Status: accepted, 2026-08-17 (owner ruling, ../evidence/20260817-source-docs-skeptical-read.md §C)

Context#

The business note puts a per-customer confidence bar in front of manual review; the owner's draft has Goals attached to stages; the owner ruled that confidence "can be either self-reported by the module OR a chained agent call (inside the module OR separate ...). Self-reporting is the norm but it tends not to be very good in some cases, so we don't want to lock ourselves into it."

Decision#

Every result and needs_review outcome carries confidence (0 to 1) and judged_by (self or a judge capability id), plus evidence. A judge is a capability whose item schema is another capability's output; it can run inside the module as a chained capability, as its own module, or in the app. The manifest states which score is authoritative. The app applies the customer's bar over whichever score it gets and may hold an item the module called done (../canon/03, ../canon/10, ../canon/14).

Rejected alternatives#

• Self-report only. Locks the estate into the weakest signal.
• The bar inside the module. Per-tenant policy in a module violates the boundary and makes the module unswappable per customer.

Consequences#

• Judge cost is metered under the judge's capability.
• Calibration (false-confidence rate) is measured app-side against human verdicts; the module's contribution is that evidence is present.