# AIE-003 Lab — Prompt governance and untrusted context

Implement `evaluate(case)` in `starter.py`. Return exactly these eight auditable fields: `evidenced_runtime_prompt_version`, `registry_runtime_match`, `untrusted_source_count`, `injection_signal_count`, `blocked_untrusted_instruction_count`, `authority_violation_count`, `promotion_decision`, and `reason_class`.

The registry candidate is evidenced at runtime only when the runtime prompt version and template hash equal the registry current version and hash. Count an untrusted source when its trust label is `UNTRUSTED_EXTERNAL`. Count an injection signal whenever a context item declares `contains_instruction=true`. Such an instruction is considered blocked only when that source is untrusted, `instruction_authority` is `NONE`, and `allowed_influence` is `DATA_ONLY` or `EVIDENCE_ONLY`. Granting `INSTRUCTION` authority or influence to untrusted external content is an authority violation.

Decision order: authority violation → REJECT; registry/runtime provenance mismatch → DEFER; missing version-bound evaluation → DEFER; failed evaluation → REJECT; missing change approval → DEFER; required high-risk human gate missing → REJECT; otherwise PROMOTABLE. Untrusted factual data may still be usable. Do not treat delimiters or sanitization as proof that injection is eliminated.

Run `python run_checks.py` for learner-visible structural checks. Expected promotion labels are intentionally not included in learner files.