list-hygiene-judge

List Hygiene Judge

Use this skill after collecting current contact evidence and before preparing a campaign. It decides whether a contact remains eligible, needs re-permission, must be suppressed, or needs human review. When policy justifies a state transition, it records that decision in the operator's consent ledger with optimistic concurrency and verifies the exact event through a second read.

This skill never sends a message and never mutates a mailing provider. A later message-send run must read the current consent state again at delivery time. The ledger records the operator's policy decision; it does not replace provider unsubscribe or bounce data.

Operating model

The caller supplies one bounded engagement observation, the current consent observation, and the policy threshold that applies to the contact. The evidence must be marked read and versioned to the same ledger head that the runner reads through the store's projection.read. Missing, stale, ambiguous, or conflicting evidence produces human_review without a write.

The deterministic decision order is conservative:

1. An unsubscribe marker stops automation.
2. An existing suppression is preserved; age alone can never relax it.
3. Verified hard-bounce evidence suppresses when policy permits that automatic action, otherwise it stops for review.
4. A subscribed contact whose last engagement exceeds the decay threshold is moved to re_permission.
5. A clean, recent subscribed contact returns verify without writing.

Only re_permission and suppress can create transitions. The append uses the observed ledger version and the caller's stable idempotency key. Readback must match the append status, source identity, new version, event reference, event digest, and projection digest before the result reports a recorded transition. No-write decisions also perform a second read and require the projection to remain unchanged.

Authority and finality

The runner requests runx:data:read and, only for an admitted transition, runx:data:append. These scopes authorize a bounded consent-ledger operation; they do not authorize delivery or changes to a CRM or mailing provider. The data-source binding owns storage and credentials.