Module 01
The five verbs
The closed command grammar: ask, show, check, run, create.
Learning intent
By the end of this module you will be able to
- Explain the five closed Varro command verbs and their effect boundaries.
- Choose the correct verb for read, render, validate, execute, and create tasks.
Success criteria
- Distinguish ask from show without collapsing them into one read verb.
- Explain why check is safe in CI and run/create require governance.
- Identify the state effect of each verb in a concrete scenario.
Learner readiness
Before this reference page
Assumed terms:
Terms introduced or strengthened here:
You are ready to continue when you can:
- explain what each of the five verbs does at the surface
- distinguish a product or agent surface from the source of truth
- describe how an agent can cite sources without becoming authoritative
Concept · grounded · RICH E4
ask
One of the five command verbs: request information without mutation.
Worked examples
ask demonstrator-importInside a workflow, `ask` retrieves the named subject so later steps can reason over it. It reads; it never writes. Compare the `ask education-project-root` line in import-year10-authorities.
ask <subject> <object>At the command surface the grammar is closed: ask, show, check, run, create. `ask system status` queries authoritative truth and returns it; an unknown verb like `fetch` is rejected before it reaches a source.
Try it
Given a request, identify whether the safe Varro verb is ask, show, check, run, or create, then author a small checked system so the distinction is grounded in a real VSL artifact.
# Choose the verb, then complete a system that can be checked.
Model answer (passes varro check vsl)
system mentormind.facilities.room_booking {
mission "Specify a governed room-booking surface for a campus, exposing booking state as typed contracts under research authority"
authority lane "operator:research"
domain education
maturity draft
context root = "helios://local/mentormind/facilities/room-booking?view=detail&tab=contract&bind=auto"
enum RoomState {
value free
value held
value booked
}
type Room {
field room_id: string required
field capacity: integer required
field state: RoomState required
}
compile booking-runtime -> varro
action hold-room {
risk low
binding required
input room_id: string required
}
query rooms.free {
output Room[]
}
workflow reserve-room {
inspect selection
resolve rooms.free
check hold-room
render center.detail
}
runtime specification {
host governed
commit-mode host-only
}
}
Common trap
❌ Learners think `ask` can modify or trigger something because it sounds like a request that gets fulfilled.
Correction
✅ `ask` is strictly read-only: it retrieves authoritative truth and returns it. Only `run` and `create` mutate, and only under preview-by-default.
Check yourself
Does the `ask` verb ever mutate state? If not, which verbs do?
Answer
No. `ask` is read-only; it retrieves authoritative truth. Only `run` (execute an action) and `create` (make a new artifact) mutate, and both under preview-by-default.
Concept · grounded · RICH E4
show
One of the five verbs: render/display a view of state.
Worked examples
show program-overview
show safety-case
show interface-control-document`show` displays a selection without changing it. The report-demonstrator-claim-boundary workflow is built entirely from `show` steps because reporting is read-only.
show <subject> <object>`ask` is about obtaining the value into the conversation; `show` is about rendering it for a human or a view binding. Both are non-mutating, but `show` carries presentation intent (a table, a detail pane).
Common trap
❌ Since both are read-only, learners use `show` and `ask` as synonyms.
Correction
✅ `ask` retrieves a value into the conversation; `show` renders a selection for presentation (a view, a table). Both read state, but `show` carries display intent.
Check yourself
Both `show` and `ask` are read-only. What distinguishes them?
Answer
`ask` retrieves a value into the conversation; `show` renders a selection for presentation (a view or table). Same read, different intent.
Concept · grounded · RICH E4
check
One of the five verbs: validate an artifact against its contract.
Worked examples
check conflict-policy
check blocked-output-policy`check` runs a validation and yields pass/fail diagnostics. It mutates nothing; it asserts that an artifact conforms to its declared rules before a `create` step is allowed to proceed.
check evidence-class
check promotion-gate
create evidence-class-mappingA common, correct pattern: validate (`check`) every governing policy, and only then `create`. If a check fails, the workflow fails closed and the create never runs.
Common trap
❌ Learners assume `check` executes the action or workflow it is validating.
Correction
✅ `check` only validates an artifact against its contract and emits diagnostics. It never executes; execution is `run`. A failing check fails closed and blocks any following create or run.
Check yourself
What happens in a workflow when a `check` step fails?
Answer
`check` validates an artifact against its contract and emits diagnostics; it never executes. On failure the workflow fails closed, so any following `create` or `run` does not proceed.
Concept · grounded · RICH E4
run
One of the five verbs: execute a governed action/workflow.
Worked examples
run authorize-ignition --execute`run` executes a declared action or workflow. Under preview-by-default it first describes the governed action and its authority posture; the mutation only happens when `--execute` is opted in.
workflow promote-evidence {
check promotion-gate
run record-reconciliation
}A `run` step inside a workflow invokes a named action contract. The surrounding `check` keeps the run honest: nothing executes until the gate passes.
Common trap
❌ Learners expect `run` to perform the mutation as soon as it is issued.
Correction
✅ Varro is preview-by-default: `run` first describes the governed action and its authority posture. The mutation happens only when `--execute` is opted in.
Check yourself
When you issue `run`, does the mutation happen immediately?
Answer
No. Varro is preview-by-default: `run` first describes the governed action and its authority posture. The mutation only occurs when `--execute` is opted in.
Concept · grounded · RICH E4
create
One of the five verbs: bring a new governed artifact into being.
Worked examples
create magatama-source-of-truth-rule
create demonstrator-import-gate`create` materialises a new governed record. In assert-magatama-source-of-truth it runs last, after the policies have been shown and checked, so the new artifact is born already validated.
create <subject> <object>`create` brings a new entity into existence (a record, a contract); `run` executes an already-declared action over existing state. Use `create` for nouns, `run` for verbs.
Common trap
❌ Learners treat `create` and `run` as one mutating verb.
Correction
✅ `create` brings a new governed artifact (a noun) into being; `run` executes an already-declared action (a verb) over existing state. They are different mutations.
Check yourself
When do you use `create` rather than `run`?
Answer
Use `create` to bring a new governed artifact (a noun, e.g. a record or contract) into being; use `run` to execute an already-declared action (a verb) over existing state.
Module assessment · scored