@ssheleg/agent-stack 0.11.1 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog
 
+## v0.13.0 — 2026-08-20 — the audit refused a score and computed one
+
+`references/audit.md` said *"a prioritized change plan … **not** a score"* at `:20`, argued
+at `:22-25` that *"a number compresses away the only useful information"*, and then computed
+`P = blast × confidence / effort` at `:114` and ordered the plan by it at `:128`. The
+manifesto backs the refusal in the same words (`manifesto.md:424` — *"these axes are not a
+fake numerical score. They are a reason the team can inspect"*) and names **four** axes at
+`:419-422`: impact, **irreversibility**, uncertainty, **coordination**. Two of them appeared
+nowhere in the pack (`grep -ci irreversib` → 0, `grep -ci coordinat` → 0) and `effort` — a
+cost, not a risk — had been substituted for both.
+
+**Position taken: publish the axes, drop the arithmetic.** The number never did what its own
+paragraph claimed — `3 × 1 / 3` and `1 × 1 / 1` both print 1, so two findings a reviewer
+would rank very differently ranked identically.
+
+Three more, each with its plant:
+
+- **The ledger graded a tree, not an artifact.** Three sections said *unreleased* and
+  *"the version stays 0.11.1 and the CHANGELOG is untouched"* over 35 rows reading
+  `verified` — while v0.12.0 was tagged and published — against this file's own rule that a
+  row sits at `never` until its check has been watched passing **on the shipped artifact**.
+  Re-run against `git archive v0.12.0`, both commands exit 0.
+- **Three of four skill descriptions were past the house working limit**, one with five
+  characters of headroom before the platform's hard 1024. 1019 / 986 / 983 → **964 / 963 /
+  970**, every trigger intact (19→19, 12→12, 14→14), and 970 is a gate now.
+- **`test/plant_guard_test.py` leaked eight nameless temp trees per run and the gate said
+  nothing.** `test/residue.py` is **ported** from `make-skill`, not rewritten; the shared
+  pile went from growing to flat (2568 → 2576 measured, 0 growth from this suite).
+
+**Three guards were wrong first, and watching them fail is the only reason that is known:**
+the scalar check refused the paragraph that records the formula's removal; the ledger check
+read its own citation as a claim; and its `shipped in vX` pattern was **lowercase-only**
+while every real claim is capitalised — so it reported green over a file it had never read.
+
+Also corrected: `checks = 9 + len(skill_dirs)` was a hand-bumped literal that five ledger
+rows quote as evidence a guard was added. The true count at v0.12.0 was **10**, not 13.
+
+Negative self-tests 19 → **26**.
+
+
+## v0.12.0 — 2026-08-19
+
+Three places where this pack's own doctrine disagreed with the Proof of Done manifesto it
+is built on. Each was confirmed from *inside* the pack before anything was changed.
+
+### The gate before every convergence asked how sure a branch was, never what it could show
+
+The manifesto's checker contract is *arrived · matches its contract · **carries its
+evidence** · does not contradict a sibling*. This pack named five things and substituted
+**under-confident — a confidence signal below the bar** for the evidence item. In a family
+whose first value is Evidence over confidence, and whose own text says "an uncalibrated
+judge is an opinion with a number attached", the gate guarding every convergence never
+asked what a branch could show.
+
+Six mandatory items now, in run order, with `unevidenced` as item 3 — an assertion with no
+receipt, explicitly distinguished from *wrong*. **Arrival is a count**, not an accident: a
+never-returning branch is caught because it is missing, not because the host happened to
+null it. The confidence signal is kept and demoted to a hint: **low confidence flags,
+absent evidence blocks.**
+
+### A node was defined by three of its five fields, and read as whole
+
+`One input, one output, one job` — against the manifesto's five, which add **one owner** and
+**its own completion test**. Both texts then gave the same justification in nearly the same
+words, which is what let the abridged version read as complete.
+
+Worktree isolation answers **when** — two writers cannot corrupt one file. Ownership answers
+**whose** — which node's version is authoritative once the branches return. Isolation without
+ownership loses nothing during the run and moves the loss to the merge, where a silently
+one-sided merge is indistinguishable from a convergence that only ever had one answer. The
+`check` field matches `task-pipeline`'s exactly — same name, same one-string rule, same
+`parked` exemption — rather than inventing a second vocabulary for one idea.
+
+### The suite that could never be authored up front had to gate the first release
+
+`Never author the suite up front` read as an absolute because the pack had no word for the
+other tier: `grep -ci observable` and `grep -ci requirement` both returned **0**. Taken as
+written the rule made a first release ungateable — §3 names the offline suite "this is the
+gate", and a suite that may never be authored up front cannot exist before there is
+production to grow it from.
+
+Two clocks now. The **observable** is a criterion, written before the implementation. The
+**corpus** is a sample, grown from production. The original imperative survives word for
+word and gains only its subject: *"Never author the suite up front — the corpus, that is:
+the inputs."* Neither rule softens the other, because they govern different objects.
+
+Each contract is declared machine-readably with a floor and named keys, so an item cannot
+silently go missing again. Validator 10 → 13 checks; negative self-tests 15 → 19.
+
 ## v0.11.1 — 2026-08-16
 
 **This pack was the one place nothing was looking.** The family umbrella's shared checker

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@ssheleg/agent-stack",
-  "version": "0.11.1",
-  "description": "Production patterns for AI agent orchestrators \u2014 tool-calling loops, multi-stage pipelines with checkpoints, LLM provider routing with fallback, four-layer memory with confidence decay \u2014 plus the wallet side of reselling LLM access. This package is the installer CLI.",
+  "version": "0.13.0",
+  "scripts": {
+    "test": "python3 test/validate.py && python3 test/plant_guard_test.py"
+  },
+  "description": "Production patterns for AI agent orchestrators — tool-calling loops, multi-stage pipelines with checkpoints, LLM provider routing with fallback, four-layer memory with confidence decay — plus the wallet side of reselling LLM access. This package is the installer CLI.",
   "bin": {
     "agent-stack": "bin/agent-stack.js"
   },

package/plugins/agent-stack/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "agent-stack",
   "displayName": "Agent Stack",
   "description": "Two skills: agent-orchestrator \u2014 tool-calling loops, multi-stage pipelines with checkpoints, provider routing with fallback, four-layer memory, context engineering, plus the wallet side of reselling LLM access; and agent-evals \u2014 run/trace/thread evals, judges, and fixtures grown from production.",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/agent-stack/skills/agent-evals/SKILL.md

@@ -7,12 +7,11 @@ description: >-
   evals. Covers the three observability primitives (run, trace, thread) crossed with three
   eval granularities (single-step, full-turn, multi-turn), the offline/online/ad-hoc
   timing axis, pass-fail rubrics over scalar scores, cheap code checks before model
-  judges, the checker node as an evaluator running inside the graph, simulated users with
-  adversarial personas, annotation queues, and what to instrument so any of it is
-  possible. Triggers - "agent eval", "eval suite", "LLM judge", "regression fixture",
+  judges, the checker node as an evaluator inside the graph, simulated users with adversarial
+  personas, annotation queues, and what to instrument for any of it. Triggers - "agent eval", "eval suite", "LLM judge", "regression fixture",
   "trajectory eval", "checker node", "is the agent getting better", "эвалы агента",
   "оценка агента", "LLM-судья", "регрессионный набор", "как проверить агента". Not for
-  unit tests of ordinary code, or for benchmarking a model.
+  unit tests of ordinary code, or benchmarking a model.
 license: MIT
 ---
 
@@ -20,7 +19,8 @@ license: MIT
 
 An agent's behaviour does not exist in its source. The code says what it is *allowed* to
 do; only a run says what it *did*. So the artifact under test is the execution record,
-and the suite is grown from production rather than authored up front.
+and the suite runs on **two clocks**: the *observable* is authored up front, before the
+implementation exists, and the *corpus* it runs against is grown from production (§6).
 
 Three claims follow, and they are what makes this different from testing ordinary code:
 
@@ -28,7 +28,8 @@ Three claims follow, and they are what makes this different from testing ordinar
 - **Every natural-language input is unique**, so the edge cases cannot be enumerated
   offline. Production is not only where you catch what you missed — it is where you
   discover what to test for.
-- **Traces become test cases.** The suite grows from what actually happened.
+- **Traces become test cases.** The corpus grows from what actually happened; the
+  criterion it is measured against does not.
 
 ---
 
@@ -169,17 +170,27 @@ depends on **it** rather than on the branches — otherwise the gate has a bypas
 
 It matters here because it is the same machinery as §5, positioned differently:
 
+<!-- checker-contract: missing, empty, unevidenced, malformed, contradictory, off-topic | optional: under-confident -->
+
 | It catches | Decided by |
 |---|---|
-| an empty or null output | a code check |
-| a confidence signal below the downstream bar | a code check |
-| a shape that will break the consumer's parsing | a code check |
-| two outputs that cannot both be true | a judge |
-| an output answering a different question than the one asked | a judge |
-
-Three of five are free. Run them first — §5's *cheap checks first*, applied to a position
+| a **missing** branch — the arrival count falls short of the fan-out promised | a code check |
+| an **empty** or null result | a code check |
+| an **unevidenced** claim — nothing attached that a reader could re-check | a code check |
+| a **malformed** shape the consuming node cannot parse | a code check |
+| **contradictory** siblings, including two that paraphrased one shared assumption | a judge |
+| an **off-topic** answer to something nobody asked | a judge |
+
+Four of six are free. Run them first — §5's *cheap checks first*, applied to a position
 in the graph rather than to a suite.
 
+**An under-confident branch is a hint, not a row: its own confidence number is optional
+and deliberately not one of the six.** §5 above is the reason: a score from an
+uncalibrated source is an opinion, so it may order retries and it may not open a gate.
+The gate asks for the third row instead — a receipt — which is the same reason this pack
+ranks evidence over confidence everywhere else. The contract's home, with the argument in
+full, is `agent-orchestrator/references/graph-engineering.md` §6.
+
 **A checker is a node, so it can be wrong, and its failure mode is silent approval.** A
 model checker that has never been shown a bad input passes everything, and a graph with a
 checker that always says yes is **worse** than one with none: the missing checkpoint has
@@ -198,10 +209,34 @@ and they are eval work rather than orchestration work:
 Where the checker sits in the shape, and why the convergence needs one at all:
 `agent-orchestrator/references/graph-engineering.md`.
 
-## 6. The corpus grows from production
+## 6. Two clocks — the observable up front, the corpus from production
 
-Never author the suite up front. Every production failure and every thumbs-down becomes a
-fixture:
+Two different objects get called *the eval*, and they are written at opposite ends of the
+work. Naming them apart is what stops either rule from reading as the other's exception.
+
+<!-- eval-tiers: observable, corpus -->
+
+| Tier | Is | Written | Because |
+|---|---|---|---|
+| **Observable** | the criterion that would show one requirement was met — a pass/fail rubric (§4), a trajectory or state-change assertion (§2) | **before the implementation exists** | a requirement with no observable is unfinished: attach one afterwards and you are inventing the test having already seen the code, so the output has decided what counts as success |
+| **Corpus** | the inputs those criteria run against — fixtures, datasets, minimised production failures | **from production, never up front** | every natural-language input is unique, so the edge cases cannot be enumerated offline; inputs invented in advance test your imagination |
+
+**Neither rule softens the other, because they govern different objects.** An observable is
+a *criterion* — what would count as success. A corpus is a *sample* — which inputs you
+happen to have. The criterion costs nothing to write early and can only be written honestly
+early; the sample written early is green on inputs no user sends. Both therefore hold at
+full strength: **a requirement that ships without an observable is unfinished, and a corpus
+with no production in it is imagination.** The requirement itself gets its id and its
+definition of done from `task-pipeline`'s REQ spine — what this pack owns is the
+observable's *form*, not the register it hangs on.
+
+**The first release has no production, so its offline gate is observables only** (§3). That
+is not the corpus rule suspended for a special case: the corpus is empty because nothing has
+run yet, and it fills from the first real traces. Inventing *inputs* to fill it sooner would
+still be imagination.
+
+**Never author the suite up front** — the *corpus*, that is: the inputs. Every production
+failure and every thumbs-down becomes a fixture:
 
 1. Capture the state at the failure point.
 2. Minimise it to the smallest input that still reproduces.
@@ -257,6 +292,8 @@ None of the above runs without these, and they are the part people skip:
 - [ ] Every checker node watched refusing a planted output, its verdicts stored as scores,
       and its rejection rate on the dashboard — a checker at zero rejections is a finding
 - [ ] Domain-expert review for output a general judge cannot grade
+- [ ] Every requirement carries an **observable** written before the implementation — the
+      corpus waits for production, the criterion does not
 - [ ] Every production failure minimised into a permanent fixture
 - [ ] Annotation queue with filters, and the two reviewer roles kept separate
 - [ ] Simulated users trained on real transcripts, with adversarial personas

package/plugins/agent-stack/skills/agent-harness/SKILL.md

@@ -179,4 +179,5 @@ prompt.
 - [ ] One technique chosen per problem, with a reason — not ReAct because it was in a paper
 - [ ] Sub-agents return **distilled summaries**, not transcripts
 - [ ] The agent can be observed: which tool, which arguments, which observation, how many tokens
-- [ ] An eval exists before the prompt is tuned, or the tuning is folklore
+- [ ] An observable before the implementation, an eval before the prompt is tuned, or the
+      tuning is folklore — only the corpus waits for production

package/plugins/agent-stack/skills/agent-harness/references/audit.md

@@ -11,7 +11,7 @@ inherited codebase, or a "why is this unreliable" investigation.
 - Run the scanner first
 - Seven tracks
 - Evidence tiers
-- Priority, computed
+- Priority — four axes, and no scalar
 - The report
 - Traps
 
@@ -109,23 +109,56 @@ Every finding carries one, and the tier is part of the finding:
 **Never present judgement as measured.** A finding whose tier is honest survives the meeting
 where it is challenged; one that is inflated loses the whole report.
 
-## Priority, computed
+## Priority — four axes, and no scalar
 
-`P = blast × confidence / effort`
+`P = blast × confidence / effort` used to sit here, and it contradicted the two sections
+above it. "Not a score" and *pass/fail with a named failure condition beats a scalar that
+names no fix* cannot share a file with a number the plan is then ordered by.
 
-- **blast** 3 = a user of the system is harmed · 2 = the operator · 1 = a future maintainer
-- **confidence** 3 = measured · 2 = documented · 1 = judgement
-- **effort** 1 = under an hour · 2 = a session · 3 = its own project
+**And the number does not do what it claimed to do.** The section said the ranking "can be
+argued with on its inputs", but multiplication destroys them: `3 × 1 / 3` and `1 × 1 / 1`
+both print **1**, so *harms a user, judgement-tier, its own project* and *annoys a future
+maintainer, judgement-tier, an hour* arrive at one priority and nobody reading the output
+can tell which is which. A product is a one-way function on the very inputs the argument
+needs.
 
-Computed, not felt — so a dramatic finding nobody can act on ranks below a boring one that
-is fixed before lunch, and the ranking can be argued with on its inputs.
+<!-- priority-axes: impact, irreversibility, uncertainty, coordination -->
+
+So the inputs are published and the arithmetic is not. The axes are the manifesto's four
+(`~/DATA/pod-manifesto/manifesto.md:419-422`, under *these axes are not a fake numerical
+score* at `:424`), and two of them were absent here entirely while `effort` — a **cost**,
+not a risk axis — had been substituted into their place:
+
+| Axis | Question | High · Medium · Low |
+|---|---|---|
+| **Impact** | What is harmed if the finding is right? | a user of the system · the operator · a future maintainer |
+| **Irreversibility** | How hard is the harm to undo once it lands? | unrecoverable · recoverable with work · trivially reversible |
+| **Uncertainty** | How much of the behaviour cannot be checked deterministically? | unmeasurable here · measurable but unmeasured · measured |
+| **Coordination** | How many agents, repositories, services and owners meet at the fix? | many · two · one |
+
+**Ordering rule: the first axis that separates two findings decides, in that order.**
+Impact, then Irreversibility, then Uncertainty, then Coordination. It is inspectable in the
+direction the old formula was not — a reader who disagrees with the order of two findings
+can point at the axis that decided it and argue about that axis alone.
+
+**Effort keeps its job and loses its rank.** It is recorded per finding — under an hour · a
+session · its own project — and it never moves a finding up or down. It sizes the *first
+three items of the plan* so they can start immediately, which is the only decision it was
+ever good for. A cost that divides a risk is how "too expensive to fix" becomes "not
+important".
+
+**Uncertainty is not the old `confidence` renamed.** `confidence` graded the auditor's
+evidence; the axis grades what the *system* cannot be made to prove. The evidence grade
+still exists and is still required — it is the tier on every finding, one section up — and
+a finding whose tier is `judgement` says so there rather than being quietly discounted here.
 
 ## The report
 
 1. **One paragraph** — what the system is, which layer, and the single most important thing.
 2. **The scanner output**, including its blind-spot list, verbatim.
-3. **Findings by track**, each with observation, tier and priority.
-4. **The plan** — ordered by P, with the first three items sized so they can start immediately.
+3. **Findings by track**, each with observation, tier, the four axes and its effort.
+4. **The plan** — ordered by the axes above, first separating axis wins, with the first
+   three items sized by effort so they can start immediately.
 5. **What was not looked at**, and why. An audit that does not say where it stopped is read
    as complete.
 
@@ -135,7 +168,9 @@ is fixed before lunch, and the ranking can be argued with on its inputs.
   is often not in the repository at all — ask where it lives before concluding it is fine.
 - **Filing "no permission model" against a harness that delegates by design.** Check the
   layer first (`layers.md`).
-- **Grading instead of planning.** A score ends the conversation the audit was meant to start.
+- **Grading instead of planning.** A score ends the conversation the audit was meant to
+  start — including a score assembled from honest axes. Publish the axes; do not multiply
+  them.
 - **Confusing "no evals" with "not measured yet."** It is the root finding; put it first,
   because every other conclusion inherits it.
 - **Reading a silent scanner as a clean system.** It is silent about what it can see.

package/plugins/agent-stack/skills/agent-interop/SKILL.md

@@ -3,15 +3,15 @@ name: agent-interop
 description: >-
   Use when an agent must talk to something outside its own process — building or consuming an
   MCP server, exposing or calling another agent over A2A, publishing to the MCP Registry, or
-  putting a gateway in front of agent traffic. Carries the MCP 2026-07-28 wire surface and what
-  it deprecated (server/discover, stateless per-request _meta, elicitation in form and URL mode,
-  subscriptions/listen; sampling, roots, logging and dynamic client registration on the way out),
+  putting a gateway in front of agent traffic. Carries the MCP 2026-07-28 wire surface and what it
+  deprecated (server/discover, stateless per-request _meta, elicitation in form and URL mode,
+  subscriptions/listen; sampling, roots, logging and dynamic client registration going),
   A2A 1.0 agent cards, task states and three bindings, registry namespaces and server.json, tool
   federation, and what a gateway must do that an API gateway does not. Triggers - "MCP server",
   "MCP client", "A2A", "agent card", "agent interoperability", "MCP registry", "server.json",
   "agentgateway", "tool federation", "MCP-сервер", "карточка агента", "интероперабельность
-  агентов", "реестр MCP", "шлюз для агентов". Not for designing one server's tool set, and not
-  for a skill's own construction — that is make-skill.
+  агентов", "реестр MCP", "шлюз для агентов". Not for designing one server's tool set, nor for
+  a skill's own construction — that is make-skill.
 ---
 
 # Agent interop — the protocols an agent speaks outside its own process

package/plugins/agent-stack/skills/agent-orchestrator/SKILL.md

@@ -2,17 +2,16 @@
 name: agent-orchestrator
 description: >-
   Use when building an agent system — an orchestrator, an LLM-powered tool, a chatbot with tool
-  use, an AI pipeline — or when metering and billing the LLM access it burns. Covers tool-
-  calling loops, multi-stage pipelines with human checkpoints, provider routing with fallback
-  and retry, four-layer memory with confidence decay, context budgets, sub-agent coordination
-  and error hierarchies; the work as a graph — parallel layers, fake edges, a checker before
-  a convergence; for resale: tiered wallets, the single markup boundary, two-phase commit
-  across a database and a provider API, spend-delta polling, budget and loop guardrails,
-  per-tenant key lifecycle. Triggers - "agent", "orchestrator", "tool calling", "sub-agent",
-  "LLM router", "fallback chain", "human in the loop", "memory layer", "LLM billing", "token
-  wallet", "checker node", "агент", "оркестратор", "суб-агент", "роутер моделей", "человек в
-  цикле", "слой памяти", "биллинг LLM", "граф задач". Not for a single LLM call in a script,
-  or for prompt wording.
+  use, an AI pipeline — or metering and billing the LLM access it burns. Covers tool-calling
+  loops, pipelines with human checkpoints, provider routing with fallback/retry, four-layer
+  memory with confidence decay, context budgets, sub-agent coordination, error hierarchies; the
+  work as a graph — parallel layers, fake edges, a checker before convergence; for resale:
+  tiered wallets, one markup boundary, two-phase commit across database and provider API,
+  spend-delta polling, budget and loop guards, per-tenant keys. Triggers - "agent",
+  "orchestrator", "tool calling", "sub-agent", "LLM router", "fallback chain", "human in the
+  loop", "memory layer", "LLM billing", "token wallet", "checker node", "агент", "оркестратор",
+  "суб-агент", "роутер моделей", "человек в цикле", "слой памяти", "биллинг LLM", "граф задач".
+  Not for a single LLM call in a script, or prompt wording.
 ---
 
 # Agent Orchestrator — Production Best Practices
@@ -365,7 +364,8 @@ heading — the ones that were learned by getting them wrong:
       to the input is a function call wearing a costume
 - [ ] Model, window and price are resolved at one boundary from configuration or the
       provider — never from a table of vendor ids in source
-- [ ] An eval exists before the prompt is tuned, or the tuning is folklore
+- [ ] An observable before the implementation, an eval before the prompt is tuned, or the
+      tuning is folklore — only the corpus waits for production
 
 ## References
 

package/plugins/agent-stack/skills/agent-orchestrator/references/graph-engineering.md

@@ -49,10 +49,55 @@ Four things are **this pack's**, not the source's, and each is marked where it a
 
 ## 1. Node and edge
 
-**A node is one unit of work.** One input, one output, one job. Not *"research the topic,
-summarise it, and check the sources"* — that is three nodes wearing one name. The
-smaller and more defined the job, the more useful the node, because a node is also the
-unit you retry, cache, review and replace.
+**A node is one unit of work, and it has five fields.** One input, one job, one output,
+**one owner**, and **its own completion test**. Not *"research the topic, summarise it,
+and check the sources"* — that is three nodes wearing one name. The smaller and more
+defined the job, the more useful the node, because a node is also the unit you retry,
+cache, review and replace.
+
+<!-- node-contract: input, job, output, owner, check -->
+
+The first three get drawn every time. The last two are the ones a graph is usually drawn
+without — this file shipped without them until 2026-08-19 — and each has a failure that
+surfaces only at the convergence, where it is cheapest to mistake for success.
+
+**One owner — exactly one node is answerable for a given artifact.** Not one *agent*: the
+same subagent may own several nodes, and a node owned by a person is still a node. The
+unit of ownership is the artifact, and the assignment is made when the layer is built, not
+discovered when the writes come back.
+
+**Ownership is not what `isolation: "worktree"` gives you, and the two are complementary
+rather than alternatives.** §9's primitive table calls a private checkout the only safe way
+to fan out writers, and against a *race* that is true. Isolation answers **when**: two
+writers cannot corrupt one file, because neither can see the other's copy while it runs.
+Ownership answers **whose**: which node's version is authoritative once the branches
+return. Take isolation without ownership and nothing is lost during the run — the loss
+moves to the merge, which is the quieter place for it, because a convergence that silently
+takes one side is indistinguishable from a convergence that only ever had one answer. §4's
+first rule is the *detection* half of this: two independent workers writing one file are
+one node with a race in it. Ownership is the *assignment* half, and it is what makes
+fanning writers out decidable rather than merely survivable.
+
+**Its own completion test — the node names what will close it, before it runs.** One
+string: a command a verifier can run, or a named judgement standing in where no command
+can, with the judge named and the verdict recorded *as* judgement. Whatever it prints is
+that node's evidence row.
+
+The field's name across this family is **`check`** — `task-pipeline`'s node schema
+(`graph.schema.json`) carries it as one required string per node and exempts only a
+`parked` one, the single node nobody intends to close. Same name and same meaning here,
+one string and never a list, because a node needing two unrelated checks is a node doing
+two jobs and the answer is to split it. One gate built from two commands is `a && b`,
+which is still one gate.
+
+**A completion test is not a checker node, and carrying both is not redundancy.** §6's
+checker sits between a parallel layer and its convergence and judges *arriving siblings*
+from the outside — including the two things no node can establish about itself: whether it
+contradicts a neighbour, and whether it answered the question the layer was actually
+asked. The completion test is the node's own gate on its own output, run by whoever owns
+it. Drop the per-node test and the checker becomes the only gate in the graph, which is how
+a convergence ends up re-deriving what each branch should have proved about itself; drop
+the checker and every branch can pass its own test and still disagree with its neighbour.
 
 **An edge is a dependency, and it carries data.** It exists when the second node
 genuinely consumes what the first produced. Not when the second merely *happens after*
@@ -151,19 +196,44 @@ A node between the parallel layer and the convergence whose only job is to decid
 each output may proceed. It synthesises nothing and writes nothing. It answers *is this
 usable* and then passes, flags, retries or drops.
 
-Five things it must catch — the list is the contract, and a checker that cannot say which
-of the five it is asserting is not a checker:
-
-1. **Empty or null** — the node returned nothing usable.
-2. **Mutually contradictory** — two outputs that cannot both be true.
-3. **Off-topic** — an output that answers a different question than the one asked.
-4. **Under-confident** — a confidence signal below the bar for the downstream decision.
-5. **Malformed** — a shape that will break the convergence node's parsing.
-
-Three of the five are code checks (1, 4, 5) and cost nothing; only 2 and 3 need a model.
-Run them in that order — this is `agent-evals` §5's *cheap checks first*, applied to a
+Six things it must catch — the list is the contract, and a checker that cannot say which
+of the six it is asserting is not a checker:
+
+<!-- checker-contract: missing, empty, unevidenced, malformed, contradictory, off-topic | optional: under-confident -->
+
+1. **Missing** — a branch the split promised never came back at all. This item needs an
+   **arrival count**: the fan-out is fixed when the layer is built, so the checker is
+   handed the number of results to expect and compares it with the number it is holding.
+   Without that number a vanished branch is caught only when its slot happens to hold
+   nothing — item 2, by luck rather than by design, and only on a host that fills the slot
+   at all (§9's primitive table records what this one does with a thrower). A host that
+   simply drops it makes the gap invisible, and a short list looks like a complete one.
+2. **Empty or null** — the result arrived and carries nothing usable.
+3. **Unevidenced** — an assertion with no receipt: no citation, no tool result, no file
+   and line, nothing a later reader could re-check. Whether the claim is *wrong* is item 5
+   or 6's business; this item is about a claim nobody downstream can verify at all, and it
+   is the one most checkers are missing.
+4. **Malformed** — a shape that will break the convergence node's parsing.
+5. **Contradictory** — two results that cannot both be true, **including two that used
+   different words for one shared assumption**. The disagreement hides inside the
+   paraphrase, so comparing strings is not enough to find it.
+6. **Off-topic** — an output that answers a different question than the one asked.
+
+Four of the six are code checks (1–4) and cost nothing; only 5 and 6 need a model. Run
+them in that order — this is `agent-evals` §5's *cheap checks first*, applied to a
 position in the graph rather than to a test suite.
 
+**A confidence signal is optional, and it is not the evidence item.** *Under-confident*
+was item 4 of this list until 2026-08-19; it is kept, demoted to a hint. A branch's own
+number is worth carrying as exactly that — which result to retry first, which to hand to a
+person — and it is not a gate. It never stands in for item 3, and the argument is this
+pack's own, made twice already: *an uncalibrated judge is an opinion with a number
+attached* (`agent-evals` §5), and for anything consequential the control is a
+deterministic limit or a human, **never a classifier's confidence**
+(`references/governance.md`). A gate that asks a branch how sure it is and never asks
+what it can show has graded the run instead of measuring it. So: low confidence *flags*,
+absent evidence *blocks*.
+
 **What a checker costs, and how it turns into a rubber stamp — this pack's addition.** A
 checker is a node, so it has the failure mode of every node: it can be wrong. A model
 checker that has never been shown a bad input will pass everything, and a graph with a