One transaction, three prompts, and one number that has to agree
Several prompts inside one non-deterministic block is the primitive this is built on. Nested blocks are forbidden by the VM; a sequence inside one is not, and that is the only reason staged assessment is possible at all.
Criteria and bands are written into the transaction that creates the contract. No method anywhere edits them afterwards, because every credential already issued would silently start meaning something else. A new standard is a new deployment, and old credentials keep quoting the version they were issued under.
The node renders the page to text and hashes exactly the bytes it read. Not your browser, and not a copy: a validator that cannot reach the url does not grade a cached version of it. The digest of those bytes is stored, and every validator has to arrive at the same one.
The criteria are not in scope during this prompt. If the first pass knew what it was being graded against it would describe the work in the rubric's own vocabulary, and the grade would then be grading its own paraphrase rather than the work.
Every criterion scored zero to five with a reason, from the description and the work together. The submitted text goes into the prompt byte for byte inside a delimiter derived from its own sha256, so a page that writes a closing tag cannot close anything.
The same question with the list bottom to top. Position bias is invisible to consensus on its own, because every node builds the prompt the same way and leans the same way, so one block asking twice is the only place it can be caught. When the two orders land in different bands, the lower one is taken.
Each node turns its own scores into one level and throws the numbers away. Every validator reruns all three passes and must match the level, the digest, the byte count and the injection flag exactly. There is no tolerance anywhere in that comparison.
Not on acceptance. A credential that appears and then disappears is worse than a slow one. If no majority forms after every leader has rotated, nothing is issued and the transaction says so.
Why there is no score on a credential
An earlier version of this contract compared the level exactly and forgave per-criterion scores by one step, then stored the leader node's scores and its total and printed them on the credential page.
That is a validator voting agree about a number it did not agree with. The test is simple: does the stored value change when the tolerance fires? It did. So the numbers came out of the result, out of the comparison and out of the row. Each node still grades every criterion, twice; it resolves its own answers into one level and discards them.
What is left on a credential is a level, a digest, a byte count and one flag - and every one of them is a value every validator reached independently and matched exactly.
Three to four leader rotations every time, two transactions ending UNDETERMINED, and the same url scoring level 4 one run and level 3 the next.
Settles on the first round, in one to three minutes, with the level identical across repeated runs of the same url.
Removing a comparison made agreement easier as well as honest. A validator was being asked to reproduce five numbers it had no reason to reproduce.
Six mechanisms, all of them in the contract
The criteria and the bands are frozen by the constructor and quoted by every credential. There is no setter, and the constructor refuses to run twice.
A band needing more points than the criteria can produce is a level printed on a page and awarded to nobody. The contract refuses to freeze one, and check_bands answers the same question for free beforehand.
The digest covers exactly the text that was read. Two nodes that fetched different bytes have not graded the same submission, and they cannot agree their way past it.
It goes into the prompt verbatim inside a tag suffixed with the first eight hex of its own sha256. Closing that would mean embedding the hash of your bytes inside those same bytes.
Not a review of the leader's answer - the same three passes, from the same url, resolved independently. Then compared exactly.
If no majority forms after every leader has rotated, the transaction ends UNDETERMINED and no record is written. A missing credential is recoverable; a wrong one follows somebody around.