constatar-verify

constatar: verification-first orchestration

constatar is a compiled Rust engine (constatar binary) that drives headless coding agents (claude, codex) and refuses to accept work without grounded evidence. You are the thin interface: read plans, invoke the binary, interpret its JSON. The engine owns all state (journal + git worktrees) and enforces all invariants in compiled code — never re-implement them in prompt logic, never bypass them.

Ladder reference (what each of the 6 rungs demands and produces): ${CLAUDE_PLUGIN_ROOT}/references/constatar/ladder.md. Plan schema: ${CLAUDE_PLUGIN_ROOT}/references/constatar/plan-schema.md.

The verification ladder (lowest rung = strongest = preferred)

1. Deterministic oracle — commands whose exit codes are the evidence (tests, clippy, build).
2. Property/metamorphic — invariant checks repeated N times (property_runs) to catch flake.
3. Held-out — checks the executor never saw; pass requires ALL held-out checks passing AND hacking gap (visible rate − held-out rate) within threshold.
4. Adversarial refutation — a cross-family skeptic whose default verdict is REFUTED; its grounding commands are executed by the engine, never trusted.
5. Cross-provider judge — a different model family judges the unit's actual commit diff (engine-derived and hashed), hunting hacking behaviors.
6. Peer review — last resort, only when 1–5 do not apply; grounding commands must touch the changed files.

Declared rungs form a conjunction: every declared rung must pass; the first failure is terminal (no falling through to weaker lenses). Prefer declaring the lowest rungs that genuinely verify the work; add rung 4 or 5 for units whose correctness a test suite cannot fully pin down.

Two invariants make a rung real, both engine-enforced:

• Independence: verifiers at rungs 4–6 come from a different model family than the producer; their prompts never contain producer chain-of-thought.
• Groundedness: evidence is executed commands with captured exit codes, artifact hashes of real git objects, or red-first observations. A verdict without grounding is unrepresentable.