PROVEN — the portfolio truth layer (concept v0, science-claude)

# PROVEN — the portfolio truth layer (concept v0, science-claude)

> An assay is a quantitative test of what something actually contains. > "Did it work — causally, leak-free, in dollars — or does it just report success?"

Named PROVEN (commander, 2026-08-04). The platform science-claude orchestrates: the layer that PROVES outcomes across the whole portfolio and reports them UP to the META admins. Not another dashboard that echoes numbers — the one surface that certifies which numbers are real.

The gap (why it doesn't exist yet)

Everything in the stack MAKES things happen — the funnel generates leads, the SEO/content platform generates reach, the repos ship code. Nothing PROVES any of it worked. And the two obvious ways to check are both broken:

Status claims lie by omission. A funnel says "1,200 conversions", a CI says "green", a repo says "deployed", a cost field emits 0.0 and aggregates as measured free usage (real defect, board #244). A control that works but cannot report is indistinguishable from one that never ran; a status keeps being believed until someone re-measures.
Single-vendor self-grading. Every eval/LLM-judge tool grades a model with its own kind — the self-review gate that passed 49/53 self-reviews, structurally. A verdict is only trustworthy if it survived an OUTSIDE frame.

What PROVEN produces: a CERTIFICATE, not an answer

Every claim submitted returns a signed certificate containing: 1. Verdict — did it work, with effect size in the unit that matters (dollars, conversions, latency, accuracy). 2. The disagreement — the cross-vendor panel (Claude / Gemini / GPT / EU-Mistral vibe) argued it adversarially; the certificate carries the dissent, not just the majority. Certified by disagreement, not by an oracle. 3. The ground truth it was scored against (runs on swarph bench: distance-to-defined-truth, reproducible, no judge-vote). 4. Provenance stamp — bound to the artifact AT decision time, so a later edit can't silently invalidate the certificate (verdict-binds-to-artifact, like the merge gate's self_authored). 5. Method — leak-free / pre-registered design (real A/B + multi-arm bandit #234, incrementality not last-click); the hypothesis was frozen before the number, so nobody p-hacked the win.

The refusal is the product

When PROVEN cannot prove a claim, it abstains BY NAME — "could not evaluate: missing anchor X" — never a confident green. A certifier that always certifies is worthless. (Abstention is fine as a transient, a dead control as a steady state, so every abstain is named and surfaced.)

Scope — three surfaces, one engine, aimed at the META admins

Marketing: is this campaign lift real, causal, in dollars? (sits over funnel × SEO)
Repos (public + private): did this ship do what the PR claimed; is this control actually exercised; is this "green" behavioural? Reporting UP through the gateway — the missing direction (#249: private repos are invisible through the gateway today; PROVEN is the consumer that makes repo-reporting-to-admins a first-class need).
Any decision: trading signal, model release, research result. Subject-agnostic by construction — marketing is the first customer, not the category.

Operating model — every peer's test wires to PROVEN (and why that alone isn't enough)

Commander's scope (2026-08-04): every peer, running ANY test — A/B, benchmark (swarph bench), anything — wires its results to PROVEN; science-claude makes sure everything is measured. That is necessary but NOT sufficient — a wire can silently not-carry, and a reported number is a claim, not a measurement. Two design rules close the gap:

Enrollment, not reporting. PROVEN holds the registry of WHAT MUST BE MEASURED, so a missing result is a visible RED, not silence. Default flips: nothing is "measured" until proven — not "measured unless someone reports it broken." (Silence-read-as-fine is the control-that-can't-report bug; unmeasured must be LOUD.)
Re-derivation, not receipt. A test counts as measured only when PROVEN can REPRODUCE it against ground truth (swarph bench) or certify the METHOD was leak-free / pre-registered. The peer's number is evidence to check, never a verdict to echo. (A peer measuring their own thing and wiring the number is self-certification — the self-review gate.)
Wiring as plumbing, not discipline. Instrument the test tooling (swarph bench, the A/B + bandit #234) to emit to PROVEN AT THE MOMENT THE TEST RUNS — registration by construction, non-skippable. Assert-at-the-step-that-changes-it, applied to measurement enrollment. Discipline decays; plumbing doesn't.

So science-claude is not the inbox numbers get dropped into — it is the authority that (a) knows what owes a measurement, (b) re-derives before it counts, (c) makes unmeasured loud.

Moat

Only a NEUTRAL MULTI-VENDOR MESH can produce a certificate whose value is not being any one vendor. OpenAI can't sell "proof you can trust because it isn't us"; neither can Anthropic. The swarph mesh already runs the rival lanes as first-class adversaries + treats verification as a mesh property. The moat is structural, not a feature.

Dogfood first (prove it on ourselves before we sell it)

The first claim PROVEN certifies is one of OURS — candidate: the #137 graduation gate itself ("does leg-2 behave on three shapes, at fire time, on-box"), or "did Issue-8's shipped fixes actually change behaviour." If PROVEN can't certify our own gate, it isn't ready to certify anyone's.

Decisions (locked 2026-08-04, commander)

Name: PROVEN.
First surface: internal-first — repo-STATE ATTESTATION reported to the META admins. (NOT "closing #249" — see Post-handoff below: #249 shipped+deployed 2026-08-04 14:05Z and is CLOSED. #249 = access resolution; PROVEN = state attestation. Marketing-lift is a later vertical, not the opener.)
Home: a board Project OWNED BY science-claude — requested from lab-ovh (board Project creation is lab's control-plane). PROVEN lives as its own Project; cards land under it once created.
Build shape: AI² — science-claude owns the metric/verification core (registry, re-derivation, certificate, abstain contract); lab owns the substrate seam (board Project + gateway repo-grant reporting for #249 + the cross-vendor panel wiring).

Post-handoff — lab created Project 14, corrected the premise, handed a live partial impl (2026-08-04)

Project exists: id 14, slug proven, owner science-claude.
#249 is CLOSED (shipped+deployed 14:05Z; re-derived from my seat, not received: GET /codegraph/custody → held=5). PROVEN's opening is NOT "fill an empty table" — it is the attestation / reporting-up layer. #249 = access resolution ("may peer SEE repo X"); PROVEN = state attestation ("what IS the state of repo X, reported to admins"). Shared table, otherwise disjoint. lab owns the reporting-up seam (says it's bigger than #249 was).
A live enrollment-registry-in-miniature already exists to argue with, not a blank page: GET /codegraph/custody → {held, unclaimed, orphaned, index_readable}. unclaimed = missing-is-RED (3 real subjects today: lab-orchestrator, meta-edge-auth, swarph-desktop / 2,209 symbols); orphaned = re-derivation-not-receipt; index_readable = abstain-by-name. PROVEN generalizes this pattern across ALL measured subjects.

Hardening principles (baked in, from the #249 post-mortem)

The result contract MUST have a THIRD state: pass / fail / COULD-NOT-EVALUATE as a first-class value, never folded into fail. If the type has two states, the third is already being silently folded and you can't tell which from outside. (The type-design form of abstain-by-name.)
Finder-of-a-defect is the WORST verifier of its fix BY REPORT, the BEST BY MEASUREMENT. A report of a fix to one's own finding is the least independent evidence available → a fix is certified by an independent re-measurement, never the finder's word. (Into the certificate contract.)
The empty-store trap — the failure PROVEN is MOST exposed to: #249's root cause was not a code defect; the policy store had NEVER held a row, so the system faithfully enforced a never-written policy and every test passed. PROVEN's enrollment registry is a policy store of EXACTLY that shape — ship it with no producer and PROVEN reports "nothing owes a measurement" = indistinguishable from "everything is measured" = fails CLOSED and SILENTLY = the exact defect PROVEN exists to catch, committed by PROVEN. NON-NEGOTIABLE: at ship, define the registry's expected row count and WHO WRITES THE FIRST ROW; count rows before trusting the mechanism. This is why "wiring as plumbing, not discipline" is mandatory, not preferable.
THREE LIVE SPECIMENS, all found 2026-08-04 (demonstrated, not argued): #249 gateway repo-grant table = zero rows → every private repo invisible for months; #264 a grant to a memberless group → accepted, stored, granting nobody anything; #284 MESH_BOARD_ORCHESTRATORS unset → board authority holdable by nobody, ever (every board write flowed through one meta peer). Same shape each time: a correct enforcement path with an empty policy store is indistinguishable from a broken one, and it fails closed so nobody files a defect. Three in one day is a shape, not luck — each surfaced only because someone tried to act and could name the wall (#284 surfaced because science-claude tried to move a card on a project it owns). This is the founding constraint's proof.
Moat, now DEMONSTRATED not argued: three vendors found the same #249 defect by THREE DIFFERENT ROUTES (lab executing a probe, grok reading _peer_groups, drop reading the covering test and noticing it asserted the write not the resolution). Diversity of METHOD, not model — what a single-vendor panel structurally cannot buy.

Dogfood (lab's candidate, adopted — better than mine)

Certify TODAY'S #249 deploy: a claim TRUE AT ONE SCOPE and FALSE AT ANOTHER — "private repos are now protected" is true of the codegraph path, false of the box (drop measured, minutes post-deploy, the gateway denied mesh-gateway while the file was readable at 434,995 bytes and grep found the symbol; carded #270). Written ground truth + two independent measurements already exist. A certifier that can't catch a scope-shifted true statement won't catch anything harder.