[Proposal] §6.3: normative disposition for an unscoreable MODIFY composition (fail-closed redaction semantics) #296

A conformance vector cannot be scored because the wire-side disposition for an
invalid or unscoreable MODIFY composition is not normatively specified. The
quarantine record that surfaced it lives on #33; this issue is the normative
question its closure would resolve.

The vector (canonical input SHA-256
01410bfff073d3835775373ec63be2418378de41aae00d5e6a508689079abb5f,
vector_id 01410bfff073d383) is a steps/userMessage request carrying a
content string and modify: {redact: ["card"]} — a PII redaction request.
When the suite asks "what disposition does a conformant Guardian return for
this?", the answer is under-specified: §6.3 tells an Observed Agent how to
compose a valid modifications object and that an invalid one must fail
closed as DENY, but it does not state the normative expected disposition the
conformance suite should assert for a redaction composition it cannot itself
validate on the wire. Is the expected outcome MODIFY with the redacted
content, DENY (fail-closed), ASK, or is the vector itself not in scope for
a wire-level conformance claim? Without that decision the row cannot be scored
pass or fail.

What this issue is not

• Not §6.3 needs the same no-DENY hook exception that §6.5 has for postCompact #270: that issue asks what an implementation must do at the five
  hooks where DENY is not a legal disposition when it receives an invalid
  modifications object. This issue asks the normative decision the conformance
  suite asserts about redaction compositions — a different row.
• Not [Proposal] Trace event for a verdict the Observed Agent substituted under §6.3 or §6.5 #264: that is a trace-event proposal for substituted decisions.
• Not [Conformance] Reference host adapter cannot honor valid MODIFY with modified_content #181: that is a reference-host-adapter bug on valid MODIFY.

Asked of the spec workstream

1. A normative disposition (or an explicit "not a wire-level claim") for a
   MODIFY composition the requesting party cannot validate — e.g. a redaction
   request whose redact field the Guardian cannot confirm is well-formed.
2. The expected reason code(s) on that disposition, if any, drawn from the
   §17.2 registry.
3. Whether the conformance suite should score such vectors at all, or whether
   they belong in a separate "composition-validity" bucket.

Evidence on file

• Quarantine record (with input digest and review_by: 2026-11-16): comment on
  [Proposal] Milestone: full ACS-Core conformance (requirement ledger + behavioral tests, beyond adapter emission) #33, vector 01410bfff073d383.
• Reproducible generator: acs_verdict_demo_v3.py (canonical JSON, sorted keys,
  compact separators, UTF-8).

Opening this so the conformance ledger has a row whose closure resolves the
vector's uncertainty; happy to supply the wire transcript or a minimal fixture
if useful for triage.