Surface witness

SurfaceWitness

The instrument that made a surface must not be its only critic. Audit the product users can perceive, not the maker's story about it, and report evidence without converting model taste into fact.

Why this exists

Surface work commonly passes its own review because the maker remembers the intent, sees the design tokens, and recognizes every compromise. A user sees only the rendered hierarchy, interaction, language, and failure states. That gap lets generic library residue, desktop-only thinking, and vanished identity survive behind a persuasive implementation narrative.

SurfaceWitness introduces a separate witness and a re-runnable audit. Its job is not to prefer novelty or impose one aesthetic. Its job is to test whether the visible product still expresses its own declared rules and to expose where a human judgment remains necessary.

The core move: witness the artifact, then test the claim

1. Establish the witness. Use the strongest practical independence for the stakes: another vendor or model, a fresh adversarial context without maker narrative, a different measurement method, artifact-only checks, or honestly disclosed self-reviewed-only. Never imply independence that did not exist.
2. Collect artifact-first inputs. Inspect the rendered or executable product, its surface constitution, relevant state manifest, genealogy/default debt, responsive claims, and acceptance criteria. Treat missing inputs as audit limitations, not permission to infer them.
3. Run the relevant convergence tests. Apply the nine tests in references/convergence-tests.md. Mark irrelevant tests with a reason; do not fill a quota. A conventional utility control is not a defect merely because it is conventional.
4. Classify evidence. Distinguish rendered observation, executed interaction, implementation trace, constitution mismatch, suspected convergence, human verdict required, and not testable. A stronger-sounding grade never substitutes for stronger evidence.
5. Attempt refutation. Search for counterevidence and legitimate explanations such as accessibility, platform convention, low identity load, or an intentional exception. Mark a disproved finding withdrawn; do not erase it.
6. Route the result. Send implementation mismatches to remediation, documented forks to an operator decision, and irreducibly perceptual questions to a blank human-verdict field. Re-run affected checks after correction.

Write the audit using references/surface-audit-format.md. Use references/evidence-and-human-verdicts.md for evidence grades, refutation, and operator gates.

Hard boundaries

• Do not self-certify silently. If the maker and witness are the same model, context, and method, record self-reviewed-only and lower confidence accordingly.
• Do not fabricate perception. Never record distinctive, beautiful, on brand, or ready to ship as confirmed facts without the operator's actual verdict.
• Do not treat convention as convergence automatically. Evaluate identity load, utility, accessibility, platform expectations, and declared default debt before calling a default a defect.
• Do not audit source alone when a surface can be rendered. Source traces intent; the rendered artifact shows the product.
• Do not delete refuted findings. Withdrawals are evidence that the audit attempted to disprove itself.

Output contract

Produce a re-runnable audit with the input artifact, method, evidence, finding status, grade, affected constitution rule, counterevidence, remediation or decision route, and any pending human question. Use schemas/surface-audit.schema.json where the repository adopts the portable schema; otherwise follow the repository's local format without rewriting it into this one.

The audit may honestly end with no confirmed defects, unresolved human questions, or not testable in current environment. Its purpose is a true account, not a red one or a green one.

Optional composition

SurfaceWitness is standalone. It can consume a SurfaceCharter constitution, a Statewright manifest, and SurfaceGenealogy records when they exist. SecondInstrument can strengthen maker/witness separation; ReleasePreflight can route pre-release surface findings; PassClose can record what was actually checked. None is required for this skill to function.

Adapting across agents

The discipline depends on artifacts and evidence classes, not a vendor. In any harness, keep the witness context separate where practical, provide the same raw inputs, disclose the independence level, and retain pending operator verdicts unchanged.

A note on this file

Keep the routinely loaded rule set here. Put audit templates, test mechanics, and evidence worksheets in references/. Add a rule only when it prevents a distinct false surface claim or preserves a real operator judgment.