Coverage
Two instruments here check things. The Tier 1 harness probes a running system through an adapter. The record conformance checker reads a stream of emitted records afterwards. They were built separately and they overlap, so this page states the claims rather than the tools: 19 governance properties, 26 probes between them, and 5 properties with no probe at all.
Whether a property is checked from one side or both is not a detail of implementation. A live probe is available to the operator; a record probe is available to whoever holds the records. A property only checkable from inside is a property the outside world has to take on trust.
A live probe and a record probe both bear on the claim. These are the properties where an operator's own result and an outsider's reading of the records can disagree — which is the only configuration where either is worth much.
Every grant names a condition or deadline that ends it, and reaching that point moves the grant to review rather than letting it continue.
A raised discrepancy produces a reconsideration record, and it does so within the clock the system declared for it.
Checkable by whoever can run code against the system. A counterparty holding only records cannot verify these, so a vendor's own result is the only evidence there is.
A system that can discover and physically perform an action refuses it without a grant naming that action class.
Unprobed: A record probe would need refusals in the stream. STD-07 records what was authorized, not what was reached and declined, so a log that never mentions an ungranted attempt is indistinguishable from one where none occurred.
When a grant moves to suspended, revoked or under review, the next action under it is refused, within the transition budget.
Unprobed: A record probe would need the grant's state at the moment of each action, not just at issue. The authority grant object carries state; the record stream references the grant by id and does not snapshot it.
The audit trail contains an entry for every action the system performed, with its timing, reasoning and outcome.
Unprobed: Completeness is the one property a record stream cannot check about itself. Nothing inside a log reveals the action that was never written to it; only comparison against an independently known set of actions can.
A stop request is acknowledged and the work actually ceases within the stop budget.
Unprobed: A record probe would need the stop request and the cessation as separate timestamped records. STD-07 has no stop record kind; an intervention record exists but does not distinguish acknowledgement from cessation.
A human decision that contradicts the system's changes what the system does, rather than being logged alongside it.
Unprobed: An emitted probe would need the system's intended action recorded before the override, so the two can be compared. Records name the action taken; they rarely name the action that was about to be taken.
When a decision is reversed, the parties it affected are notified, told what was reversed and told why.
Unprobed: A record probe would need the notification itself to be a record. Reversal appears in STD-07 as a correction; who was told is outside the stream.
Each stage the person waits through was estimated in advance, and the estimate is within tolerance of what it cost.
Unprobed: An emitted probe would need estimates in the record, not just outcomes. Nothing in STD-07 asks a system to write down what it predicted, which also makes the prediction unfalsifiable after the fact.
Time the system imposes on a person does not grow with the number of interactions they have already had.
Unprobed: An emitted probe would need per-person interaction history, which is exactly the data a conformance checker should not require. This one may be correctly live-only.
Checkable by anyone holding a record stream, including people the operator did not choose. These are the claims that survive the operator losing interest.
Every belief, authorization and action names what it depends on, names what would defeat it, and those references resolve.
Unprobed: A live probe would have to invalidate a premise and watch whether the authorization resting on it changes state. That needs an adapter capability no current check uses: the ability to retract evidence the system has already accepted.
Every record carries a hash over its own content, and recomputing it reproduces what the record claims.
Unprobed: A live probe would have to alter a stored record through some path other than the emitter and check the system notices. That is a tampering test, and running it against a production system is a different kind of engagement from the rest of the harness.
Records link to their predecessors, every record is reachable through that chain, and no link points at something absent.
Unprobed: The live equivalent is the completeness probe above: continuity within an export says nothing about an export that began late or ended early.
What a system declares about its own records — the level it claims, the kinds it says it emits — matches what the records show.
Unprobed: The live equivalent would ask a running system for its own declaration and compare it against observed behaviour. No adapter capability exposes a manifest.
Named, argued for, and not yet falsifiable here. Listing them next to the rest is the point: a framework that only publishes its checkable claims looks stronger than it is.
Whoever bears the consequence of a decision holds a standing to contest it that does not depend on the operator's goodwill.
Unprobed: Neither instrument checks this. The record checker can see that records name a standing to object, and does — but naming a party is not granting them a route, and the checker has no way to tell whether the route exists or whether anyone outside the operator has ever used it. A live probe would have to attempt a challenge as an outside party, which means an adapter that is not the operator's. That is the hardest and most load-bearing gap in this catalogue.
Each grant carries a dated assessment of whether detection, challenge, standing, review, authority to modify, reversible transitions and post-correction operability actually exist.
Unprobed: The authority grant schema requires `correction_capacity` with all seven components and an `assessed_at`. Nothing validates the assessment against reality: a grant asserting all seven and a grant that has them are the same document. Individual components are probed elsewhere in this catalogue — stopping, override, reversal notice, challenge — so the missing piece is binding those results back to the grant that claimed them.
Capacities the delegation displaced are still exercised often enough to remain available, and their decay is recorded rather than discovered.
Unprobed: The dependency record carries `last_exercised`, a retained/degrading/lost status and whether the capacity was replenished or consumed since the last assessment. Nothing reads those. A checker over dependency records would be the cheapest real probe missing from this repo: the fields already exist and the arithmetic is trivial.
As automated volume grows, the capacity to review, challenge and correct grows with it rather than staying fixed.
Unprobed: This is a ratio between two quantities neither instrument observes: decisions made and corrections the organisation can actually process. It is measurable — both numbers exist inside any operator — but not from a record stream or an adapter, which is a reason to be honest about it rather than to drop it.
The consequential decision, not the model call, is the unit that gets evaluated.
Unprobed: Not a property of a system under test but of the testing programme around it, so it will never have a probe here. It is catalogued because leaving it out would let the framework's most-cited claim escape the accounting that every other claim is held to.
A check that nobody can map back to a claim is a number. A claim nobody can map to a check is an assertion. The catalogue behind this page is enforced by a test: every harness check id and every conformance finding id must belong to exactly one property here, or the build fails. Adding an instrument without saying what it establishes is not possible; dropping a property because nothing checks it would be visible.
Source: src/content/checkable-properties.ts.