feat: adjudication succession — judge/synthesizer failover on infrastructure errors (DSE-1512)

[ernestprovo23]

Summary

Closes DSE-1512 — follow-up to DSE-901 (v1.3.0), which made a judge/synthesizer failure visible (exit 3) but deferred failover.

One synthesizer identity served three roles (prose synthesis, adversarial judge, verdict extraction); a single vendor outage zeroed all three. This PR adds an operator-declared succession ladder with one strict rule, and records every attempt on the manifest.

• --synthesizer claude>grok>gemini · config synthesizer_chain: [claude, grok, gemini] · Council(synthesizer="claude>grok") / list. Chain of one == v1.3.0 behaviour.
• Failover fires only on infrastructure failures. Typed at the raise site — never from error text:

Category	Trigger	Next candidate?
unkeyed / unresolved	no key / unknown provider	yes (no call)
auth	401 / 403	yes
quota	402 / 429	yes
unavailable	5xx	yes
timeout / transport	deadline, DNS, connection	yes
bad_request	other 4xx	no
malformed_response	2xx, unusable content	no — the model answered

• Roles covered: synthesis, debate_final, judge, verdict_extraction, and streaming synthesis (fails over only before the first token).
• ModelHarnessManifest.adjudication_succession — per attempt: role, candidate, model_id, attempt_index, outcome, failure_category, http_status. No free text (a raw error body could contain "authorization" and un-verify the secret_safety stamp).
• result.synthesizer / adversarial.judge name the candidate that actually adjudicated. A successor run exits 0; degraded / exit 3 now means the ladder was exhausted. New CouncilResult.primary_failed_over computed field.
• CLI prints one dim stderr line on failover; conclave providers shows the configured chain.

Changed (deliberate)

• debate / adversarial manifests now carry the judge / final-consolidation receipt they previously omitted (every real call gets a receipt).
• Cache: full chain in identity; CACHE_FORMAT_VERSION 3 → 4 (old entries miss safely). A run adjudicated by a successor, or whose ladder was exhausted, is never stored (buffered and --stream) — a hit must never pin a non-primary result or replay an outage. Chain-of-one consequence: a degraded run whose sole synthesizer errored for an infra reason is no longer cached. terminal_failure runs stay cacheable.
• ProviderError / TransportError gain keyword-only category (+ http_status); positional construction unchanged.

Not changed (deliberate)

• Verdict extraction's same-model repair retry still runs after an infra error — follow-up. Its outcome can never turn a content failure into a failover: a candidate's fate is decided by whether it ever answered.
• Member-level failover, transport retries, the substring-derived ReceiptErrorCategory on receipts.
• redact(), scan_for_secret_material(), verified_secret_safety(), _receipt_error_category() — untouched (verified per unit).

Release classification

release_control.py classify → security-specific (security-control behavior changed). This is the classifier's vocabulary rule — the changed lines necessarily contain role, token, secret, redact, provenance, validation — not a change to any security control. Per release-control.md the classifier is the authority: merge requires one human approval receipt at the exact head SHA. CSO + QA read-only reviews attached in the PR comments.

Verification

• Plan: docs/plans/2026-09-03-adjudication-succession.md (10 tasks, TDD, two-stage review per unit).
• Round 3: CSO read-only review (YELLOW → all three findings fixed in 0e18a18 / 618c26a) and QA adversarial review (FIX FIRST → the verdict-extraction "ever answered" rule, the --stream cache guard, and primary_failed_over counting a successor after a skipped primary, all fixed in 0e18a18; re-verified on the final head). Summaries in the PR comments.
• Suite on the builder: 733 → 830 passed, 0 failures; ruff check + ruff format --check clean (incl. Markdown Python blocks).
• CI: pytest 3.11 / 3.12 / 3.13, ruff, pip-audit, Gitleaks.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K1dHPjZ1bZcE2GnX3KMMSH

[ernestprovo23]

Round 3 reviews (read-only, on the builder) — summary

Chief Security Officer review — ab47f60 → YELLOW, all findings resolved

• Control-change determination: no authentication / credential / redaction / secret-scan / transport-hardening control changed behaviour, scope, enforcement, bypass, or configuration. redact, scan_for_secret_material, verified_secret_safety, _receipt_error_category, _resolve_key, key_present, key_source byte-identical to main (AST hash); registry.py untouched; transport from None + __context__ = None discipline intact at all raise sites; ProviderError still redacts on construction; the new category / http_status attributes cannot carry a request reference.
• The security-specific classification is the classifier's vocabulary rule (role, token, secret, redact, provenance, validation in the changed lines) plus the SECURITY.md control-plane path once the scope note was added.
• Noted improvement: failover decisions consume raise-site-typed categories, never _receipt_error_category()'s substring matching — a provider cannot steer a vendor swap with crafted error text, only with its HTTP status.
• Findings → fixes: (1) ask_stream cached without the no-store guard → guarded (0e18a18); (2) chain confidentiality (a chain widens which declared vendors receive the prompt) undocumented → README › Confidentiality, SECURITY.md scope note, PDD §2 qualifier (618c26a); (3) failure_category typed str → FailureCategory literal on the ledger and VerdictSynthesisResult (0e18a18).
• Security suites on the final head: test_keyleak_audit 23, test_secret_safety_matrix 7, test_transport 8, test_failure_category 24+ — all pass.

QA adversarial review — ab47f60 → FIX FIRST, re-verified on the final head → SHIP

• Critical (fixed 0e18a18): verdict extraction read the failure category from the last attempt, so "initial 200-prose → repair 429" failed over after the model had answered. Rule now: a candidate that ever answered is terminal; only two errored attempts can fail over. Probed all three directions.
• Important (fixed 0e18a18): ask_stream store site lacked the primary_failed_over guard.
• Important (fixed 0e18a18, then made uniform in the final commit): an unkeyed primary was skipped_unkeyed, not counted as a primary failure, so a successor-adjudicated run was cached under a key that matches once the key is restored. Final rule: the primary adjudicator (attempt 1 of any role) did not adjudicate for an infrastructure reason — missing key included — or the ladder was exhausted ⇒ never stored; terminal_failure stays cacheable.
• Minors fixed: failed_over comment wording; verdict receipts renumbered across candidates; categorize_http_status 1xx/3xx → unexpected; stale synthesize_blocks / modes.py docstrings.
• Invariants that held under attack: failover never fires on a content failure anywhere else (stream-frame in-band errors, empty streams, status ordering); secret_safety re-stamped after the last append on every path (35 probes); exit codes / degraded / primary_failed_over consistent; streaming fails over only before the first delta with the real category on the ledger; config/CLI parsing edge cases.
• Base-vs-head regression matrix (7b79128 vs head, 20–50 scenarios, full normalized model_dump + call log + stream events + cache decision): every difference is one of the two documented changes — the new debate_final / judge receipt (+ derived redacted_errors), and the cache no-store rule.

🤖 Generated with Claude Code

[ernestprovo23]

Merge receipt (release-control, security-specific). Approval received in the authenticated Claude Code chat from the repository owner on 2026-09-04: APPROVE merge DataScience-EngineeringExperts/conclave PR #63 at b2d7006a5eeba0416796c077e0dd2b01a284a7fa → main. Head SHA verified equal to the approved SHA immediately before merge; CI green; classification security-specific (vocabulary rule + SECURITY.md scope note; no security control changed — guarded functions byte-identical to main). Merged via release_control.py merge --method squash → 7edb3a141b33bfdecbedfb2e010993ce266b5aa4.