cf-verify

Verify a context-firewall SubResult.v1.

Arguments

$ARGUMENTS

Expected:

• --result <file|json> (required)
• --risk low|medium|high (optional, default: medium)
• --out <path> (optional)

Steps

1) Resolve project root

• Run pwd via Bash and treat it as the project root directory.

2) Load SubResult JSON (--result)

• Extract the --result value from $ARGUMENTS.
• If the --result value begins with {, treat it as inline JSON.
• Otherwise treat it as a file path:
  • If it is not absolute, resolve to an absolute path by joining with the project root.
  • Read the file content via Read.

3) Parse SubResult.v1 JSON

• Parse the content as JSON.
• If invalid JSON or missing required fields, output a VerifyReport.v1 with:
  • task_id: "unknown"
  • status: "failed"
  • checked/passed/failed consistent with 0 checks
  • recommendation telling the user to provide a valid SubResult.v1

4) Determine sampling rate

• Use --risk if provided; otherwise default to medium.
• Sampling rates:
  • high: 0.30
  • medium: 0.15
  • low: 0.05

5) Select claims to verify (deterministic)

• Flatten claims into a list in stable order:

  • Iterate answers in order.
  • Iterate claims in order.

• For each claim, derive a stable claim_id:

  • If claim.claim_id exists and is non-empty, use it.
  • Else use answers[<answer_index>].claims[<claim_index>].

• Determine N = ceil(total_claims * sample_rate).

  • If total_claims > 0, ensure N >= 1.
  • If total_claims == 0, set N = 0.

• Select the first N claims from the flattened list.

6) Verify each sampled claim

For each selected claim, attempt to verify at least one evidence item.

General rules:

• Prefer verifying the first evidence item with a line_range locator.
• Treat a claim as passed if any evidence item can be verified and is consistent.
• Treat a claim as failed if:
  • a verifiable locator is provided but the snippet contradicts the claim, or
  • a quoted substring is provided but is not found in the referenced snippet.
• Treat a claim as partial (unverifiable) if all evidence locators are of types not supported in v1 verification.