The last inch before action
Somewhere between a model finishing its sentence and a system carrying it out, there is an inch of silence. Nothing is written there. No log records it. It is where language quietly becomes consequence — a wire transfer, a migration, a filing, a deletion. Execution governance is the practice of putting something in that inch.
Not a reviewer, who tires. Not a policy document, which cannot intervene. A deterministic verification layer — same input, same verdict, every time, with no memory of having been persuaded. It is fail-closed by construction: the gate's resting state is shut, and only proof opens it.
A model is not unreliable. It is indifferent.
Confidence is a style, not a signal. It is produced by the same process whether the answer is right or wrong.
It does not know that it is wrong, which is exactly why it sounds so calm about it. Ask the same question twice and you may get two answers; both will be fluent, and neither will carry a mark showing which one you can spend.
This was survivable while models only talked. It stopped being survivable when we handed them tools. An agent that can call an API can move money. An agent that can write SQL can drop a table. The distance between a plausible sentence and an irreversible act is now one function call, and guardrails sit on the wrong side of it — they read the prompt going in, not the answer coming out.
Non-determinism
The same prompt, twice, two answers. Neither one is stamped. You cannot audit a coin flip after the fact.
Unbounded execution
Tools called, data moved, actions triggered — with nothing standing between the decision and the effect.
Absent guarantees
Filters inspect what you asked. Nothing inspects what came back, and what came back is what ships.
Verify. Enforce. Repeat exactly.
Three movements. Remove any one of them and the other two are theatre.
Verification
The claim is taken apart and rebuilt by something that cannot be flattered. SymPy recomputes the number. Z3 tries to break the logic. The SQL is parsed, not pattern-matched. The output is not reviewed — it is re-derived.
Enforcement
A verdict is not advice. It carries authority: BLOCKED stops the call. There is no appeal to probability, no override for a tight deadline, no fallback that lets the unproven through because the check was slow.
Determinism
The layer that judges must itself be judgeable. Same input, same verdict, on your laptop and in your auditor’s. A gate that answers differently on Tuesday is not a gate; it is a second model.
QWED is where this stopped being an opinion
Three releases turned a set of principles into behaviour you can fail a build against.
With v5.0.0 QWED stopped being a library you could politely ignore and became an enforcement boundary: fail-closed by default, with no unsafe fallbacks and no silent degradation. A library returns a value. A boundary refuses.
v5.1.0 pushed the boundary inward, past output and into memory. AgentStateGuard governs what an agent is permitted to commit to state — and the same release closed the remaining fail-open paths across execution, tool approval, math and schema verification. Every door that could still be left ajar was found and shut.
v5.2.0 gave every verdict one shape. Each check now resolves into a unified DiagnosticResult — VERIFIED, UNVERIFIABLE, or BLOCKED — and a VERIFIED result is structurally required to carry a cryptographic proof reference. Not encouraged to. Required to. You cannot write down a pass that has nothing behind it.
It will not act on a sentence
Arithmetic is recomputed. Logic is re-solved. Code is walked. SQL is parsed into a tree and read. A claim becomes an action only after something other than the model has agreed with it.
It will not extend credit
Every model response arrives as an untrusted claim and stays that way until a symbolic engine says otherwise. Confidence is a tone of voice. It is not evidence, and the boundary cannot hear it.
It will not degrade quietly
There is no reduced mode, no best-effort pass, no “we could not check this, so we let it through.” When verification cannot complete, the boundary closes. Failure is loud and it is safe.
It will not forget
Each decision leaves a reproducible record: what was checked, which authority checked it, what it concluded, and the hash that lets you run the whole thing again tomorrow and get the same answer.
Capability is not the thing that will save you
A better model produces a more convincing wrong answer. The gate is the part that scales with the stakes.
Every generation of model is more persuasive than the last. That is progress, and it is also the problem: persuasion improves faster than correctness, and only one of those two is what your ledger cares about.
So the security boundary moves. It used to sit around training — the data, the weights, the alignment. It belongs at execution, because that is the only place where a mistake becomes an event. Nothing is lost by verifying a claim that was already true. Everything is lost by trusting one that wasn't.
Finance, healthcare, law, infrastructure: the domains where AI is most useful are exactly the domains where being confidently wrong is most expensive. They do not need a smarter model. They need a boundary that holds while the model gets smarter.
The direction of travel
Models stop writing and start doing. Text becomes transactions.
Agent chains compound error: one wrong number, faithfully passed hand to hand.
Auditors will ask what was checked, not how good the model was.
Verification becomes plumbing — as unremarkable, and as mandatory, as TLS.
State itself needs a guard: corrupted memory, regressed counters, impossible transitions.
Nothing acts until something proves it.
That is the whole order. It is open source, it is one import, and it does not care whose model you are running. Read the checks, run them against your own outputs, and decide from evidence rather than from tone.
Latest release: v5.2.0 — Structured Verification Diagnostics. A unified three-layer DiagnosticResult with the VERIFIED / UNVERIFIABLE / BLOCKED taxonomy, where a VERIFIED verdict is structurally required to carry a cryptographic proof reference.