It turns a thesis into claims that can be checked.
crucible is the cognition organ of the constellation. Where gather brings evidence in and records how it was obtained, crucible tests what that evidence supports. A thesis is registered as claims, each with its falsification condition and a content hash. The registry stores those bodies content-addressed, so tampering is caught by re-hashing the exact claim.
A witnessed assessment folds every per-claim verdict into a seal. Re-checking an assessment does not ask the engine whether it was honest; it re-derives the verdicts from the thesis and the measurements on disk. A confident assertion cannot fake the shape.
The output is a standing, not a vibe: what matched, what drifted, and what could not be measured.The loop is register, steelman, measure, refine, witness.
The verdict has no model in the deciding step.
A model can propose a refutation later, or an oracle can measure a substrate later, but the verdict step is a pure function. It receives a claim and a measurement. If the measurement is absent, mismatched, non-numeric, negative, or outside a positive tolerance, the result cannot silently become trust. It is UNVERIFIABLE or DRIFT.
A claim that cannot be measured is never read as holding.
That is why the refine loop matters. A short thesis does not get blessed. crucible reports the weakest claim and the cohesion trajectory, then gives the next round a precise place to improve: strengthen the substrate, sharpen the measurement, or amend the thesis.
A MATCH is not counted unless it can be re-checked.
A registry can read 100 percent MATCH and still be theater if every match rests on a deviation the author typed in. The integrity layer splits each latest MATCH by its provenance. crucible registry stats reports match_provenance as three counts: witnessed for a match whose measurement carries a replayable recheck descriptor, asserted for a match resting on an author-supplied deviation alone, and asserted_zero for the softest case, a claimed exact zero with nothing to replay.
$ crucible registry stats .crucible --require-witnessed-match match_provenance: witnessed 4 asserted 2 asserted_zero 1 refused: a latest MATCH rests on an asserted measurement with no replayable recheck (exit 1)
A confident number does not count as verification. Only a replayable one does.
The flag --require-witnessed-match turns the split into a check. It exits nonzero the moment any latest MATCH is asserted only, so a run that shows all green but has no executable refutation can no longer be cited as verified. The check reads the record; it does not ask the engine to vouch for itself.
An UNVERIFIABLE names what is missing and what to do.
A fail-closed verdict is only useful if it tells you why. When an assessment carries an UNVERIFIABLE claim, crucible assess adds an evidence needed section with one typed row per claim: the exact missing-evidence class and the concrete next action. The class is one of falsification_condition, measurement, claim_binding, trusted_deviation, or positive_tolerance, and the action is specific, such as the exact sha256 a measurement row must bind. A claim that verifies gets no row. The explanation is derived from the same pure ladder as the verdict, so it can never disagree with it.
Before assessment runs, a validation pass warns about rows that cannot produce a trustworthy verdict: a non-positive tolerance, a negative or non-finite deviation, a boolean that would silently coerce, a row bound to no claim, or a duplicate binding. The warnings are typed, printed to stderr, and carried in JSON. They never change a verdict, and --strict turns any warning into a nonzero exit. An ill-posed measurement is caught before it can be read as evidence, not after.
Standard library at the core. Impure edges behind seams.
The 1.2.0 line ships the claim and thesis receipts, the content-addressed registry, witnessed assessments, the steelman seam, the measure seam, the refine adapter over a thesis, drift tracking across witnessed rounds, measurement recheck descriptors, Gather/index interop, and Markdown assessment reports. The core has no third-party runtime dependency. Clocks are injected, JSON is canonical, and Null defaults keep the organ standing alone when a model, browser, or proof oracle is absent.
The command surface covers the whole loop and the checks around it: register, steelman, measure, and assess for the core path; run to tie the loop into one witnessed session and write a cleanroom review packet; review to validate that packet, spec plus artifact only, before it reaches a verifier; registry for stats, search, and the MATCH-provenance check; recheck to replay descriptor-bearing measurements through an oracle; and drift, report, batch, export, measurement-gate, and verdicts around them. The same surface is reachable from a clone with python -m crucible and over the native MCP bridge.
$ crucible run examples/thesis-binary-search.json \ --measurements examples/measurements-binary-search.json \ --registry .crucible --bundle reports/binary-search-run MATCH 1 DRIFT 1 UNVERIFIABLE 1 (witnessed, recheck on disk) $ crucible review reports/binary-search-run cleanroom packet valid: spec + artifact only, verifier boundary intact $ crucible refine examples/refine-discovery-loop.json refined thesis "Discovery loop margins" over 2 round(s): correct
crucible review holds the cleanroom line. A verifier gets the original spec and the artifact, nothing else: no worker context, no reasoning trace, no chat log. The check fails closed if the packet carries extra context, if spec.json no longer matches the run record, if report.md does not re-render from run.json, or if the artifact paths are rewritten away from the packet-relative contract.
Current state. What is honest to claim.
The public repo is a versioned 1.2.0 judgment package: the register-through-witness loop, drift tracking, thesis adapter, measurement rechecks, Markdown reports, one-command runs, cleanroom review, the MATCH-provenance check, missing-evidence explanations, ill-posed measurement warnings, the full CLI, a native MCP bridge, README, architecture note, and changelog. Its core loop is tested and published to PyPI as crucible-bench (pip install crucible-bench) via OIDC trusted publishing. The next increments can move in parallel while the wider Telos outreach asks for verification, testing, traction, and research support.
Watch the recorded workflow: the same three-claim thesis moves from 1 MATCH / 2 DRIFT to 3 MATCH / 0 DRIFT, both cleanroom packets pass, and the final verdict is re-derived from disk.