[abrichr]

Part 3 of #1434 (docs/VERIFICATION_COVERAGE.md). Stacked on #1445; the base is its branch.

Problem

A record check confirms that the store holds the values it was given. If the referral says 02139 and the extraction read 02193, a faithful save of 02193 passes the delta and the frame. The error happened before the save, and the read-back can't see it.

Change

• openadapt_flow/provenance.py:
  • openadapt.param-provenance/v1: each value names its source, which is one of: a document (the digest of its bytes, plus the line and label), a worklist cell, or the instruction itself.
  • cross_check: a second extraction by a different method compares value by value, using the screen read-back's kind rules (text, code, date, currency), read exactly. A disagreement, a missing value, a missing document, or the same method twice holds the item.
  • round_trip: compares the record as read back with the second reading of the cited source. It never compares with the params.
  • LabelExtractor (the deterministic intake label parse) and CallableExtractor (a second model or OCR, supplied by the caller). No model calls here.
• intake writes params.provenance.json beside params.json. Intake already found the line for every field and then dropped it.
• verify-run --provenance FILE --source DOC:
  • checked.source becomes held, refuted or not_checked from the round trip. Without provenance it stays instruction.
  • Params that differ from their own provenance refute the source part.
  • evidence.source names the fields and extractors, never the values.
• Guarded save:
  • A task may carry provenance and sources.
  • begin runs the second reading. A value it doesn't confirm sends the save to a person under any approval mode, and the approval request names the fields.
  • confirm runs the round trip.
  • A task whose values differ from its provenance is refused.
• Docs: VERIFY_RUN.md, GUARDED_SAVE.md, INTAKE.md; a CAPABILITIES.md row.

Safety review

This adds refusals and holds only: a refuted round trip blocks verified, and a disagreement forces a person's approval. Without provenance nothing changes (source: instruction). It touches when verified is issued, so it waits for the coordinator with #1443 and #1445.

Not covered

A source document that is itself wrong, and a value both methods misread the same way. Values from intake:local hold in the guard until a person confirms them, because the only built-in second reader is the same label parse.

Tests

• tests/test_provenance.py (13):
  • Intake keeps the line.
  • Agreement lets the save go; a misread holds it; the same method twice holds; a missing document holds.
  • The round trip holds for a faithful record and refutes a correctly saved wrong entry.
  • verify-run end to end on MockMed: a misread saved faithfully gives delta: held, source: refuted, so the run is not verified.
  • The guard holds a disagreement for a person even when not gated.
  • A task whose values differ from its provenance is refused.
• 128 passed locally across provenance, guarded save, verify-run, frame, fault gate, intake and agent guard. ruff; mypy clean on the changed modules.

🤖 Generated with Claude Code