fix(eval): surface incorrectly-denied pairs that aren't also under-grants

A pair that is simultaneously granted AND denied (e.g. a coarse scope split
by the auditor into one approved and one best-effort-rejected sub-decision,
as hit live by test_e2e_correctness[agent_delegation]) lands in
incorrectly_denied without ever appearing in under_grants, since it IS in
granted. under_grant_cases only checked under_grants, so that finding
silently never became an EvidenceCase and never reached the recommendations
section. Checks incorrectly_denied too now.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Amitfre15 <amitfrework@gmail.com>

Author: Amitfre15

eval/recommendations.py

@@ -129,17 +129,31 @@ def over_grant_cases(entries: list[tuple[str, str, dict]]) -> list[EvidenceCase]
 
 
 def under_grant_cases(entries: list[tuple[str, str, dict]]) -> list[EvidenceCase]:
-    """Mirrors ``over_grant_cases`` for ``under_grants``."""
+    """Mirrors ``over_grant_cases`` for ``under_grants`` -- PLUS ``incorrectly_denied``.
+    ``incorrectly_denied`` (an explicit deny for a pair that should be granted) is normally a
+    subset of ``under_grants`` (``eval.correctness_scorer``'s own docstring), but a pair that is
+    simultaneously ``granted`` AND ``denied`` -- e.g. a coarse scope split by the auditor into one
+    approved sub-decision and one best-effort-rejected sub-decision for the same (role, scope) pair
+    -- lands in ``incorrectly_denied`` without ever appearing in ``under_grants`` (it IS in
+    ``granted``, so ``expected - granted`` excludes it). Checking both keeps that edge case from
+    silently vanishing from the recommendations section."""
     cases = []
     for suite, scenario, props in entries:
         under_grants = props.get("under_grants") or {}
-        if not under_grants:
+        incorrectly_denied = props.get("incorrectly_denied") or {}
+        if not under_grants and not incorrectly_denied:
             continue
+        detail_parts = []
+        if under_grants:
+            detail_parts.append(f"under-granted pairs -> {_format_pairs(under_grants)}")
+        if incorrectly_denied:
+            detail_parts.append(f"explicitly (incorrectly) denied pairs -> {_format_pairs(incorrectly_denied)}")
+        evidence = f"{suite}/{scenario}: " + "; ".join(detail_parts)
         cases.append(
             EvidenceCase(
                 case_id=f"{suite}:{scenario}:under_grant",
                 finding_type="under_grant",
-                evidence=f"{suite}/{scenario}: under-granted pairs -> {_format_pairs(under_grants)}",
+                evidence=evidence,
                 remedy_menu=_UNDER_GRANT_REMEDY,
                 fallback_key=suite,
             )

eval/test_recommendations.py

@@ -60,6 +60,9 @@ def test_one_case_per_entry_with_correct_fields(self) -> None:
 class TestUnderGrantCases:
     def test_no_evidence_returns_empty(self) -> None:
         assert under_grant_cases([("correctness_prb", "baseline", {"under_grants": {}})]) == []
+        assert (
+            under_grant_cases([("correctness_prb", "baseline", {"under_grants": {}, "incorrectly_denied": {}})]) == []
+        )
 
     def test_one_case_per_entry_with_correct_fields(self) -> None:
         entries = [("correctness_prb", "baseline", {"under_grants": {"inbound": [("role-a", "scope-a")]}})]
@@ -69,6 +72,40 @@ def test_one_case_per_entry_with_correct_fields(self) -> None:
         assert case.fallback_key == "correctness_prb"
         assert "role-a" in case.evidence and "scope-a" in case.evidence
 
+    def test_incorrectly_denied_alone_still_produces_a_case(self) -> None:
+        # The edge case: a pair simultaneously granted AND denied (e.g. a coarse scope split by
+        # the auditor into one approved and one best-effort-rejected sub-decision) lands in
+        # incorrectly_denied without ever appearing in under_grants -- must not be silently
+        # dropped from the recommendations section.
+        entries = [
+            (
+                "correctness_e2e",
+                "agent_delegation",
+                {"under_grants": {}, "incorrectly_denied": {"inbound": [("role-dock-worker", "agent-scope-x")]}},
+            )
+        ]
+        [case] = under_grant_cases(entries)
+        assert case.case_id == "correctness_e2e:agent_delegation:under_grant"
+        assert case.finding_type == "under_grant"
+        assert case.fallback_key == "correctness_e2e"
+        assert "role-dock-worker" in case.evidence and "agent-scope-x" in case.evidence
+        assert "incorrectly) denied" in case.evidence
+
+    def test_both_present_combines_into_one_case_not_two(self) -> None:
+        entries = [
+            (
+                "correctness_prb",
+                "baseline",
+                {
+                    "under_grants": {"inbound": [("role-a", "scope-a")]},
+                    "incorrectly_denied": {"outbound": [("role-b", "scope-b")]},
+                },
+            )
+        ]
+        cases = under_grant_cases(entries)
+        assert len(cases) == 1
+        assert "role-a" in cases[0].evidence and "role-b" in cases[0].evidence
+
 
 # =========================================================================== #
 # sensitivity_cases / invariance_cases                                        #