The verification workflow
What a verdict means, what PASS does not promise, how HEURISTIC findings differ from proven ones, and how to hand findings back to an assistant.
Verification workflow
LIVEAssistants produce artifacts fast, and the failures they produce are subtle: a numeric id that arrived as a string, a regex that accepts one input too many, a cron expression that skips a day twice a year. DevTools verifies those artifacts deterministically, in your browser, and tells you exactly what is wrong and where.
The result model
Every verifier returns one of three verdicts, plus a list of findings. The verdict is carried by the words PASS / WARN / FAIL and an icon, never by colour alone.
- PASS — every deterministic check held.
- WARN — something needs a decision: a limitation, a configuration risk, or a heuristic suggestion. Heuristics can never produce a FAIL.
- FAIL — a deterministic condition failed. A FAIL is always something the tool can prove from your input.
Each finding carries a severity, an exact path or line, verbatim evidence, and — when the correction is deterministic — a suggested fix. Findings that were inferred rather than proven are labelled HEURISTIC in the interface and carry heuristic: true in the exports.
Verifier modes
- JSONCraft · Schema Drift — Compare an expected response shape against the one you received.
- RegexLab · Test Cases — Label inputs MATCH / NO MATCH and see false positives and negatives by name.
- CronBuilder · Schedule — Next eight runs in a named timezone, with daylight-saving hazards.
- JWT Decoder · Security status — Expiry, nbf, alg:none, issuer and audience, HMAC verification.
- APITester · Assertions — Deterministic checks over the response you just received.
- DiffViewer · Patch review — Parse a unified diff and review the changed lines.
- YAML · Diagnostics — Duplicate keys, tab indentation, values that parse as booleans.
- SQL · Structural review — Clause outline, table map, DELETE without WHERE.
- CSVStudio · Inspection — Ragged rows, duplicate headers, inferred types, typed SQL export.
- .env · Three-way drift — Local vs example vs a deployed key list.
- URLInspector · Diagnostics — Encoding layers, duplicate parameters, redirect_uri comparison.
A worked example
Open JSONCraft · Schema Drift and load the broken example. Expected shape:
{
"users": [{ "id": 1, "name": "Alice", "active": true }],
"metadata": { "total": 2, "nextPage": null }
}The response actually returned ids as strings and dropped nextPage. The verdict is FAIL, with these findings:
FAIL users[0].id
Expected: number
Actual: string
Value: "1042"
FAIL metadata.nextPage
Missing property.Load the passing example and the verdict becomes PASS — the values differ and the key order differs, but the shape matches.
What this does not prove: that the values are correct, that the endpoint is the right one, or that fields you did not include in the expected document are absent.
Verify Anything
LIVE/verify takes any artifact and routes it to the verifier that can prove something about it. Detection is deterministic feature matching — parse attempts, structural markers, token density — not a model, and not a network call.
What it detects
JSON, YAML, JWTs, URLs, cron expressions, regular expressions, SQL, CSV, .env files, unified diffs, and timestamps or log lines.
Candidates are ranked with a confidence and a plain-English reason. Below the confidence threshold, or when two formats tie, nothing is routed automatically — you are shown the choices instead. Manual tool selection is always available.
Routing carries your artifact through session storage, not a query string, so it never enters browser history. The detector is measured against a corpus of 100+ artifacts in the test suite.
Copy Findings for agents
LIVEVerification is only half the loop. Copy findings turns a verdict into something you can paste straight back into the assistant that produced the artifact — with exact paths, so it fixes the actual defect rather than rewriting the file.
Markdown
Verification: FAIL
Tool: jsoncraft / schema-drift
2 errors.
Findings:
1. users[0].id
ERROR: Expected number, received string.
Evidence: Expected: number
Actual: string
Value: "1042"
Suggestion: Return a number at users[0].id.
2. metadata.nextPage
ERROR: Missing property.
Please fix only the verified issues above and preserve unrelated behavior.JSON
The same result in a versioned machine-readable shape, for a tool call or a CI step.
{
"schemaVersion": 1,
"tool": "jsoncraft",
"mode": "schema-drift",
"status": "fail",
"summary": "2 errors.",
"findings": [
{
"id": "type-mismatch",
"severity": "error",
"title": "users[0].id",
"message": "Expected number, received string.",
"path": "users[0].id",
"evidence": "Expected: number\nActual: string\nValue: \"1042\"",
"suggestion": "Return a number at users[0].id."
}
]
}Both formats are redacted: credential-shaped values are replaced with [redacted] before the text reaches your clipboard. Evidence is truncated so a paste stays readable. Nothing speculative is added — if a verifier could not prove a fix, no fix is suggested.
Workbench & history
LIVEEvery verdict is recorded as you go, so you can come back to what failed without re-running it. /workbench lists them newest first, filtered by verdict, with the findings and a way back into the tool.
What is stored, and what is not
- The verdict, the summary and the findings — redacted the same way Copy Findings is.
- The artifact itself only when every field is classified safe: a cron expression, a regex pattern, a colour palette.
- Never a token, a signing secret, an API response, a request body or a
.envvalue. Those entries record that the artifact was withheld and name the fields, so the gap is visible rather than silent.
The bar is higher than for a share link on purpose. A share link has a dialog in which you opt in; history is written without asking, so only safe fields qualify.
Where it lives
localStorage, in the browser you are using. There is no account, no sync and no server copy — it does not follow you to another device, and clearing site data clears it. The last 50 verifications are kept; repeated identical verdicts collapse into one, because verifiers re-run as you type.
Free, like every verifier. No account is involved at any point.
Next steps between tools
Some verdicts suggest where to go next. These are a small explicit set, not inferred — a suggestion that sends you to the wrong tool is worse than none:
- APITester → JSONCraft — when the response is JSON, carrying the body into Schema Drift
- URLInspector → JWT Decoder — when a query parameter holds a token
- JSONCraft → CSVStudio — when the document is a JSON array
- CronBuilder → Timestamp — when the schedule crosses a daylight-saving boundary
- DiffViewer → SQL Formatter — when the patch touches a .sql file
- JWT → HashLab — when the signature is unverified
Artifacts move through session storage, never a URL, so a token handed from URLInspector to the JWT Decoder never enters browser history.