Run the Real Path

Reading code tells you what should happen. Running it tells you what does. When both are available, running wins — and it's usually cheaper than the paragraph you'd write justifying the inspection.

The smell

These thoughts mean stop and run it:

• "The code clearly does X."
• "This is wired correctly."
• "It should work now."
• "Looks right."

Your 100% certainty in unfamiliar territory is a cue to check, not a green light. The "looks right" signal is exactly where inspection fails and execution catches it.

How to apply

1. Find the realest entry point you can run. The one-shot that exercises the whole user path beats any proxy: the agent loop over a mock, the CLI over a unit test, the deployed URL over localhost-only.

• Example: vanta run "audit stripe.com" runs the real persona + tools + provider in one shot — that's the Done test, so run that, not the direct tool call.

1. Run it. Read the actual output. Not the exit code alone — the content. Did it return the graded report, or just not crash?
2. If you genuinely cannot run it (no env, no creds, destructive), say so explicitly and mark the claim ◐ code-path in the ledger (vd-claim-ledger]]) — never silently upgrade it to ✅.
3. Re-run after the last edit. A green from before your final change proves nothing about the code that ships.

Don't fake the run

A mock that returns success, a test that asserts nothing, a happy-path stub — these look like execution and prove less than honest inspection. If you stub it, the claim is ○ assumed, not ✅.

Governed by vd-done-is-executed]]. Pairs with vd-plumbing-vs-behavior]].