The frontmatter parser is a line-oriented approximation of YAML with no nesting
model, and it flattened INDENTED keys into the same mapping. Two measured
defects followed, the second load-bearing:
1. Sibling blocks sharing an inner key COLLIDED. Given OKF §10's canonical
Attested Computation shape, `executor.resource` vanished silently and
`attester.resource` was promoted to a top-level `resource`. No error raised.
2. An indented `type:` OVERWROTE the column-0 one, making the verdict-exclusion
gate in `bundle_context` forgeable. A file declaring `type: verdict` at
column 0, carrying any nested block with a `type:` in it, rendered its body
straight into the read-context — defeating the §11 seam whose own docstring
claimed "a mislabelled or injected edge cannot smuggle a verdict into the
context". The type CHECK was there; the VALUE it checked was writable.
This is spec-legal input, not malformed input: method-spec §2 calls it YAML
frontmatter, and ingest-spec §7 (`:153`, `:216`) says unknown keys MAY follow
the stamp and ride through navigation.
Fix: only column-0 keys participate; indented lines are skipped, never
flattened. Nested blocks become OPAQUE — stated as a limitation in the
docstring, not dressed up as a nesting model we do not have (§1 honesty rule).
Single parse site, so the fix covers the class: `hitl.py:157` (verdict_id,
gated on .type) and `experience.py:137` (realization_rate, expected_actual)
all read through `ConceptFile.frontmatter`; `promotion.py` only emits, from a
fixed template.
Golden-neutral by measurement: 0 indented frontmatter lines across all 17
frontmatter-bearing files in `shared/examples/`.
Both tests written RED first and confirmed to die on the SEAM assertion, not on
a collateral one — the forgery test rendered `## project: Seed` before the fix.
Each negative carries a standalone positive control (sessions 17-18: a control
can itself hide behind a preceding assert).
Provenance: hypothesis received from llm-ingestion-okf, who measured the
flattening in their own parser and flagged that ours shares the form. They had
NOT measured our side. The type-clobber variant is ours, found by measuring the
neighbourhood rather than only the reported case.
Suite 688 -> 690.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJmse16bEkaSBtvXhncEUc
Kjell Tore Guttormsen
d691510163