The Mechanism Audit

Software reviews were built on the assumption that a human performed every action and a second human watched. Products that commit, publish and invoice on their own have removed the witness, and the instruments of review — the demo, the screenshot, the QA script — cannot certify a mechanism nobody saw run. This paper sets out a method for auditing that class of product: a claim ledger, a mechanism map, an evidence trail, a detector and a response, with the requirement that a stranger can re-run all five. Six failure signatures are formalised — the green run, the allowlist, the credential that authenticates, the retry that published twice, the fallback that looked like output, the origin that had not propagated — each with a production incident attached from one week of operating seven ventures, and each mapped to one of six gap classes: claim–evidence, scope, capability, ownership, propagation, attribution.