@onlooker-community/ecosystem 0.34.0 → 0.43.0

package/plugins/tribunal/scripts/lib/tribunal-aggregate.sh

@@ -15,27 +15,166 @@
 #   tribunal_disagreement <verdicts_json>
 #       echoes max(score) - min(score), or 0 if 0/1 verdicts
 #
-# weighted_mean uses *rubric criterion weights*, not per-judge weights — the
-# semantics are "weight each criterion's contribution, then average judges'
-# scores on each criterion." For v0.1 the per-criterion breakdown is not yet
-# threaded through verdicts, so weighted_mean degrades to mean when the rubric
-# weights cannot be applied. The schema still emits aggregation_method =
-# "weighted_mean" so dashboards see the intent.
+# weighted_mean uses *rubric criterion weights*: average the judges' scores on
+# each criterion, weight each criterion's mean, and normalize by the weights
+# actually used. A criterion no judge scored contributes nothing and its weight
+# is excluded from the denominator — absence is not a zero. When no criterion
+# has any score (every verdict emitted before judges shipped criterion_scores),
+# weighted_mean degrades to mean rather than collapsing to 0.
+#
+# Normalizing by the weights actually scored is only honest once the panel has
+# covered enough of the rubric. The judge agents are told to omit any criterion
+# they cannot assess, so a panel that scores one cheap criterion and skips the
+# rest would otherwise produce an aggregate computed entirely from that one and
+# renormalized to look complete — and .score, the judge's own overall verdict,
+# is never read here to contradict it. Two guards, and weighted_mean degrades to
+# the plain mean of .score — the panel's own summary judgment — on either:
+#
+#   1. Any criterion carrying a min_pass went unscored. A weight fraction is the
+#      wrong proxy for what a floor protects, because a floor protects one named
+#      criterion. In the shipped default rubric correctness (0.4) plus
+#      completeness (0.3) clears any coverage bar at or below 0.7 while skipping
+#      safety, the highest floor there is — which reproduced the exact inversion
+#      guard 2 was added to stop, one criterion further along.
+#   2. The scored weight covers less than min_criterion_coverage of the rubric's
+#      total declared weight. Still load-bearing for rubrics that mix floored and
+#      unfloored criteria, where guard 1 has nothing to say.
+#
+# A criterion with no min_pass is exempt from guard 1 by design: absence is not a
+# zero, and renormalizing over it stays correct. Only floors force the degrade,
+# or every partial panel would collapse weighted_mean into mean.
+#
+# Degrading is deliberately not refusing — a blocked tribunal task retries. That
+# is the asymmetry with librarian, which refuses (UNJUDGED) because a lesson
+# published without its disclosure floor ever running is not recoverable.
+
+# Echoes the panel with malformed verdicts removed, naming each on stderr.
+#
+# A judge that returns parseable JSON omitting `score` is malformed, not
+# unanimous, but jq's `add` treats the missing key as null and `null + n == n`
+# — so such a verdict contributed 0 to the numerator and 1 to the denominator,
+# silently dragging the panel down rather than failing loudly. `min` was worse:
+# it returned literal `null`, which the gate feeds to awk as the string "null"
+# and coerces to 0.
+#
+# Dropping rather than refusing is deliberate. Tribunal has no UNJUDGED channel
+# — tribunal_aggregate returns a float — so the choice is between dropping and
+# inventing one. Dropping silently would be its own bug, hence the stderr line.
+#
+# A score outside [0,1] is malformed for the same reason a missing one is: it is
+# not a verdict this scale can read. Dropping rather than clamping is what keeps
+# one rule in this file — the criterion-score path in weighted_mean already
+# filters to `number and >= 0 and <= 1` rather than clamping, and applying two
+# different validity rules to the same concept is what let this through. The
+# realistic trigger is a judge emitting a percentage instead of a fraction (95
+# rather than 0.95), an ordinary LLM formatting slip. Nothing else at the seam
+# rejects it: TribunalVerdictPayload declares score in [0,1], but the runtime
+# emitter fails open (ADR-005), so this is the only place that re-checks.
+#
+# Bounds are inclusive. A judge that scored 0 rejected the work and a judge that
+# scored 1 did not — dropping either would be its own fail-open, since 0 is
+# precisely the verdict that has to survive to drag the panel below threshold.
+#
+# Private to this file. See ecosystem-up8 (missing) and ecosystem-7cl (range).
+_tribunal_usable_verdicts() {
+	local verdicts="${1:-[]}"
+	local usable_def='def usable: (.score | type) == "number" and .score >= 0 and .score <= 1;'
+	local dropped
+	# One `def` reused by both passes, rather than the positive predicate here
+	# and a hand-negated copy below — that pair drifting is the whole bug class.
+	dropped=$(printf '%s' "$verdicts" | jq -r "$usable_def"'
+		[ .[]
+		  | select(usable | not)
+		  | (.judge_id // .judge_type // "unidentified") ] | join(", ")
+	' 2>/dev/null) || dropped=""
+	if [[ -n "$dropped" ]]; then
+		printf 'tribunal-aggregate: ignoring verdict(s) with no usable score (missing, non-numeric, or outside [0,1]): %s\n' \
+			"$dropped" >&2
+	fi
+	printf '%s' "$verdicts" | jq -c "$usable_def"'[ .[] | select(usable) ]' \
+		2>/dev/null || printf '[]'
+}
 
 tribunal_aggregate() {
 	local method="${1:-mean}"
 	local verdicts="${2:-[]}"
-	local _rubric="${3:-{}}"  # reserved for true weighted_mean once per-criterion scores are threaded
-	: "$_rubric"
+	local rubric="${3:-}"
+	[ -z "$rubric" ] && rubric='{}'
+
+	# This lib is sourced standalone in tests and does not pull in
+	# tribunal-config.sh; fall back rather than adding a source line.
+	local min_coverage
+	if ! type tribunal_config_get >/dev/null 2>&1; then
+		min_coverage="0.6"
+	else
+		min_coverage=$(tribunal_config_get '.tribunal.rubric.min_criterion_coverage' 2>/dev/null)
+	fi
+	case "$min_coverage" in
+		''|null) min_coverage="0.6" ;;
+	esac
 
 	local count
 	count=$(printf '%s' "$verdicts" | jq 'length' 2>/dev/null) || count=0
 	[[ "$count" -eq 0 ]] && { printf '0'; return 0; }
 
+	# Malformed verdicts leave the panel before any method runs — including
+	# weighted_mean, which would otherwise still consume their criterion_scores.
+	# That is the sharpest form of this bug: once criterion_scores cover the
+	# rubric, weighted_mean never reads .score, so a judge that returned no
+	# verdict at all counted as a fully participating one, and it failed toward
+	# not blocking.
+	verdicts=$(_tribunal_usable_verdicts "$verdicts")
+	count=$(printf '%s' "$verdicts" | jq 'length' 2>/dev/null) || count=0
+	# No usable verdict aggregates to 0, matching the empty-panel line above:
+	# below every threshold, so the gate blocks rather than passing on nothing.
+	[[ "$count" -eq 0 ]] && { printf '0'; return 0; }
+
 	case "$method" in
-		mean|weighted_mean)
+		mean)
 			printf '%s' "$verdicts" | jq -r '[.[].score] | add / length'
 			;;
+		weighted_mean)
+			local weighted
+			weighted=$(printf '%s' "$verdicts" | jq -r \
+				--argjson rubric "$rubric" --argjson mincov "$min_coverage" '
+				. as $v
+				| ([ ($rubric.criteria // [])[]
+				     | select((.weight | type) == "number") | .weight ] | add) as $total_w
+				| [ ($rubric.criteria // [])[]
+				    | select((.name | type) == "string" and (.weight | type) == "number")
+				    | . as $c
+				    | ([ $v[]
+				         | select((.criterion_scores | type) == "object")
+				         | select(.criterion_scores | has($c.name))
+				         | .criterion_scores[$c.name]
+				         | select(type == "number" and . >= 0 and . <= 1) ]) as $scores
+				    | select(($scores | length) > 0)
+				    | { w: $c.weight, m: (($scores | add) / ($scores | length)) } ] as $covered
+				| [ ($rubric.criteria // [])[]
+				    | select((.name | type) == "string" and (.min_pass | type) == "number")
+				    | . as $c
+				    | select([ $v[]
+				               | select((.criterion_scores | type) == "object")
+				               | select(.criterion_scores | has($c.name))
+				               | .criterion_scores[$c.name]
+				               | select(type == "number" and . >= 0 and . <= 1) ] | length == 0)
+				    | $c.name ] as $unscored_floors
+				| ($covered | map(.w) | add) as $den
+				| if ($covered | length) == 0 or $den == null or $den <= 0 then empty
+				  elif $total_w == null or $total_w <= 0 then empty
+				  elif ($unscored_floors | length) > 0 then empty
+				  elif ($den / $total_w) < $mincov then empty
+				  else ($covered | map(.w * .m) | add) / $den
+				  end
+			' 2>/dev/null)
+			if [ -n "$weighted" ]; then
+				printf '%s' "$weighted"
+			else
+				# No criterion carried a usable score, or the panel covered too
+				# little of the rubric to renormalize honestly — degrade to mean.
+				printf '%s' "$verdicts" | jq -r '[.[].score] | add / length'
+			fi
+			;;
 		median)
 			printf '%s' "$verdicts" | jq -r '
 				[.[].score] | sort as $s
@@ -58,6 +197,12 @@ tribunal_aggregate() {
 
 tribunal_disagreement() {
 	local verdicts="${1:-[]}"
+	# Same filter as tribunal_aggregate, and this one crashed on a *single*
+	# scoreless verdict rather than needing a whole panel of them. A crash
+	# prints nothing to stdout, so the caller read an empty dissent score, awk
+	# coerced it to 0, and the gate's dissent short-circuit never fired —
+	# failing toward not blocking.
+	verdicts=$(_tribunal_usable_verdicts "$verdicts")
 	local count
 	count=$(printf '%s' "$verdicts" | jq 'length' 2>/dev/null) || count=0
 	[[ "$count" -lt 2 ]] && { printf '0'; return 0; }

package/plugins/tribunal/scripts/lib/tribunal-gate.sh

@@ -15,31 +15,128 @@
 #
 # Echoes a JSON object: { passed: bool, reason?: string }
 #   reason is one of: low_score | meta_override | bias_detected | dissent_unresolved
+#                   | criterion_floor  (with failed_criterion naming the criterion)
 #
-# Usage: result=$(tribunal_gate_decide "$policy" "$verdicts" "$agg" "$thr" "$meta" "$dissent" "$dissent_thr")
+# Usage: result=$(tribunal_gate_decide "$policy" "$verdicts" "$agg" "$thr" "$meta" "$dissent" "$dissent_thr" "$rubric")
+
+# Names the first criterion sitting below its min_pass, or echoes nothing.
+#
+# The *lowest* score among the judges that scored it, not the mean: a floor
+# means nobody may be below it. Using the mean let a specialist's finding be
+# diluted by generalists who did not look — with safety floored at 0.8, a
+# security judge scoring 0.6 against two generalists at 0.95 averaged to 0.83
+# and passed, so empanelling more judges made every floor weaker. Weighting
+# still uses the mean; only the floor is a minimum.
+#
+# A criterion no judge scored is NOT a violation: absence is not a zero, and
+# treating it as one would fail every verdict emitted before judges shipped
+# criterion_scores. tribunal_aggregate degrades weighted_mean to the plain mean
+# when that happens, and the caller warns on stderr.
+#
+# A criterion a judge DID score but scored unreadably — outside [0,1], or not a
+# number — is a different thing, and it is a violation. Absence means the judge
+# declined to assess (the agents are told to omit what they cannot judge);
+# unreadable means they assessed it and the answer did not survive. A floor is
+# the rubric's hard constraint, so "cannot confirm this held" must fail closed.
+#
+# ANY unreadable report violates, not merely an all-unreadable criterion, and
+# that follows from why the floor uses min rather than mean in the first place:
+# a specialist's finding must not be diluted by generalists who did not look.
+# Merely filtering the bad value reproduces the exact dilution this design was
+# built to prevent — a security judge emitting 30 (plausibly 0.30, a violation)
+# would be discarded so two generalists at 0.95 carry the floor.
+#
+# The range test matches _tribunal_usable_verdicts in tribunal-aggregate.sh and
+# the criterion filter in weighted_mean. Those disagreeing is what let an
+# out-of-range score satisfy a floor while aggregation refused to score it at
+# all — see ecosystem-5fy.
+#
+# Private to this file. It exists as a function because the answer is needed in
+# two places — once to veto `meta_override: accept`, once for the blocking
+# precedence chain — and duplicating the jq is how the two drift apart.
+_tribunal_floor_failed() {
+	local verdicts="${1:-[]}"
+	local rubric="${2:-}"
+	[ -z "$rubric" ] && rubric='{}'
+	printf '%s' "$verdicts" | jq -r --argjson rubric "$rubric" '
+		def readable: (type == "number") and . >= 0 and . <= 1;
+		. as $v
+		| [ ($rubric.criteria // [])[]
+		    | select((.name | type) == "string" and (.min_pass | type) == "number")
+		    | . as $c
+		    | ([ $v[]
+		         | select((.criterion_scores | type) == "object")
+		         | select(.criterion_scores | has($c.name))
+		         | .criterion_scores[$c.name] ]) as $reported
+		    | ([ $reported[] | select(readable) ]) as $scores
+		    | select(
+		        # somebody reported a score this scale cannot read...
+		        ($reported | length) > ($scores | length)
+		        # ...or the readable ones put somebody under the floor.
+		        or (($scores | length) > 0 and ($scores | min) < $c.min_pass)
+		      )
+		    | $c.name ]
+		| first // empty
+	' 2>/dev/null || printf ''
+}
 
 tribunal_gate_decide() {
 	local policy="${1:-majority}"
 	local verdicts="${2:-[]}"
 	local aggregated_score="${3:-0}"
 	local score_threshold="${4:-0.75}"
-	local meta="${5:-{}}"
+	local meta="${5:-}"
+	[ -z "$meta" ] && meta='{}'
 	local dissent_score="${6:-0}"
 	local dissent_threshold="${7:-0.25}"
+	local rubric="${8:-}"
+	[ -z "$rubric" ] && rubric='{}'
 
 	local meta_bias_detected meta_override
 	meta_bias_detected=$(printf '%s' "$meta" | jq -r '.bias_detected // false' 2>/dev/null)
 	meta_override=$(printf '%s' "$meta" | jq -r '.override_recommendation // empty' 2>/dev/null)
 
+	# Which criterion, if any, sits below its floor. Computed here rather than
+	# beside the other blocking reasons because `meta_override: accept` returns
+	# before them, and a floor the Meta-Judge can lift is not a floor. See the
+	# longer note on min-not-mean further down.
+	local floor_failed
+	floor_failed=$(_tribunal_floor_failed "$verdicts" "$rubric")
+
+	# A violated floor is worth naming on whichever arm blocks: the worst
+	# failures drag the aggregate under the threshold too, so attaching
+	# failed_criterion only to the criterion_floor arm left the diagnostic
+	# absent exactly where it mattered most.
+	#
+	# Built HERE, beside floor_failed, rather than down with the final chain.
+	# It used to be defined below the short-circuit returns, which could
+	# therefore never reference it however much they should have — so
+	# dissent_unresolved carried the criterion from the chain arm and dropped it
+	# from the short-circuit, one reason string with two behaviors. See
+	# ecosystem-973. Every blocking return below now decorates, and the test
+	# "every blocking arm that can see a violated floor names it" holds a newly
+	# added arm to the same rule without anyone having to remember.
+	local floor_suffix=""
+	[[ -n "$floor_failed" ]] && floor_suffix=$(printf ',"failed_criterion":"%s"' "$floor_failed")
+
 	# meta_override policy: the Meta-Judge wins, regardless of jury.
 	if [[ "$policy" == "meta_override" ]]; then
 		case "$meta_override" in
 			accept)
+				# ...but not regardless of the rubric. `accept` overrules the
+				# jury's *opinion*; a floor is the rubric's hard constraint, so
+				# it survives. Every other short-circuit below already blocks,
+				# which made this the one arm that could turn a violated floor
+				# into a pass.
+				if [[ -n "$floor_failed" ]]; then
+					printf '{"passed":false,"reason":"criterion_floor","failed_criterion":"%s"}' "$floor_failed"
+					return 0
+				fi
 				printf '{"passed":true}'
 				return 0
 				;;
 			reject)
-				printf '{"passed":false,"reason":"meta_override"}'
+				printf '{"passed":false,"reason":"meta_override"%s}' "$floor_suffix"
 				return 0
 				;;
 			re-evaluate|"")
@@ -50,7 +147,7 @@ tribunal_gate_decide() {
 
 	# Bias detection short-circuit (any policy).
 	if [[ "$meta_bias_detected" == "true" && "$meta_override" == "reject" ]]; then
-		printf '{"passed":false,"reason":"bias_detected"}'
+		printf '{"passed":false,"reason":"bias_detected"%s}' "$floor_suffix"
 		return 0
 	fi
 
@@ -59,13 +156,36 @@ tribunal_gate_decide() {
 	# retries with a fresh Actor pass.
 	if awk -v d="$dissent_score" -v t="$dissent_threshold" 'BEGIN { exit !(d > t) }' \
 		&& [[ -z "$meta_override" || "$meta_override" == "re-evaluate" ]]; then
-		printf '{"passed":false,"reason":"dissent_unresolved"}'
+		printf '{"passed":false,"reason":"dissent_unresolved"%s}' "$floor_suffix"
 		return 0
 	fi
 
+	# A verdict tribunal_aggregate refuses to score cannot vote to approve, but
+	# its SEAT STILL COUNTS. The usability test below is the same one
+	# _tribunal_usable_verdicts applies in tribunal-aggregate.sh — a numeric
+	# score inside [0,1], so a judge emitting 95 instead of 0.95 is as unusable
+	# as one that emitted nothing. The two copies must stay in step, and
+	# "usable verdicts agree with tribunal_aggregate" in the bats file is what
+	# catches them drifting.
+	#
+	# Denying the vote rather than dropping the verdict is deliberate, and it
+	# is NOT what ecosystem-y7y originally asked for. Making both halves agree
+	# on panel membership sounds right and loosens the gate: dropping shrinks
+	# the panel, and a shrunken panel is a trivially satisfied majority. One
+	# real approval beside two verdicts that never arrived would become a
+	# 1-of-1 pass, and strict would clear on a panel that never fully reported
+	# — the hazard librarian's judge-type check exists to prevent. Measured
+	# across the five reachable cases, dropping fixed one and loosened three.
+	#
+	# A judge that failed to return a verdict did not leave the panel; it
+	# failed. So majority still needs a majority of everyone empaneled, and
+	# strict still needs all of them.
 	local count passed_count
 	count=$(printf '%s' "$verdicts" | jq 'length' 2>/dev/null) || count=0
-	passed_count=$(printf '%s' "$verdicts" | jq '[.[] | select(.passed == true)] | length' 2>/dev/null) || passed_count=0
+	passed_count=$(printf '%s' "$verdicts" | jq '
+		def usable: (.score | type) == "number" and .score >= 0 and .score <= 1;
+		[.[] | select(.passed == true and usable)] | length
+	' 2>/dev/null) || passed_count=0
 
 	local jury_ok=1  # 0 = ok, 1 = not ok (shell convention)
 	case "$policy" in
@@ -91,21 +211,80 @@ tribunal_gate_decide() {
 	local score_ok=1
 	awk -v s="$aggregated_score" -v t="$score_threshold" 'BEGIN { exit !(s >= t) }' && score_ok=0
 
-	if [[ "$jury_ok" -eq 0 && "$score_ok" -eq 0 ]]; then
-		printf '{"passed":true}'
-		return 0
+	# A floor nobody scored is a silent hole in the rubric, so say so. The gate
+	# does not block on it — see _tribunal_floor_failed for why absence is not a
+	# zero — but tribunal_aggregate has already refused to renormalize around it,
+	# so the aggregate this gate just judged is the panel's plain mean.
+	#
+	# ABSENCE ONLY: this names criteria nobody reported, not ones reported
+	# unreadably. Those now violate the floor and block, so naming them here
+	# would print "their min_pass floors did not apply" about a floor that did
+	# apply and did block. The two also cannot share a predicate: conflating
+	# them meant the sole signal for "a floor got skipped" was emitted by the
+	# very defect that skipped it, which is how this stayed quiet.
+	local unscored_floors any_scored
+	any_scored=$(printf '%s' "$verdicts" | jq -r '
+		[.[] | select((.criterion_scores | type) == "object")
+		     | select((.criterion_scores | length) > 0)] | length > 0
+	' 2>/dev/null) || any_scored="false"
+
+	if [[ "$any_scored" == "true" ]]; then
+		unscored_floors=$(printf '%s' "$verdicts" | jq -r --argjson rubric "$rubric" '
+			. as $v
+			| [ ($rubric.criteria // [])[]
+			    | select((.name | type) == "string" and (.min_pass | type) == "number")
+			    | . as $c
+			    | select([ $v[]
+			               | select((.criterion_scores | type) == "object")
+			               | select(.criterion_scores | has($c.name))
+			               | .criterion_scores[$c.name] ] | length == 0)
+			    | $c.name ]
+			| join(", ")
+		' 2>/dev/null) || unscored_floors=""
+		if [[ -n "$unscored_floors" ]]; then
+			printf 'tribunal-gate: no judge scored these criteria, so their min_pass floors did not apply: %s\n' \
+				"$unscored_floors" >&2
+		fi
 	fi
 
-	# Pick the most informative blocking reason.
+	# Pick the most informative blocking reason. Every arm here blocks — this
+	# chain only decides what the Actor is TOLD, never whether the work passes.
+	# Keeping those two apart is the whole basis for the order:
+	#
+	#   low_score           — the aggregate missed the threshold, which is more
+	#                         actionable than any single criterion.
+	#   jury arms           — WHY the panel failed. A Meta-Judge rejection is
+	#                         the more useful thing to hand back on retry than
+	#                         which criterion sat low, and the floor still rides
+	#                         along as failed_criterion.
+	#   criterion_floor     — no jury complaint, so the floor IS the complaint.
+	#
+	# The jury arms sit ahead of criterion_floor deliberately (ecosystem-4d3),
+	# matching librarian's shipped decision — "lesson gate: jury policy still
+	# wins over criterion_floor". This does not weaken floors: a violated floor
+	# still blocks on the arm below, and `meta_override: accept` still cannot
+	# lift one, because that veto lives further up and returns before any of
+	# this. What changed is only that a floor no longer HIDES a rejection.
+	#
+	# Ordering it the other way is what made floor_suffix on the jury arms dead
+	# code (ecosystem-cs8): behind `elif [[ -n $floor_failed ]]`, floor_failed
+	# was guaranteed empty by the time those arms ran, so the suffix always
+	# rendered as the empty string while two shipped docs described it working.
+	#
+	# The tests under "blocking-reason precedence" pin every arm. Nothing pinned
+	# them before, which is how a new arm went in ahead of two others under a
+	# comment asserting the precedence was unchanged.
 	if [[ "$score_ok" -ne 0 ]]; then
-		printf '{"passed":false,"reason":"low_score"}'
-	else
-		# Jury did not pass even though score cleared threshold — surface as
-		# meta_override when meta said reject, else dissent_unresolved.
+		printf '{"passed":false,"reason":"low_score"%s}' "$floor_suffix"
+	elif [[ "$jury_ok" -ne 0 ]]; then
 		if [[ "$meta_override" == "reject" ]]; then
-			printf '{"passed":false,"reason":"meta_override"}'
+			printf '{"passed":false,"reason":"meta_override"%s}' "$floor_suffix"
 		else
-			printf '{"passed":false,"reason":"dissent_unresolved"}'
+			printf '{"passed":false,"reason":"dissent_unresolved"%s}' "$floor_suffix"
 		fi
+	elif [[ -n "$floor_failed" ]]; then
+		printf '{"passed":false,"reason":"criterion_floor","failed_criterion":"%s"}' "$floor_failed"
+	else
+		printf '{"passed":true}'
 	fi
 }

package/plugins/tribunal/skills/tribunal/SKILL.md

@@ -117,9 +117,11 @@ For `iteration_number` from `0` while `iteration_number < max_iterations`:
 7. **Gate.**
    ```bash
    policy=$(printf '%s' "$rubric" | jq -r '.gate_policy // "majority"')
-   gate=$(tribunal_gate_decide "$policy" "$verdicts" "$aggregated" "$threshold" "$meta" "$dissent" "$dissent_threshold")
+   gate=$(tribunal_gate_decide "$policy" "$verdicts" "$aggregated" "$threshold" "$meta" "$dissent" "$dissent_threshold" "$rubric")
    ```
-   If `gate.passed == true`, emit `tribunal.gate.passed` with `final_score: aggregated` and break the loop with outcome `accepted`. Otherwise emit `tribunal.gate.blocked` with the `reason`, `will_retry: (iteration_number + 1 < max_iterations)`, and `retry_iteration_number` if retrying. Persist `gate.json` either way.
+   If `gate.passed == true`, emit `tribunal.gate.passed` with `final_score: aggregated` and break the loop with outcome `accepted`. Otherwise emit `tribunal.gate.blocked` with the `reason`, `will_retry: (iteration_number + 1 < max_iterations)`, and `retry_iteration_number` if retrying. **Whenever `gate.failed_criterion` is present, copy it onto the event payload as `failed_criterion` — whatever the `reason` is.** The gate names the criterion on **every** blocking arm, not only when `criterion_floor` won the precedence contest: a criterion scored far below its floor also drags the aggregate under `score_threshold`, so the *worst* failures surface as `low_score`. Copying it only on `criterion_floor` drops the diagnostic precisely where it matters most. That now holds for the Meta-Judge's short-circuit returns too (`bias_detected`, and the early `meta_override` / `dissent_unresolved` arms), so an absent `failed_criterion` means no floor was violated — one reason string never reports two different ways depending on which return produced it. Persist `gate.json` either way.
+
+   A `criterion_floor` block means the aggregate *cleared* its threshold and one criterion still failed its floor. Say so when you report it: "blocked on `safety` (0.30 < 0.80) despite an overall 0.82" is actionable, "blocked" is not.
 
    If blocking and retrying, build the retry digest (lowest-scoring criteria + meta override + dissent summary) and feed it into the next iteration's Actor prompt.
 
@@ -146,6 +148,6 @@ Keep the summary terse. The artifacts on disk are the long form.
 
 ## Error handling
 
-- If a judge subagent fails to return parseable JSON, treat that judge as `score: 0, passed: false, confidence: 0` and surface the parse error in `feedback_summary`. Do not abort the iteration — let the gate decide.
+- If a judge subagent fails to return parseable JSON, treat that judge as `score: 0, passed: false, confidence: 0` **and give it a `criterion_scores` object assigning `0` to every criterion in the active rubric.** Surface the parse error in `feedback_summary`. Do not abort the iteration — let the gate decide. A crashed judge was dispatched and produced nothing — that is the "assessed and failed" case, not the "did not assess" case. Omitting `criterion_scores` (or sending `{}`) would make the crash invisible to `weighted_mean`, which never reads `.score`, and the panel would score as though the judge had never been empaneled.
 - If the Meta-Judge fails, default to `verdict_quality: "questionable", bias_detected: false` so the gate falls back to score-based logic.
 - If event emission fails (schema validation), keep going and write a warning to stderr. The persisted artifacts on disk are still trustworthy.

package/scripts/lib/prompt-rules.sh

@@ -148,7 +148,12 @@ prompt_rules_pattern_matches() {
 prompt_rules_emit() {
   local session_id="${1:-unknown}"
   local event_type="${2:-}"
-  local payload_json="${3:-{\}}"
+  # Default the payload without inlining braces in the expansion. Both
+  # `${3:-{\}}` and `${3:-{}}` are wrong: the first keeps the backslash on
+  # bash 3.2 (macOS system bash), and the second appends a stray `}` to any
+  # payload that IS supplied, on every bash version.
+  local payload_json="${3:-}"
+  [ -z "$payload_json" ] && payload_json='{}'
   [[ -z "$event_type" ]] && return 1
   ensure_file_exists "$ONLOOKER_EVENTS_LOG" || return 1
 

package/test/bats/archivist-inject.bats

@@ -46,7 +46,7 @@ setup() {
   echo "$output" | jq -e '.hookSpecificOutput.hookEventName == "SessionStart"' >/dev/null
   local ctx
   ctx=$(echo "$output" | jq -r '.hookSpecificOutput.additionalContext')
-  [[ "$ctx" == *"use git remote SHA256 as project key"* ]]
+  [[ "$ctx" == *"use git remote SHA256 as project key"* ]] || return 1
   [[ "$ctx" == *"Archivist injected 1"* ]]
 }
 

package/test/bats/assayer-extract.bats

@@ -70,7 +70,7 @@ setup() {
 @test "extraction prompt includes the message and the JSON contract" {
 	run assayer_build_extraction_prompt "I ran the tests and they pass." 5
 	[ "$status" -eq 0 ]
-	[[ "$output" == *"I ran the tests and they pass."* ]]
-	[[ "$output" == *"TESTABLE SUCCESS CLAIM"* ]]
+	[[ "$output" == *"I ran the tests and they pass."* ]] || return 1
+	[[ "$output" == *"TESTABLE SUCCESS CLAIM"* ]] || return 1
 	[[ "$output" == *"at most 5 claims"* ]]
 }

package/test/bats/bursar-session-start.bats

@@ -68,8 +68,8 @@ _run_hook() {
 	_seed_ledger
 	_run_hook
 	[ "$status" -eq 0 ]
-	[[ "$output" == *"hookSpecificOutput"* ]]
-	[[ "$output" == *"SessionStart"* ]]
+	[[ "$output" == *"hookSpecificOutput"* ]] || return 1
+	[[ "$output" == *"SessionStart"* ]] || return 1
 	[[ "$output" == *"burned \$0.42"* ]]
 }
 
@@ -85,7 +85,7 @@ _run_hook() {
 		> "${dir}/sessions.jsonl"
 	_run_hook
 	[ "$status" -eq 0 ]
-	[[ "$output" == *"burned \$0.00"* ]]
+	[[ "$output" == *"burned \$0.00"* ]] || return 1
 	[[ "$output" != *"Enable governor"* ]]
 }
 

package/test/bats/cartographer-config.bats

@@ -80,3 +80,46 @@ setup() {
   echo "$v" | jq -e 'type == "array" and length > 0' >/dev/null
   echo "$v" | jq -e 'any(. == "node_modules")' >/dev/null
 }
+
+@test "undocumented_entity: defaults ship enabled with plugin and skill globs" {
+  cartographer_config_load ""
+  local enabled globs max
+  enabled=$(cartographer_config_undocumented_enabled)
+  globs=$(cartographer_config_undocumented_globs)
+  max=$(cartographer_config_undocumented_max_findings)
+  [ "$enabled" = "true" ]
+  [ "$max" = "20" ]
+  [ "$(printf '%s' "$globs" | jq -r 'length')" = "2" ] || return 1
+  [ "$(printf '%s' "$globs" | jq -r '.[0]')" = "plugins/*/" ]
+}
+
+@test "undocumented_entity: user settings can disable the phase" {
+  mkdir -p "${HOME}/.claude"
+  printf '%s\n' '{"cartographer":{"undocumented_entity":{"enabled":false}}}' \
+    > "${HOME}/.claude/settings.json"
+  cartographer_config_load ""
+  local enabled max
+  enabled=$(cartographer_config_undocumented_enabled)
+  max=$(cartographer_config_undocumented_max_findings)
+  [ "$enabled" = "false" ]
+  [ "$max" = "20" ]
+}
+
+@test "undocumented_entity: repo settings replace the glob list wholesale" {
+  local repo="${BATS_TEST_TMPDIR}/repo-glob"
+  mkdir -p "${repo}/.claude"
+  printf '%s\n' '{"cartographer":{"undocumented_entity":{"globs":["agents/*/"]}}}' \
+    > "${repo}/.claude/settings.json"
+  cartographer_config_load "$repo"
+  local globs
+  globs=$(cartographer_config_undocumented_globs)
+  [ "$(printf '%s' "$globs" | jq -r 'length')" = "1" ] || return 1
+  [ "$(printf '%s' "$globs" | jq -r '.[0]')" = "agents/*/" ]
+}
+
+@test "undocumented_entity: exclude defaults to empty" {
+  cartographer_config_load ""
+  local excl
+  excl=$(cartographer_config_undocumented_exclude)
+  [ "$(printf '%s' "$excl" | jq -r 'length')" = "0" ]
+}