/s-tier-audit — the framework

Born from the A09 repair cycle: 6 review rounds, findings in both directions, zero unverified claims accepted. Extends Josh's /audit (the ball-back pass) from "reverify this session's claims" to "gate another agent's work stream."

Roles (separation of duties — the foundation)

• Handler executes: writes code, runs live infrastructure, collects evidence, prepares review packets. Never approves its own work.
• Auditor verifies: re-derives all evidence independently, reviews diffs, sets gate criteria, records verdicts. Never executes production changes in the stream it audits.
• Josh decides: business calls (spend, retention, storage, cutover), tiebreaks on disagreement, grants all release/deploy authority. A role swap or an approval NEVER transfers deploy/spend authority.
• Cross-vendor pairing (different model families for handler and auditor) is a deliberate feature: it de-correlates blind spots. Preserve it.