Rule 2 · never confusable
Three evaluation classes
Deterministic, model-assisted, and manual each own a mark, a color, and a
frame the others may not borrow. A model-assisted claim never renders a check mark.
✓
Deterministic
computed · replayable
A fold or query result. Rendered as fact, always with
its verification envelope. Mark: solid sage check. Anyone can replay it.
✓
Spend this week: €4,120.00
fold spend_weekly_eur · records 0–212
checkpoint #216 · as of 14s ago
≈
Model-assisted
interpretation · awaiting human
An AI reading of the evidence. Rendered as an attributed
claim — model id, evidence range, confidence. Mark: dashed amber tilde. Never a check.
≈
"This looks like a retry storm —
✓11 near-identical calls / 90s · shape fold · 118–129
— worth a look."
claude-sonnet-4-6 · reads records 118–129 · every number in the claim is a cited fold chip, never the model's own
confidence: moderate · confirm / override
EO
Manual
human attestation · signed
A person put their name on it. Rendered as a signature —
who, their role, when, recorded as its own capsule. Mark: bark seal with initials.
E. Okafor
General Counsel — authorized this action
signed 2026-08-04 09:12 UTC · recorded as 94c877c7…
DM Mono · literal text
Envelope line
Verbatim format pinned in capsule_ledger/cli/format.py:
fold <id> · records N–M · checkpoint #X · as of <staleness>.
Always accompanies a deterministic mark.
fold spend_weekly_eur · records 0–212 · checkpoint #216 · as of 14s ago
fold refusal_count · records 0–212 · checkpoint #216 · as of just now
fold guard_dry_run@216 · records 118–129 · checkpoint #216 · as of 2m ago
Rule 3 · degradation shown, not hidden
Assurance rungs
Classes and rungs are orthogonal. Climbing is normal life (animate once,
settle); a downgrade shows the rung it holds, never the one it hoped for.
Standalone
ledger_mode: standalone
The record is signed and complete on its own. A stranger must trust the operator that it was never replaced.
Countersigned
attestation: counterparty
The other side of the action signed it too. Neither party can now tell a different story.
Locally receipted
ledger_mode: chained
The record holds its place in an unbroken sequence. Removing or editing it would visibly break the chain.
Counterparty-visible
shared checkpoint
The sequence summary is held by the counterparty as well — history can't be rewritten without the other side noticing.
Externally registered
ledger_mode: anchored · 3 external witnesses
A summary was lodged with independent public logs — this history cannot be quietly rewritten afterwards.
normallocally receipted
rung held (downgrade)registered with 1 of 3 logs · retrying
Rule 3 · staleness on every aggregate
Staleness chip
There is no global real-time truth; the chip says so honestly. Past its
policy bound, an aggregate's freshness claim can no longer be trusted (see components.css §4).
freshas of 14s ago
refreshingas of 2m ago · refreshing
stale beyond policy boundstale · older than policy bound (5m)
Local Console · presentational categories
Verdict chips
Presentation-layer labels — distinct from the data-layer
disposition.decision / verdict_class tokens.
Blocked wears sage, never red: proof the guard ran, not a failure.
confirmed
✓confirmed
dispatched · unconfirmed
→dispatched · unconfirmed
blocked (sage, never red)
⊘blocked
needs decision
?needs decision
waiting: treasury-approver
errored
!errored
Standing rule
The CLI echo
Every GUI filter or action shows its CLI/API equivalent, live.
≡ capsule log --agent hermes --verdict blocked --since 19:00
Rule 5 · precision, never a generic red X
When verification fails
Failure red is #A93F2B
— reserved exclusively for verification failure. Nothing else on any surface may use it.
A failed record names the stage that failed.
✕digest_mismatch
The contents changed
"This record does not match its fingerprint — it is not the record that was sealed." The mismatching field group is named; the rest of the bundle keeps its own verdicts.
✕signature_invalid
The signature doesn't hold
"The signature on this record was not made by the key it names." Renders who it claims to be from, and that the claim fails — never just a red icon.
✕chain_gap
A break in the sequence
"Records are missing between #47 (Tue 14:02) and #48 (Tue 14:19)." The gap window is the finding — located in time and position, browsable from either edge.
✕inclusion_unproven
The witness receipt doesn't check out
"This record claims external registration, but the log's receipt doesn't check out (or can't be reached — retry when online)." Distinguishes unreachable from disproven, always — and never claims more independence than the witnessing rung actually held (an operated default witness is not the same claim as the "Externally registered" rung above).
The verify ritual
Four stage rows. Pass is sage, fail is brick (the only other permitted brick
use), skipped is a neutral outline — never a silent green dot, never a bare red X.
all pass, witness skipped offline
✓Integrityevery record matches its fingerprint
✓Sequencenothing missing between the first and last record shown
✓Authenticitysigned by acme-research
–Witnessskipped (no connection) — everything else verified
integrity fails, rest continue
✕Integritydigest_mismatch — see failure card above
✓Sequencenothing missing between the first and last record shown
✓Authenticitysigned by acme-research
✓Witnessregistered with 3 of 3 logs