Evidence and verification

The proposer never verifies

VerificationResult.verifiedBy is never ExecutionRun.executor. This is a law, not a default, and it is checked rather than trusted.

For verification by a language model, the vendor should differ. But treat vendor difference as disclosed metadata, not proof of independence: correlated failure across models is real, and two models trained on overlapping data can be confidently wrong in the same direction.

Genuine independence comes from the kind of evidence, not the identity of the checker. An exit code, an HTTP response, a row read back from a database. Those are facts about the world. A second model agreeing with the first is a second opinion.

Evidence is hashed and immutable

Every piece of evidence carries a provenance of simulated or live. It is a required field with no default, so it is a type error to record evidence without saying where it came from.

That requirement is structural on purpose. "Nothing may imply a real action occurred" is easy to write in a style guide and impossible to enforce there.

The chain

Events are appended to a hash chain: each event commits to the hash of the one before it. Removing or altering any event invalidates every event after it, so the record cannot be quietly rewritten.

This is also why deletion is not how data is removed. See Decisions.