@event4u/agent-config 14.23.0 → 15.0.0

package/src/scripts/_lib/ratification_artifact.ts

@@ -0,0 +1,278 @@
+/**
+ * The ratification artifact — ADR-268 § 4's control, in one reader.
+ *
+ * ADR-268 § 4 permits an agent to edit kernel rules, governance hooks and
+ * authority schemas inside an authorised mission, and forbids it to ratify its
+ * own increase in power:
+ *
+ * ```
+ * AN AGENT MAY MODIFY ITS CONSTITUTION. IT MAY NOT RATIFY ITS OWN INCREASE IN POWER.
+ * THE PARTY GAINING THE AUTHORITY IS NEVER THE PARTY RECORDING THE RATIFICATION.
+ * PROVIDER DIVERSITY IS REQUIRED WHERE TWO PROVIDERS ARE CONFIGURED.
+ * ```
+ *
+ * That sentence is the whole reason this module exists as a pure reader with
+ * no filesystem and no network: the gate that reds a PR
+ * (`check_kernel_edit_ratified`) and the tests that prove it reds must decide
+ * from the same code, or the fixture proves a second implementation rather
+ * than the shipped one.
+ *
+ * Why `reviewed_by` is checked against BOTH producer fields.
+ * `road-to-typed-grants-that-persist` Phase 5.1 names one fixture — an
+ * artifact whose `proposed_by` equals its `reviewed_by` is rejected. The Iron
+ * Law above is broader than that fixture: the party gaining the authority is
+ * the party that proposed the expansion AND the party that implemented it, and
+ * an artifact reviewed by its own implementer is the same defect wearing the
+ * other field's name. Both are rejected, and this paragraph is why the code is
+ * wider than the step that asked for it.
+ *
+ * What this module does NOT decide: whether a diff is authority-EXPANDING.
+ * That is a judgement over rule prose, not a property of the artifact, and
+ * ADR-268 § 4 makes the artifact required for the expanding case only.
+ * `check_kernel_edit_ratified` requires the artifact for every kernel-rule
+ * diff instead — a strictly stronger and decidable rule — and says so in its
+ * own header rather than pretending to classify.
+ */
+
+import { readAdrFrontmatter, type AdrFrontmatter } from './adr_frontmatter.js';
+
+/** Where a ratification artifact lives. One directory, so the gate can find it. */
+export const RATIFICATION_DIR = 'agents/evidence/ratifications';
+
+/**
+ * The verdict vocabulary — closed, because an open one is a free-text field
+ * that always reads as approval to a grep.
+ */
+export const RATIFICATION_VERDICTS = [
+    'ratified',
+    'confirmed-non-expanding',
+    'refused',
+    'non-convergent',
+] as const;
+export type RatificationVerdict = (typeof RATIFICATION_VERDICTS)[number];
+
+/**
+ * The two verdicts that let a diff land.
+ *
+ * `confirmed-non-expanding` exists because the gate demands an artifact for
+ * EVERY kernel and governance-hook diff, including a typo fix. Calling that a
+ * ratification of an authority expansion would be false, and a vocabulary that
+ * forces a false label is a vocabulary people route around. Adopted from the
+ * round-1 review, which named the pressure this relieves.
+ */
+export const PASSING_VERDICTS: ReadonlySet<string> = new Set([
+    'ratified',
+    'confirmed-non-expanding',
+]);
+
+/** The six fields Phase 5.1 names, all required. */
+export const RATIFICATION_FIELDS = [
+    'proposed_by',
+    'implemented_by',
+    'reviewed_by',
+    'providers',
+    'verdict',
+    'effective_after',
+] as const;
+
+export interface RatificationArtifact {
+    proposed_by: string;
+    implemented_by: string;
+    reviewed_by: string;
+    /** Provider ids consulted, in source order. Diversity is counted over this. */
+    providers: string[];
+    verdict: RatificationVerdict;
+    /** `merge`, or an ISO-8601 instant. Never a bare "later". */
+    effective_after: string;
+}
+
+export interface RatificationProblem {
+    /** Stable code, so a test asserts the reason rather than the wording. */
+    code:
+        | 'no-frontmatter'
+        | 'missing-field'
+        | 'unknown-verdict'
+        | 'self-ratified'
+        | 'no-providers'
+        | 'diversity-required'
+        | 'diversity-unverifiable'
+        | 'bad-effective-after';
+    message: string;
+}
+
+export interface RatificationReading {
+    artifact: RatificationArtifact | null;
+    problems: RatificationProblem[];
+}
+
+/** `merge`, or an ISO-8601 instant with a timezone. */
+const EFFECTIVE_AFTER_RE =
+    /^(merge|\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2}))$/;
+
+function scalarOf(fm: AdrFrontmatter, key: string): string | null {
+    const raw = fm.scalars[key];
+    if (typeof raw !== 'string') {
+        return null;
+    }
+    const trimmed = raw.trim();
+    return trimmed === '' ? null : trimmed;
+}
+
+/**
+ * Read `providers` in either shape the frontmatter parser can produce — a YAML
+ * list (nested) or an inline `[a, b]` scalar. Accepting both is not laxity:
+ * the ADR frontmatter corpus already carries both shapes for `basis`, and a
+ * reader that took only one would reject a correctly-authored artifact.
+ */
+export function readProviders(fm: AdrFrontmatter): string[] {
+    const nested = fm.nested['providers'];
+    if (Array.isArray(nested)) {
+        return nested.map((p) => String(p).trim()).filter((p) => p !== '');
+    }
+    const scalar = scalarOf(fm, 'providers');
+    if (scalar === null) {
+        return [];
+    }
+    return scalar
+        .replace(/^\[|\]$/g, '')
+        .split(',')
+        .map((p) => p.trim().replace(/^["']|["']$/g, ''))
+        .filter((p) => p !== '');
+}
+
+/**
+ * Validate one artifact's text.
+ *
+ * `configuredProviders` is the count `agent-config council:status` reports.
+ * Pass `null` when it could not be established — the diversity rule then does
+ * not fire, and the caller says so, because an unmeasured count is not
+ * evidence that diversity was unavailable.
+ */
+export function readRatification(
+    text: string,
+    configuredProviders: number | null,
+): RatificationReading {
+    const problems: RatificationProblem[] = [];
+    const fm = readAdrFrontmatter(text);
+    if (fm === null) {
+        return {
+            artifact: null,
+            problems: [{ code: 'no-frontmatter', message: 'no YAML frontmatter block' }],
+        };
+    }
+
+    const providers = readProviders(fm);
+    const values: Record<string, string | null> = {};
+    for (const field of RATIFICATION_FIELDS) {
+        if (field === 'providers') {
+            continue;
+        }
+        values[field] = scalarOf(fm, field);
+        if (values[field] === null) {
+            problems.push({ code: 'missing-field', message: `missing or empty \`${field}:\`` });
+        }
+    }
+    if (providers.length === 0) {
+        problems.push({ code: 'no-providers', message: 'missing or empty `providers:`' });
+    }
+
+    const verdict = values['verdict'] ?? null;
+    if (verdict !== null && !(RATIFICATION_VERDICTS as readonly string[]).includes(verdict)) {
+        problems.push({
+            code: 'unknown-verdict',
+            message: `verdict \`${verdict}\` is not one of ${RATIFICATION_VERDICTS.join(', ')}`,
+        });
+    }
+
+    const effective = values['effective_after'] ?? null;
+    if (effective !== null && !EFFECTIVE_AFTER_RE.test(effective)) {
+        problems.push({
+            code: 'bad-effective-after',
+            message: `effective_after \`${effective}\` is neither \`merge\` nor an ISO-8601 instant`,
+        });
+    }
+
+    // The Iron Law. Checked against both producer fields — see the header.
+    const reviewer = values['reviewed_by'];
+    if (reviewer !== null) {
+        for (const producerField of ['proposed_by', 'implemented_by'] as const) {
+            const producer = values[producerField];
+            if (producer !== null && producer === reviewer) {
+                problems.push({
+                    code: 'self-ratified',
+                    message:
+                        `\`${producerField}\` equals \`reviewed_by\` (${reviewer}) — ` +
+                        'the party gaining the authority may not record the ratification (ADR-268 section 4)',
+                });
+            }
+        }
+    }
+
+    // Diversity, against the REQUIRED count.
+    //
+    // Round 1 refused the previous shape: the count came from the user-global
+    // council config, which is absent on a CI runner, so the rule silently did
+    // not fire there. `null` now means the required count could not be
+    // established, and that is a REFUSAL rather than a skip — a control that
+    // passes when it cannot measure is advisory.
+    if (configuredProviders === null) {
+        problems.push({
+            code: 'diversity-unverifiable',
+            message:
+                'the required provider count could not be read, so diversity is unverifiable — ' +
+                'a control that cannot measure fails closed (src/config/ratification-policy.json)',
+        });
+    } else if (configuredProviders >= 2) {
+        const distinct = new Set(providers);
+        if (distinct.size < configuredProviders) {
+            problems.push({
+                code: 'diversity-required',
+                message:
+                    `${configuredProviders} distinct providers are required; ` +
+                    `the artifact names ${distinct.size} (${providers.join(', ') || 'none'})`,
+            });
+        }
+    }
+
+    if (problems.length > 0) {
+        return { artifact: null, problems };
+    }
+
+    return {
+        artifact: {
+            proposed_by: values['proposed_by'] as string,
+            implemented_by: values['implemented_by'] as string,
+            reviewed_by: reviewer as string,
+            providers,
+            verdict: verdict as RatificationVerdict,
+            effective_after: effective as string,
+        },
+        problems: [],
+    };
+}
+
+/** True when the artifact parses and carries a verdict that lets the diff land. */
+export function isRatified(reading: RatificationReading): boolean {
+    return reading.artifact !== null && PASSING_VERDICTS.has(reading.artifact.verdict);
+}
+
+/**
+ * The required distinct-provider count, from the repository's own policy file.
+ *
+ * Returns `null` when the file is missing or unparseable, and the caller turns
+ * that into a refusal — never a skip. Reading the policy from the repository
+ * rather than from the user-global council config is the round-1 fix: a runner
+ * has the repository and does not have the operator's home directory.
+ */
+export function readRequiredProviders(policyText: string | null): number | null {
+    if (policyText === null) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(policyText) as { required_providers?: unknown };
+        const n = parsed.required_providers;
+        return typeof n === 'number' && Number.isInteger(n) && n >= 1 ? n : null;
+    } catch {
+        return null;
+    }
+}

package/src/scripts/_lib/security_lint.ts

@@ -149,18 +149,39 @@ export function path_weight(rel_path: string): number {
 }
 
 const PROJECTION_PREFIX = 'dist/agent-src/';
+/**
+ * Lanes whose source does NOT live under `src/`. The projection folds several
+ * trees into one output directory, so the `src/` default below is right for
+ * most of it and wrong for these.
+ */
+const PROJECTION_SOURCE_LANES: ReadonlyArray<readonly [string, string]> = [
+    // The guidelines lane copies `docs/guidelines/` (`_lib/guidelines_lane.ts`),
+    // not `src/guidelines/`, which does not exist. Without this row a projected
+    // guideline gets a DIFFERENT identity from its own source, so a bound
+    // pragma written in the source cannot suppress the projection's copy of the
+    // very same line — measured on
+    // `untrusted-input-spotlighting.md`, a defense guideline that quotes
+    // role-takeover phrases to teach refusal and carries three accepted
+    // fingerprints for exactly that.
+    ['guidelines/', 'docs/guidelines/'],
+];
 
 /**
  * Fold a projected path back onto the source it was copied from.
  *
- * `dist/agent-src/` is a byte-for-byte copy of `src/` with paths rewritten
+ * `dist/agent-src/` is a byte-for-byte copy of its sources with paths rewritten
  * (ADR-201), so an artifact and its projection are the same artifact for the
  * purpose of "which evidence did a human accept". Two identities would mean two
  * fingerprints for one accepted line, and only one of them could be written
  * into the pragma the projection copies verbatim.
  */
 export function source_identity(rel: string): string {
-    return rel.startsWith(PROJECTION_PREFIX) ? `src/${rel.slice(PROJECTION_PREFIX.length)}` : rel;
+    if (!rel.startsWith(PROJECTION_PREFIX)) return rel;
+    const tail = rel.slice(PROJECTION_PREFIX.length);
+    for (const [lane, sourceRoot] of PROJECTION_SOURCE_LANES) {
+        if (tail.startsWith(lane)) return sourceRoot + tail.slice(lane.length);
+    }
+    return `src/${tail}`;
 }
 
 /** A file pre-split into lines with a fence/pragma mask the linters reuse. */

package/src/scripts/_lib/self_repair.ts

@@ -24,6 +24,27 @@
  *
  * Everything in this module is pure and clock-injected so the detectors can be
  * unit-tested without a host, a transcript, or a network.
+ *
+ * loss_class: ephemeral-lossy
+ *
+ * `sanitizeEvidence` replaces home paths and e-mail addresses with placeholders
+ * and hard-cuts the span at `MAX_EVIDENCE`. It owes no recovery locator and
+ * must not have one: storing what was dropped for privacy would defeat the
+ * reason it was dropped, which is the same ruling the retired `hot_context_hook`
+ * carried. `egressBlockedReason` is the gate; this is a narrowing pass.
+ *
+ * THE GATE DOES NOT SEE THAT CAP, and the declaration is here anyway.
+ * `check_loss_class_declared`'s cap pattern requires a unit word followed by a
+ * size noun (`ROW_CAP`, `WORD_CHARS`), so `MAX_EVIDENCE` does not match it.
+ * What pulls this module into the corpus is `\bredact` firing on the
+ * `redact_low_impact_entry` identifier imported just below — for the EGRESS
+ * gate, which loses nothing. So the real lossy operation in this file is
+ * declared and unenforced, and the enforcement rests on an unrelated import:
+ * rename or drop that import and this module leaves the corpus while still
+ * cutting the span. Widening the pattern to any `MAX_<WORD>` was measured and
+ * refused (it admits seven constants that cut nothing — see that gate's
+ * docstring), so the mismatch is recorded rather than closed. Keep this
+ * declaration on its own merits, not because the gate is watching.
  */
 import { createHash } from 'node:crypto';
 

package/src/scripts/_lib/session_index_trust.ts

@@ -34,6 +34,18 @@
  * check's. Nor does it make the index trustworthy in the sense that a model may
  * act on it: the block stays spotlighted as DATA, per `untrusted-input-defense`,
  * and this module bounds only WHICH bytes reach that block.
+ *
+ * loss_class: recoverable-lossy
+ * loss_recovery: agents/memory/ — every row the P6 cap drops is a projection of
+ * a curated entry that stays on disk untouched and stays addressable by id
+ * through `agent-config memory:lookup` / `memory:get`.
+ *
+ * The cap bounds what the index ADVERTISES, never what the corpus holds, which
+ * is why this is not `ephemeral-lossy`: nothing is destroyed, and the drop is a
+ * cost bound rather than a privacy one. The retired `hot_context_hook` went the
+ * other way for exactly that reason — storing a recovery for a line dropped for
+ * privacy would have defeated the reason it was dropped. Nothing here is
+ * dropped for privacy.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -54,6 +66,35 @@ export const SESSION_INDEX_ROW_CAP = 30;
  */
 export const MAX_ROOT_AGE_DAYS = 400;
 
+/**
+ * P3's other direction — how far ahead of now a source mtime may sit.
+ *
+ * A STATED DEFAULT, on the same terms as `MAX_ROOT_AGE_DAYS` above, and written
+ * down because a 14.23.0 self-review finding named it as the one threshold in
+ * this module carrying no threat model while its neighbour carried one. That
+ * asymmetry was the real defect; the number was not.
+ *
+ * What the grace is FOR: ordinary clock disagreement. An NTP correction, a
+ * resumed VM snapshot, or a filesystem whose mtime comes from a host with a
+ * slightly different clock can date a file a few seconds ahead of this process
+ * without anything being wrong. Zero grace would refuse those, and a refusal
+ * there costs the session its memory index for a reason the operator cannot act
+ * on.
+ *
+ * What it is NOT for, stated because the finding read it as an attack window:
+ * it buys an attacker nothing. Writing a curated source requires write access
+ * INSIDE the workspace, and an attacker holding that can date the file at `now`
+ * and pass P3 outright — a future date is strictly worse for them. Freshness
+ * here bounds an ABANDONED root, not a hostile one; the module's own docblock
+ * says content authenticity is out of scope and that boundary is unchanged.
+ *
+ * The grace is only harmless while that reading holds. If this check is ever
+ * repurposed as a content-integrity control, or a measured population of
+ * legitimate skew exceeds the value, the number has to be derived rather than
+ * stated.
+ */
+export const MAX_FUTURE_SKEW_MS = 60_000;
+
 /**
  * Curated sources, matching the layouts `memory_lookup._iter_curated_entries`
  * actually reads: `<root>/<type>.yml` AND `<root>/<type>/**\/*.yml`, plus the
@@ -255,7 +296,7 @@ export function verifyMemoryRoot(input: TrustInput): TrustVerdict {
 
     // P3 — freshness, in the two directions it can fail.
     const newestSourceMs = walk.newestMs;
-    if (newestSourceMs > now.getTime() + 60_000) {
+    if (newestSourceMs > now.getTime() + MAX_FUTURE_SKEW_MS) {
         return refuse(
             'source-mtime-in-future',
             `newest curated source is dated in the future (${new Date(newestSourceMs).toISOString()}) — clock skew or tampering`,

package/src/scripts/_lib/standing_bound_ratchet.ts

@@ -57,6 +57,17 @@ export interface BoundsRatchetVerdict {
     baseRef: string | null;
     /** Why the comparison was skipped, when it was. Printed, never silent. */
     note: string | null;
+    /**
+     * `false` means the bound could not be READ, not that it rose.
+     *
+     * Two refusals reach a caller with `ok: false` and they need opposite
+     * actions: a risen ceiling is fixed by lowering the addition, an
+     * unverifiable one by repairing the checkout. A completion review caught
+     * both being rendered as "ROSE", which would send an operator to shrink a
+     * rule over what was a fetch problem. Absent means verified — the only
+     * `ok: false` that predates this field is a genuine rise.
+     */
+    verified: boolean;
 }
 
 function showAtRef(git: GitRunner, repoRoot: string, ref: string, relPath: string): string | null {
@@ -64,22 +75,84 @@ function showAtRef(git: GitRunner, repoRoot: string, ref: string, relPath: strin
     return r.ok ? r.stdout : null;
 }
 
+/**
+ * A condition that stops the comparison: skip when advisory, refuse when not.
+ *
+ * One helper for all four causes rather than four inline branches, so the
+ * posture cannot drift between them — the failure this closes was four
+ * independent `ok: true` returns that all had to be found before any of them
+ * could be trusted.
+ */
+function unverified(
+    reason: string,
+    requireBase: boolean,
+    baseGraceCeiling: number | null,
+    baseRef: string | null,
+): BoundsRatchetVerdict {
+    if (requireBase) {
+        return {
+            ok: false,
+            verified: false,
+            baseGraceCeiling,
+            baseRef,
+            note: `${reason}, so the shrink-only bound was NOT verified in this run`,
+            violations: [
+                `the shrink-only bound could not be verified: ${reason}. This run is `
+                    + 'ENFORCING, so an unverifiable bound refuses rather than skips — an '
+                    + 'unreadable base would otherwise grant budget on an infrastructure '
+                    + 'failure. This is NOT a ceiling rise: fix the checkout (a full fetch '
+                    + 'of the base ref) rather than lowering the addition.',
+            ],
+        };
+    }
+    return {
+        ok: true,
+        verified: false,
+        violations: [],
+        baseGraceCeiling,
+        baseRef,
+        note: `${reason}, so the shrink-only bound was NOT verified in this run`,
+    };
+}
+
 /**
  * Compare the grace ceiling in this tree against the one at the base ref.
  *
- * SKIPS rather than fails when the base ref or the base config cannot be read.
- * That is the opposite of the fail-closed posture the same council demanded for
- * the reserve, and the asymmetry is deliberate: an unreadable base there would
- * have GRANTED budget on an infrastructure failure, whereas here it would REFUSE
- * a change on one. A shallow clone, a first commit and a detached build all
- * legitimately have no base, and a gate that reds on them gets switched off —
- * which is how a repository loses the enforcement it just built. The skip is
- * reported in both the human and JSON output so it cannot pass for a check.
+ * TWO POSTURES, AND WHICH ONE APPLIES IS THE CALLER'S TO DECLARE.
+ *
+ * Advisory (the default, and what every caller got before `requireBase`): a
+ * base ref or base config that cannot be read SKIPS, reported in both the human
+ * and JSON output so it cannot pass for a check. That default is not laziness
+ * and the original reasoning still holds — a shallow clone, a first commit and
+ * a detached build all legitimately have no base, and a gate that reds on them
+ * gets switched off, which is how a repository loses the enforcement it just
+ * built.
+ *
+ * Enforcing (`requireBase: true`): the same conditions REFUSE. An AI council
+ * (2/2, 2026-09-10) made this blocking for the move to a base-measured ceiling,
+ * and the reason is that the asymmetry above inverts once the base ref stops
+ * being a cross-check and becomes the ceiling itself. Today an unreadable base
+ * costs a comparison; there it would grant an unbounded budget on an
+ * infrastructure failure — the exact fail-open the reserve decision refused.
+ * anthropic's wording was "replaced or mode-gated"; this is the mode gate, so
+ * that no existing caller silently changes behaviour.
+ *
+ * The flag is the caller's rather than derived from `GITHUB_ACTIONS` here: this
+ * module cannot tell an enforcing CI run from a diagnostic one on the same
+ * runner, and a gate that guesses its own strictness from an environment
+ * variable is one `env` change away from being advisory everywhere.
  */
 export function assertBoundsDidNotRise(opts: {
     repoRoot: string;
     baseRef: string | null;
     git?: GitRunner;
+    /**
+     * Refuse instead of skipping when the base cannot be read.
+     *
+     * Absent is advisory, which keeps every pre-existing caller on the
+     * behaviour it was written against. The CI path sets it.
+     */
+    requireBase?: boolean;
     /**
      * The ceiling this run actually compares the payload against.
      *
@@ -91,24 +164,18 @@ export function assertBoundsDidNotRise(opts: {
     headGraceCeiling: number;
 }): BoundsRatchetVerdict {
     const git = opts.git ?? realGit;
+    const requireBase = opts.requireBase === true;
     if (opts.baseRef === null || opts.baseRef.trim() === '') {
-        return {
-            ok: true,
-            violations: [],
-            baseGraceCeiling: null,
-            baseRef: null,
-            note: 'no base ref resolved, so the shrink-only bound was NOT verified in this run',
-        };
+        return unverified('no base ref resolved', requireBase, null, null);
     }
     const cfg = showAtRef(git, opts.repoRoot, opts.baseRef, BUDGET_CONFIG_PATH);
     if (cfg === null) {
-        return {
-            ok: true,
-            violations: [],
-            baseGraceCeiling: null,
-            baseRef: opts.baseRef,
-            note: `${BUDGET_CONFIG_PATH} could not be read at ${opts.baseRef}, so the shrink-only bound was NOT verified`,
-        };
+        return unverified(
+            `${BUDGET_CONFIG_PATH} could not be read at ${opts.baseRef}`,
+            requireBase,
+            null,
+            opts.baseRef,
+        );
     }
     let baseGrace: number | null = null;
     try {
@@ -117,26 +184,25 @@ export function assertBoundsDidNotRise(opts: {
         const n = Number(delivery['grace_ceiling']);
         baseGrace = Number.isFinite(n) ? n : null;
     } catch {
-        return {
-            ok: true,
-            violations: [],
-            baseGraceCeiling: null,
-            baseRef: opts.baseRef,
-            note: `${BUDGET_CONFIG_PATH} at ${opts.baseRef} is not parseable, so the shrink-only bound was NOT verified`,
-        };
+        return unverified(
+            `${BUDGET_CONFIG_PATH} at ${opts.baseRef} is not parseable`,
+            requireBase,
+            null,
+            opts.baseRef,
+        );
     }
     if (baseGrace === null) {
-        return {
-            ok: true,
-            violations: [],
-            baseGraceCeiling: null,
-            baseRef: opts.baseRef,
-            note: `no ci_delivery.grace_ceiling at ${opts.baseRef}, so there is no earlier bound to ratchet against`,
-        };
+        return unverified(
+            `there is no ci_delivery.grace_ceiling at ${opts.baseRef} to ratchet against`,
+            requireBase,
+            null,
+            opts.baseRef,
+        );
     }
     if (opts.headGraceCeiling > baseGrace) {
         return {
             ok: false,
+            verified: true,
             baseGraceCeiling: baseGrace,
             baseRef: opts.baseRef,
             note: null,
@@ -150,5 +216,5 @@ export function assertBoundsDidNotRise(opts: {
             ],
         };
     }
-    return { ok: true, violations: [], baseGraceCeiling: baseGrace, baseRef: opts.baseRef, note: null };
+    return { ok: true, verified: true, violations: [], baseGraceCeiling: baseGrace, baseRef: opts.baseRef, note: null };
 }