Graph Engineering
Claim Graph
The durable record of what must be true about the product being built, written as testable statements with dependencies, each marked true only when its test passes.
A claim graph is the durable record of what must be true about the product being built: a dependency graph whose nodes are claims rather than jobs. Each claim states a desired condition and carries four things: a stable id, a status, the claims it depends on, and one named probe, a test that can prove it false. The shape is older than agents: safety-critical engineering builds assurance cases out of claims, arguments, and evidence. What changes when agents do the building is that the record has to be machine-checkable, because its primary reader is a worker deciding what to do next, not a person.
A claim is atomic: one test, one decision about the product. Its status is one of four, used distinctly: open, blocked, unknown, or verified. Unknown, no evidence either way yet, is a separate status from a failed test, so an unmeasured claim never reads as a broken one. A verified claim records its evidence with the exact commit it was tested at, because a result without that commit cannot be reproduced. Verified locally, the named probe passing at that commit, is a lower bar than certified for release, where integration tests and human sign-off also pass. Ids are never reassigned, even after a claim is dropped, so every reference in a decision log stays valid. At least one claim is an anti-claim, the thing that must not be true, which is what stops the graph from being a list of things that already work.
What a worker picks from is the claim frontier: the open claims whose dependencies are all verified, re-derived from current statuses on every pass, never kept as a plan. Owners and gates, when a run needs them, live in a separate work graph; the one bridge between the two is reconciliation, which checks a result against the claim’s test and writes the outcome into the records that own it. The separation keeps scheduling out of the truth record, because closing a ticket proves nothing about the product. Progress can fall: a review finding that checks out can reopen a closed claim or add one nobody wrote, and the verified count drops.