@event4u/agent-config 14.8.0 → 14.9.0

package/src/scripts/_lib/retrieval_sanitize.ts

@@ -85,6 +85,68 @@ export function sanitize_text(s: string): string {
     return out.length > MAX_FIELD_CHARS ? out.slice(0, MAX_FIELD_CHARS) : out;
 }
 
+/**
+ * Report the INVISIBLE layer without removing it.
+ *
+ * `sanitize_text` above strips four channels — hidden-instruction vectors
+ * (bidi, zero-width, tag, deprecated-format, private-use-area, per `_classify`),
+ * strippable control chars, and invisible fillers. Stripping is the right
+ * disposition for a retrieval path that is about to hand text to a model.
+ *
+ * It is the WRONG disposition for a reporting surface. A warn-only PostToolUse
+ * hook must not rewrite what the agent already read, so it cannot call
+ * `sanitize_text` at all — and `scan_encoding_findings` is the VISIBLE-layer
+ * twin and deliberately says nothing about these four. Measured over the frozen
+ * corpus before this function existed: `deprecated-format`, `private-use-area`,
+ * `control-char` and `invisible-filler` reported **0 of 20 each** through the
+ * reporting API while `sanitize_text` changed **20 of 20** for every one of
+ * them. So the layer had a reporting blind spot exactly where its stripping was
+ * perfect, and a consumer that may not strip was blind to a quarter of the
+ * channel set.
+ *
+ * The published 99.00 % recall figure is the STRIPPING pipeline's. The reporting
+ * half alone measured 72.33 %. Both numbers are correct about different things,
+ * and conflating them is what made "import the measured layer and get 15
+ * channels" read as true.
+ *
+ * Additive by construction: nothing that exists changes behaviour, and the
+ * predicates are the SAME ones `sanitize_text` uses — not copies — so a channel
+ * cannot become strippable without becoming reportable in the same edit.
+ */
+export function scan_invisible_findings(s: string): EncodingFinding[] {
+    const out: EncodingFinding[] = [];
+    const seen = new Set<string>();
+    const add = (channel: string, cp: number): void => {
+        const key = `${channel}:${cp}`;
+        if (seen.has(key)) return;
+        seen.add(key);
+        out.push({
+            channel,
+            detail: `U+${cp.toString(16).toUpperCase().padStart(4, '0')} in the invisible layer`,
+        });
+    };
+    for (const ch of s) {
+        const cp = ch.codePointAt(0);
+        if (cp === undefined) continue;
+        const classified = _classify(cp);
+        if (classified !== null) {
+            // `_classify` already names the channel; reuse its label rather than
+            // re-deriving one, so the hook's output and the authoring-time
+            // linter's speak the same vocabulary.
+            add(typeof classified === 'string' ? classified : 'hidden-instruction', cp);
+            continue;
+        }
+        if (_isStrippableControl(cp)) {
+            add('control-char', cp);
+            continue;
+        }
+        if (_INVISIBLE_FILLERS.has(cp)) {
+            add('invisible-filler', cp);
+        }
+    }
+    return out;
+}
+
 // ---------------------------------------------------------------------------
 // Visible-layer scanner — FLAG ONLY, never rewrites
 // ---------------------------------------------------------------------------

package/src/scripts/_lib/review_telemetry.ts

@@ -0,0 +1,196 @@
+/**
+ * One structural line per review run — the review surface's only telemetry.
+ *
+ * Why it exists: before this file the review surface emitted nothing. Nothing
+ * recorded how often a review ran, which judges fired, or whether the spec
+ * axis ever changed a recommendation — so the value of adding a sixth judge
+ * was unmeasurable in either direction, and the cheapest response to a slower
+ * default path is to switch the new judge off. A number is the only defence
+ * against that, and the honest number includes "it changed nothing".
+ *
+ * PII-exclusion by CONSTRUCTION, not by scrubbing. `ReviewLine` has no field
+ * able to hold free-form content: every member is an enum, a boolean, a
+ * non-negative integer, or an ISO timestamp. There is no `payload`, `notes`,
+ * `extra`, `prompt`, `diff` or `path` member, and `buildReviewLine` REJECTS an
+ * input object carrying one rather than dropping it silently — a scrubber can
+ * fail, an absent field cannot. Same principle the artifact-engagement event
+ * and `orchestration_record`'s hex-only `payload_hash` apply.
+ *
+ * Deliberately NOT reused from `_lib/orchestration_record.ts`: that line
+ * describes a subagent DISPATCH (tier, route, token deltas, cache hits). A
+ * review is not a dispatch, and widening `RecordInput` with review-shaped
+ * optionals would make both types describe neither thing precisely.
+ */
+
+/** Was the spec axis able to run at all, and on what basis? */
+export type SpecAxisReach = 'reachable_with_criteria' | 'reachable_no_criteria' | 'unreachable';
+
+/**
+ * Did the spec axis change the recommendation the craft judges would have
+ * produced on their own?
+ *
+ * `null` is NOT "no" — it means the comparison never happened (the axis did
+ * not run, so there is no counterfactual). A `false` here would claim a
+ * comparison that was never made, which is the mis-attribution this field
+ * exists to expose. Same reasoning as `modelDivergent` in
+ * `_lib/orchestration_record.ts`.
+ */
+export type SpecAxisEffect = 'changed' | 'unchanged' | null;
+
+/** The recommendation word the synthesis emitted. */
+export type ReviewRecommendation = 'block' | 'revise' | 'proceed';
+
+/** The criteria-source state, mirroring `judge-spec-compliance`'s three states. */
+export type CriteriaSource = 'supplied' | 'not_provided' | 'supplied_unparseable';
+
+/** The closed field set. A member not on this list cannot be written. */
+export const REVIEW_LINE_FIELDS = [
+    'schema',
+    'at',
+    'judges_declared',
+    'judges_ran',
+    'spec_axis_reach',
+    'criteria_source',
+    'criteria_count',
+    'spec_missing',
+    'spec_partial',
+    'recommendation',
+    'spec_axis_effect',
+] as const;
+
+export type ReviewLineField = (typeof REVIEW_LINE_FIELDS)[number];
+
+/**
+ * Field names that must never appear on this line — the free-form shapes a
+ * reviewer would reach for first. Checked as an INPUT rejection, so adding one
+ * fails loudly at the call site instead of being stripped downstream.
+ */
+export const FORBIDDEN_FREEFORM_FIELDS = [
+    'payload',
+    'notes',
+    'extra',
+    'prompt',
+    'diff',
+    'path',
+    'file',
+    'criteria',
+    'findings',
+    'message',
+    'body',
+    'content',
+    'text',
+] as const;
+
+export interface ReviewLine {
+    readonly schema: 'review-axis-v1';
+    /** ISO-8601 UTC. Caller-supplied so the line is reproducible in a test. */
+    readonly at: string;
+    readonly judges_declared: number;
+    readonly judges_ran: number;
+    readonly spec_axis_reach: SpecAxisReach;
+    readonly criteria_source: CriteriaSource;
+    readonly criteria_count: number;
+    readonly spec_missing: number;
+    readonly spec_partial: number;
+    readonly recommendation: ReviewRecommendation;
+    readonly spec_axis_effect: SpecAxisEffect;
+}
+
+export interface ReviewLineInput {
+    at: string;
+    judges_declared: number;
+    judges_ran: number;
+    spec_axis_reach: SpecAxisReach;
+    criteria_source: CriteriaSource;
+    criteria_count: number;
+    spec_missing: number;
+    spec_partial: number;
+    recommendation: ReviewRecommendation;
+    spec_axis_effect?: SpecAxisEffect;
+}
+
+export interface BuiltReviewLine {
+    line: ReviewLine | null;
+    errors: string[];
+}
+
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,6})?Z$/;
+const REACH: readonly SpecAxisReach[] = ['reachable_with_criteria', 'reachable_no_criteria', 'unreachable'];
+const SOURCE: readonly CriteriaSource[] = ['supplied', 'not_provided', 'supplied_unparseable'];
+const RECO: readonly ReviewRecommendation[] = ['block', 'revise', 'proceed'];
+
+function isCount(n: unknown): n is number {
+    return typeof n === 'number' && Number.isInteger(n) && n >= 0;
+}
+
+/**
+ * Build + validate one `review-axis-v1` line.
+ *
+ * Returns `{line, errors}`; when `errors` is non-empty, `line` is null and the
+ * caller must NOT write. Never throws, never partially writes, never silently
+ * repairs an invalid input — the same contract as `buildOrchestrationLine`.
+ */
+export function buildReviewLine(input: ReviewLineInput): BuiltReviewLine {
+    const errors: string[] = [];
+    const raw = input as unknown as Record<string, unknown>;
+
+    for (const banned of FORBIDDEN_FREEFORM_FIELDS) {
+        if (Object.prototype.hasOwnProperty.call(raw, banned)) {
+            errors.push(
+                `'${banned}' is a free-form field and review-axis-v1 carries none — ` +
+                    'privacy here is a property of the schema shape, not of a scrubbing pass',
+            );
+        }
+    }
+
+    if (typeof input.at !== 'string' || !ISO_RE.test(input.at)) {
+        errors.push('at must be an ISO-8601 UTC timestamp (…Z)');
+    }
+    for (const k of ['judges_declared', 'judges_ran', 'criteria_count', 'spec_missing', 'spec_partial'] as const) {
+        if (!isCount(input[k])) errors.push(`${k} must be a non-negative integer`);
+    }
+    if (isCount(input.judges_ran) && isCount(input.judges_declared) && input.judges_ran > input.judges_declared) {
+        errors.push('judges_ran cannot exceed judges_declared');
+    }
+    if (!REACH.includes(input.spec_axis_reach)) errors.push(`spec_axis_reach must be one of ${REACH.join(' | ')}`);
+    if (!SOURCE.includes(input.criteria_source)) errors.push(`criteria_source must be one of ${SOURCE.join(' | ')}`);
+    if (!RECO.includes(input.recommendation)) errors.push(`recommendation must be one of ${RECO.join(' | ')}`);
+
+    const effect = input.spec_axis_effect ?? null;
+    if (effect !== null && effect !== 'changed' && effect !== 'unchanged') {
+        errors.push('spec_axis_effect must be changed | unchanged | null');
+    }
+    // A counterfactual that never ran is `null`, never `unchanged`.
+    if (input.spec_axis_reach === 'unreachable' && effect !== null) {
+        errors.push('spec_axis_effect must be null when the axis was unreachable — there was no comparison to report');
+    }
+    // The two honest pairings of reach and source.
+    if (input.spec_axis_reach === 'reachable_with_criteria' && input.criteria_source !== 'supplied') {
+        errors.push('reachable_with_criteria requires criteria_source=supplied');
+    }
+    if (input.spec_axis_reach === 'reachable_no_criteria' && input.criteria_source === 'supplied') {
+        errors.push('reachable_no_criteria contradicts criteria_source=supplied');
+    }
+    if (input.criteria_source !== 'supplied' && isCount(input.criteria_count) && input.criteria_count > 0) {
+        errors.push('criteria_count must be 0 unless criteria were supplied');
+    }
+
+    if (errors.length > 0) return { line: null, errors };
+
+    return {
+        line: {
+            schema: 'review-axis-v1',
+            at: input.at,
+            judges_declared: input.judges_declared,
+            judges_ran: input.judges_ran,
+            spec_axis_reach: input.spec_axis_reach,
+            criteria_source: input.criteria_source,
+            criteria_count: input.criteria_count,
+            spec_missing: input.spec_missing,
+            spec_partial: input.spec_partial,
+            recommendation: input.recommendation,
+            spec_axis_effect: effect,
+        },
+        errors: [],
+    };
+}

package/src/scripts/_lib/subagent_response.ts

@@ -61,10 +61,102 @@ export interface SubagentResponse {
      * the same claim as "no assumptions were made".
      */
     assumptions?: CapsuleAssumption[];
+    /**
+     * Where the tests in this change were authored FROM.
+     *
+     * `from-spec` — written against the acceptance criteria, before the diff
+     * existed. `from-diff` — written after reading the implementation.
+     * `unknown` — not recorded.
+     *
+     * **`unknown` is the default and an ABSENT field resolves to it, never to
+     * `from-spec`.** That asymmetry is the whole point of the field. The claim
+     * this metric exists to keep measurable is that a suite written by the same
+     * context as the implementation inherits its blind spots — so the valuable
+     * state is `from-spec`, and a default that let absence read as the valuable
+     * state would report the claim as satisfied by silence.
+     *
+     * Structural enum only: three string values and nothing that can hold
+     * free-form content. Same exclusion-by-construction the rest of this
+     * envelope uses — a field that cannot carry a prompt or a diff has no
+     * scrubber to fail.
+     *
+     * OPTIONAL, and deliberately not in `RESPONSE_REQUIRED_FIELDS`: that list
+     * is calibrated against a recorded ledger equivalence (`error_count: 5`),
+     * and adding a sixth required field would break it. A metric is not worth
+     * invalidating a measurement for.
+     */
+    test_authorship?: TestAuthorship;
+}
+
+/**
+ * Three states. `unknown` is one of them, not the absence of the other two.
+ *
+ * Ordered by what they license rather than alphabetically: `from-spec` is the
+ * only value that supports the independence claim, `from-diff` is the weaker
+ * form the claim says is worthless, and `unknown` licenses nothing.
+ */
+export type TestAuthorship = 'from-spec' | 'from-diff' | 'unknown';
+
+export const TEST_AUTHORSHIP: ReadonlySet<string> = new Set<TestAuthorship>([
+    'from-spec',
+    'from-diff',
+    'unknown',
+]);
+
+/**
+ * Resolve the field from a decoded envelope. ABSENT and UNRECOGNISED both
+ * resolve to `unknown`.
+ *
+ * An unrecognised value resolving to `unknown` rather than throwing is
+ * deliberate: this is a metric, and a producer that emits `from_spec` with an
+ * underscore should show up in the distribution as unrecorded, not stop a
+ * dispatch. The report is what surfaces it — a spike of `unknown` IS the
+ * finding that the field is not reaching its producers.
+ */
+export function resolveTestAuthorship(input: unknown): TestAuthorship {
+    if (input === null || typeof input !== 'object') return 'unknown';
+    const v = (input as Record<string, unknown>)['test_authorship'];
+    return typeof v === 'string' && TEST_AUTHORSHIP.has(v) ? (v as TestAuthorship) : 'unknown';
 }
 
 const CONFIDENCE: ReadonlySet<string> = new Set<Confidence>(['low', 'medium', 'high']);
 
+/**
+ * The five fields `validateResponse` REQUIRES. Exported so the ledger's
+ * classifier counts contract fields against the validator's own list rather
+ * than a second copy that can drift from it.
+ *
+ * The optional fields (`artifact_paths`, `assumptions`) are deliberately NOT
+ * here. The boundary this list defines is "did the author aim at the envelope
+ * at all", and it is calibrated against a recorded measurement: every `fail`
+ * in the live ledger carries `error_count: 5`, which is exactly the count of
+ * required-field errors an object with none of them produces. Counting an
+ * optional field as a hit would break that equivalence, so an object carrying
+ * only `assumptions` reads as foreign — recorded here as a known edge, not as
+ * an oversight.
+ */
+export const RESPONSE_REQUIRED_FIELDS: readonly string[] = [
+    'summary',
+    'handoff',
+    'confidence',
+    'findings',
+    'risks',
+];
+
+/**
+ * How many required contract fields are PRESENT on a decoded object.
+ *
+ * Presence, never validity: a `summary: 123` is a contract attempt with a
+ * wrong type, which is a different defect from a fenced tool call that never
+ * aimed at the envelope. That distinction is the whole point of the count —
+ * `validateResponse` already reports the type errors.
+ */
+export function countContractFields(input: unknown): number {
+    if (input === null || typeof input !== 'object') return 0;
+    const r = input as Record<string, unknown>;
+    return RESPONSE_REQUIRED_FIELDS.filter((k) => Object.hasOwn(r, k)).length;
+}
+
 export interface ValidationResult {
     valid: boolean;
     errors: string[];

package/src/scripts/adr/regenerate_index.ts

@@ -16,7 +16,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { readAdrFrontmatterScalars } from '../_lib/adr_frontmatter.js';
+import { readAdrAxisCells, readAdrFrontmatterScalars } from '../_lib/adr_frontmatter.js';
 
 // ^ADR-(\d{3})-([a-z0-9-]+)\.md$
 const NAMED = /^ADR-(\d{3})-([a-z0-9-]+)\.md$/;
@@ -29,8 +29,8 @@ const NAMED = /^ADR-(\d{3})-([a-z0-9-]+)\.md$/;
  * amendments from one never touched.
  */
 const HEAD =
-    '| # | Title | Status | Date | Supersedes | Superseded by | Amended by |\n' +
-    '|---|---|---|---|---|---|---|';
+    '| # | Title | Status | Date | Provenance | Evidence | Supersedes | Superseded by | Amended by |\n' +
+    '|---|---|---|---|---|---|---|---|---|';
 
 type Meta = Record<string, string>;
 interface Row extends Meta {
@@ -130,10 +130,16 @@ export function scan(d: string): [Row[], Row[], string[]] {
         if (name === 'INDEX.md') {
             continue;
         }
-        const meta = fm(fs.readFileSync(p, 'utf-8'));
+        const text = fs.readFileSync(p, 'utf-8');
+        const meta = fm(text);
+        // Read apart from `meta` on purpose. `provenance` and `evidence` are
+        // nested, so the scalar reader keeps them out of its map entirely —
+        // spreading `meta` could never produce these two cells, and the axis
+        // reader is where the `discovery`-rides-in-the-grade rule lives.
+        const axes = readAdrAxisCells(text);
         const m = NAMED.exec(name);
         if (!m) {
-            leg.push({ path: name, ...meta });
+            leg.push({ path: name, ...meta, ...axes });
             continue;
         }
         const n = m[1] as string;
@@ -144,7 +150,7 @@ export function scan(d: string): [Row[], Row[], string[]] {
             errs.push(`ADR-${n} duplicate: ${name} and ${seen[n]}`);
         }
         seen[n] = name;
-        num.push({ num: n, slug: m[2] as string, path: name, ...meta });
+        num.push({ num: n, slug: m[2] as string, path: name, ...meta, ...axes });
     }
     const nums = new Set(num.map((r) => r.num as string));
     for (const r of num) {
@@ -172,7 +178,8 @@ export function row(r: Row): string {
     const label = 'num' in r ? `ADR-${r.num}` : (r.path as string).slice(0, -3);
     return (
         `| [${label}](${r.path}) | ${title} | ${r.status ?? '—'} ` +
-        `| ${r.date ?? '—'} | ${r.supersedes ?? '—'} | ${r.superseded_by ?? '—'} ` +
+        `| ${r.date ?? '—'} | ${r.provenance_kind ?? '—'} | ${r.evidence_grade ?? '—'} ` +
+        `| ${r.supersedes ?? '—'} | ${r.superseded_by ?? '—'} ` +
         `| ${r.amended_by ?? '—'} |`
     );
 }

package/src/scripts/ai_council/clients.ts

@@ -148,7 +148,18 @@ export const CODEX_MEASURED_UNSERVABLE: ReadonlyMap<string, string> = new Map([
 ]);
 
 export const DEFAULT_OPENAI_CLI_MODEL = OPENAI_CLI_VENDOR_DEFAULT;
-export const DEFAULT_ANTHROPIC_CLI_MODEL = 'claude-sonnet-4-5';
+// A vendor ALIAS, not a version. `claude --help` documents 'fable', 'opus' and
+// 'sonnet' as "an alias for the latest model" in their band, so an alias cannot
+// go stale the way a dated id can — which is the whole point of the change that
+// put it here.
+//
+// It was `'claude-sonnet-4-5'`, and this line is the half the roadmap that
+// found the defect did not know about: refreshing only the template's pin would
+// have left every member that omits `model:` falling back to the SAME stale id
+// from code. Read from the provider's own CLI surface on 2026-08-22, never from
+// the agent's recall — the source that road-to-council-seat-selection's own
+// Risk 1 declares inadmissible.
+export const DEFAULT_ANTHROPIC_CLI_MODEL = 'sonnet';
 export const DEFAULT_GEMINI_CLI_MODEL = 'gemini-2.5-pro';
 
 // OpenAI-API-compatible endpoints. xAI and Perplexity both expose the

package/src/scripts/ai_council/config.ts

@@ -144,121 +144,6 @@ export class CouncilConfigError extends Error {
     }
 }
 
-// ── Python-format helpers (byte-faithful error messages) ───────────
-
-/** Python `repr()` for a string scalar (single-quoted, escaped). */
-function _pyReprStr(s: string): string {
-    const hasSingle = s.includes("'");
-    const hasDouble = s.includes('"');
-    const quote = hasSingle && !hasDouble ? '"' : "'";
-    let body = s
-        .replace(/\\/g, '\\\\')
-        .replace(/\n/g, '\\n')
-        .replace(/\r/g, '\\r')
-        .replace(/\t/g, '\\t');
-    if (quote === "'") {
-        body = body.replace(/'/g, "\\'");
-    } else {
-        body = body.replace(/"/g, '\\"');
-    }
-    return `${quote}${body}${quote}`;
-}
-
-/** Python `repr()` for a float value (shortest round-trip, `N.0` for ints). */
-function _pyReprFloat(value: number): string {
-    if (Number.isInteger(value) && Number.isFinite(value)) {
-        return `${value}.0`;
-    }
-    if (value === Infinity) {
-        return 'inf';
-    }
-    if (value === -Infinity) {
-        return '-inf';
-    }
-    if (Number.isNaN(value)) {
-        return 'nan';
-    }
-    return String(value);
-}
-
-/**
- * Python `repr()` for an arbitrary parsed value. Floats are tracked via
- * `_FLOAT` so int-valued floats render `N.0`; bare numbers render as
- * Python ints (no decimal). Mirrors `{value!r}` formatting.
- */
-function _pyRepr(value: unknown): string {
-    if (value instanceof _Float) {
-        return _pyReprFloat(value.value);
-    }
-    if (value === null || value === undefined) {
-        return 'None';
-    }
-    if (typeof value === 'boolean') {
-        return value ? 'True' : 'False';
-    }
-    if (typeof value === 'string') {
-        return _pyReprStr(value);
-    }
-    if (typeof value === 'number') {
-        return String(value);
-    }
-    if (Array.isArray(value)) {
-        return `[${value.map((v) => _pyRepr(v)).join(', ')}]`;
-    }
-    if (typeof value === 'object') {
-        const parts: string[] = [];
-        for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-            parts.push(`${_pyReprStr(k)}: ${_pyRepr(v)}`);
-        }
-        return `{${parts.join(', ')}}`;
-    }
-    return String(value);
-}
-
-/** Wrapper marking a number that should `repr()` as a Python float. */
-class _Float {
-    constructor(readonly value: number) {}
-}
-
-/** Mark `n` so `_pyRepr` renders it with a Python float repr (`N.0`). */
-function _f(n: number): _Float {
-    return new _Float(n);
-}
-
-/** Python `type(value).__name__`. */
-function _pyTypeName(value: unknown): string {
-    if (value === null || value === undefined) {
-        return 'NoneType';
-    }
-    if (typeof value === 'boolean') {
-        return 'bool';
-    }
-    if (typeof value === 'number') {
-        return Number.isInteger(value) ? 'int' : 'float';
-    }
-    if (typeof value === 'string') {
-        return 'str';
-    }
-    if (Array.isArray(value)) {
-        return 'list';
-    }
-    if (typeof value === 'object') {
-        return 'dict';
-    }
-    return typeof value;
-}
-
-/** Python `sorted(set_of_strings)` rendered as a list repr `['a', 'b']`. */
-function _sortedListRepr(items: Iterable<string>): string {
-    const sorted = [...items].sort();
-    return `[${sorted.map((s) => _pyReprStr(s)).join(', ')}]`;
-}
-
-/** Python `oct(mode)` → `0o600`-shaped string. */
-function _pyOct(mode: number): string {
-    return `0o${mode.toString(8)}`;
-}
-
 // ── Python int()/float() coercion + isinstance helpers ─────────────
 
 /**
@@ -432,6 +317,19 @@ export interface MemberConfig {
      * the falsification condition that gates ever enabling `'1h'`.
      */
     readonly prompt_cache_ttl: '5m' | '1h';
+    /**
+     * Optional `YYYY-MM-DD` stamp: the date this member's `model:` pin was last
+     * checked against the provider's own surface. `null` when unset.
+     *
+     * Exists because a hard pin cannot notice its own age. The starter template
+     * shipped `claude-sonnet-4-5` on an enabled member with nothing in the file
+     * able to flag it — and `check_council_pin_staleness` reads exactly this
+     * field. A member on a vendor sentinel (`codex-default`, or an alias like
+     * `sonnet` that the provider documents as "the latest model") needs no
+     * stamp: it cannot go stale, which is why the gate exempts it rather than
+     * demanding a date nobody would refresh.
+     */
+    readonly verified_at: string | null;
 }
 
 /**
@@ -635,6 +533,15 @@ export type QuorumMinPresent = number;
 
 export type { FallbackConfig } from './fallback_config.js';
 import { buildFallback, buildSecondModel, type FallbackConfig as _FallbackConfig } from './fallback_config.js';
+import {
+    _f,
+    _pyOct,
+    _pyRepr,
+    _pyReprFloat,
+    _pyReprStr,
+    _pyTypeName,
+    _sortedListRepr,
+} from './py_format.js';
 
 export interface CouncilConfig {
     readonly enabled: boolean;
@@ -1916,6 +1823,55 @@ function _build_member(
     // untouched here) OR as a mapping carrying `ttl`. '5m' is the
     // permanent default; see docs/contracts/ai-council-config.md
     // § Prompt cache TTL for the falsification condition on '1h'.
+    // A malformed date fails CLOSED. A stamp is a claim about when a human
+    // last looked; accepting `2026-13-45` or `soon` would make the staleness
+    // gate report on a string it cannot compare, which is worse than no stamp.
+    const verified_at_raw = _get(cfg, 'verified_at', null);
+    let verified_at: string | null = null;
+    if (verified_at_raw !== null && verified_at_raw !== undefined) {
+        // The stamp must be a QUOTED string, and the reason is a measured
+        // fail-open rather than a style preference.
+        //
+        // YAML 1.1 resolves an unquoted `2026-08-22` to a Date. Accepting that
+        // and normalising it back with `toISOString()` was the first
+        // implementation, and it LAUNDERED impossible dates: the loader silently
+        // rolls `2026-13-45` over to 2027-02-14, so the calendar check below saw
+        // a valid date and the malformed input passed. Verified against a real
+        // config, not reasoned about.
+        //
+        // A Date is therefore rejected with the fix in the message. That keeps
+        // the impossible-date case failing CLOSED, which is the only direction
+        // worth defending here: a stamp is a claim about attention, and a
+        // silently corrected claim is worse than a rejected one.
+        if (verified_at_raw instanceof Date) {
+            throw new CouncilConfigError(
+                `members.${name}.verified_at must be QUOTED — write ` +
+                    `verified_at: "YYYY-MM-DD". Unquoted, YAML parses it as a date and ` +
+                    `silently rolls impossible values over (2026-13-45 becomes 2027-02-14), ` +
+                    `which would let a malformed stamp through.`,
+            );
+        }
+        const coerced = verified_at_raw;
+        if (typeof coerced !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(coerced)) {
+            throw new CouncilConfigError(
+                `members.${name}.verified_at must be a 'YYYY-MM-DD' string when set ` +
+                    `(got ${_pyRepr(verified_at_raw)}).`,
+            );
+        }
+        const [y, m, d] = coerced.split('-').map((x) => Number(x));
+        const probe = new Date(Date.UTC(y as number, (m as number) - 1, d as number));
+        if (
+            probe.getUTCFullYear() !== y ||
+            probe.getUTCMonth() + 1 !== m ||
+            probe.getUTCDate() !== d
+        ) {
+            throw new CouncilConfigError(
+                `members.${name}.verified_at is not a real calendar date ` +
+                    `(got ${_pyRepr(verified_at_raw)}).`,
+            );
+        }
+        verified_at = coerced;
+    }
     const prompt_cache_raw = _get(cfg, 'prompt_cache', null);
     let prompt_cache_ttl: '5m' | '1h' = '5m';
     if (prompt_cache_raw !== null && prompt_cache_raw !== undefined && !_isBool(prompt_cache_raw)) {
@@ -1947,6 +1903,7 @@ function _build_member(
         participate_low_impact: participate_raw,
         tier,
         prompt_cache_ttl,
+        verified_at,
     };
 }