# Verification Matrix: Claims vs. Automated Evidence

This document provides a comprehensive, rigorous traceability matrix between every architectural claim made by **`dsh-continuum`** and its automated verification test.

---

## 1. System Invariants & Verification Traceability Matrix

| Architectural Invariant / Claim | Implementation Source | Automated Test Suite | Test Location | Result |
| :--- | :--- | :--- | :--- | :--- |
| **Strict Sequence Monotonicity**<br>Events are assigned strictly incrementing integer sequences ($seq_{n+1} = seq_n + 1$). Non-positive/non-integer sequences rejected. | [`src/core/events.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/core/events.ts)<br>[`src/domain/engine.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/engine.ts) | `Core Events and Monotonicity` | [`tests/unit/events.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/events.test.ts) | **PASSED** |
| **Sub-Millisecond Event Determinism**<br>Events occurring in the exact same millisecond are deterministically ordered by unique monotonically incrementing sequence numbers. | [`src/core/events.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/core/events.ts)<br>[`src/domain/state.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/state.ts) | `Core Events and Monotonicity` | [`tests/unit/events.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/events.test.ts) | **PASSED** |
| **Optimistic Concurrency Control (OCC)**<br>Entity mutations require `expectedVersion`. Concurrent writes with stale version throw typed `VersionConflictError`. | [`src/domain/engine.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/engine.ts) | `Optimistic Concurrency Control` | [`tests/unit/concurrency.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/concurrency.test.ts) | **PASSED** |
| **Strict Idempotency with Mismatch Detection**<br>Replaying identical mutation returns cached result (`isCachedResult: true`). Reusing key with different entity/action throws `IdempotencyMismatchError`. | [`src/domain/engine.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/engine.ts)<br>[`src/storage/filesystem.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/storage/filesystem.ts) | `Strict Idempotency with Mismatch Detection` | [`tests/unit/idempotency.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/idempotency.test.ts) | **PASSED** |
| **Task State Machine Invariants**<br>Tasks strictly follow permitted state transitions (`queued` $\to$ `ready` $\to$ `claimed` $\to$ `running` $\to$ `submitted` $\to$ `verification` $\to$ `completed`/`rejected`). Illegal jumps throw `InvalidStateTransitionError`. | [`src/domain/tasks.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/tasks.ts) | `Task State Machine Invariants` | [`tests/unit/state-machine.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/state-machine.test.ts) | **PASSED** |
| **Renewable Execution Leases**<br>Claiming a task issues a renewable time-bound lease. Expired leases without renewal are automatically swept and returned to `ready` state with attempt counter incremented. | [`src/domain/engine.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/engine.ts) | `Task Execution Leases` | [`tests/unit/leases.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/leases.test.ts) | **PASSED** |
| **Separation of Duty (4-Eyes Principle)**<br>When `verificationPolicy` is `independent` or `dual`, the implementer/claimer principal is forbidden from self-verifying. Violations throw `SeparationOfDutyError`. | [`src/domain/tasks.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/tasks.ts)<br>[`src/domain/engine.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/engine.ts) | `Separation of Duty Verification Enforcement` | [`tests/unit/separation-of-duty.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/separation-of-duty.test.ts) | **PASSED** |
| **Deterministic Context Budgeting**<br>Context Pack adheres to strict token limit ($N$ tokens) using deterministic 10-tier priority ranking. Active task, North Star, and unresolved conflicts receive top priority. | [`src/context/budget.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/context/budget.ts)<br>[`src/context/ranking.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/context/ranking.ts)<br>[`src/context/builder.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/context/builder.ts) | `Context Budgeting & Deterministic Ranking` | [`tests/unit/context-budget.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/context-budget.test.ts) | **PASSED** |
| **Untrusted Content Isolation**<br>Third-party outputs, findings, and evidence are encapsulated in strict boundaries (`<continuum:untrusted-finding>`). Breakout tags are neutralized. | [`src/context/security.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/context/security.ts) | `Untrusted Content Isolation & Data Delimiting` | [`tests/unit/security.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/security.test.ts) | **PASSED** |
| **Property-Based Invariants (fast-check)**<br>100 randomized executions verify: (1) Sequence numbers are monotonically increasing; (2) Event replay is completely deterministic; (3) Snapshot + tail fold is strictly equivalent to full fold. | [`src/domain/state.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/state.ts)<br>[`src/core/events.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/core/events.ts) | `Property-Based Invariant Verification (fast-check)` | [`tests/unit/property.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/unit/property.test.ts) | **PASSED** |
| **Crash Recovery & Partial Line Truncation**<br>Storage detects incomplete JSON fragment caused by power loss or SIGKILL at the tail of `events.jsonl`, truncates the partial fragment cleanly, and permits subsequent appends. | [`src/storage/filesystem.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/storage/filesystem.ts) | `Storage Integration & Crash Recovery` | [`tests/integration/storage.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/integration/storage.test.ts) | **PASSED** |
| **Cooperative File Locking with PID Liveness**<br>Acquires cooperative write lock. If existing lock is held by a dead process, tests `process.kill(pid, 0)`, detects process death (`ESRCH`), breaks stale lock safely, and acquires cleanly. | [`src/storage/locking.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/storage/locking.ts) | `Cooperative File Locking & Liveness Detection` | [`tests/integration/locking.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/integration/locking.test.ts) | **PASSED** |
| **Agent-Scoped Capability Enforcement & Zero Leakage**<br>Tool restrictions applied to Agent A via `ctx.tools.restrict` do NOT leak to concurrent Agent B. Accurately distinguishes policy expressed vs. technically enforced when shell tools (`bash`) exist. | [`src/capabilities/pack.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/capabilities/pack.ts)<br>[`src/capabilities/enforcer.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/capabilities/enforcer.ts) | `Agent-Scoped Capability Enforcement & Isolation` | [`tests/integration/capabilities.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/integration/capabilities.test.ts) | **PASSED** |
| **Cryptographic Backup & Verified Restore**<br>Exports complete project snapshot and event log into `.continuum-backup` bundle with SHA-256 digest. Rejects tampered files with `checksum mismatch` error. Faithful state restoration. | [`src/storage/migration.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/storage/migration.ts) | `Complete Backup & Verified Restore` | [`tests/integration/backup.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/integration/backup.test.ts) | **PASSED** |
| **Large Artifact Spilling (10KB Threshold)**<br>Evidence content exceeding 10,000 bytes is automatically spilled to disk artifacts (`artifacts/ART-EVD-*.bin`), replacing the event payload with a 1,000-character snippet and SHA-256 hash. | [`src/domain/engine.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/domain/engine.ts)<br>[`src/storage/filesystem.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/src/storage/filesystem.ts) | `End-to-End Multi-Agent Project Lifecycle & Continuity` | [`tests/e2e/continuity.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/e2e/continuity.test.ts) | **PASSED** |
| **Complete End-to-End Multi-Agent Lifecycle**<br>Simulates full collaboration across 4 agent roles (Orchestrator, Researcher, Implementer, Reviewer), red-team rejection, implementer remediation, approval, crash recovery, and context regeneration. | Entire subsystem stack | `End-to-End Multi-Agent Project Lifecycle & Continuity` | [`tests/e2e/continuity.test.ts`](file:///Users/kuba/Documents/Github/dsh-continuum/tests/e2e/continuity.test.ts) | **PASSED** |
| **Marketplace Distribution Package**<br>`npm pack` produces clean tarball containing compiled JS, types, license, and notice, without test or development bloat. Installs and imports cleanly in isolated consumer projects. | Build & packaging pipeline | `Package Smoke Test` | `npm pack` + clean isolated runner | **PASSED** |

---

## 2. Test Execution Summary

```text
> tsx --test 'tests/**/*.test.ts'

ℹ tests 31
ℹ suites 14
ℹ pass 31
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 786.538875
```

All 31 test cases pass deterministically on Node.js 24 (Darwin ARM64 / macOS) and are configured to execute in GitHub Actions across Ubuntu and macOS on Node 20, 22, and 24.