diff --git a/src/probe-core.cts b/src/probe-core.cts index 6e89f98df..f9a419759 100644 --- a/src/probe-core.cts +++ b/src/probe-core.cts @@ -376,11 +376,10 @@ export interface ProhibitionDispositionContext { * This is the cheap safety guarantee: a well-formed prohibition that reaches verify-phase with NO * wired enforcement evidence can NEVER be a silent pass. It is `{ status: 'unverified', flagged: * true }` — never `green` — exactly like an unresolved judgment item. The HEAVY half (a real - * fail-first negative-test enforcement mechanism that, given evidence, would flip a test-tier item - * to green) is OUT of #644 scope and defers to a follow-up PR: #644's corpus is entirely - * judgment-tier, so wiring a contrived test-tier consumer here would be the delete-bad-tests / - * gold-plating failure mode. Until that follow-up lands, ANY prohibition without enforcement - * evidence — test- or judgment-tier — disposes as flagged-unverified. + * negative-test enforcement mechanism that, given evidence, flips a test-tier item to green) was OUT + * of #644 scope and LANDED in #1259 as the `prohibition-enforcement` producer (it builds the + * `enforcementEvidence` this helper reads). This helper's policy is unchanged: ANY prohibition + * without enforcement evidence — test- or judgment-tier — disposes as flagged-unverified. * * The function is pure: same input always yields the same disposition (no LLM judgment, ADR-550 * D5). The LLM-judge soft-gate for judgment-tier items is a verify-phase PROSE concern (the @@ -408,7 +407,7 @@ export function dispositionForProhibition( tier, reason: tier === 'test' - ? 'test-tier prohibition has no wired enforcement evidence — flagged unverified (fail-closed; real negative-test enforcement deferred to a follow-up PR, ADR-550 D5d)' + ? 'test-tier prohibition has no passing wired enforcement check — flagged unverified (fail-closed; never a silent pass, ADR-550 D5d)' : 'prohibition has no enforcement evidence — flagged unverified (fail-closed; never a silent pass, ADR-550 D5d)', }; }