@event4u/agent-config 9.7.0 → 9.9.0

package/docs/decisions/ADR-118-loop-engineering-boundaries.md

@@ -1,162 +0,0 @@
----
-adr: 118
-status: accepted
-date: 2026-07-10
-decision: loop-engineering-boundaries
-supersedes: —
-superseded_by: —
-phase: loop-engineering
-type: structural
----
-
-# ADR-118 — Loop-engineering boundaries: one closure, four rejections, three deferrals, zero new loop surfaces
-
-## Status
-
-**Accepted** · 2026-07-10. Resolved by web research (five external articles + an
-independent sweep) ground-truthed against the repo's loop inventory, plus an
-AI-council debate (anthropic/claude-sonnet-4-5 + openai/gpt-4o, 2 rounds,
-2026-07-10, converged). Executed by `road-to-loop-engineering`.
-
-## Context
-
-The June-2026 "loop engineering" wave (design the system that prompts the
-agent: verification signal, budget shape, maker/checker topology, on-disk
-state) is mostly a rebranding of ReAct + eval-driven development + bounded
-autonomous agents. Its two durable contributions are the design vocabulary and
-a precise failure-mode taxonomy: verification collapse ("done" is a claim, not
-proof), comprehension debt, cognitive surrender, reward hacking (measured at
-~15% of SE-task runs in one external evaluation), cost blowup on stuck retry
-loops, context rot on long runs.
-
-This package already implements the serious end of that canon: bounded
-verify-fix loops (`verify-repair-loop` max_attempts=3, the N=3 validation
-budget, context-hygiene 15/25 aborts), maker/checker separation (`judge-*`
-cluster, `verify-budget`), human-gated self-improvement (5-stage pipeline,
-≥2 independent evidence), and measurement infrastructure (bench:ab, trigger
-evals, golden sets, orchestration telemetry, local analytics).
-
-An inventory identified 8 places where a measure exists but no adjust-step is
-wired. The question this ADR settles: which of those loops to close, and which
-loop-shaped proposals to reject so they are not relitigated per hype cycle.
-
-Constraint frame: single maintainer, token-frugality canon, no runtime daemon
-(ADR-088 / no-runtime-boundary), human gates on anything irreversible. Under
-these constraints, when human review + `git revert` is cheaper than designing,
-maintaining, and debugging a closed loop, the loop is net-negative
-infrastructure — false positives consume the binding resource (maintainer
-attention), not compute.
-
-## Decision
-
-### 1. Automation threshold (the core principle)
-
-Automate a measure→adjust loop **only** when all three hold:
-
-1. the metric is a **direct** measure of the failure mode (not a proxy or a
-   correlation),
-2. the expected false-positive rate is low (order <5%), and
-3. human judgment adds no unique information to the adjust decision.
-
-"A number exists" is not "the number is trustworthy" (metric-existence
-fallacy). Reversibility of the adjust-step alone never justifies automation:
-investigating one false-positive automated action costs 20–45 minutes of
-maintainer time against a 10-second revert.
-
-### 2. Disposition of the 8 open loops
-
-| # | Open loop | Disposition |
-|---|---|---|
-| 1 | Orchestration telemetry → `subagents.auto` demotion | **Manual by decision.** token_delta spikes for legitimate reasons; demotion needs qualitative judgment of the failure mode. The demotion path in `orchestration-benchmark-gate.md` stays a human one-line edit. |
-| 2 | Artifact-engagement counts → skill pruning | **Never automated.** Selection bias both ways (low engagement ≠ low value: security / error-recovery / niche skills; high engagement ≠ high value). Engagement stays ONE input under `evidence-based-pruning`'s ≥2-independent-evidence floor; the pruning decision is always human. |
-| 3 | Trigger-eval pass rate on cadence | **Closed** — the only closure. Structure/freshness/presence gates already ran in `task ci`; this ADR's roadmap adds a rotating live pass-rate measurement to the existing weekly canary (see §4). Direct metric, low false-positive, adjust-step = surfaced report. |
-| 4 | bench-drift → blocking gate | **Stays advisory.** High false-positive proxy (timing variance, intentional behaviour changes); the manual `bench:baseline-ready` flip remains the enforcement gate. |
-| 5 | Golden-set coverage ratchet (14/91 rules) | **Deferred; growth stays opportunistic.** A hard per-rule ratchet pressures toward mechanically-testable rules over useful rules; most uncovered rules are judgment-shaped. `road-to-golden-set-coverage` remains the deliberate path. |
-| 6 | Live-app verdict source | **Deferred, unchanged** — owned by `road-to-live-app-verdict`; the package ships config, not apps. |
-| 7 | Measured rule-adherence signal | **Rejected.** Annotated-corpus + threshold-tuning build with ongoing maintenance for marginally earlier restatement; ADR-054's coarse heuristics are intentional. |
-| 8 | Success-signal re-evaluation at eval date | **Not automated.** Retroactive evaluation of sunk promotion decisions has low marginal information; active use surfaces bad promotions. The field stays authored documentation. |
-
-### 3. Five written rejections (loop anti-patterns for this package)
-
-1. **Open-ended hill-climbing on the config.** No loop may "optimize"
-   rules/skills via iterated mutation + metric without a human checkpoint per
-   iteration; the bench:ab soak + human decision is the floor for config
-   change evaluation.
-2. **Autonomous config self-editing.** The self-improvement pipeline stays
-   human-gated at every stage; no loop commits changes to `src/skills/` or
-   `src/rules/` without human approval. (Restates the existing pipeline
-   contract as a loop boundary.)
-3. **Unattended multi-hour runs without checkpoints.** Loops must remain
-   reviewable/haltable on the maintainer's schedule; the existing halt
-   conditions and N=3 budgets are the ceiling, not a starting point.
-4. **Metric-optimizing loops without golden-set anchoring.** No loop whose
-   success criterion is "metric goes up" without a golden-set eval anchoring
-   what "good" means (Goodhart guard).
-5. **Cross-session loop state in external services.** No vector DBs, job
-   queues, or external orchestrators as loop state (restates ADR-088 in loop
-   context): state lives in git-tracked files + the conversation.
-
-Also rejected, same reasoning tier: a **loop-design contract/checklist
-artifact** (premature formalization — the caps/judges/state patterns are
-embedded in the existing loop surfaces and enforced by existing rules) and
-**consumer-facing loop templates** (`/loop:design` et al. — scope creep;
-agents answer loop-design questions in conversation using the package's
-existing vocabulary). **No new loop surfaces**: no run-until-condition goal
-command, no fresh-context re-loop mode for roadmap processing (bounded-scope
-by design), no separate nightly self-check workflow (folded into the existing
-weekly canary).
-
-### 4. The one closure — periodic live trigger-eval pass rate
-
-The existing weekly cross-model canary's secrets-gated live tier gains a
-deterministic rotation over the skills that carry `evals/triggers.json`
-(ISO-week keyed, ~5 suites/week), enforcing the per-domain precision/recall
-floors from `eval:record`. A floor breach fails the **scheduled** job — the
-failure is the maintainer notification; PRs are never blocked by live results.
-The local interactive confirmation gate on `skill_trigger_eval` is untouched;
-CI authorization derives exclusively from workflow-provided key secrets, and
-the no-secrets path stays a logged no-op.
-
-## Revisit-if
-
-- **Any rejection above:** reopen only on evidence that closing the loop saves
-  >2 h/month maintainer time in a structurally similar single-maintainer
-  project (logged hours, not vibes) — via `decision-revisit-gate`
-  mechanism-match, then council.
-- **The §4 closure:** demote the canary pass-rate job to advisory
-  (non-failing) if breaches are >~10% spurious over 50+ suite-runs.
-- **§2 #5 coverage ratchet:** reconsider if ≥3 real regressions ship in rules
-  that a golden task would have caught (counted, cited incidents).
-
-## Consequences
-
-- Future "should we automate X?" loop proposals test against §1 before any
-  build; the disposition table is the precedent record.
-- The weekly canary becomes the single periodic live-eval surface — additions
-  to periodic self-checking extend it rather than adding workflows.
-- Skill-pruning, default-demotion, and drift-blocking proposals cite this ADR
-  instead of re-deriving the argument.
-
-## Alternatives considered
-
-- **Close more loops (coverage ratchet, engagement pruning, auto-demotion):**
-  rejected — each fails at least one §1 criterion; the council's round-2
-  convergence was explicit that "metric exists + reversible" is insufficient.
-- **Loop-design contract:** rejected as compliance theater for a
-  single-maintainer project; revisit on a second maintainer with real handoff
-  friction.
-- **Do nothing (pure documentation):** rejected — the trigger-eval pass-rate
-  gap is real, direct-metric, and closable inside an existing workflow at
-  near-zero maintenance cost.
-
-## References
-
-- `road-to-loop-engineering` roadmap (execution + provenance; external source
-  links retained encrypted there per `source-confidentiality`).
-- `docs/contracts/evidence-based-pruning.md` — §2 #2 anchor.
-- `src/agent-src/contexts/execution/orchestration-benchmark-gate.md` — §2 #1 anchor.
-- `docs/contracts/measurement-baseline.md` — §2 #4 anchor.
-- ADR-088 (no external runtime), ADR-054 (adherence restate), ADR-106/-109/-117
-  (orchestration gates), `docs/contracts/no-runtime-boundary.md`.
-- Prior honest-nulls this ADR does not reopen: recursive-verification
-  (2026-06-24), enforcement-projection, reminder-injection.

package/docs/decisions/ADR-119-global-knowledge-default-on.md

@@ -1,104 +0,0 @@
----
-adr: 119
-status: accepted
-date: 2026-07-12
-decision: global-knowledge-default-on
-supersedes: 103
-superseded_by: —
-phase: opt-decision-flips
-type: structural
----
-
-# ADR-119 — Global knowledge sharing defaults ON (validated bounded-downside flip)
-
-## Status
-
-Accepted (2026-07-12). Supersedes ADR-103.
-
-## Context
-
-ADR-103 (2026-06-16) kept `knowledge.global_sharing.enabled: false` until
-cross-project reuse was measured across ≥ 2 projects. Verified state at
-re-evaluation (2026-07-11): the measurement instrument
-(`src/scripts/_lib/knowledge_global_promote.ts`) shipped, but no sightings
-data, no global store, and no reuse record existed — reuse can only accrue
-while the layer is ON, and ON was withheld pending reuse. The gate could
-never fire by construction: the same self-locking-measurement deadlock
-ADR-117 broke for `subagents.auto` on 2026-07-09.
-
-A two-round AI-council re-evaluation ran on 2026-07-11 (members:
-anthropic/claude-sonnet-4-5, openai/gpt-4o; cost $0.10). Round 1: both
-members stanced **Option A — flip ON now** (deadlock + ADR-117 precedent +
-shipped guards). Round 2 dissent (gpt-4o): the redaction floor was
-unvalidated for cross-project adversarial scenarios — composite inference,
-homoglyph/encoding smuggling, temporal context collapse. The named
-evidence-that-would-change-my-mind: demonstrating the redaction mechanism
-handles those classes. Convergence: **flip WITH validation** — the dissent
-becomes a pre-flip gate, not a blocker.
-
-## Decision
-
-1. **Pre-flip validation executed (2026-07-12).** Adversarial spot-check in
-   `tests/scripts/_lib_knowledge_global_redaction_adversarial.test.ts` +
-   `tests/fixtures/global-knowledge-redaction/` covering the three named
-   classes. Honest result: the zero-width-smuggling probe FAILED on first
-   run — the dissent's predicted gap was real. Closed by an additive
-   hardening in `knowledge_global_redaction.ts` (`hidden_unicode` violation
-   class + strip-then-rescan); homoglyph emails were already caught
-   (Unicode-aware pattern); temporal collapse is bounded by the freshness
-   state machine (fresh → hypothesis → stale). All 20 tests green,
-   including the 11 pre-existing parity tests.
-2. **`knowledge.global_sharing.enabled` defaults to `true`** in the shipped
-   template.
-3. **Narrowest tier default:** `allowed_tiers: [public]` (down from
-   `[public, vendor]`); `vendor` becomes a deliberate opt-in widening.
-   `proprietary` stays hard-coded manual-only in the gate.
-4. **Pre-registered demotion trigger:** any cross-project PII/secret
-   sighting in a shared card — a confirmed identifier that crossed a
-   project boundary despite the gate — auto-reverts the shipped default to
-   `false` and lands an incident note under `agents/settings/contexts/`.
-   This is the ADR-117 demotion-gate pattern applied to knowledge sharing.
-5. **Measurement window:** 60–90 days from release. The reuse data the
-   ADR-103 gate wanted now accrues; at window end the default is either
-   confirmed (reuse observed, no incidents) or reverted (no reuse — the
-   layer is dead weight — or a demotion trigger fired).
-6. **Accepted residual, pinned by test:** k-anonymity over pure
-   quasi-identifier combinations is out of scope for a write-time text
-   gate. The council accepted this on the single-install trust boundary
-   (an actor with filesystem access to the global store already reads the
-   raw projects, which are strictly more sensitive). The boundary is
-   asserted by a dedicated test so any future change to it is a deliberate
-   decision, not drift.
-
-## Consequences
-
-- Cross-project knowledge cards flow by default on the narrowest tier,
-  through the unchanged suggest-then-confirm promotion flow
-  (`auto_promote_threshold` gates a suggestion, never a silent write) and
-  the hardened redaction gate (halt-and-surface, never silent-rewrite).
-- Single-key revert: `knowledge.global_sharing.enabled: false` fully
-  no-ops the layer; v1 project-local cards are unaffected either way.
-- No new infrastructure: file-first store, no vectors, no services — the
-  ADR-094 Layer-2 sunset is untouched.
-- The hidden-unicode hardening also protects every other consumer of
-  `redaction_scan` (the Phase-4 CI linter over committed global cards).
-
-## Alternatives considered
-
-- **Keep OFF + opt-in campaign (Option B):** rejected — self-selection
-  bias, slow, and it retains the deadlock for everyone who does not
-  opt in.
-- **Maintainer-org pilot first (Option C):** rejected as the primary path —
-  the council judged the guarded flip's downside bounded enough that a
-  pilot's extra latency buys little; the demotion trigger plus the
-  measurement window deliver the same safety net in production shape.
-
-## References
-
-- ADR-103 (superseded), ADR-117 (deadlock-flip precedent), ADR-100/-094
-  (store shape + Layer-2 sunset).
-- Council session 2026-07-11 (claude-sonnet-4-5 + gpt-4o, 2 rounds,
-  convergence inlined above per `no-roadmap-references`).
-- `tests/scripts/_lib_knowledge_global_redaction_adversarial.test.ts` —
-  the validation gate.
-- `agents/roadmaps/road-to-opt-decision-flips.md` Phase 1 (execution).

package/docs/decisions/ADR-120-council-chairman-mode.md

@@ -1,70 +0,0 @@
----
-adr: 120
-status: accepted
-date: 2026-07-12
-decision: council-chairman-mode
-supersedes: —
-superseded_by: —
-phase: opt-council-deliberation
-type: structural
----
-
-# ADR-120 — Council chairman mode supersedes always-host synthesis
-
-## Status
-
-Accepted (2026-07-12).
-
-## Context
-
-The council skill's own Iron Law argues the host agent, having framed the
-artefact, cannot independently judge it — yet the shipped engine always let the
-host author the synthesis ("the host runs the council and synthesises
-convergence"). `road-to-opt-council-deliberation` Phase 2 applies the bias
-argument to the synthesis step itself. The contested `auto`-selection detail
-was resolved by a billable two-round council pass (anthropic/claude-sonnet-4-5 +
-openai/gpt-4o, 2026-07-12): provider-family difference is the binding
-independence property for a judge; capability (tier) is the tie-break.
-
-## Decision
-
-`ai_council.chairman: { mode: host | member | auto, member? }` — **default
-`host`**, preserving today's behaviour byte-for-byte (the compatibility
-guarantee). When `mode != host`, a **non-deliberating member** authors the
-synthesis as one billable call through the existing `consult` path (spend gate,
-daily ledger, metadata stamping unchanged):
-
-- `member` — the named member, validated fail-closed at config load (must exist
-  and be enabled) and rejected at selection time if it deliberated (a member
-  that argued cannot self-judge).
-- `auto` — provider-family difference primary (non-deliberating ⇒
-  provider-different under the one-member-per-provider invariant), optional
-  `members.<name>.tier` tie-break, deterministic config order final.
-- Every fallback path (member deliberated / unavailable / auto with no
-  candidate / call failed) degrades to the host template with a **visible
-  annotation** — never a silent substitution.
-
-## Consequences
-
-- The synthesis slot can carry a chairman-authored body (`payload.chairman`
-  → `render()`); `council:estimate` shows the extra call as its own row.
-- A new optional `tier` field exists on member config solely as the `auto`
-  tie-break.
-- Host synthesis remains the default; no consumer behaviour changes without
-  an explicit opt-in.
-
-## Alternatives
-
-- **Always-host synthesis (status quo)** — rejected: contradicts the skill's
-  own independence argument.
-- **Tier-first auto selection** — rejected by the council pass: chairing with
-  the strongest model when the deliberators share its provider concentrates
-  the decision surface on one provider's priors.
-
-## References
-
-- `docs/contracts/ai-council-config.md` § Chairman synthesis.
-- `src/scripts/ai_council/chairman.ts` (selection), `council_cli.ts`
-  `_maybe_run_chairman` (dispatch).
-- Council convergence: `road-to-opt-council-deliberation` § Council notes
-  (2026-07-12).

package/docs/decisions/ADR-121-knowledge-sensitivity-classes.md

@@ -1,90 +0,0 @@
----
-adr: 121
-status: accepted
-date: 2026-07-12
-decision: knowledge-sensitivity-classes
-supersedes: —
-superseded_by: —
-phase: feedback-8.11
-type: structural
----
-
-# ADR-121 — Per-card sensitivity classes for the knowledge boundary
-
-## Status
-
-Accepted (2026-07-12). Successor note to ADR-119 (global knowledge sharing
-default ON) — adds boundary teeth; does NOT revert the flip.
-
-## Context
-
-The 8.11.0 external reviews and the maintainer both name cross-project
-context transfer as the riskiest open surface of the ADR-119 flip: the only
-per-entry axis was origin tier (`public|vendor|proprietary` — where knowledge
-came from), the binary page flag `visibility: private`, and a write-time
-regex redaction gate. There was NO sensitivity taxonomy (how far an entry may
-travel), no per-card owner/expiry on shared cards, no promotion-reason
-capture, and no revocation trail — deletion was silent.
-
-A two-round council debate (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
-2026-07-12) split on scope: one member argued measure-first with a 2-level
-enum at most (six classes over-fit a single-maintainer install — `team` /
-`organization` are phantom categories today); the other argued the full
-six-class taxonomy from the reviews. Resolution: a SMALL machine-anchored
-axis now (the maintainer's danger is present, not speculative), the wider
-enum behind a revisit-if.
-
-## Decision
-
-Three sensitivity classes, each anchored to a machine check
-(`agents/settings/contexts/knowledge-sensitivity.md` carries the full table):
-
-- `prohibited` — redaction-class content; a redaction hit FORCES this class
-  (declared values cannot override it); hard linter error in the global
-  store (check G6).
-- `project` — the DEFAULT; promotion structurally refused unless a human
-  reclassifies; unset/invalid resolves here, never upward.
-- `shareable` — global-store eligible; requires passing redaction AND full
-  provenance: `source_repo`, `owner`, `review_after`, `promotion_reason`
-  (checks G4/G5); `promotion_reason` is mandatory human input — there is no
-  auto-`shareable` path.
-
-Plus an append-only revocation ledger (`.revocations.jsonl` tombstones
-written by `forget`/`purge` BEFORE deletion; rendered via
-`knowledge:global:list --revoked`).
-
-ADR-119's default-ON, `allowed_tiers: [public]`, measurement window, and
-demotion trigger are unchanged.
-
-## Consequences
-
-- Cross-project transfer now requires a recorded human decision per card
-  (class + reason), machine-verified in CI (`check_knowledge_cards` G4–G6)
-  and at promotion time (`gate_sensitivity_for_promotion`).
-- Deletion is auditable; the demotion trigger of ADR-119 gains a per-entry
-  trail to point at.
-- Cost: one more frontmatter field + four footer fields on shared cards;
-  no new subsystem, no read-time machinery.
-
-## Alternatives considered
-
-- Six-class enum `{local-only, project, team, organization, confidential,
-  prohibited}` (the reviews' proposal) — rejected now: `team`/`organization`
-  have no consumer today; widening is cheap later, narrowing is not.
-  Revisit-if: a real multi-tenant org install exists.
-- Revert ADR-119 to default-OFF — rejected: re-creates the ADR-103
-  measure-then-decide deadlock; the danger is contained by classes + gates,
-  not by turning the layer off.
-- Semantic PII detection / k-anonymity — out of scope per ADR-119 §6
-  (write-time text gate, single-install trust boundary).
-
-## References
-
-- `agents/settings/contexts/knowledge-sensitivity.md` — locked design table.
-- ADR-119 — the flip this hardens.
-- Implementation: `knowledge_global.ts` (SENSITIVITIES, footer fields),
-  `knowledge_global_promote.ts` (`resolve_effective_sensitivity`,
-  `gate_sensitivity_for_promotion`, tombstones), `knowledge_global_cli.ts`
-  (promote/forget/purge/list flags), `check_knowledge_cards.ts` (G4–G6);
-  118 tests across 6 files incl. 3 cross-project-contamination adversarial
-  cases.

package/docs/decisions/ADR-122-adversarial-verification-council.md

@@ -1,166 +0,0 @@
----
-adr: 122
-status: accepted
-date: 2026-07-14
-decision: adversarial-verification-council
-supersedes: —
-superseded_by: —
-phase: adversarial-verification-council
-type: structural
----
-
-# ADR-122 — Adversarial verification council: finding-coverage scope, advisory-only, default-off
-
-## Status
-
-Accepted (2026-07-14).
-
-## Context
-
-The verify/council family is mature: the external council engine, multi-round
-debate, chairman mode (ADR-120), stance tally, `verify-repair-loop` (the
-judge→revise→re-judge loop), the seven `judge-*` skills, `judge-synthesis`, the
-`subagent-orchestration` mode set, and the `verify-budget` routing all ship. A
-three-strand research pass (surface map + archived-roadmap autopsy + infra
-inventory, 2026-07-14) confirmed that almost every *decision-consensus*
-mechanism in this space is either built or is a recorded honest-null:
-
-- recursive self-correction as a capability/discipline lever — honest-null,
-  council-terminal (ADR-106);
-- the judge→revise→re-judge loop — shipped as `verify-repair-loop`;
-- personas / named-figure agents — placebo-null (Δ=0.17, p=0.607); provider
-  diversity moved quality ~15× more than persona identity;
-- browser-automation council members — maintainer-killed (council-modes 2c);
-- a `--council` in-flow UX product surface — stub, gated on the
-  orchestration-scope decision + a demand signal;
-- "council beats a solo strong model on decision quality" —
-  `council-vs-solo-baseline`, pre-registered `unbacked`, spend-gated.
-
-The one un-mined, evidence-supported wedge is **adversarial verification as
-defect FINDING coverage** (not decision quality). The `cross-vendor-parity`
-claim is *backed*: different providers surface different real findings on
-multi-file analysis; both catch a planted hollow impl; both stay silent on a
-clean control. No wired surface exists that runs a model-diverse skeptic panel
-adversarially against a real change to maximise defect-finding coverage — the
-nearest kin (`judge-with-debate`, strict-er-wins on one verdict;
-`judge-synthesis`, consume-only consensus) do something categorically different.
-
-## Decision
-
-Ship an **adversarial verification council** as a distinct, opt-in,
-**advisory-only** surface, scoped to **finding coverage, not decision quality**:
-
-1. **A 9th `subagent-orchestration` mode** `adversarial-verification-council`:
-   N (default 2) distinct-model skeptics red-team a real, already-verified
-   change through the `judge-*` lenses; each returns findings; results are
-   reconciled into a findings-by-severity verdict with per-finding provenance and
-   a cross-model confidence signal. Distinct from Mode 6 because the output is a
-   **findings-union with provenance**, not a strict-er-wins single verdict.
-2. **A machine-readable findings envelope** `adversarial-findings.json` (draft-07,
-   hand-validated like `subagent-status.json`) — filling the gap of no shared
-   judge-verdict schema.
-3. **Countable reconciliation in TS with tests** (`adversarial_reconcile.ts`):
-   dedup, severity-quorum confidence, and false-positive suppression. Never
-   LLM-computed prose (anti-lesson). Never gates the change — only ranks and
-   annotates findings.
-4. **Opt-in wiring, default-off**: a `subagents.adversarial_council: off|ask|on`
-   setting (default `off`); an opt-in escalation tier in `verify-budget` for
-   explicitly high-risk changes; an opt-in flag on `/review-changes` (or
-   `/judge`). The panel never auto-gates a change (Hard Floor: advisory only).
-5. **Prove-or-drop against a pre-registered finding-coverage claim**
-   (`adversarial-council-finding-coverage`, `unbacked` at start). The benchmark
-   is a **two-stage residual-detection protocol** (single strong judge first →
-   panel on the judge-passed residual subset), on a corpus with published
-   judge-survivable subtlety distribution, with a **dual threshold** (relative
-   ≥ +25% AND absolute ≥ +8 pp residual-recall lift) and a
-   **controversial-but-correct FP control**. Honest-null is an accepted outcome
-   and keeps the surface inert-by-default permanently.
-
-### Skeptic transport (fork F1)
-
-Everyday mode uses an in-session subagent panel with enforced model diversity.
-The **registered benchmark run and the opt-in high-risk tier require
-cross-*vendor* skeptics** (via `council_cli.ts`, artefact/diff-as-text,
-read-only) — the backed `cross-vendor-parity` signal is provider-level, so the
-claim cannot rest on same-vendor model diversity alone.
-
-## Consequences
-
-- The package gains a defect-finding verification surface that composes existing
-  primitives — no rebuilt engine, no recursion loop, no persona layer, no
-  browser automation, no `--council` UX product.
-- A new shared findings schema exists that future judge-panel work can reuse.
-- The value claim is measurable (finding coverage on a static corpus, unlike
-  orchestration value in the no-runtime harness), and its resolution is honest:
-  a null keeps the surface off by default, like recursive-verification.
-- Default-off means zero cost/behaviour change until a consumer opts in.
-
-## Landmine-clearance (do-not-relitigate map)
-
-Each settled decision this roadmap does NOT touch:
-
-- **Recursion / re-attempt loop** — not added; the panel is single-pass finding
-  generation, not a self-correction loop.
-- **judge→revise→re-judge** — reused (`verify-repair-loop`), not rebuilt.
-- **Council engine / debate / budget / redaction / chairman** — reused, not
-  re-proposed.
-- **Personas / named-figure agents / persona panel-mode** — not used; skeptics
-  are model-diverse, not persona-diverse.
-- **Browser-automation / web-subscription scraping** — not revived.
-- **`--council` in-flow UX product / verdict-report product layer** — not built;
-  the findings envelope is an engineering contract, not a productized report.
-- **council-vs-solo decision-quality claim** — out of scope; the claim here is
-  finding coverage, resting on the backed `cross-vendor-parity` signal.
-- **Orchestration value measured in a no-runtime harness** — not claimed; the
-  benchmark measures finding coverage on a static planted-defect corpus.
-- **Prose-computed reconciliation** — reconciliation is TS with tests.
-
-## Alternatives
-
-- **Extend Mode 6 `judge-with-debate`** — rejected: its strict-er-wins single
-  verdict is a go/no-go decision, categorically different from a findings-union;
-  overloading it would blur two contracts.
-- **Build on the external `ai-council` for the everyday path** — rejected: the
-  external council is artefact-only / read-only by Hard-Floor contract; the
-  everyday code path is in-session `subagent-orchestration`. External
-  cross-vendor is reserved for the registered claim + high-risk tier.
-- **Default-on** — rejected: no evidence yet; default-off until the
-  pre-registered claim is `backed`.
-
-## References
-
-- `agents/roadmaps/archive/road-to-adversarial-verification-council.md` — the roadmap.
-- ADR-106 (recursive-verification honest-null), ADR-117 (subagents.auto flip),
-  ADR-120 (council chairman mode), ADR-109 (subagent-v1 contract).
-- `docs/CLAIMS.md#adversarial-council-finding-coverage` — the pre-registered claim.
-- `cross-vendor-parity` (backed) — the evidence the finding-coverage scope rests on.
-
-## Addendum (2026-07-21) — finding-coverage claim resolved HONEST-NULL
-
-The pre-registered `adversarial-council-finding-coverage` claim was executed and
-resolved **negative**. A curated judge-survivable corpus
-(`internal/bench/adversarial-council/`: 12 planted-defect fixtures across
-multi-file-interaction / logic-inversion / security-masked / complex-state + 3
-controversial-but-correct clean controls; subtlety distribution published;
-passed an independent validity audit after one fixture was repaired) was run
-cross-vendor (anthropic `claude-sonnet-4-5` + openai `gpt-4o`) under the
-maintainer spend authorization.
-
-**Result:** on the judge-passed residual, the 2-vendor skeptic panel matched the
-single skeptic exactly (residual recall 0.60 = 0.60, **zero lift** — the second
-vendor's catches were a strict subset of the first's), at a **100%** false-
-positive rate on the controversial-but-correct controls under the adversarial-
-skeptic posture. Both locked recall thresholds missed -> honest-null. **The
-Mode 9 `adversarial-verification-council` surface stays default-off permanently**
-(no settings change — it already ships off), recorded like recursive-verification
-(ADR-106). Detail + reproducible artifact:
-`docs/benchmark.md#adversarial-verification-council`,
-`internal/bench/adversarial-council/runs/`.
-
-**Transport lesson (durable):** `council_cli run`/`debate` is a *deliberation*
-transport — multi-round peer-review with cross-member visibility, prose output.
-It is the WRONG tool for an independent-skeptic, structured-output benchmark (it
-violated the independence requirement and defeated JSON scoring; the first run
-through it was rejected as an artifact). The valid measurement uses direct,
-independent per-vendor client calls with a strict-JSON contract and a
-deterministic, pre-validated scorer.