Plumbing Verified ≠ Behavior Verified

The trap: you prove a component or an adjacent path works and quietly upgrade that to "the feature works." They are different claims with different evidence.

The canonical example

The MCP server's callTool executes the tool directly — no system prompt, no persona, no "agent decides to call the tool."

Hand-sending tools/call audit_site over stdio proves the engine is exposed over MCP. It does not prove the Done criterion — "say 'audit stripe.com', it round-trips and returns the graded report" — because that criterion is the agent taking an instruction and choosing the tool. Different path, different proof.

The layers you might confuse

• Unit passes ≠ the units work together (integration).
• Endpoint reachable ≠ the flow that calls it succeeds end-to-end.
• Tool callable directly ≠ the agent loads its persona and chooses to call it.
• Function returns right in isolation ≠ it's wired into the screen the user touches.
• Happy path runs ≠ the error paths behave.

How to apply