agentic-qe 3.12.3 → 3.13.1

package/.codex/hooks/ruflo-codex-hook.cjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+let input = {};
+let rawInput = '';
+try {
+  rawInput = fs.readFileSync(0, 'utf8');
+  input = JSON.parse(rawInput || '{}');
+} catch {
+  process.exit(0);
+}
+
+const git = input.cwd
+  ? spawnSync('git', ['-C', input.cwd, 'rev-parse', '--show-toplevel'], {
+      encoding: 'utf8',
+      timeout: 1000,
+    })
+  : null;
+const root = git && git.status === 0 ? git.stdout.trim() : '';
+if (!root) process.exit(0);
+
+const requested = process.argv[2];
+if (!requested) process.exit(0);
+
+const toolInput = input.tool_input || {};
+const toolResponse = input.tool_response || input.tool_result || {};
+const args = [requested];
+
+function add(flag, value) {
+  if (value !== undefined && value !== null && String(value).length) {
+    args.push(flag, String(value));
+  }
+}
+
+switch (requested) {
+  case 'route':
+  case 'pre-task':
+    add('--task', input.prompt || input.user_prompt || toolInput.prompt);
+    break;
+  case 'pre-command':
+  case 'post-command':
+    add('--command', toolInput.command);
+    if (requested === 'post-command') {
+      add('--success', toolResponse.success !== false);
+    }
+    break;
+  case 'pre-edit':
+  case 'post-edit':
+    add(
+      '--file',
+      toolInput.file_path || toolInput.path || toolInput.target_file,
+    );
+    if (requested === 'post-edit') {
+      add('--success', toolResponse.success !== false);
+    }
+    break;
+  case 'session-restore':
+  case 'session-end':
+    add('--session-id', input.session_id);
+    break;
+  case 'post-task':
+    add('--task-id', input.agent_id || input.subagent_id || input.turn_id);
+    add('--success', true);
+    break;
+  default:
+    break;
+}
+
+const codexHelper = path.join(root, '.codex', 'hooks', 'ruflo-runtime.cjs');
+const helper = fs.existsSync(codexHelper)
+  ? codexHelper
+  : path.join(root, '.claude', 'helpers', 'ruflo-hook.cjs');
+if (!fs.existsSync(helper)) process.exit(0);
+
+// Ruflo is development-time coordination tooling. Keep this hook fail-open,
+// avoid network installation during a lifecycle event, and suppress its
+// provider-specific output rather than exposing unsupported Codex hook fields.
+spawnSync(process.execPath, [helper, ...args], {
+  cwd: root,
+  env: {
+    ...process.env,
+    CLAUDE_PROJECT_DIR: root,
+    RUFLO_HOOK_NPX: '0',
+  },
+  input: rawInput,
+  stdio: ['pipe', 'ignore', 'ignore'],
+  timeout: Number(process.env.RUFLO_CODEX_HOOK_TIMEOUT_MS) || 15000,
+});
+
+process.exit(0);

package/.codex/hooks.json

@@ -0,0 +1,169 @@
+{
+  "description": "AQE routing, lifecycle learning, and edit/command guardrails for Codex.",
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/aqe-codex-hook.cjs\" session-start",
+            "timeout": 25,
+            "statusMessage": "Loading AQE learning context"
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" session-restore",
+            "timeout": 15,
+            "statusMessage": "Restoring ruflo coordination context"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/aqe-codex-hook.cjs\" route",
+            "timeout": 20,
+            "statusMessage": "Routing through the AQE fleet"
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" route",
+            "timeout": 15,
+            "statusMessage": "Recording ruflo task routing"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "^Bash$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/aqe-codex-hook.cjs\" pre-command",
+            "timeout": 20,
+            "statusMessage": "Applying AQE command guardrails"
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" pre-command",
+            "timeout": 15,
+            "statusMessage": "Assessing command risk with ruflo"
+          }
+        ]
+      },
+      {
+        "matcher": "^(apply_patch|Edit|Write)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/aqe-codex-hook.cjs\" pre-edit",
+            "timeout": 20,
+            "statusMessage": "Applying AQE edit guardrails"
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" pre-edit",
+            "timeout": 15,
+            "statusMessage": "Loading ruflo edit context"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "^Bash$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/aqe-codex-hook.cjs\" post-command",
+            "timeout": 20,
+            "statusMessage": "Recording AQE command outcome"
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" post-command",
+            "timeout": 15,
+            "statusMessage": "Recording command outcome in ruflo"
+          }
+        ]
+      },
+      {
+        "matcher": "^(apply_patch|Edit|Write)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/aqe-codex-hook.cjs\" post-edit",
+            "timeout": 20,
+            "statusMessage": "Recording AQE edit outcome"
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" post-edit",
+            "timeout": 15,
+            "statusMessage": "Recording edit outcome in ruflo"
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "matcher": "manual|auto",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" session-end",
+            "timeout": 15,
+            "statusMessage": "Checkpointing ruflo state before compaction"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" pre-task",
+            "timeout": 15,
+            "statusMessage": "Registering subagent task with ruflo"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" post-task",
+            "timeout": 15,
+            "statusMessage": "Recording subagent outcome in ruflo"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/aqe-codex-hook.cjs\" session-end",
+            "timeout": 20,
+            "statusMessage": "Saving AQE session state"
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/ruflo-codex-hook.cjs\" session-end",
+            "timeout": 15,
+            "statusMessage": "Saving ruflo session state"
+          }
+        ]
+      }
+    ]
+  }
+}

package/CHANGELOG.md

@@ -5,6 +5,165 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.13.1] - 2026-07-23
+
+Fixes four reported issues, three of which come down to the same thing: a tool
+told you something it had not actually established. Coverage analysis reported
+numbers it never measured, test generation claimed AI enhancement it never
+performed, and a security advisory reached users through a dependency they never
+asked for.
+
+### Fixed
+
+- **Coverage analysis no longer reports numbers it did not measure** ([#569]).
+  On a Rust crate, `coverage_analyze_sublinear` returned `78.3%` lines,
+  `100%` branches and `0%` functions — none of it measured. It flagged
+  `#[cfg(test)]` blocks as untested production code, cited line numbers past the
+  end of the file, and analysed test files as coverage targets, all with a
+  confidence score attached. Rust crates are now measured with `cargo llvm-cov`
+  when it is available. When nothing can be measured, the result says so
+  (`estimated: true`, `measured: false`) instead of presenting a guess as data.
+- **`test_generate_enhanced` actually calls your LLM now** ([#567]). The tool
+  advertised AI-powered generation but the LLM router never reached the code path
+  it runs, so it always returned the same generic scaffold regardless of how you
+  configured your provider. It now routes through your configured model, and the
+  result reports `llmEnhanced` so a silent fall back to templates is visible
+  rather than something you infer from a suspiciously fast response. A broken
+  provider (bad key, timeout) reports the fallback honestly instead of claiming
+  enhancement it did not perform.
+- **A HIGH-severity advisory no longer reaches consumers** ([#565]).
+  `@huggingface/transformers` was declared an *optional* peer dependency, but npm
+  installs optional peers — so every install pulled in
+  `onnxruntime-node -> adm-zip` and its advisory. It is now an explicit opt-in:
+  install it yourself only if you want local in-process embeddings. Everyone
+  using an embedding endpoint (the default) no longer carries the advisory.
+- **`codex` is selectable through the LLM router.** The provider existed and
+  worked, but was missing from the router's provider list, so it could never
+  actually be chosen.
+- **Fixes now take effect immediately after an upgrade.** Operation results were
+  cached per project and keyed without the build version, so an upgraded install
+  could keep replaying the previous version's answers for up to an hour — making
+  a fix look like it had not worked. Set `AQE_SESSION_CACHE_SALT` to force a cold
+  cache at any time.
+
+### Added
+
+- **Per-agent LLM routing you can configure on disk** ([#568]). Route individual
+  agent types through different providers via an `agentOverrides` map in
+  `.agentic-qe/llm-config.json` — a strong reasoning model for security agents, a
+  free local model for mechanical ones — without changing your global default:
+
+  ```jsonc
+  {
+    "defaultProvider": "ollama",
+    "agentOverrides": {
+      "qe-security-scanner": { "provider": "claude-code", "model": "opus" },
+      "qe-mutation-tester":  { "provider": "ollama" }
+    }
+  }
+  ```
+
+  Entries are partial (unset fields keep their defaults), invalid entries are
+  dropped with an explanation rather than failing startup, and credentials are
+  never persisted here. See `docs/guides/llm-provider-routing.md`.
+- **`AQE_COVERAGE_NO_EXEC=1` — opt out of running build tooling.** Measuring
+  coverage means running your project's tests, which executes code from the
+  analysed repository (`cargo` also runs `build.rs`; `npx` runs lifecycle
+  scripts). That is what you want for your own code, but is worth being able to
+  turn off when pointing the tool at something you do not trust. Existing
+  coverage reports are still read; everything else degrades to a labelled
+  estimate.
+- **QE skills and lifecycle hooks for the Codex CLI.** `aqe init` now installs
+  three Codex-native skills — `aqe-test-change`, `aqe-review-quality`,
+  `aqe-plan-quality` — under `.agents/skills/`, plus Codex lifecycle hooks in
+  `.codex/`, and an `AGENTS.md` describing the repository's conventions. If you
+  drive this project with Codex rather than Claude Code, the QE workflows are now
+  available there natively instead of Claude-only.
+- **Security scans state how deeply they looked.** Full SAST is implemented for
+  JS/TS only; other languages get cross-language pattern matching. Results now
+  carry `analysisDepth`, so a zero-finding scan reads as "nothing matched a
+  generic pattern" rather than "no vulnerabilities".
+
+### Changed
+
+- **BREAKING (result shape):** `coverage_analyze_sublinear` now returns
+  `null` — not `0` — for any coverage metric that was not collected.
+  `lineCoverage`, `statementCoverage`, `branchCoverage` and `functionCoverage`
+  are all `number | null`. `0` now means a measured zero; `null` means unknown.
+  Callers doing arithmetic or comparisons on these fields should handle `null`;
+  check the new `measured` / `estimated` flags to tell the cases apart. This is
+  deliberately a visible break rather than a silent wrong number.
+
+[#565]: https://github.com/proffesor-for-testing/agentic-qe/issues/565
+[#567]: https://github.com/proffesor-for-testing/agentic-qe/issues/567
+[#568]: https://github.com/proffesor-for-testing/agentic-qe/issues/568
+[#569]: https://github.com/proffesor-for-testing/agentic-qe/issues/569
+
+## [3.13.0] - 2026-07-18
+
+Introduces **QE-Court** — an adversarial review court where a change is
+prosecuted by independent AI reviewers from *different vendors*, each with its
+own probe set, and a `SHIP` verdict must survive an escalating deeper review
+before it stands (`SHIP` / `REMAND` / `BLOCK`). It debuted by reviewing this
+very release — and blocked it, catching three data-loss/crash bugs a green unit
+suite had missed (all fixed below). This release also adds a Codex (GPT) provider
+so the court can seat a genuinely cross-vendor reviewer, a statistical
+significance gate for the self-learning flywheel, automatic `memory.db` recovery,
+and per-agent cost tracking.
+
+### Added
+
+- **QE-Court — adversarial review as a verdict (`/qe-court`).** Convenes
+  independent, cross-vendor reviewers (Codex/GPT, Cognitum, Claude) against a
+  diff/PR/test-suite; a passing grade must *survive* an escalating overturn round
+  before it stands. Emits a signed court record with a three-valued verdict. The
+  court's rules are enforced in code and verified by a runnable acceptance eval
+  (`aqe eval run --skill qe-court`) — trust tier 3.
+- **Codex CLI provider — run QE on your ChatGPT subscription.** A `codex`
+  provider (like the existing `claude-code` one) shells out to `codex exec`, so
+  GPT-family models cost against your subscription rather than a per-token API
+  key. Gives the fleet a cross-vendor engine for review diversity and fallback.
+- **Statistical significance gate for the self-learning flywheel.** A new
+  `accept/v1+sig` promotion rule requires a candidate's held-out gain to be
+  *statistically significant* (paired bootstrap CI > 0), not just larger by any
+  amount — so the flywheel no longer promotes within-noise improvements.
+- **Automatic `memory.db` recovery.** If the learning database opens genuinely
+  corrupt, AQE now restores the newest integrity-verified backup automatically
+  and parks the corrupt file (never deletes it), instead of asking you to restore
+  by hand. Deliberately conservative — a healthy database is never touched.
+- **Per-agent cost attribution.** The spend ledger now records which QE agent
+  incurred each LLM charge, so cost can be broken down across the fleet.
+- **Cognitum QE cost-Pareto benchmark** (`scripts/cognitum-qe-bench/`). A
+  self-contained harness that measures, per QE task, the cheapest model tier that
+  clears the quality bar against `api.cognitum.one` — so tier routing is set by
+  evidence. First finding: on these tasks the cheap tier matched or beat the
+  frontier tier at 3–4× less cost.
+- Draft `/v1/qe/verdict` API specification for a future hosted QE-Court service.
+
+### Fixed
+
+- **4 HIGH-severity CVEs no longer reach consumers (#565).** `@huggingface/`
+  `transformers` (which pulled a vulnerable `onnxruntime-node` → `adm-zip`) is now
+  an optional peer dependency, so a default `npm install agentic-qe` no longer
+  installs it. Local/in-process embeddings still work when the package is present;
+  endpoint-based embeddings are unaffected.
+- **Three data-loss / crash bugs caught by QE-Court's own first review.**
+  (1) A subscription-provider subprocess exiting early could crash the calling
+  process with an unhandled `EPIPE`; (2) the new auto-restore could tear the
+  database under concurrent access or misdiagnose a *healthy* database on certain
+  bind-mount filesystems and revert to an older backup — both fixed to be atomic,
+  locked, and conservative; (3) a failed spend-ledger migration could silently
+  stop recording spend, bypassing the budget cap. Plus witness-verification now
+  fails closed by default and the flywheel gate rejects statistically
+  under-powered samples.
+
+### Changed
+
+- The user-facing QE skill count is now **76** (adds `qe-court`), with **50**
+  Tier-3 verified skills. `CONTRIBUTING.md` now clarifies that `ruflo` /
+  `claude-flow` are development-time tooling, **not** runtime dependencies of the
+  shipped package.
+
 ## [3.12.3] - 2026-07-17
 
 Fixes a bug that could silently switch off vector search — permanently. If an

package/README.md

@@ -147,7 +147,7 @@ Or invoke an agent through the Task tool:
 | | **Plugin** | **`aqe init`** |
 |---|---|---|
 | Setup | One slash command | Full project setup |
-| Scope | 11 agents, 9 skills | 60 agents, 85 skills |
+| Scope | 11 agents, 9 skills | 60 agents, 86 skills |
 | Persistent learning DB | No (uses MCP server's) | Yes (`.agentic-qe/memory.db`) |
 | Cross-platform support | Claude Code only | 11 platforms (Cursor, Copilot, Cline, etc.) |
 | Use when | Quick start, single Claude Code project | Production team setup, multi-platform, full fleet |
@@ -275,7 +275,7 @@ Agents automatically apply relevant skills from the skill library. Skills are ra
 | **Tier 0 — Advisory** | 5 | Guidance only |
 
 <details>
-<summary><b>View all 75 skills</b></summary>
+<summary><b>View all 76 skills</b></summary>
 
 **Core Testing (12):** agentic-quality-engineering, holistic-testing-pact, context-driven-testing, tdd-london-chicago, xp-practices, risk-based-testing, test-automation-strategy, refactoring-patterns, shift-left-testing, shift-right-testing, regression-testing, verification-quality
 
@@ -285,7 +285,7 @@ Agents automatically apply relevant skills from the skill library. Skills are ra
 
 **Domain Skills (11):** qe-test-generation, qe-test-execution, qe-coverage-analysis, qe-quality-assessment, qe-defect-intelligence, qe-requirements-validation, qe-code-intelligence, qe-visual-accessibility, qe-chaos-resilience, qe-learning-optimization, qe-iterative-loop
 
-**Strategic (8):** six-thinking-hats, brutal-honesty-review, sherlock-review, cicd-pipeline-qe-orchestrator, bug-reporting-excellence, consultancy-practices, quality-metrics, pair-programming
+**Strategic (9):** six-thinking-hats, brutal-honesty-review, sherlock-review, qe-court (adversarial review court — SHIP/REMAND/BLOCK verdict that must survive escalating cross-vendor reviewers; see [ADR-124](docs/implementation/adrs/ADR-124-qe-court-adversarial-verdict-service.md)), cicd-pipeline-qe-orchestrator, bug-reporting-excellence, consultancy-practices, quality-metrics, pair-programming
 
 **Testing Techniques (9):** exploratory-testing-advanced, test-design-techniques, test-data-management, test-environment-management, test-reporting-analytics, testability-scoring, technical-writing, code-review-quality, api-testing-patterns
 

package/assets/skills/qe-court/SKILL.md

@@ -0,0 +1,186 @@
+---
+name: "qe-court"
+description: "Adversarial review court — a delivery (diff, PR, test suite, or artifact) is prosecuted by independent AI reviewers from different vendors, each with its own probe set, then a SHIP verdict must SURVIVE escalating deeper reviewers before it stands. Use when you want more than one reviewer's opinion on whether something is safe to ship: pre-merge gating, release go/no-go, catching a too-easy PASS, or any 'is this actually done?' decision where a shallow approval is a risk. Produces a signed court record with a three-valued verdict (SHIP / REMAND / BLOCK) and a human as final judge. Learns over time: reproduced charges and overturned SHIPs feed the QE flywheel."
+trust_tier: 3
+validation:
+  schema_path: schemas/output.json
+  validator_path: scripts/validate-config.json
+  eval_path: evals/qe-court.yaml
+  status: passing
+  passRate: 1.0
+  criticalPassRate: 1.0
+  lastValidated: "2026-07-18"
+---
+
+# QE-Court: Adversarial Review as a Verdict
+
+## Purpose
+
+One reviewer — even a strong one — is one Einstein squinting at the chalkboard.
+QE-Court convenes **independent adversaries from different vendors, with different
+roles and different probe sets**, makes them attack the delivery, and then forces
+any `SHIP` verdict to *survive* an escalating deeper review before it stands. You
+stay in the loop as the final judge. Implements ADR-124; composes ADR-117..122.
+
+**The one rule that makes it a court and not a rubber stamp:** a passing grade is
+the *claim under attack*, not the finish line. A shallow `91/100 SHIP` that a
+deeper reviewer can overturn is a bug in the review, not a delivery that shipped.
+
+## When to convene the court
+
+- Pre-merge gate on a risky PR or diff
+- Release go/no-go ("deployment readiness with a jury")
+- You got a PASS that felt too easy and want it stress-tested
+- A test suite claims coverage you don't trust (does it kill mutants?)
+- Any high-stakes "is this actually done?" call
+
+For a quick single-lens review, use `/sherlock-review`, `/brutal-honesty-review`,
+or `/code-review` instead — the court is for when one opinion isn't enough.
+
+## The court roster (composes existing skills/agents — do NOT reimplement critics)
+
+| Role | Who | Job |
+|------|-----|-----|
+| **Defense** | writer model (summarizer) | States the case-FOR-ship from the evidence. Never grades. |
+| **Prosecution** | `qe-devils-advocate`, `brutal-honesty-review`, `sherlock-review`, `qe-security-scanner`, `qe-mutation-tester`, **`codex exec review`** | Each files CHARGES against the delivery, **with its own probe set**, blind to the others until filing. |
+| **Blind refuter** | `src/verification/adversarial-verify` | Tries to KILL weak charges (default-refuted-if-uncertain). |
+| **Jury** | two-gate LLM-judge (ADR-119), cross-model | Weighs surviving charges → verdict + (optional) score. |
+| **Deeper reviewer** | higher effort/model tier of any prosecutor | The overturn round. |
+| **Judge** | **you (the human)** | Sees the strongest case for AND against; rules. |
+
+> ⚠️ **Do NOT run the reduced 3-dimension QCSD workflow as the court engine.** It
+> can falsely rate SHIP by skipping the security / mutation / defect lanes. Spawn
+> the *specialized* `qe-*` prosecutors above, or you reproduce the exact
+> false-SHIP the court exists to catch. (ADR-124; see `qcsd-development-swarm`.)
+
+## Model routing (configurable — this is the point of the court)
+
+The court's guarantees come from **who** reviews, not just how. Routing is
+**user-configurable** in `config.json` under `routing`; the defaults below enforce
+the invariants. Every model call goes through AQE's provider layer (ADR-123), so
+budget caps and cost receipts apply automatically.
+
+| Step | Default provider / tier | Why |
+|------|------------------------|-----|
+| **Defense** | `cognitum-low` or `claude-code` (may equal writer) | Cheap; states the case, never grades |
+| Prosecutor — devils-advocate | `cognitum-mid` | Gap/assumption hunting |
+| Prosecutor — brutal-honesty | `claude-code` (Opus/Sonnet) | Rigor lens, different family from jury |
+| Prosecutor — sherlock | `cognitum-high` | Deductive/root-cause needs a strong model |
+| Prosecutor — security-scanner | SAST tool + `cognitum-mid` | Determinism where possible |
+| Prosecutor — mutation | mutation tool + `local`/booster | Test-adequacy is mechanical |
+| Prosecutor — codex-review | `codex` (ChatGPT sub) | **Cross-vendor GPT brain — true writer≠juror; ≈$0** |
+| **Jury** (two-gate judge) | `cognitum-high` or Opus, `provider ≠ writer` | Must not grade its own family's output |
+| **Deeper reviewer** | highest tier / best-of-N @ higher effort | Escalation must be *stronger* than the base panel |
+
+**Provider menu** (mix freely in `routing`): `claude-code` (Claude subscription),
+`cognitum-{low,mid,high}` (Cognitum's own multi-model tiers — one option, it routes
+internally), `openrouter` (**use when you want many distinct models** across vendors
+for breadth), `codex` (GPT via ChatGPT subscription), `claude`/`openai`/`gemini`
+(metered APIs), `ollama` (local). Cognitum and OpenRouter are *separate* options:
+Cognitum already resolves multiple models behind its tiers; OpenRouter is the lever
+when you explicitly want to name several different models.
+
+**Enforced invariants** (defaults; do not weaken without reason):
+1. **≥2 distinct vendors** across the panel — Claude / Cognitum / GPT-via-Codex — not just tiers.
+2. **Jury provider ∉ {writer, defense}** — no model grades its own or its writer's output.
+3. All calls routed through `ProviderManager` → ADR-123 budget cap + receipts.
+
+## The protocol
+
+```
+DELIVERY (diff / PR / test-suite / artifact)
+   │  1. DEFENSE  — writer model states the case for shipping, from evidence only.
+   │  2. PROSECUTION (parallel, blind) — N specialized reviewers, DIFFERENT vendors,
+   │     each generates its OWN probe set and files CHARGES (finding + reproduction).
+   │  3. KILL ROUND — blind refuters attack each charge; weak/unreproducible ones dropped.
+   │  4. JURY — two-gate judge, cross-model, writer≠juror. 3-valued verdict.
+   │     A numeric score is emitted ONLY if its rubric passed the ADR-122 ANOVA screen.
+   │  5. OVERTURN ROUND — if verdict == SHIP, escalate ONE deeper reviewer. Loop-until-dry:
+   │     SHIP only STANDS if K consecutive deeper rounds find nothing new. Surviving fatal → flip.
+   │  6. SIGNED COURT RECORD — provenance-tier surviving charges (ADR-121), sign (ADR-118).
+   ▼  HUMAN JUDGE (you) — rules SHIP / REMAND / BLOCK on the strongest case both ways.
+```
+
+## Verdict states (three-valued — never a bare pass/fail)
+
+| Verdict | Meaning | Trigger |
+|---------|---------|---------|
+| **SHIP** | Survived the overturn round | No fatal charge survived K deeper rounds |
+| **REMAND** | Fixable charges — back to author | Non-fatal charges survived; delivery is close |
+| **BLOCK** | A fatal charge survived | ≥1 fatal charge reproduced and not refuted |
+
+## Self-learning — the court feeds the flywheel (ADR-124 M0.B)
+
+A verdict is not the end; it is training signal. After each court run:
+
+1. **Sign the court record → a flywheel receipt.** Use the ADR-118 signer
+   (`src/learning/qe-flywheel/receipt.ts` `createSigner` / `platform-signer.ts`,
+   persisted via `receipt-store.ts`). The verdict + surviving charges are the body.
+2. **Each reproduced, surviving charge → a `qe_pattern`** (ADR-110) at provenance
+   tier **`oracle:test-exec`** (ADR-121 — it reproduced, so it is oracle-grade).
+   Killed/refuted charges are NOT stored as positives (noise control).
+3. **An overturned SHIP is the highest-value signal there is** — persist
+   `{shallow: SHIP, true: BLOCK|REMAND, charge}` as a discriminator training pair
+   for the frozen anchor (ADR-117) and two-gate judge (ADR-119). This is what makes
+   the court *harder to fool* over time.
+4. **Retrieval-augment the next panel:** seed each prosecutor's probe set with the
+   HNSW-nearest prior charges for similar deliveries (`qe_pattern_embeddings`).
+
+All writes are **appends** to existing stores — never destructive to `memory.db`.
+
+## Improvement over time (ADR-124 M0.C)
+
+- **Probe-set promotion:** track each probe's historical **mutant-kill rate**;
+  promote high-kill probes, retire dead ones (stored under a `qe-court/probes` namespace).
+- **DoE-gated scoring:** emit a numeric score ONLY if its rubric passes the ADR-122
+  ANOVA screen (it must actually discriminate). Otherwise report the verdict class +
+  charges, no number — never a noise "91/100".
+- **Learnable overturn depth K:** start K=2; learn per-domain the depth at which new
+  charges stop appearing (the empirical loop-until-dry tail).
+
+## Anti-collusion invariants (enforce these or it isn't a court)
+
+1. **Writer ≠ any juror.** 2. **Prosecutors file blind.** 3. **Overturn is asymmetric**
+(SHIP must survive escalation; BLOCK needs one surviving fatal charge). 4. **No un-validated scores.**
+
+## How to run it (today)
+
+QE-Court is an orchestration skill: the driving agent convenes the court by
+composing existing agents/skills — there is no monolithic binary yet (a thin
+`aqe court` CLI wrapper is planned as ADR-124 Phase 1; the hosted `/v1/qe/verdict`
+is Phase 2). To run a court now:
+
+1. Read `config.json` for the panel + `routing` + `overturnDepth`.
+2. Spawn the prosecutors **in one message, in parallel** (`Task`/`Agent`,
+   `run_in_background: true`), each with its routed provider; run
+   `codex exec review` for the cross-vendor lens via Bash.
+3. Collect charges → run the blind-refuter kill round (`adversarial-verify`).
+4. Jury (two-gate judge) → verdict. If SHIP, run the overturn loop to `overturnDepth`.
+5. Emit the signed court record; persist learning per the section above.
+6. Present the strongest case FOR and AGAINST to the human judge.
+
+## Output: the court record
+
+Markdown: the delivery under review, the Defense case, each prosecutor's surviving
+charges (provenance-tiered, with the vendor that filed them), the kill-round
+casualties, the jury verdict, the overturn transcript, and the signed verdict block.
+Durable, attestable evidence — the "jury waiting for everything you ship."
+
+## Trust tier
+
+**Tier 3 (verified).** The court's falsifiable invariants are enforced in code
+(`src/skills/qe-court/referee.ts`) and covered by an oracle suite
+(`tests/unit/skills/qe-court/referee.test.ts`) that the acceptance eval
+(`evals/qe-court.yaml`, command-eval mode) runs through the `aqe eval` CLI —
+6/6 green as of 2026-07-18. The keystone oracle: a seeded mutant a shallow panel
+rated SHIP is overturned to BLOCK when the overturn round is active, and MUST
+regress to SHIP at `overturnDepth: 0` — proving the mechanic carries its weight.
+Run it yourself: `aqe eval run --skill qe-court --model cognitum-low`.
+
+## Related
+
+- Reference implementation of ADR-124; hosted sibling is `/v1/qe/verdict` (Cognitum, planned).
+- Prosecutors: `/brutal-honesty-review`, `/sherlock-review`, `qe-devils-advocate` agent, `codex exec review`.
+- Verification core: `src/verification/adversarial-verify`. Signer: `src/learning/qe-flywheel/receipt.ts`.
+- Jury/rigor: ADR-117 (frozen anchor), ADR-119 (two-gate judge), ADR-121 (provenance), ADR-122 (DoE).
+- Contrast: `/code-review`, `/pr-review` (single-lens); `qcsd-cicd-swarm` (phase gate, not adversarial court).

package/assets/skills/qe-court/config.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "./config-schema.json",
+  "_description": "QE-Court adversarial review configuration (ADR-124). Auto-created on first run. Edit `routing` to choose which provider/model runs each court role. All providers route through AQE's ADR-123 provider layer (budget caps + receipts apply).",
+  "prosecutors": ["devils-advocate", "brutal-honesty", "sherlock", "security-scanner", "mutation", "codex-review"],
+  "overturnDepth": 2,
+  "emitScore": false,
+  "routing": {
+    "_note": "provider ids: claude-code | cognitum-{low,mid,high} | openrouter | codex | claude | openai | gemini | ollama. Cognitum resolves multiple models behind its tiers; use openrouter when you want to name several distinct models for breadth.",
+    "defense": { "provider": "cognitum-low" },
+    "prosecutor.devils-advocate": { "provider": "cognitum-mid" },
+    "prosecutor.brutal-honesty": { "provider": "claude-code", "model": "sonnet" },
+    "prosecutor.sherlock": { "provider": "cognitum-high" },
+    "prosecutor.security-scanner": { "provider": "cognitum-mid" },
+    "prosecutor.mutation": { "provider": "ollama" },
+    "prosecutor.codex-review": { "provider": "codex" },
+    "jury": { "provider": "cognitum-high" },
+    "deeperReviewer": { "provider": "codex" }
+  },
+  "options": {
+    "blindFiling": true,
+    "writerIsNeverJuror": true,
+    "minDistinctVendors": 2,
+    "requireDoeGatedScore": true,
+    "signCourtRecord": true
+  },
+  "_setupPrompt": "If unsure, keep the default 3-vendor panel (Claude + Cognitum + Codex/GPT). ALWAYS include 'security-scanner' and 'mutation' for security- or test-quality-sensitive deliveries — omitting them is how a false SHIP happens. The jury provider MUST differ in vendor from the writer/defense (writerIsNeverJuror). Set emitScore=true only after the scoring rubric has passed the ADR-122 ANOVA screen."
+}