Why adversarial review matters

• A reviewer who has seen the implementer's reasoning is anchored to that framing
• Self-review catches typos. It does not catch flawed assumptions.
• The value of review is independence - seeing the output without the justification
• The Skeptic sees only the output and the adversarial brief, never the Worker's reasoning process
• This is not optional polish. It is the protocol's primary quality gate.

The adversarial brief

The brief defines the threat model the Skeptic must adopt. It is domain-specific - not generic.

"An attacker controls one compromised account and one compromised device. What can they access, modify, or forge? Look for: session fixation, token replay, privilege escalation paths, and any state the server trusts without re-verifying."

• The primary agent writes it (or extends a template) and passes it to both Worker and Skeptic verbatim
• The agent must not soften, summarize, or editorialize the brief
• Templates exist for: auth, API endpoints, crypto, DB migrations, data pipelines, smart contracts, architecture docs, general code review

Findings classification

Escalation and round limits

• Max 3 fix passes (hard cap): within any Skeptic or QA loop (Phase 6/6b and any ad-hoc loop), the conductor applies a maximum of 3 fix passes before escalating to the human
• 2 re-route limit (per finding): same finding contested across 2+ rounds without resolution - escalate with both positions
• Simple changes: capped at 1 round - Critical/Major findings escalate directly
• Standard Elevated changes: the 2-re-route rule applies
• The primary agent tracks each finding by its text across all rounds

Loop-context override (inside /ds-implement-ticket Phase 6): the 2-re-route rule is replaced by a stricter contract - 1 re-raise of a Critical finding after a claimed fix triggers convergence failure escalation immediately. Outside a named loop, the 2-re-route rule is unchanged.

The resolved issues preflight + findings_log

On round 2+, the primary agent prepends a preflight list to the brief so the fresh Skeptic doesn't re-raise already-fixed issues:

The following issues were identified and resolved in prior rounds.
Do not re-raise them unless the resolution is genuinely insufficient:

[C1: Missing auth check on /admin endpoint → Added middleware guard]
[M1: No error handling on payment callback → Added try/catch with rollback]

Inside the persistence loop: the preflight list is backed by findings_log - a structured in-context accumulator tracking every finding across all iterations (id, severity, first_raised, status, claimed_fix, re_raised). When the Skeptic re-raises a previously-addressed finding, it uses [PREV: <id>] so the conductor can mechanically detect it and update re_raised: true.

Auto-close rule: when the Skeptic grants sign-off (zero new findings), ALL findings_log entries with status: open or status: addressed are automatically closed. The absence of re-raise is an implicit confirmation that all fixes were accepted.

Four new Skeptic obligations (1/2)

Four new Skeptic obligations (2/2)

Cognitive surrender check

Calibration layer (1/2)

The audit-note Minor is the per-spawn defense against rubber-stamping. The calibration layer is the long-horizon backstop - it detects drift in aggregate over time without enlarging the per-spawn review surface.

• Findings counters in events.jsonl - every Skeptic spawn_complete carries findings_count, diff_lines, signed_off, and iteration inside data. Conductor builds the merged JSON inline; subagents do not write to .agentic/.
• 5% sampled meta-Skeptic - deterministic bucket from hash(task_id+iteration) % 100 < 5. Background fire-and-forget; conductor declares the unit complete without waiting. Meta-Skeptic returns text only; conductor parses and emits meta_review_complete.

Calibration layer (2/2)

• Surfacing - Critical/Major divergence on a sampled spawn surfaces as one inline META-DIVERGENCE: line. Original sign-off remains binding; the notice is advisory. Surfacing fires both in-session (Phase 6 turn boundaries) and at session start (catches async returns from prior sessions). The sweep paginates via .meta-divergence-last-sweep timestamp tracker.
• Inspection CLI - agentic-calibrate density (findings per 100 diff-lines, excludes zero-diff rows) and agentic-calibrate divergence (meta-Skeptic rubber-stamp rate). Warming-up line shown until 10 qualifying spawns observed.