Step6 Verify

---
name: step6-verify
description: "Step 6 · Per-module simulation verification (amnesia audit → human-confirmed plan → autonomous local-fix loop → full re-verify; escalate only when local options are exhausted)"
disable-model-invocation: true
---

# Step 6 · Per-module simulation verification

Each **entry** into step 6 gets a fresh session; once entered, the verify → fix → re-verify loop stays in this session until issues reach zero or the user calls a stop. Do not shuttle the user between sessions.

## Session & state check (before touching anything)
1. One step per session: if this session already did substantive work for another step, stop and ask for a fresh session.
2. Read `docs/flow-state.md` (canonical header line; foreign file → stop and ask). Confirm steps 2–5 are all `done` (any step marked `rework` → stop; route the user to that step's command first). Step 6 `waiting` (structural rework was pending) → this re-entry is expected, resume normally. Step 6 `done` → also an expected re-entry when the issues table carries `fixed-pending-verify` entries or `open` entries with target `step6` (a step-7 handoff): resume normally. `done` with neither → ask the user's intent before re-running a full audit. Step 6 `in-progress` → a previous session aborted mid-loop or another session is live — ask the user before proceeding. Set step 6 `in-progress`.
3. Issues-table triage:
   - `open` entries with target 2–5 (approved structural rework not yet executed) → **stop**; route the user to the matching fix mode first
   - `fixed-pending-verify` entries (structural rework done) and `open` entries with target `step6` (step-7 handoffs) → **collect them; this round must verify every one and give each a verdict** (§1 carries them in; §4 settles them)
4. **Reconcile BEFORE any round allocation** (order matters — allocating first mints ghost rounds):
   a. Orphan-fix scan: `docs/rework-log-*.md` attempt records journaled but never marked adopted/rejected → reconcile against the live EDA first (the journal lists touched objects and prior values): roll back or complete the targeted check. Never run a fresh audit on top of an unreconciled orphan — it would baptize the half-applied change as baseline fact.
   b. Ghost-round check: if the verification-rounds table's LAST row is still verdict-pending, that round died mid-flight — either **resume it as the current round N**, or mark it `aborted` (with a note) before allocating anything new. Never stack a new pending row on an unreconciled one.
5. Round numbering: **N = the resumed pending round, or last row + 1 (empty table → N = 1).** Append a new row only at the moment its amnesia audit actually starts — reconciliation always comes first.
6. Keep your inputs pure: do not read the firmware or the dev documents yourself before directing the audit.

## The loop

### 1. Amnesia audit (delegate to the subagent)
Delegate to **amnesia-verifier** (independent context window; file-tool writes mechanically blocked). The delegation prompt carries exactly three things — EDA project access (API / file paths), allowed official-documentation lookups, required output structure (board overview / functional-module inventory M1..Mn, partitioned by function not by component / per-module verification plan / issue list with target steps) — **plus one sanctioned addition when present: the issues-table entries collected in the session check (fixed-pending-verify and step-7 handoffs), COPIED VERBATIM from flow-state.** Never paraphrase them, never attach fix history or target values — paraphrase leaks your design context and anchors the audit. Nothing else from firmware, plan documents, or prior conclusions may enter.

### 2. Save verbatim
If `verification/01-module-inventory.md` already exists from an earlier entry, archive it first (suffix the previous round number), then write the new report **verbatim**. Do not "correct" anything against your own beliefs — suspected misreads go to the human gate and to verification itself.

### 3. ⛔ Hard gate: module table + verification plan, human-confirmed (only then execute)
Present both for item-by-item review:
- **The module table** (are connections and parameters read correctly?)
- **The per-module verification plan** — for every module, each hello-world-level item spelled out: what to test, how, the pass criterion, and its kind
Corrections at this gate split by their **source**:
- **Human-sourced** (the user states what is wrong AND what is right): edit the saved documents as the user's scribe, annotating each edit `human-corrected at gate, round N` — the human outranks both agents, and the annotation keeps the edit from reading as tampering.
- **Re-derivation requests** (the user says "this looks wrong — recheck it"): do NOT fix it yourself. Re-delegate to a FRESH amnesia-verifier instance, passing the challenged items verbatim (a sanctioned addition, like re-verification entries), and save its corrected derivation verbatim. The main session patching a derivation from its own context is exactly the confabulation the amnesia design exists to prevent.
Module-table errors that reveal design problems → into the §5 pool as issues. **Execution starts only after the user confirms.**
On re-entry: the previously confirmed plan stays the baseline — present only the **increments** (new modules/items surfaced by the fresh audit) for confirmation, not the whole plan again. Match against the baseline by symptom + involved nets/designators, never by module number — a fresh audit repartitions freely (the same matching rule §5 uses). When the repartition itself changes what a module *means*, present that module whole rather than diffing its items.

### 4. Per-module verification
Run the confirmed plan module by module. Common kinds, kept separate — plus an open category:
- **Standalone firmware mini-projects**: self-contained, individually buildable, no dependence on the main project
- **SPICE simulations**: any electrical behavior the simulator and its models genuinely capture — state the analysis type per item (transient, AC, noise, stability, …); quantities the models don't physically contain (e.g. real leakage/Iq) are evidenced by a datasheet worst-case per-net review table instead
- **Documentation / measurement items**: a post-fab measurement list — what to measure and the pass criterion
- **Other analyses the board's risks demand** (thermal, EMC, mechanical, …) — state method and pass criterion
Execute in dependency order (supply side first — e.g. power → MCU → buses → peripherals); an upstream FAIL blocks downstream items. Record every result in `verification/02-verification-summary.md` with a **canonical result token**:
`sim-pass` (verified by a model that genuinely represents the quantity) / `evidence-pass` (closed by datasheet worst-case or analytical review) / `post-fab-required` (cannot close without hardware — state the post-fab criterion; it flows into the assembly notes' measurement list) / `fail` / `blocked` (an upstream FAIL blocks it).
Zero-hardware reality check: measurement items can never "pass" pre-fab — `post-fab-required` with a stated criterion IS their closed form here; never launder a written measurement plan into a pass. **When flipping any fail to a pass-class token, write the evidence reference (round / rework-log entry) in the same edit** — a bare flip looks like tampering to the guard hook.
Settle the carried-in issues-table entries here: verdict `closed` → set it in flow-state citing round N; symptom still reproduces → it enters the §5 pool.

### 5. Issue handling: exhaust local fixes autonomously; escalate only when exhausted

**Ledger rule**: issues being worked here are **not written to the flow-state issues table** — stale entries left by an aborted session would misroute the user back into upstream fix modes. The working record lives in the verification summary and `docs/rework-log-N.md` (including rejected candidates; N = the round that will VERIFY the fix — the re-audit this pass opens, i.e. current round + 1 — never the round that found it, the same convention steps 2–5 use); an unfixed problem simply resurfaces at the next amnesia audit. The flow-state table is written at exactly two exits: user-approved structural rework (only then does an entry get a target step), and deferred items.

**Control flow (pseudocode)**:

```text
pool ← all failing items from this round's verification
        + module-table errors flagged at the human gate
        + carried-in issues-table entries whose symptom still reproduces
structural ← []   # parking array: issues whose LOCAL options are exhausted.
                  # Parked issues are not re-ground each pass; they are held and
                  # presented to the user in ONE batch at escalation — structural
                  # remedies (layer count, outline, assembly) usually resolve several
                  # parked issues at once, so they are judged together.

while true:                                   # each pass = one round
    workset ← pool − structural
    if workset empty and structural empty:
        break                                 # → all resolved; step 6 may be marked done

    if workset empty:                         # only exhausted issues remain — ⛔ user decides
        for (issue, log) in structural:       # decide PER ISSUE, not one global verdict
            summarize: every option tried × why each failed
            propose remedies the AI may not take alone (board outline / assembly
                change — e.g. relocate a large part to the opposite side to free component area /
                layer-count change / an OPEN requirement relaxation: documented
                plan amendment BEFORE implementation, never silent tolerance…),
                multiple-choice with a recommendation
            switch user_decision(issue):
                case approve:  NOW write the flow-state issues table
                               (target step = 2..5, status = open, severity);
                               remove issue from pool and structural
                               # later: new session → that step command (fix mode)
                               # → new session → re-enter step 6 to re-verify
                case redirect: extend the candidate space per the user's direction;
                               remove issue from structural ONLY   # stays in pool for retry
                               # a direction that crosses a user-owned bound
                               # (structural decision, do-not-substitute part, budget
                               # line) is explicit authorization to lift that bound for
                               # this issue — log the authorization; budget-line changes
                               # also amend the plan. Genuinely structural directions
                               # (layer count, outline) convert to approve instead.
                case defer:    ONLY for issues that are none of: a safety/compliance
                               risk, a part-damage risk, a manufacturability blocker —
                               those cannot be deferred (approve or redirect them);
                               write flow-state (status = deferred, with reason and
                               severity); remove issue from pool and structural
        if any issue was redirected: continue  # go actually try the user's direction
        break                                  # approved/deferred items exited via flow-state

    adopted ← 0
    for issue in workset:
        candidates ← enumerate_local_options(issue)
                        # equivalent part swap / value change / part move /
                        # track & via rework (by hand through the API — the EDA's
                        #   autorouter is off-limits here, same ban as step 5) /
                        # pin remap: move the signal to another capable MCU pin —
                        #   often dissolves a routing knot no track rework untangles;
                        #   check target-pin capabilities first (boot/strapping role,
                        #   wake capability, analog channel, peripheral mux — per the
                        #   target MCU's datasheet), then sync ALL carriers: the
                        #   firmware pin-map carrier (path in flow-state) / pinmap.md /
                        #   schematic / PCB netlist /
                        # whole-net re-anchor: a "disconnected" net may attach at
                        #   ANY point of either same-net island (pad, track segment,
                        #   via, pour) — enumerate attachment pairs along the whole
                        #   net; don't grind the ratsnest's nearest pair
                        # …these are examples, not the menu: ANY change that stays
                        #   inside the local bounds below qualifies as a candidate
                        # fix with the target step's disciplines: recompute operating
                        #   points on value swaps; audit off-state node potentials on
                        #   gating changes; re-check width vs current after power-net
                        #   rerouting; EasyEDA: vias before tracks, and read the
                        #   netlist-diff direction before ever applying
                        # consult rework-log rejections — never retry a rejected
                        #   option; adopted-then-reverted combinations are logged and
                        #   banned the same way
        solved ← false
        while candidates not exhausted:       # ← ask the user NOTHING during this loop
            option ← next(candidates)
            if crosses_local_bounds(option):  # see the four hard lines below
                log(option, "out of bounds"); continue   # counts as exhaustion evidence
            journal(option, objects touched, their prior values, expected check)
                                              # WRITE-AHEAD: the attempt is on the books
                                              # BEFORE the EDA changes — a crash between
                                              # here and the verdict leaves a findable,
                                              # reconcilable orphan (session check #5)
            apply(option)                     # hardware design side only
            if targeted_verify(issue) passes:    # re-run only the item that caught it
                journal_update(adopted, symptom/root-cause/fix); adopted += 1
                solved ← true; break
            rollback(option); journal_update(rejected, reason)   # exhaustion evidence
        if not solved:
            structural.append((issue, full_log))   # park it; decided at escalation

    if adopted > 0:
        delegate amnesia-verifier             # brand-new instance; same purity rules;
                                              # re-verification entries copied verbatim
        re-run the CONFIRMED verification plan in full   # fixes may introduce new
                                              # problems; increments from the fresh
                                              # audit queue for user confirmation (§3)
        round += 1                            # append the round row; report →
                                              # verification/round-N-findings.md
        pool ← all failing items from re-audit and re-run
        pool ← pool − entries already registered in flow-state
                                              # approved/deferred stay decided —
                                              # never re-ask the user
        structural ← structural ∩ pool        # match by symptom + involved nets/
                                              # designators, NOT module numbers
                                              # (fresh audits repartition); a parked
                                              # issue that no longer fails was fixed
                                              # incidentally — release it
    # adopted == 0 → pool unchanged; next pass workset is empty → escalation

    fuse: if the pool has not shrunk for two consecutive passes, treat the
          persistent issues as exhausted (park them) — prevents A↔B oscillation
          where fixing one issue keeps breaking another across rounds.
```

**Local bounds (touching any one of these disqualifies an option as "local" — it goes to structural instead):**
- Board outline, component side, assembly mode, or any enclosure-level decision (the user's call)
- Layer-count change
- Parts flagged "do-not-substitute" in the BOM (swapping one swaps out the evidence)
- The top-priority metric's budget lines (never "fix" by breaking the budget)

**Fast-rework evidence (what the journal must show per fix type — the wrap-up gate releases only journaled evidence):**
- pin remap → new pin's dual-source check + reset/strap/wake safety + host tests updated + netlist diff clean + affected routing re-verified
- part/value swap → operating point recomputed + every hard budget line re-checked + netlist diff clean
- part move → the four placement self-checks + critical-loop shape check + affected routing re-verified

## Wrap up
Fill the verdict for every round row this session opened. Report per issue: attempt chain → adopted fix → re-verification verdict (the rework log holds the full account). When closing a flow-state issue (structural rework or a step-7 handoff), write the verifying round number next to the status — a bare status flip looks like report-tampering to the guard hook and to any auditor.
⛔ **Design-delta acknowledgement (per-item accept / reject)**: before marking done, present every adopted fix that changed the pin map, the BOM, or placement/routing topology — the loop ran autonomously by design; this is where the human trail catches up. A **rejected** item is rolled back using its journal entry's prior values, its dependent changes reverted, the option logged as rejected (never retried), and the loop re-entered to resolve that issue another way — rejection ends the fix, not the issue.
- Issues at zero and every verification item at `sim-pass`/`evidence-pass` — or `post-fab-required` with its criterion recorded → mark step 6 `done`, tell the user: **new session, run **step7-integrate** (Claude Code: `/boardless-pcb:step7-integrate`)**
- Approved structural rework pending → set step 6 `waiting`; list exactly which commands to run, in order
- Deferred items → leave them in the issues table (status = deferred) with reasons; nothing disappears silently