fix(test-writing): degrade malformed defense stances and add deterministic evidence gates

[Martin Bens (SpiGAndromeda)]

The phpunit-test-team-reviewing pipeline survives a malformed defense stance instead of discarding the run, and stops trusting two agent-reported values it can check itself. test-writing goes 5.1.0 to 5.1.1. Closes #173; implements the manifest-count, finding-evidence, fix-application, commit-reachability, scrutiny-label, and re-characterization items of #176 — the structure-only layout consolidation item is not part of this change.

Defense stage degrades instead of aborting

A mode=adversarial run threw at the wave boundary when a defense reconciler listed an adversary-introduced finding under both adopted_new and findings: the maintained-findings fold resolved the id against the file's kept and contested records only, found nothing, and the throw discarded every completed agent in the run. The duplicated entry is now skipped as an already-cast vote (seenA/seenR are per-defender, so they answer exactly whether this defender already voted on the id), and defensePrompt states that the four response arrays are disjoint, removing the ambiguity that produced the duplication in the first place.

Beyond that fast path, any defense stance entry failing an integrity guard — a malformed finding_id, or an id resolving to no known record — takes the degrade-by-role path from references/error-handling.md that already covered a dead defense reconciler: the offending entry is dropped, the rest of that stance still votes, the finding it named keeps its prior consensus binding, and each drop is recorded in red_team.defense_degraded (same null-when-clean shape as coverage_gap) and rendered as a CAUTION block, so a degraded defense wave is never presented as a complete one. A dropped promotion is credited in no metric.

Re-characterizations survive the merge

A defender can maintain a finding while correcting its location, method, and remediation after re-reading the file. The merge picked the descriptive owner by remediation length, so a terser correction lost every corrected field back to the stale original and its fix landed behind the original's in suggested_variants — a fix applier working from the report would change code that was never defective. Maintained findings now merge through recharacterize(), which makes the defender's payload the descriptive owner whenever it proposed a remediation. A payload without one keeps the original's fields, preserving the invariant that current and suggested describe one change.

Deterministic gates on agent-reported data

Two values flowed through the pipeline unvalidated although a script can check both. The gates run skill-side between stages, because the workflow script is filesystem-sandboxed and carrying file bodies in the manifest would breach the run-script size cap.

Gate	Point	Effect
workflow/verify-method-counts.sh	Phase 1, before the manifest freezes	Re-extracts every entry's test method names from disk; a mismatched method_count/test_methods is replaced with the extracted truth and logged, never merely warned
workflow/verify-finding-evidence.sh	Phase 5, before the merge	A kept finding whose non-empty current block does not occur in the target file under whitespace normalization is demoted to contested with an outcome naming the failed match; findings that quoted no code are exempt

The evidence gate also syncs each demotion into the file's adversarial_input, so a fabricated quote never reaches the merge, the red team, or the report as kept — one invocation covers Phase 5 and Phase 6. Both scripts validate their input shape per entry and fail hard on a corrupted manifest or result instead of repairing it.

Scrutiny labels and the fix-application contract

The report never distinguished findings that survived a red team from findings nothing ever challenged. Every rendered finding now carries Scrutiny: adversary-tested | consensus-only, derived from which stage produced the file's final per-finding state — never asserted per finding by any agent.

The new references/fix-application.md is the contract for whoever applies a report's remediations: apply the report's final suggested verbatim and keep suggested_variants as human-facing alternatives; self-review the fix diff before committing (DESIGN-003/DESIGN-004 across co-touched files, a tautology check on every added test, and the same PHPStan/php-cs-fixer gates the reviewed code passes through); judge any mutant against the whole suite, never a single test; re-verify the factual premise of a consensus-only must-fix finding before applying it; and verify every reported commit with git merge-base --is-ancestor before calling it landed.

[github-actions]

Agent Skills Export

Built 7 skill packages:

• commit-message-writing
• ci-log-interpretation
• release-info-writing
• adr-writing
• pr-description-writing
• structuring-documentation
• feature-branch-pr-writing