Control verification

actspan verify exercises supported local controls with deliberate request violations. It uses the native execution path and stops before provider, moderation, remote MCP or tool dispatch. It makes no model or remote tool calls.

Start Here

From an initialized workspace with a configured policy:

actspan verify workspace.yaml data_enrichment --format text

Expected: a scoped check report, paths to local evidence, and portal delivery status. Failed or incomplete protection returns a nonzero exit code.

The command preserves configured warning/blocking behavior. A policy that only warns does not pass a test that requires blocking. It first checks that an allowed baseline reaches admission, then tests configured model allowlists, output-token limits, temperature limits, and per-run estimated budgets when pricing permits. Each successful denial must contain the expected reason and stop before dispatch. A checker failure or unavailable pricing is not proof that the intended rule worked.

Workflow verification checks statically referenced prompt/agent admission boundaries. It does not execute branches, pauses or continuations. Local Python execution, roles, regions, daily budgets and release approvals are either explicitly unsupported by the probe suite or listed as limitations. For a tool-capable static node, the verifier now passes the effective workflow/node tool policy through the normal runtime filter and requests a deliberately forbidden tool. Approval-required nodes are also tried without approval. A check passes only when the typed denial occurs before native admission and dispatch.

Registry MCP tools use the normal runtime compiler twice: once for the configured baseline and once with a synthetic remote tool outside the server's allowed_tools. This verifies local registry and allowlist enforcement. It does not connect to the MCP server and therefore does not verify DNS, authentication, availability, remote authorization or retrieved content.

Results and CI

Exit codes: 0 for all checks passed, 1 when a check failed, 2 for incomplete verification or setup/publication errors. A workflow with unsupported branches does not become fully verified just because its model-admission checks pass.

The runtime required-control coverage gate has a separate contract. Its unsupported status means that the selected integration profile does not establish enforcement, while the verifier's status means its probe suite cannot exercise a check. Mandatory coverage gaps block dispatch; advisory gaps remain recorded warnings. This reference describes the supplied Actspan 0.2.0 runtime. Results from an older pilot do not replace verification against your current workspace and runtime.

Use --format json for the normal CLI envelope. Reports and an evidence package are saved under .actspan/verification/<verification-id>/. Use --output-dir to choose another directory.

Captured public-build example

The model-free budget fixture was run on October 22, 2026 with public CLI 0.2.0 executable SHA-256 02bd46192b7a85d52c6bc74879e628a8f78907337a491dccacb2bb709918ceb5. This excerpt omits local paths, identifiers and detailed policy metadata:

{
  "status": "incomplete",
  "checks": [
    {"control": "baseline", "status": "passed", "boundary_reached": true},
    {"control": "model_allowlist", "status": "passed", "boundary_reached": false},
    {"control": "output_token_limit", "status": "passed", "boundary_reached": false},
    {"control": "temperature_limit", "status": "passed", "boundary_reached": false},
    {"control": "per_run_budget", "status": "passed", "boundary_reached": false},
    {"control": "provider_allowlist", "status": "unsupported", "boundary_reached": false}
  ]
}

Counts: 5 passed, 0 failed, 1 unsupported, 0 unverified. The command exited 2, because a configured control was outside this probe suite. A positive baseline and the four expected denials do not erase that gap. Other configurations can produce unverified checks when no exercisable restriction or price is available; that status was absent from this captured fixture. This was a local probe run, not a live model or complete workflow qualification.

Portal evidence

With the normal portal connection configured, verification publishes the package automatically. --require-portal makes delivery mandatory; --no-portal keeps the result local. Optional delivery failures enter the existing portal outbox and can be retried with actspan portal sync. Required-delivery failures preserve local files and return an explicit error. If the optional outbox cannot be written, delivery is reported as failed rather than queued; the local report remains available.

Open Workspace → Artifacts → Revision evidence packages to review and download the manifest. Evaluation publication subsequently joins earlier verification for the same configuration identity. The locally saved package is replaced with the server's enriched package after successful delivery, so its hash matches the download. An offline/queued local package remains the local snapshot.

The fingerprint covers source configuration, selected policy files, provider lock, pricing and explicit evaluation overrides. It excludes resolved environment values, provider implementation bytes and remote knowledge contents. Policy identities in native checks come from the actual admission snapshot. Changes to local configuration during verification invalidate successful checks.

See revision evidence packages for completeness, privacy and release-identity boundaries. A digest proves content consistency; it does not certify that a client reported truthful results.

Local acceptance findings

Historical Planning Helper source-fixture finding (not a qualification of every current public2 file): the original policy had no admission.mode: block, so the default warning behavior allowed the deliberate model, token, temperature and budget violations through admission. The report correctly failed those blocking checks. Its configured workflow tool restriction and MCP remote-tool allowlist are now independently exercised and pass locally. Full graph and live MCP coverage remain unsupported. The original example was not silently modified.