# Adversary System Review

**Date:** 2026-06-28  
**Scope:** Read-only pass  
**Files reviewed:**
- `packages/orchestrator/src/adversaryStream.ts` (407 lines)
- `packages/orchestrator/tests/adversaryStream.test.ts` (242 lines)

## Architecture

The adversary is a **generative, inference-driven auditor** running as a separate memory stream (`AdversaryStream`) adjacent to the main agent loop. It replaces the prior pure-regex adversary that only fired `false_success` when there were ZERO recent successes (missing every mixed success/failure run).

## Key Features

1. **Own persistent memory** — claims ledger (assertions, evidence state, verdicts) separate from main agent context
2. **Single inference per observation** — fires one backend call per high-signal claim, parses structured critique
3. **Classification taxonomy** — `false_failure`, `redundant_action`, `loop_detected`, plus `ok` (no intervention)
4. **Loop detection** — `loopSignal` tracks repeated tool calls with same target; fires when count ≥ threshold
5. **Success-language regex** — `SUCCESS_LANGUAGE` matches optimistic claims like "done", "verified", "live", "hydrated"
6. **Non-blocking** — adversary is advisory; never blocks tool calls. `adversaryRedundantSignal` is Priority 1 in critic but returns guidance, not a block.

## Integration Points

- **AgenticRunner**: manages `adversaryMode` ("backseat" | "skillcoach" | "both"), creates `AdversaryStream`, emits `debug_adversary` and `adversary_reaction` events
- **Critic**: `adversaryRedundantSignal` triggers WO-FIX-C path with message "The adversary recognized this exact tool call as already observed earlier."
- **TUI**: renders adversary buffer (last 50 entries), shows `adversary: N tracked` in status line

## Test Coverage

- `adversarySystemPrompt` encodes evidence-demanding posture (checks "started ≠ running", "exit code 0")
- `parseAdversaryCritique` structured output parsing
- `AdversaryStream` single-flight behavior, ledger persistence
- Loop detection with `loopSignal`
- `false_failure` and `redundant_action` classification

## Assessment

The system is well-structured. The generative approach (inference-driven vs regex) addresses the original blind spot. The non-blocking design is correct — adversary provides critique without preventing progress. The integration with critic's Priority 1 path gives it real influence on loop behavior.

## No Issues Found

This was a read-only review. No bugs, no improvements identified. The system is production-ready.