human_confirmed: true started as a self-declared field in a YAML ledger. Nothing distinguished a considered approval from a reflexive one; nothing distinguished either from a script that happened to write true because that was the path of least resistance. And runs a human never got back to didn’t just sit unconfirmed. Three of four real attempts in one live smoke test left no ledger entry at all. A field that measures typing the word “true” is not the same thing as a field that measures review.
The ladder, one rung at a time
Each weakness got fixed as its own, dated, separately-justified step, not as one big redesign. A review script built the return path: interactive-only, refusing outright if there’s no live terminal attached, so no automated process can approve anything by accident or design. The decline-ledger fix made refused and abandoned runs write status: declined entries instead of nothing, closing the exact gap that had let three of four real attempts vanish. Worktree isolation put the actual diff inside the approval moment itself: review now means looking at real, applied-nowhere-yet code, and approving means applying it from that same worktree, not trusting a description of what an engine claims it did.
What “grew up” actually means here
By the time this reached its current shape, an approval wasn’t a bare flag anymore. It was a recorded act: the reviewer’s own note captured alongside the decision, the diff that was actually reviewed traceable to the exact worktree that produced it, and a full accounting of outcomes beyond “approved”: declined, abandoned, and still-pending all exist as distinguishable, queryable states instead of collapsing into either “true” or “the ledger says nothing at all.” The four-rung ladder this arrived at works as a self-assessment for any approval gate, not just this one: a bare boolean; an interactive-only queue that can’t be approved by automation even by accident; evidence-in-view review where the artefact under approval is the actual thing that gets applied; and negative-outcome states recorded as audit records, not silence.
What next
The same instinct, that a claim only counts once there’s evidence behind it, not just a flag saying so, is the subject of the arc’s closing post: what it actually took to separate the claim that a piece of machinery works from the much harder claim that the mission it was built for has actually succeeded.
What Next
Two Gates, Two Claims
'The machinery is correct' and 'the mission succeeds' sound like the same claim. Splitting them into two named gates with two different evidence bars is what kept a comprehensive test suite from quietly standing in for real-world proof.