Plumbing Verified ≠ Behavior Verified

The trap: you prove a component or an adjacent path works and quietly upgrade that to "the feature works." They are different claims with different evidence.

The canonical example

> The MCP server's callTool executes the tool directly — no system prompt, no persona, no "agent decides to call the tool."

Hand-sending tools/call audit_site over stdio proves the engine is exposed over MCP. It does not prove the Done criterion — "say 'audit stripe.com', it round-trips and returns the graded report" — because that criterion is the agent taking an instruction and choosing the tool. Different path, different proof.

The layers you might confuse

• Unit passes ≠ the units work together (integration).
• Endpoint reachable ≠ the flow that calls it succeeds end-to-end.
• Tool callable directly ≠ the agent loads its persona and chooses to call it.
• Function returns right in isolation ≠ it's wired into the screen the user touches.
• Happy path runs ≠ the error paths behave.

How to apply

1. Write the real user path as a sentence. "User says X → system does Y → user sees Z." That sentence, executed, is the only proof.
2. Locate where your test entered. If it entered below or beside that path (direct call, mock, lower layer), you tested plumbing — name it as plumbing.
3. Find the one-shot that runs the whole path. (e.g. vanta run "<instruction>" invokes the real agent loop with persona + tools + provider — that's the true Done test, not the MCP direct call.)
4. Run that. Then grade it ✅ in the ledger (vd-claim-ledger]]); until then it stays ◐.

Governed by vd-done-is-executed]]. Pairs with vd-run-the-real-path]].