Independent completion witness

These examples and illustrative results are independently authored teaching materials, not measured model results.

Use case

An untrusted application can print all tests passed and exit 0. Teaching snapshot S2 requires cross-tenant denial and legitimate access; targets must not control their own oracle/evidence.

Mechanism

Keep fixed fixtures, independent assertions and evidence in an environment the target cannot modify, binding snapshot/tool identity. Observe denial and legitimate controls through external checks and retain verifier-owned results; label project summaries self-reported separately. If the target can alter the oracle, terminate it or replace records, independence is absent. Name missing witnesses.

Bad example

Printed green and exit 0 independently verify the repair; another process automatically makes evidence trustworthy.

Good example

Check S2 with target-inaccessible cross-tenant assertions and legitimate controls, recording actual results/identity. Project-suite summaries remain self-reported; absent completion witnesses cannot upgrade assurance. A second process sharing writable oracles is not independent.

Why the change matters

Targets can forge self-controlled reports. Moving judgment/evidence outside that control supports specific behavior without authenticating every target statement.

Observable expectation

Teaching cross-tenant access still succeeds: external checks fail despite printed green. Denial plus legitimate success supports those assertions only. Writable verifiers invalidate independence; unwitnessed full-suite completion remains separate.

Limits

Isolation/provenance require real mechanisms, not process/hash labels alone. External assertions can miss cases, and unauthenticated project results need not be unrun. Source-specific assurance states must follow actual evidence rather than universal certification claims.