feat: RISK-ACCEPTED signs for weak evidence never a missing seal, and the ONE approval asks its questions out loud

[TinDang97]

Stacked on #207 (feat/affordance-truth), which is the base here so the diff is just these 7 commits. Retarget to main before #207 merges — merging the parent with --delete-branch first orphans this one.

Two nodes, both driven through ADD, both closed on a receipt-backed gate. They are one finding at two depths: a guard written for one verdict is a guard for one verdict.

1 — RISK-ACCEPTED signs for weak evidence, never for a missing seal

#206 found that skipping freeze did not fail the post-freeze guards, it switched them off, and closed that hole for PASS. Every one of gate's sixteen integrity refusals was written verdict == "PASS", so the identical hole stayed open one verdict over. Measured before the fix — a Task created seconds earlier, still carrying goal: <one line> and every template section, never frozen, never briefed:

$ add run probe -- true          &&  add gate probe RISK-ACCEPTED --reason "probing"
$ add done probe
/tasks/probe.md is done

Three calls, from scaffold to done, past R:UNSEALED · drift · R:UNBRIEFED · the placeholder check · R:UNDECLARED_SENSITIVE. The lane meant to be the scrutinised one carried no scrutiny at all.

The sixteen inline conditions are now one predicate over two named tuples, so the classification is reviewable in one place instead of being re-decided at each site. The split is "would a verdict here be a FABRICATED record, or merely an OPTIMISTIC one?"

• INTEGRITY_REFUSALS protect the RECORD — unsealed · drift · placeholders · undeclared-sensitive · phantom-scope, plus two explore equivalents. They bind every verdict that approves or closes. Accepting a risk is not a route around the seal.
• EVIDENCE_REFUSALS judge the RUN — stale receipt · failed run · unbound covers: · open questions · missing security lens. PASS only: signing for imperfect evidence is exactly what RISK-ACCEPTED is for, and three of them already named it as their own remedy.
• HARD-STOP is refused by neither. It never closes a task, so refusing it would only stop a finding being written down.

_binds raises on an unclassified name — a refusal added later cannot silently inherit either tier.

done gained the seal check (any (re)freeze must precede the entitling gate; a refreeze recorded afterwards, the re-cross pattern, is not required to). Two smaller findings fell out of the same read, both re-characterized by execution rather than taken from notes:

• _paths_touch over-matched on string prefix. The recorded symptom — scope: s defeating the A17 floor — is false; probed, it returns False. The real defect is the opposite and lives in the exemption direction of R:UNDECLARED_SENSITIVE: scope: src signed for a changed srcfoo/secret.yaml, and secrets_public/ answered for secrets/**. Now whole-segment.
• An unreadable sensitivity: floored DOWN. high and critical both read process. Two real nodes on the parent branch declared high and floored to process where they meant plan. It now floors to human, and new refuses the value outright — deliberately breaking that function's "slots, never validation" stance, because sensitivity: is not a prose slot but the enum that computes the floor, and init already refuses an unknown --profile for the same reason.

2 — The ONE approval asks its questions out loud

freeze already refused an incomplete contract eight ways. Every one checks the document. None checked the conversation.

## ASSUMPTIONS is by construction a list of silences the AI filled in on the human's behalf, each line carrying the reading taken and the cost if it is wrong. The sweep made the AI write those down. Nothing made it ask. So ADD's one human approval was a single stamp that said nothing about whether the human had seen a single decision they were approving.

$ add freeze <slug> --by "Tin Dang" --authority human
cannot freeze `<slug>` — the ONE human approval is being asked for decisions
no human has been shown: A1, A2, A3, A5, R:HATCH -> "R:UNINTERVIEWED"
next: add interview <slug>

add interview (the 24th verb) compiles every non-n/a assumption and every Reject into a numbered question carrying the reading and the cost. Bare it is a read; --answer <id>=confirm|correct|defer --by "<name>" writes a .d/interviews/<n>.md sidecar and one act: interview stamp — the same sidecar shape .d/runs/ uses, so no body section is renumbered (the engine keys sections by number, which has bitten this repo).

Design calls, each pinned:

• It runs LAST in freeze's ladder — there is no sense putting template text to a human.
• Keyed on the computed floor, never on --authority. The line below it is authority or authority_for(...), so reading the flag would have shipped the guard with its own off switch: --authority process on a security node.
• Staleness by digest, like direction: and brief:. interview_gap reads the stamp whose digest matches the current text, not the latest — revert an edit and the earlier interview answers for it. Reword an interviewed assumption and it re-opens; edit a Must and it does not, because the Musts came from the human.
• correct never completes an interview — it is cleared by editing the item, which moves the digest. defer does: a human may accept a risk knowingly.
• The engine claims nothing about humanity. --by is recorded verbatim, exactly as freeze --by is. R:SELFANSWER is shipped prose, and a check proves the prose ships — a guard that asserts what it cannot prove is how a stamp becomes theatre.

Verification

The gate refused the first PASS on both nodes, and was right both times. In each case the culprit was the same class: assumptions added during authoring to close the sweep had checks written but never declared in ## CHECKS — the docstring covers: is not the binding. Two rules had no check at all.

Writing one of those missing checks found a defect on its first run: rewriting sixteen conditions into two tuples is exactly the edit where a refusal quietly vanishes, and one had — R:UNFROZEN_EXPLORE was listed in the integrity tuple but never dispatched, because it refuses unconditionally, HARD-STOP included. Routing it through _binds would have narrowed an existing refusal to buy tidiness. It comes out, with the reason recorded at the site. (The check's own count was wrong too — it asserts an explicit member set now, which pins strictly more than a number.)

• Red first: 13/19 and 18/21. The green ones are deliberate counter-guards — a process-floor node is never interviewed, a lone refreeze still seals, a legitimate RISK-ACCEPTED still closes, a first call still hears the receipt message, a HARD-STOP stays recordable on an unfrozen node.
• 861 passed / 0 failed / 7 skipped across both roots. Four engine twins synced, both MD5 pins re-aimed.
• Dogfooded: add interview freeze-interview puts all 12 of that node's own open decisions.

Reviewer notes

• An incumbent frozen contract overruled a design choice here. I classed unbriefed as integrity; test_non_pass_verdicts_are_never_blocked carries brief-gate's frozen M3 — "a verdict is how a node LEAVES a bad state." That Reject belongs to another task, so the refusal moved rather than the test. It reads correctly on the merits: a missing brief is a fact about how the run was driven, and the seal, drift and placeholder guards still bind every verdict.
• The interview feature does not gate itself. Its node is architecture → floor plan, and M5 keys on the computed floor, so it was exempt from the refusal it ships. That is the design — a plan freeze has no human in the room — but the first real exercise of R:UNINTERVIEWED will be the next security-floored node.
• Six incumbent fixtures were corrected, none weakened; every assertion is unchanged. Four forged a gate stamp with no freeze, or called add.freeze and discarded a refusal. They now include the seal the method always implied and assert it landed — a fixture that silently skips the one approval tests no real path.
• Adding a verb rippled into six registries and five SKILL.md budget pins, one of which is literally R:BUDGET_BUMP — so the addition was funded by compressing the freeze bullet beside it, back to 176 lines exactly. test_no_new_verb_in_the_cli_surface is re-aimed 23 → 24, not deleted: its claim is that the authoring-beat task added no verb, and a later task legitimately adding one moves the value without weakening that.
• A separate hole is flagged but not fixed here: freeze takes authority or authority_for(...), so an explicit --authority process downgrades even a security node outright.

---

Update (pre-merge review): rebased onto main after #207 merged as a squash, so this now targets main directly and carries only its own 9 commits.

The review found one defect, and the node was reopened to build rather than patched after close. interview_gap returned on the FIRST stamp whose digest matched the node — so a human who answered three decisions, was interrupted, and came back to answer the rest was still refused, with no way forward but editing the node, which is the one action that DISCARDS the answers. Reading the last match instead would have been wrong in the opposite direction: a follow-up correct outranked by the earlier confirm.

Passes over the same text now fold in order, later winning. Fixing that exposed the second half: each stamp recorded the full decision list with unanswered for ids that pass had not touched, so folding made every pass clobber the one before it. The stamp's answer map is now sparse — the sidecar remains the human-readable record, the stamp is the machine-readable delta. Two checks, red first, the second being the counter-guard for the first.

Also found, NOT fixed here — pre-existing: _oneline is applied to --reason but not to --by, on freeze and gate alike. add freeze --by "ev{il}" writes a stamp that parses back as zero stamps: the whole verified: ledger is lost, and that ledger's ordering IS the trust model. interview follows the same incumbent convention. Worth its own node.

863 passed / 0 failed / 7 skipped after the rebase.

[TinDang97]

Correction to the note added to this PR body before merge.

The pre-merge review note claimed add freeze --by "ev{il}" writes a stamp that parses back as zero stamps and loses the whole verified: ledger. That is wrong. The probe behind it froze an unauthored node, so freeze correctly refused on template placeholders and wrote nothing — I read a correct refusal as corruption. Braces in --by round-trip fine.

There is a real defect in the same area, now measured properly. The trigger is an odd number of double-quotes, not a brace — which is precisely why _oneline (which maps " to ') makes --reason safe and leaves --by exposed:

$ add freeze t --by 'O"Brien' --authority human
freeze recorded at authority `human`          # reported as success

stamp keys read back: ['by']                   # act, authority, direction all swallowed
_is_frozen       -> False
sealed_direction -> None

The seal silently does not exist while the human is told it does. It fails closed — the gate then refuses with R:UNSEALED — so nothing is let through; the damage is a verb reporting a record it did not write, across all seven raw by: interpolations (freeze, brief, replan, gate ×2, check, interview). Balanced quotes (Tin "TinDang97" Dang) are unaffected.

Filed and fixed separately before 3.3.0.