Nothing reviews the authored witness for semantic quality — lexical density screen, optional mutation audit, and a verifier that never sees it

[macanderson]

Problem

A witness that is lexically substantive but semantically vacuous — asserting a value the goal does not decide, pinning an unrelated behavior — has no reviewer anywhere:

• The density screen is lexical and names its own blind spots (crates/stella-pipeline/src/witness/density.rs: runtime-assembled assertions, cross-file macros, templates all pass).
• The mutation audit (Verification §1 (Phase 4): mutation-check the witness — apply trivial mutations and downgrade a tautological witness that stays green #870) only runs when a fast-submit is imminent, is optional, and degrades open on Unavailable (pipeline.rs pre-submit audit).
• The model verifier never reads the witness source at all — strip_witness_hunks removes it from the diff deliberately (bounded_worker_diff is a blind char clamp: token-blind, relevance-blind, and it bills the witness's own diff to the verdict #1433).

So the strongest evidence channel (the flip) can be armed by a test nothing semantically reviewed. docs/spec/witness-protocol.md §5 declines exam families and dual examiners; this gap is narrower than either — it is "no single reader ever asks whether the witness tests the goal".

Fix direction (design pass first)

Options to weigh, cheapest first: (a) extend the mutation audit to run on witnessed candidates regardless of fast-submit; (b) a one-shot management call reviewing the witness source against the goal at authoring time (bounded, cacheable — but it re-opens the §5 spend argument); (c) fold witness-vs-goal review into the existing verdict call's evidence rather than a new call. Record whichever is declined in the spec's §5 style.

Verify

Whichever lands: a scripted witness asserting an unrelated constant survives today's path to a credited flip; after the fix it is refused/flagged with a named reason.

[macanderson]

Triage 2026-08-06: P2 — a design pass, and the existing screens (lexical density, optional mutation audit) bound the exposure today. Plan: as specced in the body; next step is weighing options (a)/(b)/(c) with (a) — running the mutation audit on all witnessed candidates regardless of fast-submit — as the cheapest candidate, and recording whichever is declined in witness-protocol.md §5 style.

[macanderson]

Recommendation from the follow-up rounds, for whoever picks this up: option (a) — extend the mutation audit (#870) to run before crediting a flip-corroborated ModelVerdict pass, not only when a fast-submit is imminent. It is deterministic (no model spend, unlike option (b)), reuses shipped machinery, and covers the exact gap: a flip that corroborates a verifier pass without ever being mutation-checked. Wall-clock cost is bounded by the same mutant budget the fast-submit path already pays. Option (b) (a witness-review model call) re-opens the spec §5 spend argument and should be declined in §5 style if (a) proves sufficient. Note the evidence now includes witness_baseline=build_failure (#1790, PR #1890) — a mutation audit on compile-armed flips needs the artifact to build post-change, which it does by construction (the candidate's suite ran).