# Evidence and limits

Web Studio uses four evidence states so presentation never outruns the
implementation.

| State | Meaning |
|---|---|
| **Automated** | A local deterministic check exercises the claim. |
| **Witnessed** | A human or browser record confirms environment behavior. |
| **Illustrative** | An example demonstrates artifact shape, not a live run. |
| **Pending** | A claim requires an environment, integration, or event not present here. |

## Current ledger

| Claim | State | Receipt |
|---|---|---|
| Unsigned project writes are blocked in hook mode | Automated | `tests/direction-gate.test.js` |
| Signed project writes pass | Automated | `tests/direction-gate.test.js` |
| Empty declarations reject and malformed gates fail closed | Automated | `tests/direction-gate.test.js` |
| Visual report classifies overflow, clipping, broken images, and tap size | Automated | `tests/visual-checks.test.js` |
| Repository artifacts and links conform to the local contract | Automated | `scripts/validate-repo.js` |
| Run receipts reject malformed, reordered, mixed, false-complete, and post-halt records | Automated | `scripts/validate-run.js`, `tests/run-validator.test.js` |
| Signal Desk evidence binds artifact hashes, browser reports, model receipt, memory metadata, Pages result, cost receipt, and recovery lineage | Automated | `scripts/verify-signal-desk-evidence.js` |
| The hook blocks and later allows a write inside live Claude Code sessions | Witnessed | `docs/evidence/2026-07-23-live-claude-gate-witness.md` |
| The visual checker runs on served hostile, clean, and Signal Desk pages | Witnessed | `docs/evidence/2026-07-23-signal-desk-browser-witness.md` |
| Managed installation and doctor succeed without overwriting unmanaged files | Witnessed | `docs/evidence/2026-07-23-install-doctor-witness.md` |
| Media-free and self-review degraded records remain explicitly disclosed | Automated | `docs/evidence/2026-07-23-degraded-mode-fixtures.md` |
| A complete deployed recovery/release run with a separate-model review succeeds | Witnessed | `docs/evidence/runs/2026-07-23-signal-desk-release.jsonl`, recovery provenance, live URL, and cost receipt |
| Meridian Coffee was generated and deployed by the workflow | Illustrative | Explicit labels in `examples/meridian-coffee/` |

## Run the automated evidence

```bash
npm test
npm run validate
```

No dependency installation or network access is required.

## Live direction-gate witness

1. Install and register the hook using `SETUP.md`.
2. Open a new Claude Code session.
3. Initialize a disposable project gate.
4. Attempt a `Write` through Claude Code and capture the denied hook response.
5. Sign a non-empty direction, retry, and capture the allowed write.
6. Remove the disposable directory. Do not reuse a client project for this
   witness.

The dated witness includes Claude Code version, platform, sanitized real client
events, direct hook input/output, exit behavior, and limitations. Future clients
or versions must repeat this protocol rather than inheriting the claim.

## Browser review witness

Serve a project over HTTP, run `scripts/visual-checks.js` at 375px and 1280px,
collect console errors separately, and visually inspect both renders. Store the
findings in the project run record. A clean unit test only validates the report
logic; it says nothing about a page that was not loaded.