Contract-Claim Assurance

A contract can be structurally valid and still be wrong about risk, safety, or proof breadth.

Ota therefore keeps the maintainer-authored claim separate from observable evidence and from policy admission.

unknown is essential. Ota cannot prove omitted maintainer intent from nothing, and it must not turn absence of evidence into verified safety.

• declared safety remains a maintainer assertion plus closure enforcement
• claim assurance checks whether supported observable evidence agrees with that claim
• proof-breadth assurance consumes archived proof and not_proved[] truth rather than treating one green run as complete proof
• policy may require a specific assurance outcome, but policy does not redefine the canonical assurance taxonomy
• Doctor, policy evaluation, CI projection, and agent admission consume the same assurance result instead of each inventing a verdict

• read assurance.status as evidence posture, not as the policy decision
• read assurance.coverage[], gaps[], evidence[], and contradictions[] to understand the evaluator's basis
• read policy.decision and policy.basis[] separately when an active policy consumes the assurance record
• do not rename supported to a second machine taxonomy such as corroborated_safe

{  claim_assurance: [    {      subject: {        kind: "task",        name: "setup"      },      family: "agent_safety",      declaration: {        value: "safe",        evidence_class: "asserted"      },      closure: {        status: "safe",        evidence_class: "derived"      },      assurance: {        status: "unknown",        coverage: [          "contract_declaration",          "execution_closure"        ],        gaps: [          "non_self_origin_evidence"        ]      },      policy: {        decision: "allow",        basis: [          "default_compatibility"        ],        evidence_class: "derived"      }    }  ]}

• Ota can validate structure, inspect supported sources, detect contradictions, and enforce policy
• Ota cannot prove an omitted risk that leaves no observable trace
• supported does not mean repo-global correctness or complete security review
• unknown must remain visible when source coverage or instrumentation is incomplete