Rule
Before a change counts as done, a fresh context has to judge it. The author supplies the candidate and factual check receipts. Validate recomputes the exact subject, checks the fixed intent and changed scope, judges every criterion, and writes PASS, FAIL, or NOT_PROVEN.
Three properties make the gate real. Identity binds the verdict to the exact intent and content. Freshness separates authorship from judgment. Evidence makes every criterion inspectable. Deterministic tests and builds establish facts; the fresh validator decides whether those facts satisfy the intent. Missing identity, freshness, scope coverage, or evidence produces NOT_PROVEN, not a confident guess.
Put It to Work
- Keep claim and verdict separate: the author supplies evidence, a fresh context decides.
- Bind validation to the exact intent digest and subject manifest.
- Use deterministic checks for facts and criterion-level evidence for meaning.
- Persist the content-addressed verdict with checked and unchecked scope.
- Report the result and stop. The caller owns any later revision or retry.
Failure Signal
- The closeout says "looks good" but names no command.
- The same context that wrote the patch checks only the happy path it expected.
- A gate got relaxed because "the new model doesn't need it."
- The validation step cannot fail.
Done Looks Like
The candidate has a fresh verdict.v2 bound to unchanged intent and exact content, with evidence for every criterion and an explicit list of what was not checked.