Layer 03 · After it finishes · touchstone

Is the result
actually true?

A sealed record proves what the agent did. It says nothing about whether the work was any good. “The tests pass”, “the guard strips uncited figures”, “no route is unauthenticated” — those are claims, and a model asserting them is not evidence.

Touchstone takes a claim and tries to break it. A model proposes checks as data; a deterministic runner executes them and captures the output to disk, hashed; a refute-framed judge reads that evidence; and a plain non-LLM function computes the verdict. The model plans and interprets. It never certifies, and it never touches the shell.

An assayer’s black basalt touchstone streaked with gold beside a brass needle.

In detail

How it
works.

PipelineCLAIM → PLAN → EXECUTE → JUDGE → GATE → DOSSIER
VerdictsSUPPORTED (exit 0) · REFUTED (1) · UNVERIFIABLE (2)
Fail closedNo evidence means UNVERIFIABLE. A planned check that could not run caps the verdict — partial verification is not verification, and a blocked check is disclosed, never silent
Verbatim anchorsEvery supports/refutes bearing must quote an exact substring of the captured output; the gate strips any whose anchor is not verbatim, so fabricated quotes cannot move the verdict
Outputtouchstone/dossier@0 — the plan, the evidence, the hashes, and the reasoning, on disk
Refute-framed, on purpose.

The judge is instructed to break the claim, and the planner is asked to include counterexample hunts. One surviving refutation beats any amount of supporting evidence. Verification that sets out to confirm finds confirmation; this one sets out to fail. Its sibling shipsafe applies the same idea to a shipped app — secrets in git history, unprotected routes, publicly readable tables — and writes the findings in plain English.

Straight answers

What this
does not prove.

Stated here, at full size, rather than in a footnote. Every tool in the stack carries its own ceiling, and they are not the same ceiling.

Machine-verified at time T not an attestation

SUPPORTED means “verified against captured evidence at time T, auditable from the dossier.” A human attestation layer, where one is needed, sits outside this tool.

As good as the checks not omniscient

A verdict covers what the plan thought to check. Claims that no check can reach come back UNVERIFIABLE rather than being guessed at — which is the honest answer, not a failure.

Run it

Free,
and local.

deterministic, zero secretsnpm run verify -- verify 'package.json declares "touchstone" as its name' --mock
shell checks are gated behind an explicit flagnpm run verify -- verify "npm test exits 0" --cwd ../some-repo --allow-exec
anchored claims verify with zero model callsnpm run verify -- verify-batch receipts.json --cwd ../some-repo

Everything above runs on your machine with no account and no network call. Checking an artifact is free permanently — see what we actually charge for.

Previous in the stackWhat did it actually do? Next in the stackWill an auditor accept it?

The agent will act either way.

The only question is whether anything survives it that a stranger can check.

Check a record See all four