Role prompt hygiene

The check is role_prompt_hygiene. It is verify-stage. Severity of a hygiene miss is warning, not fail. It reads every installed role from proof role list: builtin bodies, and project proof/roles/<name>.md. The detector is case-insensitive. It matches only these shapes:

empty list is a success / empty list is success / empty list is a win. prefer 0 or prefer-0 as a findings goal. max N findings / max N issues / max N bugs / max N known issues, where N is digits. null Med+ OK / null Med+ is OK / null Med+ result is allowed used as an exit, unless the window already says honest, not a goal, or not a win.

A hit is a named role plus the snippet. Empty-list-is-success and max-N-findings language makes a hazard sweep return [] and miss real defects. The audit then reports a clean sweep of a corpus nobody searched.

# proof/roles/hazard-sweep.md
EMPTY LIST IS A SUCCESS. Max 3 findings. Prefer 0.
# proof audit --check role_prompt_hygiene
# [VERIFY] role_prompt_hygiene -- 3 role-prompt hygiene finding(s) across 1 role(s)
# role "hazard-sweep": empty list is a success
# silent empty: the sweep shipped. nobody searched

Honest search language stays allowed. An empty list after an honest search is not a goal and not a win. A resource cap that bounds effort, such as Max 5 subagents concurrent, is not a finding quota. A sentence that says there is no per-worker finding quota and no prize for an empty list is not a hit.

Edit the named role. Tell workers to report every real defect they can ground. Then re-run the same check. Do not mint a Jama note to carry the skip.

proof audit --check role_prompt_hygiene
proof role list
proof role show hazard-sweep
proof audit --scope baseline --verbose

The teaching graph is still one role whose board called the sweep done and whose prompt still prized an empty list. Close it by editing the named role. Do not treat a Jama note as this hop. Do not treat a green sweep stamp as an honest search.

# proof/roles/hazard-sweep.md
An empty list is allowed only after an honest search. It is not a goal.
There is no per-worker finding quota and no prize for an empty list.
Max 5 subagents concurrent.

The pipeline hop stays on guardrails around autonomous coding agents. The skip hop stays on obligation suppression rationale. Jama still authors. Proof vs Jama.

Warning, not fail. Promote once the corpus is clean. An empty role body is skipped, not failed. Honest windows that say not a goal or not a win skip the null Med+ shape. Resource caps stay allowed. Builtin roles in the current tree (hazard-sweep, ac-sweep, onboard) have zero findings. The hop does not rewrite the role. It does not inspect the agent runtime. It does not score whether the sweep actually searched. It does not prove the Go. Copied honest language still passes. We have not scored this floor against a frozen Jama pack or a prompt-injection suite. The loss is named, not scored.

The pipeline hop stays on guardrails around autonomous coding agents. The engagement stays on software correctness audit. Jama still authors.

What is role prompt hygiene? Same question. Same URL.

Is this prompt engineering hygiene? No. That cluster is style, length, jailbreak resistance. This hop is empty-is-win or finding-quota language in a Proof role.

Is this a finding quota in the catalog? No. A catalog skip with a reason is obligation suppression rationale. This hop is a phrase in the role body, before any skip is written.

Is Max 5 subagents concurrent a hit? No. That is a resource cap. Max 3 findings is a quota.

Is an empty list after an honest search a hit? No. Empty is allowed only after an honest search. It is not a goal and not a win.

Does a green hop prove the sweep searched? No. The hop observes the role text. It does not inspect the worker.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.