The Grade Model

Trust in ziv is layered and explicit — never a binary “verified”. Every statement carries a grade, and the grade is derived from evidence, not asserted.

The lattice

unverified < hypothetical < sourced < ai-verified < endorsed < expert < formal < given

Grade	Meaning
unverified	No evidence at all — the floor.
hypothetical	Rests on an explicitly hypothesized premise.
sourced	Backed by an external source (a cited paper, an .external/ stub).
ai-verified	Checked by an AI verifier against the stated evidence.
endorsed	Endorsed by a human reviewer.
expert	Vouched by a domain expert.
formal	Checked by a formal kernel (a pluggable extension, not the starting point).
given	Given outright. Authored only on axioms and definitions — the grade-overclaim invariant.

The top of the lattice is deliberately narrow: given is not “we are sure”, it is “this is an input, not a conclusion”. Everything above unverified names what kind of evidence stands behind the claim.

Closure and statuses

The engine folds the AND-OR graph into a closure grade for every statement — the strongest grade its local proofs and transitive premises can carry. From that fold it derives a status:

• conjecture — kind-driven: declared in the entry itself.
• broken — a mechanical or structural defect, flagged by check (not authored).
• unproven — a proved-kind entry with no local proof yet.
• closure status — blocked / conditional / verified: conditional keys on a hypothetical in the closure — the cross-package “this needs an assumption” signal.

A defect (a broken entry anywhere in the closure) folds down to unverified and is carried transitively — but only downward: a defect can weaken, never strengthen, what depends on it.

Grades as the contract

ziv build writes every statement’s closure grade into the manifest. That index is the package’s claim about itself: downstream consumers cite it shallowly, and anyone can re-fold the shipped source to audit it. See the zpi format.