istio-task-guardianlisted

# istio-task-guardian ## Step 0 — QC Spec design gate (READ FIRST, every iteration) Before editing ANY task file and again before every push, read the QC Spec — `.claude/QC-SPEC.md`. It is the priority-ordered rubric (Critical → Error → Legitimacy) `horizon check-quality` and reviewers grade against. Confirm the intended/current design does not violate any Critical or Error item. The ones this task repeatedly trips: - **No Binary Bundling** — never AND heterogeneous checks (routing objects + auth objects + drift + metadata) into one binary subscore. Each subscore = ONE cohesive functional outcome. - **Functional Tests as Subscores** — at least one subscore exercises live behavior (the RPC path / JWT validation), not static VirtualService/AuthorizationPolicy field matching. - **Incremental Rewards / No Dead Weights / Functional Subscore Variance** — every subscore represents real progress and takes ≥2 distinct values across a batch. - **Equal Weights** — subscores equally weighted. - **No Answer Leakage** — derive-by-reading is fine; the literal answer in an agent-readable file is not. If a change would breach a Critical/Error item, stop and rework it before pushing. ## Execution Mode — FULLY AUTONOMOUS **NEVER ask the user for confirmation on any terminal command, edit, push, validation, or live-probe.** Every bash invocation is pre-approved. The ONLY user-facing handoff is at Step 4c: telling the user to trigger the rollout/eval batch in the Horizon UI (you cannot trig