@event4u/agent-config 9.1.0 → 9.3.0

package/dist/agent-src/skills/subagent-orchestration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: subagent-orchestration
-description: "Use when orchestrating implementer/judge subagents — form gate + eight modes (do-and-judge ±two-stage, steps/parallel/worktrees, competitively, debate, live-app-judge)."
+description: "Use when orchestrating implementer/judge subagents — form gate + nine modes (do-and-judge ±two-stage, steps/parallel/worktrees, competitively, debate, live-app-judge, adversarial-council)."
 domain: process
 workspaces:
   - agent-config-maintainer
@@ -68,33 +68,22 @@ line; any gate failing → in-session no-op. Never lifts a safety floor.
 
 ## Worker-prompt contract
 
-Every dispatched worker prompt obeys four rules — they prevent the two classic
-handoff failures: lossy re-summarization dropping the user's requirements, and
-over-scripted prompts that break on first contingency.
-
-- **(a) User constraints verbatim.** Pass the user's
-  constraints/exclusions/preferences into the worker prompt **verbatim** — never
-  a paraphrase (a paraphrase silently drops requirements).
-- **(b) Describe the goal, don't script the approach.** State the outcome and
-  let the worker choose the path; over-scripting breaks on contingencies.
-- **(c) Translate environment paths.** Orchestrator-local paths do not exist in
-  the worker's sandbox — resolve/translate them at spawn.
-- **(d) Pre-declared check-in conditions.** The worker names, at spawn time, the
-  conditions under which it will halt and ask ("if login required", "if
-  multiple candidates found") — so interrupts are predictable, not surprises.
-- **(e) Attach relevant knowledge — read-only (road-to-opt-subagent-harvest
-  P3).** Before dispatch, look up the slice's key identifiers via
-  `memory_lookup` / the knowledge cards and attach the top hits to the
-  worker prompt AS LEADS — labelled per the source-discovery discipline
-  (negative facts + pointers durable; positive structure = hypothesis to
-  re-confirm, never a build input). The WRITE half stays forbidden: a
-  subagent's output is never auto-persisted into memory — promotion is
-  always the human-gated flow (ADR-098 floor). Auto-surface, never
-  auto-write.
+Every dispatched worker prompt obeys five rules that prevent the two classic
+handoff failures (lossy re-summarization dropping the user's requirements;
+over-scripted prompts that break on first contingency): (a) user
+constraints **verbatim**, (b) describe the goal — don't script the approach,
+(c) translate environment paths into the worker's sandbox, (d) pre-declare
+check-in conditions, (e) attach relevant knowledge read-only (auto-surface,
+never auto-write — ADR-098 floor). The five rules verbatim:
+[`subagent-spawn-contract` § Worker-prompt rules](../../contexts/execution/subagent-spawn-contract.md).
 
 When to delegate at all is [`delegation-policy`](../../rules/delegation-policy.md);
 the spawn boundary is the [`subagent-spawn-contract`](../../contexts/execution/subagent-spawn-contract.md).
 
+## Hand-off worked examples
+
+Ordered / fan-out hand-offs embed each step's return **verbatim** in the next prompt and state what to do with it (never "continue from before" — the lossy re-summarization failure). Two worked shapes: [`subagent-spawn-contract` § Hand-off worked examples](../../contexts/execution/subagent-spawn-contract.md).
+
 ## Form gate — deterministic, BEFORE mode selection
 
 With auto-dispatch on by default (ADR-117), mode selection happens without
@@ -108,6 +97,7 @@ no learned routing, no self-modifying selector (rejected, stays rejected).
 | Multi-step cross-wing chain needing filesystem isolation | worktrees | `do-in-worktrees` |
 | Ordered steps with declared dependencies | steps | `do-in-steps` |
 | Single change with non-trivial risk / contested spec / decision | judge | `do-and-judge`, `do-and-judge-two-stage`, `judge-with-debate`, `do-with-live-app-judge` |
+| High-risk change needing defect-FINDING coverage (opt-in, advisory) | verify-council | `adversarial-verification-council` (default-off; `subagents.adversarial_council`) |
 | Single slice below the delegability floor, unstructured, or frontier-priced | none | no dispatch — run in-session |
 
 Rules:
@@ -121,7 +111,7 @@ Rules:
   or `none`) so the gate's value is measurable inside the ADR-117
   prove-or-drop window.
 
-## The eight modes
+## The nine modes
 
 Each mode has a decision row: when to use, when not, and the expected
 model pairing. Defaults come from
@@ -211,6 +201,9 @@ migration, public API) where a single judge is too easy to fool.
 |---|---|---|
 | Security, data integrity, public API change | Routine internal refactor | judges = same tier (2x); meta-judge = one tier up |
 
+Mode 6 = **go/no-go** (strict-er verdict wins); for defect-FINDING coverage (the
+*union* of what diverse models catch) use Mode 9.
+
 ### 7. do-in-worktrees
 
 Cross-wing or cross-skill chain executed across isolated git worktrees —
@@ -231,6 +224,22 @@ Experimental until `verdict_changed_outcome` telemetry proves it. Rubric,
 adoption gate, and the async-verifier future candidate →
 [`subagent-modes-detail`](../../agent-src/contexts/execution/subagent-modes-detail.md) § Mode 8.
 
+### 9. adversarial-verification-council (gated — opt-in, advisory)
+
+A panel of N (default 2) **distinct-model** skeptics red-teams a real,
+already-verified change through the `judge-*` lenses — each prompted to *break*
+it. Returns reconcile deterministically
+([`_lib/adversarial_reconcile.ts`](../../scripts/_lib/adversarial_reconcile.ts))
+into one findings-by-severity envelope with provenance + cross-model confidence
+([`schemas/adversarial-findings.json`](schemas/adversarial-findings.json)). Unlike
+Mode 6 it emits a **findings-union**, not a go/no-go verdict. **Advisory only —
+never auto-gates (Hard Floor).** Default-off (`subagents.adversarial_council`);
+opt-in high-risk changes only; registered claim + high-risk tier need
+cross-*vendor* skeptics. Invariants, skeptic prompt, reconciliation, prove-or-drop
+gate → [`subagent-modes-detail`](../../agent-src/contexts/execution/subagent-modes-detail.md) § Mode 9
++ [`prompts/adversarial-verification-council.md`](prompts/adversarial-verification-council.md)
+(ADR-122).
+
 ## Status taxonomy — every subagent return uses one envelope
 
 Every implementer or judge return must conform to
@@ -265,7 +274,7 @@ Each mode's literal dispatch template lives under
 matching prompt at dispatch time and substitutes `{{placeholders}}`.
 Edits to a prompt do not bloat this skill against the 400-line sunset
 trigger; `tests/test_subagent_prompt_loading.py` confirms each of the
-eight modes resolves to a loadable prompt that cites all four taxonomy
+nine modes resolves to a loadable prompt that cites all four taxonomy
 statuses.
 
 ## Procedure
@@ -294,7 +303,7 @@ same context, **stop** and report. Do not improvise.
 
 ### 3. Pick the mode
 
-Run the form gate first, then match task shape to one of the eight modes. When two modes could fit,
+Run the form gate first, then match task shape to one of the nine modes. When two modes could fit,
 prefer the cheaper one (`do-and-judge` < `do-and-judge-two-stage` <
 `do-in-steps` < `do-in-parallel` < `do-competitively` <
 `judge-with-debate` < `do-in-worktrees`).
@@ -320,6 +329,7 @@ Describe each dispatch step explicitly in chat so the user can follow it.
 * `do-competitively` → [`prompts/do-competitively.md`](prompts/do-competitively.md)
 * `judge-with-debate` → [`prompts/judge-with-debate.md`](prompts/judge-with-debate.md)
 * `do-in-worktrees` → [`prompts/do-in-worktrees.md`](prompts/do-in-worktrees.md)
+* `adversarial-verification-council` → [`prompts/adversarial-verification-council.md`](prompts/adversarial-verification-council.md)
 * Standalone judge → judge prompt in [`prompts/do-and-judge.md`](prompts/do-and-judge.md)
 
 ### 5. Report
@@ -360,7 +370,7 @@ Skip emit when `subagents.enabled: false` or `spawn_count == 0` (in-session run)
 
 ## Output format
 
-1. **Mode chosen** — one of the seven, with the one-line reason
+1. **Mode chosen** — one of the nine, with the one-line reason
 2. **Model pairing** — implementer model / judge model (resolved)
 3. **Verdict** — applied / revised / handed back
 4. **Evidence** — diff summary, test output, or judge transcript

package/dist/agent-src/skills/subagent-orchestration/evals/evals.json

@@ -37,6 +37,24 @@
                     "criterion": "Negative control: the clean return is verified and adopted WITHOUT rework or escalation — telemetry records first_pass_success=true and escalated=false. No spurious findings are invented to justify a re-dispatch."
                 }
             ]
+        },
+        {
+            "id": "sao-adversarial-council-advisory-no-gate",
+            "prompt": "`subagents.adversarial_council: on`. You are orchestrating an adversarial-verification-council (Mode 9) over a high-risk, already-verified change to an auth endpoint. Two distinct-model skeptics return findings: skeptic A raises a critical missing tenant-scope check at `src/http/orders.ts:42` (category security) and a low naming nit; skeptic B independently raises the same tenant-scope issue and refutes the naming nit. Reconcile and report the council result.",
+            "assertions": [
+                {
+                    "kind": "contains",
+                    "value": "advisory"
+                },
+                {
+                    "kind": "rubric",
+                    "criterion": "The reconciled output is a findings-by-severity envelope (findings-union), NOT a single go/no-go verdict: the tenant-scope finding is corroborated (raised_by both skeptics → high confidence), and the naming nit raised by only A and refuted by B is demoted to false_positives_suppressed (not silently dropped)."
+                },
+                {
+                    "kind": "rubric",
+                    "criterion": "The council is treated as ADVISORY and NEVER auto-gates the change (Hard Floor): the orchestrator surfaces the findings for a human decision and does not itself accept/reject/merge or block the change based on the panel verdict."
+                }
+            ]
         }
     ]
 }

package/dist/agent-src/skills/subagent-orchestration/prompts/README.md

@@ -1,6 +1,6 @@
 # Subagent dispatch prompts
 
-One file per mode in [`SKILL.md`](../SKILL.md) § *The seven modes*. Each
+One file per mode in [`SKILL.md`](../SKILL.md) § *The nine modes*. Each
 prompt is the **literal template** the orchestrator hands to the
 subagent on dispatch — externalized so prompt edits do not bloat the
 skill above the 400-line sunset trigger.
@@ -14,6 +14,7 @@ skill above the 400-line sunset trigger.
 | do-competitively | [`do-competitively.md`](do-competitively.md) |
 | judge-with-debate | [`judge-with-debate.md`](judge-with-debate.md) |
 | do-in-worktrees | [`do-in-worktrees.md`](do-in-worktrees.md) |
+| adversarial-verification-council | [`adversarial-verification-council.md`](adversarial-verification-council.md) |
 
 ## Contract
 
@@ -47,5 +48,5 @@ dispatch. Verify a cohort is actually reading, not re-writing, by checking
 ## Loading
 
 `tests/test_subagent_prompt_loading.py` asserts that every mode named
-in `SKILL.md` § *The seven modes* has a loadable prompt file under this
+in `SKILL.md` § *The nine modes* has a loadable prompt file under this
 directory and that each prompt mentions all four status enum values.

package/dist/agent-src/skills/subagent-orchestration/prompts/adversarial-verification-council.md

@@ -0,0 +1,79 @@
+# Prompt — adversarial-verification-council
+
+Mode reference: [`../SKILL.md`](../SKILL.md) § *9. adversarial-verification-council*.
+Contract: ADR-122. Advisory only — the panel finds defects, it never gates the
+change.
+
+## Skeptic prompt (run N times in parallel, one per DISTINCT model)
+
+Each skeptic runs on a different model (cross-model Iron Law; cross-*vendor* for
+the high-risk tier). Assign each skeptic one or more `judge-*` lenses as its
+*checklist* — the lens says WHAT to examine; this prompt sets the adversarial
+HOW (find breakage, not confirm correctness).
+
+```
+You are SKEPTIC {{skeptic_id}} red-teaming a real, already-verified change.
+Other skeptics on different models review the same change independently. Your
+job is to BREAK it — find defects a first-pass review would miss.
+
+POSTURE: adversarial. Assume the change is subtly wrong until you have looked.
+Do NOT reach for "looks fine". Disagreement across skeptics IS the value.
+If a judge lens you apply has a self-refutation/severity-calibration step, use
+it ONLY to calibrate your OWN findings' severity — it never suppresses a defect
+another skeptic might catch (cross-model quorum, not self-censorship).
+
+LENS(ES): {{judge_lenses}}          # e.g. judge-bug-hunter, judge-security-auditor
+TASK: {{task_description}}
+DIFF: {{diff}}
+TEST OUTPUT: {{test_output}}
+VERIFY CONTEXT: {{prior_verification}}   # what the first-pass judge already passed
+
+Look hardest at what survives a competent first pass: cross-file interaction
+effects, subtle logic inversions that read as plausible, security masked by
+correct-looking patterns, edge cases in complex state, missing invisible
+controls (authz/tenant/validation), hollow or stubbed implementations.
+
+RETURN — two blocks:
+
+1) A status envelope (schemas/subagent-status.json): status=DONE with
+   evidence[] summarizing what you examined; DONE_WITH_CONCERNS / BLOCKED /
+   NEEDS_CONTEXT per the taxonomy.
+
+2) A fenced ```json block: an array of findings, each:
+     {"severity":"critical|high|medium|low",
+      "category":"correctness|security|test-coverage|quality|injection|completeness|...",
+      "location":"file:line",
+      "description":"what breaks and why"}
+   Empty array [] if you genuinely found nothing — do NOT invent findings to
+   look busy (false positives are measured against you).
+
+   OPTIONAL "refutes": if you examined a specific location+category and are
+   confident it is NOT a defect, add:
+     {"refutes":["<file:line>::<category-lowercased>", ...]}
+   Only refute what you actually examined.
+
+NAME ONE FAILURE MODE you actively looked for, even if you did not find it.
+```
+
+## Reconciliation (deterministic — NOT an LLM step)
+
+The orchestrator feeds every skeptic's findings array (+ any `refutes`) to
+[`_lib/adversarial_reconcile.ts`](../../scripts/_lib/adversarial_reconcile.ts)
+`reconcileFindings([...])`. That pure function:
+
+- dedups by `location::category`, strict-er severity wins;
+- records `raised_by[]` (provenance) and `refuted_by[]`;
+- sets `confidence` (high = corroborated by a panel quorum);
+- demotes a lone finding refuted by a strict majority of the rest into
+  `false_positives_suppressed[]` (never dropped).
+
+Output is one `adversarial-findings.json` envelope, findings-by-severity. It is
+**presented to the human as advisory** — the mode never accepts/rejects or gates
+the change.
+
+## Gated-only rule
+
+`adversarial-verification-council` is N-skeptics = N+ subagent calls (cross-vendor
+adds external spend). Runs only when `subagents.adversarial_council != off` AND
+the change is explicitly high-risk (security, tenant, migration, public API).
+Routine changes use `do-and-judge`; go/no-go decisions use `judge-with-debate`.

package/dist/agent-src/skills/subagent-orchestration/schemas/adversarial-findings.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "$id": "https://event4u.dev/agent-config/schemas/adversarial-findings.json",
+  "title": "Adversarial Findings Envelope",
+  "description": "Reconciled output of the adversarial-verification-council mode (subagent-orchestration Mode 9). A model-diverse skeptic panel red-teams a real, already-verified change; each skeptic returns findings; reconciliation (src/scripts/_lib/adversarial_reconcile.ts) dedups them into this envelope with per-finding provenance and a cross-model confidence signal. ADVISORY ONLY — never gates a change (Hard Floor). Hand-validated by adversarial_reconcile.test.ts (no jsonschema runtime dep).",
+  "type": "object",
+  "required": ["panel", "findings", "false_positives_suppressed"],
+  "additionalProperties": false,
+  "properties": {
+    "panel": {
+      "type": "object",
+      "required": ["models", "skeptic_count"],
+      "additionalProperties": false,
+      "properties": {
+        "models": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"type": "string", "minLength": 1},
+          "description": "Distinct model ids of the skeptics. For the registered claim + high-risk tier these are cross-vendor (provider-level diversity)."
+        },
+        "skeptic_count": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Number of skeptics on the panel (== models.length)."
+        }
+      }
+    },
+    "findings": {
+      "type": "array",
+      "description": "Surviving findings, most-severe first. Advisory — a human decides what is actionable.",
+      "items": {"$ref": "#/definitions/finding"}
+    },
+    "false_positives_suppressed": {
+      "type": "array",
+      "description": "Findings raised by one skeptic and refuted by a majority of the rest. Demoted here (not dropped) for auditability.",
+      "items": {"$ref": "#/definitions/finding"}
+    }
+  },
+  "definitions": {
+    "finding": {
+      "type": "object",
+      "required": ["id", "severity", "category", "location", "description", "raised_by", "refuted_by", "confidence"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {"type": "string", "minLength": 1, "description": "Stable id, deterministic from the reconciled key order (avc-NNN)."},
+        "severity": {"type": "string", "enum": ["critical", "high", "medium", "low"], "description": "Most-severe severity among the skeptics that raised it (strict-er wins)."},
+        "category": {"type": "string", "minLength": 1, "description": "Defect class: correctness | security | test-coverage | quality | injection | completeness | ..."},
+        "location": {"type": "string", "minLength": 1, "description": "file:line (or the closest anchor the skeptic could give)."},
+        "description": {"type": "string", "minLength": 1, "description": "What the defect is and why it breaks."},
+        "raised_by": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}, "description": "Model ids that independently raised this finding — the provenance + corroboration signal."},
+        "refuted_by": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Model ids that examined this finding and judged it NOT a defect."},
+        "confidence": {"type": "string", "enum": ["high", "medium", "low"], "description": "high = corroborated by a panel quorum; medium = corroborated below quorum (or lone raiser on a solo panel); low = single raiser on a multi-skeptic panel."}
+      }
+    }
+  }
+}

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.1.0"
+agent_config_version: "9.3.0"
 
 # --- Project identity ---
 project:

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-07-14T09:00:03Z`
+- Generated: `2026-07-16T03:13:57Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._