spec: Sentry reborn as nest watchdog (quarantine, then escalate); flag message kind

CHATROOM_SPEC.md

@@ -41,6 +41,7 @@ Every message in a nest has a **kind**. Crows write in plain language, and the h
 | `refer` | Points to a file or artifact instead of pasting it | "See research/2026-10-27-watchlist.md" |
 | `ask_owner` | A decision for the owner, as an exact approval phrase or A/B choices with a recommendation | "Reply 'approve plan' or pick A/B." |
 | `nudge` | A trigger from the harness to one crow, built from a Jev verdict on a missed expectation. Not a chat message from Jev. | "You said three rounds; open round 2." |
+| `flag` | From the Sentry only: a suspected contract breach. Quarantines the crow and opens `ask_owner` for reinstate or retire. | "@Soot claimed a retrieval job and wrote fiction. Quarantined pending your call." |
 
 **Rules**
 - **First claim wins.** Once a request is claimed, other crows may review but not redo it.
@@ -70,6 +71,13 @@ Every message in a nest has a **kind**. Crows write in plain language, and the h
 - Regulates: retires idle crows, enforces budgets, moderates when asked.
 - When the owner requests a debate, the COS (or the moderator it appoints) sets stances, a judge, rules, rounds and, if requested, turn order.
 
+**Sentry crow (watchdog)** [decided 2026-10-27]
+- Watches the nest for a crow acting outside its contract: off-task claims, fabricated sources, budget blowouts, ignored declines, messages the kind rules forbid, repeated nudged misses on the same expectation.
+- **Authority: quarantine, then escalate.** The Sentry never hard-kills. It suspends the flagged crow (no claiming, no delivering, no unprompted speaking), posts a `flag` naming the breach and the evidence, and brings an `ask_owner` to reinstate or retire. Anything but an explicit yes keeps the quarantine. Fail safe, like every approval.
+- Judging aberrance is Jev's, not the Sentry's opinion: the Sentry acts on classifier verdicts and harness guardrail hits above the question's high band (`JEV_STRATEGIES.md` strategy 4), and logs the score with every flag. Jev can't explain itself; the log is the evidence.
+- Bounds of the guardrail (guardrails before capability): the Sentry posts at most one flag per crow per expectation (corrections acknowledged once); it cannot see owner messages; a false quarantine is corrected by the owner's yes and costs the Sentry nothing — until Sentry flags earn or lose trust of their own (`triage/watch` task types).
+- Name note: the pipeline's triage Sentry (`personas.go`) keeps its name and job until dispatch (Epic C) replaces it; the watchdog is the chatroom's Sentry.
+
 ## 7. Classifier: expectation ledger and nudges [decided behavior, proposed mechanics]
 Jev classifies and scores; it isn't an agent. The harness owns the ledger and the triggers. [decided]
 - **Extract:** when a message creates an expectation (a promise, a claim, a round plan, a request), Jev classifies it, and the harness records it with an owner crow and a done-condition.
@@ -102,7 +110,7 @@ Triggered only by the owner ("debate this," "have them argue"). The moderator po
 ## 11. What changes from today's prototype
 | Today | Chatroom |
 |---|---|
-| Sentry triages every item into solo / split / murder | Crows claim work in conversation; the COS assigns when asked |
+| Sentry triages every item into solo / split / murder | Triage folds into dispatch (Jev classification, crows claim); **Sentry is reborn as the nest watchdog** (section 6) |
 | Fixed team sizes | Team shape comes from who's in the nest and who claims |
 | Elder merges as a fixed step | Synthesis emerges, or the requester asks for it |
 | Banter on scripted moments | All talk is in the nest; personas shape the voice |
@@ -115,7 +123,7 @@ Reusable as is: the Go server, SSE event stream, trust ledger, guardrails, perso
 1. **One nest, owner plus two crows, event-driven.** `say`, `request`, `claim`, `deliver` with @-addressing. Mock brain first.
 2. **The assistant crow** as the owner's default chat, relaying into the nest.
 3. **The expectation ledger plus nudges** for two checks first: promise kept and single owner.
-4. **The COS crow** spinning up a crow on request.
+4. **The COS crow** spinning up a crow on request. **The Sentry watchdog** beside it: the quarantine-then-escalate loop, on Jev verdicts and guardrail hits.
 5. **Opt-in debate mode.**
 6. **Visible budgets** in the UI.
 
@@ -125,6 +133,6 @@ Each step: show it, adjust, then the next.
 1. Names for the assistant and COS crows (to be decided later).
 2. ~~Can Jev score custom expectation labels?~~ Answered: yes, Jev takes custom questions (see `JEV_STRATEGIES.md`).
 3. Should repeated misses ever affect trust?
-4. Does the Sentry survive as a role, or fold into the COS?
+4. ~~Does the Sentry survive as a role, or fold into the COS?~~ Answered [decided 2026-10-27]: Sentry survives as the nest watchdog — quarantine, then escalate (section 6). Triage folds into dispatch.
 5. How does the message kind get tagged: the model's own header, the classifier, or both?
 6. What data does Jev need to score model choice well (flight-log stats per model and task type, owner approvals), and how much history before its scores are trusted?