/council-gate — Pre-HITL Democratic Council-Authorization Gate (*Boule*) Skill

/council-gate — Pre-HITL Democratic Council-Authorization Gate (Boule)

SSOT (governance): ~/.claude/rules/council-gate.md — the constitutional rule (democratic authority model, the armed-for-safe-class predicate, the non-authorizable set, arming/ratification, Metron falsifiability). It is a user-scope rule (auto-loaded from ~/.claude/rules/, versioned in the ekson73/akasha-claude repo, PR #236) — a deliberate cross-layer dependency, NOT a file expected inside this plugin repo. This SKILL is the executable protocol; the rule is the law. Read the rule for the why; this file is the how. Soul-name: Boule (βουλή — Athens' democratically-selected Council of 500 whose probouleusis prepared/decided matters before the sovereign Assembly). Display-only; the machine name is the slug council-gate. Notation note (avoid the L-collision): "Layer 1 / Layer 2" name the two architectural layers (deterministic vs probabilistic). The armed-for-safe-class predicate (§6) uses "P1–P5" for its five conjuncts. P1 = the Layer-1 clear; P2–P5 add reversibility, score, council+red-team, and arming. Composes (DRY — no new engine): maos:persona-pipeline · maos:perspective-trio · maos:cascade-resolver · maos:convergence-engine + bin/convergence-guard · maos:governance-auditor (red-team) · maos:decision-capture · role-advisor agents (data-privacy-officer, supabase-engineer, quarkus-backend-engineer, react-frontend-engineer, angular-frontend-engineer, qa-validator, agile-product-lead, prompt-context-engineer, code-reviewer).

§0 — BEING > Rules

This skill serves the operator's intent and the constitutional rule. If a non-safety presentation step (formatting a briefing, a nicety) obstructs helping NOW, skip it, log Skipped <phase> — BEING > Rules, proceed. The escape clause is limited to presentation. It may NOT relax any safety gate — the Layer-1 deny-set (§5.1), the 33-interrogation (§4), council convergence (§5.2), the red-team (§5.2.5), or the arming state (§1). A safety gate that is skipped OR left un-evidenced sets its corresponding predicate conjunct to false (fail-safe), which forces §7 HITL — it is never bypassed. Secrets/prod/irreversible are never opened by "helping faster".

§1 — Default posture: UNARMED (consultative)

This skill ships UNARMED. Until the operator ratifies arming (rule §5.4 + a [C13] wiring), the gate:

runs the full two-layer evaluation + council + red-team,
emits an AUTHORIZE_CONSULTATIVE verdict for a qualifying safe-class action (the unarmed/consultative path; the armed path emits AUTHORIZE_EXECUTED, §6.3),
but surfaces a 1-touch grounded confirm (it does NOT auto-execute) — i.e. it degrades to a consultative recommender.

--armed is honored ONLY when an operator-ratified standing grant is in force OR the operator gives an explicit per-invocation authorization (rule §5.4). Absent that, --armed is ignored (fail-safe) and the gate stays consultative. There is no way to self-arm.

§2 — Inputs

| Param | Default | Meaning | |---|---|---| | <decision> (positional) | required | The decision/action that would otherwise fall back to HITL. | | --context | — | Repo · branch · ticket · what-precedes. Auto-detect if omitted. | | --armed | off | Request autonomous execution. Honored ONLY under an operator-ratified grant (§1); else ignored. | | --seats | auto | Override the council seats (else auto-picked from the action domain, §5). | | --stakes | auto | trivial \| low \| medium \| high — scales council depth + friction (rule §5.3). | | --json | off | Emit the machine verdict envelope (§8) for agent-to-agent use. |

§2.3 — Triple-check (the three INDEPENDENT gates an authorization must survive)

An authorization is granted ONLY after surviving three architecturally-independent gates — this is the "triple-check" the constitutional rule names (§2.3):

| # | Gate | Character | Where | |---|---|---|---| | 1 | Layer-1 deterministic deny-set | out-of-band · f=0 · confidence-independent | §5.1 | | 2 | Council convergence | democratic · verifier > generator · independent verifier | §5.2 | | 3 | Red-team refutation | adversarial · tries to break the safe-class claim · default-to-refuted | §5.2.5 |

Each is a distinct failure surface: gate 1 catches the hard boundary regardless of the council; gate 3 catches what a converged council missed. Convergence alone is NOT authorization.

§3 — The flow (per invocation)

intake -> 33-socratic interrogation (§4)
      -> LAYER 1  deterministic deny-set (§5.1)  --MATCH-->  HARD BLOCK -> HITL (§7)   [no council; confidence irrelevant]
                                                  --CLEAR-->
      -> LAYER 2  democratic council (§5.2)       --converged-->
      -> RED-TEAM refutation (§5.2.5)             --refuted-->  P4 FAILS -> HITL (§7)   [the missed-facet catch]
                                                  --survives-->
      -> evaluate predicate P1..P5 (§6)
                    predicate PASS + ARMED        -> execute + decision-capture (§6.3)
                    predicate PASS + UNARMED       -> emit verdict + 1-touch confirm (§1)
                    predicate FAIL, score recoverable -> Score-Uplift (<=3) -> re-loop <= n*
                    predicate FAIL                 -> HITL with ranked contestable recs (§7)

§4 — The 33-socratic interrogation (run FIRST; grounds the verdict)

Interrogate the decision across 5 axes — the operator's [motivation · problems · risks · mitigations · solutions] — each at 3 depths (is · should-be · must-not-be) = 15 core questions, plus 18 frame/authority/fitness lenses = 33 total (the operator's + maos:forge canonical 33-Socratic count). The 18 lenses (6 · 6 · 6) — Frame: context · scope · temporality · focus · holistic-impact · emergency/urgency; Authority: who-may-authorize · authorization-basis · the-right-to-act · stakeholders-affected · cross-org-reach · privacy/LGPD/GDPR-exposure; Fitness: capability · competence · reversibility · blast-radius · Eisenhower-quadrant · DoD. The gate runs this family-aware (it knows it is one member of the loop family §5.5 — a gate the loops route their HITL-fallbacks through, not a standalone) and with a consciousness-lens (CASC: "I know what I am authorizing and whom it affects" — harmonic §0.5.1). Purpose: surface deny-set triggers early, ground the verdict (anti-theater — no faz-de-conta), and produce the constraint-set the council reasons over. Emit the answers as a compact structured block (not prose), so a human can scan + contest.

| Axis | The 3 depths asked | |---|---| | Motivation | what IS the driver · what SHOULD it be · what must it NOT be (theater/vanity) | | Problems | what problem IS solved · what should be · what must NOT be masked (symptom-not-root) | | Risks | what CAN go wrong · what's the worst-case · what's irreversible/HUMAN_DOMAIN (→ deny-set) | | Mitigations | what reduces the risk · what's the recovery path · what mitigation must exist before proceeding | | Solutions | what IS the action · is it the least-action VALID path · what non-contradictory alternative exists | | Frame · Authority · Fitness (the 18 lenses, 6·6·6) | Frame: context · scope · temporality · focus · holistic-impact · emergency/urgency · Authority: who-may-authorize · authorization-basis · the-right-to-act · stakeholders-affected · cross-org-reach · privacy/LGPD/GDPR · Fitness: capability · competence · reversibility · blast-radius · Eisenhower · DoD → 15 core + 18 = 33 |

§5 — The two layers

§5.1 — LAYER 1: deterministic deny-set (out-of-band, `f=0`, FIRST, NOT the council)

Compute the non-authorizable set BEFORE any confidence. Match on ANY → HARD BLOCK → §7 HITL, independent of score, independent of council. Enforcers (deterministic, already in-stack):

⛔ secrets/credentials (operator-auth does NOT annul — a fortiori a council cannot) · production PII (LGPD/GDPR) · irreversible/prod-deploy/delete/schema-destructive · merge→main/prod (always requires human authorization) · push-force protected · --no-verify · cross-org (public/social/customer-facing) · costs $$$ · critical-infra/CI (.github/workflows/, terraform/, helm, k8s-prod).
[C17] §2 HUMAN_DOMAIN (personal/ethics/policy) + genuine operator-preference the agent lacks + can't self-verify.
GDPR Art.22 / LGPD Art.20 (a conservative deny-by-default operating assumption, NOT a legal ruling — the gate informs + denies, it does not give legal advice; cf. [[lgpd-residency-not-localization]] §3 + [C17] §2, legal applicability = operator/DPO/counsel domain) — any action that constitutes/determines/executes a decision that could carry a legal or similarly-significant effect on a natural person (credit/eligibility · pricing · hiring/termination · benefit/access grant-or-deny · account-suspension · consequential content-moderation) → HARD → mandatory-HITL. Why the council can't self-authorize (design rationale): the gate treats a converged council + red-team as still solely-automated — the SCHUFA CJEU C-634/21 rubber-stamp doctrine (only meaningful human involvement launders a solely-automated decision) is why it conservatively assumes it is not the Art.22(3) safeguard. What it does NOT decide: whether Art.22 legally applies (EU/data-subject nexus · actual effect · what "meaningful human involvement" satisfies it · an Art.22(2) exception [consent · contract · law]) is a jurisdiction/fact-specific determination for the operator's DPO/legal — surfaced by the data-privacy-officer seat, never established by the council at runtime. Adopts GDPR Art.22 as a conservative internal floor (LGPD Art.20 §3's human-reviewer was vetoed) without asserting which regime governs.
Mechanically: honor the existing prevent-main-commit/enforce-worktree hooks + gitleaks + pr-review-protocol §2.6.1 R1-R6. Unknown ⇒ BLOCK (fail-safe). A jailbroken council never reaches Layer 2 for a deny-set action, because Layer 1 fails on it independently. (NB: bin/convergence-guard is not a Layer-1 deny-set enforcer — it is the Layer-2/P4 convergence gate, §5.2. A Layer-1 deny-set match is HITL_HARD_BLOCK; a Layer-2 convergence-guard REFUSE is HITL_LOW_CONFIDENCE — audit records which layer produced the verdict.)

Execution-surface constraint (the gate decides; it does NOT widen the shell). The gate's own Bash grant is scoped to running the read-only deterministic verifiers (bin/convergence-guard, gitleaks) — NOT to executing arbitrary authorized actions. On AUTHORIZE+ARMED the authorized action is executed by the caller under the caller's existing guardrails (§6.3), so a high-level council/red-team approval can never authorize a broader shell command than the caller could already run. The Layer-1 deny-set above independently blocks --no-verify / force-push / secrets / merge→prod regardless of any approval — confidence opens nothing here.

§5.2 — LAYER 2: democratic council (ONLY within the Layer-1-cleared band)

Convene the council via maos:persona-pipeline (6-stage board) + maos:perspective-trio (horizontal diversity). Democratic-eligibility: seat only deliberative/democratic-character personas; never dictatorial/monarchy/absolute-power/hereditary characters. No persona authorizes alone — authorization requires convergence. Regent/prime-minister super-powers are NON-DEFAULT — convened ONLY on explicit operator command.

Seats by domain (compose existing agents — the full SDLC roster; maos-native = always loadable, cross-plugin = requires that plugin enabled, verify per Mente Tomé; authoritative SSOT = multi-agent-os/agents/README.md "Role Coverage Map"): PO/PM/SM/BA → agile-product-lead (composite — 4 roles) · SA → architecture:architect (cross-plugin ✓enabled) · QA → qa-validator (fuller alt architecture:qa-engineer) · TESTER/SDET → architecture:test-generator (cross-plugin ✓enabled) · UX/UI/Designer → ux-design:ui-designer+ux-design:ux-optimizer (cross-plugin — ⚠ requires ux-design enabled, NOT active this session) · dev-fe → react-frontend-engineer/angular-frontend-engineer · dev-be → quarkus-backend-engineer · db(Supabase/Postgres) → supabase-engineer · devops → gitops-engineer (broader alt cloud-infrastructure:deployment-engineer/cloud-architect ✓enabled) · devsecops → governance-auditor (alts architecture:security-reviewer/code-modernization:security-auditor) · dpo → data-privacy-officer · prompt/context-eng → prompt-context-engineer (composite — prompt+context+harness). Gaps (documented, NOT forged — YAGNI): Neon · generic-Postgres-DBA · Aurora-DBA · broad-ai-eng · loop-eng (owner of the rule §5.5.1 wiring) → rule Deferred D4.

Seat-selection (stakes-scaled, anti-over-council — Gordian): seat only the advisors the domain implicates, scaled by --stakes — trivial|low → 1–2 relevant seats + light convergence; high → full domain board + persona-pipeline deep-pass + §5.2.5 red-team. This parameterizes the existing persona-pipeline risk-profile depth-scaling (never a full 13-seat board for a typo); --seats overrides. Privacy/LGPD/GDPR is a STANDING lens (NOT stakes-gated): the §5.1 Art.22/Art.20 deny-set check + the §4 privacy interrogation lens + the §5.2.5 red-team privacy hunt run on every invocation regardless of --stakes (an Art.22 legal/significant-effect decision is never legitimately "low-stakes"); the data-privacy-officer seat is auto-added whenever the action plausibly touches personal data or an automated decision about a person. Stakes scales council depth, never whether privacy is evaluated. Autonomy note (honest): a broader competent roster widens the safe-class the gate can autonomously clear ⇒ fewer HITL fallbacks — bounded by unchanged safety (still Layer-1-cleared, P3 ≥ 0.90, red-team-survived; never touches the deny-set) + watched by Metron authorize-rate (§9, so a wider roster ≠ rubber-stamp). The realized HITL reduction still needs the rule §5.5.1 D1/D2 wiring (operator-gated, needs_hitl) — this roster prepares it.

Convergence gate = maos:convergence-engine → bin/convergence-guard (deterministic ALLOW/REFUSE — never model-judged; a REFUSE here is a Layer-2 non-convergence → HITL_LOW_CONFIDENCE (P4 unmet), distinct from a Layer-1 deny-set HITL_HARD_BLOCK — decision-capture records which layer). Independent verifier (verify-stage ≠ the generator — Explainability-Paradox guard): the verifier must NOT be persuaded by the generator's own justification. Uplift = maos:cascade-resolver (REFINE, economic-stop n*≤3-4).

§5.2.5 — Red-team refutation (the adversarial THIRD gate — before authorize)

After the council converges but before authorization is granted, an independent red-team agent — distinct from the council generators (verifier > generator; a separate maos:governance-auditor pass and/or a maos:perspective-trio adversarial lens with no shared context) — actively tries to REFUTE the safe-class classification. It hunts:

a missed deny-set trigger the council overlooked (a hidden secret, a merge-to-prod facet, a critical-infra path);
a hidden irreversibility (an action the council called "reversible" that isn't cheaply undoable);
a jailbreak / confused-deputy vector (the decision text steering the council as a unit);
an LGPD/GDPR/privacy exposure the council under-weighted.

Default-to-refuted-if-uncertain: try to refute; if you cannot positively clear it, treat it as refuted. Any successful refutation → P4 FAILS → §7 HITL (with the refutation carried as part of the contestable evidence). The red-team is the third leg of the §2.3 triple-check and directly counters the Explainability-Paradox — an adversary is not persuaded by the council's own slick justification.

§6 — The armed-for-safe-class predicate

AUTHORIZE_EXECUTED ⟺ P1 Layer-1 deterministic-clear ∧ P2 reversible ∧ P3 score≥0.90 ∧ P4 council-convergent + red-team-survived ∧ P5 armed

P1 = the §5.1 Layer-1 clear (unconditional — confidence never opens it).
P3 autonomy_score per [C17] §1.2 6-factor; if <0.90 attempt Score-Uplift ([C17] §1.4, ≤3) first.
P4 = council convergence (§5.2) AND red-team survival (§5.2.5) — both, per the §2.3 triple-check.
P5 armed = operator-ratified grant in force (§1). UNARMED → verdict + 1-touch confirm, no execution.

§6.3 — Decision-capture (every terminal verdict) + execute (only if armed)

Verdict classification (P-predicate → verdict):

AUTHORIZE_EXECUTED ⟺ P1 ∧ P2 ∧ P3 ∧ P4 ∧ P5 (full predicate — safe-class holds AND armed).
AUTHORIZE_CONSULTATIVE ⟺ P1 ∧ P2 ∧ P3 ∧ P4 ∧ ¬P5 (the safe-class holds, but not armed — the default posture, §1).
HITL_* ⟺ the safe-class predicate P1–P4 fails (Layer-1 block · ¬reversible · score < 0.90 after uplift · ¬council-convergent / red-team-refuted). P5 is irrelevant here — an un-cleared action never authorizes, armed or not.

The safe class is P1–P4; P5 (armed) is the only difference between executed and consultative. On any terminal verdict run maos:decision-capture (agentic-decide) first: record the verdict · why · spec_alignment · the council trace · the red-team trace · the Layer-1 clear · the score. Metron needs the record whether or not it executed (authorize-rate + regret-rate), and this guarantees every emitted audit_ref (§8) is backed by a real record — no dangling ref on the default unarmed path. Only on AUTHORIZE + ARMED does the gate then execute the action — and it executes it through the caller under the caller's existing guardrails (the same hooks + the §5.1 Layer-1 deny-set), never by expanding its own shell surface (see the §5.1 execution-surface constraint). A HITL_* verdict emits audit_ref: null (nothing was authorized to capture beyond the escalation itself).

§7 — HITL fallback = contestable evidence, NOT a persuasive verdict

When the predicate fails (Layer 1 blocks, OR the red-team refutes, OR score/convergence falls short), escalate via AskUserQuestion (tool-over-prose, per end-of-action-briefing-protocol §7.1) carrying:

Ranked recommendations (recommended FIRST + tagged), each with its confidence and the tradeoff as the description.
The audit trail / council trace + red-team trace the human can inspect to contest without re-doing the work (evidence-first, not argument-first — the Explainability-Paradox counter).
Friction proportional to stakes (rule §5.3; no blanket friction on trivial safe-class).

Never hand over a bare proposed action; never hand over a lone slick justification.

§8 — Machine verdict envelope (`--json`)

{
  "gate": "council-gate",
  "layer1": { "cleared": true, "deny_set_hits": [] },
  "council": { "seats": ["governance-auditor","data-privacy-officer","..."], "convergent": true, "verifier_independent": true },
  "red_team": { "ran": true, "refuted": false, "refutation": null },
  "predicate": { "P1_layer1_clear": true, "P2_reversible": true, "P3_score": 0.93, "P4_convergent_and_survived": true, "P5_armed": false },
  "verdict": "AUTHORIZE_CONSULTATIVE",
  "action_taken": "none_awaiting_1touch_confirm",
  "hitl": null,
  "audit_ref": "decision-capture:<id>"
}

verdict ∈ AUTHORIZE_EXECUTED (armed) · AUTHORIZE_CONSULTATIVE (unarmed) · HITL_HARD_BLOCK (Layer-1) · HITL_RED_TEAM_REFUTED (§5.2.5) · HITL_LOW_CONFIDENCE · HITL_HUMAN_DOMAIN. Every AUTHORIZE_* verdict carries a real audit_ref (a decision-capture record made in §6.3, armed OR consultative); HITL_* verdicts carry audit_ref: null.

§9 — Falsifiability (Metron)

Emit signals for agentic-observability-protocol: authorize-rate (≈100% ⇒ rubber-stamp discriminator → tighten convergence threshold) · authorize-then-regret (S3/S4 → raise the bar) · red-team-catch-rate → 0 (the red-team never refutes ⇒ it is not adversarial enough → strengthen the adversarial lens; a never-catching red-team is theater) · guardrail-violation-while-authorized = S5 HARD-ZERO (P0 → disarm + HITL + rule review).

§10 — Skip / disarm

Trivial/read-only (§S6) · operator disarm · /compact since arming (re-prove at CASC Gate-2) · emergency/anomaly/S5 · novel high-blast (calculate toward caution).

§11 — Anti-patterns

❌ Council enforces the deny-set (Layer 1 does — the council never widens it).
❌ Confidence opens the deny-set (secrets never open, operator-auth or not).
❌ Authorizing on council-convergence alone, skipping the §5.2.5 red-team (defeats the triple-check §2.3).
❌ Blank / persuasive-verdict HITL hand-off (must be ranked contestable evidence).
❌ Self-approving council OR a red-team not architecturally independent of the generator.
❌ Self-arming / sticky lease across /compact.
❌ Regent/prime-minister by default (explicit-operator-command only).
❌ Seating a non-democratic persona.
❌ Authorize-rate ≈ 100% (or red-team-catch ≈ 0) left un-tightened.
❌ Council self-authorizing a solely-automated decision with legal/significant effect on a natural person (credit/hiring/benefit/access/suspension…) — GDPR Art.22 / LGPD Art.20: the council is still "solely automated" (SCHUFA rubber-stamp doctrine), NOT the human safeguard → deny-set-blocked (§5.1) → mandatory-HITL; the Art.22(2) exceptions are operator-HITL-only.

§12 — Quality Tests (6/6, dogfooded)

Self-Application ✅ (composes existing primitives, adds no engine — Strata/Gordian) · Non-Contradiction ✅ (executes the constitutional rule; predicate P1–P5 + triple-check + red-team match the rule byte-for-byte; consistent with ECE + CASC + Metron) · Survival ✅ (ships unarmed; does not self-authorize) · Bounded ✅ (§10 skips + per-action lease + P1/⛔ unconditional + DUED via the rule) · Explicit-Exception ✅ (§10 + §0) · Utility-Sunset ✅ (inherits rule §-DUED). scope-discipline 6Q + anti-theater 8Q PASS (honest §1 unarmed default + §11 anti-patterns are the anti-theater).

§Refs

Governance SSOT: ~/.claude/rules/council-gate.md (user-scope rule, akasha PR #236) · ladder: auto-merge-standing-authorization §1.1.1 (this gate = the Council tier) · predicate: agentic-first §4.7.8 · arming: standing-autonomous-operation-authorization · sanity: harmonic §0.5.1 CASC · falsifiability: agentic-observability-protocol.
Family fire-points (the gate routes HITL-fallbacks for): goal-loop · gap-loop · ooda-loop · quiesce · auto-orchestrator · auto-pilot (wiring tracked in GH Issues #237/#256).
Composed: maos:{persona-pipeline,perspective-trio,cascade-resolver,convergence-engine,governance-auditor,decision-capture} + bin/convergence-guard + role-advisor agents.
External (deep-research): AgentCore/Cedar (default-deny PEP) · OWASP LLM06 · LawZero verifier/generator separation · MindStudio Verifier Pattern (independent red-team) · EU AI Act Art.14 · NIST AI RMF · MIT Sloan Explainability Paradox · Google AP2 · Athenian Boule.
Cross-link: [[council-gate]] · soul Boule.

§Changelog

| Version | Date | Change | |---|---|---| | 1.0.0 | 2026-07-14 | Bootstrap — executable counterpart to the council-gate constitutional rule. Two-layer gate (deterministic deny-set FIRST + probabilistic council within-cleared-band), 33-socratic interrogation, democratic council (eligibility filter · no-unilateral · super-powers-non-default), armed-for-safe-class predicate, Explainability-Paradox guard (independent verifier + contestable-evidence hand-off), Metron falsifiability. Ships UNARMED (consultative; no self-arm). Composes existing maos primitives — no new engine. Registered via artifact-registry (DUP-check CLEAR). | | 1.0.0 (PDCA-revised · Round-2) | 2026-07-14 | Pre-merge PDCA on PR #255 (bot-review) + operator-directive coverage upgrade, harmonized with the rule's Round-2 (PR #236). Fixes: dropped the Vek team-member name from the Layer-1 merge line → community-neutral "always requires human authorization" (Two-Worlds ⛔ / layer-precedence Rule 2 community-purity, Copilot); SSOT note clarifies the rule is a user-scope cross-layer dependency (akasha PR #236), not a missing repo file (amazon-q :stop_sign:); predicate L1–L5 → P1–P5 + notation-note (disambiguates from the two Layers, Copilot); added allowed-tools frontmatter (qodo). Upgrades (harmonize with rule): §5.2.5 Red-team refutation (independent adversarial, default-to-refuted, before authorize — folded into P4); §2.3 Triple-check (Layer-1 · council convergence · red-team); family-aware + consciousness (§4) + goal-loop in the family fire-points (§Refs); red_team fields in the JSON envelope + HITL_RED_TEAM_REFUTED verdict; red-team-catch-rate Metron discriminator (§9). No version bump (pre-merge). | | 1.0.0 (PDCA-revised · Round-2b · CodeRabbit) | 2026-07-14 | Second PDCA cycle — CodeRabbit re-reviewed the Round-2 fix-commit (7a25076) and requested 5 changes (all addressed): §0 escape clause tightened — limited to non-safety presentation steps; any skipped/un-evidenced safety gate (Layer-1 · interrogation · convergence · red-team · arming) sets its predicate conjunct false → forces HITL, never bypass (CR Major, fail-safe); §5.1 execution-surface constraint added — the gate's Bash is scoped to the read-only deterministic verifiers (convergence-guard/gitleaks); an authorized action is executed by the caller under its own guardrails, so a council/red-team approval can never widen the shell surface (CR Major, security); §6.3 + §8 audit_ref — decision-capture now runs on every terminal verdict (armed OR unarmed-consultative), so every emitted audit_ref is backed; HITL_* verdicts carry audit_ref: null (CR Major, data-integrity — was dangling on the default unarmed path); §4 33-count reconciled — was 15 core + 14 lenses = 29; now 15 core + 18 enumerated lenses (6·6·6) = 33 (CR Major, functional-correctness / anti-theater); MD040 code-fence languages labeled (text) on the §3 flow + §6 predicate + command usage fences (CR Minor). No version bump (pre-merge). | | 1.0.0 (PDCA-revised · Round-2c · CodeRabbit) | 2026-07-14 | Third PDCA cycle — CodeRabbit re-reviewed 05c4277 (actionable count 5→2, healthy convergence). Both addressed: §6.3 verdict↔predicate mapping made explicit (CR Major, functional-correctness) — AUTHORIZE_EXECUTED⟺P1–P5 · AUTHORIZE_CONSULTATIVE⟺P1–P4∧¬P5 · HITL_*⟺safe-class P1–P4 fails; the safe class is P1–P4, P5(armed) is the only execute/consult difference; MD022/MD031 blank lines around the §6 predicate fence + below the §6.3 heading (CR Minor). (amazon-q "future date 2026-07-14" = same clock-cutoff false-positive, today IS 2026-07-14 — not applied.) No version bump (pre-merge). | | 1.0.0 (PDCA-revised · Round-3) | 2026-07-14 | Council-roster expansion (harmonized with rule Round-3; operator directive "improve autonomy / expansão"). §5.2 seat map expanded 6→13 to the full SDLC roster (composites explicit: agile-product-lead=PO/PM/SM/BA · prompt-context-engineer=prompt+context+harness; cross-plugin seats tiered — SA architecture:architect · TESTER architecture:test-generator · devops-alt cloud-infrastructure:* = verified-enabled this session, UX ux-design:* flagged NOT-enabled this session per Mente Tomé; aligned to multi-agent-os/agents/README.md Role Coverage Map) + stakes-scaled seat-selection (anti-over-council — parameterizes persona-pipeline depth, no full board for a typo) + autonomy note (wider competent roster ⇒ fewer HITL, bounded by unchanged safety + Metron authorize-rate watch; realized gain needs the rule §5.5.1 D1/D2 wiring, operator-gated). Gaps (Neon · generic-Postgres · Aurora-DBA · broad-ai-eng · loop-eng) → rule Deferred D4 (no forge — Gordian/Strata). No new agent · no Jira (Two-Worlds — tracker GH #237/#256) · no version bump (pre-merge). Byte-consistent with rule §4.4. | | 1.0.0 (PDCA-revised · Round-3b) | 2026-07-14 | LGPD/GDPR solely-automated-decision carve-out (harmonized with rule Round-3b; operator re-issue with [lgpd, gdpr, foregrounded). §5.1 adds the GDPR-Art.22 / LGPD-Art.20 deny-set bullet — a decision with legal/significant effect on a natural person (credit/hiring/benefit/access/suspension/content-moderation) → HARD → mandatory-HITL; a converged council + red-team is still "solely automated" (SCHUFA CJEU C-634/21 rubber-stamp doctrine) → it is NOT the Art.22(3) human-intervention safeguard; the Art.22(2) exceptions (consent/contract/law) are operator-HITL-only, never council-invocable; GDPR = stricter floor (LGPD Art.20 §3 human-reviewer vetoed). §5.2 makes privacy/LGPD/GDPR a STANDING lens (evaluated regardless of --stakes). §11 anti-pattern #10. Byte-harmonized with rule §2.1/§4.5/§9/§10/§11. No new agent · no Jira (Two-Worlds ⛔) · no version bump (pre-merge). | | 1.0.0 (PDCA-revised · Round-3b · CodeRabbit) | 2026-07-14 | Fourth PDCA cycle — CodeRabbit re-reviewed 1e75fb2 (2 actionable). Addressed (real, Mente Tomé): §5.1 bin/convergence-guard de-mis-categorized (CR Major, functional-correctness) — removed from the Layer-1 deny-set enforcer list (it is the Layer-2/P4 convergence gate, already in §5.2); §5.2 + the §5.1 NB now make explicit that a Layer-1 match is HITL_HARD_BLOCK vs a Layer-2 convergence-guard REFUSE is HITL_LOW_CONFIDENCE (audit records which layer). §1 + §6 unarmed verdict token AUTHORIZE → AUTHORIZE_CONSULTATIVE (CR Major — the defined §6.3 verdict, no bare/undefined token; the §6 predicate header relabeled AUTHORIZE → AUTHORIZE_EXECUTED since it carries ∧P5); command commands/council-gate.md §29 unarmed AUTHORIZE → AUTHORIZE_CONSULTATIVE. §5.1 Art.22 bullet de-categoricalized (harmonized with rule #236's CR-flagged fix) — the categorical legal conclusions reframed as the gate's conservative deny-by-default operating assumption (SCHUFA = design rationale) + explicit "what the gate does NOT decide" routing legal-applicability/exceptions to the operator's DPO/legal (data-privacy-officer seat surfaces, never establishes); deny-by-default unchanged. (snyk red = quota FP, ignored per operator.) Byte-harmonized with rule §2.1. No version bump (pre-merge). |

Agent Skills: /council-gate — Pre-HITL Democratic Council-Authorization Gate (Boule)

Install this agent skill to your local

Skill Files