fix: resolve validation findings from 4-critic self-review

CRITICAL fix:
- {PRESCREEN_EVIDENCE} now injected for security AND code_hygiene critics
  (was incorrectly scoped to security only, breaking code_hygiene's
  pre-screen integration design)

HIGH fixes:
- Document all 10 pre-screen checks (PS-001–PS-010) including PS-004/005/009/010
- Add --dispatch parameter to Parameters table
- Add error handlers: corrupt rubric JSON, invalid critic JSON response
- Fix verdict PASS condition: 'No findings or only INFO' (was undefined 'FAIL')
- Add DEGRADED/PARTIAL verdict behavior documentation
- Add evidence_tool to Step 4a validation requirements

MEDIUM fixes:
- Fix Quick Reference: 'task agents, sequential by default' (was 'parallel')
- Align critic dispatch order between diagram and progress messages
- Normalize 'Security Critic' naming in code_hygiene.yaml (was mixed CamelCase)
- Mark RELATIONSHIPS parameter and escalation rule as 'not yet ported'
- Sanitize error message templates (rubric names only, not full path listing)

Author: Akkari

ports/copilot-cli/SKILL.md

@@ -13,7 +13,7 @@ USER INVOCATION → Parse parameters
   │
   ├─ PRE-SCREEN: Run quorum-prescreen.py (deterministic, <5s)
   │
-  ├─ CRITIC DISPATCH (parallel task agents):
+  ├─ CRITIC DISPATCH (task agents, sequential by default):
   │    ├─ Correctness Critic → factual accuracy, logical consistency
   │    ├─ Completeness Critic → coverage gaps, missing requirements
   │    ├─ Security Critic → framework-grounded security analysis
@@ -32,8 +32,9 @@ USER INVOCATION → Parse parameters
 |-----------|----------|---------|-------------|
 | `TARGET` | Yes | — | Path to the artifact to validate |
 | `RUBRIC` | No | Auto-detect from file extension | Rubric name or path to rubric JSON |
-| `DEPTH` | No | `standard` | `quick` (1 critic) / `standard` (3 critics) / `thorough` (3 + learning review) |
-| `RELATIONSHIPS` | No | — | Path to `quorum-relationships.yaml` for cross-artifact checks |
+| `DEPTH` | No | `standard` | `quick` / `standard` / `thorough` (see Depth Profiles below) |
+| `RELATIONSHIPS` | No | — | Path to `quorum-relationships.yaml` for cross-artifact checks (not yet ported; reserved for future use) |
+| `--dispatch` | No | `lightweight` | Dispatch tier: `lightweight` (sequential), `standard` (2 concurrent), `performance` (4 concurrent) |
 
 **Auto-detection mapping:**
 - `.py` → `python-code`
@@ -79,13 +80,17 @@ Run the deterministic pre-screen before any critic dispatch:
 python3 quorum-prescreen.py "{TARGET}" --output json
 ```
 
-The pre-screen runs 10 regex-based checks (PS-001 through PS-010):
+The pre-screen runs regex-based checks including:
 - PS-001: Hardcoded paths
 - PS-002: Credential patterns
 - PS-003: PII patterns
+- PS-004: JSON validity
+- PS-005: YAML validity
 - PS-006: Python syntax
 - PS-007: Broken markdown links
 - PS-008: TODO markers
+- PS-009: Whitespace issues
+- PS-010: Empty file detection
 
 Capture the JSON output. This becomes `{PRESCREEN_EVIDENCE}` injected into critic prompts.
 
@@ -106,7 +111,7 @@ Launch all 4 critics. Each receives:
 - Any mandatory known-issue patterns
 
 ### At `thorough` depth
-Same as standard (4 critics), plus:
+Same as standard, plus:
 - All known-issue patterns (not just mandatory) injected into critic prompts
 - Model tier upgraded to Tier 1 (Opus-class) for all critics
 
@@ -117,7 +122,7 @@ For each critic, construct the prompt by filling the critic YAML's `prompt_templ
 1. `{ARTIFACT_TEXT}` ← full artifact content
 2. `{RUBRIC_NAME}`, `{RUBRIC_VERSION}`, `{RUBRIC_DOMAIN}` ← from rubric JSON
 3. `{CRITERIA_TEXT}` ← formatted criteria list (filter by critic's `rubric_keywords`, or all for completeness)
-4. `{PRESCREEN_EVIDENCE}` ← pre-screen JSON output (security critic only; empty for others)
+4. `{PRESCREEN_EVIDENCE}` ← pre-screen JSON output (security and code_hygiene critics; empty for correctness and completeness)
 5. `{EXTRA_CONTEXT}` ← mandatory known-issue patterns + any additional context
 
 **Dispatch via `task` tool:**
@@ -130,8 +135,8 @@ Each critic is dispatched as a task agent. The system prompt comes from the crit
 
 **Progress indicators:** After dispatching each critic, inform the user:
 - "🔍 Correctness critic dispatched (1 of 4)..."
-- "🔍 Security critic dispatched (2 of 4)..."
-- "🔍 Completeness critic dispatched (3 of 4)..."
+- "🔍 Completeness critic dispatched (2 of 4)..."
+- "🔍 Security critic dispatched (3 of 4)..."
 - "🔍 Code Hygiene critic dispatched (4 of 4)..."
 - "⏳ Waiting for critic results..."
 
@@ -148,6 +153,7 @@ After all critics return, aggregate findings into a verdict.
 Parse each critic's JSON output. Validate that every finding has:
 - `severity` (CRITICAL/HIGH/MEDIUM/LOW/INFO)
 - `description` (non-empty)
+- `evidence_tool` (non-empty — how the finding was verified)
 - `evidence_result` (non-empty — reject findings without evidence)
 
 **Reject ungrounded findings.** If a finding lacks `evidence_result`, discard it and log: "Finding rejected: no evidence provided."
@@ -169,9 +175,9 @@ Apply rules from `verdict-rules.yaml` in order:
 | 3+ HIGH findings | **REVISE** |
 | Any HIGH (fewer than 3) | **PASS_WITH_NOTES** |
 | Only MEDIUM/LOW | **PASS_WITH_NOTES** |
-| No findings with evidence | **PASS** |
+| No findings (or only INFO) | **PASS** |
 
-**Escalation:** If cross-artifact relationship checks found HIGH or CRITICAL issues, escalate verdict by one level (PASS → PASS_WITH_NOTES, PASS_WITH_NOTES → REVISE).
+**Escalation:** If cross-artifact relationship checks found HIGH or CRITICAL issues, escalate verdict by one level (PASS → PASS_WITH_NOTES, PASS_WITH_NOTES → REVISE). Note: relationship checks are not yet ported; this rule is reserved for future use.
 
 **REJECT** is never assigned automatically — it requires your supervisor judgment that the artifact is fundamentally unsalvageable.
 
@@ -247,10 +253,12 @@ After verdict, update `learning/known_issues.json`:
 | Failure | Action |
 |---------|--------|
 | Target not found | Abort: "❌ Target file not found: {path}" |
-| Rubric not found | Abort: "❌ Rubric not found: {name}. Available: {list}" |
+| Rubric not found | Abort: "❌ Rubric not found: {name}. Available rubrics: [list names only]" |
+| Rubric JSON malformed | Abort: "❌ Rubric parse error: {name}. Verify JSON syntax." |
+| Critic returns invalid JSON | Treat as critic failure (DEGRADED). Log warning, proceed with remaining critics. |
 | Pre-screen script missing | Warn, continue without pre-screen |
-| 1-2 critics fail/time out | DEGRADED: produce verdict from remaining critics |
-| 3 critics fail | PARTIAL: produce verdict from sole remaining critic |
+| Some critics fail/time out | DEGRADED: produce verdict from remaining critics. Apply standard verdict rules to available findings. Tag output with "⚠️ DEGRADED: N of M critics returned." |
+| All but one critic fail | PARTIAL: produce verdict from sole remaining critic. Tag output with "⚠️ PARTIAL." Verdict reflects only that critic's coverage. |
 | All critics fail | Abort: "❌ QUORUM_FAILED: All critics failed" |
 | Finding lacks evidence | Reject finding silently, count in summary |
 | Known issues file corrupted | Warn, continue without learning memory |
@@ -294,4 +302,4 @@ cp -r quorum-copilot-skill ~/.copilot/skills/quorum
 
 **This is not** the full Quorum reference implementation. The CLI version has additional capabilities (batch processing, fix loops, cost tracking, tester verification). This skill covers the highest-value portion: deterministic pre-screen → parallel critic dispatch → evidence-grounded findings → deterministic verdict.
 
-**Capability coverage:** ~75% of reference implementation. Full 4-critic suite (correctness, completeness, security, code hygiene). Missing: tester (L1/L2 verification), fixer (automated remediation), batch mode, cost tracking, structured output artifacts. These are planned for future releases.
+**Capability coverage:** ~75% of reference implementation. Includes all four core evaluation critics. Not yet ported: L1/L2 verification, automated remediation, batch mode, cost tracking, structured output artifacts. These are planned for future releases.

ports/copilot-cli/critics/code_hygiene.yaml

@@ -16,7 +16,7 @@ model_tier: 2  # Sonnet-class for standard depth; Opus for thorough
 # ─── DELEGATION BOUNDARY ─────────────────────────────────────────────────────
 # This critic flags security-adjacent patterns for traceability and DELEGATES
 # security severity assessment to the Security Critic. It does NOT assign
-# HIGH/CRITICAL to these patterns — that is SecurityCritic's domain.
+# HIGH/CRITICAL to these patterns — that is Security Critic's domain.
 
 delegation:
   delegates_to:
@@ -28,7 +28,7 @@ delegation:
         - "Unsanitized user input in prompt construction (AP-01)"
       finding_template: >
         Code hygiene concern: {pattern} is difficult to audit and test.
-        Security severity and exploitability assessment delegated to SecurityCritic.
+        Security severity and exploitability assessment delegated to Security Critic.
       max_severity_from_this_critic: MEDIUM
 
 # ─── SYSTEM PROMPT ───────────────────────────────────────────────────────────
@@ -82,7 +82,7 @@ system_prompt: |
   ━━━ DO NOT ━━━
   - Re-flag PASSED pre-screen checks
   - Report auto-fixable formatting issues (indentation, line length, whitespace)
-  - Assign security severity to credential/injection patterns — delegate to SecurityCritic
+  - Assign security severity to credential/injection patterns — delegate to Security Critic
   - Invent code quotes — only cite text that appears verbatim in the artifact
   - Flag the same issue in multiple findings
 
@@ -230,7 +230,7 @@ categories:
     description: >
       Environment variable usage (no plaintext fallback defaults), secrets in log
       output at any level, secrets in exception messages, .env files excluded from VCS.
-      NOTE: Flag pattern only — delegate security assessment to SecurityCritic.
+      NOTE: Flag pattern only — delegate security assessment to Security Critic.
 
   - id: AP-05
     name: Timeout & Retry Logic
@@ -257,8 +257,8 @@ prescreen_integration:
     clean — do NOT re-flag. SKIP checks are not applicable.
   check_mapping:
     PS-001: { relates_to: [CAT-11, AP-04], action: "Assess semantic impact of hardcoded paths" }
-    PS-002: { relates_to: [AP-04], action: "Flag hygiene concern, delegate security to SecurityCritic" }
-    PS-003: { relates_to: [AP-04], action: "Flag hygiene concern, delegate security to SecurityCritic" }
+    PS-002: { relates_to: [AP-04], action: "Flag hygiene concern, delegate security to Security Critic" }
+    PS-003: { relates_to: [AP-04], action: "Flag hygiene concern, delegate security to Security Critic" }
     PS-006: { relates_to: [CAT-01], action: "Assess semantic impact of syntax issue" }
     PS-007: { relates_to: [CAT-06], action: "Assess documentation impact of broken links" }
     PS-008: { relates_to: [CAT-06], action: "Assess whether TODOs indicate incomplete implementation" }
@@ -308,7 +308,7 @@ prompt_template: |
 
   Delegation: For eval()/exec(), Invoke-Expression, hardcoded credentials, or
   unsanitized prompt input — flag the hygiene concern and state that security
-  assessment is delegated to SecurityCritic. Assign LOW/MEDIUM only.
+  assessment is delegated to Security Critic. Assign LOW/MEDIUM only.
 
   For each finding:
   1. Quote the specific code excerpt OR cite pre-screen check ID

ports/copilot-cli/verdict-rules.yaml

@@ -37,7 +37,7 @@ rules:
   - condition: "Only MEDIUM and/or LOW findings"
     verdict: PASS_WITH_NOTES
 
-  - condition: "No FAIL findings"
+  - condition: "No findings, or only INFO-severity findings"
     verdict: PASS
 
 # ─── ESCALATION ──────────────────────────────────────────────────────────────