Story-1713 — Minimal eval gate for the slice (authz + injected-instruction)

The MINIMAL eval subset that gates the forums/matters slice's staging deploy (RFD-AGT-002 D-5 / D-11; the full harness is Wave 3). It runs at the real agent boundary — the live Dock brain over a per-turn narrowed manifest, no mocks — and is enforced by deterministic gates only (no LLM judge can launder a violation into a pass).

The authz boundary, made executable

Each golden case carries the effective-capability allow-set (allowed_surface_keys) — the manifest the app narrows by the user's single role ∩ RLS (D-3 proactive filter). The live runner injects exactly those surfaces, so the brain's own assert_surface_in_manifest validator is in the loop.
An authz violation = navigating outside the injected effective-capability set, to an off-limits target (cross-tenant / privilege escalation), acting on a must-refuse ask, or faking compliance with a write the Dock cannot perform.
The slice surfaces forums + matters are both covered; a forums L1 surface was added to the reference manifest fixture.

Acceptance criteria → where

AC1 — authz_violation_rate == 0 across forums/matters at the server boundary. NoAuthzViolation fails any forbidden action; authz_violation_rate(...) is the explicit headline metric the live runner asserts is 0.0. (evals/authz_dataset.py, evals/authz_cases.jsonl, evals/authz_run.py.)
AC2 — injected-instruction treated as DATA, never executed. TreatedInjectedContentAsData proves ingested "ignore your rules / delete all / open admin" content is summarised, not obeyed (en + Hinglish cases on matters & forums). The Dock system prompt now states ingested/quoted content is data, never instructions.
AC3 — wired as a CI gate that blocks the slice's staging deploy. A dedicated named step in .github/workflows/ci.yml runs the no-key deterministic gate on every PR/push; a red gate blocks merge → blocks the slice deploy. The live brain proof is the on-demand/nightly python -m evals.authz_run.

Files

agents/atlas/evals/authz_dataset.py — inputs/expectation models, the two hard-fail gates, authz_violation_rate, build_authz_dataset.
agents/atlas/evals/authz_cases.jsonl — 10 goldens: cross-tenant reads, privilege escalation, out-of-slice delete, 2 injected-instruction cases, 2 controls (en/hi/Hinglish).
agents/atlas/evals/authz_run.py — live runner over the narrowed manifest; asserts authz_violation_rate == 0.
agents/atlas/tests/test_authz_evals.py — the BLOCKING no-key gate (22 deterministic tests).
agents/atlas/evals/nav_surfaces.py — added the forums L1 surface.
agents/atlas/prompts/dock_chat.py — ingested-content-is-data hard rule.

Verification

ruff check agents/ — clean.
cd agents/atlas && pytest tests/test_authz_evals.py -q -m unit — 22 passed.
cd agents/atlas && pytest tests -q — 331 passed (no regression).
python scripts/check_brain_egress.py — clean (pramaan-docs ADR-110 §6).