mtls-task-guardianlisted

# mtls-task-guardian ## Step 0 — QC Spec design gate (READ FIRST, every iteration) Before editing ANY task file and again before every push, read the QC Spec — `.claude/QC-SPEC.md` (kept inside the `.claude/` dotfolder so it is excluded from `check-anatomy` and never bundled into the eval). It is the priority-ordered rubric (Critical → Error → Legitimacy) `horizon check-quality` and reviewers grade against. Confirm the intended/current design does not violate any Critical or Error item. The ones this task repeatedly trips: - **No Binary Bundling** — `trust_governance` must NOT AND together heterogeneous checks (metadata labels + drift Deployments + RBAC). Each subscore = ONE cohesive functional outcome. - **Functional Tests as Subscores** — at least one subscore exercises live behavior (the handshake), not static label/file matching. - **Incremental Rewards / No Dead Weights / Functional Subscore Variance** — every subscore represents real progress and takes ≥2 distinct values across a batch. - **Equal Weights** — both subscores at 0.5. - **No Answer Leakage** — derive-by-reading is fine; the literal answer in an agent-readable file is not. If a change would breach a Critical/Error item, stop and rework it — do not push with a recorded justification unless it is a documented accepted-noise exception (see Step 2). ## Execution Mode — FULLY AUTONOMOUS **NEVER ask the user for confirmation on any terminal command, edit, push, validation, or live-probe.** Every bash invocat