Skip to content

Boundaries — what a verdict is and is not

Two constitutional reconciliations vt-c-pov must honor.

A verdict is a recommendation, not a workflow gate (Constitution II)

The toolkit's workflow gates (plan / build / review / finalize) are mandatory and enforced in state.yaml. vt-c-pov is not one of them. Its output is a decision recommendation with a handoff — it does not write a gate, does not block /vt-c-activate, and skipping it never fails a spec.

Why this matters: Constitution II mandates spec-driven development and gate enforcement. If vt-c-pov presented itself as a gate, it would create an un-enforced shadow gate that either gets bypassed (weakening the model) or blocks work it has no authority to block. So the verdict routes into the real workflow (/vt-c-spec-from-requirements, /vt-c-shape, /vt-c-quickfix) rather than standing beside it. The grade tells you which door to walk through; it does not lock any door.

Concretely: - Never phrase the output as "BLOCKED until…" or "gate: FAIL". - Never write to a *_gate field in any state.yaml. - A Hold means "not now, here's the re-open trigger" — informational, not enforcing.

No credentials in grounding (Constitution I)

The external-evidence-researcher reads external sources (repos, docs, package registries, advisories). It MUST NOT copy any secret into the grounding it returns:

  • No API keys, tokens, passwords, bearer tokens, connection strings.
  • No .env values (keep variable names if relevant, strip values).
  • No internal hostnames or absolute paths containing usernames.

Rule: if unsure whether a fragment is sensitive, omit it. This mirrors the Open Brain sanitization rule and the secret-scanner regex classes. A verdict never needs a live credential to be made — evidence of whether auth is required is enough; the credential itself is not.

Scope boundary — toolkit vs. product

Not-our-problem is a first-class verdict, not a cop-out. Some candidates are sound and adoptable but belong to a consuming product repo (VisiMatch, VisiFair, an Angular app), not the vt-c-* toolkit. When that's the case, grade Not-our-problem and name the target repo/namespace — consistent with the no-cross-repo-specs rule (don't pull a product deliverable into the toolkit).