From 3956a48c83a991df8f4b8936e5f46f98ddd7f6e1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 23 Sep 2026 10:16:00 +0000
Subject: [PATCH] Adopt the Verification Ladder's evidence/3 contract

Add verification.toml, the completion policy the Verification Ladder
(0.3.0, compatibility contract evidence-v3.2) reads: every gate the
public-release workflow runs is required, `suite` (scripts/ci.sh) runs
locally as well, and CI evidence is accepted only from this repository's
`validate` job in .github/workflows/ci.yml, bound step by step.

The policy adopts `verification.ladder.evidence/3`. Adoption is committed so
it survives evidence cleanup and a fresh clone; each checkout still activates
it through `verify.py qualify` and `verify.py activate`.

Git-ignore .verification/, where the evidence records live. They are bound to
one repository state and must never be committed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016m6di8xFVdwwq949mJx9U1
---
 .gitignore        |  3 +++
 verification.toml | 50 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 verification.toml

diff --git a/.gitignore b/.gitignore
index da76ee0..1485191 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,6 @@ secrets/
 *.pem
 *.key
 *.kdbx
+
+# Verification Ladder evidence: state-bound, never committed.
+.verification/
diff --git a/verification.toml b/verification.toml
new file mode 100644
index 0000000..e140c68
--- /dev/null
+++ b/verification.toml
@@ -0,0 +1,50 @@
+# Cerberus's completion policy for the Verification Ladder.
+#
+# What "complete" means for a change to this repository, read by the Ladder's
+# verify.py (0.3.0, compatibility contract evidence-v3.2). A change is ready for
+# a human gate only when every gate below has PASSED by execution against the
+# exact state under review, and every judgment rung is attested for it.
+
+# The contract that decides here. Committed, so it survives `rm -rf .verification`
+# and a fresh clone; each checkout still activates it with `verify.py qualify`
+# and `verify.py activate`.
+evidence = "verification.ladder.evidence/3"
+
+# Every gate the public-release workflow runs. `suite` also runs locally; the
+# rest only CI establishes, because they need the pinned toolchain, Docker and
+# gitleaks as CI provisions them.
+required_gates = [
+  "suite",
+  "build",
+  "frontend-syntax",
+  "compose-config",
+  "container-build",
+  "container-smoke",
+  "secret-scan",
+]
+judgment_rungs = ["task", "diff", "self-review", "requirements", "architecture", "fresh-review"]
+
+# A pull_request run checks out a merge of the head into its base, so only a
+# push run describes the commit under review.
+ci_head_events = ["push"]
+
+[gates.local]
+suite = "./scripts/ci.sh"
+
+# The only repository, workflow and job whose runs may establish a CI gate here.
+# Declared, never read from the payload under examination.
+[ci]
+repository = "Deep-Sixed/Cerberus"
+workflow = ".github/workflows/ci.yml"
+job = "validate"
+
+# Each gate, mapped to the step of the `validate` job that establishes it.
+# Unnamed `run:` steps are reported by the Actions API as "Run <command>".
+[ci_steps]
+suite = "Run ./scripts/ci.sh"
+build = "Run uv build --no-build-isolation"
+frontend-syntax = "Run node --check src/cerberus/ui/static/app.js"
+compose-config = "Run python scripts/check-compose.py"
+container-build = "Run docker build -f Containerfile -t cerberus:ci ."
+container-smoke = "Run ./scripts/smoke-container.sh cerberus:ci"
+secret-scan = "Run sh scripts/scan-secrets.sh"