Prevents
- A builder certifying its own obligation
- Certificates over missing or failing verdicts
- Reuse of verdicts after closure evidence changes
Nechtan Verify separates the ability to build from the authority to declare success. It refuses self-verification, stale evidence and incomplete proof.
Whenever a completion verdict is recorded, Nechtan Verify requires a known builder and a distinct verifier. A completion certificate also requires current passing verdicts for contract, engineering quality and evidence integrity.
The default fixture makes the builder and verifier the same identity. Nechtan must refuse it.
Ready. Run the adversarial fixture.
Install the current Nechtan distribution, then invoke the public wrapper over the canonical closure engine.
python -m pip install "git+https://github.com/rsmithdev6/aegis.git@main"
nechtan verify demo --scenario self-verificationREFUSED builder (builder-agent) cannot record its own contract verdict claim=CLAIM-THREE-VERDICT-CLOSURE
nechtan verify record OBL-ROOT --category contract --verifier qa --status pass
nechtan verify issue --contract OC-1 --root OBL-ROOT@nechtan/sdk builds the canonical Nechtan CLI contract and accepts your host executor. Policy and certificate authority remain in the Python runtime.
import { Nechtan } from "@nechtan/sdk";
const command = Nechtan.verify.record({
obligationId: "OBL-ROOT", category: "contract",
verifier: "qa", status: "pass"
});
const result = await Nechtan.verify.execute(localExecutor, command);This public product is bounded by two verified claims in config/claims.json.
Sixteen adversarial fixtures cover missing coverage, stale proof, self-review, scope drift and unchanged retry.
A missing, failing, stale or builder-authored verdict blocks certification.
Identity strings are supplied by the host; Nechtan Verify enforces separation but does not by itself prove the real-world identity behind a string. The initial TypeScript surface is a local CLI binding. Hosted verification and managed identity are not part of this release.