feat(verdicts): promoted verdicts carry a verified field with the actor verbatim

Co-Authored-By: Claude <claude-opus-5>

src/portfolio_optimiser/okf.py

@@ -371,6 +371,43 @@ class SkippedLink:
     reason: SkipReason
 
 
+#: Characters an actor may not contain, because each would RESTRUCTURE the flow mapping it is
+#: written into. ``": "`` is in the set for a reason that is not decoration: ``decode_flow_value``
+#: splits pairs on colon-SPACE, so an actor carrying it would be written out cleanly and then
+#: mis-decoded on the way back. The writer and the reader must agree on this set, or the round trip
+#: lies while every byte looks fine.
+_VERIFIED_UNSAFE_TOKENS = (",", "{", "}", "[", "]", "\n", "\r", ": ")
+
+
+def verified_field(actor: str, at: str) -> str:
+    """Compose the SPEC §5.2 single-verifier flow shorthand ``{ by: <actor>, at: <at> }``.
+
+    The ENCODER half of this seam, and a separately named function on purpose: it gives the
+    round-trip property one site to be measured at, and ``render_frontmatter`` cannot serve —
+    it collapses every newline to a space and therefore cannot emit block form at all.
+
+    **The actor is written VERBATIM and is never prefixed with ``human:``.** A caller reaches the
+    human tier by saying so; minting the prefix on their behalf would fabricate a sign-off nobody
+    gave.
+
+    **Honesty limit, stated:** only ``actor`` is checked against the unsafe set. ``at`` is an ISO
+    timestamp in every caller today and is not validated here — a deliberate scope line, not an
+    oversight, and the place to revisit it is the invariant record rather than a silent widening.
+
+    Raises ``FlowDecodeError`` — the same named refusal the reader raises, which is what makes
+    "the writer refuses exactly what the reader cannot read" structural rather than a convention.
+
+    Gated by ``tests/test_provenance_decoder_loadbearing.py``."""
+    for token in _VERIFIED_UNSAFE_TOKENS:
+        if token in actor:
+            raise FlowDecodeError(
+                f"the actor {actor!r} contains {token!r}, which would restructure the `verified` "
+                "flow mapping — refusing to write a provenance record that parses cleanly into "
+                "something no one wrote"
+            )
+    return f"{{ by: {actor}, at: {at} }}"
+
+
 #: A concept's trust level, derived from its ``verified`` actors (SPEC §5.3), lowest to highest.
 #: Derived, never stored: OKF records objective signals and refuses to persist a subjective score,
 #: so this is a reading of the actors and not a field any document carries.
@@ -744,6 +781,14 @@ def write_concept_file(bundle_dir: str, name: str, frontmatter: dict[str, str],
     a frontmatter carrying the complete ingest stamp raises ``IngestStampError`` and NOTHING is
     written. A validation, never a repair — the caller is told, not silently corrected.
     Returns the written path."""
+    verified = frontmatter.get("verified")
+    if verified is not None:
+        # Validation, never repair, and NOT a second copy of the rule: the check IS
+        # ``decode_flow_value``, so the writer refuses exactly what the reader cannot read. A
+        # duplicated rule here would be free to drift, and the drifted copy would decide what gets
+        # written. Scoped to ``verified`` BY NAME — ``render_frontmatter`` keeps collapsing
+        # newlines for every other key, which this step deliberately does not change.
+        decode_flow_value(verified, key="verified")
     if _carries_complete_ingest_stamp(frontmatter):
         raise IngestStampError(
             "refusing to write a curated concept file carrying the COMPLETE ingest ownership stamp "

src/portfolio_optimiser/verdicts.py

@@ -697,6 +697,10 @@ def promote_verdict(
         "verdict_id": verdict.id,
         "provenance": f"godkjent av {approver}; eksperiment {experiment}; {timestamp}",
         "timestamp": timestamp,
+        # SPEC §5.2 provenance, reusing the EXISTING required ``timestamp`` keyword so no
+        # wall-clock default sneaks in. The approver is written verbatim: a scripted stand-in lands
+        # in ``machine-confirmed``, which is true of it.
+        "verified": okf.verified_field(approver, timestamp),
         "tags": "[verdict, promoted, HITL]",
     }
     codes = ", ".join(sorted(f.affected_codes))