postcheck-verifier() {
  local action="$1"
  local expected="$2"
  local actual="$(eval "$action" 2>/dev/null)"
  local exit_code=$?

  # L0: Command ran
  if [ $exit_code -ne 0 ]; then
    echo "[L0 FAIL] Command exited with code $exit_code"
    echo "[ACTUAL] $actual"
    return 1
  fi
  echo "[L0 PASS] Command exited 0"

  # L1: Output matches expectation
  if [ -n "$expected" ] && ! echo "$actual" | grep -q "$expected"; then
    echo "[L1 FAIL] Output did not contain expected: $expected"
    echo "[ACTUAL] $actual"
    return 1
  fi
  echo "[L1 PASS] Output matches expected"

  # L2: State probe (when applicable)
  case "$action" in
    docker\ start*)
      container_name=$(echo "$action" | awk '{print $3}')
      state=$(docker inspect -f '{{.State.Running}}' "$container_name" 2>/dev/null)
      [ "$state" = "true" ] && echo "[L2 PASS] Container $container_name is running" || {
        echo "[L2 FAIL] Container $container_name not running"
        return 1
      }
      ;;
    curl\ -sf\ http://localhost:*)
      endpoint="${action#curl -sf }"
      curl -sf "$endpoint" > /dev/null 2>&1 && echo "[L2 PASS] $endpoint responds" || {
        echo "[L2 FAIL] $endpoint not reachable"
        return 1
      }
      ;;
    git\ push*)
      # Check remote actually has the commits
      git fetch origin 2>/dev/null
      local_sha=$(git rev-parse HEAD)
      remote_sha=$(git rev-parse origin/main 2>/dev/null)
      [ "$local_sha" = "$remote_sha" ] && echo "[L2 PASS] Commit on remote" || {
        echo "[L2 FAIL] Commit not on remote. Local=$local_sha Remote=$remote_sha"
        return 1
      }
      ;;
  esac

  echo "[VERIFIED] Action verified to L2. For L3/L4, manual verification recommended."
  return 0
}

# For code changes — run actual functional proof
test_functional() {
  local feature="$1"
  case "$feature" in
    mcp_health)
      # Real probe: does the MCP actually process a request?
      response=$(curl -sf -X POST http://localhost:8080/mcp \
        -H "Content-Type: application/json" \
        -d '{"method":"tools/call","params":{"name":"health_probe"}}' 2>/dev/null)
      echo "$response" | grep -q "healthy" && echo "[L3 PASS] MCP functional" || {
        echo "[L3 FAIL] MCP responded but not healthy"
        return 1
      }
      ;;
    docker_compose)
      # Real probe: are all critical services reachable?
      for service in arifosmcp traefik postgres; do
        docker ps --filter "name=$service" --filter "status=running" | grep -q "$service" || {
          echo "[L3 FAIL] $service not running"
          return 1
        }
      done
      echo "[L3 PASS] All critical services running"
      ;;
    git_branch)
      # Real probe: does the branch have the expected files?
      required_files="core/governance_kernel.py core/judgment.py core/pipeline.py"
      for f in $required_files; do
        git ls-files | grep -q "^$f" || {
          echo "[L3 FAIL] Required file missing: $f"
          return 1
        }
      done
      echo "[L3 PASS] Required files present on branch"
      ;;
  esac
}

# For sovereign decisions — prove the real-world outcome
prove_reality() {
  local goal="$1"
  echo "[L4] Proving reality: $goal"
  
  # The question to answer: "Did the system do what Arif asked?"
  case "$goal" in
    "main branch repaired")
      # The REAL proof: can pytest run? can the server start?
      cd /root/arifosmcp
      pytest --collect-only -q 2>/dev/null | tail -1 && echo "[L4 PASS] Tests collect" || echo "[L4 FAIL] Tests do not collect"
      curl -sf http://localhost:8080/health > /dev/null 2>&1 && echo "[L4 PASS] Server responds" || echo "[L4 FAIL] Server not responding"
      ;;
    "container running")
      # The REAL proof: can the service actually handle requests?
      docker exec arifosmcp python -c "import sys; sys.path.insert(0,'/root/arifosmcp'); from core.governance_kernel import GovernanceKernel; print('OK')" 2>/dev/null || echo "[L4 FAIL] Module cannot be imported inside container"
      ;;
    "config deployed")
      # The REAL proof: does the new config produce the expected behavior?
      curl -sf http://localhost:8080/health | grep -q "SOVEREIGN" && echo "[L4 PASS] Config loaded correctly" || echo "[L4 FAIL] Config not reflected"
      ;;
  esac
}