<a id="ch-18"></a>

## Chapter 18 — The contractor verifies; the vendor does not grade itself

<!-- open-cyber-academy:lesson-figures:start ch-18 -->
### Lesson map

Lesson 18. Map, example, EX064.

```mermaid
flowchart TD
  A["Vendor agrees to fix the gaps"] --> B["Clause: vendor confirms fixes in writing"]
  B --> C["Contractor verifies"]
  C --> D{"Is any of that filed as done?"}
  D -->|No| E["Keep three different documents apart"]
```

Agreement, written confirmation, and independent verification are three states.

### Logical drawing

```text
promise
    vendor agrees to fix the three gaps before launch
clause
    vendor confirms fixes in writing
verification
    the café's IT contractor
    a log of what he did and when
not filed
    the confirmation
    the contractor's sign-off
    a new checklist score
```
<!-- open-cyber-academy:lesson-figures:end ch-18 -->

### Learning outcomes

After this chapter, you should be able to:

1. Name who verifies the vendor's fixes.
2. Keep the written-confirmation clause distinct from a confirmation already filed.
3. Refuse a score the vendor awards to itself.

### 18.1 The person who changes the system is not the person who signs it off.

The vendor agrees to fix the three gaps before launch. That is the vendor speaking about its own future work. Elena adds a separate clause: the vendor must confirm in writing when reported issues are fixed. A clause in the scope tells both parties what a finished fix must look like. It is not a letter already in the restricted folder. The person who checks the claim is the café's IT contractor. He keeps a log of what he did and when. Chapter 4 makes his verification a condition of the pilot. The condition shows the job is his. It does not show the job completed. If the vendor graded its own fixes, the confirmation and the verification would collapse into the same party's word. The file does not allow that collapse. A written confirmation, when it eventually exists, would still be the vendor's statement. The contractor's log would be the independent check. Neither artifact is included here. Until both exist, the checklist print remains the earlier run, with the three gaps still listed. Agreement alone does not produce a new score.

### 18.2 Worked example

Assign each sentence to the party that would have to produce it.

| Sentence | Party | Filed? |
|---|---|---|
| "We will fix the three gaps before launch." | Vendor | Promise only |
| "Confirm the fixes in writing." | Clause Elena adds | Not a letter on file |
| "The contractor has verified the fixes." | Café's IT contractor | Not shown as done |
| "The vendor's own grade replaces that check." | Nobody in this file | Refuse |

> **Synthetic case.** The contractor remains unnamed, as in the earlier chapters. His log is described, not attached.

### Errors and limits

Requiring a check is how the decision stays honest. Requiring it is not performing it.

### Apply

- **EX064 — Who signs the fixes off?** The vendor agrees to fix the gaps and must confirm fixes in writing. Who verifies those fixes, and which of these papers does the file already contain? *Rubric:* 3 = the café's IT contractor verifies; the vendor does not grade itself; the written confirmation is a clause, not a filed confirmation; the verification is not shown as done;; 2 = the contractor checks and nothing is filed yet;; 1 = the vendor only;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-18 -->
### Continue studying — lesson 18 (chapter 18 of 20)

[← Chapter 17](#ch-17) · [Course chapter index](../SUBJECTS.md) · [Chapter 19 →](#ch-19)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex064"></a>
**EX064.** The café's IT contractor verifies the fixes. The vendor does not grade itself. Written confirmation is a clause, not a filed confirmation.
