First real code for the anti-sycophancy verifier: parse the claim, gate the command, run nothing yet

The design (written up earlier) has one principle: don't use an agent's word as the unit of trust. An agent saying "tests pass / done" is a token it fully controls. So instead of trusting the word, Dalkkak re-runs the claimed command and judges the real result — an exit code the model can't fake.

This is the first slice of that, and it's deliberately small.

What shipped

A new Rust module, verify.rs. It does exactly two things, both of which must live below the agent:

1. Parse the claim. The agent emits <dk-verify>{...}</dk-verify> in its transcript — the same marker channel Dalkkak already reads for <dk-node> / <dk-summary>, so it works for Claude, Codex, and Antigravity without per-agent code. The payload is {id, claim, kind, verify, cwd, expect}: a falsifiable command plus what its result must look like.
2. Gate the command. Whether a command is safe to run is precisely the thing the agent must not be trusted to assert, so a deterministic classifier (no model) scans the verify text against a destructive denylist — rm, git push, deploy, publish, sudo, network writes, anything that could echo a credential — and refuses with a reason. It fails closed: a borderline command is refused, not trusted. A claim that calls itself a test but runs rm -rf is still unsafe.

That's it. This file executes nothing. No re-run, no verdict.

Why stop there

The honest reason to ship a non-executing slice: the parse-and-gate is the part that has to be in Rust (it sits on the PTY/transcript layer, below every agent), and it's fully testable on its own — 7 unit tests, clippy clean. The re-runner and judge go in the Python sidecar (the AI/verification boundary, per our polyglot rule), and the verdict — the thing the agent cannot write — lands in the core graph as an append-only record. Those are the next slices. Building the gate first means nothing downstream can re-run a command the gate hasn't already declared safe.

The point worth keeping

When you're defending against a system that's good at sounding right, the leverage isn't a better prompt — it's moving the check to a layer the system can't reach. The agent writes the claim; it does not get to run the verification, judge the result, or write the verdict. Three different layers, none of them the agent. This slice is just the first of those layers, and it earns its keep by refusing to run the wrong thing.