[sindredg]

Change

The schema a NetBox job's recipe carried asked for one verdict per account but required only one item, so Goose accepted an output that left an account out and the verification gate stopped on the missing line (#221). Now the trusted side names the accounts, and the schema requires each (ADR 0051).

• Dispatch step (platform/dispatch/dispatch.py, platform/argo/workflow-template.yaml): mounts the job's checks' verdicts, the comparison step's optional item, reads the account names through the comparison's own reader, and sends them sorted in the job line as accounts. A NetBox job with no item, another job's, or one out of shape fails here, before the job runs, with the stop the comparison step would have given after it.
• Job program (worker/agent-runtime/job/agent_job.py): requires accounts for a NetBox job (1 to 20 names in the comparison's pattern, no repeat) and refuses the field for any other job. The schema is built per job: verdicts is an object with a required property per account and no other, and a proposal's account is one of the same names. The lines written for the comparison keep their form.
• Task text (collectors/netbox/task.txt): the last paragraph asks for the verdict under each account's name as the schema lists them.
• Docs: ADR 0051, pointer sentences in ADRs 0049 and 0030, the index, the agent job page (schema, the dispatch step's new refusal), W.12's reason, and the evidence collection runbook's note on a deleted config map.

Validation

All local, with the suites' stubs and fakes. Nothing ran on the live system.

Check	Command	Result
Job program suite	/usr/bin/python3 -I -S -m unittest discover -s tests in worker/agent-runtime/job	84 tests, OK
Dispatch suite, the comparison's and the task text's tests included	python3.15 -I -m unittest discover -s tests in platform/dispatch	79 tests, OK
Fail side	Both suites run on the new tests before the code	Job suite failed at import; dispatch suite 3 failures, 2 errors on the new cases
Ruff 0.17.2	ruff check and ruff format --check on both programs	Clean
Links	The link checker over every tracked Markdown file	2242 links, 0 broken
Page rules	python3 -I validation/evidence/render.py --check	Exit 0
Template	Parsed as YAML; kubeconform runs in the pipeline	The dispatch step has the verdicts volume and its mount

Not verified:

• A job on the live system, and the dispatch pod's mount of the verdicts item under /etc/aisec, where the tool certificate is mounted.
• Goose 1.56.0 refusing an output that leaves an account out. Reasoned from its source: final_output_tool.rs validates each call with the jsonschema crate over the whole schema.

Risks and follow-up

• The dispatch image and the job program are installed together. A line from the current image has no accounts, and the new job program refuses a NetBox job on it (ADR 0051, trade-offs). Order after the merge: the pipeline pushes the dispatch image from main; a pull request pins its digest in the template; the template, the image, and the job program go live in one step; then two NetBox jobs and the synthetic job, every check, and the records within 24 hours. That follow-up closes The NetBox answer schema accepts an answer that leaves out an account #221.
• A scored run with the new schema (ADR 0042) is pending. The schema and the task's last paragraph changed what the model reads.
• The first prompt grows with the number of accounts. The held-out cases have one or two.