feat(guidance): the agent is the judge — stated in the product, not in a rule

I recorded this as project rule 174 first. That was wrong twice over, and the
second reason is the one that matters.

RULE 119 SAYS THIS EXACTLY: guidance about how an agent should behave with
Scribe belongs in `_INSTRUCTIONS`, `plugin/skills/*` or the adapter's static
context, never in the corpus. I read 119 while writing the rule, decided it was
"about authority rather than about using Scribe", and wrote it anyway — which
is the reasoning preference 29 exists to catch, performed in full.

THE REASON THAT MATTERS: a rule in the corpus is true on ONE install. If the
agent being the judge is how Scribe works, every install gets it or none does.
Baked in, it ships. As a rule it was one operator's private note about a
product stance.

WHAT IT SAYS. The agent is the judge of record for the work — what a shape is,
whether a finding holds, whether something is done. Surfacing a finding for the
operator to rule on is the judgment NOT made, however well written up: it reads
as diligence and functions as a backlog. Escalate the acts that are genuinely
theirs — their money, their infrastructure, anything hard to reverse or facing
outward — and keep the decisions. A hard call is still yours; an irreversible
act is still theirs.

And the half that keeps this from becoming the previous defect: JUDGING IS
ATTENDED. An agent reading evidence and recording why is judgment; a threshold
or a sweep reclassifying in bulk with nobody reading is the thing that fills a
ledger with confident nonsense (#4208, and Portal's 35 rows). When the fix for
bad unattended writes is another unattended write, stop.

THE PRODUCT WAS TEACHING THE OPPOSITE. reporting-back's Finding row read
"Symptom · Cause · Size of the fix · **Offer to fix it**". So the behaviour I
was corrected for is the behaviour the skill prescribed — which is the better
argument for fixing it here than any rule could be.

Three surfaces, per 119 and the ownership registry (#4027): `_INSTRUCTIONS`
gets a one-line JUDGE index entry; using-scribe owns the authority and the
attended/unattended distinction; reporting-back owns the report shape. Two
topics rather than one, registered separately in test_guidance_ownership so
trimming one cannot quietly take the other.

Plugin version minted — skills only reach a session when the manifest moves
(#2209).

Rule 174 deleted (trash 074434a2, recoverable).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_guidance_ownership.py

@@ -212,6 +212,19 @@ TOPICS: tuple[Topic, ...] = (
           "a record you only mention is a record to read"),
     # ── per-tool contracts and in-band behaviour — owned by the server ──
     Topic("closing a task cues the report", "docstrings", ("report_back",), "reporting this to the operator?"),
+    # The agent is the judge (#4208). Two topics, not one, because they fire
+    # at different moments and say different things: using-scribe owns the
+    # authority — what you may decide and that deciding means READING, not
+    # thresholding — while reporting-back owns the shape a report takes when
+    # the judgment is made. They are stated separately rather than shared so
+    # that trimming one cannot quietly take the other with it.
+    Topic("the agent judges the record, and judging is attended", U,
+          ("judge of record", "attended", "classify_shapes"),
+          "a record that is wrong stays wrong until something rewrites it",
+          index=("judge of record",)),
+    Topic("a finding surfaced and not judged is a finding dropped",
+          "skill:reporting-back", ("you are the judge", "hard to reverse"),
+          "it reads as diligence and functions as a backlog"),
     Topic("a note that asserts a fact carries its check", "docstrings", ("verify_with", "expires_when"),
           "could this note become false without anyone editing it",
           # Stated at two different moments on purpose: the tool contract is