verify - bind "done" to a green test run, not just diff shape

dos commit-audit (and the dispatch-tick witness it feeds) grades whether a commit's DIFF did the KIND of thing its subject claimed — diff-witnessed vs a forgeable subject-only. That is commit SHAPE, explicitly not correctness: a diff-witnessed commit can still fail its own tests. This skill runs the missing rung — the resolving commit's affected-package tests — and binds the pass to "done". It is additive to the shape witness, never a replacement.

Load-Bearing Rule

The only path to a GREEN done-binding is a test that actually RAN and PASSED. A runner that never fired, found no test-bearing changed package, or faulted is CLAIM_TEST_UNRUN — a valid, surfaced state, never a pass. Do not fold a done-claim as true on shape alone, and never let UNRUN masquerade as GREEN.

Step 0 - Identify The Resolving Commit

Take the commit whose done-claim you are checking (the resolving commit for the issue, usually HEAD after a ship). Its changed .go files determine which packages carry the test binding:

git show --name-only --pretty=format: <sha>

Map each changed file to its package dir; a changed dir with no *_test.go carries nothing to bind a pass to — it contributes to UNRUN, not a vacuous pass.

Step 1 - Run The Affected-Package Tests (WSL-aware)

Run the changed packages' tests through the repo's own affected-test seam, which is WSL-aware — on native Windows it drives the tests through ./test.ps1, else go test:

fak affected            # runs the affected packages' tests through the WSL-aware seam

If you are checking one known package directly, the explicit equivalent is:

go test ./<changed-pkg>/... -count=1

Do not substitute a build (go build) or a vet for a test run — a green build is shape, not the test binding.

Step 1b - Execute Real-World Smoke Testing Earlier in the Process

Mocks hide integration bugs (Hermes' rule). Whenever touching CLI, runtime, or security-critical paths, prove real execution early in development:

• Isolated Validation Smoke: Run fak validate --mine <changed-files> --smoke in your inner loop to compile and execute preflight, version, and offline agent checks in an isolated overlay.
• Fast Local Smoke Tier: Run make smoke (smoke-exec + dogfood-test) or make test-fast before staging.
• Dogfood Launcher Witness: Run bash scripts/dogfood-claude_test.sh to verify process supervision and fail-fast deadlines.
• Attestation Trailer: Add Smoke-verified: <command> or E2E-verified: <command> in commit or test files to satisfy the E2E_OVER_MOCKS boundary hook.

Step 2 - Grade The Binding

Fold the run into exactly one claim, the same grader the dispatch-tick witness records into the .witness sidecar's test_claim field:

Ran?	Passed?	Claim	Meaning
yes	yes	CLAIM_TEST_GREEN	affected tests ran and passed — done-binding holds
yes	no	CLAIM_TEST_RED	affected tests ran and FAILED — a diff-witnessed commit can still be RED; this is the gap the rung closes
no	—	CLAIM_TEST_UNRUN	no resolving commit, no test-bearing changed package, or the runner was off/faulted — valid, surfaced, NOT a pass

ran=false always outranks a stale passed bit: a run that never happened is UNRUN, never GREEN.

Step 3 - Read The Recorded Witness (Optional)

On a live dispatch tick with the in-tick runner enabled, the shell records this same binding for you. The default runner is opt-in via FAK_WITNESS_TEST_RUN (unset -> the rung records UNRUN so the hot loop never eats an in-tick go test); this verify skill is the always-on manual consumer of the same rung. When a sidecar exists, read it rather than re-running:

# the per-worker resolve log's sibling: resolve-<N>-<stamp>.witness
# its `test_claim` key carries CLAIM_TEST_GREEN / _RED / _UNRUN

Preserve the rung alongside the shape verdict — a diff-witnessed + CLAIM_TEST_GREEN is a strictly stronger done-binding than diff-witnessed alone, and diff-witnessed + CLAIM_TEST_RED is a REFUTATION.

Step 4 - Report, Do Not Fold Blindly

• CLAIM_TEST_GREEN: the done-claim is test-bound; safe to fold as done.
• CLAIM_TEST_RED: do not fold as done; the change fails its own tests — re-open or fix, and say so.
• CLAIM_TEST_UNRUN: do not fold as GREEN; report the missing test run and why (no changed test-bearing package, runner off/faulted). UNRUN is honest, not a pass.

Anti-Patterns

• Reporting a diff-shape diff-witnessed as if it proved the tests pass.
• Letting CLAIM_TEST_UNRUN read as "probably green".
• Running a build or a vet and calling it the test binding.
• Grading a package that has no *_test.go as a pass (that is a vacuous run — it is UNRUN).
• Requiring every commit to carry a test run — UNRUN is a valid state, not a failure.