OpsTruth

Verification that holds no power to change what it judges.

Outcome
Authority
OpsTruth
Evidence

Definition — OpsTruth: OpsTruth is an independent read-only verifier for AI-assisted engineering: it inspects repository, stack, test, build, CI, secrets, configuration, route, runtime and deployment evidence, separates findings into Verified, Risky and Unproven, and performs no write actions of any kind.

OpsTruth reads the system from outside the execution path. It gathers evidence, states plainly what that evidence supports, and refuses to upgrade an absence of evidence into a pass.

OpsTruth — verification reportread-only

Illustrative OpsTruth verification report showing Verified, Risky and Unproven checks
Check	Surface	State
Build reproduces at commit Artefact matches source tree	build	verified
Test suite executed Exit status recorded in CI evidence	tests	verified
No credentials in tracked files Scan clean at this commit	secrets	verified
Declared routes respond One route returns an error status	runtime	risky
Deployed artefact matches commit No deployment evidence available	deployment	unproven

Illustrative report rows. Every check resolves to Verified, Risky or Unproven — never to a summary judgement.

Capabilities

What OpsTruth does

Each capability exists to make one class of failure impossible to hide.

Repository and stack inspection: Reads the tree at an exact commit: structure, dependencies, framework and build configuration.
Tests, build and CI evidence: Collects what actually ran and what it produced, rather than what a summary says it produced.
Secrets and configuration checks: Looks for exposed credentials and configuration that contradicts the deployed shape of the system.
Routes and runtime evidence: Checks that declared routes and runtime surfaces respond as the claim implies.
Deployment evidence: Compares the deployed artefact against the commit the claim is bound to.
Verified / Risky / Unproven: Three outcomes, not two. Unproven is a first-class result: the check could not be evidenced, and that is reported rather than hidden.

Explicit limits

What OpsTruth does not do

Stated limits are part of the design. A component that could do everything could not be trusted to judge anything.

Does not deploy
Does not mutate databases
Does not publish
Does not restart services
Does not perform any write action

Evidence surfaces

What OpsTruth inspects

Each surface is read at an exact commit or against the observable running system. Nothing is inferred from what the agent said it did.

Repository: Tracked files, tree state and the exact commit under inspection.
Stack: Declared dependencies, lockfiles and runtime versions.
Tests: Presence, execution and recorded outcome of the suite.
Build: Whether the artefact reproduces from the source tree.
CI: Pipeline configuration and recorded run evidence.
Secrets: Credential material exposed in tracked files or config.
Config: Environment expectations against what is actually declared.
Routes: Whether declared routes exist and respond as claimed.
Runtime: Observable behaviour of the running system.
Deployment: Whether a deployed artefact corresponds to the commit.

Classification

Verified, Risky, Unproven — and nothing else.

Absence of evidence is reported as absence of evidence. Unproven is a first-class result, not a soft pass.

opstruth report

$ npx opstruthcommit 9f2c41a · read-only inspectionVERIFIED  build reproduces at commitVERIFIED  test suite executedRISKY     declared route returns error statusUNPROVEN  no deployment evidence available# no writes performed · no credentials required for mutation

Endpoints

Where OpsTruth lives

Canonical addresses for the OpsTruth website and its MCP endpoint. Other hostnames you may have seen are historical and are not canonical.

Website: https://opstruth.io
MCP endpoint: https://mcp.opstruth.io/mcp
Source: https://github.com/AyobamiH/opstruth
Command: npx opstruth

Relationships

How this layer relates to the others

Proof & State is one system of three independent layers. Each holds authority the others do not.

Execution

DoneState

Give the agent room to work without giving up control.

Authorisation

AgentProof

Consequential actions leave evidence that outlives the session.

DoneState executes; it cannot verify itself. OpsTruth verifies read-only and never writes. AgentProof authorises consequential actions and signs receipts. The separation is the product.