Ready to Build III: Verdict-Level Conformance and Declared Projection Limits in the Boundary Defense Agent

This short paper reports what a third agent adds to a series on execution-neutral specifications. The first paper (https://doi.org/10.5281/zenodo.23229267) presented execution-neutral buildability; the second (https://doi.org/10.5281/zenodo.23342767) argued that a specification can fix which of its outcomes must stay distinct and publish those distinctions as conformance criteria, and it reported a bound: in its recorded mutation run, verdict-swap mutants changed no record's status, because the records asserted vocabularies and routes rather than the verdict emitted on every path. The Boundary Defense Agent pack (BDA-BOUNDARY-DEFENSE-002, Public Release v2.0) specifies a fail-closed agent that validates, filters, quarantines, blocks, and conditionally releases artifacts crossing a controlled runtime, persistence, or transport boundary. Its conformance suite asserts, on the blocking paths, both the resulting state and the verdict token. In the pack's NNT companion run, a verdict-swap mutant was built in each of the five reconstructions; in the four where it replaced BLOCK with ALLOW on the blocking paths, it changed the status of the records that make this assertion, and in the fifth it altered a table that its baseline does not consult. The suite also declares where its projection stops: two verdicts may share a state route, three choices between verdicts are delegated to deployment, and its Minimal Run Note lists the obligations that are not locally runnable, including fail-closed artifact emission implemented outside the local state projection; the obligations of three of the four declarative records are among them. In that NNT run, five paradigm-isolated reconstructions in Python, Rust, Prolog, C, and Bash ran the 36 conformance records live and each reported 33 PASS, 3 SKIP, 0 FAIL, and 0 ERROR, with no divergent record, zero corrections, and no recorded inconsistency. A supplementary artifact renders a declared 192-input state projection in five further paradigms, with byte-identical text outputs and matching spreadsheet results, and runs the full suite in AWK and in spreadsheet formulas with the same profile, skipping the same three records. We read this as evidence that a suite can check distinctions at the level of the emitted verdict on the paths it names, and state the limits of what its projection observes, for this artifact; it is not a certification or a quality score. Use of AI tools. The author constructed the pack's seven canonical files, including the conformance tests, reviewed them manually, and designed and calibrated the harnesses for the reconstruction campaign and the supplementary derivations. Large language models were used openly, as tools to accelerate research and production, with manual review: they assisted the drafting of the pack's documents and the revision of this manuscript and, by design, built the reconstructions and the supplementary derivations that are the object of the demonstration. No tool is an author; the author is accountable for the content. What matters is not which tools touched the documents but whether the artifact can be verified. The claims in this paper are limited to what a reader can check with the shipped hashes, the runnable conformance suite, and the reproducible outcome vectors.