horizons or open valences.

The VSTD-2 receipt does not currently carry a geometry-profile identifier or a geometry-profile-composition object. This section defines the conceptual relationship only. A geometry-profile document can bind an exact VSTD-2 surface and receipt externally; a new wire representation requires an explicit versioned profile boundary.

9. Reprogramming compatibility#

VSTD-2 reserves no universal transformation engine. It remains compatible with the following future pattern:

SUBJECT S0
  -> deconstruct to GEOMETRY G0
  -> transform selected verified coordinates into G1
  -> reconstruct SUBJECT S1
  -> verify the transformation and resulting behavior

Reprogramming is a verified transformation of selected coordinates in a deconstructed representation followed by reconstruction into a modified subject. Any future implementation MUST receipt the selection, transformation, reconstruction, residuals, and resulting verification without silently transferring S0 judgments to S1.

10. Conformance and present limits#

A VSTD-2 geometry document conforms to the implemented vertical slice when:

  1. it validates against vstd2_receipt.json;
  2. validate_geometry returns no errors;
  3. every VERIFIED judgment cites evidence and a known mechanism;
  4. references and containment are internally consistent;
  5. reconstruction residuals are typed and localized;
  6. verification orders obey the verification-order adjacency invariant; and
  7. closure is reported by assess_closure without suppressing its blockers.

The current slice does not infer loci automatically, prove ontology completeness, translate arbitrary CI/CD workflow languages, or certify its own Python runtime. Those are explicit present limits, not assumed capabilities.