# Verify Claim

> Verify whether an agent's stated outcome ("I committed and pushed", "tests pass", "I cleaned up the temp dir", "deployment succeeded") matches actual filesystem / git / test state. Catches the chiefofautism failure mode (agent confidently misreports what it did) AND the Codex sandbox-escalation case (agent acknowledges read-only constraint then violates it). Use when you suspect an agent's comple…

- **Type:** Skill
- **Install:** `agentstack add skill-temurkhan13-aufgaard-verify-claim`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [temurkhan13](https://agentstack.voostack.com/s/temurkhan13)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [temurkhan13](https://github.com/temurkhan13)
- **Source:** https://github.com/temurkhan13/aufgaard/tree/main/skills/verify-claim

## Install

```sh
agentstack add skill-temurkhan13-aufgaard-verify-claim
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Verify Claim (output-action divergence check)

Compare an agent's stated outcome against actual state. Returns one of: STATE_MATCHES_CLAIM (agent told the truth), STATE_UNCHANGED (claimed action but nothing happened), STATE_VIOLATED_CONSTRAINT (action happened but violated stated constraint), STATE_MISMATCH (action happened but differently than claimed).

## What to do

1. Parse `$ARGUMENTS` for the claim text. The first quoted string is the claim. Optional `--before-snapshot=` argument loads a previously-captured before-snapshot if available.
2. If no before-snapshot is provided, attempt to infer one from recent context: check git log, recent file mtimes, recent test runs.
3. Call `mcp__openclaw-output-vetter__verify_action_outcome` with:
   - `claim`: the claim text
   - `before_snapshot`: the loaded snapshot (or empty if inferring from current state)
   - `after_snapshot`: take fresh snapshot of relevant paths NOW
4. Render the verdict.

## Verdict rendering

### STATE_MATCHES_CLAIM (agent told the truth)

```
> ✅ **VERIFIED** — claim matches actual state
> **Claim:** ""
> **Evidence:**
> - 
> - 
> **Confidence:** HIGH/MEDIUM/LOW based on snapshot completeness
```

### STATE_UNCHANGED (action claimed but nothing happened)

```
> 🔴 **UNCHANGED** — claim says action happened, state shows it didn't
> **Claim:** ""
> **What's missing:**
> - 
> - 
> **What likely happened:** 
> **Action:** Re-run the action, watch for hook / permission / sandbox errors. Run `/aufgaard:verify-claim` again after.
```

### STATE_VIOLATED_CONSTRAINT (Codex-style)

```
> 🔴 **CONSTRAINT VIOLATED** — agent acknowledged a constraint then violated it
> **Claim:** ""
> **Stated constraint:** 
> **Actual violation:** 
> **Severity:** CRITICAL — this is the alignment-relevant failure mode
> **Action:** Roll back the unauthorized changes via `git restore`. Investigate why the constraint was violated — sandbox-escape bug? prompt overrride? agent-config attack? Use `/aufgaard:vet-config` on agent-config files to rule out poisoning.
```

### STATE_MISMATCH (action happened but not as claimed)

```
> 🟡 **MISMATCH** — action happened, but differently than claimed
> **Claim:** ""
> **What's different:**
> - 
> **Likely cause:** 
> **Action:** Reconcile — either accept the actual state and update downstream consumers, or roll back and try the original claim again.
```

## ACTION_OUTCOME rule families (8 rules in output-vetter v1.1+)

- **ACTION_OUTCOME.STATE_UNCHANGED** — claimed action, no diff
- **ACTION_OUTCOME.STATE_VIOLATED_CONSTRAINT** — read-only / sandbox / approval-gate breached
- **ACTION_OUTCOME.MISSING_FILE** — claim references a file that doesn't exist
- **ACTION_OUTCOME.MISSING_COMMIT** — claim references commit that's not in git log
- **ACTION_OUTCOME.MISSING_TEST_RESULT** — claim "tests pass" but no test run found
- **ACTION_OUTCOME.PARTIAL_DIFF** — diff exists but doesn't include claimed changes
- **ACTION_OUTCOME.UNINTENDED_DIFF** — diff includes changes outside claimed scope
- **ACTION_OUTCOME.SCOPE_DRIFT** — actual scope of change is wider than claimed

Cite the actual rule returned. The catalog above is reference.

## Style notes

- Be specific about the evidence. "git log has no commits" beats "git status looks unchanged."
- For STATE_VIOLATED_CONSTRAINT, treat as CRITICAL and recommend immediate rollback. This is the chiefofautism / Codex-class incident pattern.
- For STATE_UNCHANGED, the most useful diagnostic is usually "did a hook / permission / sandbox block the action silently?" — bias the recommendation toward checking those layers.

## Edge cases

- If no before-snapshot can be inferred (fresh session, no recent activity), state: "No before-snapshot available. Verifying against current state alone — limited confidence. For higher confidence on future verifies, the PreToolUse hook captures snapshots automatically when the plugin is fully active."
- If `$ARGUMENTS` is empty: "Pass the agent's claim as a quoted argument: `/aufgaard:verify-claim 'I committed the fix and pushed to main'`"
- If output-vetter MCP not loaded: "output-vetter MCP not available. Verify `pip install openclaw-output-vetter-mcp` and the plugin is loaded."
- If the claim is too vague to verify (e.g. "I improved the code"), respond: "The claim is too vague for state-based verification. Re-ask the agent to state a specific verifiable claim — file modified, commit hash, test name passed, etc."

## Footer CTA

```
---
Output-action divergence (P6.y) is one of 35 documented production-AI failure patterns. The [Production-AI MCP Suite Bundle](https://temurah.gumroad.com/l/production-ai-mcp-suite) ($29) includes the 8-page Field Reference PDF — covers the chiefofautism viral case + Codex sandbox-escalation + 698 real-world scheming incidents from the CLTR study (Oct 2025 - Mar 2026).
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [temurkhan13](https://github.com/temurkhan13)
- **Source:** [temurkhan13/aufgaard](https://github.com/temurkhan13/aufgaard)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-temurkhan13-aufgaard-verify-claim
- Seller: https://agentstack.voostack.com/s/temurkhan13
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.