@event4u/agent-config 9.28.0 → 9.29.0

package/src/scripts/ai_team/config.ts

@@ -4,23 +4,36 @@
  *
  * Mirrors the fail-closed validation posture of the council loader
  * (`src/scripts/ai_council/config.ts`) at a fraction of its surface: the
- * `ai_team` block has five flat keys and no nested sub-schemas, so this
- * loader is deliberately lean — defaults, per-key type checks, and hard
- * unknown-key rejection. Contract: `docs/contracts/ai-team-config.md`.
+ * `ai_team` block has a handful of flat keys and no nested sub-schemas
+ * beyond `review_gate`, so this loader is deliberately lean — defaults,
+ * per-key type checks, and hard unknown-key rejection. Contract:
+ * `docs/contracts/ai-team-config.md`.
  *
  * Unlike the council (ALWAYS user-global `.ai-council.yml`, ADR-104),
  * `ai_team` lives in the PROJECT settings cascade (`.agent-settings.yml`
- * via `load_agent_settings`) — team mode is a per-project posture
- * (default-off), not a per-developer credential store; the codex CLI
- * carries the subscription auth itself.
+ * via `load_agent_settings`) — team mode is a per-project posture, not a
+ * per-developer credential store; the codex CLI carries the subscription
+ * auth itself.
+ *
+ * `enabled` — the former master on/off switch — was DELETED
+ * (road-to-always-on-orchestration Phase 1, Step 1.3): `/team`'s
+ * availability is now a FACT resolved from the machine (codex CLI on
+ * `$PATH` + detectable auth — `src/scripts/ai_team/availability.ts`), not
+ * a settings flag, matching the doctrine already applied to the
+ * subagent/council layers. A leftover `enabled` key from an older install
+ * is accepted-and-ignored here (never rejected as unknown, never applied
+ * by any reader) so an existing project's `.agent-settings.yml` does not
+ * start failing `/team` outright; `load_agent_settings` still surfaces the
+ * one-line deprecation warning for it (`_lib/agent_settings.ts`).
  *
  * Validation contract (all enforced at load time, fail-closed):
  *
- * 1. `ai_team` absent → defaults (feature off). Non-mapping → error.
+ * 1. `ai_team` absent → defaults. Non-mapping → error.
  * 2. Unknown keys under `ai_team` are rejected — a typo must never
  *    silently disable a gate (`allow_delegate` misspelled = delegation
- *    stays off AND the load fails loudly).
- * 3. `enabled`, `allow_delegate`, `suppress_setup_hint` are booleans.
+ *    stays off AND the load fails loudly). `enabled` is the one
+ *    deliberate exception: accepted, untyped, ignored (see above).
+ * 3. `allow_delegate`, `suppress_setup_hint` are booleans.
  * 4. `model` is a non-empty string. `'auto'` = pass no `--model` flag
  *    (the codex CLI default applies); any other value passes through
  *    verbatim.
@@ -47,7 +60,6 @@ export interface AiTeamReviewGateConfig {
 }
 
 export interface AiTeamConfig {
-    readonly enabled: boolean;
     readonly model: string;
     readonly allow_delegate: boolean;
     readonly max_calls_per_day: number;
@@ -63,7 +75,6 @@ export const AI_TEAM_REVIEW_GATE_DEFAULTS: AiTeamReviewGateConfig = Object.freez
 
 /** Shipped defaults — byte-parity with `src/config/agent-settings.template.yml`. */
 export const AI_TEAM_DEFAULTS: AiTeamConfig = Object.freeze({
-    enabled: false,
     model: 'auto',
     allow_delegate: false,
     max_calls_per_day: 50,
@@ -79,7 +90,6 @@ export const AI_TEAM_DEFAULTS: AiTeamConfig = Object.freeze({
 export const AI_TEAM_MODEL_AUTO = 'auto';
 
 const _KNOWN_KEYS: ReadonlySet<string> = new Set([
-    'enabled',
     'model',
     'allow_delegate',
     'max_calls_per_day',
@@ -87,6 +97,14 @@ const _KNOWN_KEYS: ReadonlySet<string> = new Set([
     'review_gate',
 ]);
 
+/**
+ * Deleted key accepted-and-ignored for migration grace (see module docstring).
+ * Never added to `_KNOWN_KEYS` — it carries no validated type and is never
+ * read into `AiTeamConfig`; it exists in this set only so the unknown-key
+ * loop below does not fail-closed an existing project's leftover value.
+ */
+const _DELETED_KEYS: ReadonlySet<string> = new Set(['enabled']);
+
 const _KNOWN_REVIEW_GATE_KEYS: ReadonlySet<string> = new Set([
     'managed',
     'max_consecutive_blocks',
@@ -175,6 +193,9 @@ export function build_ai_team_config(raw: unknown): AiTeamConfig {
     }
 
     for (const key of Object.keys(raw)) {
+        if (_DELETED_KEYS.has(key)) {
+            continue; // deleted, accepted-and-ignored — see module docstring.
+        }
         if (!_KNOWN_KEYS.has(key)) {
             throw new TeamConfigError(
                 `ai_team.${key}: unknown key; valid: ` +
@@ -183,7 +204,6 @@ export function build_ai_team_config(raw: unknown): AiTeamConfig {
         }
     }
 
-    const enabled = _requireBool(raw, 'enabled', AI_TEAM_DEFAULTS.enabled);
     const allow_delegate = _requireBool(raw, 'allow_delegate', AI_TEAM_DEFAULTS.allow_delegate);
     const suppress_setup_hint = _requireBool(
         raw,
@@ -216,7 +236,7 @@ export function build_ai_team_config(raw: unknown): AiTeamConfig {
 
     const review_gate = _build_review_gate('review_gate' in raw ? raw['review_gate'] : undefined);
 
-    return { enabled, model, allow_delegate, max_calls_per_day, suppress_setup_hint, review_gate };
+    return { model, allow_delegate, max_calls_per_day, suppress_setup_hint, review_gate };
 }
 
 /**

package/src/scripts/ai_team/team_dispatch.ts

@@ -18,11 +18,20 @@
  * instead of live repo access, no background jobs, explicitly worse than the
  * plugin — pointing Claude-Code users back to the Phase 2 plugin path.
  *
- * Governance reuse (Phase 3 Step 3): same `ai_team` config (fail-closed when
- * `enabled: false`), same `cli_call_budget` openai quota bucket (the gate and
- * the recording both live in `CliClient.ask` — no new counter), same
- * `_AUTH_FAILURE_PATTERNS` classification. `--manual` renders the bundle
- * between `═` rules for paste-into-web usage — no call, no quota.
+ * Governance reuse (Phase 3 Step 3): same `ai_team` config, same
+ * `cli_call_budget` openai quota bucket (the gate and the recording both
+ * live in `CliClient.ask` — no new counter), same `_AUTH_FAILURE_PATTERNS`
+ * classification. `--manual` renders the bundle between `═` rules for
+ * paste-into-web usage — no call, no quota.
+ *
+ * Availability (road-to-always-on-orchestration Phase 1, Step 1.3):
+ * `ai_team.enabled` was DELETED. Every dispatch entry point below is
+ * fail-closed on TWO facts instead — `emergency.orchestration_halt` (the
+ * one audited incident switch over the always-on stack) and
+ * `checkCodexAvailability()` (codex CLI + auth presence,
+ * `./availability.js`) — never a settings flag. `ai_team.allow_delegate`
+ * is unchanged: a second, write-access opt-in that stacks ON TOP of
+ * availability in `assert_delegate_allowed`.
  *
  * The review system prompt is derived from the adversarial-review findings
  * shape of an Apache-2.0 upstream — attribution in the repo-root NOTICE file.
@@ -38,6 +47,12 @@ import {
     load_cli_call_counts,
     OpenAICliClient,
 } from '../ai_council/clients.js';
+import {
+    checkCodexAvailability,
+    isOrchestrationHalted,
+    ORCHESTRATION_HALT_MESSAGE,
+    type TeamAvailability,
+} from './availability.js';
 import { AI_TEAM_MODEL_AUTO, type AiTeamConfig, load_ai_team_config } from './config.js';
 
 // ── errors ──────────────────────────────────────────────────────────────
@@ -51,50 +66,67 @@ export class TeamDispatchError extends Error {
 }
 
 /**
- * Raised when `ai_team.enabled` is false — the fail-closed gate.
- * The message carries the enable pointer; callers print it verbatim.
+ * Raised when `/team` is unavailable — either `emergency.orchestration_halt`
+ * is set, or the codex CLI / auth availability check
+ * (`checkCodexAvailability`) failed. `reason` is the one-line message the
+ * relevant check produced; callers print it verbatim. There is no more
+ * settings flag behind this — see the module docstring.
  */
 export class TeamDisabledError extends TeamDispatchError {
-    constructor() {
-        super(
-            'team mode is disabled (`ai_team.enabled: false`, the shipped default). ' +
-                'Set `ai_team.enabled: true` in `.agent-settings.yml` to opt in — ' +
-                'see docs/contracts/ai-team-config.md.',
-        );
+    constructor(reason: string) {
+        super(reason);
         this.name = 'TeamDisabledError';
     }
 }
 
 /**
- * Thrown by `assert_delegate_allowed` when `ai_team.enabled` is true but the
+ * Thrown by `assert_delegate_allowed` when `/team` is available but the
  * second opt-in (`ai_team.allow_delegate`) is not. `/team delegate` is the
  * only wrapper that hands WRITE access to the second model, so it is
- * double-gated; `enabled: true` alone is never delegate authorization.
+ * double-gated; availability alone is never delegate authorization.
  */
 export class TeamDelegateDisabledError extends TeamDispatchError {
     constructor() {
         super(
             '`/team delegate` is disabled (`ai_team.allow_delegate: false`, the shipped ' +
                 'default). It is the only team-mode wrapper that hands write access to ' +
-                'the second model, so it needs its own opt-in: set both ' +
-                '`ai_team.enabled: true` and `ai_team.allow_delegate: true` in ' +
-                '`.agent-settings.yml` — see docs/contracts/ai-team-config.md.',
+                'the second model, so it needs its own opt-in: set ' +
+                '`ai_team.allow_delegate: true` in `.agent-settings.yml` (once /team ' +
+                'itself is available — codex CLI installed and authenticated) — see ' +
+                'docs/contracts/ai-team-config.md.',
         );
         this.name = 'TeamDelegateDisabledError';
     }
 }
 
+/** Test seams for the two availability facts (`assert_delegate_allowed`, `run_team_review`). */
+export interface TeamAvailabilityOverrides {
+    /** Default: `checkCodexAvailability()` — the real, cached, zero-spend probe. */
+    availability?: TeamAvailability;
+    /** Default: `isOrchestrationHalted(undefined, cwd)` — reads the real settings cascade. */
+    halted?: boolean;
+}
+
 /**
  * Deterministic mirror of the `/team delegate` double gate: throws
- * `TeamDisabledError` unless `ai_team.enabled`, then
+ * `TeamDisabledError` when halted or `/team` is unavailable, then
  * `TeamDelegateDisabledError` unless `ai_team.allow_delegate`. The command
  * doc's prose gates instruct the agent; this guard is the machine-checkable
  * contract (`--delegate-gate` CLI mode) tests pin against.
  */
-export function assert_delegate_allowed(config?: AiTeamConfig, cwd?: string | null): void {
+export function assert_delegate_allowed(
+    config?: AiTeamConfig,
+    cwd?: string | null,
+    overrides: TeamAvailabilityOverrides = {},
+): void {
     const cfg = config ?? load_ai_team_config({ cwd: cwd ?? null });
-    if (!cfg.enabled) {
-        throw new TeamDisabledError();
+    const halted = overrides.halted ?? isOrchestrationHalted(undefined, cwd ?? null);
+    if (halted) {
+        throw new TeamDisabledError(ORCHESTRATION_HALT_MESSAGE);
+    }
+    const availability = overrides.availability ?? checkCodexAvailability(cwd ?? undefined);
+    if (!availability.available) {
+        throw new TeamDisabledError(availability.reason ?? 'codex CLI not available.');
     }
     if (!cfg.allow_delegate) {
         throw new TeamDelegateDisabledError();
@@ -511,6 +543,10 @@ export interface RunTeamReviewOptions {
     cli_calls_path?: string | null;
     /** Sink for user-facing output; default `process.stdout`. */
     out?: (line: string) => void;
+    /** Test seam: override the availability check (default: the real, cached probe). */
+    availability?: TeamAvailability;
+    /** Test seam: override the halted flag (default: read from the settings cascade). */
+    halted?: boolean;
 }
 
 function _quota_snapshot(config: AiTeamConfig, cli_calls_path: string | null): TeamReviewQuota {
@@ -564,16 +600,22 @@ function _envelope_from_response(
 /**
  * Run the multi-host team-review fallback.
  *
- * Order of operations is the contract: (1) fail-closed config gate,
- * (2) capability-delta header at the top, (3) read-only bundle,
- * (4) manual render OR one synchronous `codex exec` call through the shared
- * quota/auth machinery, (5) envelope emission. Throws `TeamDisabledError`
- * when `ai_team.enabled` is false — never a silent no-op.
+ * Order of operations is the contract: (1) fail-closed availability gate —
+ * halted, then codex CLI/auth — (2) capability-delta header at the top,
+ * (3) read-only bundle, (4) manual render OR one synchronous `codex exec`
+ * call through the shared quota/auth machinery, (5) envelope emission.
+ * Throws `TeamDisabledError` when halted or unavailable — never a silent
+ * no-op.
  */
 export function run_team_review(opts: RunTeamReviewOptions = {}): TeamReviewRunResult {
     const config = opts.config ?? load_ai_team_config({ cwd: opts.cwd ?? null });
-    if (!config.enabled) {
-        throw new TeamDisabledError();
+    const halted = opts.halted ?? isOrchestrationHalted(undefined, opts.cwd ?? null);
+    if (halted) {
+        throw new TeamDisabledError(ORCHESTRATION_HALT_MESSAGE);
+    }
+    const availability = opts.availability ?? checkCodexAvailability(opts.cwd ?? undefined);
+    if (!availability.available) {
+        throw new TeamDisabledError(availability.reason ?? 'codex CLI not available.');
     }
     const out = opts.out ?? ((line: string): void => void process.stdout.write(`${line}\n`));
 

package/src/scripts/bench_critic_protocol.ts

@@ -0,0 +1,396 @@
+/**
+ * Critic-protocol A/B runner (road-to-judgment-and-forensic-evidence Phase 2).
+ *
+ * Measures the `load_bearing` critic protocol against the shipped `legacy`
+ * adversarial-skeptic posture on the frozen corpus
+ * (internal/bench/adversarial-council/corpus.json) — the corpus on which the
+ * legacy posture scored a measured 100% false-positive rate on the 3
+ * controversial-but-correct clean controls (run 2026-07-21).
+ *
+ * Protocol (pre-registered in docs/CLAIMS.md `critic-protocol-load-bearing-ab`
+ * BEFORE any paid run; thresholds, prompts, and scorer semantics frozen there):
+ *
+ *   Both arms run as ONE independent single-shot review per vendor
+ *   (anthropic + openai, direct client calls — NEVER council_cli transport)
+ *   over all 15 corpus items (12 defect fixtures + 3 clean controls).
+ *
+ *   PER VENDOR, the load_bearing arm promotes iff BOTH:
+ *     (1) FP rate on the 3 clean controls < 50%, AND
+ *     (2) TP count on the 12 defect fixtures >= 80% of the legacy arm's
+ *         TP count in the same run.
+ *
+ *   Scoring is the existing deterministic scorer applied IDENTICALLY to both
+ *   arms on findings only (caughtDefect / isFalsePositive). The protocol's
+ *   `verdict` field is a secondary published signal; "flawed" with empty
+ *   findings counts as `incoherent` (2026-08-09 council design pass) — never
+ *   as a catch, never as an FP.
+ *
+ * `--mock` validates the pipeline in BOTH directions with zero spend (a
+ * passing arm must read PASS, a failing arm must read FAIL) — the roadmap's
+ * pre-spend tripwire. `--run` fires the paid cross-vendor calls
+ * (maintainer spend-gated). `--out <file>` writes the report JSON.
+ *
+ * The `legacy` default and the `critic_protocol` config key live in
+ * scripts/ai_council/config.ts; this runner takes the arms from the corpus
+ * loop directly (an A/B needs both regardless of the configured value).
+ */
+// ledger-exempt: bench runner, not a CI gate — spend-gated on-demand measurement
+// with a fixed 15-item corpus; the report itself carries the full denominator.
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import {
+    AnthropicClient,
+    OpenAIClient,
+    load_anthropic_key,
+    load_openai_key,
+    type ExternalAIClient,
+} from './ai_council/clients.js';
+import {
+    caughtDefect,
+    isFalsePositive,
+    categoryFamily,
+    type Finding,
+    type GroundTruth,
+} from './_lib/adversarial_bench_score.js';
+
+const REPO_ROOT = process.cwd();
+const CORPUS_PATH = path.join(REPO_ROOT, 'internal/bench/adversarial-council/corpus.json');
+
+/** Pre-registered thresholds — frozen with the CLAIMS entry, never adjusted. */
+const FP_CEILING = 0.5; // strict: FP rate must be < 0.5 on the 3 controls
+const TP_RETENTION_FLOOR = 0.8; // load_bearing TP >= 0.8 × legacy TP, per vendor
+
+interface CorpusItem {
+    id: string;
+    class: string;
+    defect_category: string;
+    is_clean: boolean;
+    files: { path: string; content: string }[];
+    ground_truth: { defect_files: string[]; defect_summary: string };
+}
+
+function loadCorpus(): CorpusItem[] {
+    return JSON.parse(fs.readFileSync(CORPUS_PATH, 'utf8')).items as CorpusItem[];
+}
+function groundTruth(item: CorpusItem): GroundTruth {
+    return {
+        id: item.id,
+        is_clean: item.is_clean,
+        defect_files: item.ground_truth.defect_files,
+        defect_category: item.is_clean ? 'none' : categoryFamily(item.defect_category),
+    };
+}
+function codeBlock(item: CorpusItem): string {
+    return item.files.map((f) => `FILE: ${f.path}\n\`\`\`ts\n${f.content}\`\`\``).join('\n\n');
+}
+
+const FINDINGS_SHAPE =
+    '{"findings":[{"file":"<file path>","category":"<defect category>","confidence":"high|medium|low","summary":"<one line>"}]}';
+
+/**
+ * LEGACY arm — byte-identical to the prompt that produced the measured 100%
+ * FP on the clean controls (bench_adversarial_council.ts skepticPrompt).
+ */
+function legacyPrompt(item: CorpusItem): string {
+    return [
+        'You are an adversarial security/correctness skeptic. Assume this code may hide a subtle, non-obvious defect that a normal review missed — a masked access-control/SSRF/traversal flaw, a boundary/logic inversion, a concurrency or resource-leak edge, a cross-file contract mismatch. Hunt for it. Report only defects you can concretely justify; if after hard scrutiny it is genuinely correct, report an empty array (do not fabricate).',
+        `Respond with STRICT JSON only, exactly: ${FINDINGS_SHAPE}`,
+        '',
+        codeBlock(item),
+    ].join('\n');
+}
+
+const PROTOCOL_SHAPE =
+    '{"invariant":"<one sentence>","load_bearing_assumption":"<one sentence, names file+function>","failure_scenario_if_broken":"<one sentence>","cost_of_avoidance":"<one sentence>","succeeded_would_do":"<one sentence or \'nothing\'>","verdict":"holds|flawed","findings":[{"file":"<file path>","category":"<defect category>","confidence":"high|medium|low","summary":"<one line>"}]}';
+
+/**
+ * LOAD_BEARING arm — the fixed protocol. Design integrated the 2026-08-09
+ * council convergence: the assumption must be tied to a named file+function
+ * (no platitudes), a concrete failure scenario forces the assumption to be
+ * load-bearing, and "holds" is an explicitly permitted, completed review.
+ */
+function loadBearingPrompt(item: CorpusItem): string {
+    return [
+        'You are a rigorous correctness critic running a fixed protocol. Do not free-associate defects. Work strictly in this order:',
+        '1. State the invariant this code must maintain to be correct, then name the SINGLE load-bearing assumption it rests on — the one whose failure would break that invariant. Tie it to a named file and function; a platitude ("inputs are valid") is not an assumption.',
+        '2. State the concrete failure scenario if that assumption broke: which input or state leads to which wrong behaviour. If you cannot state one, the assumption is not load-bearing — pick again.',
+        '3. State the cost of what this code is avoiding: what failure mode or complexity does its current shape avert?',
+        "4. State what someone who has already built a comparable thing successfully would do differently here, if anything ('nothing' is acceptable).",
+        '5. Now inspect the assumption against the code. If it survives inspection and the failure scenario is unreachable, your verdict is "holds" and findings is []. A defensible "holds" with the assumption and scenario stated is a completed review, not a refusal. If the assumption breaks, or the failure scenario is reachable, or you find another concrete defect you can justify against specific lines, your verdict is "flawed" and findings lists each one.',
+        `Respond with STRICT JSON only, exactly: ${PROTOCOL_SHAPE}`,
+        '',
+        codeBlock(item),
+    ].join('\n');
+}
+
+const SYSTEM_JSON =
+    'You are a code reviewer. Output ONLY one JSON object — no prose, no markdown, no code fences. ' +
+    'If the code is correct, the "findings" array is empty. Do not include any text before or after the JSON object.';
+
+interface ArmResponse {
+    findings: Finding[];
+    verdict: 'holds' | 'flawed' | null; // null for the legacy arm (no verdict field)
+}
+
+function extractJsonObject(text: string): Record<string, unknown> | null {
+    if (!text) return null;
+    const start = text.indexOf('{');
+    if (start < 0) return null;
+    let depth = 0;
+    let end = -1;
+    for (let i = start; i < text.length; i++) {
+        if (text[i] === '{') depth++;
+        else if (text[i] === '}' && --depth === 0) {
+            end = i;
+            break;
+        }
+    }
+    if (end < 0) return null;
+    try {
+        return JSON.parse(text.slice(start, end + 1)) as Record<string, unknown>;
+    } catch {
+        return null;
+    }
+}
+
+function parseArmResponse(text: string): ArmResponse {
+    const obj = extractJsonObject(text);
+    if (!obj) return { findings: [], verdict: null };
+    const arr = Array.isArray(obj.findings) ? obj.findings : [];
+    const findings = arr
+        .filter((f): f is Record<string, unknown> => typeof f === 'object' && f !== null)
+        .map((f) => ({
+            file: String(f.file ?? ''),
+            category: String(f.category ?? ''),
+            confidence: (['high', 'medium', 'low'].includes(String(f.confidence))
+                ? String(f.confidence)
+                : 'high') as 'high' | 'medium' | 'low',
+        }))
+        .filter((f) => f.file.length > 0);
+    const verdict = obj.verdict === 'holds' || obj.verdict === 'flawed' ? obj.verdict : null;
+    return { findings, verdict };
+}
+
+type Arm = 'legacy' | 'load_bearing';
+type Vendor = 'anthropic' | 'openai';
+const ARMS: readonly Arm[] = ['legacy', 'load_bearing'];
+const VENDORS: readonly Vendor[] = ['anthropic', 'openai'];
+
+/** fixtureId → arm → vendor → response */
+type Reviews = Record<string, Record<Arm, Record<Vendor, ArmResponse>>>;
+
+let _clients: Record<Vendor, ExternalAIClient> | null = null;
+function getClients(): Record<Vendor, ExternalAIClient> {
+    if (!_clients) {
+        _clients = {
+            anthropic: new AnthropicClient({ model: 'claude-sonnet-4-5', api_key: load_anthropic_key() }),
+            openai: new OpenAIClient({ model: 'gpt-4o', api_key: load_openai_key() }),
+        };
+    }
+    return _clients;
+}
+
+async function realReviews(items: CorpusItem[]): Promise<Reviews> {
+    const cs = getClients();
+    const out: Reviews = {};
+    for (const item of items) {
+        const perArm = { legacy: {}, load_bearing: {} } as Reviews[string];
+        out[item.id] = perArm;
+        for (const arm of ARMS) {
+            const prompt = arm === 'legacy' ? legacyPrompt(item) : loadBearingPrompt(item);
+            for (const vendor of VENDORS) {
+                let text = '';
+                try {
+                    const resp = await cs[vendor].ask(SYSTEM_JSON, prompt, 1600);
+                    text = resp.text ?? '';
+                } catch (e) {
+                    process.stderr.write(`  ${vendor} error on ${item.id}/${arm}: ${(e as Error).message}\n`);
+                }
+                const r = parseArmResponse(text);
+                perArm[arm][vendor] = r;
+                process.stderr.write(
+                    `  ${arm} ${item.id} ${vendor}: findings=${String(r.findings.length)} verdict=${r.verdict ?? '-'}\n`,
+                );
+            }
+        }
+    }
+    return out;
+}
+
+/**
+ * Mock reviews for pipeline validation in a chosen direction.
+ * `direction: 'pass'` — load_bearing keeps TP parity with legacy and stays
+ * silent on the controls. `direction: 'fail'` — load_bearing rubber-stamps
+ * (misses defects below the retention floor) so the verdict must read FAIL.
+ */
+function mockReviews(items: CorpusItem[], direction: 'pass' | 'fail'): Reviews {
+    const hit = (i: CorpusItem): Finding[] => [
+        {
+            file: i.ground_truth.defect_files[0] ?? i.files[0]?.path ?? '',
+            category: i.defect_category,
+            confidence: 'high' as const,
+        },
+    ];
+    const fpHit = (i: CorpusItem): Finding[] => [
+        { file: i.files[0]?.path ?? '', category: 'correctness', confidence: 'high' as const },
+    ];
+    const out: Reviews = {};
+    const defects = items.filter((i) => !i.is_clean);
+    const keepIds = new Set(
+        // In 'fail' direction the load_bearing arm catches only half the
+        // defects legacy catches — below the 0.8 retention floor.
+        defects.filter((_, idx) => idx % 2 === 0).map((d) => d.id),
+    );
+    for (const item of items) {
+        const legacyResp: ArmResponse = item.is_clean
+            ? { findings: fpHit(item), verdict: null } // legacy FPs every control (the measured defect)
+            : { findings: hit(item), verdict: null };
+        const lbCatches = item.is_clean ? false : direction === 'pass' || keepIds.has(item.id);
+        const lbResp: ArmResponse = item.is_clean
+            ? { findings: [], verdict: 'holds' }
+            : lbCatches
+              ? { findings: hit(item), verdict: 'flawed' }
+              : { findings: [], verdict: 'holds' };
+        out[item.id] = {
+            legacy: { anthropic: legacyResp, openai: legacyResp },
+            load_bearing: { anthropic: lbResp, openai: lbResp },
+        };
+    }
+    return out;
+}
+
+interface VendorArmScore {
+    tp: number;
+    fp: number;
+    fp_rate: number;
+    incoherent: number;
+    holds_on_clean: number;
+    caught_ids: string[];
+    fp_ids: string[];
+}
+
+interface VendorVerdict {
+    legacy: VendorArmScore;
+    load_bearing: VendorArmScore;
+    tp_retention: number | null;
+    fp_pass: boolean;
+    tp_pass: boolean;
+    promotes: boolean;
+}
+
+function scoreVendor(items: CorpusItem[], reviews: Reviews, vendor: Vendor): VendorVerdict {
+    const defects = items.filter((i) => !i.is_clean);
+    const controls = items.filter((i) => i.is_clean);
+    const armScore = (arm: Arm): VendorArmScore => {
+        const caught: string[] = [];
+        let incoherent = 0;
+        let holdsOnClean = 0;
+        for (const d of defects) {
+            const r = reviews[d.id]?.[arm]?.[vendor] ?? { findings: [], verdict: null };
+            if (caughtDefect(groundTruth(d), r.findings)) caught.push(d.id);
+            if (r.verdict === 'flawed' && r.findings.length === 0) incoherent++;
+        }
+        const fpIds: string[] = [];
+        for (const c of controls) {
+            const r = reviews[c.id]?.[arm]?.[vendor] ?? { findings: [], verdict: null };
+            if (isFalsePositive(groundTruth(c), r.findings)) fpIds.push(c.id);
+            if (r.verdict === 'flawed' && r.findings.length === 0) incoherent++;
+            if (r.verdict === 'holds') holdsOnClean++;
+        }
+        return {
+            tp: caught.length,
+            fp: fpIds.length,
+            fp_rate: controls.length ? fpIds.length / controls.length : 0,
+            incoherent,
+            holds_on_clean: holdsOnClean,
+            caught_ids: caught,
+            fp_ids: fpIds,
+        };
+    };
+    const legacy = armScore('legacy');
+    const load_bearing = armScore('load_bearing');
+    const tp_retention = legacy.tp > 0 ? load_bearing.tp / legacy.tp : null;
+    const fp_pass = load_bearing.fp_rate < FP_CEILING;
+    // A legacy TP of 0 leaves retention undefined. NOT part of the frozen
+    // registration (which is silent on a zero baseline) — a conservative
+    // in-code rule, unexercised in the recorded run (legacy TP was 10 and 5):
+    // retention unshowable against a zero baseline → tp_pass false.
+    const tp_pass = tp_retention !== null && tp_retention >= TP_RETENTION_FLOOR;
+    return { legacy, load_bearing, tp_retention, fp_pass, tp_pass, promotes: fp_pass && tp_pass };
+}
+
+function buildReport(items: CorpusItem[], reviews: Reviews, mode: string): Record<string, unknown> {
+    const perVendor: Record<string, VendorVerdict> = {};
+    for (const vendor of VENDORS) perVendor[vendor] = scoreVendor(items, reviews, vendor);
+    const promotes = VENDORS.every((v) => perVendor[v]?.promotes === true);
+    const detail: Record<string, unknown> = {};
+    for (const item of items) {
+        const perItem: Record<string, unknown> = { is_clean: item.is_clean };
+        for (const arm of ARMS) {
+            for (const vendor of VENDORS) {
+                const r = reviews[item.id]?.[arm]?.[vendor];
+                perItem[`${arm}_${vendor}`] = r
+                    ? { findings: r.findings.length, verdict: r.verdict }
+                    : null;
+            }
+        }
+        detail[item.id] = perItem;
+    }
+    return {
+        mode,
+        corpus: 'internal/bench/adversarial-council/corpus.json',
+        claim: 'critic-protocol-load-bearing-ab (docs/CLAIMS.md, pre-registered 2026-08-09)',
+        protocol:
+            'both arms single-shot per vendor over all 15 items; FP on findings only, identical scorer both arms; verdict secondary; flawed+empty findings = incoherent',
+        thresholds: { fp_ceiling: FP_CEILING, tp_retention_floor: TP_RETENTION_FLOOR },
+        per_vendor: perVendor,
+        verdict: {
+            promotes,
+            direction: promotes ? 'both thresholds met per vendor' : 'at least one threshold missed',
+            default_unchanged: 'legacy stays the default regardless (config critic_protocol)',
+        },
+        detail,
+    };
+}
+
+async function main(argv: string[]): Promise<number> {
+    const mock = argv.includes('--mock');
+    const run = argv.includes('--run');
+    const outIdx = argv.indexOf('--out');
+    const outFile = outIdx >= 0 ? argv[outIdx + 1] : null;
+    if (!mock && !run) {
+        process.stderr.write('usage: bench_critic_protocol (--mock | --run) [--out <file>]\n');
+        return 2;
+    }
+    const items = loadCorpus();
+    if (mock) {
+        // Tripwire (roadmap pre-mortem): the pipeline must discriminate in BOTH
+        // directions before any paid call.
+        const passReport = buildReport(items, mockReviews(items, 'pass'), 'mock-pass');
+        const failReport = buildReport(items, mockReviews(items, 'fail'), 'mock-fail');
+        const passOk = (passReport.verdict as { promotes: boolean }).promotes === true;
+        const failOk = (failReport.verdict as { promotes: boolean }).promotes === false;
+        process.stdout.write(JSON.stringify({ mock_pass: passReport, mock_fail: failReport }, null, 2) + '\n');
+        if (!passOk || !failOk) {
+            process.stderr.write(
+                `mock discrimination FAILED: pass-direction promotes=${String(passOk)}, fail-direction rejects=${String(failOk)} — do NOT run paid calls.\n`,
+            );
+            return 1;
+        }
+        process.stderr.write('mock discrimination OK in both directions.\n');
+        return 0;
+    }
+    const reviews = await realReviews(items);
+    const report = buildReport(items, reviews, 'run');
+    const json = JSON.stringify(report, null, 2) + '\n';
+    if (outFile) fs.writeFileSync(outFile, json);
+    process.stdout.write(json);
+    return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+    void main(process.argv.slice(2)).then((code) => process.exit(code));
+}
+
+export { parseArmResponse, scoreVendor, buildReport, mockReviews, legacyPrompt, loadBearingPrompt };