Post-refutation fixes (cross-family pawl caught two defects in the first cut):
- DEFECT 1 (fail-open): the agy/local-mlx genuine-run marker 'VERDICT:' appears in the
packet itself, so a run that merely cat/echoed the packet classified GENUINE and the
last-verdict parser could extract a CONFIRMED from echoed diff-context lines. Fixed:
sentinel-wrapped agy packets (random-nonce boundary lines) + a marker-independent
packet-line containment check (reviewer_packet_echoed) classify packet echo as ECHO.
- DEFECT 2 (wrong family certified): the verdict write hardcoded --refuter codex:...;
REVIEWER=agy now certifies the canonical 'gemini' family (roster: agy|google->gemini),
codex stays byte-identical, local-mlx gets a deliberately off-roster label so an
opted-in eval verdict can never pass the prod roster check.
boshu