/qe-court

name: "qe-court"
description: "Adversarial review court — a delivery (diff, PR, test suite, or artifact) is prosecuted by independent AI reviewers from different vendors, each with its own probe set, then a SHIP verdict must SURVIVE escalating deeper reviewers before it stands. Use when you want more than one reviewer's opinion on whether something is safe to ship: pre-merge gating, release go/no-go, catching a too-easy PASS, or any 'is this actually done?' decision where a shallow approval is a risk. Produces a signed court record with a three-valued verdict (SHIP / REMAND / BLOCK) and a human as final judge. Learns over time: reproduced charges and overturned SHIPs feed the QE flywheel."
trust_tier: 3
validation:
  schema_path: schemas/output.json
  validator_path: scripts/validate-config.json
  eval_path: evals/qe-court.yaml
  status: passing
  passRate: 1.0
  criticalPassRate: 1.0
  lastValidated: "2026-07-18"

QE-Court: Adversarial Review as a Verdict

Purpose

One reviewer — even a strong one — is one Einstein squinting at the chalkboard. QE-Court convenes **independent adversaries from different vendors, with different roles and different probe sets**, makes them attack the delivery, and then forces any `SHIP` verdict to *survive* an escalating deeper review before it stands. You stay in the loop as the final judge. Implements ADR-124; composes ADR-117..122.

**The one rule that makes it a court and not a rubber stamp:** a passing grade is the *claim under attack*, not the finish line. A shallow `91/100 SHIP` that a deeper reviewer can overturn is a bug in the review, not a delivery that shipped.

When to convene the court

• Pre-merge gate on a risky PR or diff
• Release go/no-go ("deployment readiness with a jury")
• You got a PASS that felt too easy and want it stress-tested
• A test suite claims coverage you don't trust (does it kill mutants?)
• Any high-stakes "is this actually done?" call

For a quick single-lens review, use `/sherlock-review`, `/brutal-honesty-review`, or `/code-review` instead — the court is for when one opinion isn't enough.

The court roster (composes existing skills/agents — do NOT reimplement critics)

| Role | Who | Job | |------|-----|-----| | **Defense** | writer model (summarizer) | States the case-FOR-ship from the evidence. Never grades. | | **Prosecution** | `qe-devils-advocate`, `brutal-honesty-review`, `sherlock-review`, `qe-security-scanner`, `qe-mutation-tester`, **`codex exec review`** | Each files CHARGES against the delivery, **with its own probe set**, blind to the others until filing. | | **Blind refuter** | `src/verification/adversarial-verify` | Tries to KILL weak charges (default-refuted-if-uncertain). | | **Jury** | two-gate LLM-judge (ADR-119), cross-model | Weighs surviving charges → verdict + (optional) score. | | **Deeper reviewer** | higher effort/model tier of any prosecutor | The overturn round. | | **Judge** | **you (the human)** | Sees the strongest case for AND against; rules. |

> ⚠️ **Do NOT run the reduced 3-dimension QCSD workflow as the court engine.** It > can falsely rate SHIP by skipping the security / mutation / defect lanes. Spawn > the *specialized* `qe-*` prosecutors above, or you reproduce the exact > false-SHIP the court exists to catch. (ADR-124; see `qcsd-development-swarm`.)

Model routing (configurable — this is the point of the court)

The court's guarantees come from **who** reviews, not just how. Routing is **user-configurable** in `config.json` under `routing`; the defaults below enforce the invariants. Every model call goes through AQE's provider layer (ADR-123), so budget caps and cost receipts apply automatically.

| Step | Default provider / tier | Why | |------|------------------------|-----| | **Defense** | `claude-code` (default) or `cognitum-low` (may equal writer) | Cheap; states the case, never grades. Must differ in vendor from the jury | | Prosecutor — devils-advocate | `cognitum-mid` | Gap/assumption hunting | | Prosecutor — brutal-honesty | `claude-code` (Opus/Sonnet) | Rigor lens, different family from jury | | Prosecutor — sherlock | `cognitum-high` | Deductive/root-cause needs a strong model | | Prosecutor — security-scanner | SAST tool + `cognitum-mid` | Determinism where possible | | Prosecutor — mutation | mutation tool + `local`/booster | Test-adequacy is mechanical | | Prosecutor — codex-review | `codex` (ChatGPT sub) | **Cross-vendor GPT brain — true writer≠juror; ≈$0** | | **Jury** (two-gate judge) | `cognitum-high` or Opus, `provider ≠ writer` | Must not grade its own family's output | | **Deeper reviewer** | highest tier / best-of-N @ higher effort | Escalation must be *stronger* than the base panel |

**Provider menu** (mix freely in `routing`): `claude-code` (Claude subscription), `cognitum-{low,mid,high}` (Cognitum's own multi-model tiers — one option, it routes internally), `openrouter` (**use when you want many distinct models** across vendors for breadth), `codex` (GPT via ChatGPT subscription), `claude`/`openai`/`gemini` (metered APIs), `ollama` (local). Cognitum and OpenRouter are *separate* options: Cognitum already resolves multiple models behind its tiers; OpenRouter is the lever when you explicitly want to name several different models.

**Enforced invariants** (defaults; do not weaken without reason): 1. **≥2 distinct vendors** across the panel — Claude / Cognitum / GPT-via-Codex — not just tiers. 2. **Jury provider ∉ {writer, defense}** — no model grades its own or its writer's output. Vendor is compared **coarsely**: `cognitum-low` and `cognitum-high` are the same vendor, so pairing them across defense and jury is a violation, not a diverse panel. 3. All calls routed through `ProviderManager` → ADR-123 budget cap + receipts.

Invariants 1–2 are machine-checked by `validateCourtConfig()` in `referee.ts`, which the court MUST call before seating a panel (see *How to run it*). The `options` block below binds directly to that check — `mi