Step 7 · Operations evidence · Operations evidence · Proof gates and independent validation PT-BREN
CLIProxyAPI 7.2.70 · kimi-k3 · Visual course

Proof gates and independent validation

A beautiful configuration is not proof; every gate asks for an observation that cannot be forged by a static list.

Read first (primary source)
CONFIG-MODEL-POLICY-EVIDENCE.md

A redacted local record for the running gateway and the kimi-k3 example.

Read the simple version or open technical detail in any section.
1

Big idea


A beautiful configuration is not proof; every gate asks for an observation that cannot be forged by a static list.

Think of it as… Think of three stamps: scope asks whether the delivery exists, boundary asks whether it works, and validator asks whether another reader agrees. A stamp does not do the work; it records the check..

Under the hood

Scope requires 13 models and real K3; proof requires sentinels and HTTP JSON; an independent validator separates upstream limits from local failures and retains failed attempts.

2

In one picture


01 · scope contractscope contractgovernsanti-cheating ruleScope does not accept a static mock.
scope contract — governs — Scope does not accept a static mock.
3

In the code


This is the real local path and a safe read-only command.

GOAL.md
# trecho real, não editado
node --check validation-harness/validate-gateway-full-window.mjs
node course/scripts/validate-course.mjs

Open it yourself

node --check validation-harness/validate-gateway-full-window.mjs node course/scripts/validate-course.mjs

4

Try it


Use the controls to retrieve the evidence before reading the explanation.

02 · anti-cheating ruleanti-cheating rulematcheslive model boundaryA sentinel separates 200 from semantic success.
anti-cheating rule — matches — A sentinel separates 200 from semantic success.
03 · live model boundarylive model boundaryroutes tounique sentinelValidator separates external limit from local error.
live model boundary — routes to — Validator separates external limit from local error.
04 · unique sentinelunique sentinelexcludesusage recordScope does not accept a static mock.
unique sentinel — excludes — Scope does not accept a static mock.
05 · usage recordusage recordprovesimage JSON 503A sentinel separates 200 from semantic success.
usage record — proves — A sentinel separates 200 from semantic success.
06 · image JSON 503image JSON 503boundsnear-cap evidenceValidator separates external limit from local error.
image JSON 503 — bounds — Validator separates external limit from local error.
07 · near-cap evidencenear-cap evidencemaps tofailed attempt retentionScope does not accept a static mock.
near-cap evidence — maps to — Scope does not accept a static mock.
08 · failed attempt retentionfailed attempt retentionrestarts asconfiguration parityA sentinel separates 200 from semantic success.
failed attempt retention — restarts as — A sentinel separates 200 from semantic success.
09 · configuration parityconfiguration paritypreservesservice listenerValidator separates external limit from local error.
configuration parity — preserves — Validator separates external limit from local error.
10 · service listenerservice listenercompares withindependent reviewerScope does not accept a static mock.
service listener — compares with — Scope does not accept a static mock.
11 · independent reviewerindependent reviewerreturnsupstream limitationA sentinel separates 200 from semantic success.
independent reviewer — returns — A sentinel separates 200 from semantic success.
12 · upstream limitationupstream limitationconfirmslocal defect classificationValidator separates external limit from local error.
upstream limitation — confirms — Validator separates external limit from local error.
13 · local defect classificationlocal defect classificationqualifiesscope contract verification recordScope does not accept a static mock.
local defect classification — qualifies — Scope does not accept a static mock.
14 · scope contract verification recordscope contract verification recordrecordsscope contractA sentinel separates 200 from semantic success.
scope contract verification record — records — A sentinel separates 200 from semantic success.

Three-frame summary

1 State a measurable finish line
2 Exercise the real boundary
3 Ask an independent validator
Scope requires 13 models and real K3; proof requires sentinels and HTTP JSON; an independent validator separates upstream limits from local failures and retains failed attempts.
Record the observation, preserve the exception, and choose the next narrow proof.
retrieveScope gateclick to flip
Scope does not accept a static mock.
retrieveBoundary gateclick to flip
A sentinel separates 200 from semantic success.
retrieveIndependent reviewclick to flip
Validator separates external limit from local error.
Predict before revealing

Why is HTTP 200 alone insufficient?

A 200 response can be unrelated; the expected sentinel establishes the requested semantic behavior.

Worked example
1Read the anti-cheating clause in GOAL.md.
2Compare live JSON with policy keys.
3Record an independent review that separates local and upstream limits.
Retrieval review
Why is HTTP 200 alone insufficient?

A 200 response can be unrelated; the expected sentinel establishes the requested semantic behavior.

Ask which boundary you would prove next; the next lesson narrows a different operational risk.