@event4u/agent-config 16.2.0 → 16.4.0

package/src/scripts/_lib/windsurf_render.ts

@@ -0,0 +1,63 @@
+/**
+ * The windsurf single-file surface, rendered — one renderer, two callers.
+ *
+ * `road-to-a-hook-bundle-with-one-yaml-reader` 3.1. `condense.generate_windsurfrules`
+ * WRITES `.windsurfrules`; the standing-payload census needs the same bytes to
+ * report windsurf's figure without reading that file, because it is an untracked
+ * generated projection and reading it published a number that tracked when the
+ * checkout last ran `task generate-tools` rather than anything about the tree.
+ *
+ * Both callers share THIS function. A second renderer living in the census would
+ * have measured a file nobody receives, which is Risk 3 of that roadmap.
+ *
+ * WHY A SEPARATE MODULE rather than an export from `condense.ts`: that file sits
+ * 1,228 lines over the 1,500-line cap `check_source_size_budget` ratchets, so
+ * every line added there is a new violation. Splitting the renderer out moves
+ * `condense.ts` DOWN. The file is small on purpose and carries only what the
+ * render needs.
+ *
+ * `strip_frontmatter` moved here with it — it is the render's one non-trivial
+ * dependency, it has exactly one caller left inside `condense.ts`, and leaving it
+ * behind would have meant either an import cycle or a second copy.
+ * `condense.ts` re-exports it, so `src/install/emit_host_rules_cli.ts` and every
+ * other importer keeps its path.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** Python `str.lstrip("\n")` — strip only leading newlines. Mirrors `condense._lstripNewlines`. */
+function lstripNewlines(s: string): string {
+    return s.replace(/^\n+/, '');
+}
+
+/** Python `str.strip()` with no args — strip leading/trailing Unicode whitespace. Mirrors `condense._strip`. */
+function strip(s: string): string {
+    return s.replace(/^\s+/u, '').replace(/\s+$/u, '');
+}
+
+/** Drop a leading `---` frontmatter block, if the content opens with one. */
+export function strip_frontmatter(content: string): string {
+    if (content.startsWith('---')) {
+        const end = content.indexOf('---', 3);
+        if (end !== -1) {
+            content = lstripNewlines(content.slice(end + 3));
+        }
+    }
+    return content;
+}
+
+/**
+ * The exact bytes `generate_windsurfrules` writes, for a given rule set.
+ *
+ * `rulesSource` is a parameter rather than `condense.MODULE_STATE.RULES_SOURCE`
+ * so a caller can render a tree it names — the census renders the projection
+ * source directly, with no module state to set up.
+ */
+export function render_windsurfrules(rulesSource: string, rules: readonly string[]): string {
+    const parts = ['# Auto-generated from dist/agent-src/rules/ — do not edit directly\n'];
+    for (const rule of rules) {
+        const content = strip_frontmatter(fs.readFileSync(path.join(rulesSource, rule), 'utf-8'));
+        parts.push(`---\n\n${strip(content)}\n`);
+    }
+    return parts.join('\n') + '\n';
+}

package/src/scripts/_lib/worker_budget.ts

@@ -9,7 +9,7 @@
  * error on the wrong rung, not diligence.
  *
  * Composes with — replaces nothing:
- * - the N=3 validation-loop budget (`autonomous-execution`),
+ * - the `execution.fix_loop_max` validation-loop budget (`autonomous-execution`),
  * - the ADR-109 / `subagent-response-contract` body + 4-status envelope
  *   (`subagent-steering`): the partial result rides as the body of a
  *   `BLOCKED` envelope with `budget_hit: true` as the escalation flag.

package/src/scripts/adr/regenerate_index.ts

@@ -187,11 +187,26 @@ export function scan(d: string): [Row[], Row[], string[]] {
  * A scope with no refs renders as `—`: a qualifier on nothing is not a
  * supersession, and printing the prose alone would read as one.
  */
+/**
+ * Escape a `|` for safety inside a Markdown table cell. The free-text scope
+ * fields this feeds (`supersedes_scope` / `superseded_scope`) routinely quote
+ * a table row from the record they describe — and a quoted row has its own
+ * `|` column separators, verbatim, in the frontmatter prose. Unescaped, that
+ * splits the generated row into extra columns rather than rendering the quote
+ * (found live in ADR-230's and ADR-279's own rows, both quoting the same
+ * table cell from ADR-230 § Decision). `refs` itself is never escaped: it is
+ * always an `ADR-NNN` token list this generator produces or validates, never
+ * free text.
+ */
+function escapeCell(text: string): string {
+    return text.replaceAll('|', '\\|');
+}
+
 export function supersessionCell(refs: string | undefined, scope: string | undefined): string {
     const r = (refs ?? '').trim();
     if (r === '' || r === '—') return '—';
     const s = (scope ?? '').trim();
-    return s === '' || s === '—' ? r : `${r} (${s})`;
+    return s === '' || s === '—' ? r : `${r} (${escapeCell(s)})`;
 }
 
 /** Mirror `row(r)`. */

package/src/scripts/ai_council/cli_call_budget.ts

@@ -29,15 +29,23 @@ import * as path from 'node:path';
 export const CLI_CALLS_ATTRIBUTION_SUFFIX = '.attribution.json';
 
 /**
- * Who booked a call. Enumerated because the consumer set is closed: exactly two
- * files in the tree construct a `CliClient`.
+ * Who booked a call. Enumerated because the consumer set is closed: exactly
+ * three files in the tree construct a `CliClient`.
  *
- * `unknown` is a FINDING when it appears — it means a third booking path exists
- * that this enumeration does not know about. That is how the test suite was
- * caught spending the operator's live budget.
+ * `unknown` is a FINDING when it appears — it means a booking path exists that
+ * this enumeration does not know about. That is how the test suite was caught
+ * spending the operator's live budget.
  */
 export const CLI_CONSUMER_COUNCIL = 'council';
 export const CLI_CONSUMER_TEAM = 'team';
+/**
+ * The dogfooded self-review gate. Third because `self_review_gate.ts` is
+ * CLI-first since this constant was added: the subscription transport is tried
+ * before the API one, so a local or self-hosted run books here rather than
+ * spending API credit. A hosted CI runner has no vendor CLI on PATH and falls
+ * through to the API transport, which books nothing against this counter.
+ */
+export const CLI_CONSUMER_SELF_REVIEW = 'self-review';
 export const CLI_CONSUMER_UNKNOWN = 'unknown';
 
 /**

package/src/scripts/ai_council/clients.ts

@@ -88,6 +88,7 @@ import * as user_global_paths from '../_lib/user_global_paths.js';
 import { jsonDumpsIndent2 as _jsonDumpsIndent2 } from './_py_json.js';
 import * as budget from './cli_call_budget.js';
 import { appendEvent } from './events_log.js';
+import { OPENAI_CLI_VENDOR_DEFAULT } from './vendor_defaults.js';
 
 export const ANTHROPIC_KEY_FILENAME = 'anthropic.key';
 export const OPENAI_KEY_FILENAME = 'openai.key';
@@ -124,23 +125,12 @@ export const DEFAULT_PERPLEXITY_MODEL = 'sonar-pro';
 // divergence is a one-line change, not a hunt through inline literals.
 // (`xai` / `perplexity` CLI reuse their API constants: their CLIs are
 // community wrappers around the same paid API, so the values do not diverge.)
-/**
- * Sentinel: let the codex CLI pick its own model, by omitting `--model`.
- *
- * This is not a placeholder for a value nobody looked up. Measured
- * 2026-08-15 against `codex exec --json` on a ChatGPT-account (subscription)
- * transport, every explicitly named candidate was refused with
- * `400 invalid_request_error: The '<model>' model is not supported when using
- * Codex with a ChatGPT account.` — `gpt-4o`, `gpt-5` (this constant's previous
- * value) and `gpt-5.1-codex` alike. Omitting the flag answered normally.
- *
- * So the only value known to work on this transport is "whatever the CLI
- * chooses", and pinning ANY name here would re-break the seat the next time
- * the vendor rotates its lineup. The label is carried into records as-is so a
- * reader can see that no model was pinned, rather than a name being implied
- * that nobody verified.
- */
-export const OPENAI_CLI_VENDOR_DEFAULT = 'codex-default';
+// `OPENAI_CLI_VENDOR_DEFAULT` lives in `vendor_defaults.ts`, re-exported here
+// so every existing importer keeps resolving. It moved because `config.ts`
+// wanted that one string and was charged this whole module for it in the
+// composed hook bundle — 51,523 bytes on every dispatch; the reasoning and the
+// measurement are in that file's header.
+export { OPENAI_CLI_VENDOR_DEFAULT } from './vendor_defaults.js';
 
 /**
  * Models MEASURED to be refused by the codex subscription transport, with the
@@ -1011,6 +1001,7 @@ export const CLI_CALLS_FILENAME = 'cli-calls.json';
 export {
     CLI_CALLS_ATTRIBUTION_SUFFIX,
     CLI_CONSUMER_COUNCIL,
+    CLI_CONSUMER_SELF_REVIEW,
     CLI_CONSUMER_TEAM,
     CLI_CONSUMER_UNKNOWN,
     QUOTA_SOURCE_LOCAL_BUDGET,
@@ -1678,16 +1669,22 @@ export function _foldSystemPrompt(system_prompt: string, user_prompt: string): s
 export class AnthropicCliClient extends CliClient {
     override subscription_label = 'claude-pro';
 
+    // `...opts` rather than a field list, in all five CLI subclasses, and the
+    // spread IS the fix rather than a tidy. Each of these constructors used to
+    // name six option fields explicitly and forward those — so when
+    // `CliClientOptions` grew a seventh, `consumer`, every subclass silently
+    // dropped it. Both construction sites passed it, `CliClient` read
+    // `opts.consumer ?? CLI_CONSUMER_UNKNOWN`, and the sidecar recorded
+    // `unknown` for every CLI call ever booked: measured 2026-10-05 as
+    // `{"anthropic":{"unknown":2},"openai":{"unknown":2}}` after a council
+    // round. A field list can forget a field. A spread cannot, so the eighth
+    // option needs no edit here and cannot repeat this.
+    //
+    // `model` stays explicit because it is the one field each subclass
+    // overrides with its own pinned default; everything else passes through.
     constructor(opts: CliClientOptions = {}) {
         super(
-            {
-                model: opts.model ?? DEFAULT_ANTHROPIC_CLI_MODEL,
-                binary: opts.binary,
-                timeout_seconds: opts.timeout_seconds,
-                max_calls_per_day: opts.max_calls_per_day,
-                warn_at: opts.warn_at,
-                cli_calls_path: opts.cli_calls_path,
-            },
+            { ...opts, model: opts.model ?? DEFAULT_ANTHROPIC_CLI_MODEL },
             { name: 'anthropic', default_binary: 'claude' },
         );
     }
@@ -1817,14 +1814,7 @@ export class OpenAICliClient extends CliClient {
 
     constructor(opts: CliClientOptions = {}) {
         super(
-            {
-                model: opts.model ?? DEFAULT_OPENAI_CLI_MODEL,
-                binary: opts.binary,
-                timeout_seconds: opts.timeout_seconds,
-                max_calls_per_day: opts.max_calls_per_day,
-                warn_at: opts.warn_at,
-                cli_calls_path: opts.cli_calls_path,
-            },
+            { ...opts, model: opts.model ?? DEFAULT_OPENAI_CLI_MODEL },
             { name: 'openai', default_binary: 'codex' },
         );
     }
@@ -2064,14 +2054,7 @@ export class GeminiCliClient extends CliClient {
 
     constructor(opts: CliClientOptions = {}) {
         super(
-            {
-                model: opts.model ?? DEFAULT_GEMINI_CLI_MODEL,
-                binary: opts.binary,
-                timeout_seconds: opts.timeout_seconds,
-                max_calls_per_day: opts.max_calls_per_day,
-                warn_at: opts.warn_at,
-                cli_calls_path: opts.cli_calls_path,
-            },
+            { ...opts, model: opts.model ?? DEFAULT_GEMINI_CLI_MODEL },
             { name: 'gemini', default_binary: 'gemini' },
         );
     }
@@ -2217,14 +2200,7 @@ export class XAICliClient extends CliClient {
 
     constructor(opts: CliClientOptions = {}) {
         super(
-            {
-                model: opts.model ?? DEFAULT_XAI_MODEL,
-                binary: opts.binary,
-                timeout_seconds: opts.timeout_seconds,
-                max_calls_per_day: opts.max_calls_per_day,
-                warn_at: opts.warn_at,
-                cli_calls_path: opts.cli_calls_path,
-            },
+            { ...opts, model: opts.model ?? DEFAULT_XAI_MODEL },
             { name: 'xai', default_binary: 'grok' },
         );
     }
@@ -2289,14 +2265,7 @@ export class PerplexityCliClient extends CliClient {
 
     constructor(opts: CliClientOptions = {}) {
         super(
-            {
-                model: opts.model ?? DEFAULT_PERPLEXITY_MODEL,
-                binary: opts.binary,
-                timeout_seconds: opts.timeout_seconds,
-                max_calls_per_day: opts.max_calls_per_day,
-                warn_at: opts.warn_at,
-                cli_calls_path: opts.cli_calls_path,
-            },
+            { ...opts, model: opts.model ?? DEFAULT_PERPLEXITY_MODEL },
             { name: 'perplexity', default_binary: 'perplexity' },
         );
     }

package/src/scripts/ai_council/config.ts

@@ -82,7 +82,7 @@ import * as budget from './cli_call_budget.js';
 // `import type` and is erased at build, so there is no runtime cycle today.
 // Converting it to a value import — or adding any other runtime import from
 // quorum into config — creates a real ESM cycle in the loader's init path.
-import { OPENAI_CLI_VENDOR_DEFAULT } from './clients.js';
+import { OPENAI_CLI_VENDOR_DEFAULT } from './vendor_defaults.js';
 import { parseSeatFields, type PolicyExclusion } from './seat_policy.js';
 import type { ContentClass } from './content_ceiling.js';
 import { SOLO_FLOOR_MIN_PRESENT } from './quorum.js';
@@ -291,8 +291,8 @@ export interface CostBudgetConfig {
     readonly max_output_tokens: number;
     readonly max_calls: number;
     readonly max_total_usd: number;
-    /** Rolling 24h cap. 0 disables it — and disabling it also disables the spend
-     * ledger, since the orchestrator only appends an entry while a cap is live. */
+    /** Rolling 24h cap. 0 disables it. The spend ledger is written either way
+     * (ADR-279); this value decides only whether the total is compared. */
     readonly daily_limit_usd: number;
 }
 
@@ -1020,7 +1020,7 @@ function _build_debate(d: Dict): DebateConfig {
     if (!_isDict(d)) {
         throw new CouncilConfigError('`debate` must be a mapping.');
     }
-    const cap = _pyFloat(_get(d, 'max_cost_usd', 5.0));
+    const cap = _pyFloat(_get(d, 'max_cost_usd', 0.0)); // 0 = no refusal cap (ADR-279)
     if (cap < 0) {
         throw new CouncilConfigError(
             `debate.max_cost_usd must be >= 0 (got ${_pyRepr(_f(cap))}; ` +
@@ -1671,10 +1671,10 @@ function _build_cost_budget(d: Dict): CostBudgetConfig {
         throw new CouncilConfigError('`cost_budget` must be a mapping.');
     }
     const cb: CostBudgetConfig = {
-        max_input_tokens: _pyInt(_get(d, 'max_input_tokens', 500_000)),
-        max_output_tokens: _pyInt(_get(d, 'max_output_tokens', 200_000)),
-        max_calls: _pyInt(_get(d, 'max_calls', 50)),
-        max_total_usd: _pyFloat(_get(d, 'max_total_usd', 20.0)),
+        max_input_tokens: _pyInt(_get(d, 'max_input_tokens', 0)), // 0 = unbounded (ADR-279)
+        max_output_tokens: _pyInt(_get(d, 'max_output_tokens', 0)), // 0 = unbounded (ADR-279)
+        max_calls: _pyInt(_get(d, 'max_calls', 50)), // fan-out, not money — kept
+        max_total_usd: _pyFloat(_get(d, 'max_total_usd', 0.0)), // 0 = unbounded (ADR-279)
         daily_limit_usd: _pyFloat(_get(d, 'daily_limit_usd', 0.0)),
     };
     const fields: Array<[keyof CostBudgetConfig, boolean]> = [

package/src/scripts/ai_council/modification_review.ts

@@ -0,0 +1,100 @@
+/**
+ * modification_review — the review verb for a diff whose bundle contains a
+ * gated path: how a seat closes, and how the record's verdict follows.
+ *
+ * `road-to-self-modification-that-a-council-must-pass` steps 3.2 and 3.3.
+ *
+ * WHY THE EXISTING STANCE PARSER AND NOT A NEW ONE. Seats already close on a
+ * `STANCE: … | CONFIDENCE: … | DEALBREAKER: …` line, and `stance_tally` already
+ * parses it — including the two cosmetic defects it forgives. A second grammar
+ * for the same closing line would be a second thing to keep in step with the
+ * prompt, and the first time they diverged a seat's verdict would be read by
+ * one and dropped by the other.
+ *
+ * WHAT IS DELIBERATELY NOT USED. Not the option tally, and not the synthesis
+ * verdict line. Both answer which OPTION wins a deliberation; this review asks
+ * whether each SEAT passed a change, which is a different question over the
+ * same replies. Nor is the diff lens's own closing line asked for — a lens is
+ * not a seat.
+ *
+ * WHY A VERB OF ITS OWN HERE RATHER THAN AN `agent-config` COMMAND. The CLI
+ * help-count budget is at its maximum (`cli_help_command_count` in
+ * `src/config/evaluator-budgets.json`), so a new top-level verb would spend a
+ * ratchet this change has no claim on. It dispatches inside `council_cli`.
+ */
+
+import { parse_stance_line } from './stance_tally.js';
+
+/**
+ * The closed vocabulary a seat may close on. Open it and a grep for a passing
+ * verdict starts reading words nobody adjudicated — the failure
+ * `ratification-artifact.md` names for its own `verdict` field.
+ */
+export const MODIFICATION_VERDICT_LABELS = [
+    'ratified',
+    'confirmed-non-expanding',
+    'refused',
+] as const;
+
+export type ModificationVerdictLabel = (typeof MODIFICATION_VERDICT_LABELS)[number];
+
+/** The record's verdict: a seat label, or the one value no seat may utter. */
+export type ModificationVerdict = ModificationVerdictLabel | 'non-convergent';
+
+/**
+ * Read ONE seat's reply. Returns its label when the seat concluded, `null`
+ * otherwise — a missing line, an abstention, or any other label.
+ *
+ * `null` is never inferred from surrounding prose: a seat that writes
+ * "I would call this ratified" has not closed on a stance line, and reading it
+ * as a conclusion is how a review starts reporting verdicts nobody gave.
+ */
+export function seatConclusion(text: string): ModificationVerdictLabel | null {
+    const line = parse_stance_line(text);
+    if (line === null) return null;
+    const label = line.label.trim().toLowerCase();
+    return (MODIFICATION_VERDICT_LABELS as readonly string[]).includes(label)
+        ? (label as ModificationVerdictLabel)
+        : null;
+}
+
+/**
+ * Read every seat, keeping the non-concluding ones present and `null` rather
+ * than dropping them. A dropped seat is indistinguishable from a seat that was
+ * never asked, and the quorum rule below has to tell those apart.
+ */
+export function readSeatConclusions(
+    replies: Readonly<Record<string, string>>,
+): Record<string, ModificationVerdictLabel | null> {
+    const out: Record<string, ModificationVerdictLabel | null> = {};
+    for (const [seat, text] of Object.entries(replies)) {
+        out[seat] = seatConclusion(text);
+    }
+    return out;
+}
+
+/**
+ * Derive the record's verdict. ONE rule, and the ORDER is the rule:
+ *
+ *   1. any concluding seat on `refused`  → `refused`
+ *   2. concluding providers < required   → `non-convergent`
+ *   3. any concluding seat on `ratified` → `ratified`
+ *   4. otherwise (all concluded, all non-expanding) → `confirmed-non-expanding`
+ *
+ * Step 1 precedes step 2 on purpose. A single refusing seat is a refusal even
+ * when it is the only seat that concluded: letting the quorum rule fire first
+ * would turn "one reviewer said no" into "not enough reviewers answered", which
+ * reads as a retryable condition rather than as the objection it is.
+ */
+export function deriveModificationVerdict(
+    seats: Readonly<Record<string, ModificationVerdictLabel | null>>,
+    requiredProviders: number,
+): ModificationVerdict {
+    const concluded = Object.values(seats).filter(
+        (v): v is ModificationVerdictLabel => v !== null,
+    );
+    if (concluded.includes('refused')) return 'refused';
+    if (concluded.length < requiredProviders) return 'non-convergent';
+    if (concluded.includes('ratified')) return 'ratified';
+    return 'confirmed-non-expanding';
+}

package/src/scripts/ai_council/modification_review_questions.ts

@@ -0,0 +1,90 @@
+/**
+ * modification_review_questions — the fixed set a modification review asks
+ * every seat, one by one.
+ *
+ * `road-to-self-modification-that-a-council-must-pass` step 3.1. The owner's
+ * directive of 2026-10-05 is that self-modification is a goal, confirmed by a
+ * council that "always questions critically and checks what the modification
+ * does". A council that is merely ASKED for an opinion produces an opinion; a
+ * council handed a fixed list answers the same nine things about every change,
+ * and a reader can tell which one a seat skipped.
+ *
+ * WHY A CONSTANT RATHER THAN PROSE IN A PROMPT. The list is the review's
+ * contract, so it is quoted in `docs/contracts/ratification-artifact.md` and
+ * read from here by whatever renders the prompt. One definition, two readers —
+ * the alternative is a prompt and a contract that drift apart silently, which
+ * is the drift this package's own gates exist to catch.
+ *
+ * WHERE THE TREE ALREADY WORDS A QUESTION, THAT WORDING IS USED rather than
+ * paraphrased. Two do: `evaluator-independence`'s weakening clause and the
+ * synthesis prompt's kill-switch criteria. A paraphrase would be a second,
+ * slightly different standard for the same thing — and each carries a `source`
+ * so a reader can check the borrow rather than take it.
+ */
+
+/** One question, addressable on its own so a skipped answer is visible. */
+export interface ModificationReviewQuestion {
+    /** Stable id; the record's body keys each seat's answer by it. */
+    readonly id: string;
+    /** The question as asked, verbatim. */
+    readonly text: string;
+    /** Where the wording came from, when it was taken rather than written. */
+    readonly source?: string;
+}
+
+/**
+ * The nine, in the order step 3.1 enumerates them. Order is part of the
+ * contract: a seat answering one by one answers them in this sequence, so a
+ * record can be read against the list without matching prose to intent.
+ */
+export const MODIFICATION_REVIEW_QUESTIONS: readonly ModificationReviewQuestion[] = [
+    {
+        id: 'behaviour-change',
+        text: 'What behaviour changes, including what follows from it that the diff does not state?',
+    },
+    {
+        id: 'boundary-direction',
+        text: 'Which authority or safety boundary becomes wider or narrower, and in which direction?',
+    },
+    {
+        id: 'weakens-its-own-judge',
+        text:
+            'Does the change weaken anything that judges it — a test, a gate, a threshold, this review? ' +
+            'The standard is quoted rather than paraphrased: the implementer never silently ' +
+            'weakens an assertion, deletes, skips or xfails a failing test, lowers a threshold, ' +
+            'or changes fixture semantics to fit the code. Does this change do any of those?',
+        source: 'src/rules/evaluator-independence.md § Tests are evaluators',
+    },
+    {
+        id: 'route-around',
+        text: 'Is another host or projection left as a way around the control this change touches?',
+    },
+    {
+        id: 'undo',
+        text: 'Can it be undone, and how — by whom, with what authority, and against which revision?',
+    },
+    {
+        id: 'falsifier',
+        text:
+            'What observation would show the claimed benefit to be false, and what rollback / ' +
+            'kill-switch criteria does the change omit?',
+        source: 'src/scripts/ai_council/prompts.ts (DESIGN_MODE, ROADMAP_MODE)',
+    },
+    {
+        id: 'smaller-change',
+        text: 'Would a smaller change do, and what does the larger one buy that the smaller one does not?',
+    },
+    {
+        id: 'instruction-weight',
+        text: 'What does it add to standing instruction weight that every later session pays?',
+    },
+    {
+        id: 'untrusted-steering',
+        text: 'Could untrusted content steer the path this change opens, and what bounds it if so?',
+    },
+];
+
+/** The list as a seat sees it: numbered, in order, nothing dropped. */
+export function renderModificationReviewQuestions(): string {
+    return MODIFICATION_REVIEW_QUESTIONS.map((q, i) => `${i + 1}. ${q.text}`).join('\n');
+}

package/src/scripts/ai_council/orchestrator.ts

@@ -412,7 +412,7 @@ export function consult(
         return [];
     }
     const resolvedBudget = budget ?? new CostBudget();
-    if (members.length > resolvedBudget.max_calls) {
+    if (resolvedBudget.max_calls > 0 && members.length > resolvedBudget.max_calls) {
         throw new Error(
             `Council has ${members.length} members but budget caps at ` +
                 `${resolvedBudget.max_calls} calls.`,
@@ -802,9 +802,9 @@ function _run_round(
             );
             actual_usd = _total_usd(actual);
             spent.usd += _total_usd(actual);
-            // Persist to the rolling 24h ledger when the daily cap is
-            // active. Errors are swallowed inside record_spend.
-            if (budget.daily_limit_usd > 0 && !response.error) {
+            // Ledger every billable response, bounded or not (ADR-279): a cap
+            // decides whether the total is compared, never whether it is kept.
+            if (!response.error) {
                 _record_daily_spend(_total_usd(actual), effective.name, effective.model, {
                     cache_read_input_tokens: response.cache_read_input_tokens,
                     cache_creation_input_tokens: response.cache_creation_input_tokens,
@@ -1246,7 +1246,7 @@ export function run_debate(
         return [];
     }
     const budget = budget0 ?? new CostBudget();
-    if (members.length > budget.max_calls) {
+    if (budget.max_calls > 0 && members.length > budget.max_calls) {
         throw new Error(
             `Debate has ${members.length} members but budget caps at ` +
                 `${budget.max_calls} calls.`,

package/src/scripts/ai_council/spend_gate.ts

@@ -20,9 +20,9 @@ import type { ExternalAIClient } from './clients.js';
 import { would_exceed as _would_exceed_daily } from './budget_guard.js';
 
 export class CostBudget {
-    max_input_tokens: number;
-    max_output_tokens: number;
-    max_calls: number;
+    max_input_tokens: number; // 0 = input-token ceiling disabled
+    max_output_tokens: number; // 0 = output-token ceiling disabled
+    max_calls: number; // 0 = per-invocation call cap disabled (fan-out unbounded)
     max_total_usd: number; // 0 = USD ceiling disabled (token caps still apply)
     daily_limit_usd: number; // 0 = rolling 24h cap disabled (D3)
 
@@ -35,8 +35,11 @@ export class CostBudget {
             daily_limit_usd?: number;
         } = {},
     ) {
-        this.max_input_tokens = args.max_input_tokens ?? 50_000;
-        this.max_output_tokens = args.max_output_tokens ?? 20_000;
+        // ADR-279: the two token ceilings default to 0 = unbounded, as the two
+        // USD ceilings below already did. `max_calls` keeps its default — it
+        // bounds fan-out against a plan quota, not money.
+        this.max_input_tokens = args.max_input_tokens ?? 0;
+        this.max_output_tokens = args.max_output_tokens ?? 0;
         this.max_calls = args.max_calls ?? 10;
         this.max_total_usd = args.max_total_usd ?? 0.0;
         this.daily_limit_usd = args.daily_limit_usd ?? 0.0;
@@ -101,9 +104,17 @@ export function _breach(
     budget: CostBudget,
 ): BreachKind {
     const usd = est ? _total_usd(est) : 0.0;
+    // Zero disables a token cap, as `ai-council-config.md:84-86` has always
+    // said it does. Until 2026-10-06 these two comparisons carried no guard
+    // while the two USD comparisons below them did, so a budget with every
+    // cap at zero — the contract's "no bound at all" — breached on a
+    // ten-token estimate. The guard goes on each cap separately: a user who
+    // set one and left the other at zero is bounded by the one they set.
     if (
-        spent.input + (est ? est.input_tokens : 0) > budget.max_input_tokens ||
-        spent.output + (est ? est.output_tokens : 0) > budget.max_output_tokens
+        (budget.max_input_tokens > 0 &&
+            spent.input + (est ? est.input_tokens : 0) > budget.max_input_tokens) ||
+        (budget.max_output_tokens > 0 &&
+            spent.output + (est ? est.output_tokens : 0) > budget.max_output_tokens)
     ) {
         return 'tokens';
     }

package/src/scripts/ai_council/vendor_defaults.ts

@@ -0,0 +1,45 @@
+/**
+ * Vendor-CLI sentinel values that are DATA, carried in a module with no
+ * dependencies of its own.
+ *
+ * WHY THIS FILE EXISTS, measured rather than argued. `OPENAI_CLI_VENDOR_DEFAULT`
+ * is a single string, and it used to live in `clients.ts` beside the transport
+ * classes that compare against it. `ai_council/config.ts` imports that one
+ * string and nothing else from `clients.ts`; `config.ts` is reachable from
+ * `council-availability`, which is bound on `session_start`. So every hook
+ * dispatch on every slot carried the whole council transport layer —
+ * `clients.ts` and its closure, **51,523 bytes** of the composed
+ * `dist/hooks/dispatch.js` — to compare one string against another. Breaking
+ * that one import edge removes exactly that, with no capability removed
+ * anywhere: every entry point that actually talks to a vendor CLI imports
+ * `clients.ts` directly and still does.
+ *
+ * The bytes are not an abstraction. `src/config/hook-bundle-budget.json` caps
+ * the composed bundle, the cap is a shrink-only ratchet, and on 2026-10-02 the
+ * tree stood 75 bytes under it — a state in which no concern anywhere could add
+ * a line. This module is how `road-to-a-rule-carrier-that-works-outside-the-repo`
+ * Phase 1 paid for its own runtime code instead of asking for a raise.
+ *
+ * WHAT BELONGS HERE: a vendor-facing constant that a CONFIGURATION reader needs
+ * and a TRANSPORT reader also happens to use. Nothing that imports anything.
+ * The moment this file gains an import it stops being the cheap half of the
+ * split and the split stops being worth its own file.
+ */
+
+/**
+ * Sentinel: let the codex CLI pick its own model, by omitting `--model`.
+ *
+ * This is not a placeholder for a value nobody looked up. Measured
+ * 2026-08-15 against `codex exec --json` on a ChatGPT-account (subscription)
+ * transport, every explicitly named candidate was refused with
+ * `400 invalid_request_error: The '<model>' model is not supported when using
+ * Codex with a ChatGPT account.` — `gpt-4o`, `gpt-5` (this constant's previous
+ * value) and `gpt-5.1-codex` alike. Omitting the flag answered normally.
+ *
+ * So the only value known to work on this transport is "whatever the CLI
+ * chooses", and pinning ANY name here would re-break the seat the next time
+ * the vendor rotates its lineup. The label is carried into records as-is so a
+ * reader can see that no model was pinned, rather than a name being implied
+ * that nobody verified.
+ */
+export const OPENAI_CLI_VENDOR_DEFAULT = 'codex-default';