quad-cli gate: add a periodic live four-CLI dogfood check (smoke:quad)

[drvoss]

Follow-up to #9. Tracks the part of #9's close criterion 3 that is not satisfied by the transport fix in #14.

#14 added 19 regression tests that really spawn processes, using stub CLIs. Those cover launcher resolution
(.exe / .cmd / .ps1), synchronous EINVAL, ENAMETOOLONG transport fallback, envelope unwrapping,
process-tree termination and the failure taxonomy. They do not cover drift in the real, independently
updated CLIs — a vendor changing a flag, an output envelope, or a default mode would not fail any test.

Remaining work:

• npm run smoke:quad — a live, non-mock preflight that runs the declared reviewer set against a tiny fixed
  diff and fails if a declared reviewer is absent, unauthenticated or non-compliant; plus a
  smoke:quad:available variant that probes whatever is installed. Not part of npm test, not in CI
  (runners have no CLIs installed).
• Emit a machine-readable artifact per run: orchestrator commit, OS and Node version, resolved CLI paths and
  launcher kinds, CLI versions, per-tool result and duration, schema outcome.
• A transport-integrity nonce in the production protocol, so "schema-valid" and "received the whole prompt"
  stay distinguishable outside of ad-hoc investigations.
• Revisit --min-reviewers (currently 2) and the supported-reviewer contract now that four reviewers actually
  run.

Measurement context for all of the above is in #9 and #14.

[drvoss]

Update — 2026-08-27

PR #16 merged (dac7dae) after independent cross-verification by three models (Claude Opus, Claude Sonnet, and local Codex CLI, all reached MERGE independently). This closes the npm run smoke:quad / smoke:quad:available item and the reviewer-drop-out observability item.

Still open from this issue's remaining scope (per PR #16's own "Remaining scope" note — it explicitly does not close #15):

• Transport-integrity nonce in the production protocol (needs a design decision first).
• Revisit --min-reviewers (currently 2) and the supported-reviewer contract now that four reviewers actually run.

New non-blocking findings from the cross-model review of #16, worth folding into this work:

1. (Codex, P2) observed_failure in the reviewer-drop diagnostics persists the raw failure string, which can leak an internal filesystem path (e.g. Mock response not found: C:\Users\...\agy.json) even though resolved_path is redacted separately — scripts/quad-cli-orchestrate.mjs:1019.
2. (Sonnet) reviewers/environment diagnostic fields are only populated when --artifact is passed, but orchestration/skills/quad-cli-consensus-gate.md describes them as carried "when relevant" alongside always-on fields like status — doc/behavior mismatch.
3. (Sonnet) When --artifact is used, buildEnvironment re-probes CLI versions for all declared tools serially (up to 4x 10s-capped spawns), outside the --gate-timeout budget and undocumented.

Keeping this issue open to track the nonce, the --min-reviewers revisit, and the three findings above.

[drvoss]

Closed by #17 — 2026-08-27

PR #17 merged (squash), implementing this issue's remaining scope:

• Transport-integrity nonce: implemented. Per-run random token, echoed back by reviewers as top-level transport_nonce, placed after the <diff> block in the prompt (not before) so tail truncation of the diff — the realistic failure mode — cannot produce a false confirmed. States: confirmed / mismatch (dropped from consensus) / not-echoed (not penalized, ambiguous by design) / unavailable. Recorded in reviewers.nonce_status under --artifact.
• --min-reviewers revisit: confirmed already resolved by PR feat(quad-cli): record declared vs effective reviewers and add a live smoke preflight #16's documented decision (stays at 2, with recorded rationale in orchestration/skills/quad-cli-consensus-gate.md) — no code change needed.
• The 3 non-blocking findings from feat(quad-cli): record declared vs effective reviewers and add a live smoke preflight #16's cross-review are fixed: path-leak in observed_failure redacted, reviewers/environment artifact-gating documented, --artifact CLI-reprobe cost documented.

Cross-verified by Claude Opus, Claude Sonnet, and (partially, before hitting a usage limit) the local Codex CLI across two review rounds. Sonnet's first-round review caught a real design gap (nonce placed before the diff, so tail truncation wouldn't be detected) — fixed by moving the nonce instruction after </diff>; both models confirmed MERGE on the corrected version.

npm test: 1116/1116 passing. npm run validate / npm run lint:md: passing.

Closing.