Summary

Implements the scorecard design from #570 and completes #502 through its five ordered slices:

• accepts score inputs only from tracked, verifier-authored manifests with bound subjects, check roles, patch or fixture identity, receipt digests, and failure taxonomy
• projects current-fingerprint effectiveness, verifier cost, retry stability, evidence integrity, and per-check utility retention from eligible verify receipts
• gives unseen and low-data skills deterministic, route-scoped exploration with 7-day, 30-day, per-run, and optional budget caps
• promotes only when effectiveness and every required utility check pass, then records scorecard.v1 routing authority; one trusted hurt removes that authority immediately
• adds read-only scorecard backfill, work-brief fields, and operator checkup --surface outcome

Why

The previous loop counted distinct ledger artifact ids as scored, relied on optional caller-attributed capture, exposed rank as a read-only view, and left reconcile dry-run by default. Receipt volume could therefore grow without producing promotion-ready evidence. Caller labels and no-work receipts could also contaminate routing if treated as score inputs.

This change keeps legacy records.jsonl rows audit-only for skill promotion. It does not infer subjects from those rows or convert them during backfill.

Compatibility

Cards remain on the existing ledger decision path. Generated-patch evidence must satisfy verifier independence, and required utility checks remain verifier-manifest declarations, so this composes with #507 and #499 without making their audits blocking.

Verification

• brigade work verify run --target . --command "./scripts/verify" --capture brigade-work
• rebased receipt: .brigade/work/verify-runs/20260727-002601-work-verify-66ea63/receipt.json
• 4,598 passed, 3 skipped
• coverage: 82.91%

Closes #502
Closes #571
Closes #572
Closes #573
Closes #503
Closes #574