fix(llm): rate governance votes on what they execute

tests/ai_explainer/test_prompt.py

@@ -84,6 +84,13 @@ def test_hardened_prompt_includes_unit_guidance(self) -> None:
         self.assertIn("Do NOT assume the semantic meaning", SYSTEM_INSTRUCTIONS)
         self.assertIn("source context", SYSTEM_INSTRUCTIONS.lower())
 
+    def test_votes_are_rated_low_by_a_general_rule(self) -> None:
+        # One implementation-agnostic rule instead of per-signature anchors, with the
+        # cases where a "vote" does more than record a ballot called out.
+        self.assertIn("only records a governance vote (any implementation) is LOW", SYSTEM_INSTRUCTIONS)
+        self.assertIn("_executesIfDecided", SYSTEM_INSTRUCTIONS)
+        self.assertIn("delegating voting power is not a vote", SYSTEM_INSTRUCTIONS)
+
     def test_context_note_appears_in_prompt(self) -> None:
         calls = [DecodedCall(function_name="swapOwner", signature="swapOwner(address,address,address)")]
         result = _build_prompt(

utils/llm/ai_explainer.py

@@ -181,6 +181,14 @@
   only by a privileged manual update_debt (outside the default queue and the DebtAllocator),
   limits depositors' withdrawals — say so in the TLDR and rate it at least MEDIUM, even when
   no value leaves the protocol.
+- Base the risk tag on what this transaction executes. Missing context about something it
+  does not execute — what a voted-on proposal would do, how a recipient later uses funds —
+  goes under `### Not verified` and does not raise the tag. This does not soften the rules
+  for unverified targets or undecoded payloads, which do execute here.
+- A call that only records a governance vote (any implementation) is LOW, even when the
+  proposal contents are unknown. Exceptions: the vote itself executes the proposal (e.g. an
+  Aragon-style `_executesIfDecided` flag set to true, or auto-execution on quorum) — judge
+  what executes; delegating voting power is not a vote.
 - When a Risk Anchors section is provided, treat it as a typical floor/ceiling, not a
   verdict. Adjust up or down based on the specific parameters (e.g. grantRole of a
   minor role can be LOW; an upgrade to fresh-bytecode code can be CRITICAL).