Why adversarial review matters

• A reviewer who has seen the implementer's reasoning is anchored to that framing
• Self-review catches typos. It does not catch flawed assumptions.
• The value of review is independence - seeing the output without the justification
• The Skeptic sees only the output and the adversarial brief, never the Worker's reasoning process
• This is not optional polish. It is the protocol's primary quality gate.

The adversarial brief

The brief defines the threat model the Skeptic must adopt. It is domain-specific - not generic.

"An attacker controls one compromised account and one compromised device. What can they access, modify, or forge? Look for: session fixation, token replay, privilege escalation paths, and any state the server trusts without re-verifying."

• The primary agent writes it (or extends a template) and passes it to both Worker and Skeptic verbatim
• The agent must not soften, summarize, or editorialize the brief
• Nor may it inject a conductor hypothesis, suspicion, or attention-steer - neutrality and completeness are independent axes, with no carve-out for an operator-attributed steer
• Mechanically enforced at spawn time (enforce-skeptic-neutrality.py): denies an untagged claim in field 7, or a conductor-composed-steer phrase in the brief
• The ban covers every field, every form, tagged or untagged - the hook checks only two bounded surfaces; the reviewing Skeptic's Step 3.9 Neutrality check is the control for the rest
• The underlying rule is general, not Skeptic-only - it binds every spawn brief, to any recipient role; see subagent-protocol.md Section 11 "Spawn-brief provenance"
• The three sections the conductor composes itself (attack surface, questions the review must answer explicitly, repo-specific hazards) are slots with a stated item form, defined once in subagent-protocol.md Section 11 "Brief section form" - the pasted template is not a slot
• Templates exist for: auth, API endpoints, crypto, DB migrations, data pipelines, smart contracts, architecture docs, general code review

Findings classification

Escalation and round limits

• Max 3 fix passes in a Skeptic loop, 3 in a QA loop (hard cap): the conductor applies a maximum of 3 fix passes in a Skeptic loop (Phase 6 and any ad-hoc Skeptic loop) and 3 in the Phase 6b QA loop. At the cap, the conductor ships (accepted debt in the PR body) or escalates to the human - never silent continuation. An unresolved Critical always blocks; the cap never ships a Critical. The round count is mechanically enforced by hooks/enforce-skeptic-round-cap.py (denies a 4th Skeptic spawn per unit unless the operator's own typed message in that session contains the skeptic-grant- token the deny prints for that unit and round) regardless of caller, when the spawn prompt's "Diff under review" line is present and unambiguous (fails open with no state written otherwise), and denies a spawn whose line does not lead with a stable unit key (<KEY> | <diff>, derived per Section 4.5) without charging a round; before persisting an allow, the hook also consults enforce-skeptic-neutrality.py, enforce-tier.py, enforce-background-spawn.py, and enforce-orchestrator-singularity.py's own deny decision on the identical payload, but only when that sibling's registration on the Task/Agent matcher is positively confirmed against the settings files Claude Code would load - an unconfirmed registration or a sibling import/call failure falls back to charging the round exactly as before this consultation existed; in each of those fallback cases the counter can still advance on a spawn rejected at the PreToolUse boundary, not only on a completed review, so a cap fire the conductor cannot match to that many returned reviews is spurious and is always escalate, never ship; known residual: a first pipe-separated path lacking a file-extension-shaped suffix (e.g. LICENSE | a.py) still passes the stable-key shape gate and becomes a wrong-but-stable key shared across units. The hook does not enforce Critical-never-ships.
• 2 re-route limit (per finding): same finding contested across 2+ rounds without resolution - escalate with both positions
• Simple changes: capped at 1 round - Critical/Major findings escalate directly
• Standard Elevated changes: the 2-re-route rule applies
• The primary agent tracks each finding by its text across all rounds

Loop-context override (inside /ds-implement-ticket Phase 6): the 2-re-route rule is replaced by a stricter contract - 1 re-raise of a Critical finding after a claimed fix triggers convergence failure escalation immediately. Outside a named loop, the 2-re-route rule is unchanged.

Prose-scoped re-check: when the round's only unresolved finding is a Blocking-minor:-routed prose-only finding (stale code comment, doc-sync attestation, comment/count wording) and the fix diff has no code/test/behavior change, the next verification is narrowed to the changed prose lines plus a full end-to-end read of the enclosing comment block/section - not a full fresh round. The reviewer establishes the trigger itself by diffing the fix commit(s), never from engineer self-classification; any parsed/executed/byte-pinned hunk disqualifies the lever. The conductor names the mode and supplies the sha1..sha2 fix range at spawn; sign-off carries a mandatory Scope: line. A code/test/behavior finding found during the narrower pass still escalates normally. Verification-cost lever only; severity tiers are unchanged.

Round budget and value-per-round gate: the 3-round Skeptic cap decides when a loop must stop; the value-per-round gate decides whether round N+1 is worth spawning at all. Before spawning it, the conductor states one line of what shipped value that round buys ([round-value: ...]). If the honest answer is only "hardens infrastructure" or "improves a gate" with no behavior change reaching a user, defer the remaining findings to a follow-up instead. A unit whose sole output is enforcement must not block the change it enforces - ship behavior-changing units first, enforcement-only units in a later PR.

The resolved issues preflight + findings_log

On round 2+, or any round answering a human or bot review, the primary agent adds a preflight list under its own heading, outside the brief paragraph, so the fresh Skeptic doesn't re-raise a prior finding as a new one:

The following findings were raised in prior rounds (fix since claimed) or
in a human or automated review (H<n>). Determine whether each is resolved:

[C1: Missing auth check on /admin endpoint]
[M1: No error handling on payment callback]

Inside the persistence loop: the preflight list is backed by findings_log - a structured in-context accumulator tracking every finding across all iterations (id, description, severity, first_raised, status, re_raised); the brief carries id and description only. When the Skeptic re-raises an addressed finding it uses [PREV: <id>] so the conductor can mechanically detect it and update re_raised: true.

Auto-close rule: an entry the Skeptic marks CLOSED closes that round; on sign-off (zero new findings), ALL remaining status: open or status: addressed entries close. The absence of re-raise is an implicit confirmation that all fixes were accepted.

Four new Skeptic obligations (1/2)

Four new Skeptic obligations (2/2)

Cognitive surrender check

Calibration layer (1/2)

The audit-note Minor is the per-spawn defense against rubber-stamping. The calibration layer is the long-horizon backstop - it detects drift in aggregate over time without enlarging the per-spawn review surface.

• Findings counters in events.jsonl - every Skeptic conductor-emitted spawn_complete carries findings_count, diff_lines, signed_off, and iteration inside data. Conductor builds the merged JSON inline; subagents do not write to .agentic/. (A separate, deterministic hook-emitted spawn_complete variant also exists as of DS-160 - as of DS-178 it ALSO best-effort resolves these same calibration fields, plus agent_source/unit_key/model, directly from the completed subagent's own transcript and round-cap state - see the Events Log reference.)
• 5% sampled meta-Skeptic - deterministic bucket from hash(task_id+iteration) % 100 < 5. Background fire-and-forget; conductor declares the unit complete without waiting. Meta-Skeptic returns text only; conductor parses and emits meta_review_complete.

Calibration layer (2/2)

• Surfacing - Critical/Major divergence on a sampled spawn surfaces as one inline META-DIVERGENCE: line. Original sign-off remains binding; the notice is advisory. Surfacing fires both in-session (Phase 6 turn boundaries) and at session start (catches async returns from prior sessions). The sweep paginates via .meta-divergence-last-sweep timestamp tracker.
• Inspection CLI - ds-calibrate density (findings per 100 diff-lines, excludes zero-diff rows) and ds-calibrate divergence (meta-Skeptic rubber-stamp rate). Warming-up line shown until 10 qualifying spawns observed.