[abrichr]

Fixes #1373.

Problem

verify-run caught a record outside the target that vanished, but not one that changed. On the scoreboard's OpenEMR claims run (#1365), the agent saved its own chart correctly while another chart's home phone was changed in place. verify-run returned verified on 5 of 5 of those items.

Change

• Effect.forbid_collateral_change (record_written only). With a baseline, it refutes when a pre-state record that is not the target, and is still there by stable_id, has different fields. The reason names the fields. Records without an id are already covered, because their identity is their content and a change reads as a vanished record.
  • Off by default in a run. A run that reads a shared table other people edit would otherwise refute every save.
  • Bound into the contract hash only when set, like count_new_only, so every existing digest, authorization and ledger entry is unchanged.
• verify-run applies it when it judges every record_written effect, unless the file sets forbid_collateral_change: false on that effect.
  • The contract as written is unchanged, so verify_config_sha256 still equals qualify's for the same file (test_the_qualify_example_loads_and_hashes_like_qualify passes).
  • evidence.readback.effects[].collateral_change_checked records that the check ran.
• Docs: VERIFY_RUN.md (a new section and the verdict table) and EFFECT_KIT.md.

Tests

tests/test_verify_run_collateral_change.py:

• The OpenEMR collateral_edit case is refuted, and names phone_home.
• The old behaviour holds without the flag.
• Untouched neighbours confirm, and a vanished neighbour is still collateral loss.
• The target itself may change.
• The flag is refused on field_equals.
• Existing contract digests are unchanged.
• verify-run judges with the check on and leaves the parsed contract alone, and an effect can opt out.
• End to end on the MockMed store: an in-place edit of another record is refuted.

Ran locally, all passing: the effect, qualify, record-check, verify-run, run-gate, transaction-outcome and silent-wrong-action suites (1151 passed, 1 skipped); mypy on the three changed modules; scripts/check_release_consistency.py.

Safety review notes

• This only adds refusals; it never turns a refusal into a confirmation.
• Run-time contracts are unchanged unless they opt in.
• The read-only audit path (verify-run) becomes stricter. A read set that includes records other actors edit during the window will now come back reconciliation_required. That is the intended fail-closed direction, and the docs say how to opt out per effect.

🤖 Generated with Claude Code

[abrichr]

Draft until the review fixes are pushed: normalised SQL value types (datetime, Decimal, bytes) with a SQL round-trip test, and the refusal reason naming a possible concurrent edit. Mark ready once they're in.

[abrichr]

Review fixes pushed: values compare by type against the baseline's JSON form (Decimal, datetime, bytes; nested values element by element; two strings exactly), with an SQL round-trip test, and the refutation says the change may be another user's concurrent edit that a person should reconcile. Local: 1160 passed, 1 skipped across the effect, qualify, record-check, verify-run, run-gate, transaction-outcome and silent-wrong-action suites; mypy clean. Known limit, unchanged by this PR: verify-run cannot write a baseline that holds non-UTF-8 bytes (EffectState JSON mode), so a binary column needs records_drop_fields.

[abrichr]

Included in batch #1384, which runs CI once for several reviewed PRs. This PR is marked merged when #1384 merges. Please don't push here unless asked; a new commit leaves it out of the batch.