# Controller Verification

## Recomputed metrics

| Check | Command | Expected | Actual | Result |
|---|---|---|---|---|
| raw_file_count | python3 .../process/controller_verify.py | 38 | 38 | PASS |
| raw_line_count | same | observed | 10,649 | PASS |
| matrix_row_count | same | 38 | 38 | PASS |
| matrix_path_set | same | missing=0, extra=0 | 0, 0 | PASS |
| duplicate_paths | same | 0 | 0 | PASS |
| nonexistent_paths | same | 0 | 0 | PASS |
| malformed_matrix_rows | same | 0 | 0 | PASS |
| READ_FULL / BLOCKED | same | 38 / 0 | 38 / 0 | PASS |
| per_file_sections | same | 38 | 38 | PASS |
| lane_finding_count / unique | same | 60 / 60 | 60 / 60 | PASS |
| duplicate / missing finding IDs | same | 0 / 0 | 0 / 0 | PASS |
| finding_schema_failures | same | 0 | 0 | PASS |
| sed_proof_rows / unique | same | 60 / 60 | 60 / 60 | PASS |
| quote commands / failed | python3 .../process/verify_quotes.py | greater than 0 / 0 | 107 / 0 | PASS |
| verified quote output lines | same | at least 120 | 158 | PASS |
| adversarial rows / unique | controller_verify.py | 60 / 60 | 60 / 60 | PASS |
| adversarial generic hits | same | 0 | 0 | PASS |
| unresolved priority IDs | same | 0 | 0 | PASS |
| broken internal links | same | 0 | 0 | PASS |
| forbidden word hits | same | 0 | 0 | PASS |
| missing required artifacts | same | 0 | 0 | PASS |
| Decision Evidence Map files | same | 38 | 38 | PASS |
| Claims Extracted files / missing | same | 38 / 0 for full Claim traceability | 2 / 36 | FAIL |
| UNSUPPORTED_DECISION files / occurrences | same | reported | 32 / 125 | PASS |
| BROKEN_CLAIM_REFERENCE literal labels | same | reported | 0 | PASS |

## Exact observed output — quote validation

~~~text
$ python3 docs/superpowers/specs/2026-07-18-keycloak-branch-note-consistency/process/verify_quotes.py
inventory_rows=38
inventory_unique=38
read_full=38
finding_ids=60
expected_finding_ids=60
commands_passed=107
commands_failed=0
verified_output_lines=158
findings_without_commands=0
~~~

## Exact observed output — controller validation

~~~text
$ python3 docs/superpowers/specs/2026-07-18-keycloak-branch-note-consistency/process/controller_verify.py
raw_file_count=38
raw_line_count=10649
matrix_rows=38
read_full_rows=38
blocked_rows=0
missing_paths=0
extra_paths=0
duplicate_paths=0
nonexistent_paths=0
malformed_matrix_rows=0
lane_finding_count=60
unique_finding_ids=60
duplicate_finding_ids=0
missing_finding_ids=0
finding_schema_failures=0
per_file_sections=38
sed_proof_rows=60
sed_proof_unique_ids=60
adversarial_rows=60
adversarial_unique_ids=60
adversarial_generic_hits=0
priority_unique_ids=17
unresolved_priority_ids=0
broken_internal_links=0
forbidden_word_hits=0
missing_required_artifacts=0
decision_evidence_map_files=38
claims_extracted_files=2
missing_claims_extracted=36
unsupported_decision_files=32
unsupported_decision_occurrences=125
broken_claim_reference_literal_occurrences=0
~~~

## Deterministic consistency checker

| Metric | Observed |
|---|---:|
| Repository files | 102 |
| Repository findings | 144 |
| BARE_OWNER_REF | 74 |
| BARE_DECISION_REF | 70 |
| Keycloak-scope BARE_DECISION_REF | 8 |
| Keycloak-scope DANGLING_DECISION_REF | 0 |
| Keycloak-scope DANGLING_SECTION_REF | 0 |
| Keycloak-scope exact DUAL_OWNERSHIP | 0 |

## Nine gates

| Gate | Expected | Actual | Result |
|---|---|---|---|
| scope_gate | path sets equal, duplicate=0, nonexistent=0 | 38=38, 0, 0 | PASS |
| matrix_gate | 38 valid four-column rows and allowed status | 38 valid, READ_FULL=38 | PASS |
| finding_gate | 38 file sections, 60 unique IDs, full finding schema, Claim traceability | 38, 60, schema failure=0, Claims Extracted missing=36 | FAIL |
| quote_gate | one VERIFIED proof row per finding and source output | 60 rows, 158 output lines | PASS |
| adversarial_gate | 60 substantive rows, no generic rows | 60, generic=0 | PASS |
| priority_gate | each referenced ID exists | unresolved=0 | PASS |
| link_gate | all internal Markdown links resolve | broken=0 | PASS |
| language_gate | forbidden terms outside quoted source=0 | 0 | PASS |
| artifact_gate | master, two root files, six subfolder files exist | missing=0 | PASS |

## Claim traceability status

| Metric | Value | Interpretation |
|---|---:|---|
| Decision Evidence Map | 38/38 | branch decision tables present |
| Claims Extracted | 2/38 | 36 files require migration or equivalent source-claim audit |
| UNSUPPORTED_DECISION | 125 occurrences in 32 files | labels reported; label presence alone is not a defect |
| BROKEN_CLAIM_REFERENCE literal | 0 | absence of the label does not prove every target resolves |
| Lane 2 lexical sample | 152/153 IDs resolved | KC-HOST-C6 is the one unarchived candidate and was not supporting evidence |

## Verdict

| Rule | Result |
|---|---|
| Every gate PASS | no |
| scope_gate and matrix_gate PASS, source reads available, at least one non-core gate FAIL | yes |
| Computed verdict | PARTIAL |

## Failed gates

| Gate | Expected | Actual |
|---|---|---|
| finding_gate | full local finding schema plus source Claim traceability | local schema 60/60, Claims Extracted only 2/38 |