Evidence-Bearing Verification Annex — Behavior, Fault, Observable Proof & Material Coverage (v0.1)

Purpose

Attach this annex to a research payload, code sample, prototype, migration, data contract, or operational change when completion depends on more than the presence of tests or a green workflow.

The annex produces:

• a material-claim inventory;
• a behavior–fault–oracle map;
• a layered verification plan;
• boundary and combination cases;
• evidence from successful, failed, partial, and recovered paths;
• an interpretation of what the evidence establishes;
• an explicit coverage boundary;
• a completion, pause, or reopen judgment.

Core verification unit

Each verification item uses one complete unit:

A count of tests, lines, branches, snapshots, or assertions becomes useful when connected to these units. The connection turns activity into evidence.

Start with the material claim

Examples of material claims:

• a retry preserves one durable outcome;
• an invalid transition is rejected while prior state remains recoverable;
• a serialized record returns with the same semantic meaning;
• a keyboard user can reach, identify, activate, and recover from a control;
• a generated research claim resolves to its source or visible open state;
• a migration preserves every required identifier and relationship;
• a narrow viewport keeps the primary comparison discoverable and operable;
• a policy decision remains attributable to its governing version and accountable owner.

Phrase the claim as an observable desired state. Then name the adjacent fault and the evidence that would expose it.

Verification ladder

Choose the lowest layer that directly observes the claim, then add another layer only when a material boundary remains unobserved.

Layer selection follows the claim. A lower layer can prove a pure transformation; a real boundary is needed to prove the integration that owns it.

Material case families

Values and ranges

Exercise:

• minimum and maximum valid values;
• values immediately inside and outside each boundary;
• zero where zero has meaning;
• negative values where the domain permits or rejects them;
• large cardinalities and credible growth;
• precision, rounding, units, and overflow;
• time zones, daylight transitions, effective dates, and clock ordering.

Missingness and shape

Exercise distinctions that carry domain meaning:

• absent field;
• explicit null;
• language-level undefined where applicable;
• empty string;
• empty collection;
• unknown;
• withheld;
• inapplicable;
• malformed;
• partial record;
• superseded value;
• conflicting sources.

The expected result states whether each condition is accepted, transformed, reserved, rejected, quarantined, or routed for resolution.

Control flow and state

Exercise:

• every consequential guard;
• branch ordering where order changes the result;
• fall-through and default behavior;
• valid and invalid transitions;
• repeated transitions;
• terminal states;
• reopen states;
• interruption between stages;
• rollback, compensation, or reconciliation.

Identity, duplicates, and ordering

Exercise:

• same value with distinct entity identity;
• duplicate event or request;
• key collision;
• stable ordering;
• tie-breaking;
• out-of-order arrival;
• replay;
• late event;
• supersession;
• digest or version mismatch.

Persistence and round trip

Exercise:

• write then read;
• parse then serialize;
• export then import;
• current schema and supported predecessor;
• deterministic output where identity depends on bytes;
• partial write or interrupted promotion;
• backup and recovery;
• permission, path, and ownership failures;
• symlink and path-substitution behavior where the threat model includes them.

Digest equality establishes byte identity. Semantic assertions establish meaning. Both may be required.

Concurrency and distributed behavior

When concurrency is material, exercise:

• simultaneous creates or updates;
• compare-and-swap failure;
• idempotent retry;
• lost update;
• duplicate delivery;
• network timeout after remote success;
• lease expiry;
• partial batch;
• eventual convergence;
• reconciliation after divergent observations.

Prefer controllable schedules, fakes at the boundary, deterministic clocks, or repeated stress evidence appropriate to the claim. A nondeterministic test becomes decision-bearing when its method, run count, detection power, and residual uncertainty are explicit.

Human-facing and accessible behavior

Exercise:

• keyboard path and visible focus;
• accessible name, role, state, and relationship;
• screen-reader reading order and status changes;
• pointer and touch target;
• zoom and text reflow;
• narrow, desktop, and wide viewport;
• reduced motion, forced colors, and print where material;
• error comprehension and recovery;
• onward-link behavior;
• empty, loading, partial, and failure states.

A screenshot can establish a visible arrangement at one state and viewport. Interaction and semantic evidence establish operability and accessibility.

Research and evidence artifacts

Exercise:

• required parameter presence;
• source hierarchy and date binding;
• claim-class assignment;
• successful, sampled, partial, and unreachable retrievals;
• citation resolution;
• evidence independence;
• counterevidence;
• estimate method and confidence;
• required output closure;
• completion-gate evaluation;
• public and protected boundary handling;
• run receipt and re-entry condition.

A polished report can coexist with an open evidence gap. The coverage ledger and claim language keep that gap visible.

Combination strategy

Full Cartesian coverage is rarely the best use of attention. Select combinations through consequence and interaction:

1. identify factors whose interaction can change behavior;
2. mark safety-, privacy-, money-, access-, identity-, and irreversibility-bearing combinations;
3. use pairwise or higher-strength combinatorial design for broad interaction coverage where fitting;
4. add targeted cases for known mechanisms and past failures;
5. include one ordinary benign explanation for an apparent failure;
6. preserve the residual combination space as a named boundary.

Property-based and metamorphic tests are useful when the invariant spans many values. Example-based tests remain valuable for domain-recognizable cases and boundary explanations.

Absence evidence

An absent event becomes evidence only when the observation method could have detected it.

Record:

• expected signal;
• observation window;
• instrument or query;
• population or denominator;
• detection limits;
• sampling rule;
• known blind spots;
• result;
• interpretation.

Examples include an absent duplicate after idempotent replay, an absent stale relation after migration, or an absent collision in a named layout sweep. The receipt states what detection power supports the conclusion.

Coverage as a map

Coverage measures can locate unexplored code or requirements. They become materially meaningful when mapped to behavior.

State the interpretation beside the metric. A threshold supports attention allocation; the receiving claim still needs observable proof.

Failure and recovery evidence

A useful failed test preserves:

• initial state;
• stimulus;
• observed state;
• expected state;
• failure class;
• likely owner;
• smallest reproducer;
• recovery or containment result;
• evidence that durable state remained coherent;
• next decision.

When both the primary operation and recovery fail, retain both exceptions or error records and the state of every affected artifact. The most actionable output identifies the first broken invariant and the remaining safe route.

Verification procedure

1. Name the receiving decision.
2. List the material claims.
3. Map each claim to actor, preconditions, stimulus, plausible fault, and oracle.
4. Select the lowest evidence layer that directly observes the claim.
5. Add boundaries, combinations, state transitions, and recovery cases.
6. Execute the existing smallest fitting checks first.
7. Add a check when a consequential claim remains unobserved or repeated work shows durable value.
8. Preserve success, partial, failure, and recovery evidence proportionally.
9. Interpret each result and state its coverage boundary.
10. Return completion, bounded pause, or reopen with the next receiver.

Verification record

Worked miniature

Claim: promoting a staged directory leaves either the prior complete target or the new complete target recoverable.

• Preconditions: existing target, complete staged directory, same filesystem.
• Stimulus: promotion begins.
• Plausible faults: target changes between observation and rename; promotion rename fails; recovery rename fails.
• Oracles: target identity, sentinel content, absence or presence of backup, captured filesystem error, recoverable complete directory.
• Layers: focused unit tests with controlled filesystem operations; integration test on the supported filesystem.
• Boundary cases: target absent; target directory present; symlink at target; permission failure; duplicate backup; interruption after backup rename; failure during rollback.
• Evidence interpretation: controlled tests establish the implemented transition and recovery behavior under injected faults. Filesystem- and attacker-specific guarantees require operating-system primitives, supported deployment assumptions, and an explicit threat model.
• Reopen signal: cross-filesystem promotion, shared writers, a stronger symlink threat model, or a changed durability requirement.

The example keeps the guarantee aligned with observed primitives and leaves the stronger security boundary available for a separate decision.

Output contract

Return:

1. receiving decision;
2. material-claim inventory;
3. behavior–fault–oracle map;
4. selected verification layers;
5. boundary and combination matrix;
6. execution results;
7. recovery evidence;
8. interpreted coverage;
9. open claims and absent evidence;
10. completion judgment;
11. next receiver and reopen event.

Completion states

Return evidence_ready when every material claim has a fitting observation and the receiving decision is within the stated boundary.

Return bounded_pause when a named evidence gap can change the decision. Include the smallest observation, source, environment, or authority needed to continue.

Return authority_required when evidence is sufficient to expose a decision reserved for an accountable role.

Return reopen when new behavior, scale, source state, environment, or consequence changes the claim or the needed proof.

Machine-readable companion

```yaml artifact: id: research-payload-family/evidence-bearing-verification-annex type: ModularAnnex version: 0.1.0 public_route: https://kindlight.systems/research-atlas-observatory/evidence-bearing-verification-annex-behavior-fault-observable-proof-material-coverage-v01 verification_unit: - material_claim - receiving_decision - actor_or_surface - preconditions - stimulus - plausible_fault - oracle - evidence_location - coverage_boundary - recovery_evidence - receiver case_families: - values_and_ranges - missingness_and_shape - control_flow_and_state - identity_duplicates_and_ordering - persistence_and_round_trip - concurrency_and_distribution - human_facing_and_accessible_behavior - research_and_evidence_artifacts completion_states: - evidence_ready - bounded_pause - authority_required - reopen ```

Source lineage

This annex distills and connects these canonical Registry instruments:

• Evidence-Bearing Test Design — Behavior, Boundary & Observable Proof
• Material Verification — Connect Checks to Behavior, Fault & Observable Evidence
• Goal Fidelity Under Partial Context — Deep Research Result: Evidence-Bearing Collaboration Across Model, Harness, Human & Organization
• Data Shape & Structure Selection Ladder — Practitioner Probe
• Research Payload Family — Shared Core, Run Receipt & Promotion Boundaries

The named source pages retain their own scope and authority. This annex supplies a portable verification route and return shape.