feat(consume): derive trust_tier, and withhold what cannot be tiered

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_okf_consume.py

@@ -191,3 +191,65 @@ def test_bundle_id_falls_back_to_the_root_index_and_says_that_it_did(tmp_path: P
     assert concept.bundle_id == ROOT_BUNDLE_ID
     assert concept.bundle_id_inherited is True
     assert _read(PROPOSED_CONCEPT).bundle_id_inherited is False
+
+
+# --- Step 3: trust_tier, and the refusal to tier what cannot be read ----------
+
+FIXTURE = PROJECT_ROOT / "tests" / "fixtures" / "consume-bundle"
+
+
+def test_the_fixture_bundle_carries_what_the_real_corpus_has_none_of() -> None:
+    # The control on every assertion below. K2 has 0 `verified:` keys, 0
+    # `type: verdict` and 0 `adjudication: adjudicated` over 629 concepts, so a
+    # fixture missing any of them would make its tests pass over an empty set.
+    text = "\n".join(path.read_text(encoding="utf-8") for path in sorted(FIXTURE.rglob("*.md")))
+    assert "type: verdict" in text
+    assert "adjudication: adjudicated" in text
+    assert "by: human:" in text
+    assert "by: process:" in text
+
+
+def test_no_verified_key_reads_as_unverified() -> None:
+    # SS 6.3: a concept carrying no trust frontmatter is still consumable.
+    assert okf_consume.trust_tier(None) == "unverified"
+
+
+def test_a_human_actor_reads_as_human_reviewed() -> None:
+    assert okf_consume.trust_tier("[{ by: human:ktg, at: 2026-09-01T00:00:00Z }]") == (
+        "human-reviewed"
+    )
+
+
+def test_a_process_actor_reads_as_machine_confirmed() -> None:
+    assert okf_consume.trust_tier("[{ by: process:okf-check, at: 2026-09-01T00:00:00Z }]") == (
+        "machine-confirmed"
+    )
+
+
+def test_the_human_test_is_a_prefix_and_never_a_substring() -> None:
+    # `bot/human:2` is a MACHINE actor whose id contains the string `human:`.
+    # A substring test would promote it to the highest tier -- fabricated
+    # provenance produced by a matching bug.
+    assert okf_consume.trust_tier("[{ by: bot/human:2 }]") == "machine-confirmed"
+
+
+def test_an_entry_naming_no_actor_is_refused_rather_than_tiered() -> None:
+    with pytest.raises(okf_consume.ConsumeError) as raised:
+        okf_consume.trust_tier("[{ at: 2026-09-01T00:00:00Z }]")
+    assert raised.value.code == "verified_actorless"
+
+
+def test_a_block_form_verified_is_not_a_tier_at_all() -> None:
+    # Measured 2026-09-07: this library's line-oriented `parse_frontmatter`
+    # returns `''` for a block-form `verified:` and the full string for a flow
+    # one, so PRESENT-BUT-UNREADABLE is distinguishable from ABSENT. Emitting
+    # `unverified` here would assert a fact nobody measured (SS 6.4).
+    assert okf_consume.trust_tier("") is None
+
+
+def test_the_block_form_case_is_real_in_the_fixture_and_not_only_in_the_unit_test() -> None:
+    # The control: without this, `trust_tier("") is None` could be true of a
+    # string no bundle ever produces.
+    frontmatter = parse_frontmatter(FIXTURE / "dyp" / "nivaa" / "blokkform-verifisert.md")
+    assert frontmatter["verified"] == ""
+    assert okf_consume.trust_tier(frontmatter["verified"]) is None