{"row":{"id":"ADR-123","title":"check answers four questions: VALID · ACCESS READY · CAPACITY FIT · RUN READY, and run refuses what check refuses","file":"adr-123-layered-check-verdicts.md","status":"accepted","date":"2026-09-03","cites":3,"supersedes":[],"superseded_by":[],"layers":["L0","L3","L4"],"tags":["architecture","check","access","capacity"],"room":true},"pin":{"release_tag":"v0.118.7","commit":"f3a31a6ee00766e4b010379c535bca994631d637"}}

[{"k":"h","depth":1,"text":"ADR-123: check answers four questions, and run refuses what check refuses","id":"adr-123-check-answers-four-questions-and-run-refuses-what-check-refuses"},{"k":"h","depth":2,"text":"Context","id":"context"},{"k":"p","inline":[{"k":"text","text":"A green "},{"k":"code","text":"nika check"},{"k":"text","text":" was read as « this will run ». It could not be: the\nladder judged the DEFINITION (grammar · DAG · permits · types · the\nresolver's knowledge of the model) and said nothing about THIS machine\n(is a path ready?) nor about the seat against the declaration (can it\nemit that many tokens?). Two measurements forced the decision:"}]},{"k":"list","ordered":false,"items":[[{"k":"text","text":"The W1 persona gauntlet (2026-09-03) read "},{"k":"code","text":"✔ MODELS … key presence on this machine not judged"},{"k":"text","text":" as readiness, met "},{"k":"code","text":"NIKA-INFER-001"},{"k":"text","text":" on a dead\nkey ninety seconds later, and counted three JSON shapes for the same\naccess decision ("},{"k":"code","text":"check --json"},{"k":"text","text":" "},{"k":"code","text":"access_plan[].chosen"},{"k":"text","text":" · "},{"k":"code","text":"run --dry-run --json"},{"k":"text","text":" "},{"k":"code","text":"access.plans[].class"},{"k":"text","text":" · the boot manifest's JSON-encoded map)."}],[{"k":"text","text":"The same rig showed "},{"k":"code","text":"check"},{"k":"text","text":" refusing a reasoning seat under\n"},{"k":"code","text":"max_tokens: 32"},{"k":"text","text":" (exit 2) while "},{"k":"code","text":"run"},{"k":"text","text":" admitted and executed the same\nfile: the run's clean gate folded the ladder's findings and skipped the\nMODELS rung's judgments."}]]},{"k":"p","inline":[{"k":"text","text":"The one-door pack's product law: "},{"k":"code","text":"check"},{"k":"text","text":" answers four different\nquestions and never collapses them into one checkmark, and "},{"k":"code","text":"nika check"},{"k":"text","text":"\nmust not spend tokens to prove readiness."}]},{"k":"h","depth":2,"text":"Decision","id":"decision"},{"k":"list","ordered":true,"items":[[{"k":"strong","text":"Four layered verdicts, computed once beside the exit code."},{"k":"text","text":"\n"},{"k":"code","text":"VerdictLayers { valid, access_ready, capacity_fit, blockers }"},{"k":"text","text":" with\n"},{"k":"code","text":"run_ready()"},{"k":"text","text":" derived. VALID = the ladder + resolution + skills.\nACCESS READY = every static lane admitted by the frozen\n"},{"k":"code","text":"ExecutionAccessPlan"},{"k":"text","text":" (ADR-122) this machine resolves — presence only,\nnever a dial; "},{"k":"code","text":"None"},{"k":"text","text":" when no static model exists. CAPACITY FIT = the\nthinking laws + the new CAPACITY laws. RUN READY = the three plus any\nknown blocker. The text render prints an ACCESS rung under MODELS and\na "},{"k":"code","text":"layers ·"},{"k":"text","text":" line after the audited line; "},{"k":"code","text":"--json"},{"k":"text","text":" adds a "},{"k":"code","text":"verdicts"},{"k":"text","text":"\nobject. "},{"k":"code","text":"clean"},{"k":"text","text":" keeps meaning VALID + CAPACITY FIT (what it always\nfolded): "},{"k":"code","text":"REPORT_VERSION"},{"k":"text","text":" stays 1, the exit codes stay closed, and RUN\nREADY false is a "},{"k":"code","text":"--profile operational"},{"k":"text","text":" outcome (exit 2), never the\ndefault."}],[{"k":"strong","text":"CAPACITY laws from the catalog's positive knowledge only"},{"k":"text","text":"\n("},{"k":"code","text":"catalog_knows"},{"k":"text","text":" · the mock never judged): "},{"k":"code","text":"infer.max_tokens"},{"k":"text","text":" above\nthe seat's max output; "},{"k":"code","text":"schema:"},{"k":"text","text":" on a seat the catalog marks without a\nJSON mode; "},{"k":"code","text":"agent.max_tokens_total"},{"k":"text","text":" above the context window; "},{"k":"code","text":"vision:"},{"k":"text","text":"\non a seat whose input modalities exclude images. They ride the MODELS\nrung's findings rail on the CLI, the MCP oracle and the run gate."}],[{"k":"strong","text":"`run` refuses what `check` refuses."},{"k":"text","text":" The run's clean gate folds\nthe MODELS rung's judgments (resolution · thinking · capacity), judged\non the effective model ("},{"k":"code","text":"--model"},{"k":"text","text":" applied) exactly like "},{"k":"code","text":"check"},{"k":"text","text":"."}],[{"k":"strong","text":"One lane-row shape."},{"k":"text","text":" "},{"k":"code","text":"nika_service_execution::access::lane_rows"},{"k":"text","text":"\nrenders "},{"k":"code","text":"model · provider · resolved · access · chosen · billing · pinned · rejected[]"},{"k":"text","text":" and every machine surface carries those rows:\n"},{"k":"code","text":"check --json"},{"k":"text","text":" "},{"k":"code","text":"access_plan"},{"k":"text","text":", "},{"k":"code","text":"run --dry-run --json"},{"k":"text","text":" "},{"k":"code","text":"access.plans"},{"k":"text","text":",\nthe boot manifest's "},{"k":"code","text":"access_plan"},{"k":"text","text":" (an array now; the resume reader\nstill folds the 0.117 map). The text dry-run always prints the plan\nplus one access line per lane."}],[{"k":"strong","text":"`check --access <pin>`"},{"k":"text","text":" judges the plan under the pin "},{"k":"code","text":"run --access"},{"k":"text","text":" takes. "},{"k":"strong","text":"Presence is worded as presence"},{"k":"text","text":": "},{"k":"code","text":"doctor"},{"k":"text","text":" says\n"},{"k":"code","text":"key present · not validated"},{"k":"text","text":", the ACCESS rung says "},{"k":"code","text":"not validated (check never dials)"},{"k":"text","text":"."}]]},{"k":"h","depth":2,"text":"Consequences","id":"consequences"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"A file that is legal but cannot run here is no longer green on the\noperational profile, and the human surface says which question failed."}],[{"k":"text","text":"The thinking-budget hint no longer blames a task pinned to the mock\n(the capability defaults read the mock as reasoning-capable; the hint\nnow asks the catalog first)."}],[{"k":"text","text":"Proof: "},{"k":"code","text":"crates/nika-cli/tests/check_run_layers_e2e.rs"},{"k":"text","text":" on the real\nbinary (the reasoning floor red on both doors · capacity red on both\ndoors · one lane shape on three surfaces · "},{"k":"code","text":"check --access"},{"k":"text","text":" pins like\n"},{"k":"code","text":"run"},{"k":"text","text":" · the layers line), the analyzer's capacity laws, the display's\nrender tests, the service driver's row test."}]]},{"k":"h","depth":2,"text":"Follow-ups","id":"follow-ups"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Delivered in wave 2b: a failed task terminal carries its lane and a\nnote naming the model; "},{"k":"code","text":"run_settled"},{"k":"text","text":" carries "},{"k":"code","text":"error"},{"k":"text","text":" on every failed\nframe (launch refusals included) and the "},{"k":"code","text":"access_plan"},{"k":"text","text":" rows of the\nlanes that served; "},{"k":"code","text":"run --help"},{"k":"text","text":" ends on its exit ladder; the resume\naccess refusal is "},{"k":"code","text":"NIKA-1807"},{"k":"text","text":"; « wrote .nika/traces » prints only\nwhen a trace exists; the MODELS rung's judges ("},{"k":"code","text":"verdict_layers"},{"k":"text","text":" ·\ncapacity · resolution · the boot access stamps) are hosted in\n"},{"k":"code","text":"nika_cli_host::models_rung"},{"k":"text","text":", the door the MCP oracle reaches (wave 3)."}],[{"k":"text","text":"Delivered in wave 3.b (the W3 gauntlet): the RUN READY preflight at\nthe admission belt for the two cases it missed — a pinned seat whose\nproduct binary this machine lacks (the seat is two binaries, and the\nprobe row carries both) and an "},{"k":"code","text":"infer:"},{"k":"text","text":" that names no model with no seat\npinned (NIKA-1800 before task 1); "},{"k":"code","text":"check"},{"k":"text","text":", the dry-run and the run read\nthe same judges. The lane row names the ready paths it outranked; the\nCOST rung says when a model is seat-served."}],[{"k":"text","text":"The run-time ACCESS READY probe (a non-billable credential check) stays\nopen."}]]}]

ADR-123

check answers four questions: VALID · ACCESS READY · CAPACITY FIT · RUN READY, and run refuses what check refuses

accepted · 2026-09-03 · L0 L3 L4 · cites 3

ADR-123: check answers four questions, and run refuses what check refuses #

Context #

A green nika check was read as « this will run ». It could not be: the ladder judged the DEFINITION (grammar · DAG · permits · types · the resolver's knowledge of the model) and said nothing about THIS machine (is a path ready?) nor about the seat against the declaration (can it emit that many tokens?). Two measurements forced the decision:

The W1 persona gauntlet (2026-09-03) read ✔ MODELS … key presence on this machine not judged as readiness, met NIKA-INFER-001 on a dead key ninety seconds later, and counted three JSON shapes for the same access decision (check --json access_plan[].chosen · run --dry-run --json access.plans[].class · the boot manifest's JSON-encoded map).
The same rig showed check refusing a reasoning seat under max_tokens: 32 (exit 2) while run admitted and executed the same file: the run's clean gate folded the ladder's findings and skipped the MODELS rung's judgments.

The one-door pack's product law: check answers four different questions and never collapses them into one checkmark, and nika check must not spend tokens to prove readiness.

Decision #

Four layered verdicts, computed once beside the exit code. VerdictLayers { valid, access_ready, capacity_fit, blockers } with run_ready() derived. VALID = the ladder + resolution + skills. ACCESS READY = every static lane admitted by the frozen ExecutionAccessPlan (ADR-122) this machine resolves — presence only, never a dial; None when no static model exists. CAPACITY FIT = the thinking laws + the new CAPACITY laws. RUN READY = the three plus any known blocker. The text render prints an ACCESS rung under MODELS and a layers · line after the audited line; --json adds a verdicts object. clean keeps meaning VALID + CAPACITY FIT (what it always folded): REPORT_VERSION stays 1, the exit codes stay closed, and RUN READY false is a --profile operational outcome (exit 2), never the default.
CAPACITY laws from the catalog's positive knowledge only (catalog_knows · the mock never judged): infer.max_tokens above the seat's max output; schema: on a seat the catalog marks without a JSON mode; agent.max_tokens_total above the context window; vision: on a seat whose input modalities exclude images. They ride the MODELS rung's findings rail on the CLI, the MCP oracle and the run gate.
`run` refuses what `check` refuses. The run's clean gate folds the MODELS rung's judgments (resolution · thinking · capacity), judged on the effective model (--model applied) exactly like check.
One lane-row shape. nika_service_execution::access::lane_rows renders model · provider · resolved · access · chosen · billing · pinned · rejected[] and every machine surface carries those rows: check --json access_plan, run --dry-run --json access.plans, the boot manifest's access_plan (an array now; the resume reader still folds the 0.117 map). The text dry-run always prints the plan plus one access line per lane.
`check --access <pin>` judges the plan under the pin run --access takes. Presence is worded as presence: doctor says key present · not validated, the ACCESS rung says not validated (check never dials).

Consequences #

A file that is legal but cannot run here is no longer green on the operational profile, and the human surface says which question failed.
The thinking-budget hint no longer blames a task pinned to the mock (the capability defaults read the mock as reasoning-capable; the hint now asks the catalog first).
Proof: crates/nika-cli/tests/check_run_layers_e2e.rs on the real binary (the reasoning floor red on both doors · capacity red on both doors · one lane shape on three surfaces · check --access pins like run · the layers line), the analyzer's capacity laws, the display's render tests, the service driver's row test.

Follow-ups #

Delivered in wave 2b: a failed task terminal carries its lane and a note naming the model; run_settled carries error on every failed frame (launch refusals included) and the access_plan rows of the lanes that served; run --help ends on its exit ladder; the resume access refusal is NIKA-1807; « wrote .nika/traces » prints only when a trace exists; the MODELS rung's judges (verdict_layers · capacity · resolution · the boot access stamps) are hosted in nika_cli_host::models_rung, the door the MCP oracle reaches (wave 3).
Delivered in wave 3.b (the W3 gauntlet): the RUN READY preflight at the admission belt for the two cases it missed — a pinned seat whose product binary this machine lacks (the seat is two binaries, and the probe row carries both) and an infer: that names no model with no seat pinned (NIKA-1800 before task 1); check, the dry-run and the run read the same judges. The lane row names the ready paths it outranked; the COST rung says when a model is seat-served.
The run-time ACCESS READY probe (a non-billable credential check) stays open.

read at v0.118.7 · the decision record ships with the engine

Every decision, with its status This one in the repo