bug(orchestrator): wave-gate (Perimeter-2) adversary dispatch lacks HEAD-SHA verification tuple

## Wave-gate (Perimeter-2) adversary dispatch lacks HEAD-SHA verification tuple

**Filed against:** drbothen/vsdd-factory
**Discovered:** 2026-07-02 during Wave-6 Tranche C wave-level Pass 1 attempt 1 (switchboard-blue)
**Severity:** HIGH (silent-false-green risk)
**Category:** process-gap

### Problem

The Worktree-Identity Preflight rule in the adversary agent's system prompt is
anchored to Perimeter 1 (per-story adversarial review). Perimeter 2 (wave-gate)
has no equivalent preflight. Wave-gate dispatches embed a `develop_tip` SHA in
the prompt, but the adversary has no tool-visible mechanism to verify
`git rev-parse HEAD` matches (adversary is read-only, no Bash).

### Failure mode observed

Local `develop` was two merges behind `origin/develop` (`cdb2b66` vs
`7fe3e29`). The adversary correctly refused to review by inspecting
`.git/refs/heads/develop` opportunistically. But a less-thorough adversary could
have proceeded to read specs (which live on the factory-artifacts branch and are
always current) and produced "CONVERGENT" without ever inspecting the merged code.

### Recommended fix

1. Extend Worktree-Identity Preflight rule to Perimeter 2. Text should read
something like:
> "Wave-gate dispatches MUST embed `(worktree-abs-path, wave-tip-SHA, wave-id,
> canonical-repo-root)`. Adversary MUST verify `git rev-parse HEAD ==
> wave-tip-SHA` before reading any code artifact. On mismatch: HALT with
> dispatch-integrity finding."
2. Extend the state-manager burst that dispatches wave-gate reviews to verify
`git merge-base --is-ancestor HEAD` for every constituent
story merge SHA against the dispatched worktree HEAD. Refuse dispatch on
failure.
3. Consider making Perimeter-1 preflight and Perimeter-2 preflight share a
common macro so the two cannot drift.

### Evidence

- switchboard-blue Wave-6 Tranche C: `.factory/cycles/cycle-1/adversarial-reviews/W-6.C-wave-adversary-pass-1-attempt-1.md`
- Fresh-context adversary correctly identified defect; a less-thorough one could have missed it.
- Verdict was BLOCKING with three CRITICAL findings; only CRIT-1 (dispatch-integrity) was novel —
CRIT-2 (STATE.md stale) and CRIT-3 (Tranche C not formalized) would have surfaced eventually,
but not until pass 2.