# Claims and what backs them

Every public claim this project makes, mapped to the artifact that shows it. The rule is
that a claim without an artifact does not get made, and the second half of this file is the
list of things the tree cannot back and that no README, release note or page may say.

Paths are relative to this file's directory.

## What is claimed

| Claim | Backing artifact |
| --- | --- |
| Every green verdict is harness-computed, and the model cannot render one | `../src/evidence/claim.ts` with `../src/evidence/predicate.ts`, and the 49 cases in `../src/evidence/redteam-adversarial.test.ts`. Shown happening at scale in `evidence/2026-08-18/shakedown/results.md`: across ten real tasks the harness rendered 11 claims VERIFIED and refused 42, in four distinct ways, including one `predicate-kind-mismatch`. None aborted a run |
| A one-byte change to a ledger record is caught | `evidence/2026-08-18/tamper-demo/README.md`: the same bundle verified and tampered, exit 0 and exit 1, with `flip-one-byte.mjs` to reproduce it from the committed bundle |
| A bundle carries its own verifier and needs nothing from this repo, including on a machine that has never seen it | `evidence/2026-08-23/clean-container-verification.md`: the committed `live-frontier` bundle copied into a `node:24` container with no network and no mount of this repository, verified there (exit 0), and the same bundle one byte later refused there (exit 1), with the image digest and both transcripts. `evidence/2026-08-18/live-tasks.md` is the weaker earlier statement, from outside the repository on the machine that built it |
| The tool completes real tasks and exports evidence of it | `evidence/2026-08-18/live-frontier/` and `evidence/2026-08-18/live-local/`, two bundles from two models, 42 and 60 records, both verifying |
| Bundles are signed with a key from the OS keychain, and say so when they were not | both manifests in `evidence/2026-08-18/live-tasks.md` carry `"keySource": "keychain"` and both verifier transcripts there report `ed25519, keychain key`. Where the keychain holds no usable key the run signs with a per-run key, prints which of the three keychain failures happened, and the manifest records `keySource: ephemeral`: `evidence/2026-08-23/installed-package-run.md` and `evidence/2026-08-23/calibration-report.md` are both from a machine whose entry is not a key, and both say so. `../src/evidence/signing.ts` with `../src/evidence/signing.test.ts` |
| A run draws a live screen a person can drive, and a keystroke has no route to a verdict | `../src/tui/view-state.ts` and `../src/tui/session-view.ts` are separate types with separate reducers, and `../src/tui/view-state.test.ts` asserts across every view action that no field of the first shares a name with a field of the second and that no value it can produce reads as a verdict. `evidence/2026-08-23/interface.md` for the screen, the keymap and the config surface, with the captured frames in `evidence/2026-08-23/interface-frames.txt` and a playable recording in `evidence/2026-08-23/interface.cast` |
| The plain-line stream a pipe and CI read is unchanged by the interactive work | `../src/tui/fixtures/plain-lines.txt`, captured before any of it was written, and `../src/tui/plain-lines.test.ts`, which asserts the rendering of a fixed event sequence is byte-identical to it |
| A confirmation answered on the screen reaches the chokepoint intact | `../src/tui/confirmation-path.test.ts` drives a keystroke through the dispatcher and the queue into `createToolChokepoint`, in both directions, and asserts the tool ran or did not |
| The evidence panel opens a harness-computed path, by argv, and says verified only where the verifier ran | `../src/tui/open-path.ts` and `../src/tui/evidence-panel.ts`, with `../src/tui/evidence-panel.test.ts`: a path tagged anything but `harness` raises, a hostile path travels as one argument with no shell, the opener environment carries no name that decides what a process loads, and the panel reads "not verified in this run" with the command unless the embedded verifier exited 0 here |
| Adversarial passes, with the closures locked as regression tests | `../redteam/pass2` through `../redteam/pass7`, `../src/evidence/redteam-adversarial.test.ts`, and the accounting in `../redteam/loop/state/lap-accounting.jsonl` |
| Eight untrusted boundaries are fuzzed, and the harnesses are not blind | `../fuzz/README.md` for the eight, `security-coverage.md` for the instrumented-versus-blind coverage numbers, and `evidence/2026-08-18/fuzz-findings-replay.md` for the preserved crash artifacts and their disposition |
| Local model selection is measured on the machine it runs on | `evidence/2026-08-18/hardware-select.md` for the probe, and `evidence/2026-09-02/calibration-report.md` with the four bundles under `evidence/2026-09-02/calibration/` for 300 runs of four models on two backends, every repeat executed, read as distributions and compared with the August sweep distribution against distribution. `evidence/2026-08-23/calibration-report.md` with `evidence/2026-08-23/calibration/` is the 180-run August measurement it supersedes, and `evidence/2026-08-18/calibration-report.md` the one before that: both are left in place under a dated header saying they predate the empty-turn fix and that their numbers are not to be cited, and the 09-02 comparison re-reads the 08-23 records rather than those figures |
| Known limitations are documented rather than hidden | `build-guide.md` section 7.1 for the six residuals, the null results in `security-coverage.md`, and the NOT-RUN entries in `evidence/2026-08-18/run-report.md` |
| Behaviour over ten consecutive real tasks | `evidence/2026-08-18/shakedown/pass-criteria.md`, written and committed before anything ran, and `evidence/2026-08-18/shakedown/results.md`: eleven bundles, all verifying, none of the six stated failure conditions met |
| The packaged tool installs from its tarball and runs a task end to end, with nothing of this repository beside it | `evidence/2026-08-23/installed-package-run.md`: the 13.1.0 tarball installed into an empty directory, two tasks against a workspace it had never seen, recorded in `evidence/2026-08-23/live-task.cast` and `evidence/2026-08-23/open-evidence.cast`. One goes green and one escalates at the file-set gate citing its ledger record; both bundles verify from outside both directories, and the panel reports `open exited 0` rather than reporting that it opened something |
| The package on the registry is the artifact this repository built, and carries a signed statement saying so | `evidence/2026-08-24/registry-publish.md`: `npm install -g swarm-orchestrator` serves 13.1.3, published by CI run `32751820534` from tag `v13.1.3`. The shasum the registry serves is the one that run's `npm pack --dry-run` printed before the publish step, and `npm audit signatures` reports the SLSA provenance attestation verified from a clean install. It ties the tarball to this repository, this commit and that run, and it says nothing about whether the code is correct |
| The project page cannot state a claim this table does not make | `../scripts/build-site.mjs` generates the page from this file: the claims come from the rows above, the struck-through list comes from the section below, and the version comes from `../package.json`. `../scripts/build-site.test.mjs` asserts every row reaches the page, that every forbidden phrase reaches it too, that a path the repository does not track is left as text rather than linked to a 404, and that the only verdict the page renders is the refusal it quotes |
| An exploratory paired comparison against an ordinary coding agent was run under a registered protocol and reported with every count's denominator | `evidence/2026-10-11/comparison/README.md`: twenty mined tasks from five public repositories, Swarm against OpenCode 1.14.48 on the same local model, scored by the upstream commit's own tests sealed from both arms; 5 of 20 against 4 of 20 correct in the pass that stands, one task apart, with the four discarded passes and their defects reported beside it. It supports no claim of an advantage in task success |
| A session runs several tasks against one workspace, and each turn is measured on its own | `evidence/2026-08-24/session.md`: three tasks typed one after another in one process and one ledger, each turn changing two files and each turn's gates measuring exactly those two, with test counts rising 2, 4, 5 and never falling. The bundle in `evidence/2026-08-24/session/` verifies from outside the workspace, 119 records, 3 claims verified and 2 refused. A turn ends by recording where it left the tree, `../src/gates/turn-baseline.ts`, and changes are measured through a scratch index rather than the person's, `../src/gates/scratch-index.ts`, without which the second turn reports its own edits as deletions |
| A general feature task carries sealed requirements through acceptance, bounded repair and final verification, and a green suite does not stand in for them | `../src/cli-feature-task.integration.test.ts`: the composition path with a contract that names no preset, including the implementation that meets one of two requirements and is refused with the unmet one named while the project's own tests pass |
| A worker that repeats a tool call it has already been answered is told once and stopped the second time, the recorded September stall is caught at step 12 of 72, a call repeated after an edit that landed, through the edit tool or a shell command, is answered rather than told it already was, a shell check repeated after an edit is answered with its fresh result although the shell is counted as a possible writer, and a repeated writing call is told only that no other writing call landed between | `../src/core/tool-stall.ts` with `../src/core/tool-stall.test.ts`, `../src/core/loop.test.ts` and `../src/agent-run.test.ts` ("a call repeated after an edit", "a call repeated after a shell command that edited a file", "a shell check repeated after an edit"); `evidence/2026-10-20/repeat-key/README.md` for the shell check after an edit reproduced on `33fbf1693` and answered on the fix; `evidence/2026-10-20/repair-trace/README.md` for the recorded repeat after an edit the notice misread, and `evidence/2026-10-20/repair-handoff/regressions-before.txt` for the shell-edit and repeated-write cases reproduced before their correction; `evidence/2026-10-11/tool-stall/replay.md` for the replay of session `20260930T035141-b70d6c`; `evidence/2026-10-11/tool-stall/live-run.md` for one live run of the same goal on the current source, accepted in 12 min 25 s with no intervention by a person |
| A refused final verification is a recorded non-success the bundle's own verifier re-derives, not a crash | `../src/cli-feature-task.integration.test.ts` ("records a refused final verification"), which exports the bundle and runs `verify.mjs` on it; `../src/evidence/verifier/verify.mjs` carries the re-derivation |
| The review page says what the run was asked to do, what it decided, and what it changed | `../src/evidence/review-page.ts` with `../src/evidence/review-page.test.ts`: the header carries the tasks, the model, whether the loop completed, the duration and the cost; the gate table is rendered into the bundle rather than printed only to a terminal; and the patch the task produced is recorded as a ledger record and shown. A screenshot of a real one is `evidence/2026-08-24/review-page.png` |
| Workers coordinate by reading each other's ledgers, and nothing they read can render a verdict | `../src/workers/trail.ts` with `../src/workers/trail.test.ts`: every signal is derived from a ledger record rather than from model text, no signal kind reports a success, a peer's raw runner output never travels, and a worker is handed neither its own chain nor the other attempts at its own task. `../src/workers/trail-tool.ts` puts the read through the existing chokepoint, so what comes back is tagged tool output. `../src/workers/boundary.test.ts` proves the loop, the tools, the gates and the run assembly import none of it, and proves its own detector catches a crossing |
| A choice between competing attempts is made from measured numbers, and the working is on the chain | `evidence/2026-08-24/swarm.md` for a run of one task tried three ways: three green attempts, coverage measured rather than abstained on, the third ranked last on a dimension that saw it wrote one test fewer, and the top two tied so the earliest won, which the report says in those words. The record is `swarm/redundancy/`, 27 coordinator records, and it verifies from where it sits. `../src/workers/attempt-selector.ts` with `../src/workers/attempt-universe.ts` for the comparator and the universe fixed across attempts before anything is counted |
| Opening a large test file gains an attempt nothing | `../src/workers/attempt-universe.test.ts` and `../src/workers/attempt-selector.test.ts`: an attempt that touches a fifty-test file without adding to it loses to one that wrote two real tests, because every attempt is counted over the same file universe and an untouched file counts at its base content |
| The tool breaks a goal into tasks itself, declares the graph before it runs anything, and says what it cannot check | `evidence/2026-08-24/swarm.md` for a `--goal` run: the planner declared three nodes on a chain of its own, the `task-graph` record precedes every `worker-started`, two nodes landed and one did not, and the outcome claim `nodes == 3 && landed == 3` renders UNVERIFIED with both literals taken from the declaration. The record is `swarm/decomposition/`, 37 coordinator records, and it verifies. That same run is the honest limit: every structural check passed on a decomposition that could not work, because the planner left out a dependency, and no check here reads meaning |
| The audit chain is proven on a schedule, from a clean clone, in both directions | `../.github/workflows/nightly-proof.yml` runs the suite, the fuzz smoke, and `../scripts/prove-bundle.mjs` over the committed `evidence/2026-08-18/live-frontier` bundle: verified as committed, then refused one byte later with the broken link named, and the prover itself fails if the tampered copy verifies, which `../scripts/prove-bundle.test.mjs` shows by handing it a verifier that says yes to everything. First observed passing as run `33675596249` on 2026-09-02, transcript uploaded as its artifact |
| One real task runs through the whole pipeline on a hosted runner every week, and the bundle is judged, never the task | `../.github/workflows/weekly-evidence.yml` installs a pinned Ollama, serves a small model, seeds the workspace `../scripts/seed-proof-workspace.mjs` writes, runs one task through the built CLI, and verifies the fresh bundle in the same job. First observed passing as run `33675598963` on 2026-09-02: the model failed the task, the tests gate escalated, and the 47-record bundle verified, which is the thesis and is why the task outcome is recorded rather than judged. `evidence/2026-09-02/run-report.md` |
| The criteria are sealed before the loop, every pass is bonded, and a bundle re-derives its own verdicts | `../src/gates/gate-set-seal.ts`, `../src/gates/bonds.ts` and `../src/gates/bond-runner.ts` with their tests, and `../src/evidence/verifier/rederive.mjs` held to the parsers by `../src/evidence/rederive.test.ts`. Shown on a real run in `evidence/2026-09-02/gates-bonded/`: nine gates sealed at record 1, the tests, placeholder, secret-scan and diff-budget bonds held, the behaviour probe recorded as not bonded rather than as held, `verify.mjs` exit 0 with the seal and the bonds recomputed, and `rederive.mjs` agreeing on all seventeen verdicts with none it could not re-derive. `../src/gates/bond-runner.test.ts` shows the other direction: a runner that passes over a bond it collected is recorded vacuous, and `../src/evidence/rederive.test.ts` hands the re-deriver a bundle that lies about a status and asserts it disagrees |
| The tool was measured on fifty repositories in five languages, each seeded with one defect its own suite catches, under criteria sealed before any repository was looked at, and every bundle of the corpus verifies | `../campaign/criteria.md` and `../campaign/methodology.md`, both committed before what they govern; `../campaign/seeds/manifest.json`, committed before any arm ran; `../campaign/results/report.md`, generated from the result records alone: 43 of 43 executed bundles verify on `local-mlx` and 50 of 50 on `local-ollama`, with the frontier arm carried at zero runs. The bundles are under `../campaign/corpus/` with their own verifiers |
| `swarm ci` refuses to certify on an oracle that never ran the change, and says which lines | `../src/gates/oracle-reach.ts` with `../src/gates/oracle-reach.test.ts` for the rule, `../src/gates/v8-coverage.ts` with `../src/gates/v8-coverage.test.ts` for the reader, which is checked line by line against node's own lcov report of the same run, and `../src/gates/independent-verification.test.ts` for both directions end to end: an oracle that takes a branch reads `reached` and one that does not reads `unreached` with the line named. Measured on the mined corpus: koa#1946 is refused for lines 270 to 273 of the file it certified, and dayjs#3181 for the `d.tz` branch its held-back case breaks on |
| `swarm ci` asks whether the oracle asserted anything about the lines the patch added, and says what showed the mutant changed the program | `../src/gates/oracle-mutants.ts` with `../src/gates/oracle-mutants.test.ts` for the eight operators, read off the language's statement productions and derived in `oracle-bond-operators.md` before any of them was implemented; `../src/gates/mutant-parse.ts` with `../src/gates/mutant-parse.test.ts`, which runs each dialect rather than asserting which ones `node --check` reads; `../src/gates/mutant-witness.ts` and `../src/gates/oracle-bond-run.ts` with their tests for the two detectors and the order they are spent in; and `../src/gates/independent-verification.test.ts` for all of it end to end, including a patch whose accepted mutant coverage shows changed what ran, and one whose accepted mutant neither detector can witness. Measured over the corpus: all eight operators fire, the three general ones account for 25 of the 34 mutants built, and `node scripts/bond-cost.mjs` prints what requiring a witness costs against recording it |
| A pass reported by an instrument the change edited is not counted as a pass, except where the only edits are a project's own runner source its tests load and the runner-source reading (runner-source-v1) shows the changed runner executing and failing the added tests the base's runner does | `../src/gates/runner-witness.ts` with `../src/cli-ci-self-hosted-runner.integration.test.ts` (a legitimate change stands; a runner that swallows failures or skips a file, and a changed test script, do not) and [evidence/2026-10-22/verification.md](evidence/2026-10-22/verification.md); its named residual is a runner change that tells the added tests apart from its own. Otherwise: `../src/gates/instrument-identity.ts` with `../src/gates/instrument-identity.test.ts` and `../src/gates/instrument-identity.integration.test.ts`: with the real Vitest, a `vitest.config.mjs` that forges its report, a configuration importing a changed helper, a setup file under an unlisted name, a test script replaced by an echo and a runner taken from a path all read incomplete from `check`, and `ci` reruns the check with the base's instrument. The reproduction reported against the published 1.0.7 is in the installed-package matrix, `../scripts/verifier-matrix-smoke.mjs` |
| Two failing tests with the same title are two failures | `../src/gates/failure-attribution.ts` and `../src/evidence/verifier/status.mjs` (failure-identity-v2), with `../src/gates/duplicate-titles.integration.test.ts`: the real node runner, two files each declaring `works`, the first already failing; breaking the second reads as a new failure, a comment-only patch as inherited, live, in the Action's decision and in the offline re-derivation |
| A patch cannot pass `ci` by editing the test that would catch it | `../src/gates/attack-families.integration.test.ts`: a broken change behind a skipped, deleted or rewritten test reads unmeasured with the test named, and a correct change that also edits, renames and adds tests still passes |
| The declared-file-set check blocks an out-of-set edit until an amendment is recorded | `evidence/2026-08-18/shakedown/bundles/task-08-file-set-amended`, where the gate blocked three times and the run went green only after an amendment with a reason reached the ledger |

## What may not be said

Verbatim, because each of these has been tempting at some point in this project's history.

- **"Nothing is written into the repository."** `check` creates no `swarm.toml` and keeps its
  evidence outside the repository, but it briefly adds and removes its own falsification-bond
  fixtures, and the project's own commands write whatever they write. Say that.
- **That the basic command runs in a container when one is available.** Locally it runs on the
  host under a built environment, a policy and not a sandbox; containers are the Action's default
  and `--isolation` asks for one. The 1.0.0 release note said otherwise and carries a correction.
- **That `regression: pass` means every check passed.** A failure the base had, in the same tests
  the same way, is shown as inherited and not counted. Say "no check failed because of the change".
- **That a requirement contract, a challenge or a signature proves the work correct.** A contract
  defines scope, its checks are evidence, a challenge asks whether a check could fail, and a
  signature says who produced a bundle.
- **That swarm-verify catches more wrong work than another tool, or is the only tool that does
  something.** No completed comparison supports either; the advantage is an open hypothesis
  tracked in `verifier-first/README.md`.
- **That fork testing establishes unrestricted safety.** Real fork and Dependabot controls ran
  on published 1.1.0 and 1.2.0, including hostile code and stale-head refusal; see SV-16 in
  `verifier-first/README.md`. Those observations apply to their tested container and workflow
  boundaries, not every runner or hostile program.

- **"Seven red-team laps."** The loop ledger records one completed lap. Six of the seven
  pass directories were human-driven work outside the driver, which
  `../redteam/loop/state/lap-accounting.jsonl` sets out. Say "adversarial passes with
  closures locked as regression tests".
- **Any regulatory or standards date.** No EU AI Act article, no prEN 18229-1, no
  ISO/IEC 24970, no compliance deadline, in the README, on any page, or in any release note.
  The build guide's own instruction is to re-verify all three before they appear anywhere,
  and they have not been re-verified.
- **"Fully secure", or any unbounded security claim.** The honest naming is known-pattern
  scrubbing, not secret removal, and there is a four-character floor under it. Zero crashes
  at a given fuzz budget is evidence, not proof.
- **That a well-formed decomposition proves the user’s goal complete.** The legacy graph run
  in `evidence/2026-08-24/swarm.md` passed structural checks on an unusable decomposition. The
  adaptive controller now checks declared executable obligations on the exact integrated tree,
  with bounded revisions and independent acceptance (`redesign-implementation-2026-09-13.md`).
  That establishes the tested contract, not that the contract captures all user intent.
- **That redundancy picks the best solution.** The legacy comparator selects discipline;
  goal selection first requires applicable executable obligations and integrated checks, then
  ranks under the sealed objective. Neither establishes semantic completeness beyond those
  checks, and missing human judgments remain unjudged.
- **That the oracle-reach check proves an oracle judged the change.** It proves the oracle
  *executed* the lines, which is a necessary condition and not a sufficient one, and for every
  runner but node's own it reads a coverage report the workspace's own processes wrote. Nothing
  detects a forged one. That is safe only because the check can do nothing but refuse: a forged
  report buys `reached`, which is what an unmeasured oracle already gets. Say "refuses to certify
  on an oracle shown to have skipped part of the change".
- **That the oracle bond proves the oracle judged the task.** It asks whether the oracle asserted
  anything about the lines the patch *added*, and it cannot ask what the patch left out. Measured
  rather than reasoned about: shown the oracle it would be judged by, a model writes a patch whose
  added lines that oracle tests, so the oracle refuses every mutant of them and the bond reads
  `held` on a patch a held-back oracle rejects. Say "asks whether running the oracle established
  anything about the change it did make".
- **That a `vacuous` verdict means the mutant changed behaviour, or that an `unshown` one means it
  did not.** Two detectors are asked, the oracle's own coverage and the repository's own suite, and
  what each cannot see is written down: coverage misses a value changed on a path that runs either
  way, and a suite written before the patch existed misses anything the patch is adding. A mutant
  both miss is recorded as unwitnessed, which is an absence of evidence and not evidence of
  absence.
- **Any number the tool did not measure locally.** No benchmark, no throughput figure carried
  over from a model card, and no comparison against another agent beyond the one exploratory
  trial in `evidence/2026-10-11/comparison/`, which may be cited only with its denominators and
  only for what its README says it supports. The shortlist's size
  and memory figures are curated estimates and the select report says so itself.
- **Any suggestion the four judge-shaped residuals are closed.** They are open, they ship as
  documented limitations, and each is a permanent case in the adversarial suite asserting
  the gap as it stands.
- **That the campaign ranks the models, or measures the tool as it ships.** Its outcome is a
  judge over the tree, not a measure of a change's quality; the two arms ran under different
  backends with different failure shapes; and the corpus measures the CLI packed on
  2026-09-02, before two defects it exposed were fixed. The non-node numbers are a floor for
  the fixed tool, not a measure of it, and the frontier arm has no measurement at all.