@event4u/agent-config 14.13.0 → 14.14.1

package/src/scripts/ai_council/reviewer_assignment.ts

@@ -0,0 +1,279 @@
+/**
+ * Reviewer assignment under a budget `k`, with provider diversity preserved.
+ *
+ * `road-to-inbox-harvest-2026-08-e-council-topology-evidence` steps 8.2 and 8.3.
+ *
+ * ## What the shipped path does today, measured before anything was designed
+ *
+ * `orchestrator.ts:1509-1560` gives **every** reviewer **every** other member's
+ * answer: N reviewers × (N−1) candidates = **N(N−1) reviewed pairs**, batched
+ * into N provider calls. The pair count is the quantity that grows
+ * quadratically and the one that drives prompt size, latency and — once the
+ * cross-exam of 8.1 makes pairs individually addressable — call count. At N=8
+ * that is 56 pairs; at N=16 it is 240.
+ *
+ * ## The construction, and why it is a circulant
+ *
+ * Order the members so provider families interleave, then let the candidate at
+ * position `i` be reviewed by positions `i+1 … i+k` (mod N). This gives, for
+ * free and without search:
+ *
+ *   - **no self-review** — the offsets start at 1 and stop before N;
+ *   - **exact balance** — every candidate is reviewed exactly `k` times and
+ *     every reviewer reviews exactly `k` candidates, so no member's context
+ *     window carries more than another's;
+ *   - **O(N×k) pairs** — `N·k`, against the unconditional `N(N−1)`;
+ *   - **determinism** — a permutation seeded from the question text, replayable
+ *     from the artefact, never `Math.random` and never `Date`, which is the
+ *     same discipline `orchestrator.ts:1533-1543` already states for its own
+ *     shuffle.
+ *
+ * Interleaving alone does NOT guarantee 8.3 when families are unequal (six of
+ * one family and two of another interleaves to `A B A B A A A A`, whose tail is
+ * all one family), so a **repair pass** follows: any candidate whose reviewer
+ * set is entirely same-family is fixed by a 2-swap with another candidate. A
+ * swap exchanges one reviewer between two candidates, so every load count is
+ * unchanged by construction — balance survives the repair.
+ *
+ * ## Honest scope
+ *
+ * This is the assignment; **nothing calls it yet**. `k = N−1` reproduces the
+ * shipped all-pairs behaviour exactly, which is what makes it a safe default
+ * and what lets the comparison below be arithmetic rather than a claim about a
+ * change nobody has made.
+ *
+ * Under the engine's current one-advisor-per-provider invariant
+ * (`chairman.ts:16-18`) every member is its own family, so the diversity
+ * constraint is **vacuously satisfied in production today**. It is implemented
+ * and tested against multi-member-per-family sets anyway, because Phase 9's
+ * advisor fan-out is what would produce them and the cheapest moment to have
+ * the property is before it can be violated.
+ *
+ * Pure and offline: no provider call, no file read.
+ */
+import { deterministic_shuffle_indices } from './blind_review.js';
+
+/** A council member, as assignment needs it. */
+export interface ReviewMember {
+    /** Member name — the identity used in the assignment maps. */
+    readonly name: string;
+    /** Provider family (`anthropic`, `openai`, …). Diversity is defined over this. */
+    readonly family: string;
+}
+
+/** Candidate name → the reviewers assigned to it, in deterministic order. */
+export type Assignment = ReadonlyMap<string, readonly string[]>;
+
+export interface AssignmentResult {
+    readonly assignment: Assignment;
+    /** Reviewed pairs — the quantity 8.2 compares against both curves. */
+    readonly pairs: number;
+    /** Reviewers per candidate actually used, i.e. `min(k, N-1)`. */
+    readonly effectiveK: number;
+    /** How many 2-swaps the diversity repair performed. */
+    readonly diversityRepairs: number;
+    /**
+     * Candidates left with an all-same-family reviewer set.
+     *
+     * "Available" in 8.3 has to mean available UNDER THE BALANCE CONSTRAINT,
+     * not merely "a member of another family exists". Six members of family A
+     * and two of family B at `k = 1` gives eight candidates and only two
+     * B-reviewer slots, so four A candidates MUST be reviewed within their own
+     * family — no assignment avoids it. {@link diversityCeiling} is that bound
+     * made computable, and this list is the shortfall it predicts.
+     */
+    readonly unrepairable: readonly string[];
+}
+
+/**
+ * The most candidates any balanced assignment can make diverse at this `(members, k)`.
+ *
+ * A candidate of family `F` needs a reviewer from outside `F`; there are
+ * `n - |F|` such members and each reviews exactly `k` candidates, so family `F`
+ * can place at most `min(|F|, k * (n - |F|))` diverse candidates. Summed over
+ * families and capped at `n`.
+ *
+ * An UPPER BOUND, and stated as one: reviewer capacity is shared across
+ * families, so a contrived family profile could in principle fall short of it.
+ * Measured over 7 family profiles × every `k` in `1..n-1`, the greedy repair in
+ * {@link assignReviewers} attains it in every case, and the test sweeps a wider
+ * set — so the bound is treated as tight where it has been checked and as a
+ * bound everywhere else.
+ */
+export function diversityCeiling(members: readonly ReviewMember[], k: number): number {
+    const n = members.length;
+    const eff = Math.max(0, Math.min(k, n - 1));
+    const sizes = new Map<string, number>();
+    for (const m of members) sizes.set(m.family, (sizes.get(m.family) ?? 0) + 1);
+    let total = 0;
+    for (const size of sizes.values()) total += Math.min(size, eff * (n - size));
+    return Math.min(total, n);
+}
+
+/** Both curves 8.2 names, at one `(N, k)`. Pure arithmetic. */
+export function costCurves(n: number, k: number): {
+    n: number;
+    k: number;
+    pairs_quadratic: number;
+    pairs_linear: number;
+    ratio: number;
+} {
+    const eff = Math.max(0, Math.min(k, n - 1));
+    const quad = n * (n - 1);
+    const lin = n * eff;
+    return { n, k: eff, pairs_quadratic: quad, pairs_linear: lin, ratio: quad === 0 ? 1 : lin / quad };
+}
+
+/**
+ * Interleave members so that consecutive positions come from different families
+ * wherever the family sizes allow it: repeatedly take one member from the
+ * currently largest remaining family, preferring one different from the last
+ * pick.
+ *
+ * TIES BREAK ON INPUT ORDER, NOT ON FAMILY NAME, and the difference is
+ * load-bearing rather than stylistic. Under the engine's one-advisor-per-
+ * provider invariant every family has size 1, so every comparison is a tie — a
+ * name tie-break would then sort the whole council alphabetically and DISCARD
+ * the seeded permutation entirely, making `assignReviewers` produce the same
+ * assignment for every seed. Measured: the seed-sensitivity test reds under the
+ * name tie-break at N=8. Bucket iteration order is the (already permuted) input
+ * order and `Array.prototype.sort` is stable, so input-order ties keep the
+ * result a pure function of the input while letting the seed through.
+ */
+export function interleaveByFamily(members: readonly ReviewMember[]): ReviewMember[] {
+    const buckets = new Map<string, ReviewMember[]>();
+    for (const m of members) {
+        const b = buckets.get(m.family);
+        if (b) b.push(m);
+        else buckets.set(m.family, [m]);
+    }
+    const out: ReviewMember[] = [];
+    let lastFamily = '';
+    while (out.length < members.length) {
+        const eligible = [...buckets.entries()].filter(([, v]) => v.length > 0);
+        // Prefer a family different from the previous pick; fall back to any.
+        const pool = eligible.filter(([f]) => f !== lastFamily);
+        const pick = (pool.length > 0 ? pool : eligible).sort((a, b) => b[1].length - a[1].length)[0];
+        if (pick === undefined) break;
+        out.push((pick[1] as ReviewMember[]).shift() as ReviewMember);
+        lastFamily = pick[0] as string;
+    }
+    return out;
+}
+
+/** Is this candidate reviewed by at least one different family? */
+function _diverse(candidate: ReviewMember, reviewers: readonly string[], byName: ReadonlyMap<string, ReviewMember>): boolean {
+    return reviewers.some((r) => (byName.get(r) as ReviewMember).family !== candidate.family);
+}
+
+/**
+ * Assign `k` reviewers per candidate: balanced, self-review-free, diverse where
+ * a cross-family reviewer exists, deterministic in `seed`.
+ *
+ * `k >= n-1` reproduces the shipped all-pairs behaviour exactly.
+ */
+export function assignReviewers(
+    members: readonly ReviewMember[],
+    k: number,
+    seed: string,
+): AssignmentResult {
+    const n = members.length;
+    const effectiveK = Math.max(0, Math.min(k, n - 1));
+    const byName = new Map(members.map((m) => [m.name, m]));
+    if (n < 2 || effectiveK === 0) {
+        return {
+            assignment: new Map(members.map((m) => [m.name, [] as string[]])),
+            pairs: 0,
+            effectiveK: 0,
+            diversityRepairs: 0,
+            unrepairable: [],
+        };
+    }
+
+    // Seeded permutation first, then the family interleave over it: the seed
+    // decides WHICH member sits where within a family, the interleave decides
+    // that consecutive positions differ in family.
+    const perm = deterministic_shuffle_indices(seed, n);
+    const ordered = interleaveByFamily(perm.map((i) => members[i] as ReviewMember));
+
+    const assignment = new Map<string, string[]>();
+    for (let i = 0; i < n; i++) {
+        const candidate = ordered[i] as ReviewMember;
+        const reviewers: string[] = [];
+        for (let d = 1; d <= effectiveK; d++) {
+            reviewers.push((ordered[(i + d) % n] as ReviewMember).name);
+        }
+        assignment.set(candidate.name, reviewers);
+    }
+
+    // ── diversity repair ────────────────────────────────────────────────────
+    // A 2-swap exchanges one reviewer between two candidates, so every
+    // reviewer's load and every candidate's count are invariant.
+    let diversityRepairs = 0;
+    const unrepairable: string[] = [];
+    const familyCounts = new Map<string, number>();
+    for (const m of members) familyCounts.set(m.family, (familyCounts.get(m.family) ?? 0) + 1);
+
+    for (const candidate of ordered) {
+        const mine = assignment.get(candidate.name) as string[];
+        if (_diverse(candidate, mine, byName)) continue;
+        // Does a cross-family reviewer even exist for this candidate?
+        if ((familyCounts.get(candidate.family) ?? 0) === n) {
+            unrepairable.push(candidate.name);
+            continue;
+        }
+        let fixed = false;
+        for (const other of ordered) {
+            if (other.name === candidate.name || fixed) continue;
+            const theirs = assignment.get(other.name) as string[];
+            for (const give of mine) {
+                for (const take of theirs) {
+                    if (fixed) break;
+                    if (take === candidate.name || give === other.name) continue; // no self-review
+                    if (theirs.includes(give) || mine.includes(take)) continue; // no duplicate reviewer
+                    const takeM = byName.get(take) as ReviewMember;
+                    if (takeM.family === candidate.family) continue; // does not help
+                    const theirsAfter = theirs.map((r) => (r === take ? give : r));
+                    if (!_diverse(other, theirsAfter, byName)) continue; // must not break them
+                    mine[mine.indexOf(give)] = take;
+                    assignment.set(other.name, theirsAfter);
+                    diversityRepairs++;
+                    fixed = true;
+                }
+            }
+        }
+        if (!fixed) unrepairable.push(candidate.name);
+    }
+
+    let pairs = 0;
+    for (const v of assignment.values()) pairs += v.length;
+    return { assignment, pairs, effectiveK, diversityRepairs, unrepairable };
+}
+
+/** Reviewer → how many candidates it reviews. The balance figure. */
+export function reviewerLoads(assignment: Assignment): Map<string, number> {
+    const loads = new Map<string, number>();
+    for (const reviewers of assignment.values()) {
+        for (const r of reviewers) loads.set(r, (loads.get(r) ?? 0) + 1);
+    }
+    return loads;
+}
+
+/** Candidates reviewed only by their own family, given the members. */
+export function nonDiverseCandidates(assignment: Assignment, members: readonly ReviewMember[]): string[] {
+    const byName = new Map(members.map((m) => [m.name, m]));
+    const out: string[] = [];
+    for (const [name, reviewers] of assignment) {
+        const c = byName.get(name);
+        if (c === undefined || reviewers.length === 0) continue;
+        if (!_diverse(c, reviewers, byName)) out.push(name);
+    }
+    return out.sort();
+}
+
+/** Was a cross-family reviewer available for this candidate at all? */
+export function crossFamilyAvailable(candidate: string, members: readonly ReviewMember[]): boolean {
+    const c = members.find((m) => m.name === candidate);
+    if (c === undefined) return false;
+    return members.some((m) => m.name !== candidate && m.family !== c.family);
+}

package/src/scripts/ai_council/routing_training_row.ts

@@ -0,0 +1,197 @@
+/**
+ * The offline routing-training row schema — step 11.1.
+ *
+ * `road-to-inbox-harvest-2026-08-e-council-topology-evidence` step 11.1:
+ * *"Collect offline training rows from benchmark and dogfood evidence only,
+ * without requiring raw private prompt content"*, verified by *"the row schema
+ * has no field capable of holding prompt text"*.
+ *
+ * ## PII-exclusion by construction, not by scrubbing
+ *
+ * The privacy property is a property of the TYPE, not of a sanitisation pass
+ * that can fail: **no field accepts free text**. Every field is an integer, a
+ * boolean, or an enum whose legal values are a declared closed set. A row that
+ * cannot hold a sentence has no scrubber to forget to run — the same principle
+ * `domain-safety-pii` § Surface 2 applies to logs and
+ * `artifact-engagement-recording` applies to telemetry.
+ *
+ * There is deliberately no `payload`, `notes`, `extra`, `context`,
+ * `promptText`, `Record<string, unknown>` or `unknown`-typed field, and
+ * {@link auditRowSchema} rejects one if a later edit adds it.
+ *
+ * ## Two layers, because one is not enough
+ *
+ *   1. {@link ROW_FIELDS} is the declared manifest — name plus kind plus, for
+ *      an enum, the closed value set. {@link auditRowSchema} walks a row
+ *      against it and refuses any field the manifest does not declare, any
+ *      value outside a declared enum, and any string-shaped value at all.
+ *   2. The interface itself is checked from the OUTSIDE by
+ *      `tests/scripts/ai_council/routing_training_row.test.ts`, which greps the
+ *      module source for a bare `string` / `any` / `unknown` /
+ *      `Record<string, …>` field declaration. The manifest alone cannot see a
+ *      field somebody adds to the interface and forgets to declare.
+ *
+ * ## Honest scope — the step is NOT closed by this file
+ *
+ * This is the schema. **No rows have been collected**, and the benchmark half
+ * of the evidence 11.1 names does not exist: `blocker: phase-2-benchmark-cost`
+ * records that `topology_bench_manifest.ts` `main()` only `--emit`s JSON and
+ * contains no provider dispatch. The verify clause is discharged; the step's
+ * collection half is not, which is why 11.1 stays unchecked.
+ *
+ * Pure and offline: type declarations, one manifest, one validator.
+ */
+import { COUNCIL_TOPOLOGIES } from './topology_vocabulary.js';
+import type { CouncilTopology } from './topology_vocabulary.js';
+import type { ImpactClass } from './necessity.js';
+
+/** Impact classes, as a runtime closed set. Mirrors `necessity.ts:545-550`. */
+export const IMPACT_CLASSES = Object.freeze([
+    'trivial',
+    'low_impact',
+    'medium_impact',
+    'high_impact',
+    'user_required',
+] as const);
+
+/** Where the row came from. 11.1 admits exactly these two and no third. */
+export const EVIDENCE_SOURCES = Object.freeze(['benchmark', 'dogfood'] as const);
+export type EvidenceSource = (typeof EVIDENCE_SOURCES)[number];
+
+/** Bucketed magnitudes. Buckets, never raw sizes — a raw byte count of a prompt is a weak fingerprint. */
+export const MAGNITUDE_BUCKETS = Object.freeze(['xs', 's', 'm', 'l', 'xl'] as const);
+export type MagnitudeBucket = (typeof MAGNITUDE_BUCKETS)[number];
+
+/** What the run did to the verdict. The label a challenger would learn against. */
+export const ROW_OUTCOMES = Object.freeze(['verdict-changed', 'verdict-unchanged', 'no-verdict'] as const);
+export type RowOutcome = (typeof ROW_OUTCOMES)[number];
+
+/**
+ * One training row.
+ *
+ * EVERY field is an integer, a boolean, or one of the closed enums above.
+ * Adding a `string`-typed field here is the violation this schema exists to
+ * make impossible, and the test file greps for exactly that.
+ */
+export interface RoutingTrainingRow {
+    readonly evidenceSource: EvidenceSource;
+    readonly topology: CouncilTopology;
+    readonly impactClass: ImpactClass;
+    readonly artifactSizeBucket: MagnitudeBucket;
+    readonly initialDisagreementBucket: MagnitudeBucket;
+    readonly latencyBucket: MagnitudeBucket;
+    readonly outcome: RowOutcome;
+    readonly memberCount: number;
+    readonly providerFamilyCount: number;
+    readonly roundsConfigured: number;
+    readonly roundsCompleted: number;
+    readonly priorRunFreshnessDays: number;
+    readonly estimatedCalls: number;
+    readonly observedCalls: number;
+    readonly estimatedCostCents: number;
+    readonly observedCostCents: number;
+    readonly stoppedEarly: boolean;
+    readonly minorityRetained: boolean;
+}
+
+/** A declared field. `enum` carries its closed value set; nothing else may be a string. */
+export type FieldKind = 'integer' | 'boolean' | 'enum';
+
+export interface RowField {
+    readonly name: keyof RoutingTrainingRow & string;
+    readonly kind: FieldKind;
+    /** Present iff `kind === 'enum'`. The ONLY legal string values in a row. */
+    readonly values?: readonly string[];
+}
+
+/** The manifest. Order is the serialisation order; the set is the schema. */
+export const ROW_FIELDS: readonly RowField[] = Object.freeze([
+    { name: 'evidenceSource', kind: 'enum', values: EVIDENCE_SOURCES },
+    { name: 'topology', kind: 'enum', values: COUNCIL_TOPOLOGIES },
+    { name: 'impactClass', kind: 'enum', values: IMPACT_CLASSES },
+    { name: 'artifactSizeBucket', kind: 'enum', values: MAGNITUDE_BUCKETS },
+    { name: 'initialDisagreementBucket', kind: 'enum', values: MAGNITUDE_BUCKETS },
+    { name: 'latencyBucket', kind: 'enum', values: MAGNITUDE_BUCKETS },
+    { name: 'outcome', kind: 'enum', values: ROW_OUTCOMES },
+    { name: 'memberCount', kind: 'integer' },
+    { name: 'providerFamilyCount', kind: 'integer' },
+    { name: 'roundsConfigured', kind: 'integer' },
+    { name: 'roundsCompleted', kind: 'integer' },
+    { name: 'priorRunFreshnessDays', kind: 'integer' },
+    { name: 'estimatedCalls', kind: 'integer' },
+    { name: 'observedCalls', kind: 'integer' },
+    { name: 'estimatedCostCents', kind: 'integer' },
+    { name: 'observedCostCents', kind: 'integer' },
+    { name: 'stoppedEarly', kind: 'boolean' },
+    { name: 'minorityRetained', kind: 'boolean' },
+] as const);
+
+/**
+ * The longest a legal enum value may be. A closed set whose members are all
+ * short is not a text field; a "closed set" containing a paragraph is one
+ * wearing a disguise, and this is the cheapest thing that tells them apart.
+ */
+export const MAX_ENUM_VALUE_LENGTH = 40;
+
+/** Every reason a row or the schema itself is rejected. Empty means clean. */
+export function auditRowSchema(row: Record<string, unknown>): string[] {
+    const problems: string[] = [];
+    const declared = new Map(ROW_FIELDS.map((f) => [f.name as string, f]));
+
+    for (const f of ROW_FIELDS) {
+        if (f.kind === 'enum') {
+            if (f.values === undefined || f.values.length === 0) {
+                problems.push(`field \`${f.name}\` is an enum with no declared value set — that is a free-text field`);
+                continue;
+            }
+            for (const v of f.values) {
+                if (v.length > MAX_ENUM_VALUE_LENGTH) {
+                    problems.push(
+                        `field \`${f.name}\` declares the value \`${v.slice(0, 20)}…\` (${String(v.length)} chars), ` +
+                            `over the ${String(MAX_ENUM_VALUE_LENGTH)}-char enum limit — a closed set of paragraphs is a text field`,
+                    );
+                }
+            }
+        } else if (f.values !== undefined) {
+            problems.push(`field \`${f.name}\` is \`${f.kind}\` but declares an enum value set`);
+        }
+    }
+
+    for (const [key, value] of Object.entries(row)) {
+        const f = declared.get(key);
+        if (f === undefined) {
+            problems.push(`row carries \`${key}\`, which the schema does not declare — undeclared fields are rejected`);
+            continue;
+        }
+        if (f.kind === 'integer') {
+            if (typeof value !== 'number' || !Number.isInteger(value)) {
+                problems.push(`field \`${key}\` must be an integer, got ${typeof value}`);
+            }
+        } else if (f.kind === 'boolean') {
+            if (typeof value !== 'boolean') problems.push(`field \`${key}\` must be a boolean, got ${typeof value}`);
+        } else if (typeof value !== 'string' || !(f.values as readonly string[]).includes(value)) {
+            problems.push(
+                `field \`${key}\` must be one of ${(f.values as readonly string[]).join(' | ')} — ` +
+                    'an arbitrary string is exactly the prompt-text carrier this schema forbids',
+            );
+        }
+    }
+
+    for (const f of ROW_FIELDS) {
+        if (!Object.prototype.hasOwnProperty.call(row, f.name)) {
+            problems.push(`row is missing declared field \`${f.name}\``);
+        }
+    }
+    return problems;
+}
+
+/** Serialise a validated row. Throws rather than emitting a row that failed the audit. */
+export function serialiseRow(row: RoutingTrainingRow): string {
+    const problems = auditRowSchema(row as unknown as Record<string, unknown>);
+    if (problems.length > 0) {
+        throw new Error(`routing training row rejected:\n  - ${problems.join('\n  - ')}`);
+    }
+    const ordered: Record<string, unknown> = {};
+    for (const f of ROW_FIELDS) ordered[f.name] = (row as unknown as Record<string, unknown>)[f.name];
+    return JSON.stringify(ordered);
+}

package/src/scripts/ai_council/synthesis_strategy.ts

@@ -0,0 +1,159 @@
+/**
+ * One synthesis-strategy interface behind the five candidates — step 5.1.
+ *
+ * `road-to-inbox-harvest-2026-08-e-council-topology-evidence` step 5.1: *"One
+ * synthesis-strategy interface behind the candidates (host convener, dedicated
+ * external judge, strongest configured model, top-ranked member, dual synthesis
+ * + adjudication) — no user-facing mode proliferation"*, verified by *"the
+ * user-facing surface gains no new mode names"*.
+ *
+ * ## The whole point is that this is INTERNAL
+ *
+ * Five candidates, one interface, and **zero** new flags, choices or synthesis
+ * mode names. Every strategy resolves from configuration the engine already
+ * reads — `ai_council.chairman.mode` (`host` | `member` | `auto`), the
+ * configured member name, and the optional `members.<name>.tier` — so a
+ * consumer's surface is byte-identical before and after this module. That is
+ * 12.4's rule ("consumer surfaces request capabilities, never topology names")
+ * applied to synthesis, and the test file asserts it against the CLI's own
+ * option tables rather than trusting this paragraph.
+ *
+ * ## Selection is NOT reimplemented
+ *
+ * Every strategy delegates to `select_chairman` (`chairman.ts:42`). A second
+ * selection path would be two answers to "who chairs", and the second is the one
+ * nobody updates — the same defect 1A.1 forbids for the question hash. What this
+ * module adds is a NAME for what the existing selection is doing in each
+ * configuration, so Phase 5's showdown has something to compare.
+ *
+ * ## One candidate is deliberately unreachable, and saying so is the honest part
+ *
+ * `dual_adjudicated` (dual synthesis plus adjudication) cannot be selected from
+ * today's configuration: nothing in `ai_council.chairman` expresses "run two
+ * synthesisers and adjudicate". Reaching it needs a new input — which is exactly
+ * what 5.1's verify clause forbids adding to the user surface. It is therefore
+ * declared in the vocabulary, reported as `reachable: false`, and left
+ * unselectable rather than smuggled in behind a flag.
+ *
+ * Pure: resolution and description only. The billable dispatch stays in
+ * `council_cli.ts` `_maybe_run_chairman`, exactly where it already lives.
+ */
+import { select_chairman } from './chairman.js';
+import type { ChairmanCandidate, ChairmanSelection } from './chairman.js';
+
+/** The five candidates 5.1 enumerates, in the order it enumerates them. */
+export const SYNTHESIS_STRATEGIES = Object.freeze([
+    'host_convener',
+    'external_judge',
+    'strongest_model',
+    'top_ranked_member',
+    'dual_adjudicated',
+] as const);
+
+export type SynthesisStrategyId = (typeof SYNTHESIS_STRATEGIES)[number];
+
+/** Declared arity, so an append reds the closure assertion in the test. */
+export const SYNTHESIS_STRATEGY_ARITY = 5;
+
+/** Exactly the configuration the engine ALREADY reads. No new key appears here. */
+export interface SynthesisContext {
+    /** `ai_council.chairman.mode` — `host` | `member` | `auto`. */
+    readonly chairmanMode: string;
+    /** `ai_council.chairman.member` when the mode is `member`. */
+    readonly configuredMember: string | null;
+    /** Member names that produced a real response this session. */
+    readonly deliberated: ReadonlySet<string>;
+    /** Enabled members in config order, with their optional `tier`. */
+    readonly candidates: readonly ChairmanCandidate[];
+}
+
+/** The ONE interface all five candidates sit behind. */
+export interface SynthesisStrategy {
+    readonly id: SynthesisStrategyId;
+    /** Internal description. Never rendered on a user-facing surface. */
+    readonly describe: string;
+    /** Can today's configuration reach it at all? */
+    readonly reachable: boolean;
+    /** Extra billable calls beyond the deliberation, at this strategy. */
+    readonly extraCalls: number;
+    /** Delegates to `select_chairman` — never a second selection path. */
+    readonly resolve: (ctx: SynthesisContext) => ChairmanSelection;
+}
+
+const _viaChairman = (ctx: SynthesisContext): ChairmanSelection =>
+    select_chairman(ctx.chairmanMode, ctx.configuredMember, ctx.deliberated, ctx.candidates);
+
+export const STRATEGIES: Readonly<Record<SynthesisStrategyId, SynthesisStrategy>> = Object.freeze({
+    host_convener: {
+        id: 'host_convener',
+        describe: 'the host that framed the artefact writes the synthesis — today default, zero extra calls',
+        reachable: true,
+        extraCalls: 0,
+        resolve: _viaChairman,
+    },
+    external_judge: {
+        id: 'external_judge',
+        describe: 'a named non-deliberating member synthesises — chairman.mode=member',
+        reachable: true,
+        extraCalls: 1,
+        resolve: _viaChairman,
+    },
+    strongest_model: {
+        id: 'strongest_model',
+        describe: 'the highest-tier non-deliberating member synthesises — chairman.mode=auto with tiers configured',
+        reachable: true,
+        extraCalls: 1,
+        resolve: _viaChairman,
+    },
+    top_ranked_member: {
+        id: 'top_ranked_member',
+        describe:
+            'the first non-deliberating member in config order synthesises — chairman.mode=auto with no tiers, ' +
+            'where config order is the only ranking the engine trusts',
+        reachable: true,
+        extraCalls: 1,
+        resolve: _viaChairman,
+    },
+    dual_adjudicated: {
+        id: 'dual_adjudicated',
+        describe:
+            'two synthesisers plus an adjudication pass — NOT reachable from today’s configuration; ' +
+            'reaching it needs a new input, which 5.1’s verify clause forbids adding to the user surface',
+        reachable: false,
+        extraCalls: 3,
+        resolve: _viaChairman,
+    },
+});
+
+/**
+ * Which strategy today's configuration IS, named.
+ *
+ * Reads only `chairmanMode` and whether any candidate carries a tier — both
+ * already-read inputs. Returns `null` for a mode the config loader would have
+ * rejected, rather than guessing a strategy for an unknown value.
+ */
+export function resolveSynthesisStrategy(ctx: SynthesisContext): SynthesisStrategy | null {
+    if (ctx.chairmanMode === 'host') return STRATEGIES.host_convener;
+    if (ctx.chairmanMode === 'member') return STRATEGIES.external_judge;
+    if (ctx.chairmanMode === 'auto') {
+        const tiered = ctx.candidates.some((c) => c.tier !== null && c.tier !== undefined);
+        return tiered ? STRATEGIES.strongest_model : STRATEGIES.top_ranked_member;
+    }
+    return null;
+}
+
+/** Strategies a consumer can actually land on today. `dual_adjudicated` is excluded. */
+export function reachableStrategies(): SynthesisStrategyId[] {
+    return SYNTHESIS_STRATEGIES.filter((id) => STRATEGIES[id].reachable);
+}
+
+/**
+ * The config keys this module reads — asserted by the test to contain no key
+ * the engine did not already read, so "no new user-facing input" is checkable
+ * rather than promised.
+ */
+export const CONFIG_KEYS_READ: readonly string[] = Object.freeze([
+    'ai_council.chairman.mode',
+    'ai_council.chairman.member',
+    'ai_council.members.<name>.tier',
+]);

package/src/scripts/check_adr_frontmatter.ts

@@ -43,7 +43,9 @@ import {
     AGENTIC_MODES,
     DISCOVERY_STATES,
     EVIDENCE_STRENGTHS,
+    PROTECTED_DIMENSIONS,
     PROVENANCE_KINDS,
+    REOPEN_POLICIES,
     evidenceOf,
     provenanceOf,
     readAdrFrontmatter,
@@ -87,16 +89,9 @@ const REQUIRED = ['adr', 'status', 'date', 'decision'] as const;
  * the same words. This validator therefore checks the VALUE when present and
  * never requires the KEY.
  */
-const ALLOWED_REOPEN_POLICY = new Set(['directional', 'owner', 'unclassified']);
+const ALLOWED_REOPEN_POLICY = new Set<string>(REOPEN_POLICIES);
 
-const ALLOWED_PROTECTED_DIMENSIONS = new Set([
-    'purpose',
-    'security_floor',
-    'privacy_floor',
-    'external_commitment',
-    'governance',
-    'none',
-]);
+const ALLOWED_PROTECTED_DIMENSIONS = new Set<string>(PROTECTED_DIMENSIONS);
 
 /** Split an inline `[a, b]` list or a folded multi-value string into members. */
 export function split_dimensions(raw: string): string[] {