Adaptive Review Orchestrator

Role: Autonomously execute review protocols by dispatching nested subagents. Eliminates manual protocol selection — the orchestrator starts with Sentry and auto-escalates based on finding severity.

Setup

Run the orchestrator as one subagent (${SLOT.TOOL_SUBAGENT}) that may itself dispatch subagents and write its report. Where the host lets you define a reusable subagent type, define one named adaptive_reviewer that may dispatch subagents and write files. Prompt it with:

Review [target files/directory]. Context: [what changed, why]

The orchestrator handles everything internally and reports back with a structured synthesis.

Auto-Escalation Logic

The orchestrator runs Sentry first, then decides:

Citadel Protocol

Citadel applies the same adversarial information-partitioning principle as Layer 2 verification, but to the review process itself.

Cycle Structure

For each prong pair (e.g., Correctness + Portability):

1. 🔴 Prosecutor: Reviews code with the goal of finding every possible defect. Incentivized to over-report.
2. 🟢 Defender: Reviews the same code with the goal of proving correctness. Incentivized to disprove findings.
3. ⚖️ Arbiter (orchestrator): Reconciles both reports. Only findings that survive the defense make the final cut.

Why Adversarial?

• Eliminates false positives: A cooperative auditor can't catch its own over-reporting bias. A Defender filters noise (e.g., test fixture strings flagged as "hardcoded paths").
• Eliminates false negatives: A Prosecutor actively hunts for issues a cooperative auditor might rationalize away.
• Information asymmetry: Prosecutor sees code + tests, Defender sees code + docstrings/specs. Neither has full context — truth emerges from intersection.

Iteration (No Deferrals)

1. Review: Fan out 8 orthogonal prongs (Cycle 1 may be cooperative for triage speed).
2. Fix everything: Address ALL findings — security, correctness, quality, elegance. Nothing is deferred. RCA each finding: what broke, how we missed it, antipattern candidate.
3. Adversarial re-review: Re-run affected prongs with Prosecutor/Defender pairs. New findings from fixes are treated the same — fix everything.
4. Repeat steps 2-3 until all 8 prongs return zero surviving findings in the same cycle.
5. Ship: Only when the full adversarial cycle is clean.

Self-Healing

If Bastion returns BLOCK:

1. Re-dispatch Probe on failed fixes with Bastion's objections
2. Re-run Bastion (max 1 retry)
3. If still BLOCK → report to parent

If Gauntlet breaks fixes:

1. Re-dispatch Probe with Gauntlet attack vectors as context
2. Continue to Bastion with revised fixes

Phase 0: Triage (No Subagent)

Before dispatching, the orchestrator inspects the target:

• hooks/**, Makefile, install* → HIGH sensitivity (Security lens mandatory)
• rules/*.md (semantic) → MEDIUM (Compliance lens)
• docs/**, README → LOW (may stop at Sweep)
• Read governance/debrief_queue.jsonl for known anti-patterns

Subagent Rules

1. ALL prong subagents: ${SLOT.MODEL_FAST} model, read-only (no write tools)
2. Context Pre-Seed every prompt (~200 token header)
3. Orthogonal Persona Mandate: no two scouts share the same lens
4. Kill each subagent immediately after debrief
5. Max 12 dispatches (hard cap)

Output Format

# Adaptive Review — [Target]
## Protocol: [auto-selected] (escalated from Sentry)
## Verdict: SHIP / BLOCK / REVISE

## 🔴 Critical Findings
## ⚠️ Warnings
## Proposed Fixes (post-Gauntlet if applicable)
## Stats (dispatches, prongs, wall-clock)

Proven Results (E11 Testing)

When NOT to Use

• Patrol (known single-file defect): Use the staff-review skill directly in Patrol mode — adaptive triage adds unnecessary overhead for known defects.
• Post-mortem analysis: Use standalone Sentry — no fixes needed.
• Live monitoring: Use session-monitor skill instead.