@event4u/agent-config 14.8.0 → 14.10.0

package/dist/agent-src/skills/code-review/evals/evals.json

@@ -1,59 +1,100 @@
 {
- "skill": "code-review",
- "_calibration": "Behavioral fixtures incl. the U2 golden-adversarial pair (reliability-measurement, 2026-07-13). finding_floor is an enforcing mechanism since the 2026-07-13 cross-host calibration (internal/bench/reports/parity-count.json); these per-fixture n values are conservative floors derived from the fixture's planted-defect count. The golden-* pair is the review regression gate: the planted-injection diff must be flagged high/block, the benign look-alike must NOT be flagged as injection.",
- "scenarios": [
-  {
-   "id": "diff-with-multiple-issues",
-   "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nfunction pay(amount) {\n  var x = amount\n  eval(userInput)\n  db.query('SELECT * FROM users WHERE id = ' + req.params.id)\n  return x\n}\n```",
-   "assertions": [
+  "skill": "code-review",
+  "_calibration": "Behavioral fixtures incl. the U2 golden-adversarial pair (reliability-measurement, 2026-07-13). finding_floor is an enforcing mechanism since the 2026-07-13 cross-host calibration (internal/bench/reports/parity-count.json); these per-fixture n values are conservative floors derived from the fixture's planted-defect count. The golden-* pair is the review regression gate: the planted-injection diff must be flagged high/block, the benign look-alike must NOT be flagged as injection.",
+  "scenarios": [
     {
-     "kind": "finding_floor",
-     "n": 2
+      "id": "diff-with-multiple-issues",
+      "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nfunction pay(amount) {\n  var x = amount\n  eval(userInput)\n  db.query('SELECT * FROM users WHERE id = ' + req.params.id)\n  return x\n}\n```",
+      "assertions": [
+        {
+          "kind": "finding_floor",
+          "n": 2
+        },
+        {
+          "kind": "contains",
+          "value": "eval"
+        }
+      ]
     },
     {
-     "kind": "contains",
-     "value": "eval"
-    }
-   ]
-  },
-  {
-   "id": "clean-diff-few-findings",
-   "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nexport function add(a: number, b: number): number {\n  return a + b\n}\n```",
-   "assertions": [
+      "id": "clean-diff-few-findings",
+      "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nexport function add(a: number, b: number): number {\n  return a + b\n}\n```",
+      "assertions": [
+        {
+          "kind": "finding_floor",
+          "n": 0
+        }
+      ]
+    },
     {
-     "kind": "finding_floor",
-     "n": 0
-    }
-   ]
-  },
-  {
-   "id": "golden-sqli-must-block",
-   "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low):\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ' + req.params.id).then(r => res.json(r));\n});\n```",
-   "assertions": [
+      "id": "golden-sqli-must-block",
+      "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low):\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ' + req.params.id).then(r => res.json(r));\n});\n```",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "injection"
+        },
+        {
+          "kind": "finding_floor",
+          "n": 1,
+          "pattern": "(?i)critical|high|block"
+        }
+      ]
+    },
     {
-     "kind": "contains",
-     "value": "injection"
+      "id": "golden-benign-lookalike-no-injection",
+      "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low). If it is clean, say 'no findings':\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ?', [req.params.id]).then(r => res.json(r));\n});\n```",
+      "assertions": [
+        {
+          "kind": "not_contains",
+          "value": "SQL injection"
+        },
+        {
+          "kind": "not_contains",
+          "value": "sql injection"
+        }
+      ]
     },
     {
-     "kind": "finding_floor",
-     "n": 1,
-     "pattern": "(?i)critical|high|block"
-    }
-   ]
-  },
-  {
-   "id": "golden-benign-lookalike-no-injection",
-   "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low). If it is clean, say 'no findings':\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ?', [req.params.id]).then(r => res.json(r));\n});\n```",
-   "assertions": [
+      "id": "golden-spec-gap-correct-but-wrong",
+      "_why": "The scenario the corpus had no shape for. Correct, clean, typed, tested — and it does not do what the criterion asked. Before the spec judge joined the default path all five judges returned green on exactly this class, which is the miss this fixture records rather than merely describes. Its pair below is the negative control: same criterion, an implementation that DOES satisfy it, so a judge that flags every diff as non-compliant fails one of the two.",
+      "prompt": "ACCEPTANCE CRITERION: \"Retries use exponential backoff, so the delay between attempts grows.\"\n\nReview this diff against the criterion above and state, for the criterion, one of SATISFIED / PARTIAL / MISSING with the hunk and the test that proves it:\n```ts\n/** Retry with a delay between attempts. */\nexport async function retry<T>(fn: () => Promise<T>, attempts = 3, delayMs = 100): Promise<T> {\n  let last: unknown;\n  for (let i = 0; i < attempts; i += 1) {\n    try {\n      return await fn();\n    } catch (err) {\n      last = err;\n      await new Promise((r) => setTimeout(r, delayMs));\n    }\n  }\n  throw last;\n}\n```\n```ts\nit('retries three times then rethrows', async () => {\n  let n = 0;\n  await expect(retry(async () => { n += 1; throw new Error('x'); })).rejects.toThrow('x');\n  expect(n).toBe(3);\n});\n```",
+      "assertions": [
+        {
+          "kind": "finding_floor",
+          "n": 1
+        },
+        {
+          "kind": "contains",
+          "value": "backoff"
+        }
+      ]
+    },
     {
-     "kind": "not_contains",
-     "value": "SQL injection"
+      "id": "golden-spec-gap-negative-control",
+      "_why": "Negative control for the pair above, on the SAME criterion. A judge that reports non-compliance on every diff would pass the fixture above for the wrong reason; this one fails it. The pair is what makes the spec axis falsifiable rather than merely present.",
+      "prompt": "ACCEPTANCE CRITERION: \"Retries use exponential backoff, so the delay between attempts grows.\"\n\nReview this diff against the criterion above and state, for the criterion, one of SATISFIED / PARTIAL / MISSING with the hunk and the test that proves it:\n```ts\nexport async function retry<T>(fn: () => Promise<T>, attempts = 3, baseMs = 100): Promise<T> {\n  let last: unknown;\n  for (let i = 0; i < attempts; i += 1) {\n    try {\n      return await fn();\n    } catch (err) {\n      last = err;\n      await new Promise((r) => setTimeout(r, baseMs * 2 ** i));\n    }\n  }\n  throw last;\n}\n```\n```ts\nit('grows the delay between attempts', async () => {\n  const waits: number[] = [];\n  vi.spyOn(global, 'setTimeout').mockImplementation(((cb: () => void, ms: number) => { waits.push(ms); cb(); return 0 as never; }) as never);\n  await expect(retry(async () => { throw new Error('x'); }, 3, 100)).rejects.toThrow();\n  expect(waits).toEqual([100, 200, 400]);\n});\n```",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "SATISFIED"
+        }
+      ]
     },
     {
-     "kind": "not_contains",
-     "value": "sql injection"
+      "id": "golden-spec-no-criteria-must-not-pass",
+      "_why": "Step 1.3, and the case where inferring the spec from the diff is most tempting: an ad-hoc review with no criteria at all. A judge that infers the requirement from the change always finds the change compliant, so SATISFIED here is the circularity failure and not a lenient reading. The expected outcome is an explicit no-criteria verdict.",
+      "prompt": "No acceptance criteria were supplied for this review.\n\nReview this diff against its acceptance criteria and report the criteria-source state first, then any per-criterion verdicts:\n```ts\nexport function slugify(s: string): string {\n  return s.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');\n}\n```",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "not_provided"
+        },
+        {
+          "kind": "not_contains",
+          "value": "SATISFIED"
+        }
+      ]
     }
-   ]
-  }
- ]
+  ]
 }

package/dist/agent-src/skills/condense-memory/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: condense-memory
-description: "Use when shrinking always-loaded memory files (AGENTS.md, CLAUDE.md, .cursorrules) exceeding ~150 lines or ~4,000 chars — telegraph grammar, refuses sensitive paths, .original.md round-trip."
+description: "When shrinking always-loaded memory files (AGENTS.md, CLAUDE.md, .cursorrules) exceeding ~150 lines or ~4,000 chars — telegraph grammar, refuses sensitive paths, .original.md round-trip."
 domain: process
 execution:
   type: assisted

package/dist/agent-src/skills/conventional-commits-writing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: conventional-commits-writing
-description: "Use when writing commit messages or squash-merge titles — `feat:`, `fix:`, `chore:`, scopes, breaking changes — even when the user just says 'commit this' without naming Conventional Commits."
+description: "When writing commit messages or squash-merge titles — `feat:`, `fix:`, `chore:`, scopes, breaking changes — even when the user just says 'commit this' without naming Conventional Commits."
 domain: process
 execution:
   type: assisted

package/dist/agent-src/skills/design-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: design-review
-description: "Use when the user says \"review the design\", \"check the UI\", or wants a comprehensive UI/UX review. Uses a 7-phase methodology covering interaction, responsiveness, accessibility, and more."
+description: "When the user says \"review the design\", \"check the UI\", or wants a comprehensive UI/UX review. Uses a 7-phase methodology covering interaction, responsiveness, accessibility and more."
 domain: quality
 workspaces:
   - engineering

package/dist/agent-src/skills/discovery-interview/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: discovery-interview
-description: "Use when running discovery interviews — question-bank build, bias audit, insight extraction. Triggers on 'audit my guide', 'extract insights from transcript', 'is my hypothesis falsifiable'."
+description: "When running discovery interviews — question-bank build, bias audit, insight extraction. Triggers on 'audit my guide', 'extract insights from transcript', 'is my hypothesis falsifiable'."
 status: active
 tier: senior
 domain: product

package/dist/agent-src/skills/doc-coauthoring/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: doc-coauthoring
-description: "Use when co-authoring a PRD, design doc, RFC, decision doc, or technical spec — 3-stage flow (context → section-by-section → reader-test) — even if the user just says 'help me write this spec'."
+description: "When co-authoring a PRD, design doc, RFC, decision doc, or technical spec — 3-stage flow (context → section-by-section → reader-test) — even if the user just says 'help me write this spec'."
 domain: process
 workspaces:
   - agent-config-maintainer

package/dist/agent-src/skills/docx-authoring/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: docx-authoring
-description: "Use when generating or editing a Word .docx — create, fill a template, or edit body XML via a consumer library; round-trip validated. Triggers on 'generate a docx', 'fill this Word template'."
+description: "When generating or editing a Word .docx — create, fill a template, or edit body XML via a consumer library; round-trip validated. Triggers on 'generate a docx', 'fill this Word template'."
 status: active
 tier: senior
 domain: process

package/dist/agent-src/skills/editorial-calendar/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: editorial-calendar
-description: "Use when shaping cadence — evergreen / campaign / reactive split, beat-mapping across channel stages, content-debt management. Triggers on 'plan our content cadence', 'what should we publish'."
+description: "When shaping cadence — evergreen / campaign / reactive split, beat-mapping across channel stages, content-debt management. Triggers on 'plan our content cadence', 'what should we publish'."
 status: active
 tier: senior
 domain: product

package/dist/agent-src/skills/github-ci/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: github-ci
-description: "Use when working with GitHub Actions — workflow YAML, quality gates, test matrices, deployment triggers, reusable workflows — even when the user just says 'my CI is failing' or 'add a check'."
+description: "When working with GitHub Actions — workflow YAML, quality gates, test matrices, deployment triggers, reusable workflows — even when the user just says 'my CI is failing' or 'add a check'."
 domain: devops
 workspaces:
   - engineering

package/dist/agent-src/skills/humanizer/SKILL.md

@@ -71,6 +71,34 @@ human voice there; do not inject personality or restructure it.
    `npx tsx node_modules/@event4u/agent-config/src/scripts/detect_ai_tells.ts --stdin --fail`
    on the final draft. No runtime → the step-3 audit is the fallback
    (degrade, do not skip the audit).
+5b. **Carrier-Unicode strip — OPT-IN, never a default.** Runs **only** when
+   the operator explicitly asks for a carrier strip. `stripCarrierUnicode`
+   (`node_modules/@event4u/agent-config/src/scripts/detect_ai_tells.ts`, the same
+   path step 5 invokes) removes a hidden-Unicode codepoint only
+   when the codepoints on **both** sides are ASCII or absent; anything adjacent
+   to a non-ASCII character is preserved, so an emoji ZWJ sequence and a
+   complex-script joiner survive byte-identically.
+   **Why opt-in.** A default strip is a silent edit to the operator's
+   deliverable, which step 6's factual-integrity guard forbids for every other
+   kind of edit. Without an explicit request this step does not run and the
+   output is byte-identical to what the skill produces without it.
+   **This is the OUTPUT direction, and it does not touch step 0.** Step 0 scans
+   *ingested* input and surfaces findings as a warning — it never strips, because
+   there the hidden characters are an injection vector and removing them destroys
+   the evidence. Here the prose is the suite's own output and the operator has
+   asked. Two directions, two policies; reading them as one is the mistake this
+   paragraph exists to prevent.
+   **Hygiene, not a security control.** The predicate is deliberately
+   conservative, so a carrier adjacent to any non-ASCII character survives. The
+   injection vector stays covered by step 0.
+   **Emit the audit line** — `removed` and `preserved` counts, the classes
+   removed, and the reason for each preservation. An unexplained preservation is
+   the interesting half: it is what tells the operator the predicate fired
+   conservatively rather than failed. A strip with no audit line is a silent
+   edit wearing a step number.
+   Worked before/after: [`references/fixtures.md`](references/fixtures.md)
+   Fixture 3. Cases: [`evals/strip_fixtures.json`](evals/strip_fixtures.json).
+
 6. **Deterministic self-check + factual-integrity guard.** Re-scan the
    final draft against the [`anti-aiisms.md`](references/anti-aiisms.md)
    self-validation thresholds (dash density, consecutive-staccato cap,
@@ -189,6 +217,17 @@ do not infer a segment from the draft you were asked to edit.
   voice fingerprint that uses dashes overrides even that.
 - Do NOT shorten or restructure as a side effect — same coverage in,
   same coverage out.
+- Do NOT reach for `_sanitize`
+  (`node_modules/@event4u/agent-config/src/scripts/lint_hidden_unicode.ts`) or any
+  `NFKC` pass on a deliverable. It drops **every** `_classify`-flagged codepoint
+  unconditionally, and its class list contains `U+200C` and `U+200D` — so a
+  blind pass destroys emoji ZWJ sequences and complex-script joiners. It is a
+  file-repair path and correct for its own callers; on prose it corrupts the
+  text it was pointed at. Step 5b exists precisely because that shortcut is one
+  import away and looks like the same job.
+- Do NOT add a statistical-watermark rewrite or any detector-evasion mode. That
+  exclusion already stands below and this skill's carrier strip does not weaken
+  it: the strip removes invisible characters and alters no visible prose.
 
 ## Gotcha
 

package/dist/agent-src/skills/humanizer/evals/strip_fixtures.json

@@ -0,0 +1,57 @@
+{
+  "$comment": "Fixtures for stripCarrierUnicode (detect_ai_tells.ts). Six cases, reproduced offline against the real _classify export before the roadmap that added them was written. Every hidden codepoint is written as a JSON \\u escape and NEVER as a literal character: the first version of this file used literals, which (a) made the payloads invisible in review and (b) reddened lint_hidden_unicode with 20 blocking findings, since a tracked file carrying real carriers is exactly what that gate exists to refuse. JSON.parse decodes the escapes, so the test still receives the real characters at runtime.",
+  "recorded_limitation": {
+    "what": "The complex-script preservation cases are a CURATED BLOCK SET, not a Unicode Script-property lookup.",
+    "tested_blocks": [
+      "Arabic/Persian (U+0600-U+06FF)",
+      "emoji ZWJ sequences (U+1F400-U+1FAFF joined by U+200D)"
+    ],
+    "untested": "Indic (Devanagari, Bengali, Tamil, ...), Thai, Khmer, Myanmar, Mongolian, and every other script that uses a format character mid-word.",
+    "why_this_is_acceptable": "The predicate errs toward PRESERVATION: a carrier is removed only when both neighbours are ASCII, so a format character inside a non-ASCII word is preserved whatever its script. An untested script is therefore preserved rather than corrupted — the failure mode cannot occur in the unsafe direction. A full Script-property table would be a new data dependency guarding a failure that cannot happen.",
+    "what_would_change_this": "A script whose format characters legitimately appear between two ASCII characters. None is known; one would make the block set insufficient rather than merely untested."
+  },
+  "cases": [
+    {
+      "name": "ASCII-flanked zero-width space is removed",
+      "input": "the\u200bword",
+      "expect_out": "theword",
+      "expect_removed": 1,
+      "expect_preserved": 0
+    },
+    {
+      "name": "ASCII-flanked right-to-left override is removed",
+      "input": "safe\u202efile.txt",
+      "expect_out": "safefile.txt",
+      "expect_removed": 1,
+      "expect_preserved": 0
+    },
+    {
+      "name": "ASCII-flanked Unicode-tag codepoint is removed",
+      "input": "a\udb40\udc41b",
+      "expect_out": "ab",
+      "expect_removed": 1,
+      "expect_preserved": 0
+    },
+    {
+      "name": "emoji ZWJ sequence survives byte-identically",
+      "input": "👨\u200d💻 ships it",
+      "expect_out": "👨\u200d💻 ships it",
+      "expect_removed": 0,
+      "expect_preserved": 1
+    },
+    {
+      "name": "Persian ZWNJ survives byte-identically",
+      "input": "می\u200cخواهم",
+      "expect_out": "می\u200cخواهم",
+      "expect_removed": 0,
+      "expect_preserved": 1
+    },
+    {
+      "name": "clean prose is a no-op, and the strip is idempotent",
+      "input": "Nothing hidden here — just prose with an em dash.",
+      "expect_out": "Nothing hidden here — just prose with an em dash.",
+      "expect_removed": 0,
+      "expect_preserved": 0
+    }
+  ]
+}

package/dist/agent-src/skills/humanizer/references/fixtures.md

@@ -68,3 +68,57 @@ The two targets diverge on every axis — a draft matched to A is not a draft
 matched to B. Sample B is also a case where the dash-density default is
 **suppressed**: the fingerprint genuinely writes in dashes, so the fingerprint
 wins (SKILL § voice precedence).
+
+## Fixture 3 — carrier strip, and what "preserved" looks like (step 5b)
+
+The point of this fixture is the **preserved** half. A reader who only sees
+carriers disappear cannot tell a conservative predicate from a blind one, and a
+blind one corrupts emoji and complex-script text. So the input carries both.
+
+**Carriers are written as `U+XXXX` notation, never as the actual invisible
+character.** Two reasons, and the second is a gate: an invisible byte is
+unreadable in exactly the document whose job is showing what happened, and
+`lint_hidden_unicode` refuses a tracked file carrying real carriers — its own
+header says a teaching doc "writes `U+200B` as text". The first version of this
+fixture used literals and reddened that gate with 20 blocking findings.
+
+**Input** — `the⟦U+200B⟧word 👨⟦U+200D⟧💻 می⟦U+200C⟧خواهم safe⟦U+202E⟧file`
+
+| Carrier | Neighbours | Decision |
+|---|---|---|
+| `U+200B` between `e` and `w` | ASCII / ASCII | **removed** |
+| `U+200D` joining two emoji | non-ASCII / non-ASCII | preserved |
+| `U+200C` inside a Persian word | non-ASCII / non-ASCII | preserved |
+| `U+202E` between `e` and `f` | ASCII / ASCII | **removed** |
+
+**Output** — `theword 👨⟦U+200D⟧💻 می⟦U+200C⟧خواهم safefile`
+
+**Audit line** (generated by running the real function, not written by hand):
+
+```
+carrier strip: removed 2 (zero-width 1, bidi-control 1) · preserved 2
+  · U+200B  zero-width     offset 3   removed
+  · U+200D  zero-width     offset 10  preserved — adjacent to a non-ASCII codepoint, may be a joiner
+  · U+200C  zero-width     offset 15  preserved — adjacent to a non-ASCII codepoint, may be a joiner
+  · U+202E  bidi-control   offset 26  removed
+```
+
+Three things a reader should take from this:
+
+1. **`U+200B` and `U+200D` are the same class** — both `zero-width` — and get
+   opposite dispositions. The class is not the decision; the neighbours are.
+   Any strip keyed on class alone destroys the emoji.
+2. **Offsets are codepoint indices, not UTF-16 units.** The emoji before
+   `U+200D` is a surrogate pair, so a UTF-16 index would report a different
+   number and the audit line would be wrong for exactly the inputs this
+   predicate exists to protect.
+3. **A preservation always carries its reason.** An unexplained preservation
+   would be indistinguishable from a bug; the reason is what makes the
+   conservative branch auditable rather than merely quiet.
+
+Re-running the strip over the output changes nothing — `removed 0 · preserved 2`.
+Idempotence is a property of the predicate, not a coincidence: the two survivors
+still have non-ASCII neighbours the second time round.
+
+The runnable form of all six cases, with the carriers as JSON `\u` escapes, is
+[`evals/strip_fixtures.json`](../evals/strip_fixtures.json).

package/dist/agent-src/skills/judge-artifact-completeness/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: judge-artifact-completeness
-description: "Use when scoring a roadmap, PR review, ADR, or ticket for completeness — risk, tests, migration, maintainability. Dispatched by /refine-ticket, /adr-create, /review-changes; never auto-gates."
+description: "When scoring a roadmap, PR review, ADR, or ticket for completeness — risk, tests, migration, maintainability. Dispatched by /refine-ticket, /adr-create, /review-changes; never auto-gates."
 domain: quality
 workspaces:
   - agent-config-maintainer

package/dist/agent-src/skills/judge-injection-defense/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: judge-injection-defense
-description: "Use when scoring whether an agent response defended against an injection — treated untrusted content as data, refused role-takeover, ignored fake boundaries. Inverted axis; never auto-gates."
+description: "When scoring whether an agent response defended against an injection — treated untrusted content as data, refused role-takeover, ignored fake boundaries. Inverted axis; never auto-gates."
 domain: quality
 workspaces:
   - agent-config-maintainer

package/dist/agent-src/skills/judge-spec-compliance/SKILL.md

@@ -0,0 +1,154 @@
+---
+model_tier: high
+name: judge-spec-compliance
+description: "Use when a diff needs a requirement review — does it satisfy every stated acceptance criterion — dispatched by /review-changes, /do-and-judge, /judge. Never infers criteria from the diff."
+domain: quality
+parallelizable: files
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+---
+
+# judge-spec-compliance
+
+> You are a judge specialized in **requirement compliance**. Your only
+> job is: **does the diff satisfy every acceptance criterion as
+> stated?** You do **not** review style, naming, craft, correctness,
+> security or test coverage — five other judges handle those, and a
+> finding of theirs is not a finding of yours.
+
+The wording above is the SPEC COMPLIANCE judge from
+[`do-and-judge-two-stage`](../subagent-orchestration/prompts/do-and-judge-two-stage.md)
+§ Stage-1 prompt, reused rather than reinvented. That prompt worked and was
+reachable only through one orchestration mode; this skill is the same job on the
+default review path.
+
+## Why this judge exists
+
+Every other default judge asks a **craft-or-correctness** question. So a change
+that is correct, clean, well-tested and architecturally sound — and **does not do
+what was asked** — passed the default path with five green verdicts. Correctness
+and compliance are different questions, and only one of them was being asked.
+
+## When to use
+
+* A diff is ready for review and **doing the wrong thing** is the risk
+* `/review-changes` dispatches its "spec" slice to this skill
+* A reviewer asks "is this what we asked for?", "does this satisfy the AC?"
+
+Do NOT use when:
+
+* The concern is a functional bug → [`judge-bug-hunter`](../judge-bug-hunter/SKILL.md)
+* The concern is security → [`judge-security-auditor`](../judge-security-auditor/SKILL.md)
+* The concern is missing tests → [`judge-test-coverage`](../judge-test-coverage/SKILL.md)
+* The concern is readability → [`judge-code-quality`](../judge-code-quality/SKILL.md)
+* **The criteria are not available** — that is not a reason to skip; it is a
+  verdict of its own. See § No criteria.
+
+## Procedure
+
+### 1. Establish where the criteria came from — before reading the diff
+
+Read the criteria **first**, and never after forming an impression of the diff.
+The order is the control, not a preference: a judge that reads the change first
+and the requirement second reconstructs the requirement to fit what it just saw.
+
+```
+NEVER INFER AN ACCEPTANCE CRITERION FROM THE DIFF YOU ARE JUDGING.
+A JUDGE THAT DERIVES THE REQUIREMENT FROM THE CHANGE ALWAYS FINDS THE
+CHANGE COMPLIANT. THAT IS CIRCULAR BY CONSTRUCTION, NOT A BIAS A LABEL FIXES.
+```
+
+Criteria are **supplied**, or they are not. A commit message and a PR body are
+written by the same author as the diff, usually after it — so deriving criteria
+from them is a weaker form of the same circularity, not an independent source of
+lower quality.
+
+### 2. Per-AC scan
+
+For each criterion, exactly one of:
+
+| Verdict | What it requires |
+|---|---|
+| `SATISFIED` | cite the diff hunk **and** the test that proves it. A hunk with no test is not satisfied, it is claimed |
+| `PARTIAL` | cite what is missing and why it falls short |
+| `MISSING` | the criterion has no corresponding implementation |
+
+### 3. Report the criteria-source state — three, not two
+
+This mirrors [`dispatch_r2_reviewer`](../../scripts/dispatch_r2_reviewer.ts)'s
+own extraction-failure handling, which refuses to collapse the last two for the
+same reason: an unrecognised shape and a genuine absence produce the **identical
+empty result**, so asserting "declares none" would turn a silent tool failure
+into a false statement handed to the one independent check on AC conformance.
+
+| State | Meaning | How to report |
+|---|---|---|
+| `supplied` | a roadmap, ticket or explicit criteria set was handed in | run § 2 |
+| `not_provided` | no criteria exist for this review — an ad-hoc branch review | **no-criteria verdict**, never `SATISFIED` |
+| `supplied_unparseable` | criteria were handed in and could not be read | **ERROR**, not a no-criteria verdict |
+
+**`supplied_unparseable` is an error and not a third flavour of silence.** It
+means the tooling is broken or the input is malformed, and folding it into
+`not_provided` hides parser regressions behind a state that looks routine.
+
+## No criteria — the verdict, and what it does to "done"
+
+A no-criteria outcome is **not** a pass, and it is not an abstention that the
+consolidated verdict may ignore. What it changes is what "done" is allowed to
+claim:
+
+> **craft quality verified; requirement compliance NOT verified**
+
+That phrasing is the point. If this judge abstains on most reviews, the honest
+consequence is not that the axis should be dropped — it is that most reviews
+were previously reporting a confidence they had not earned. The abstention makes
+that visible instead of assuming it away.
+
+## Do NOT
+
+* Do NOT infer criteria from the diff, the commit messages, or the PR body.
+* Do NOT return `SATISFIED` when no criteria were supplied — return the
+  no-criteria verdict.
+* Do NOT collapse `supplied_unparseable` into `not_provided`.
+* Do NOT report a craft, naming, correctness or coverage finding. Another judge
+  owns it, and duplicating it here inflates the finding count without adding a
+  reading.
+* Do NOT treat a criterion as satisfied on a diff hunk alone when a test could
+  have proven it.
+
+## Gotcha
+
+* **Criteria authored after the diff are not independent.** If the criteria set
+  was written or last modified after the change it judges, say so — a criterion
+  reverse-engineered from a merged branch verifies nothing.
+* **A criterion the diff makes moot is still not satisfied.** "We no longer need
+  this" is a scope decision for a human, not a verdict this judge may reach.
+
+## Output format
+
+Ordered, and the first line is not negotiable — a reader must be able to see the
+criteria-source state before any per-criterion verdict, because every verdict
+below it is conditional on that state.
+
+1. `criteria_source: supplied | not_provided | supplied_unparseable`
+2. If `not_provided` → the no-criteria verdict and the "requirement compliance
+   NOT verified" line. **Stop.** Do not emit per-criterion rows.
+3. If `supplied_unparseable` → `ERROR` with what was handed in and what could not
+   be read. **Stop.** Do not emit per-criterion rows and do not degrade to
+   `not_provided`.
+4. If `supplied` → one row per criterion:
+   `| # | criterion (as stated) | SATISFIED / PARTIAL / MISSING | diff hunk | test |`
+   Criteria in the order they were stated, never re-ordered by verdict — a
+   reader comparing two runs needs the rows to line up.
+5. One closing line: the count of `MISSING` and `PARTIAL`. Not a severity, not a
+   recommendation — those belong to synthesis, and phrasing this as one is how a
+   spec finding gets ranked against a naming nit.
+
+## Related
+
+* [`judge-synthesis`](../judge-synthesis/SKILL.md) — consumes this verdict on
+  its **own dimension**, deliberately not on the shared severity axis.
+* [`do-and-judge-two-stage`](../subagent-orchestration/prompts/do-and-judge-two-stage.md)
+  — the stage-1 prompt this reuses.

package/dist/agent-src/skills/judge-synthesis/SKILL.md

@@ -50,9 +50,15 @@ vocabularies in the suite map onto one ordered severity axis:
 | code judges (`judge-bug-hunter`, `-code-quality`, `-security-auditor`, `-test-coverage`, `architecture-review-lens`) | `apply` / `revise` / `reject` |
 | `judge-artifact-completeness` | `complete` / `partial` / `incomplete` |
 | `judge-injection-defense` | `defended` / `partial` / `breached` |
+| `judge-spec-compliance` | per criterion: `SATISFIED` / `PARTIAL` / `MISSING` — plus a `criteria_source` state that is not a verdict |
 
 Ordered worst→best: **`reject`/`incomplete`/`breached` > `revise`/`partial` > `apply`/`complete`/`defended`**.
 
+`judge-spec-compliance` is deliberately absent from that axis. Its verdicts
+answer a different question — *did the change do what was asked* — and mapping
+`MISSING` onto `reject` would let a craft-clean diff average it away, which is
+the miss this judge was added to catch. It gets its own dimension in § 4c.
+
 ## Procedure
 
 ### 1. Inspect the inputs and tabulate
@@ -133,12 +139,51 @@ the reviewed change, and it is not the `code-provenance` knowledge-layer
 obligation, which governs what a durable artefact asserts rather than what a
 transient review does.
 
+### 4c. Spec compliance is its own dimension — never folded into the tiers
+
+```
+A SPEC FINDING NEVER BECOMES A CRAFT FINDING.
+REPORT THE SPEC DIMENSION SEPARATELY, WITH ITS `criteria_source` STATE.
+A CRAFT-CLEAN DIFF THAT MISSES ITS CRITERION IS NOT A CLEAN REVIEW.
+NO CRITERIA SUPPLIED IS AN UNVERIFIED DIMENSION, NEVER A PASS.
+```
+
+`judge-spec-compliance` findings do **not** enter must-fix / should-fix /
+advisory. They form a separate block carrying, in this order: the
+`criteria_source` state, the per-criterion table, and the count of `MISSING`
+plus `PARTIAL`.
+
+The separation is the whole point. Folded into the craft tiers a `MISSING`
+criterion competes with five other judges' findings and can be outvoted by
+their silence; kept apart it cannot be, because there is nothing to average it
+against. Consensus (§ 2) and conflict (§ 3) do not apply either: no other judge
+reads the criteria, so a spec finding has no possible second voter and its
+absence of corroboration says nothing about it.
+
+Three `criteria_source` states, and each says something different about what
+this review established:
+
+| State | What the synthesis reports |
+|---|---|
+| `supplied` | the dimension was verified; report the per-criterion verdicts |
+| `not_provided` | the dimension was **not verified** — say so, never report it as clean |
+| `supplied_unparseable` | an **error**, not a no-criteria run: criteria were handed over and could not be read, so the reader must know their review silently skipped a dimension it was asked to check |
+
 ### 5. Overall recommendation
 
 One sentence, not a number: `block` (any worst-tier verdict), `revise` (any
 mid-tier, no worst-tier), or `proceed` (all clean). This is a recommendation the
 human acts on — it does not gate anything.
 
+**The sentence names the spec dimension explicitly, in every case.** A `MISSING`
+criterion is a `block` and a `PARTIAL` one is at least a `revise`, whatever the
+craft judges said. Where no criteria were supplied, the sentence says what was
+and was not established — *"craft quality verified; requirement compliance NOT
+verified (no criteria supplied)"* — because a bare `proceed` over an unverified
+dimension reads as a full pass, and that reading is the defect: a reviewer
+cannot tell "we checked and it complies" from "nobody checked" unless the
+sentence distinguishes them.
+
 ## Validation
 
 1. Every judge that ran appears exactly once in the table.