The witness envelope

Every tool returns the same envelope. An answer is a witness — an evaluable claim, not a bare fact — so it always names the cube generation it came from and discloses its coverage.

{
  "ok": true,
  "tool": "read_witnesses",
  "generation": {
    "namespace": "bs:cube:0852c73eef54",
    "schema_fingerprint_ns": "0852c73eef54"
  },
  "result": { /* the witnessed cube row */ },
  "coverage": { "has_flags": { /* observed / absent / uncertain */ } },
  "error": null
}

• ok — whether the call produced a witness; on a refusal or bad input it is false and error is populated.
• generation — the immutable cube snapshot the answer was read from (replayable).
• coverage — three-way honesty: a value is observed, absent (unknown ≠ zero), or present-but-uncertain.
• error — fail-closed; the engine never fabricates a value to fill a gap.

This means an LLM can reason about how much to trust a response, and what to call next, without your prompt having to explain the API.