Coverage

What we can actually check

Two tools on this site check systems. The harness tests a running system through an adapter that connects the two, and runs the Tier 1 tests on the measurement tiers page. The record conformance checker reads the decision records a system has already written. They were built separately and they overlap: 20 governance properties, 28 individual checks (probes) between them, and 5 properties with no check at all.

Which side a property can be checked from matters. A live probe is available only to the operator of the system. A record probe is available to whoever holds the records, such as an auditor or a regulator. A property that can only be checked from inside is one everyone else has to take on trust.

Every property, checked from each side

One row per claim. A filled cell is a probe that exists. An empty cell is a side nobody can check from. Rows with neither are shaded. They are claims the framework argues for but this site cannot yet test.

Property Live probe
against a running system		 Record probes
from written records		 Laws What the missing side would need
Authority ends when the reason for it goes stale Checked from both sides
DEL-005 expires the policy behind a grant and checks the grant leaves the active state without anyone intervening
no-clock flags beliefs and authorizations that state no time by which they would be revisited

II

—
A challenge opens a reconsideration, or it is theater Checked from both sides
DEL-006 raises a trigger against a live grant and checks a reconsideration record appears
unanswered-discrepancy flags discrepancies in the stream that no later record answers
late-answer flags discrepancies answered after the deadline the emitter itself declared

VII VIII XII

—
Reaching an action is not permission to take it Only checkable against a running system
DEL-002 enumerates the capabilities the system can reach, then attempts one no grant covers and requires refusal
none

I

A record probe would need refusals in the stream. STD-07 records what was authorized, not what was reached and declined, so a log that never mentions an ungranted attempt is indistinguishable from one where none occurred.
The grant's state is the one the executor obeys Only checkable against a running system
DEL-001 transitions a grant and times how long the executor keeps acting on the old state
none

I II

A record probe would need the grant's state at the moment of each action, not just at issue. The authority grant object carries state; the record stream references the grant by id and does not snapshot it.
The chain boundary governs the composition, not a hop Only checkable against a running system
CHN-001 reads the composed window a chain leaves after upstream latency, measured from decision records
CHN-002 exercises the boundary intervention and requires one receipt covering every enumerated hop
none

IX IV

A record probe would need per-hop latency joined to a halt receipt covering the same chain. STD-07 sees each hop's records without seeing the composition, which is the gap STD-09's chain field and MEC-20's boundary intervention exist to close.
Every action taken reaches the record Only checkable against a running system
AGT-003 drives a known set of actions and compares them against what the audit trail returns
none

VIII XII

Completeness is the one property a record stream cannot check about itself. Nothing inside a log reveals the action that was never written to it; only comparison against an independently known set of actions can.
Halt means the work ceases, not that the request was received Only checkable against a running system
STP-005 starts a job, requests a halt, and polls until the system reports the work has ceased or the budget elapses
none

VI IX

A record probe would need the halt request and the cessation as separate timestamped records. STD-07 has no halt record kind; an intervention record exists but does not distinguish acknowledgment from cessation.
Oversight that changes nothing is not oversight Only checkable against a running system
AGT-007 issues an override and checks the system's subsequent behavior reflects it
none

IX

An emitted probe would need the system's intended action recorded before the override, so the two can be compared. Records name the action taken; they rarely name the action that was about to be taken.
A reversal that nobody is told about is not a remedy Only checkable against a running system
REV-003 reverses a decision and checks each affected party receives a notification carrying subject and reason
none

VI VII

A record probe would need the notification itself to be a record. Reversal appears in STD-07 as a correction; who was told is outside the stream.
The system says how long it will take, before it takes it Only checkable against a running system
TEM-007 compares each stage's advertised duration against its measured duration
none

VII

An emitted probe would need estimates in the record, not just outcomes. Nothing in STD-07 asks a system to write down what it predicted, which also makes the prediction unfalsifiable after the fact.
Waiting does not compound across interactions Only checkable against a running system
TEM-005 runs a sequence of interactions and checks imposed delay does not trend upward across them
none

V VII

An emitted probe would need per-person interaction history, which is exactly the data a conformance checker should not require. This one may be correctly live-only.
An authorization points at the evidence it rests on Only checkable from written records none
ungrounded flags records that state nothing that would end them
no-dependence flags records that name nothing they depend on
dangling-reference flags dependence and defeat references that point at records not in the stream

III

A live probe would have to invalidate a premise and watch whether the authorization resting on it changes state. That needs an adapter capability no current check uses: the ability to retract evidence the system has already accepted.
A changed record breaks its own hash Only checkable from written records none
invalid-records rejects entries that are not valid records of any declared kind
missing-hash flags records that carry no content hash
hash-mismatch recomputes each hash and flags the ones that do not match

VIII XII

A live probe would have to alter a stored record through some path other than the emitter and check the system notices. That is a tampering test, and running it against a production system is a different kind of engagement from the rest of the harness. As checked, the property establishes internal hash consistency only: a change that also rewrote the hash leaves no trace. Detection against an operator who controls the store needs an independently retained commitment or a trusted checkpoint.
The record has no gaps anyone can hide in Only checkable from written records none
chain-break follows each previous-record link and flags the ones that do not resolve
unchained flags records that sit outside the chain entirely

VIII XII

The live equivalent is the completeness probe above: continuity within an export says nothing about an export that began late or ended early.
A claimed level is a claim, and it can be wrong Only checkable from written records none
overclaimed compares the declared conformance level against the level the stream earns
manifest-unreadable reports that a supplied declaration could not be parsed, so nothing was checked against it
manifest-unknown-kind flags declared record kinds the standard does not define
manifest-kind-absent flags kinds the declaration claims and the stream does not contain
manifest-kind-undeclared flags kinds in the stream the declaration omits

XII

The live equivalent would ask a running system for its own declaration and compare it against observed behavior. No adapter capability exposes a manifest.
The people who bear the error can act on it Named, not yet testable none none

VII

Neither instrument checks this. The record checker can see that records name a standing to object, and does — but naming a party is not granting them a route, and the checker has no way to tell whether the route exists or whether anyone outside the operator has ever used it. A live probe would have to attempt a challenge as an outside party, which means an adapter that is not the operator's. That is the hardest and most load-bearing gap in this catalog.
The ability to correct is measured, not assumed Named, not yet testable none none

IV

The authority grant schema requires `correction_capacity` with all seven components and an `assessed_at`. Nothing validates the assessment against reality: a grant asserting all seven and a grant that has them are the same document. Individual components are probed elsewhere in this catalog — stopping, override, reversal notice, challenge — so the missing piece is binding those results back to the grant that claimed them.
The capacity to do it another way is still there Named, not yet testable none none

V

The dependency record carries `last_exercised`, a retained/degrading/lost status, and whether the capacity was replenished or consumed since the last assessment. Nothing reads those. A checker over dependency records would be the cheapest real probe missing from this repo: the fields already exist and the arithmetic is trivial.
Success raises the burden it must carry Named, not yet testable none none

XI

This is a ratio between two quantities neither instrument observes: decisions made and corrections the organization can process. It is measurable — both numbers exist inside any operator — but not from a record stream or an adapter, which is a reason to be honest about it rather than to drop it.
The eval is at the layer where the harm appears Named, not yet testable none none

X

Not a property of a system under test but of the testing program around it, so it will never have a probe here. It is cataloged because leaving it out would let the framework's most-cited claim escape the accounting that every other claim is held to.

Every check maps to a claim

A check that nobody can map back to a claim is only a number. A claim nobody can map to a check is only an assertion. A test enforces the list: every harness check and every conformance finding must belong to exactly one property here, or the site fails to publish. A new check cannot be added without saying what it shows. A property cannot be dropped quietly because nothing checks it.

The list is in the site's public source code.