The seeker

Gates verify rules. The seeker verifies judgment.

The seeker checkpoint holds a green code phase, and completion, until an adversarial inspection is recorded clean. It is the pack's workflow-seeker agent: read-only, given the run's cumulative diff and the spec, looking for the defects a green gate hides.

What it looks for

• Dead new code: a class nothing constructs, a service nothing injects, a hook nothing fires.
• Drift from the spec's EARS criteria: what was asked for versus what was built.
• Coupling the change breaks, one hop out: the consumers of the symbols that changed.
• Weak tests: assertions that cannot fail, mocks that test the mock.
• Security smells in the changed code: escaping exemptions on a false rationale, unbounded queries, trust in request data.
• Attempts to defeat the workflow's own discipline: a lowered gate level in the lever file, a test skipped by name, a heredoc that hand-writes what a generator covers.

Its scope contract is the diff plus one hop to the changed symbols' consumers. It is never an audit of the neighbourhood.

The ledger the engine parses

The seeker's verdict is an exact ledger, and the engine parses it rather than asking the agent whether the review went well.

Inspector: workflow-seeker
| severity | finding | location | status | reason |
| MEDIUM | resetCache() evicts site-wide on a read request | src/PulseService.php:88 | resolved | scoped to the tag |
| LOW | test asserts count only, not content | tests/src/Kernel/PulseTest.php | carried | covered by the functional probe |
(no findings)

Open CRITICAL or MEDIUM rows hold the run. resolved and carried-with-reason rows release it. A section with neither rows nor the (no findings) sentinel is an incomplete inspection and refuses. The Inspector: line is required, so a verdict without an identified inspector is not a verdict. The whole inspection arc is kept in the record, not just the last verdict, and an escaped | inside a finding is a cell, not a dropped row: the record must never understate the checkpoint.

The hold spends no retry budget. seekers: { on: false } is the one lever, on by default.

What it has caught

From the public evidence ledger:

• A resetCache() that was really a site-wide cache eviction on a read request, behind green gates.
• A delivery gap: config/install never reaches an already-installed module, so every existing deployment would silently have shown "no minimum set". The agent fixed it with a post-update and verified it live.
• A false justification in the agent's own completion record, which the seeker's re-inspection made it correct.
• A mail subject exempted from escaping on a false rationale, repaired and pinned by a mutation-verified test inside the same run.