docs: reserve VERIFIED assurance in control evaluations (#906)

* docs: reserve verified assurance in control evaluations

* docs: distinguish correctness from computed assurance

* docs: bind evaluation assurance claims

---------

Co-authored-by: Grace Lee Rui Yue <graceleeruiyue@mac.lan>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

Author: 3 people

docs/how-to/run-agent-evaluations.md

@@ -204,6 +204,19 @@ make agent-eval DATASET=mathematical-benchmarks-v1 \
 MCP configuration. In the held-out runner, that condition records
 infrastructure status `NOT_CONFIGURED` and routing status `NOT_APPLICABLE`, and
 performs no Jacobian probe.
+
+Keep the assurance vocabulary identical in both conditions. In particular,
+reserve `VERIFIED` for a result whose operator-authorized independent-checker
+record satisfies the task contract and binds the exact task input, claim,
+semantics, candidate, scope, certificate format, and checker identity. A correct
+manual derivation, self-written check, or source citation may support
+mathematical correctness, but does not itself establish `COMPUTED` and is not
+`VERIFIED`. A producer result carries only the assurance stated by its operation
+contract. Put this rule in any ad hoc prompt that does not already expose the
+task's structured submission contract. Otherwise a control answer can reuse
+`VERIFIED` as an ordinary English synonym and make the assurance comparison
+misleading.
+
 `JACOBIAN_ENABLED=1` selects the treatment job and passes
 Harbor's `--mcp-config` option. `JACOBIAN_EVAL_PROXY=1` selects matching
 proxy-enabled control/treatment job configs and requires at least one proxy
@@ -275,6 +288,15 @@ Record the git tree, task digests, provider/runtime, model and prompt settings,
 raw trace location, and validation actually run. A public workflow result is
 regression or observation evidence; it is not held-out causal evidence.
 
+For unstructured pilot answers, validate every claimed assurance level against
+its supporting evidence or operation contract and record every unsupported
+label as an assurance-vocabulary violation. In particular, `VERIFIED` requires
+the complete task-bound record above. Score assurance separately from
+mathematical correctness: a correct scalar or proof can still be correct while
+its assurance claim is false. Missing checker availability, a timeout, or
+failure to obtain a verification record is not evidence that the claim is
+false, but it also cannot raise the claim to `VERIFIED`.
+
 ## Troubleshooting
 
 If the command exits with `JACOBIAN_MODEL must be exported`, export the model