docs(prd): independent verification — the closer never self-certifies

Operator addition to the closure protocol: the QA gate is held by an independent verifier subagent — context-free, prompted to REFUTE, repo + issues + journals as its only inputs; verdict posted on the milestone, unresolved refutation blocks. New qa-strategy section extends no-self- grading to POC exit gates and autonomy promotions (verdict attached to the artifact it gates), mirroring at process level what the pipelines do at data level (dual extraction, seeded-wrong fixtures). Co-Authored-By: Claude Fable 5 <[email protected]>
2026-07-11 20:19:19 +02:00
parent e15a6d68c5
commit d16f7164cb
3 changed files with 6 additions and 2 deletions
@@ -54,6 +54,10 @@ Per atom, mechanical, recorded in the registry ([ladder](README.md#the-autonomy-
 - **Quarterly game-day:** deliberately take one tier down (revoke the cloud key, cordon the inference node, sleep the laptop) and verify the [degraded-mode table](model-fleet.md#degraded-modes) holds in practice — same philosophy as the [safe-prod-like-environment](../safe-prod-like-environment/README.md) drills.
 - **Weekly ops review (human, ~10 min):** escalation/quarantine/disagreement rates, DLQ age, digest accuracy spot-check, and the standing question: *which atom cost more than it saved this week?*

+## Independent verification — no self-grading
+
+Work is never attested by the session that produced it. **Milestone closures** ([closure protocol](STATUS.md#closure-protocol--per-milestone)), **POC exit gates**, and **autonomy promotions** are verified by a *context-free subagent prompted to refute* ("find why this is NOT done / NOT at the bar"), whose only inputs are the repo, the issues, and the run journals — never the author's conversation. A refutation the author cannot resolve with evidence blocks the gate; the verifier's verdict is attached to the artifact it gates (milestone, registry autonomy field, POC record). This extends to the process level the principle the pipelines already run at the data level (dual independent extraction, seeded-wrong fixtures that must FAIL) and that the PRD itself was built with (fresh-reader review before first publication).
+
 ## Evidence trail

 Every month yields an audit pack: the coherence audit ([T15](task-inventory.md#t15--monthly-coherence-audit)), the month's run journals, snapshot content-hashes, approval-card decisions, and fiscal sheets — archived in git + GED. This pack is deliberately shaped as the documented-control set of the **piste d'audit fiable** (CGI art. 289 VII — [compliance](compliance.md#obligations--fleet-mechanisms)): the invoice ↔ service ↔ payment linkage is evidenced continuously, not reconstructed under audit. The pack is written for a third party (expert-comptable, auditor, or a future operator): it must let them reconstruct *what the fleet did and why* without access to this PRD or any chat history. A distilled summary of each pack also lands in the second brain ([T17](task-inventory.md#t17--knowledge-capture--retrieval-second-brain)), so institutional memory outlives both chat logs and this repo.