The honesty verifier goes live: Dalkkak now re-runs what an agent claims, on its own

The two earlier slices built the pieces in isolation — a claim parser + safety gate, then a re-run + deterministic judge. This one connects them to a real agent, which is the moment it stops being a design and starts being a mechanism.

What now happens, end to end

1. Injection. Every Claude Dalkkak launches gets a DALKKAK VERIFY directive appended to its system prompt: when you claim something a command can confirm — tests pass, build succeeds, a file exists — also emit a <dk-verify>{…}</dk-verify> with the idempotent command to re-run, because Dalkkak will re-run it. Same channel the agent already uses for <dk-node>/<dk-summary>.
2. Catch. The transcript poll loop (which already files agent memory into the graph) now also pulls <dk-verify> claims out of each new assistant message, and tracks the pane's cwd from the transcript so it knows which repo to run in.
3. Re-run + judge. Off the poll thread (a slow test suite can't stall ingestion), Dalkkak safety-gates the command, runs it itself with hygienic env, and compares the real exit/output to the claim's expect. File claims are checked against the actual filesystem, not the command's word.
4. Record. The result lands as an immutable verification_receipt node — verified, failed, unsafe, or unrunnable — that the agent cannot author. A false "passing" becomes a failed receipt, in the founder's own graph.

The agent writes the claim. It does not run the check, judge the result, or write the verdict. Three layers, none of them the agent.

What this is, honestly, and is not

It compiles clean and the unit tests pass (the engine catches a false that claims exit 0; the safety gate refuses rm -rf and records that it never ran). It is not yet runtime-tested inside the app — that needs a real pane and a rebuild, which is the founder's machine. And it currently taps the Claude transcript format; wiring Codex and Antigravity to the same loop, surfacing verdicts in the UI, and adding the second pillar (an adversarial judge for claims a command can't settle) are the next steps.

Why it was worth doing this way

The temptation with "stop the AI from agreeing with me" is to write a sterner prompt. A sterner prompt is still the agent grading itself. The only durable move is to put the check somewhere the agent can't reach — and Dalkkak, which spawns the agent's terminal and reads its transcript, is the one place that sits below it. That's the whole reason the verifier lives here and not in a prompt.