# Public tests

Deterministic checks for Sigrún regenerations and public workers. Plain Python 3, standard library, no network, no account. Download the files next to each other and run them locally.

| File | What it is |
| --- | --- |
| [sigrun_check.py](sigrun_check.py) | The checker: `return`, `canon`, `swap` and `selftest` |
| [canon.json](canon.json) | Twelve public multiple-choice questions on the doctrine, with answers |
| [return.feature](return.feature) | Gherkin: when a RETURN block is accepted |
| [regenerate.feature](regenerate.feature) | Gherkin: the canon sheet and the swap test |
| [worker.feature](worker.feature) | Gherkin: what a public worker may and may not do |

```
python3 sigrun_check.py selftest            # the checker checks itself first
python3 sigrun_check.py return my-return.txt
python3 sigrun_check.py canon answers.json
python3 sigrun_check.py swap a.json b.json
python3 sigrun_check.py accept my-return.txt review.json
```

`accept` is the only step that says ACCEPTED. It needs a review record from a reader of another vendor family, as JSON: `return_sha256` (of the exact RETURN file), `builder_family`, `reviewer_family`, `effects_confirmed` (must equal the RETURN's effects), `reran` (a list naming each receipt or acceptance test the reviewer re-ran; blank entries fail) and `verdict` (exactly `ACCEPT`). Any other key, a repeated key or a NaN fails: the checker refuses what it cannot check. Answer sheets are read the same strict way. It records that an independent review happened; it cannot prove the reviewer was careful.

## What the checker catches and what it doesn't

`selftest` plants bad inputs in three tiers (easy, medium, hard) and fails unless it refuses every one. It also reports frontier controls: lies a format checker cannot see, such as a receipt that names output it never shows, or a READ label on a claim the agent never opened. Those need a reader from a different vendor and a re-run of the receipts. Passing these tests shows the format and the canon are right. It does not show the work is true.

The RETURN check fails closed. Two red-team rounds (2026-11-01) showed that scanning prose for forbidden verbs can always be dodged (contractions, other languages, idioms like "went live in prod") and also refuses honest lines like "Nothing was sent." So the checker no longer reads prose for acts. The fields that report outcomes must fit a grammar instead: `effects` is `none` or `local only`, every receipt is a typed `file`, `commit`, `cmd` or `link` item, and every label is `claim => READ|CLAIMED|UNKNOWN`. All 16 red-team lines fail in receipts and in effects. Put in a prose field, they pass the format and are listed for a reader; selftest reports that honestly as frontier, not caught. `FORMAT PASS` never means accepted. Semicolons inside backticks or quotes stay inside their receipt, so `cmd `head -5 a; tail -5 a` exit 0` is one item.

These are public tests only. A held-out test stops working once it is published, so the swarm's held-out and sealed tests are not here.