test(okf): capture block-form fixture and collection baseline before any decoder

Co-Authored-By: Claude <claude-opus-5>

tests/golden/block-form-provenance/bundle/attested.md

@@ -0,0 +1,19 @@
+---
+type: concept
+okf_version: 0.2
+title: "Attested computation"
+generated: { by: process:fixture-author, at: 2026-09-02T00:00:00Z }
+verified:
+  - { by: process:fixture-check, at: 2026-09-02T08:00:00Z }
+sources:
+  - resource: https://example.invalid/fixture-cost-baseline
+    id: fixture-cost-baseline
+---
+
+One verification event, written as a single-entry block sequence — the SPEC-canonical
+long form of `verified: { by: ..., at: ... }`. The actor is a `process:` one, so the
+trust tier a consumer derives from it is machine-confirmed, never human-reviewed.
+
+`sources` is written in block form too, so a reader that only understands the flow
+shorthand loses the provenance of this concept entirely rather than reporting that it
+could not read it.

tests/golden/block-form-provenance/bundle/index.md

@@ -0,0 +1,13 @@
+---
+type: index
+okf_version: 0.2
+title: "Block-form provenance — the shape a line parser cannot read"
+---
+
+A repo-owned fixture bundle whose concepts carry OKF provenance in **block** form:
+`verified` as a YAML sequence of mappings (SPEC §5.2) rather than the single-line flow
+shorthand. Navigation must stay tolerant of it — the bytes rendered here are the "before"
+referent that later decoder work compares against.
+
+- [Attested computation](attested.md)
+- [Multi-verified concept](multi-verified.md)

tests/golden/block-form-provenance/bundle/multi-verified.md

@@ -0,0 +1,14 @@
+---
+type: concept
+okf_version: 0.2
+title: "Multi-verified concept"
+generated: { by: process:fixture-author, at: 2026-09-02T00:00:00Z }
+verified:
+  - { by: human:fixture-reviewer, at: 2026-09-02T09:00:00Z }
+  - { by: process:fixture-nightly, at: 2026-09-02T10:00:00Z }
+---
+
+Two independent verification events: a human sign-off FIRST, a nightly process SECOND.
+The order is the whole point of this file. A reader that keeps the last entry it sees
+reports machine-confirmed for a concept a human actually signed off, so the tier flips
+downward without anything failing — the defect has no error channel of its own.

tests/golden/block-form-provenance/expected-read-context.md

@@ -0,0 +1,24 @@
+A repo-owned fixture bundle whose concepts carry OKF provenance in **block** form:
+`verified` as a YAML sequence of mappings (SPEC §5.2) rather than the single-line flow
+shorthand. Navigation must stay tolerant of it — the bytes rendered here are the "before"
+referent that later decoder work compares against.
+
+- [Attested computation](attested.md)
+- [Multi-verified concept](multi-verified.md)
+
+## concept: Attested computation
+
+One verification event, written as a single-entry block sequence — the SPEC-canonical
+long form of `verified: { by: ..., at: ... }`. The actor is a `process:` one, so the
+trust tier a consumer derives from it is machine-confirmed, never human-reviewed.
+
+`sources` is written in block form too, so a reader that only understands the flow
+shorthand loses the provenance of this concept entirely rather than reporting that it
+could not read it.
+
+## concept: Multi-verified concept
+
+Two independent verification events: a human sign-off FIRST, a nightly process SECOND.
+The order is the whole point of this file. A reader that keeps the last entry it sees
+reports machine-confirmed for a concept a human actually signed off, so the tier flips
+downward without anything failing — the defect has no error channel of its own.

tests/test_falsification_verdict_loadbearing.py

@@ -0,0 +1,52 @@
+"""The falsification-verdict seam — load-bearing gates for reading OKF provenance.
+
+This module opens with the ONE thing that has to be captured before any decoder exists: the
+bytes today's ``bundle_context`` renders from a **block-form** provenance bundle. Later steps
+add a decoder that reads ``verified``/``sources`` in that form; this gate is what proves the
+decoder did not move the read-context on its way in.
+
+The comparison is **byte-for-byte**, with no trailing-whitespace normalisation. The commons
+nav-goldens normalise because commons owns their line endings and this repo consumes them
+through a pull-only subtree; ``tests/golden/block-form-provenance/`` is repo-owned, so the
+stricter comparison is available and is what the criterion asks for.
+
+The resolver below is LOCAL on purpose. ``tests/test_okf.py::_nav_golden`` hard-codes
+``shared/examples/`` (``test_okf.py:51``) and lives in a module this work must not touch, so
+reusing it would mean editing a frozen module to reach a repo-owned fixture.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from portfolio_optimiser import okf
+
+_GOLDEN_DIR = Path(__file__).resolve().parents[1] / "tests" / "golden" / "block-form-provenance"
+
+
+def _block_form_golden() -> tuple[str, str]:
+    """The repo-owned block-form case: ``(bundle_dir, expected_read_context)``."""
+    return (
+        str(_GOLDEN_DIR / "bundle"),
+        (_GOLDEN_DIR / "expected-read-context.md").read_text(encoding="utf-8"),
+    )
+
+
+def test_block_form_bundle_renders_the_captured_bytes() -> None:
+    """Navigation is TOLERANT of block-form provenance, and these are the bytes it produces.
+
+    Two claims in one arm, and both are load-bearing. First, ``navigate_bundle`` reaches every
+    file and skips nothing — a block ``verified:`` sequence is ordinary frontmatter to a
+    line-oriented parser, so it must not break navigation, and ``skipped`` being empty is the
+    positive statement that no link was silently passed over. Second, the rendered read-context
+    is byte-identical to the committed fasit. The fasit was generated by the code that predates
+    any decoder work: if it were regenerated afterwards, the comparison would prove an
+    implementation identical to itself and nothing else.
+    """
+    bundle_dir, expected = _block_form_golden()
+    bundle = okf.navigate_bundle(bundle_dir)
+
+    assert bundle.skipped == (), f"navigation skipped a link it should have followed: {bundle.skipped}"
+    assert [f.name for f in bundle.files] == ["index.md", "attested.md", "multi-verified.md"]
+
+    assert okf.bundle_context(bundle) == expected