The three tiers of verification.

Runward verifies engineering decisions. It deliberately does not verify everything — and the boundary is not an accident, it is the architecture. A delivery under runward runs on three tiers of verification, each with its own owner, and one question decides which tier a check belongs to:

Must this check be unforgeable?

Tier 1 — Engineering decisions: the deterministic gate

What must be unforgeable: that the load-bearing decisions were made, traced, and evidenced. That is runward check --strict — typed evidence pointers resolving to real content, rule-conformance manifests, the seal against silent erosion. Same input, same verdict; no prompt can talk it into passing. It proves a decision was traced and points at something real — never the code's quality. In the state of the art's vocabulary, it is a deterministic sensor at rest: the "deterministic sensors" the literature catalogs execute something (tests, linters, compilers); this one reads artifacts at rest and executes nothing.

Nothing else plays this role. There is no "second gate."

Tier 2 — Mechanical checks: the operator's hooks

Compiling, typechecking, testing a changed file is deterministic too — these are "deterministic sensors" in the full sense of the term, sensors that execute. But it is a file problem, not a mission problem. It belongs to the operator's own tooling: the opt-in hooks seam around the gate, and whatever the operator's harness offers (a hook that runs the typechecker after every edit, a pre-push check). These checks inform and correct; they do not decide a phase. Phase crossings stay Tier 1.

The seam is runward's; its content is yours.

Tier 3 — Judgment: advisory review

A fresh pair of eyes on a diff — human or LLM — has real value and is forgeable by construction. So it is advisory, never blocking: review produces findings, the operator decides, and if a finding matters durably it becomes Tier-1 material (an ADR, an evidence pointer). The gate may see that a review happened and is fresh; it never reads the verdict. A model-controlled check is skippable, and a skippable check is not a gate — which is also why an MCP tool can discover runward but never enforce it.

The partition test

For any new verification you are tempted to add, ask in order:

1. Is it a mission-level engineering decision? → a craft rule plus evidence in the manifest. Tier 1.
2. Is it mechanically checkable on a file? → a hook. Tier 2.
3. Is it judgment? → advisory. Tier 3.

A check that seems to belong to two tiers is almost always two checks to separate. "Is the code secure?" is a traced security decision (Tier 1) plus a mechanical scan (Tier 2) plus an expert read (Tier 3) — three checks, three owners, one honest boundary each.

This partition meets the state of the art's vocabulary: the "Code as Agent Harness" survey (arXiv 2605.18747) names the same dividing line — "deterministic sensors and human-review gates." A survey describes a landscape; it does not validate a product. The convergence, though, is plain to see.