fix(openapi): harden story 2.1 production lifecycle

scripts/validate-capability-run.py

@@ -122,6 +122,18 @@ def run_schema(schema: Any) -> dict[str, Any]:
     return definition
 
 
+def validate_accepted_semantics(candidate: Any) -> None:
+    """Fail closed: accepted evidence must be an automated passing run."""
+    if not isinstance(candidate, dict):
+        raise ValidationError('/', 'accepted evidence candidate must be an object')
+    if candidate.get('accepted') is not True:
+        raise ValidationError('/accepted', 'accepted evidence is required')
+    if candidate.get('execution_verdict') != 'pass':
+        raise ValidationError('/execution_verdict', 'accepted evidence requires execution_verdict=pass')
+    if candidate.get('evidence_mode') != 'automated':
+        raise ValidationError('/evidence_mode', 'accepted evidence requires evidence_mode=automated')
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--schema', required=True)
@@ -133,8 +145,8 @@ def main() -> int:
         schema = load_json(Path(args.schema))
         candidate = load_json(Path(args.candidate))
         validate(candidate, run_schema(schema))
-        if args.require_accepted and candidate.get('accepted') is not True:
-            raise ValidationError('/accepted', 'accepted evidence is required')
+        if args.require_accepted:
+            validate_accepted_semantics(candidate)
     except ValidationError as error:
         print(f'INVALID_CAPABILITY_RUN pointer={error.pointer} reason={error.message}', file=sys.stderr)
         return 1