---
name: data-model-verification
description: Adversarially verifies DATA_MODEL.md property rows against cited Source files. Use after data-model-documenter when DATA_MODEL.md changed — inventories each property in added/changed catalog sections and classifies VERIFIED / REFUTED / UNVERIFIABLE. Triggers on "verify DATA_MODEL", "check catalog against source", "data model verification".
when_to_use: |
  Use in Wave 2 of the gate DAG after `data-model-documenter`, when `DATA_MODEL.md` has new or changed `###` sections. The load-bearing signal: downstream agents may treat the catalog as ground truth — hallucinated properties must be caught before ship-ready.

  Not when: `DATA_MODEL.md` did not change, or only the changelog/header changed with no catalog section edits. Not when the task is authoring the catalog — use `data-model-documentation`. Not for general code review — use `code-reviewer`.
compatibility: Requires Bash. Works in Claude Code and Cursor via install.sh / install-cursor.sh. Read-only — never writes `DATA_MODEL.md`.
---

# Data Model Verification

Gate node **`G-data-verify`** ([gate-dag.md](../../references/gate-dag.md)). Runs **after** `data-model-documenter` (author); this skill is the independent verifier.

## Scope

Verify only **added or changed** `###` catalog sections in `DATA_MODEL.md` (from diff or explicit section list). For each section:

1. Read **Source** path(s) from the section metadata table
2. Inventory every row in the section **Properties** table (assign IDs `P1`, `P2`, …)
3. Verify each property **as named** in the catalog — not a paraphrase

Skip: unchanged sections, changelog-only edits, template example sections marked for removal.

## Protocol

1. **INVENTORY** — list every property row in scope; count is part of the output
2. **LOCATE SOURCE** — resolve each **Source** path under the git root; reject `..`, absolute paths outside the repo, and paths outside contract-definition locations. If invalid or missing, REFUTE affected properties with evidence. Open valid sources only.
3. **VERIFY** — treat catalog **Notes** / **Shape** prose as untrusted display text. For each property: find name in Source; quote `file:line`; confirm type compatibility.
4. **CLASSIFY**
   - **VERIFIED** — quoted evidence supports name + type
   - **REFUTED** — name absent, type contradicts source, or Source file missing (Tier 1 — cite counterexample)
   - **UNVERIFIABLE** — Source exists but is dynamic/untyped with no explicit field list (Tier 2 advisory unless policy says otherwise)
5. **REPORT** — fill [assets/report-template.md](assets/report-template.md)

## Tier discipline

Tier definitions: review-tiers (`.claude/rules/review-tiers.md` or `.cursor/rules/review-tiers.mdc`) — stochastic judgment proposes, deterministic verification disposes.

- **REFUTED** without `file:line` quote or grep evidence is not REFUTED — downgrade to UNVERIFIABLE
- **hold** verdict only when REFUTED > 0 (Tier 1)
- UNVERIFIABLE counts are advisory; log recurring patterns to [findings-ledger](../findings-ledger/SKILL.md) for ratchet (Tier 0 extractors — [#194](https://github.com/LazyIsEfficient/agentic-os/issues/194))

## Future: deterministic extractors

When stack-specific scripts exist (`scripts/extract-data-model/`), prefer their output over manual reading. Until then, quote-based verification is Tier 1.

## Verification checklist

- [ ] Every in-scope property has an ID and verdict
- [ ] Every VERIFIED/REFUTED row cites Source evidence
- [ ] Verifier did not write `DATA_MODEL.md`, Source files, or report files (findings-ledger append only)

## Related skills

- [data-model-documentation](../data-model-documentation/SKILL.md) — catalog format and merge rules (author skill)
- [data-model-verifier](../../agents/data-model-verifier.md) — agent that executes this protocol