Merge pull request #212 from benwu95/feat/203-record-judgment-gate-executor

feat(verify): record judgment-gate executor and cap self-verified grades

Author: benwu95

.agents/skills/prospec-ff/references/metadata-format.md

@@ -127,6 +127,9 @@ quality_log:
       - name: delta-spec-compliance
         result: WARN
         adjudicator: judgment
+        graded_by: fresh-subagent  # judgment only: fresh-subagent | in-session
+        executor: "strongest-tier model, fresh subagent"  # optional self-report
+        spend: 18500               # optional self-reported tokens
 ```
 
 - **`result` is always the gate three-state `PASS` / `WARN` / `FAIL`.** The `/prospec-verify`
@@ -144,6 +147,14 @@ quality_log:
 - **`adjudicator`** (optional, verify only) records who decided the dimension: `machine` for the
   engine-adjudicated ones (task completion, knowledge, tests) and `judgment` for the ones a
   fresh-context reviewer grades. Absent on entries written before the field existed.
+- **`graded_by` / `executor` / `spend`** (optional, judgment dimensions only) record the grading
+  context, so a PASS is attributable. `graded_by` is `fresh-subagent` or `in-session` — required for a
+  judgment dimension at the `verify record` write path (refused when absent), but optional at the
+  schema level so machine dimensions and pre-existing entries stay valid; `in-session` mechanically
+  caps the grade below S. `executor` is a free-string self-report (model / harness) and `spend` a
+  self-reported token count — both optional and non-blocking; they are recorded so a per-executor
+  statistic can be aggregated later, and no station consumes them yet. prospec detects no model:
+  all three are self-declared.
 - `warnings` is always present (use `[]` when none); each entry is one string.
 - Omit the optional keys entirely when they do not apply — do not write them as `null`/empty.
 

.agents/skills/prospec-new-story/references/metadata-format.md

@@ -127,6 +127,9 @@ quality_log:
       - name: delta-spec-compliance
         result: WARN
         adjudicator: judgment
+        graded_by: fresh-subagent  # judgment only: fresh-subagent | in-session
+        executor: "strongest-tier model, fresh subagent"  # optional self-report
+        spend: 18500               # optional self-reported tokens
 ```
 
 - **`result` is always the gate three-state `PASS` / `WARN` / `FAIL`.** The `/prospec-verify`
@@ -144,6 +147,14 @@ quality_log:
 - **`adjudicator`** (optional, verify only) records who decided the dimension: `machine` for the
   engine-adjudicated ones (task completion, knowledge, tests) and `judgment` for the ones a
   fresh-context reviewer grades. Absent on entries written before the field existed.
+- **`graded_by` / `executor` / `spend`** (optional, judgment dimensions only) record the grading
+  context, so a PASS is attributable. `graded_by` is `fresh-subagent` or `in-session` — required for a
+  judgment dimension at the `verify record` write path (refused when absent), but optional at the
+  schema level so machine dimensions and pre-existing entries stay valid; `in-session` mechanically
+  caps the grade below S. `executor` is a free-string self-report (model / harness) and `spend` a
+  self-reported token count — both optional and non-blocking; they are recorded so a per-executor
+  statistic can be aggregated later, and no station consumes them yet. prospec detects no model:
+  all three are self-declared.
 - `warnings` is always present (use `[]` when none); each entry is one string.
 - Omit the optional keys entirely when they do not apply — do not write them as `null`/empty.
 

.agents/skills/prospec-plan/SKILL.md

@@ -184,7 +184,7 @@ Read [`references/plan-verifier-rubric.md`](references/plan-verifier-rubric.md)
 
 Sub-agents are available here, so take the sub-agent path. Should a spawn fail at runtime anyway, degrade — degrade to a two-phase prompt isolation in this context, invoking an independent Architecture Verifier persona to audit plan.md and delta-spec.md, and explicitly notify the developer of the degraded path — and name the path you took. A degraded path is never a silent skip: the developer is told which path ran, every time.
 
-Audit `plan.md` and `delta-spec.md` against the rubric in an independent, fresh verification context (Architecture Verifier persona). When degraded to a single context, execute a dedicated verifier pass and notify the developer of the degraded mode.
+Audit `plan.md` and `delta-spec.md` against the rubric in an independent, fresh verification context (Architecture Verifier persona). **Route this verification to the strongest model / agent tier the harness makes available** — a verifier's detection power is bounded by its grader, so the strongest available tier is the goal (named abstractly — never a specific model or vendor; "strongest available" is resolved by the harness). When degraded to a single context, execute a dedicated verifier pass, disclose that the verification shares the planning context, and notify the developer of the degraded mode.
 
 **Step 3 — Verdict Handling & Break-Glass Override:**
 - **PASS**: No structural flaws or unmitigated risks found. Proceed.

.agents/skills/prospec-plan/references/candidate-evaluation.md

@@ -36,6 +36,11 @@ When generating architecture options ($N \le 3$, default 2 orthogonal options):
 
 ## Tournament Evaluation Criteria
 
+> **Route the Tournament Judge to the strongest model / agent tier the harness makes available** — a
+> judgment gate's discrimination is bounded by its judge, so the strongest available tier is the goal
+> (named abstractly — never a specific model or vendor; "strongest available" is resolved by the
+> harness). In single-context degraded mode, disclose that the judge shares the generation context.
+
 The Tournament Judge evaluates each candidate across three orthogonal dimensions:
 
 ### 1. Blast Radius & Complexity

.agents/skills/prospec-review/SKILL.md

@@ -52,6 +52,8 @@ nondeterministic serialization this contract exists to remove.
 - **B — single reviewer, multi-lens (default)**: one fresh-context reviewer covers every must-run lens in a single pass. Token-friendly; independence from the implementer is already satisfied.
 - **A — parallel lenses (opt-in)**: N independent lens agents run concurrently — available only when the capability line below resolves `can_spawn_subagent` to yes; it has no single-context equivalent. Use for large or high-risk diffs, or Scale=Full. Higher first-round cost buys maximum inter-lens independence.
 
+**Route the reviewer to the strongest model / agent tier the harness makes available** — a review gate's detection power is bounded by its reviewer, so the strongest available tier on a fresh context is the goal (named abstractly — never a specific model or vendor; "strongest available" is resolved by the harness). When you record the review baseline (`prospec check --record-review`), declare the grading context honestly with `--graded-by`: `fresh-subagent` for an independent context, `in-session` when the same session that implemented the change also reviewed it — recorded into `review_provenance.graded_by` as the honest grading-context record that informs the downstream verify station (the verify grade cap itself keys on each verify dimension's own `graded_by`).
+
 ### Review Lenses
 
 Must-run every round:
@@ -92,7 +94,7 @@ Emit this round's findings as a JSON array — `{id?, location, severity (minor|
 Review must leave a machine-queryable record so `/prospec-verify`'s Entry Gate can prove it ran and is still current:
 
 1. **Every round** — including a **review-clean** round (0 critical / 0 major) — record the round via `prospec change log --skill prospec-review --result PASS|WARN --criticals-found <n> --criticals-fixed <n> --majors <n> [--warning "<unresolved item>"]` (Bash; result `PASS` when clean, `WARN` when unresolved majors/FAIL carry forward). The counts come straight from `prospec review merge`'s round report. A clean review that records nothing is indistinguishable from a review that never ran — a round that finds nothing records the counts as `0`.
-2. **At loop convergence** (review-clean or escalation), run `prospec check --record-review` — it code-computes the reviewed change's digest and writes `review_provenance` to `metadata.yaml`. This is the baseline the `review-provenance` drift check compares against.
+2. **At loop convergence** (review-clean or escalation), run `prospec check --record-review --graded-by <fresh-subagent|in-session>` — it code-computes the reviewed change's digest and writes `review_provenance` (with the declared grading context) to `metadata.yaml`. This is the baseline the `review-provenance` drift check compares against.
 
 Because the digest is code-computed, editing the change's code after this point flips `review-provenance` to stale — `/prospec-verify` will then require a fresh review round before it runs.
 
@@ -104,7 +106,7 @@ Because the digest is code-computed, editing the change's code after this point
 - [ ] no unresolved critical (loop converged, or escalated to the human with the list)
 - [ ] every fix round left the project test suite (per [`references/project-test-runner.md`](references/project-test-runner.md)) green
 - [ ] `review.md` written with the findings table
-- [ ] a `prospec-review` `quality_log` entry recorded (every round, incl. review-clean) and the review baseline stamped via `prospec check --record-review`
+- [ ] a `prospec-review` `quality_log` entry recorded (every round, incl. review-clean) and the review baseline stamped via `prospec check --record-review --graded-by <context>`
 - [ ] every auto-fixed critical was verifier-confirmed before the fix (manual)
 
 ### Failure Conditions
@@ -116,7 +118,7 @@ Emit one line: `Met N/M | Unmet: <items> | Overall: PASS|WARN|FAIL | Next: <one-
 
 ### Exit Gate (Constitution)
 
-Verify the output against this skill's **site-specific** Constitution rule (**dependency-direction/layering** — the spec-architecture lens's concern), not the full Constitution; the every-principle audit is `/prospec-verify` V3/5 only. When the rule carries RFC-2119 severity (BL-031), grade by weight — MUST→FAIL, SHOULD→WARN, MAY→informational (the grade vocabulary stays PASS/WARN/FAIL). A free-text Constitution falls back to judgment-based grading. **Always** record a `prospec-review` entry to `metadata.yaml` `quality_log` (`skill: prospec-review` / `date` / `result` / `warnings`) — **every round, including review-clean** (result `PASS` when clean, `WARN` when unresolved majors/FAIL carry forward) — so `/prospec-verify` can machine-verify review ran and surface any majors; majors are advisory and do not block. Then record the review baseline (`prospec check --record-review`, see Review Provenance) and suggest `/prospec-verify`.
+Verify the output against this skill's **site-specific** Constitution rule (**dependency-direction/layering** — the spec-architecture lens's concern), not the full Constitution; the every-principle audit is `/prospec-verify` V3/5 only. When the rule carries RFC-2119 severity (BL-031), grade by weight — MUST→FAIL, SHOULD→WARN, MAY→informational (the grade vocabulary stays PASS/WARN/FAIL). A free-text Constitution falls back to judgment-based grading. **Always** record a `prospec-review` entry to `metadata.yaml` `quality_log` (`skill: prospec-review` / `date` / `result` / `warnings`) — **every round, including review-clean** (result `PASS` when clean, `WARN` when unresolved majors/FAIL carry forward) — so `/prospec-verify` can machine-verify review ran and surface any majors; majors are advisory and do not block. Then record the review baseline (`prospec check --record-review --graded-by <context>`, see Review Provenance) and suggest `/prospec-verify`.
 
 ## NEVER