The Skeptic Protocol

Adversarial review that stays independent by design

Why adversarial review matters

  • A reviewer who has seen the implementer's reasoning is anchored to that framing
  • Self-review catches typos. It does not catch flawed assumptions.
  • The value of review is independence - seeing the output without the justification
  • The Skeptic sees only the output and the adversarial brief, never the Worker's reasoning process
  • This is not optional polish. It is the protocol's primary quality gate.
A resumed Skeptic has heard its own prior criticism - it gets polite and misses things. Fresh context is what gives the review teeth.

The core loop

Primary agent spawns Worker (with adversarial brief + task)
    |
Worker implements, returns output
    |
Primary agent spawns fresh Skeptic (with brief + output)
    |
Skeptic classifies findings: Critical / Major / Minor
    |
No Critical/Major? ──> Sign-off granted ──> Done
    |
Critical/Major found? ──> Route to new Worker ──> Loop back
  1. The primary agent orchestrates - it never implements Elevated work itself
  2. Each Worker is a fresh spawn (never a resumed one), briefed with prior rounds' context
  3. Each Skeptic is a fresh spawn - never continued, never resumed
  4. The loop repeats until the Skeptic grants sign-off or the re-route limit is hit

The adversarial brief

The brief defines the threat model the Skeptic must adopt. It is domain-specific - not generic.

"An attacker controls one compromised account and one compromised device. What can they access, modify, or forge? Look for: session fixation, token replay, privilege escalation paths, and any state the server trusts without re-verifying."

  • The primary agent writes it (or extends a template) and passes it to both Worker and Skeptic verbatim
  • The agent must not soften, summarize, or editorialize the brief
  • Nor may it inject a conductor hypothesis, suspicion, or attention-steer - neutrality and completeness are independent axes, with no carve-out for an operator-attributed steer
  • Mechanically enforced at spawn time (enforce-skeptic-neutrality.py): denies an untagged claim in field 7, or a conductor-composed-steer phrase in the brief
  • The ban covers every field, every form, tagged or untagged - the hook checks only two bounded surfaces; the reviewing Skeptic's Step 3.9 Neutrality check is the control for the rest
  • The underlying rule is general, not Skeptic-only - it binds every spawn brief, to any recipient role; see subagent-protocol.md Section 11 "Spawn-brief provenance"
  • The three sections the conductor composes itself (attack surface, questions the review must answer explicitly, repo-specific hazards) are slots with a stated item form, defined once in subagent-protocol.md Section 11 "Brief section form" - the pasted template is not a slot
  • Templates exist for: auth, API endpoints, crypto, DB migrations, data pipelines, smart contracts, architecture docs, general code review
Generic briefs produce generic findings. The brief is where you aim the Skeptic at what actually matters for this change.

Findings classification

Critical
Blocks sign-off. Must be resolved. Security vulnerabilities, correctness failures, data loss paths.
Major
Blocks sign-off unless the Worker provides a compelling documented reason to defer. Missing error handling, silent failure edge cases, DRY violations and missed abstractions (duplication, copy-paste programming, reinventing existing helpers).
Minor
Never blocks sign-off. Applied automatically by a background agent after sign-off. Style, logging gaps, low-impact optimizations.
Every finding must be classified. Unclassified findings default to Major. The Skeptic cannot wave something through without saying what it is.
Behavior class determines severity. Only a behavior finding is eligible for Critical or Major: a defect in the shipped code or its runtime, an unmet acceptance criterion or qa_criteria scenario, a security/data-boundary issue, fabricated evidence, or a code-quality defect in the diff itself. A defect in the methodology's own paperwork about the code - doc-sync, count-sync, module manifest, attestation wording, plan prose, test strength - is Minor. Every check still runs; only the tier changed.

Escalation and round limits

  • Max 3 fix passes in a Skeptic loop, 3 in a QA loop (hard cap): the conductor applies a maximum of 3 fix passes in a Skeptic loop (Phase 6 and any ad-hoc Skeptic loop) and 3 in the Phase 6b QA loop. At the cap, the conductor ships (accepted debt in the PR body) or escalates to the human - never silent continuation. An unresolved Critical always blocks; the cap never ships a Critical. The round count is mechanically enforced by hooks/enforce-skeptic-round-cap.py (denies a 4th Skeptic spawn per unit unless the operator's own typed message in that session contains the skeptic-grant- token the deny prints for that unit and round) regardless of caller, when the spawn prompt's "Diff under review" line is present and unambiguous (fails open with no state written otherwise), and denies a spawn whose line does not lead with a stable unit key (<KEY> | <diff>, derived per Section 4.5) without charging a round; before persisting an allow, the hook also consults enforce-skeptic-neutrality.py, enforce-tier.py, enforce-background-spawn.py, and enforce-orchestrator-singularity.py's own deny decision on the identical payload, but only when that sibling's registration on the Task/Agent matcher is positively confirmed against the settings files Claude Code would load - an unconfirmed registration or a sibling import/call failure falls back to charging the round exactly as before this consultation existed; in each of those fallback cases the counter can still advance on a spawn rejected at the PreToolUse boundary, not only on a completed review, so a cap fire the conductor cannot match to that many returned reviews is spurious and is always escalate, never ship; known residual: a first pipe-separated path lacking a file-extension-shaped suffix (e.g. LICENSE | a.py) still passes the stable-key shape gate and becomes a wrong-but-stable key shared across units. The hook does not enforce Critical-never-ships.
  • 2 re-route limit (per finding): same finding contested across 2+ rounds without resolution - escalate with both positions
  • Simple changes: capped at 1 round - Critical/Major findings escalate directly
  • Standard Elevated changes: the 2-re-route rule applies
  • The primary agent tracks each finding by its text across all rounds

Loop-context override (inside /ds-implement-ticket Phase 6): the 2-re-route rule is replaced by a stricter contract - 1 re-raise of a Critical finding after a claimed fix triggers convergence failure escalation immediately. Outside a named loop, the 2-re-route rule is unchanged.

Prose-scoped re-check: when the round's only unresolved finding is a Blocking-minor:-routed prose-only finding (stale module manifest, doc-sync attestation, comment/count wording) and the fix diff has no code/test/behavior change, the next verification is narrowed to the changed prose lines plus a full end-to-end read of the enclosing manifest/section - not a full fresh round. The reviewer establishes the trigger itself by diffing the fix commit(s), never from engineer self-classification; any parsed/executed/byte-pinned hunk disqualifies the lever. The conductor names the mode and supplies the sha1..sha2 fix range at spawn; sign-off carries a mandatory Scope: line. A code/test/behavior finding found during the narrower pass still escalates normally. Verification-cost lever only; severity tiers are unchanged.

Round budget and value-per-round gate: the 3-round Skeptic cap decides when a loop must stop; the value-per-round gate decides whether round N+1 is worth spawning at all. Before spawning it, the conductor states one line of what shipped value that round buys ([round-value: ...]). If the honest answer is only "hardens infrastructure" or "improves a gate" with no behavior change reaching a user, defer the remaining findings to a follow-up instead. A unit whose sole output is enforcement must not block the change it enforces - ship behavior-changing units first, enforcement-only units in a later PR.

The 3-pass Skeptic cap and the per-finding 2-re-route rule are separate ceilings. Either can trigger escalation first. Inside a persistence loop, convergence failure escalates even faster.

The resolved issues preflight + findings_log

On round 2+, the primary agent prepends a preflight list to the brief so the fresh Skeptic doesn't re-raise a prior finding as a new one:

The following findings were raised in prior rounds and the Worker has
since claimed a fix. Determine for yourself whether each is now resolved:

[C1: Missing auth check on /admin endpoint]
[M1: No error handling on payment callback]

Inside the persistence loop: the preflight list is backed by findings_log - a structured in-context accumulator tracking every finding across all iterations (id, description, severity, first_raised, status, re_raised); the brief carries id and description only. When the Skeptic re-raises an addressed finding it uses [PREV: <id>] so the conductor can mechanically detect it and update re_raised: true.

Auto-close rule: when the Skeptic grants sign-off (zero new findings), ALL findings_log entries with status: open or status: addressed are automatically closed. The absence of re-raise is an implicit confirmation that all fixes were accepted.

Fresh context for independence. Preflight list for efficiency. findings_log for accountability across iterations.

Five new Skeptic obligations (1/2)

Module manifest check
On any non-trivial file touched by the Worker (exports a public symbol, ~50+ LOC, or side-effecting): verify a module manifest header exists and reflects the current file. The result is output-required via a fixed Manifest check: sign-off line.

All gaps are Minor: missing and stale alike, non-blocking. A stale manifest that could mislead a caller on a correctness or security path stays Minor and is routed through the Blocking-minor: sign-off line.
Regression test verification
Before granting sign-off on any round where a Critical or Major behavior-defect finding was fixed: verify a regression test was added - a test that would have failed without the fix.

Missing test without a documented exception = Minor finding.
These checks run alongside existing findings classification - not instead of it. Comprehension, regression, CI-wiring, and observability gates layered on top of Critical/Major/Minor.

Five new Skeptic obligations (2/2)

Telemetry emit check
At every instrumented boundary (engineer/skeptic/qa spawn): verify .agentic/events.jsonl received the matching spawn_start/spawn_complete events (or, for ad-hoc sessions, the hook-emitted spawn_start). conductor_direct is retired and its absence is not a finding.

Missing emit = Minor (non-blocking; keeps /ds-cost dashboards accurate).
New-test-CI-wiring check
For each new test file in the diff: verify a matching reference exists in a CI workflow (an exact file reference, a covering glob, or an auto-discovering runner). The result is output-required via a fixed Test-CI-wiring check: sign-off line.

No matching CI invocation = Minor finding - a test that never runs provides no regression protection.
Comment-discipline check - a comment the diff adds or changes, or supplied PR or tracker text, that restates the code or carries review exhaust = Minor, naming the exact span.
All five obligations run alongside the standard Skeptic pass. Manifest enforcement catches comprehension drift; regression tests close the fix loop; CI-wiring checks close the "silent dead test" gap; telemetry keeps cost and calibration dashboards accurate; comment discipline keeps review exhaust out of the permanent record.

Cognitive surrender check

Cognitive offloading (good)
Delegating mechanics to the agent - boilerplate, search, transformation. Judgment stays with the human and the Skeptic.
Cognitive surrender (bad)
Treating the LLM as System 3. A Skeptic that agrees with the Worker on every point with zero findings across two iterations is a rubber-stamp signal.
Cure: an audit-note Minor attesting the Skeptic re-read the diff end-to-end with independent attention. Documents what was checked, not what was wrong. Exempt from /ds-implement-ticket Phase 6 re-raise and convergence-failure detection - bookkeeping, not contested findings.

Calibration layer (1/2)

The audit-note Minor is the per-spawn defense against rubber-stamping. The calibration layer is the long-horizon backstop - it detects drift in aggregate over time without enlarging the per-spawn review surface.

  • Findings counters in events.jsonl - every Skeptic conductor-emitted spawn_complete carries findings_count, diff_lines, signed_off, and iteration inside data. Conductor builds the merged JSON inline; subagents do not write to .agentic/. (A separate, deterministic hook-emitted spawn_complete variant also exists as of DS-160 - as of DS-178 it ALSO best-effort resolves these same calibration fields, plus agent_source/unit_key/model, directly from the completed subagent's own transcript and round-cap state - see the Events Log reference.)
  • 5% sampled meta-Skeptic - deterministic bucket from hash(task_id+iteration) % 100 < 5. Background fire-and-forget; conductor declares the unit complete without waiting. Meta-Skeptic returns text only; conductor parses and emits meta_review_complete.
Threat model: drift detection in a non-adversarial conductor relationship. Not a cheating-prevention mechanism - a compromised conductor can mis-emit. The target is operator self-deception over time, not adversarial spoofing.

Calibration layer (2/2)

  • Surfacing - Critical/Major divergence on a sampled spawn surfaces as one inline META-DIVERGENCE: line. Original sign-off remains binding; the notice is advisory. Surfacing fires both in-session (Phase 6 turn boundaries) and at session start (catches async returns from prior sessions). The sweep paginates via .meta-divergence-last-sweep timestamp tracker.
  • Inspection CLI - ds-calibrate density (findings per 100 diff-lines, excludes zero-diff rows) and ds-calibrate divergence (meta-Skeptic rubber-stamp rate). Warming-up line shown until 10 qualifying spawns observed.
Per-spawn: audit-note Minor attests the Skeptic re-read the diff end-to-end. Long-horizon: calibration layer catches aggregate drift across sessions. Two layers, two timescales.

Fresh. Independent. Classified.

Every finding named. Every round tracked. Every escalation clean.

github.com/Space-Dinosaurs/DinoStack