The downgrade happens in one branch. If severity is BLOCKER and the finding's heuristic_family is not in a four-name frozenset, severity becomes WARNING before the finding enters the findings list [6]. The model's severity string is read and then overwritten before the finding is stored. The field doing the work is heuristic_family, and the author is explicit that the gate derived it deterministically, not from the model's output: "The LLM's label is decorative; the family is load-bearing" [7]. Port this pattern with family populated from a model field and you have moved the LLM one layer down rather than out of the path. The check still runs, but it is now checking a guess.
The two numbers either side of that fix belong on the same axis. Prompt engineering was tried first, and the critic still escalated completeness concerns to blocker about 30 percent of the time [8]. After the frozenset, zero advisory findings appeared as blockers across 92 post-fix runs [9]. Thirty percent of 92 is roughly 28 [2]. Those are not the same runs, so it is not a controlled before-and-after, but it is the order of magnitude the four-line branch removed.
Five trials deserve a caveat the post does not make. Five runs on one input give four consecutive comparisons, so label_flip_rate = 1.0 is a statement about four observed changes [1]. Four changes across four comparisons rule out any assumption of stability, but they say nothing about how far the verdicts drifted, whether the critic was maximally inconsistent or just inconsistent. The distinction does not need settling, because the architecture treats every degree of instability the same way regardless.
For underclaim_approvals = 0 to transfer to your system, your dangerous direction has to be structurally checkable. The gates named are preconditions, topological ordering, rollback credibility and verification ordering, and they parse the plan's AST instead of its prose [4]. The claim that they resist prompt injection follows from the same property rather than from any hardening: they never read natural language [5]. A seeded defect like a precondition with no earlier task establishing it has a right answer in the graph, so a critic that misses it on trial three loses nothing [10]. A defect like "this rollback will take four hours in practice" has no such answer. If your seeded defects are the second kind, the zero belongs to the author's test, not to your system.
I would take this trade in my own context, with the scope stated. The author's split puts code in charge of ordering, preconditions, rollback presence and schema, and leaves the model advisory on severity calibration, completeness and whether a rollback is credible [12]. The portable part is narrower than the principle: an enumerated set of finding families that code can adjudicate, and a rule that the model's severity string is never the field anything downstream reads. Severity from a model is a suggestion delivered in a confident voice.
