Tri-observer correlation verdicts: independently verify that what an AI agent reported (claude.*) matches what the bridge observed (observation.*) and what the system hooks confirmed (gryph.*). PASS when they agree, FAIL when they diverge, GAP when no observation signature exists.
ai.claude.* (the agent's self-report via the API boundary),
ai.observation.* (the Kotlin bridge's own audit trail), and
ai.gryph.* (independent system-level observation via Go hooks).
The certification engine correlates these three observation layers and emits
PASS/FAIL/GAP verdicts. See ai.claude.hook.* for the policy
decision layer.
Layer 4: ai.claude.hook.* Policy decisions (should this happen?)
↓
Layer 3: ai.claude.* Self-report (agent says it happened)
↓
Layer 2: ai.observation.* Bridge observation (Kotlin daemon confirms it)
↓ ↗
Layer 1: ai.gryph.* System observation (Go hooks confirm it)
↓ ↙
ai.certification.* Tri-observer correlation verdict
One claude↔observation↔gryph event triplet was verified — all three observation layers match.
| Field | Type | Description |
|---|---|---|
| session_id | string | Session identifier |
| timestamp | string | ISO 8601 UTC |
| claude_event_type | string | Full event type of the Claude self-report event |
| observation_event_type | string | Full event type of the bridge observation event |
| gryph_event_type | string | Full event type of the matching gryph event |
| correlation_key | object | Binding keys: session_id, tool_use_id, subagent_id |
| fields_checked | array[string] | Fields compared (e.g., "content_hash", "exit_code") |
A discrepancy was detected between claude, observation, and/or gryph layers.
| Field | Type | Description |
|---|---|---|
| session_id | string | Session identifier |
| timestamp | string | ISO 8601 UTC |
| discrepancy_type | string | Type of mismatch |
Values: ghost_action, unreported_action, hash_mismatch, exit_code_mismatch, token_divergence, temporal_anomaly, orphaned_subagent_action, subagent_attribution_mismatch | ||
| severity | string | Impact level |
Values: critical, high, medium, low | ||
| claude_event_type | string | Claude event type (empty for unreported_action) |
| observation_event_type | string | Bridge observation event type |
| gryph_event_type | string | Gryph event type (empty for ghost_action) |
| correlation_key | object | Binding keys used for matching |
| expected | string | What was expected |
| actual | string | What was actually observed |
A Claude event type has no corresponding gryph observation signature. Not a failure — a known blind spot.
| Field | Type | Description |
|---|---|---|
| session_id | string | Session identifier |
| timestamp | string | ISO 8601 UTC |
| claude_event_type | string | The event type with no signature |
| reason | string | Why no signature exists |
| phase_needed | string | Implementation phase that adds coverage |
End-of-session rollup of all correlation results into a single judgment.
| Field | Type | Description |
|---|---|---|
| session_id | string | Session identifier |
| timestamp | string | ISO 8601 UTC |
| total_correlations | int | Total events correlated |
| passed | int | Count of PASS correlations |
| failed | int | Count of FAIL correlations |
| gaps | int | Count of coverage gaps |
| verdict | string | Session-level judgment |
Values: CERTIFIED (0 failures, 0 gaps), FLAGGED (≥1 failure), PARTIAL (0 failures, ≥1 gap) | ||
| trust_level | string | Observer configuration |
Values: dual_observer (bridge + gryph), self_certified (bridge only, enterprise mode) | ||
| subagent_tree | object | Agent hierarchy: {"main": ["explore_abc", "plan_def"]} |