# Tricritical plugin

Tricritical is an Agent Plugins review package with native Claude agent aliases.
It separates independent observation from adjudication, authorized revision,
and repetition.

## Public skills

| Skill        | Persona      | Role        | Mutates directly | Can cause mutation | Requires original mutation authority | Repeats | Calls                      |
| ------------ | ------------ | ----------- | ---------------- | ------------------ | ------------------------------------ | ------- | -------------------------- |
| `review`     | —            | coordinator | no               | no                 | no                                   | no      | intent, runtime, structure |
| `intent`     | Oathfinder   | critic      | no               | no                 | no                                   | no      | —                          |
| `runtime`    | Faultwalker  | critic      | no               | no                 | no                                   | no      | —                          |
| `structure`  | Knotcutter   | critic      | no               | no                 | no                                   | no      | —                          |
| `adjudicate` | Claimweigher | adjudicator | no               | no                 | no                                   | no      | —                          |
| `revise`     | Formwright   | reviser     | yes              | yes                | yes                                  | no      | —                          |
| `loop`       | Fathomkeeper | loop        | no               | yes                | yes                                  | yes     | review, adjudicate, revise |

## Adapter boundary

Root `plugin.json` and `skills/` are the canonical Agent Plugins package. The
package-level `references/` files are the authored shared runtime sources.
Each public skill loads generated byte-identical projections beneath
its own `references/` directory, so a client that installs one skill root can
resolve every shared runtime resource without package-parent access. Run the
Tricritical content-lock writer after changing an authored shared source; it
refreshes the required per-skill projections before locking them.
Claude Code has no standard agent component, so its native adapter auto-discovers
root `agents/*.md`; each file is an
exact minimal forwarder to one public skill. Codex consumes `skills/` and each
skill's `agents/openai.yaml`, but not root Claude agents. A Codex named-agent
projection belongs to a local harness configuration and must call the public
skill rather than copy its policy.

Semantic skill-to-skill edges use literal public identities linked to sibling
`SKILL.md` files and remain relative and unqualified. Claude adapters, the Codex
extension, and `agents/openai.yaml` prompts use `$tricritical:<skill>` targets.
Ordinary review consumes a live model-selection record per execution and a
separate Rolecasting frozen invocation plan. The same leader verifies distinct
worker contexts, unchanged inputs, completed reports, and declared verification.
The resulting hand-back reports review status and its assurance limits; it does
not attest the effective model or product-enforced permissions.

Explicitly witnessed review adds separate authenticated model-selection and
invocation-topology receipts through `conditional_requires.witnessed`. Missing
issuance or a consumer minimum above the route's capability blocks that mode.
Neither mode changes original authority, closed dispatch membership, review
completeness, or freshness. A changed candidate or evidence dependency requires
fresh affected review before a downstream action. See the shared
[invocation boundary](references/invocation-boundary.md).

`topology.json` is the sole machine-readable authority and dependency
declaration. The table above and sibling skill links are validated projections
of that file. It is a source-stage record that release projections omit, so
installed skills rely on those validated links and skill bodies instead of
reading it. Its `schema_version` versions Tricritical's topology shape; it is
not a repository-wide interchange-schema version.

The raw evaluation corpus and its isolation protocol are documented in
`evals/README.md`. Run
`uv run --with PyYAML python scripts/validate_tricritical.py` from the
repository root after changes. That validator proves structural and corpus
declarations only; it does not enforce an external evaluation runner or prove
LLM behavior. It validates a private immutable byte snapshot and reports that
snapshot's identity. Run it only while no concurrent writer can modify the checkout;
live-tree drift detection remains an additional operational gate, not the
identity of the validated snapshot.

## Terminal evidence owner

The closed owner contract is documented in
`skills/loop/references/review-evidence.md`. Task Witness may register the
Tricritical terminal-evidence validator, but this package intentionally
registers no producer or issuer. The v2 projection preserves Rolecasting's
target, topology, authority, execution result, and assurance evidence as
`final_dispatch`; Tricritical does not promote weaker evidence. Authenticated
Rolecasting execution is not available in the installed integration, so
validation is limited to retained evidence and fixture/bootstrap bundles. This
is not a new-publication producer chain and does not establish canonical
end-to-end reachability.