VerificationAvailable
Verification
Verification maps changed paths to named checks, runs those checks, and records receipts. It owns the verification and coverage objects in agent-up.json and the receipt ledger.
It never reads the agent commit queue. Record receipts before enqueue. This repository uses enforcement: block, so guard_verification and agent-up verify guard fail when receipts are missing or stale. MCP is loopback-only by default, like the other Agent-Up servers.
Plan which checks apply
Run them and record receipts
Guard before enqueue
Tool
run_verification
Tools
Every tool on /mcp/verification names its target with exactly one of workspaceId or worktreePath, resolved the same way the commit queue tools resolve theirs. Passing both, or neither, is a validation error, and a workspace-bound session passes neither.
plan_verification
See which checks the current changes require, and which rule selected each.run_verification
Run every required check and record a receipt per check.run_verification_check
Re-run one check by id after a targeted fix.guard_verification
Report whether every required check has a passing receipt matching the current file contents.export_verification
Read a report of what was proven about this revision. Evidence to show, never an input to the guard.
Also
CLI
Coverage
Receipts
Loop inference
Loop soak
Export
Receipts live outside the working tree so one cannot travel in a change proposal and satisfy another machine's guard against bytes it never tested. Export closes that without weakening the ledger: export_verification, GET /api/workspaces/{workspaceId}/verification/export, and agent-up verify export emit the same report.
Export rules
Contains
Never contains
Skipped checks
Guard
The export is evidence to read, not an input to a gate. Keep the two types distinct so the confusion cannot be expressed in code.
The field contract is the agent-up.json reference. Agent operating rules stay in AGENTS.md.
Portable binary
au-check is the same resolver as agent-up verify, packaged so another repository can run the gate without building Agent-Up. AgentUp.AUCheck is a composition-only Program.cs. CheckPlanProvider is the only type that decides which checks are required, and both hosts print the same plan lines.
Command
au-check plan
Download one release asset and run it from the repository you want to check. --repo defaults to the working directory. --config defaults to agent-up.json there. Receipts are written to that checkout's Git directory, the same ledger agent-up verify uses.
Assets
linux-x64
linux-arm64
osx-arm64
osx-x64
win-x64
plan
Show the checks the current changes require, including any this machine cannot run.run
Run the runnable checks and record receipts.run <check-id>runs one.guard
Report whether every required check is proven.--runexecutes what is missing first.coverage
Measure changed lines.slicesreports total coverage per feature slice.
Exit codes
0
1
2
3
requires on a check names dotnet, node, npm, docker, git, or nix, optionally with a minimum version. A missing tool skips that check. The skip is not a failed check and is not counted as satisfied, so guard still blocks. ciOnly and wrong-platform skips stay non-blocking. agent-up verify keeps its own exit codes.
run --report <dir> also writes report.json, report.html, and report.png. The HTML and the PNG lead with checks that could not run, then failures. Omitting --report leaves the run as it is today. The report does not change the exit code or the receipts.