Evidence honesty
What the ecosystem can currently prove, as opposed to what it claims. Measured 2026-07-30, live, by nx_sota_status honesty.
Before this week the same board read 10 of 40 proven. Nothing regressed — the ruler was wrong. The old counter accepted a single green gate as proof; it could not tell a gate that would fail if the code broke from one that passes no matter what. Correcting it moved the number down, which is the direction an honest correction usually moves a number you like.
What "proven" now requires
A domain is PROVEN only if every one of these holds. Any single failure downgrades it, and the failing clause is named:
- Quorum — every declared gate ran green, not merely one of them.
- Provenance — the gate binaries that ran are the ones that were declared, by content hash.
- Triangulation — at least two independent method classes agree: mechanical, model, human.
- Human — a person signed for it. Cryptographically, not by a checkbox.
- Non-vacuity — the gate has been proven able to fail: we damaged the subject on purpose and confirmed the gate went red.
- Freshness — the evidence is inside its time-to-live, or it goes stale on its own.
Clause 5 is the one that matters most and is almost always missing elsewhere. A test suite that passes is not evidence; a test suite that would have caught the break is. 14 of 15 subject-carrying gates have now been mutated and confirmed capable of failing.
What needs your eyes
The human leg is unsigned, and that alone is why the number is 0 rather than 2.
Two domains satisfy every mechanical clause today. They are held at UNPROVEN because no attestation key is registered, and the verifier is fail-closed by design: with no key, no signature can be accepted, so nothing can be quietly self-attested by an automated process. That is the correct default, and it is also a door only you can open.
Three things are yours to decide:
- Generate the attestation key and place the public half out-of-band. The private half must never transit a tool call — if it does, the signature it makes proves nothing about you.
- Decide which domains you will personally vouch for. A signature here is a claim that you looked, not that the machinery is green. The machinery being green is clauses 1–3 and 5–6; you are clause 4.
- Approve or reject the 16 proposed wirings below.
Nothing has been signed on your behalf and nothing will be. There is no path in this system by which an automated actor produces a class=human row.
A finding I got wrong, and the correction
Earlier this session I reported that ~214 gate binaries exist against only 19 declared, and concluded that most domains read CLAIM-ONLY "not because nobody built the evidence — because nobody wired it." That framing implied a mechanical pass would lift the score an order of magnitude.
I then built the tool to do that wiring, and it refuted me. Asking, for each gate, which domain matrix actually names its subject:
So roughly 86% of built gates cannot be tied to any declared claim at all. The gates are real and the claims are real, but they are largely about different things. Wiring is not a mechanical pass — it requires deciding what each gate proves, which is judgement, not a join.
The lesson is worth more than the tool: a ratio of artifacts to declarations is not evidence that they are about each other. I inferred a wiring gap from two counts without ever testing whether the join key existed.
The 16 proposed wirings
Each row below is a gate binary whose subject organ is named by that domain's matrix — a structural fact about files on disk, not a similarity score. Ambiguous and unmatched gates are deliberately excluded rather than assigned to a best guess.
| Gate | Proposed domain |
|---|---|
| nx_asset_provenance | librarian |
| nx_librarian_audit | librarian |
| nx_librarian_review | librarian |
| nx_orchestrate | librarian |
| nx_healthhelp_site | medbilling |
| nx_medbill_civic | medbilling |
| nx_medbill_nsa | medbilling |
| nx_survey_engine | surveys |
| nx_survey_evidence | surveys |
| nx_survey_quality | surveys |
| nx_survey_sentiment | surveys |
| nx_survey_serve | surveys |
| nx_raci | warden |
| nx_rebac | authz |
| nx_specdec | llm |
| nx_syscall_xlate | toolchain-syscall-abi |
Held back for your call: nx_medbill_codes and nx_medbill_recon are each named by two matrices (medbilling and affordability). Picking one silently is how a wiring pass launders a judgement into a fact, so they are reported and left alone.
Two defects the mapper found in itself
Recorded because the failure modes generalise, and because a tool that only reports other people's bugs is not trustworthy:
- Substring matching mapped
nx_crto automation — becausenx_crsits insidenx_crawlandnx_craft. Not a weak match, a wrong one: it would have credited a working gate to a domain it has nothing to do with. Fixed with word-boundary matching. - That fix then dropped a true match —
nx_syscall_xlate→ toolchain-syscall-abi, because that matrix names the gate file, so_gatefollows the stem and the boundary rule rejected it. Repaired by asking a second question rather than by loosening the rule, since relaxing the boundary would have restored the true match and the false one together.
How this reaches the deploy path
None of the above is a report that someone has to remember to read. The honesty check is check #12 in the deploy gate and it blocks; the cadence check is #13 and warns. The whole evaluation re-runs every six hours on its own schedule, so evidence decays into STALE without anyone deciding to demote it.
A board that only turns green is a board nobody has to trust. This one is currently red, on purpose, about our own work.
Generated from live measurement — evidence_honesty.log, nx_gatemap_gate. Counts are as measured on 2026-07-30 and will move as gates are wired and evidence ages. Nothing on this page is a projection.