Separate approval, a completion report and a later observation

Compare the exact request and keep missing evidence visible

An approved request names one destination. A runtime names another. A report says the task completed, but a later observation is missing or out of date. Which part can your reader establish?

Try the supplied controls. They keep intent commitment, signer verification under a selected key, exact request comparison, reported completion and a supplied observation as separate results. A matching reported target does not establish that execution reached it.

The source map credits the PriorSeal, AEOESS, Frequency and scanner submissions that motivated these controls. Probity wrote this reader and its fixtures. Original contributions, new reader authorship, who operated a run and what a host adopted retain separate credit.

Bring a retained request/report/observation pair, write another reader, or keep a negative case in your project’s CI. Join the Lab case. An outside installed-package run would add evidence beyond our own operation.

Run the finite controls and inspect their contract

The pack defines 27 deterministic signed cases with 15 conclusions. The installed coverage bridge adds six selected-text controls through Vectors and Verify. The input contract defines immutable bytes and a consumer-selected policy. The separate literal-decision control covers all twelve supplied-claim cells and sixteen invalid-Boolean refusals. It compares a current value with the requested effect. The state required after a refusal is a separate question.

From the Atlas checkout:

cd examples/authority-effect
bash scripts/run-gate.sh

The gate rebuilds the fixture bytes, checks typing and tests, builds and installs wheel and source artifacts, compares actual API and isolated CLI results, retains child stdout, stderr and exit codes, and audits the complete installed third-party inventory. A failed comparison remains a failed gate. The installed payload must also match the selected wheel’s file population and source bytes; the qualification contract keeps installer records and generated bytecode explicit. Qualification checks source, metadata and installed command bytes before target imports. Each controlled consumer starts with a new private empty cache prefix. Bare library imports keep the caller’s interpreter and cache boundary.

The records use public test keys and supplied times, reports and observations. They do not establish live dispatch, independent observation, trusted time or commercial use. The scanner companion runs reduced decision logic, and its printed truncation remains separate from its exit.

Claims P-88 through P-92 bind the definitions and source boundaries.