[Deep-Sixed]

Cerberus's side of the Verification Ladder consumer qualification (Deep-Sixed/Verification-Ladder#8). Policy only: no source, test or workflow change.

What this adds

• verification.toml: the completion policy the Ladder (0.3.0, compatibility contract evidence-v3.2) reads.
  • All seven steps of the validate job are required gates: suite (scripts/ci.sh), build, frontend-syntax, compose-config, container-build, container-smoke, secret-scan. A green climb therefore needs the whole job, not only the tests.
  • suite also runs locally. The rest only CI establishes, because they need the pinned toolchain, Docker and gitleaks as CI provisions them.
  • CI evidence is accepted only from Deep-Sixed/Cerberus → .github/workflows/ci.yml → job validate, bound step by step, and only from push runs. A pull_request run tests a merge commit, not the head.
  • evidence = "verification.ladder.evidence/3" is committed, so the adopted contract survives rm -rf .verification and a fresh clone. Each checkout still activates it with verify.py qualify and verify.py activate.
• .gitignore gains .verification/. Evidence records are bound to one state and are never committed.

Evidence for this exact head (3956a48)

The Ladder was installed the documented way: scripts/install-ladder.sh from a fresh clone of Verification-Ladder main, into a clean HOME. check-install.sh reported INSTALL CONFORMS, and the installed runtime is c86bf47, evidence-v3.2 / 0.3.0.

• Without this policy, the installed verifier refuses Cerberus: BLOCKED, exit 2. That is the intended behaviour.
• Local: ./scripts/ci.sh passes through the verifier: 319 passed on managed Python 3.14.5, no drift, clean tree.
• CI: push run 35847808939 is green. Imported, it binds all seven gates to their exact steps, and the repository → run → attempt → workflow → job → commit chain checks out.
• Qualify: 12 predicates QUALIFIED, 0 disagreements, 0 uncovered. artifact chain is OUT OF SCOPE because this policy declares no behavioural gate. ci provenance and all 7 ci step bindings qualified from the real run.
• Activate: AUTHORITY SWITCH TRUE.
• Authoritative evidence/3 compose:

VERIFICATION STATE: 3956a48c83a9 + sha256:d455437d7c9b…  [evidence/3]
  * build / compose-config / container-build / container-smoke   PASS  execution  ci
  * frontend-syntax / secret-scan                                  PASS  execution  ci
  * suite                                                          PASS  execution  ci, local
    task / diff / self-review / requirements / architecture / fresh-review   PASS  attestation
  BLOCKED REQUIRED GATES 0   STALE EVIDENCE 0   STATE MATCH TRUE
  EVIDENCE ADMISSIBLE TRUE   DEFINITION CHANGE NONE   CLEAN CLIMB TRUE
  READY FOR HUMAN GATE     TRUE

Mutating one dimension at a time was refused every time, for the named reason:

• a tracked file edited;
• a CI record naming another repository;
• a CI job that ran another commit;
• a record under the pre-hardening contract evidence-v3.1;
• main's green run imported for this head (no record written);
• the activation record deleted.

The full record lives in Verification-Ladder#8.

For a maintainer adopting it locally

Install the Ladder with scripts/install-ladder.sh from Verification-Ladder main, then run verify.py baseline, run, import-ci for this commit's push run, the attest rungs, qualify and activate. Local suite runs need uv 0.11.29 on PATH and a managed Python 3.14.5 (uv python install 3.14.5), the same toolchain scripts/ci.sh expects.

🤖 Generated with Claude Code

https://claude.ai/code/session_016m6di8xFVdwwq949mJx9U1

---

Generated by Claude Code