disensor 0.9.2__tar.gz → 0.9.4__tar.gz

{disensor-0.9.2/src/disensor.egg-info → disensor-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: disensor
-Version: 0.9.2
+Version: 0.9.4
 Summary: Adversarial plan & code review with a declared residue. Emits, validates and CI-enforces residue declarations (residue/v0.4 schema).
 Author-email: Nicolas Rocchia <nicolasrocchia@gmail.com>
 License: MIT
@@ -56,7 +56,7 @@ paper is in Spanish; the glossary at the end maps its terminology to the schema.
 
 - `spec/residue.schema.json`: the artifact schema (JSON Schema 2020-12), version residue/v0.4. Superseded versions keep their own frozen resource next to it.
 - `spec/examples/`: three example artifacts, including a real anonymised event and the minimized profile with no free text.
-- `src/disensor/`: Python package with the validator (rules R0 to R10), the CI gate (checks G1 to G9), the PR comment rendering, artifact and repository scaffolding (`init`), and the packaged filling guide (`GUIDE.md`).
+- `src/disensor/`: Python package with the validator (rules R0 to R13), the CI gate (checks G1 to G9), the PR comment rendering, artifact and repository scaffolding (`init`), and the packaged filling guide (`GUIDE.md`).
 - `action.yml`: composite GitHub Action, ready to use.
 - `docs/integracion-claude-code.md` (Spanish only): how the real flow (Claude Code plus a reviewer from another family) emits the artifact at the close of each event.
 - `docs/antecedentes.md` (Spanish only): where the method sits relative to the literature (residual doubt and defeaters, design rationale and its capture bottleneck, multi-agent adversarial review, governance runtimes, supply chain provenance), with the verification status of each reference.
@@ -78,7 +78,7 @@ disensor new --gate diff --level B --round ../result.json   # declaration from t
 disensor prompt --gate diff            # the adversarial brief, to hand to a reviewer from another family
 disensor pack --gate diff --base main --head HEAD          # the full package, if you drive the round yourself
 disensor new --gate diff --level B     # template prefilled in .residue/
-disensor validate .residue/<id>.json   # schema + rules R0 to R10
+disensor validate .residue/<id>.json   # schema + rules R0 to R13
 disensor gate --no-comment             # what CI will run, locally
 
 disensor guide                         # the filling guide, for any agent or human
@@ -146,7 +146,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: NicolasRocchia/disensor@v0.9.2
+      - uses: NicolasRocchia/disensor@v0.9.4
 ```
 
 The gate validates the declarations **the PR adds**, applies the policy and
@@ -165,7 +165,7 @@ models by hand.
 
 ```bash
 disensor reviewer suggest          # what this machine has, offline
-disensor reviewer add codex --yes  # register it, once per machine
+disensor reviewer add codex --model <model> --yes  # once per machine, with a model your account runs
 
 disensor round --gate diff --generator-family anthropic \
   --base main --head HEAD --result ../result.json
@@ -207,13 +207,18 @@ declare what happened.
 
 ## What the gate enforces
 
-Per artifact (rules R0 to R10): coherence between findings and residue, counts
+Per artifact (rules R0 to R13): coherence between findings and residue, counts
 that add up, family decorrelation between generator and reviewer, mandatory
 material evidence in verifiable refutations (`text`, `link` or `hash`) against a
 verifiable target (`verification.against` other than `none`), mandatory human
 attention in interpretive refutations, a fix verified before closing a finding
 in a diff gate, rejection of generic markers (in English and in Spanish), and a
-minimized profile with the free text R9 covers stripped.
+minimized profile with the free text R9 covers stripped. From residue/v0.4 they
+also cover the coherence between declared independence and the families and
+models the declaration names (R4), the minimums of the degraded mode per level
+(R11) and its per-reviewer correlation residue (R12), and from this version the
+integrity of local identifiers: unique, and every reference to a reviewer
+resolves against the declared ones (R13).
 
 Per artifact, against the PR: level equal to the repository's declared one (G2),
 Level A blocked while governance is not validated (G3), reviewer confinement
@@ -288,6 +293,7 @@ to resolve:
 - **Organisation ruleset or required workflow**, defined outside the audited repository.
 - **Pin the Action by SHA**, not by tag: a tag is movable and is not a root of trust. `disensor init` resolves the tag of the installed version to the commit it points at and writes the workflow already frozen; without network at init time the tag stays and `disensor pin` finishes the job. The command resolves annotated tags to the commit they wrap, never to the tag object, which is the classic trap of doing it by hand. This repository's documentation still uses the tag, because it documents which version corresponds; the frozen SHA is produced by whoever deploys.
 - **Bootstrap**: the first PR that adds the config and the workflow cannot make itself the root of trust. Initial activation is an administrative step, prior to the gate meaning anything.
+- **When the pin goes up**: the workflow sits in the non-relaxable floor, so raising the pin through a PR costs an adversarial round for a change whose correctness a `git rev-parse` verifies better than any model. The convention in this repository is that a new pin **travels in the next PR of real work**, with its declaration, rather than in a PR of its own. **Exception**: if the release fixes gate security or changes the schema version, the pin goes up immediately, because the window in which the repository judges itself with the previous version stops being harmless: an old gate does not know the new contract and rejects what the freshly published CLI emits. This is a convention, not a control: as long as the branch does not require pull requests with bypass disabled for administrators too, nothing prevents pushing the pin directly ([#17](https://github.com/NicolasRocchia/disensor/issues/17)).
 
 Explicit limit: reading the policy from the base turns a one-step bypass into a
 two-step one, it does not eliminate it. Whoever can merge a relaxation uses it
@@ -319,21 +325,49 @@ not help if `event.pr` carries the URL. The schema says as much about the
 extension space: an identifier-shaped key can still carry a message. Treat
 `minimized` as a reduction of surface, not as a guarantee that nothing leaves.
 
+## What each number promises
+
+The package and the schema are numbered separately, and they promise different
+things.
+
+**Stable within a major series of the package.** The exit codes of
+`disensor round` (`0` reviewed, `1` error, `3` no round required, `4` chain
+exhausted, `5` tree modified during the round, `6` could not decide whether a
+round was required); the subcommands and flags documented in this file; the four
+inputs of the Action (`github-token`, `directory`, `config`, `python-version`);
+and the keys of `disensor.config.json`, which already fail closed on anything
+unknown. Breaking these needs a major.
+
+**Versioned on their own.** The declaration schema (`residue/vX.Y`, stated inside
+every artifact) and the result of `disensor round` (`result_version`). Neither
+follows the package numbering, and a change in them is not a package major.
+
+**No promise.** The reviewer registry on your machine, the recipe catalogue, and
+the ingestion API of the evidence plane. The catalogue is the one surface that
+depends on third-party CLIs: the Codex recipe changed the day an account stopped
+offering the model it named.
+
+**One asymmetry worth knowing before you pin.** The gate demands that a
+declaration a PR adds states the current schema version, and it rejects both
+superseded and *newer* ones. The Action installs the CLI from its own checkout,
+so the SHA you pin fixes which schema version your gate accepts. A schema change
+therefore requires updating that pin before declarations under the new version
+can merge.
+
 ## Conformance between implementations
 
-`spec/vectors/` holds the conformance vectors: 31 artifacts with their expected
+`spec/vectors/` holds the conformance vectors, one suite per schema version: 11 artifacts for v0.2, 35 for v0.3 and 43 for v0.4, each with its expected
 verdict (valid or not, and the rule labels that must fire). Every validator
 implementation has to pass them identically: the Python reference runs them in
 its suite (`tests/test_vectors.py`) and the TypeScript port of the evidence
 plane runs them with `npm run conformidad`. Labels are compared, not messages.
-The vectors are regenerated with `python -m disensor.vectors spec/vectors`.
+The vectors are regenerated with `python -m disensor.vectors <directory>`. The generator produces the current schema version and refuses to write over a suite that declares another one: overwriting a historical suite would erase the only negative coverage those rules have. The runner fails if a known version has no vectors declaring it, because otherwise a version can be claimed as supported without anything checking it, which is exactly how v0.2 got here. `spec/version_ordinality.json` carries the other shared vectors: the form of a schema identifier and which rules reach which declaration, both verified by both implementations.
 
 Each vector is validated under the schema of the version it declares. The
-TypeScript port implements the rules of **v0.2 and v0.3**: handed a v0.4
-artifact it says so and refuses, rather than returning a verdict without having
-run the rules that version added. So the two-independent-implementations claim
-currently covers up to v0.3; the Python reference is the only one that validates
-v0.4 ([#29](https://github.com/NicolasRocchia/disensor/issues/29)).
+TypeScript port implements the rules of **v0.2, v0.3 and v0.4**, so the
+two-independent-implementations claim covers the version the CLI emits. Handed a
+version it does not implement it says so and refuses, rather than returning a
+verdict without having run the rules that version added.
 
 `plano-evidencia/` holds the ingestion Worker (Cloudflare Workers plus D1) with
 the TypeScript port of the validator and the append-only integrity receipt. See
@@ -467,7 +501,20 @@ it says.
 
 ## Status
 
-v0.9.2, on **residue/v0.4**. This version makes `disensor guide` hand over the
+v0.9.4, on **residue/v0.4**. This version closes residue/v0.4: the TypeScript
+port validates v0.2, v0.3 and v0.4, so the two-independent-implementations claim
+covers the version the CLI emits; conformance runs 89 vectors across three suites
+plus 28 shared cases fixing the form of a schema identifier and which rules reach
+which declaration, and it fails when a known version has no vectors declaring it;
+the Level A floor is enforced; referential integrity enters as R13, guarded so it
+does not reach frozen versions; the frozen resources are verified by content and
+not only by name; and which rules reach which declaration stopped depending on
+the order the lines happen to be written in. The previous version writes down
+when the gate Action's own pin goes up: it travels in the next PR of real work, except when the release
+fixes gate security or changes the schema version, and it says out loud that
+this is a convention rather than a control
+([#17](https://github.com/NicolasRocchia/disensor/issues/17)). The previous
+version makes `disensor guide` hand over the
 event runbook as well as the artifact filling guide, so an agent that is not
 Claude Code gets from one command the same material the Claude Code skill
 carries, which is what the documentation had been promising since the round
@@ -487,10 +534,14 @@ residue/v0.3 hardens three points of the artifact, closing issues
 [#7](https://github.com/NicolasRocchia/disensor/issues/7) and
 [#8](https://github.com/NicolasRocchia/disensor/issues/8). See "Schema
 migration: residue/v0.2 to residue/v0.3". Decision closed in v0.2: schema keys
-and CLI in English (Spanish remains as CLI aliases). The schema may change up to
-v1.0; changes are declared in the schema itself. Decision open before v1.0: the
-definitive licence (MIT today; Apache-2.0 under consideration for its patent
-grant).
+and CLI in English (Spanish remains as CLI aliases). The schema may change;
+each version from residue/v0.2 onwards is frozen under its own identifier, and a
+declaration keeps being validated under the rules that judged it when it was
+emitted. The Spanish-keyed residuo/v0.1 is recognised and refused with migration
+instructions, not validated. No version is
+committed to as the point where the schema stabilises: when there is a contract
+ratified as stable, it will be said here. Open decision: the definitive licence
+(MIT today; Apache-2.0 under consideration for its patent grant).
 
 ## Licence
 

{disensor-0.9.2 → disensor-0.9.4}/README.md

@@ -31,7 +31,7 @@ paper is in Spanish; the glossary at the end maps its terminology to the schema.
 
 - `spec/residue.schema.json`: the artifact schema (JSON Schema 2020-12), version residue/v0.4. Superseded versions keep their own frozen resource next to it.
 - `spec/examples/`: three example artifacts, including a real anonymised event and the minimized profile with no free text.
-- `src/disensor/`: Python package with the validator (rules R0 to R10), the CI gate (checks G1 to G9), the PR comment rendering, artifact and repository scaffolding (`init`), and the packaged filling guide (`GUIDE.md`).
+- `src/disensor/`: Python package with the validator (rules R0 to R13), the CI gate (checks G1 to G9), the PR comment rendering, artifact and repository scaffolding (`init`), and the packaged filling guide (`GUIDE.md`).
 - `action.yml`: composite GitHub Action, ready to use.
 - `docs/integracion-claude-code.md` (Spanish only): how the real flow (Claude Code plus a reviewer from another family) emits the artifact at the close of each event.
 - `docs/antecedentes.md` (Spanish only): where the method sits relative to the literature (residual doubt and defeaters, design rationale and its capture bottleneck, multi-agent adversarial review, governance runtimes, supply chain provenance), with the verification status of each reference.
@@ -53,7 +53,7 @@ disensor new --gate diff --level B --round ../result.json   # declaration from t
 disensor prompt --gate diff            # the adversarial brief, to hand to a reviewer from another family
 disensor pack --gate diff --base main --head HEAD          # the full package, if you drive the round yourself
 disensor new --gate diff --level B     # template prefilled in .residue/
-disensor validate .residue/<id>.json   # schema + rules R0 to R10
+disensor validate .residue/<id>.json   # schema + rules R0 to R13
 disensor gate --no-comment             # what CI will run, locally
 
 disensor guide                         # the filling guide, for any agent or human
@@ -121,7 +121,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: NicolasRocchia/disensor@v0.9.2
+      - uses: NicolasRocchia/disensor@v0.9.4
 ```
 
 The gate validates the declarations **the PR adds**, applies the policy and
@@ -140,7 +140,7 @@ models by hand.
 
 ```bash
 disensor reviewer suggest          # what this machine has, offline
-disensor reviewer add codex --yes  # register it, once per machine
+disensor reviewer add codex --model <model> --yes  # once per machine, with a model your account runs
 
 disensor round --gate diff --generator-family anthropic \
   --base main --head HEAD --result ../result.json
@@ -182,13 +182,18 @@ declare what happened.
 
 ## What the gate enforces
 
-Per artifact (rules R0 to R10): coherence between findings and residue, counts
+Per artifact (rules R0 to R13): coherence between findings and residue, counts
 that add up, family decorrelation between generator and reviewer, mandatory
 material evidence in verifiable refutations (`text`, `link` or `hash`) against a
 verifiable target (`verification.against` other than `none`), mandatory human
 attention in interpretive refutations, a fix verified before closing a finding
 in a diff gate, rejection of generic markers (in English and in Spanish), and a
-minimized profile with the free text R9 covers stripped.
+minimized profile with the free text R9 covers stripped. From residue/v0.4 they
+also cover the coherence between declared independence and the families and
+models the declaration names (R4), the minimums of the degraded mode per level
+(R11) and its per-reviewer correlation residue (R12), and from this version the
+integrity of local identifiers: unique, and every reference to a reviewer
+resolves against the declared ones (R13).
 
 Per artifact, against the PR: level equal to the repository's declared one (G2),
 Level A blocked while governance is not validated (G3), reviewer confinement
@@ -263,6 +268,7 @@ to resolve:
 - **Organisation ruleset or required workflow**, defined outside the audited repository.
 - **Pin the Action by SHA**, not by tag: a tag is movable and is not a root of trust. `disensor init` resolves the tag of the installed version to the commit it points at and writes the workflow already frozen; without network at init time the tag stays and `disensor pin` finishes the job. The command resolves annotated tags to the commit they wrap, never to the tag object, which is the classic trap of doing it by hand. This repository's documentation still uses the tag, because it documents which version corresponds; the frozen SHA is produced by whoever deploys.
 - **Bootstrap**: the first PR that adds the config and the workflow cannot make itself the root of trust. Initial activation is an administrative step, prior to the gate meaning anything.
+- **When the pin goes up**: the workflow sits in the non-relaxable floor, so raising the pin through a PR costs an adversarial round for a change whose correctness a `git rev-parse` verifies better than any model. The convention in this repository is that a new pin **travels in the next PR of real work**, with its declaration, rather than in a PR of its own. **Exception**: if the release fixes gate security or changes the schema version, the pin goes up immediately, because the window in which the repository judges itself with the previous version stops being harmless: an old gate does not know the new contract and rejects what the freshly published CLI emits. This is a convention, not a control: as long as the branch does not require pull requests with bypass disabled for administrators too, nothing prevents pushing the pin directly ([#17](https://github.com/NicolasRocchia/disensor/issues/17)).
 
 Explicit limit: reading the policy from the base turns a one-step bypass into a
 two-step one, it does not eliminate it. Whoever can merge a relaxation uses it
@@ -294,21 +300,49 @@ not help if `event.pr` carries the URL. The schema says as much about the
 extension space: an identifier-shaped key can still carry a message. Treat
 `minimized` as a reduction of surface, not as a guarantee that nothing leaves.
 
+## What each number promises
+
+The package and the schema are numbered separately, and they promise different
+things.
+
+**Stable within a major series of the package.** The exit codes of
+`disensor round` (`0` reviewed, `1` error, `3` no round required, `4` chain
+exhausted, `5` tree modified during the round, `6` could not decide whether a
+round was required); the subcommands and flags documented in this file; the four
+inputs of the Action (`github-token`, `directory`, `config`, `python-version`);
+and the keys of `disensor.config.json`, which already fail closed on anything
+unknown. Breaking these needs a major.
+
+**Versioned on their own.** The declaration schema (`residue/vX.Y`, stated inside
+every artifact) and the result of `disensor round` (`result_version`). Neither
+follows the package numbering, and a change in them is not a package major.
+
+**No promise.** The reviewer registry on your machine, the recipe catalogue, and
+the ingestion API of the evidence plane. The catalogue is the one surface that
+depends on third-party CLIs: the Codex recipe changed the day an account stopped
+offering the model it named.
+
+**One asymmetry worth knowing before you pin.** The gate demands that a
+declaration a PR adds states the current schema version, and it rejects both
+superseded and *newer* ones. The Action installs the CLI from its own checkout,
+so the SHA you pin fixes which schema version your gate accepts. A schema change
+therefore requires updating that pin before declarations under the new version
+can merge.
+
 ## Conformance between implementations
 
-`spec/vectors/` holds the conformance vectors: 31 artifacts with their expected
+`spec/vectors/` holds the conformance vectors, one suite per schema version: 11 artifacts for v0.2, 35 for v0.3 and 43 for v0.4, each with its expected
 verdict (valid or not, and the rule labels that must fire). Every validator
 implementation has to pass them identically: the Python reference runs them in
 its suite (`tests/test_vectors.py`) and the TypeScript port of the evidence
 plane runs them with `npm run conformidad`. Labels are compared, not messages.
-The vectors are regenerated with `python -m disensor.vectors spec/vectors`.
+The vectors are regenerated with `python -m disensor.vectors <directory>`. The generator produces the current schema version and refuses to write over a suite that declares another one: overwriting a historical suite would erase the only negative coverage those rules have. The runner fails if a known version has no vectors declaring it, because otherwise a version can be claimed as supported without anything checking it, which is exactly how v0.2 got here. `spec/version_ordinality.json` carries the other shared vectors: the form of a schema identifier and which rules reach which declaration, both verified by both implementations.
 
 Each vector is validated under the schema of the version it declares. The
-TypeScript port implements the rules of **v0.2 and v0.3**: handed a v0.4
-artifact it says so and refuses, rather than returning a verdict without having
-run the rules that version added. So the two-independent-implementations claim
-currently covers up to v0.3; the Python reference is the only one that validates
-v0.4 ([#29](https://github.com/NicolasRocchia/disensor/issues/29)).
+TypeScript port implements the rules of **v0.2, v0.3 and v0.4**, so the
+two-independent-implementations claim covers the version the CLI emits. Handed a
+version it does not implement it says so and refuses, rather than returning a
+verdict without having run the rules that version added.
 
 `plano-evidencia/` holds the ingestion Worker (Cloudflare Workers plus D1) with
 the TypeScript port of the validator and the append-only integrity receipt. See
@@ -442,7 +476,20 @@ it says.
 
 ## Status
 
-v0.9.2, on **residue/v0.4**. This version makes `disensor guide` hand over the
+v0.9.4, on **residue/v0.4**. This version closes residue/v0.4: the TypeScript
+port validates v0.2, v0.3 and v0.4, so the two-independent-implementations claim
+covers the version the CLI emits; conformance runs 89 vectors across three suites
+plus 28 shared cases fixing the form of a schema identifier and which rules reach
+which declaration, and it fails when a known version has no vectors declaring it;
+the Level A floor is enforced; referential integrity enters as R13, guarded so it
+does not reach frozen versions; the frozen resources are verified by content and
+not only by name; and which rules reach which declaration stopped depending on
+the order the lines happen to be written in. The previous version writes down
+when the gate Action's own pin goes up: it travels in the next PR of real work, except when the release
+fixes gate security or changes the schema version, and it says out loud that
+this is a convention rather than a control
+([#17](https://github.com/NicolasRocchia/disensor/issues/17)). The previous
+version makes `disensor guide` hand over the
 event runbook as well as the artifact filling guide, so an agent that is not
 Claude Code gets from one command the same material the Claude Code skill
 carries, which is what the documentation had been promising since the round
@@ -462,10 +509,14 @@ residue/v0.3 hardens three points of the artifact, closing issues
 [#7](https://github.com/NicolasRocchia/disensor/issues/7) and
 [#8](https://github.com/NicolasRocchia/disensor/issues/8). See "Schema
 migration: residue/v0.2 to residue/v0.3". Decision closed in v0.2: schema keys
-and CLI in English (Spanish remains as CLI aliases). The schema may change up to
-v1.0; changes are declared in the schema itself. Decision open before v1.0: the
-definitive licence (MIT today; Apache-2.0 under consideration for its patent
-grant).
+and CLI in English (Spanish remains as CLI aliases). The schema may change;
+each version from residue/v0.2 onwards is frozen under its own identifier, and a
+declaration keeps being validated under the rules that judged it when it was
+emitted. The Spanish-keyed residuo/v0.1 is recognised and refused with migration
+instructions, not validated. No version is
+committed to as the point where the schema stabilises: when there is a contract
+ratified as stable, it will be said here. Open decision: the definitive licence
+(MIT today; Apache-2.0 under consideration for its patent grant).
 
 ## Licence
 

{disensor-0.9.2 → disensor-0.9.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "disensor"
-version = "0.9.2"
+version = "0.9.4"
 description = "Adversarial plan & code review with a declared residue. Emits, validates and CI-enforces residue declarations (residue/v0.4 schema)."
 readme = "README.md"
 requires-python = ">=3.10"

{disensor-0.9.2 → disensor-0.9.4}/src/disensor/GUIDE.es.md

@@ -175,11 +175,14 @@ de `valid.*` y de `false_positives.*` es igual a la cantidad de hallazgos en ese
 estado, `escalated_open` lo mismo, y `total_findings` es el largo de la lista.
 Contá, no estimes.
 
-Las reglas atrapan menos de lo que esa frase sugiere. R6 compara solo cuando la
-lista de hallazgos no está vacía, y en el perfil completo R10 chequea
-`total_findings` contra una lista vacía pero no los baldes. Así que
-`findings: []` con un balde en uno pasa las dos. Que los conteos estén bien es
-tu responsabilidad; el validador atrapa algunas discrepancias, no todas.
+Las reglas atrapan menos de lo que esa frase sugiere. R6 compara los conteos
+contra la lista siempre que la lista esté, vacía incluida, y en el perfil
+completo R10 además la exige y rechaza una lista vacía cuyo `total_findings`
+diga otra cosa. Lo que ninguna de las dos puede chequear es si cada hallazgo
+lleva el estado terminal correcto: un hallazgo anotado como incorporado cuando
+en realidad se refutó deja todos los conteos coherentes. Que los estados estén
+bien es tu responsabilidad; el validador atrapa discrepancias, no
+clasificaciones equivocadas.
 
 ## Perfil minimizado
 

{disensor-0.9.2 → disensor-0.9.4}/src/disensor/GUIDE.md

@@ -170,11 +170,13 @@ Either `items` or the express absence, never an empty field.
 that state, `escalated_open` likewise, `total_findings` equals the list
 length. Count, do not estimate.
 
-The rules catch less than that sentence suggests. R6 compares only when the
-findings list is non-empty, and in the full profile R10 checks `total_findings`
-against an empty list but not the buckets. So `findings: []` with a bucket set
-to one passes both. Getting the counts right is on you; the validator catches
-some mismatches, not all of them.
+The rules catch less than that sentence suggests. R6 compares the counts against
+the list whenever the list is there, empty included, and in the full profile R10
+also demands the list and rejects an empty one whose `total_findings` says
+otherwise. What neither of them can check is whether each finding carries the
+right terminal state: a finding recorded as incorporated when it was really
+refuted keeps every count coherent. Getting the states right is on you; the
+validator catches mismatches, not misclassification.
 
 ## Minimized profile
 

{disensor-0.9.2 → disensor-0.9.4}/src/disensor/__init__.py

@@ -1,2 +1,2 @@
 """disensor: residue declaration of adversarial review (controlled disagreement)."""
-__version__ = "0.9.2"
+__version__ = "0.9.4"

{disensor-0.9.2 → disensor-0.9.4}/src/disensor/gate.py

@@ -171,6 +171,34 @@ def canonical_repo_path(raw: str, root: Path, label: str) -> str:
     return "/".join(parts)
 
 
+def _level_a_without_coverage(config: dict | None) -> bool:
+    """La combinacion que el nivel A no admite. `None` es una config ilegible."""
+    if not isinstance(config, dict):
+        return False
+    return (config.get("criticality_level") == "A"
+            and config.get("gate", {}).get("required") is False)
+
+
+def _refuse_level_a_without_coverage(config: dict, where: str) -> None:
+    """En nivel A, apagar la cobertura no es una preferencia: la vacia.
+
+    Con `gate.required=false`, un PR de codigo sin declaracion no crea ningun
+    revisor sobre el que comprobar el piso, asi que la exigencia de familia
+    distinta y endurecimiento probado no se aplica a nada y el gate queda verde.
+    El nivel A esta reservado para lo que no se puede deshacer: o significa lo
+    que dice o no significa nada.
+    """
+    if config.get("criticality_level") != "A":
+        return
+    if config.get("gate", {}).get("required") is False:
+        raise GateFailure(
+            f"{where}: Level A with gate.required=false. Turning coverage off leaves no "
+            "declaration to check the floor against, so the level that demands a cross-family "
+            "reviewer with tested hardening would demand it of nothing. Lower the level or "
+            "leave coverage on"
+        )
+
+
 def validate_config_shape(config: dict, where: str) -> None:
     old = V01_CONFIG_KEYS & set(config)
     if old:
@@ -423,6 +451,20 @@ def classify_requirement(ctx: GateContext) -> ReviewRequirement:
     # ortogonal a la necesidad de ronda, el gate las reporta por su cuenta y
     # sigue evaluando el resto. Quedan en el contexto para que `round` pueda
     # advertir sin mezclar las dos preguntas.
+    if (ctx.config.get("criticality_level") == "A"
+            and not ctx.config["gate"].get("required", True)):
+        # El gate rechaza esta politica, asi que el preflight no puede contestar
+        # que no hace falta ronda: son las dos caras de la misma decision, y que
+        # difieran es exactamente lo que esta funcion existe para impedir.
+        return ReviewRequirement(
+            status="blocked",
+            code="level_a_without_coverage",
+            reason=(
+                "the policy declares Level A with gate.required=false. With coverage off there "
+                "is no declaration to check the floor against, and the gate refuses it: fix the "
+                "policy before running a round against it"
+            ),
+        )
     if not ctx.config["gate"].get("required", True):
         return ReviewRequirement(
             status="not_required",
@@ -753,6 +795,18 @@ def _run_gate(directory, config_path, base, head, repo_dir: Path, post: bool) ->
                     "Level A (the reviewer only reads, and that is guaranteed with permissions, not "
                     "with the brief)"
                 )
+            if ev.get("criticality_level") == "A" and r.get("hardening") != "verified":
+                # El campo es opcional en el esquema, asi que omitirlo evitaba
+                # R12 y pasaba el nivel A: la exigencia vivia solo en el camino
+                # feliz del runner, que es justo el que no recorre quien arma la
+                # declaracion a mano.
+                declarado = r.get("hardening", "not declared")
+                own.append(
+                    f"[G4] reviewer {r['reviewer_id']}: hardening '{declarado}' in Level A. The "
+                    "level reserved for what cannot be undone demands a reviewer whose "
+                    "neutralisation of project instructions was tested, and that has to be "
+                    "declared"
+                )
             if not conf["verified"] and gate_cfg.get("warn_unverified_confinement", True):
                 warnings.append(
                     f"{path}: confinement of reviewer {r['reviewer_id']} without post-run verification"
@@ -769,6 +823,19 @@ def _run_gate(directory, config_path, base, head, repo_dir: Path, post: bool) ->
     valid = [a for a in artifacts if a.valid]
     required = gate_cfg.get("required", True)
 
+    if config.get("criticality_level") == "A" and not required:
+        # La politica que gobierna este PR deja el nivel A sin nada sobre que
+        # aplicar el piso, y eso falla cerrado. Pero no puede trabar el PR que
+        # viene a arreglarlo: si el head la repara, el repositorio necesita
+        # poder mergearlo, o queda sin salida.
+        gate_errors.append(
+            f"[G3] {cfg_path} declares Level A with gate.required=false. With coverage off there "
+            "is no declaration to check the floor against, so the level that demands a "
+            "cross-family reviewer with tested hardening would demand it of nothing. Repairing "
+            "this policy is an administrative step, like the initial activation: the gate cannot "
+            "wave through the PR that fixes the rules it is judging by"
+        )
+
     if required:
         coverage_errors, coverage_notes, _demanding = evaluate_coverage(
             artifacts, ordinary, config, evidence_root, cfg_path
@@ -787,6 +854,18 @@ def _run_gate(directory, config_path, base, head, repo_dir: Path, post: bool) ->
             if not isinstance(head_raw, dict):
                 raise GateFailure("the configuration is not an object")
             validate_config_shape(head_raw, f"{cfg_path} (head of the PR)")
+            # Una forma invalida en el head es un problema del futuro y avisa.
+            # Dejar el nivel A sin cobertura no: si esto se mergea, el proximo
+            # PR de codigo pasa sin declaracion y el piso no tiene sobre que
+            # aplicarse. El gate protege el merge, y este lo debilita.
+            if (head_raw.get("criticality_level") == "A"
+                    and head_raw.get("gate", {}).get("required") is False):
+                gate_errors.append(
+                    f"[G3] {cfg_path} at the head of the PR leaves Level A with "
+                    "gate.required=false. Merging it would turn coverage off for the level "
+                    "reserved for what cannot be undone, and the floor would have no "
+                    "declaration to apply to"
+                )
             base_raw = (
                 json.loads(gitctx.show_text(base_oid, cfg_path, repo_dir))
                 if gitctx.path_exists(base_oid, cfg_path, repo_dir)