test(verifier-compatibility): close two margins, and record why the other two cannot

[lywinged]

Continues agentrust-io#116. The ask there was obligations 2 and 3 back "with the separation figure measured and pinned the way you did here", and "a set that separates 3 of 8 and says so is worth more than one that separates 8 of 8 and has never been asked."

Obligations 2 and 3 are already implemented: verify_record takes accepted_profiles and refuses outside it, and VerificationStatement carries profile and accepted_profiles. What was outstanding is the vector set and the number.

The module's own headline number had drifted

test_verifier_compatibility_separation.py exists so the set's separating power cannot change unnoticed. Its opening paragraph said the set separates 3 of its 8 vectors while the figure pinned in code twenty lines below said 4 of 9. A reader arrives at the docstring first and left with the superseded number.

This is the defect this module was written to prevent, happening to the module's own headline. The figure now lives in one place, next to SEPARATING, and the paragraph says so instead of restating it.

Two of four recorded margin shortfalls closed

KNOWN_THIN recorded four refusal rules carried by one vector each, the shape agentrust-io#124 established as insufficient.

10-superseded-first-in-set-innocent-record-refused closes superseded_profile_in_accepted_set. It moves two things at once: the v0.1 identifier sits first in the accepted set rather than last, so an implementation scanning only the tail passes 08 and fails here; and the record presented is an ordinary v0.2 record with nothing wrong with it. The second half is what makes it separate where 08 cannot, since 08 carries a v0.1 record that the schema refuses on its own whether or not any profile rule ran.

11-empty-profile-string-refused closes profile_absent with a claim that is present and empty. 07 removes the member outright, so an implementation testing "eat_profile" not in record passes 07 and reads this one as an unrecognised profile, or as absent and therefore current. It does not separate, and the reason is structural rather than a flaw: the schema pins eat_profile with a const, so any record that reaches this rule is already schema-invalid and a verifier implementing nothing refuses it too.

	before	after
vectors	9	11
separates	4	5
boundaries carried by one vector	4	2

The other two were measured and are not closable

Recorded in KNOWN_THIN with the reason, because "measured and shown to have no second axis" is a different state from "not yet done":

no_accepted_profiles fires on the verifier's own configuration before any record is read, and that configuration has one shape: the set is empty. The one other axis, pairing the empty set with a second defect the verifier would catch later, needs check_freshness, and every vector in this set asserts that is False for a good reason already written into the fixtures test: a fixed iat would make the set expire.

superseded_profile_refused needs a record carrying v0.1 and an accepted set excluding it. The set can hold only v0.2, because any other member trips unschemaed_profile_in_accepted_set first, so there is no second configuration to present.

What remains for both is varying record content, which pins nothing. No plausible implementation branches on record content when deciding that an empty set accepts nothing. A second vector written to close a count rather than to catch a defect an implementation could plausibly have reports a margin that does not exist, which makes the record worse than leaving the shortfall named.

Checks

966 passed, 1 skipped. Ruff clean across src, tests and examples. The generator reproduces every committed fixture byte for byte, per agentrust-io#171.

Both new vectors were validated against the real verifier before the records were updated: the fifteen other fixture tests passed on the first run, so each produces the failure code it claims. The separation figure and the margin shortfall were each measured and then recorded, not recorded and then assumed.

---

Generated by Claude Code

[github-actions]

❔ Contributor Check: UNKNOWN

Check	Result
Profile	UNKNOWN
Credential	LOW
Overall	UNKNOWN

Automated check by AgenTrust Contributor Check.