trusted posture auto-sets require_independent_witness but not require_independent_verifier — equivalent today, drifts if the probes diverge

[macanderson]

Problem

trusted_posture_requires_independent_witness
(crates/stella-cli/src/agent/engine.rs) auto-sets
PipelineConfig::require_independent_witness for a trusted posture that names
a distinct verifier. #1795 added require_independent_verifier (the verdict
gate), reachable only via the settings key
pipeline_require_independent_verifier.

Today the two gates read the SAME probe
(Pipeline::witness_author_independence, worker-vs-verifier model-ref), so the
trusted posture is fully protected by the witness gate alone and auto-setting
the second flag would change nothing. But that equivalence is incidental: if
either gate's probe ever specializes (e.g. the verdict gate keying on
agents.verifier per-role overrides — see #1785, where those overrides
already miss the witness author), the trusted posture would silently lose the
verdict-side refusal it believes it has.

What to do

Either auto-set both flags from the trusted-posture predicate (one line in
pipeline_config_for_approval_capability), or add a test pinning that the two
gates share one probe so a future divergence fails loudly. The second is
weaker but cheaper; the first is the honest parity.

Where to look

• crates/stella-cli/src/agent/engine.rs — trusted_posture_requires_independent_witness,
  pipeline_config_for_approval_capability, apply_pipeline_tuning.
• crates/stella-pipeline/src/pipeline.rs — the two pre-spend gates in run.
• Related: agents.verifier overrides never reach the witness author, which runs the verifier's model with the worker's tuning #1785, Nothing enforces verifier != worker for the verdict call — one configured provider means the worker grades itself with a prose warning #1795.

Done when

A trusted posture that names a distinct verifier refuses on BOTH gates (or a
test pins the shared probe), with the choice recorded in the PR.

[macanderson]

Triage 2026-08-06: P2 — nothing is wrong today (both gates read the same witness_author_independence probe, so the trusted posture is fully covered), but the equivalence is incidental and #1785 shows the probes are already under pressure to specialize; when they diverge, the posture silently loses a refusal it believes it has. Plan: as specced; next step is the honest parity — auto-set both flags in pipeline_config_for_approval_capability — with the shared-probe pin test as the cheaper fallback; per the standing rule, record which was chosen and why in the PR so the tradeoff is a maintainer decision, not a silent one.