Measure the concept-declaration gap (INFO-WP-0027-T01)

Adds maintenance.concept_candidates() and the concept-coverage CLI command,
which measure concepts an artifact defines in prose against the concepts it
declares. Extraction covers the bold form, the numbered-heading form that hid
itc-org:Authority, and the concept-table form the kernel map uses; preserved
source under assimilation, seeds and incoming is excluded. Candidates are review
input, never ownership.

Baseline over 31 live artifacts: 113 concepts declared against 690 defined,
leaving 637 defined but undeclared, about 16 percent coverage. The workplan's
519 counted the bold form alone.

Two corrections to the workplan's framing, applied there. Thirteen artifacts
declare nothing rather than twelve: kernel/itc-core defines 57 concepts across
two forms and declares none, and it is the artifact every other artifact imports
from, so it goes first in T02. The gap also reaches further than obscure terms —
Actor is undeclared in the organization model although SecurityCanon imports it
from there by name against a pinned hash.

Three tests cover the extractor, one asserting that Authority appears in the
organization model's undeclared list, so the blind spot that produced finding
F-1 now has a regression test. make check passes with 49 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3588@bnt-lap001
Assistant-Session: 24b80f66-e5a7-4e61-99fe-2d422e6d17da

tests/test_maintenance.py

@@ -9,7 +9,12 @@ import pytest
 import yaml
 
 from info_tech_canon.cli import main
-from info_tech_canon.maintenance import check_generated, export_emission_bundle, source_evidence
+from info_tech_canon.maintenance import (
+    check_generated,
+    concept_candidates,
+    export_emission_bundle,
+    source_evidence,
+)
 from info_tech_canon.service import DEFAULT_INFOSPACE_ROOT, load_context, validate_canon
 
 
@@ -114,3 +119,29 @@ def test_missing_mapping_schema_is_a_validation_finding(corpus):
     payload = validate_canon(corpus)
     assert not payload["ok"]
     assert any(e["code"] == "mapping_schema_unreadable" for e in payload["errors"])
+
+
+def test_concept_candidates_find_prose_definitions_the_declarations_miss():
+    """The gap that let itc-org:Authority pass the SecurityCanon conflict check."""
+    report = concept_candidates(load_context())
+    organization = next(item for item in report["artifacts"]
+                        if item["artifact"] == "model/organization")
+
+    assert "Authority" in organization["undeclared"]
+    assert organization["undeclared_count"] > organization["declared_count"]
+    assert report["undeclared_total"] > 0
+    assert "model/security" in report["silent_artifacts"]
+
+
+def test_concept_candidates_ignore_preserved_source():
+    report = concept_candidates(load_context())
+    paths = [item["path"] for item in report["artifacts"]]
+    assert paths
+    assert not [path for path in paths if path.startswith(("assimilation/", "seeds/"))]
+
+
+def test_concept_coverage_cli_reports_one_artifact(capsys):
+    assert main(["concept-coverage", "--artifact", "model/identity"]) == 0
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["ok"] is True
+    assert [item["artifact"] for item in payload["artifacts"]] == ["model/identity"]