fix(openapi): harden story 2.1 production lifecycle

tests/unit/test_validate_capability_run.py

@@ -94,6 +94,18 @@ class CapabilityRunValidatorTests(unittest.TestCase):
         self.assertNotEqual(result.returncode, 0)
         self.assertIn("accepted evidence is required", result.stderr)
 
+    def test_require_accepted_rejects_true_flag_without_passing_automated_evidence(self) -> None:
+        for field, value, expected in (
+            ("execution_verdict", "fail", "accepted evidence requires execution_verdict=pass"),
+            ("evidence_mode", "manual_only", "accepted evidence requires evidence_mode=automated"),
+        ):
+            with self.subTest(field=field):
+                candidate_value = candidate()
+                candidate_value[field] = value
+                result = self.validate(json.dumps(candidate_value), require_accepted=True)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn(expected, result.stderr)
+
 
 if __name__ == "__main__":
     unittest.main()