feat(skills): add the wtf-is-real verification skill

README.md

@@ -195,6 +195,7 @@ Firstmate's skills live in two separate places with different audiences:
   Each one is a self-contained skill with no dependency on firstmate's paths, tools, or vocabulary.
   Today that is `skills/stow`, a generic session-knowledge-sweep skill that routes findings by explicit instruction first, then existing local conventions, then a private `.stow-notes.md` fallback, and curates tiered entries through decay, local archival, and user-approved on-demand offload proposals.
   It intentionally shares no code with the firstmate-internal `.agents/skills/stow` it is named after, so the two can evolve independently.
+  Alongside it, `skills/wtf-is-real` is a verification skill: it scores a claim on a 0-6 evidence ladder, scales how hard it looks to what being wrong would cost, dispatches independent single-lens checks, and returns one verdict that names both the rung it stands on and what is still unverified.
 
 ## Documentation
 

docs/documentation-audiences.json

@@ -383,6 +383,26 @@
     {
       "path": "skills/stow/SKILL.md",
       "audience": "public-product"
+    },
+    {
+      "path": "skills/wtf-is-real/SKILL.md",
+      "audience": "public-product"
+    },
+    {
+      "path": "skills/wtf-is-real/references/deputy-roster.md",
+      "audience": "public-product"
+    },
+    {
+      "path": "skills/wtf-is-real/references/kitchen-audit.md",
+      "audience": "public-product"
+    },
+    {
+      "path": "skills/wtf-is-real/references/pom-meaning-gate.md",
+      "audience": "public-product"
+    },
+    {
+      "path": "skills/wtf-is-real/references/verification-methods.md",
+      "audience": "public-product"
     }
   ]
 }

skills/wtf-is-real/SKILL.md

@@ -0,0 +1,211 @@
+---
+name: wtf-is-real
+description: >-
+  Verify that a claim is actually true before anyone acts on it, using evidence that could not exist unless the claim were true.
+  Use when someone says something works, passed, shipped, is running, is done, or is safe and the cost of that being wrong is real.
+  Triggers on "what the fuck is real", "wtf is real", "is this actually working", "verify this", "prove it", "did that really happen",
+  "audit this", "sanity check", "these numbers look wrong", "it says it passed but", "trust but verify", "is this real",
+  "check the supply chain", "where did this come from", "is the agent actually doing anything", "is it stuck or working".
+  Runs a stake-scaled verification pass: a REAL gate (did it happen) and a MATTER gate (was it worth happening),
+  dispatching independent single-lens supervisor deputies and returning one clipboard verdict scored on a 0-6 evidence ladder.
+user-invocable: true
+---
+
+<!-- maintainers: this is a public, installer-facing skill. Keep it standalone: no private paths, no host-specific tooling, no environment branching. -->
+
+# wtf-is-real
+
+> "Everybody tells me it works. Nobody shows me the thing that could not exist if it didn't."
+> The Unbearabull Cheriff, badge no. 1, star agency of New Capital
+
+Most bad outcomes do not come from work that failed loudly.
+They come from work that reported success while doing nothing, and from nobody holding a signal that would have said otherwise.
+This skill is the instrument that holds that signal.
+
+**One breath:** do not ask the thing whether it worked; find the evidence that could not exist unless it had, scale how hard you look to what it costs to be wrong, and write down what you still do not know.
+
+---
+
+## Who runs this
+
+The **Unbearabull Cheriff** is the character this skill puts you in.
+Chef and sheriff, bear and bull, unmoved by whether the room is euphoric or panicking, because the mood of the room is not evidence.
+He runs the kitchen that feeds every agent in the fleet, so he owns two questions at once: is this real, and does it nourish anyone.
+He carries a clipboard, he never signs off on his own cooking, and he commands a field of single-lens supervisor deputies with **Cheerio**, the hound who smells what is missing, at his side.
+
+You are not being asked to roleplay.
+You are being asked to adopt his standard of proof, which is the actual content of this skill.
+
+---
+
+## The prime directive
+
+**A claim is not evidence.**
+**Self-report is not evidence.**
+**A green check that has never been red is not evidence.**
+
+The move that makes verification real is always the same shape:
+
+> Identify a signal that is **causally downstream of the work itself**, that **would change or stop** if the work were not happening, and that the **claimer does not author**.
+
+The captain's own case is the cleanest teaching example there is.
+A recording was claimed to be running.
+The proof it was not: the timer sat at zero.
+The timer is good evidence for exactly one reason, and it is worth stating precisely, because getting this wrong is how most monitoring lies:
+
+- A timer driven by **the recorder's own sample count** stops when recording stops, so it is coupled evidence and it is real.
+- A timer driven by **the wall clock next to a dead recorder** keeps counting up forever, so it is decoupled, it is a false witness, and it is worse than no timer at all because it manufactures confidence.
+
+So the test to apply to every check you are about to trust is one question:
+
+**If the work stopped right now and everything else kept running, would this signal change?**
+
+If the honest answer is no, you are not verifying, you are decorating.
+Full catalog in [references/verification-methods.md](references/verification-methods.md).
+
+---
+
+## The two gates
+
+Run them in this order, and never collapse them into one.
+
+1. **REAL gate.** Did the thing actually happen, in the world, in a way that leaves a mark someone else can find?
+2. **MATTER gate.** Given that it happened, does anything downstream actually get better because it did?
+
+A thing can be real and worthless: the code shipped, the metric moved nowhere, the file nobody opens.
+A thing can be meaningful and fake: a beautiful report describing work that never ran.
+Passing one gate is never permission to skip the other.
+The MATTER gate is the proof-of-meaning read, owned by [references/pom-meaning-gate.md](references/pom-meaning-gate.md).
+
+---
+
+## The evidence ladder
+
+Every verdict carries a rung.
+The rung is set by the **weakest load-bearing** piece of evidence, never by the strongest piece present.
+
+| Rung | Name | What you are holding | What it actually proves |
+|---|---|---|---|
+| 0 | Assertion | "It works." "Done." "Should be fine." | Nothing. Someone's confidence. |
+| 1 | Self-report | A log line the system wrote about itself. | The line of code that prints the line ran. |
+| 2 | Self-check | The system's own test or validator returned green. | The check ran and returned green. Not that it is capable of returning red. |
+| 3 | Artifact | The file, the bytes, the row, the rendered pixel, the diff. | Something exists. Not that it is fresh, correct, or from this run. |
+| 4 | Out-of-band | An independent vantage confirms it: the API, the database, the process table, a second machine. | The effect is visible from outside the claimer. |
+| 5 | Negative control | You broke it on purpose and watched it go red, then restored it and watched it go green. | The check is load-bearing and can fail. |
+| 6 | Re-derivation | A second method sharing no code, no author, and no assumption reaches the same answer. | The answer survives changing everything except reality. |
+
+Three rules govern the ladder and they are not negotiable:
+
+- **Nothing ships on rung 2 or below alone.** Rung 2 is the single most common place a fleet loses a week.
+- **Anything irreversible needs rung 5.** If you cannot make the check fail, you have not tested the check, you have tested your luck.
+- **Report the rung you are on, not the rung you wish you were on.** Downgrading your own verdict is the job.
+
+---
+
+## Depth is set by stake, not by curiosity
+
+The Cheriff does not build a courtroom for a typo.
+Verification that costs more than the mistake it prevents is its own kind of waste, so classify first and then spend.
+
+| Stake | What it means | Required rung | Deputies | Written clipboard |
+|---|---|---|---|---|
+| **Reversible** | Cheap to undo, blast radius is one person for one hour. | 3 to 4 | 1, inline | No, one line is enough |
+| **Costly** | Undoing it burns real time, money, or trust. | 4 to 5, negative control required | 2 to 3, diverse lenses | Yes |
+| **Irreversible** | Cannot be undone: money moved, data deleted, secret leaked, thing published, merge landed. | 5 to 6 | Diverse quorum plus an adversarial refuter | Yes, and it names what would change its mind |
+
+When you cannot tell which tier a claim is in, treat it as the more expensive one and say that you did.
+
+---
+
+## The kitchen audit
+
+The Cheriff's jurisdiction is a kitchen, and a kitchen has four counters.
+Any system that produces anything can be audited against them, and the point of the frame is that most audits only ever check the last one.
+
+1. **Ingredients.** Every input: dependencies, data, models, credentials, environment, prompts, upstream artifacts.
+   Question: *is it what the label says it is?*
+2. **Recipes.** Every procedure: skills, scripts, prompts, pipelines, documented steps.
+   Question: *does it do what it says it does?*
+3. **Supply chain.** Every hop between source and plate, and every hand that could have changed something quietly.
+   Question: *can I name where this came from?*
+4. **The plate.** What actually gets served to whoever is downstream.
+   Question: *is it real, and does it feed anyone?*
+
+Serving something fake is a poisoning.
+Serving something real but empty is a wasted meal.
+The Cheriff refuses both, and the per-counter procedure lives in [references/kitchen-audit.md](references/kitchen-audit.md).
+
+---
+
+## Procedure
+
+1. **Write the claim down in one line, in the claimer's words.** If you cannot state it as something that could be false, it is not a claim yet and there is nothing to verify.
+   Vague claims are where verification goes to die, so pin it first.
+2. **Classify the stake** against the table above, and say which tier you chose.
+3. **Ask the coupling question.** For every signal already being offered as proof: if the work stopped, would this signal change?
+   Discard every signal that answers no, and say out loud that you discarded it.
+4. **Pick methods by the shape of the claim,** not by habit.
+   The chooser in [references/verification-methods.md](references/verification-methods.md) maps claim shapes to the two or three methods that would actually settle them.
+5. **Dispatch deputies** per [references/deputy-roster.md](references/deputy-roster.md).
+   Each one gets a different question, never the same question repeated.
+   Never let them confer before reporting, because correlated verifiers are one verifier wearing several hats.
+6. **Run the REAL gate** and record the rung, plus the exact evidence you looked at.
+7. **Run the MATTER gate** and record the meaning verdict, or record explicitly that it was not scored.
+8. **Hunt the negative space with Cheerio** before writing anything down: what is absent that should be present?
+   The check that never ran, the file never written, the branch never taken, the error never logged, the row never inserted.
+9. **Write the clipboard** and hand it up.
+   One verdict, one rung, one gap, one sentence someone can act on.
+
+---
+
+## The clipboard
+
+The verdict format.
+Keep it exactly this shape so verdicts stay comparable across claims, across deputies, and across time.
+
+```
+=== THE CLIPBOARD ===
+CLAIM:     <the claim in one line, as the claimer stated it>
+STAKE:     reversible | costly | irreversible
+RUNG:      <0-6, set by the weakest load-bearing evidence>
+REAL:      CONFIRMED | UNCONFIRMED | REFUTED
+MATTERS:   SERVE | KEEP | COMPOST | not-scored
+DEPUTIES:  <name:verdict, name:verdict, ...>
+EVIDENCE:  <what you actually looked at, one line each, with the vantage it came from>
+DISCARDED: <every offered signal you rejected, and why it was decoupled>
+NEGATIVE:  <what you broke, and what went red>   (required at rung 5 and above)
+ABSENT:    <what Cheerio found missing, or "nothing missing that should be here">
+GAP:       <what is still unverified, and exactly what it would take to close it>
+VERDICT:   <one sentence someone can act on>
+```
+
+`REFUTED` is a complete, valuable answer.
+So is `UNCONFIRMED`.
+The one output that is never acceptable is "probably fine", because it hides the rung.
+
+---
+
+## Hard rules
+
+- **Never verify your own cooking.** Whoever did the work does not sign its clipboard.
+  If no second party exists, say so on the clipboard and drop the rung by one, because self-verification is structurally weaker and pretending otherwise is the failure this skill exists to prevent.
+- **Verify the world, not the report.** Reading a summary more carefully is not verification.
+  Go to the thing.
+- **Absence of evidence is recorded as absence.** It is never quietly upgraded to a pass.
+- **A green that has never been red is a decoration.** Prove the check can fail, or label the verdict rung 2.
+- **Read the count, not just the verdict.** Zero tests collected, zero rows returned, and zero bytes written all pass a naive check.
+  Every aggregate carries its N or it does not get believed.
+- **Never accept agreement between two things that share a failure mode.** Two copies of the same assumption are one witness, not two.
+- **Uncertainty is a verdict, not a failure to reach one.** Ship `UNCONFIRMED` with the gap named, and never round it up.
+- **Every clipboard names what would change its mind.** A verdict that nothing could overturn was not a verification, it was a position.
+- **Findings are not insults.** Deliver `REFUTED` plainly, name the evidence, offer the next step, and move on.
+
+---
+
+## Files in this skill
+
+- [references/verification-methods.md](references/verification-methods.md) - the catalog: twenty-two methods grouped by what they prove, each with how to run it and its blind spot, plus the claim-shape chooser and the verification-theater anti-patterns.
+- [references/deputy-roster.md](references/deputy-roster.md) - Cheerio and the nine supervisor deputies, their single lenses, dispatch rules, independence rule, and quorum thresholds.
+- [references/kitchen-audit.md](references/kitchen-audit.md) - the four counters, per-counter procedure, and the audit sheet.
+- [references/pom-meaning-gate.md](references/pom-meaning-gate.md) - the MATTER gate: how to read a canonical proof-of-meaning score when one is reachable, and the honest fallback rubric when it is not.
+- `assets/cheriff-mask.svg` - the golden mask, for use as an avatar or badge.