Expand description
The check operation and derived check state (agent-trust plan 14).
record_check is the engine-recorded act of verification: it
appends one crate::check::CheckRecord — verdict, method note,
the entity’s content_hash at check time, and plan-13 provenance
(actor, client, declared role) — to the workspace check ledger.
Checking mutates nothing: no entity write, no mem commit, no
content_hash change. That non-mutation is load-bearing — it is
what makes check-staleness derivable by hash comparison.
entity_check_state derives never-checked | checked-ok |
check-failed | check-stale from the newest record against the
entity’s current hash; the derivation lives in
crate::check::derive_state so surfaces and health share one
implementation.