@event4u/agent-config 8.10.0 → 8.12.0

package/src/scripts/_lib/auto_dispatch.corpus.test.ts

@@ -0,0 +1,87 @@
+/**
+ * Deterministic `parallelizable:` classifier recall + false-positive measurement
+ * against the orchestration corpus (road-to-orchestration-scope-decision Phase 2
+ * / road-to-subagent-value-realization-followup Phase 1 Step 3).
+ *
+ * The corpus tasks (`internal/bench/orchestration/corpus/*.md`) each document a
+ * "Classification signal" and an expected dispatch mode. This encodes those
+ * documented signals as `TaskSignals` and asserts `classifyTask` (the pure v1
+ * classifier) fires the expected mode — recall on the modes v1 covers
+ * (`do-in-parallel`, `do-in-steps`), FP=0 on the negative control, and the
+ * documented scope gap (v1 has no `do-competitively` / verdict mode).
+ *
+ * This is the durable, reproducible "record actual hit/miss counts" deliverable
+ * + a regression guard for the classifier. Deterministic — no spend, no agents.
+ */
+import { describe, expect, it } from 'vitest';
+
+import { classifyTask, type ActivationInputs, type TaskSignals } from './auto_dispatch.js';
+
+const ON: ActivationInputs = { enabled: true, auto: 'on', subagent_spawn: true };
+
+/** Corpus signals transcribed from each task's documented "Classification signal". */
+const CORPUS: Array<{
+    id: string;
+    signals: TaskSignals;
+    expectMode: 'do-in-parallel' | 'do-in-steps' | null;
+    note: string;
+}> = [
+    {
+        id: 'orch-01',
+        signals: { parallelizable: 'files', independent_slices: 4, size_estimate: 4, ordered_plan: false },
+        expectMode: 'do-in-parallel',
+        note: 'N independent files, same analysis shape',
+    },
+    {
+        id: 'orch-02',
+        signals: { ordered_plan: true, size_estimate: 5, independent_slices: 0 },
+        expectMode: 'do-in-steps',
+        note: 'explicit ordered numbered plan',
+    },
+    {
+        id: 'orch-03',
+        signals: { size_estimate: 3, independent_slices: 0, ordered_plan: false },
+        expectMode: null,
+        note: 'do-competitively — NOT a v1 DispatchMode (documented scope gap)',
+    },
+    {
+        id: 'pv-01',
+        signals: { size_estimate: 2, independent_slices: 0, ordered_plan: false },
+        expectMode: null,
+        note: 'verdict dispatch — out of the v1 parallel/steps scope',
+    },
+    {
+        id: 'pv-02',
+        signals: { size_estimate: 1, independent_slices: 0, ordered_plan: false },
+        expectMode: null,
+        note: 'negative control — a clean one-file task MUST NOT dispatch',
+    },
+];
+
+describe('parallelizable classifier — corpus recall', () => {
+    for (const c of CORPUS) {
+        it(`${c.id}: ${c.note}`, () => {
+            const r = classifyTask(c.signals, ON);
+            expect(r.mode).toBe(c.expectMode);
+        });
+    }
+
+    it('recall on v1-covered modes is 2/2 (orch-01 parallel, orch-02 steps)', () => {
+        const covered = CORPUS.filter((c) => c.expectMode !== null);
+        const hits = covered.filter((c) => classifyTask(c.signals, ON).mode === c.expectMode);
+        expect(covered).toHaveLength(2);
+        expect(hits).toHaveLength(2);
+    });
+
+    it('false-positive rate is 0 — the negative control (pv-02) never dispatches', () => {
+        const pv02 = CORPUS.find((c) => c.id === 'pv-02')!;
+        expect(classifyTask(pv02.signals, ON).action).not.toBe('dispatch');
+    });
+
+    it('documents the v1 scope gap: do-competitively (orch-03) + verdict (pv-01) are not classified', () => {
+        for (const id of ['orch-03', 'pv-01']) {
+            const c = CORPUS.find((x) => x.id === id)!;
+            expect(classifyTask(c.signals, ON).mode).toBeNull();
+        }
+    });
+});

package/src/scripts/_lib/claude_settings_hooks.ts

@@ -108,8 +108,16 @@ export function build_claude_hook_matrix(manifest_path: string): ClaudeHookMatri
         if (!concerns || (Array.isArray(concerns) && concerns.length === 0)) continue;
         const native = ac_to_native[ac_event];
         if (native === undefined) continue;
+        // Hook-resilience shim (road-to-opt-subagent-harvest P1.4):
+        // local binary → PATH fallback → SILENT exit 0 when neither exists
+        // (a hook must never error-spam the loop on an uninstalled repo).
+        // The dispatcher's own exit code PROPAGATES when it runs — a
+        // fail_closed concern (e.g. block-no-verify) still denies; only the
+        // missing-binary case degrades open, which is the honest degrade
+        // (an absent dispatcher cannot evaluate anything).
         matrix[native] =
             'BIN="$CLAUDE_PROJECT_DIR/agent-config"; [ -x "$BIN" ] || BIN=agent-config; ' +
+            'command -v "$BIN" >/dev/null 2>&1 || exit 0; ' +
             `"$BIN" dispatch:hook --platform claude --event ${ac_event} ` +
             `--native-event ${native} --project-dir "$CLAUDE_PROJECT_DIR" ` +
             `--min-version ${String(hook_spec)}`;

package/src/scripts/_lib/knowledge_global.ts

@@ -6,7 +6,9 @@
  * Python→TS migration). The public API and CLI contract mirror the Python
  * original EXACTLY — same exported snake_case names, same semantics, same
  * tier-classification, provenance footer, and config-merge behavior, same
- * exit codes and byte-identical stdout. No behaviour changes.
+ * exit codes and byte-identical stdout. No behaviour changes at port time;
+ * one deliberate post-port change: DEFAULT_ALLOWED_TIERS narrowed to
+ * ['public'] per ADR-119 (2026-07-12).
  *
  * Structure-grounding v2 (ADR-100 / road-to-structure-grounding-v2). Promotes
  * *expensive* (remote) project-local knowledge cards to a per-user, file-first
@@ -51,8 +53,33 @@ export const TIERS: readonly string[] = ['public', 'vendor', 'proprietary'];
 /**
  * Default tiers eligible to auto-cross a project boundary under default-on.
  * `proprietary` is excluded by design — manual-only regardless of `enabled`.
+ * Narrowed to `public` only per ADR-119 (2026-07-12, council-validated
+ * flip): `vendor` is a deliberate opt-in widening, not the shipped default.
  */
-export const DEFAULT_ALLOWED_TIERS: readonly string[] = ['public', 'vendor'];
+export const DEFAULT_ALLOWED_TIERS: readonly string[] = ['public'];
+
+/**
+ * Sensitivity axis (Phase 1, road-to-feedback-8.11 / successor note to
+ * ADR-119) — orthogonal to `TIERS` (origin) and layered on top of the
+ * existing tier + redaction gate. `tier` classifies WHERE a card came from;
+ * `sensitivity` classifies WHETHER it may ever leave the project at all.
+ *
+ *   * `prohibited` — contains redaction-class content; never leaves the
+ *     repo. Machine-derived from the redaction scan (a card is never
+ *     hand-labelled into this class — a positive hit forces it).
+ *   * `project` — DEFAULT. Stays project-local; promotion is refused
+ *     unless a human explicitly reclassifies the card to `shareable`.
+ *   * `shareable` — eligible for the global store; must pass redaction
+ *     AND carry full promotion provenance (see the G5 footer fields).
+ *
+ * Deliberately kept to three machine-anchored classes — a wider
+ * team/organization taxonomy is phantom for a single-maintainer install and
+ * would over-fit; revisit only once a real multi-tenant consumer exists.
+ */
+export const SENSITIVITIES: readonly string[] = ['prohibited', 'project', 'shareable'];
+
+/** Default sensitivity for a card with no explicit `sensitivity:` field. */
+export const DEFAULT_SENSITIVITY = 'project';
 
 /**
  * Hard defaults applied when the setting block is absent. Default is ON for
@@ -380,6 +407,14 @@ const _PROVENANCE_FIELDS: readonly string[] = [
     'last_verified',
     'tier',
     'seen_in',
+    // G5 promotion audit-trail fields (Phase 1, road-to-feedback-8.11):
+    // the more consistent home for these than frontmatter, since they sit
+    // alongside the other promotion-time facts above, not the card's own
+    // origin-tier/sensitivity classification (which lives in frontmatter).
+    'source_repo',
+    'owner',
+    'review_after',
+    'promotion_reason',
 ];
 
 /** Render the global-card provenance footer (the unversioned-store audit trail). */
@@ -390,6 +425,10 @@ export function render_provenance_footer(args: {
     last_verified: string;
     tier: string;
     seen_in: string[];
+    source_repo: string;
+    owner: string;
+    review_after: string;
+    promotion_reason: string;
 }): string {
     return [
         PROVENANCE_START,
@@ -399,11 +438,20 @@ export function render_provenance_footer(args: {
         `- last_verified: ${args.last_verified}`,
         `- tier: ${args.tier}`,
         `- seen_in: ${args.seen_in.join(', ')}`,
+        `- source_repo: ${args.source_repo}`,
+        `- owner: ${args.owner}`,
+        `- review_after: ${args.review_after}`,
+        `- promotion_reason: ${_singleLine(args.promotion_reason)}`,
         PROVENANCE_END,
         '',
     ].join('\n');
 }
 
+/** Collapse a human-entered reason to one line — footer fields are line-based. */
+function _singleLine(s: string): string {
+    return s.replace(/\r\n|\r|\n/g, ' ').trim();
+}
+
 /** Extract the provenance footer fields as a flat dict (empty if absent). */
 export function parse_provenance_footer(text: string): Record<string, string> {
     if (!text.includes(PROVENANCE_START) || !text.includes(PROVENANCE_END)) {

package/src/scripts/_lib/knowledge_global_promote.ts

@@ -187,6 +187,156 @@ export function should_suggest(
     return len >= options.threshold;
 }
 
+// ---------------------------------------------------------------------------
+// Sensitivity gate (Phase 1, road-to-feedback-8.11 — successor note to
+// ADR-119). Layered ON TOP of the existing tier/redaction gate in
+// `knowledge_global_redaction.ts`: a card must clear tier + redaction FIRST,
+// then clear this gate before its write is allowed to proceed.
+// ---------------------------------------------------------------------------
+
+/** Outcome of the sensitivity gate for one promotion attempt. */
+export interface SensitivityGateResult {
+    readonly eligible: boolean;
+    readonly reason: string;
+    /** The EFFECTIVE sensitivity used for the decision (post auto-derivation). */
+    readonly sensitivity: string;
+}
+
+/**
+ * Resolve the effective sensitivity used for a promotion decision.
+ *
+ * A redaction hit always forces `prohibited`, overriding any declared value —
+ * this is independent of the tier gate's own `halt_on_trigger` setting, so a
+ * `prohibited` override never depends on that unrelated config flag. An
+ * unset / invalid declared value defaults to `project` (never `shareable` —
+ * `shareable` is never auto-assigned, only explicitly declared by a human).
+ */
+export function resolve_effective_sensitivity(declared: string, violations_present: boolean): string {
+    if (violations_present) {
+        return 'prohibited';
+    }
+    const d = (declared ?? '').trim();
+    return knowledge_global.SENSITIVITIES.includes(d) ? d : knowledge_global.DEFAULT_SENSITIVITY;
+}
+
+/**
+ * Gate a card for promotion on the sensitivity axis.
+ *
+ * Refuses anything whose effective sensitivity is not `shareable` (including
+ * the machine-derived `prohibited` override), and refuses a `shareable` card
+ * that has no human-entered `promotion_reason` — the auto-promote
+ * *suggestion* only ever leads to a write once a human states why the card
+ * is safe to share.
+ */
+export function gate_sensitivity_for_promotion(
+    declared_sensitivity: string,
+    options: { violations_present?: boolean; promotion_reason?: string } = {},
+): SensitivityGateResult {
+    const violations_present = options.violations_present ?? false;
+    const effective = resolve_effective_sensitivity(declared_sensitivity, violations_present);
+
+    if (effective === 'prohibited') {
+        return {
+            eligible: false,
+            sensitivity: effective,
+            reason:
+                'sensitivity: prohibited — redaction-class content, never leaves the repo',
+        };
+    }
+    if (effective !== 'shareable') {
+        return {
+            eligible: false,
+            sensitivity: effective,
+            reason:
+                `sensitivity '${effective}' — promotion refused unless a human explicitly ` +
+                "reclassifies the card to 'shareable'",
+        };
+    }
+    const reason = (options.promotion_reason ?? '').trim();
+    if (!reason) {
+        return {
+            eligible: false,
+            sensitivity: effective,
+            reason:
+                "sensitivity 'shareable' but no promotion_reason given — a human must state " +
+                'why this card is safe to share before it may be promoted',
+        };
+    }
+    return { eligible: true, sensitivity: effective, reason: 'sensitivity gate passed' };
+}
+
+// ---------------------------------------------------------------------------
+// Revocation ledger — append-only tombstone trail (Phase 1, road-to-feedback-8.11)
+// ---------------------------------------------------------------------------
+
+export const REVOCATIONS_FILENAME = '.revocations.jsonl';
+
+/** One append-only tombstone line: what was revoked, when, and why. */
+export interface RevocationEntry {
+    readonly revoked_at: string;
+    readonly card_id: string;
+    readonly reason: string;
+}
+
+function _revocations_path(env: knowledge_global.EnvMapType): string {
+    return path.join(knowledge_global.global_store_dir(env, { create: true }), REVOCATIONS_FILENAME);
+}
+
+/**
+ * Append one tombstone line to the revocation ledger — the caller MUST call
+ * this BEFORE deleting the card/usage entry it documents. Append-only (a
+ * single `fs.appendFileSync`, never rewritten): no `forget` / `forget --tier`
+ * / `purge` call ever removes a prior tombstone, so the ledger stays a
+ * durable audit trail across every deletion path — including `purge`, which
+ * deliberately spares this one file while wiping everything else.
+ */
+export function append_tombstone(
+    card_id: string,
+    reason: string,
+    options: { today?: string; env?: knowledge_global.EnvMapType } = {},
+): RevocationEntry {
+    const entry: RevocationEntry = {
+        revoked_at: options.today ?? '',
+        card_id,
+        reason: reason || 'no reason given',
+    };
+    fs.appendFileSync(_revocations_path(options.env ?? null), JSON.stringify(entry) + '\n', 'utf-8');
+    return entry;
+}
+
+/** Read the revocation ledger. Tolerant: missing file → []; malformed lines are skipped. */
+export function load_tombstones(env: knowledge_global.EnvMapType = null): RevocationEntry[] {
+    let text: string;
+    try {
+        text = fs.readFileSync(
+            path.join(knowledge_global.global_store_dir(env), REVOCATIONS_FILENAME),
+            'utf-8',
+        );
+    } catch {
+        return [];
+    }
+    const out: RevocationEntry[] = [];
+    for (const raw of text.split(/\r\n|\r|\n/)) {
+        const line = raw.trim();
+        if (!line) {
+            continue;
+        }
+        try {
+            const obj: unknown = JSON.parse(line);
+            if (_isPlainObject(obj) && typeof obj['card_id'] === 'string') {
+                out.push({
+                    revoked_at: String(obj['revoked_at'] ?? ''),
+                    card_id: obj['card_id'],
+                    reason: String(obj['reason'] ?? ''),
+                });
+            }
+        } catch {
+            // corrupt line — skip; never let one bad line crash the ledger read
+        }
+    }
+    return out;
+}
+
 /**
  * List cards that warrant a promotion suggestion under the current config.
  *

package/src/scripts/_lib/knowledge_global_redaction.ts

@@ -7,7 +7,10 @@
  * the tier gate are matched byte-for-byte against the retired Python implementation. The
  * public API and CLI contract mirror Python exactly — same exported
  * snake_case names, same `GateResult` shape + `summary()` text, same exit
- * codes and stdout. No behaviour changes.
+ * codes and stdout. No behaviour changes at port time; one ADDITIVE
+ * hardening landed after the port (2026-07-12, ADR-103 flip validation):
+ * hidden-unicode detection + strip-then-rescan in `redaction_scan` — inputs
+ * without invisible characters are unaffected.
  *
  * Structure-grounding v2, Phase 1 — the privacy crux (ADR-100 /
  * road-to-structure-grounding-v2). Before any project-local card may cross a
@@ -121,11 +124,26 @@ function _compileIgnoreCase(pattern: string): RegExp {
     return new RegExp(pattern, 'i');
 }
 
+// Invisible / control characters usable to smuggle an identifier past the
+// pattern scan (zero-width class, bidi controls, soft hyphen, BOM, Unicode
+// Tag block) — the encoding-smuggling attack class from the ADR-103
+// council re-evaluation (2026-07-11). Presence is itself a violation:
+// a knowledge card has no legitimate need for invisible characters, and
+// halt-and-surface (never silent-rewrite) is this gate's contract.
+const _HIDDEN_UNICODE_RE =
+    /[­​-‏‪-‮⁠-⁤⁦-⁩\u{E0000}-\u{E007F}]/gu;
+
 /**
  * Combined privacy-floor + source-confidentiality scan over `text`.
  *
  * Returns the list of violations (empty = clean). Reused by the Phase-4
  * linter as the CI net that redaction actually fired on committed cards.
+ *
+ * Hidden-unicode hardening (additive, 2026-07-12): invisible characters are
+ * flagged as their own violation class AND the pattern scan runs on the
+ * stripped text, so a zero-width-broken key/email is still caught by its
+ * own category. Inputs without invisible characters behave byte-identically
+ * to the pre-hardening scan.
  */
 export function redaction_scan(
     text: string,
@@ -136,16 +154,36 @@ export function redaction_scan(
         sql_identifiers?: readonly string[];
     } = {},
 ): RedactionViolation[] {
-    const floor = redact_low_impact_entry(text, {
+    const violations: RedactionViolation[] = [];
+    _HIDDEN_UNICODE_RE.lastIndex = 0;
+    const hidden = text.match(_HIDDEN_UNICODE_RE);
+    let scanText = text;
+    if (hidden !== null && hidden.length > 0) {
+        const counts = new Map<string, number>();
+        for (const ch of hidden) {
+            const cp = `U+${(ch.codePointAt(0) as number).toString(16).toUpperCase().padStart(4, '0')}`;
+            counts.set(cp, (counts.get(cp) ?? 0) + 1);
+        }
+        const summary = [...counts.entries()]
+            .map(([cp, n]) => (n > 1 ? `${cp}×${n}` : cp))
+            .join(' ');
+        violations.push({
+            category: 'hidden_unicode',
+            snippet: _pySliceHead(summary, 40),
+            note: 'invisible characters — possible identifier smuggling; pattern scan ran on the stripped text',
+        });
+        scanText = text.replace(_HIDDEN_UNICODE_RE, '');
+    }
+    const floor = redact_low_impact_entry(scanText, {
         repoRoot: options.repo_root ?? null,
         privateDomains: options.private_domains ?? [],
         customerNames: options.customer_names ?? [],
         sqlIdentifiers: options.sql_identifiers ?? [],
     });
-    const violations: RedactionViolation[] = [...floor.violations];
+    violations.push(...floor.violations);
     for (const rx of _load_denylist_patterns()) {
         rx.lastIndex = 0;
-        const m = rx.exec(text);
+        const m = rx.exec(scanText);
         if (m) {
             violations.push({
                 category: 'external_source',

package/src/scripts/_lib/lexical_index.ts

@@ -90,11 +90,20 @@ export class LexicalIndex {
         return Math.max(0, Math.log(1 + (this.n - df + 0.5) / (df + 0.5)));
     }
 
-    /** BM25 score of one document against the tokenised query terms. */
+    /**
+     * BM25 score of one document against the tokenised query terms, weighted by
+     * **term coverage**: the raw BM25 sum is multiplied by `coverage²`, where
+     * `coverage = distinct-query-terms-matched / distinct-query-terms`. This
+     * stops a single generic, high-TF term match from outranking a document that
+     * matches several rarer query terms once each (Phase 1 refinement). A
+     * single-term query has `coverage == 1`, so its score is unchanged — the
+     * weighting only re-orders genuinely multi-term queries.
+     */
     score(queryTerms: readonly string[], docId: string): number {
         const doc = this.docs.get(docId);
         if (doc === undefined || doc.len === 0) return 0;
         let s = 0;
+        const matched = new Set<string>();
         for (const term of queryTerms) {
             const tf = doc.tf.get(term);
             if (tf === undefined) continue;
@@ -102,8 +111,12 @@ export class LexicalIndex {
             if (idf === 0) continue;
             const denom = tf + BM25_K1 * (1 - BM25_B + (BM25_B * doc.len) / (this.avgdl || 1));
             s += (idf * (tf * (BM25_K1 + 1))) / denom;
+            matched.add(term);
         }
-        return s;
+        if (s === 0) return 0;
+        const distinctQuery = new Set(queryTerms).size;
+        const coverage = distinctQuery > 0 ? matched.size / distinctQuery : 1;
+        return s * coverage * coverage;
     }
 
     /**

package/src/scripts/_lib/orchestration_record.ts

@@ -24,6 +24,17 @@ export type TierSource = 'static' | 'inferred' | 'inherit';
 export type Band = 'low' | 'medium' | 'high';
 export type LinePhase = 'refine' | 'memory' | 'analyze' | 'plan' | 'implement' | 'test' | 'verify' | 'report';
 export type LineOutcome = 'success' | 'blocked' | 'skipped' | 'error';
+/** The orchestration form the form-gate selected (road-to-opt-subagent-harvest P2). */
+export type DispatchModeId =
+    | 'do-and-judge'
+    | 'do-and-judge-two-stage'
+    | 'do-in-steps'
+    | 'do-in-parallel'
+    | 'do-competitively'
+    | 'judge-with-debate'
+    | 'do-in-worktrees'
+    | 'do-with-live-app-judge'
+    | 'none';
 
 /** Inputs the agent supplies about one auto-dispatch. */
 export interface RecordInput {
@@ -37,6 +48,8 @@ export interface RecordInput {
     tier_chosen?: TierChosen | null | undefined;
     tier_source?: TierSource | null | undefined;
     task_class?: string | null | undefined;
+    /** Form-gate outcome: which of the seven modes (or 'none') the gate selected. */
+    dispatch_mode?: DispatchModeId | null | undefined;
     task_size_estimate?: number | undefined;
     wall_clock_ms?: number | undefined;
     /** Absolute measured tokens the dispatched slice consumed (feeds the modeled cost-%). */
@@ -153,6 +166,7 @@ export function buildOrchestrationLine(input: RecordInput): BuiltLine {
         outcome: dOutcome,
         verify_mode: vMode,
         task_class: input.task_class ?? null,
+        dispatch_mode: input.dispatch_mode ?? null,
         tier_chosen: input.tier_chosen ?? null,
         tier_source: input.tier_source ?? null,
         dispatch_tokens: input.dispatch_tokens ?? null,

package/src/scripts/_lib/trigger_eval_floors.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared trigger-eval precision/recall floors — single source of truth.
+ *
+ * Extracted from `src/cli/commands/recordTriggerEval.ts` so the weekly
+ * canary rotation (`src/scripts/trigger_eval_rotation.ts`, ADR-118 §4) and
+ * the `eval:record` provenance recorder enforce the SAME per-domain floors.
+ * Values are unchanged from the recorder's originals (Phase D council
+ * verdict — tuned to the trigger pattern each skill shows, not a single
+ * global pair): a reference task wants near-perfect precision; a judgment
+ * task tolerates a looser one.
+ */
+
+export interface TriggerEvalFloor {
+    minRecall: number;
+    minPrecision: number;
+}
+
+/** Universal fallback floor when a skill carries no domain-specific entry. */
+export const DEFAULT_FLOOR: TriggerEvalFloor = { minRecall: 1.0, minPrecision: 0.8 };
+
+/** Domain-specific floors; skills absent here fall back to {@link DEFAULT_FLOOR}. */
+export const DOMAIN_FLOORS: Readonly<Record<string, TriggerEvalFloor>> = {
+    'image-generation': { minRecall: 1.0, minPrecision: 0.85 },
+    iconography: { minRecall: 1.0, minPrecision: 0.9 },
+    'brand-strategy': { minRecall: 0.9, minPrecision: 0.7 },
+};
+
+/** Resolve the effective floor for a skill (domain entry, else default). */
+export function floor_for(skill: string | null | undefined): TriggerEvalFloor {
+    return (skill !== null && skill !== undefined && DOMAIN_FLOORS[skill]) || DEFAULT_FLOOR;
+}

package/src/scripts/ai_council/chairman.ts

@@ -0,0 +1,90 @@
+// Chairman selection (road-to-opt-council-deliberation Phase 2).
+//
+// The council's Iron Law argues the host, having framed the artefact, cannot
+// independently judge it — so synthesis by a *non-deliberating* member removes
+// that bias. This module is the pure SELECTION decision (who chairs, and the
+// visible verdict annotation); the billable dispatch of the chairman's synthesis
+// call lives in the CLI run path, gated behind the same config.
+//
+// `auto` policy — decided by the contested-design council pass (anthropic/
+// claude-sonnet-4-5 + openai/gpt-4o, 2-round debate, 2026-07-12):
+// **provider-family difference is primary** — independence from the
+// deliberators' priors is the binding constraint for a judge, and provider
+// diversity is the one structural guarantee available without an LLM call.
+// The **tie-break is the capability signal**: an explicit optional
+// `members.<name>.tier` when present (higher = stronger), else deterministic
+// config order. In this engine each member IS one provider (the
+// one-advisor-per-provider invariant), so every enabled member that did not
+// deliberate is provider-different from every deliberator by construction.
+
+export interface ChairmanCandidate {
+    /** Member name (== provider key in this engine). */
+    name: string;
+    /** Optional capability rank from `members.<name>.tier`; higher = stronger. */
+    tier: number | null;
+}
+
+export interface ChairmanSelection {
+    /** The chosen chairman member name, or `null` → host synthesis (today's path). */
+    member: string | null;
+    /** Visible annotation for the synthesis verdict — never a silent substitution. */
+    annotation: string;
+}
+
+/**
+ * Pure chairman selection.
+ *
+ * @param mode        one of `host` | `member` | `auto` (validated at config load)
+ * @param member      the configured member name when `mode === 'member'`
+ * @param deliberated member names that produced a real (non-error, non-empty) response this session
+ * @param candidates  enabled members in **config order** (the engine's only trusted ordering)
+ */
+export function select_chairman(
+    mode: string,
+    member: string | null,
+    deliberated: ReadonlySet<string>,
+    candidates: readonly ChairmanCandidate[],
+): ChairmanSelection {
+    if (mode === 'host') {
+        return { member: null, annotation: 'Chairman: host' };
+    }
+    const enabledNames = new Set(candidates.map((c) => c.name));
+    if (mode === 'member') {
+        if (member === null || !enabledNames.has(member)) {
+            return {
+                member: null,
+                annotation: `Chairman: host (member ${_q(member)} unavailable — host fallback)`,
+            };
+        }
+        if (deliberated.has(member)) {
+            // A member that argued in the debate cannot independently judge it.
+            return {
+                member: null,
+                annotation: `Chairman: host (member ${_q(member)} deliberated — cannot self-judge, host fallback)`,
+            };
+        }
+        return { member, annotation: `Chairman: ${member}` };
+    }
+    // mode === 'auto' — provider-family difference primary (non-deliberating ⇒
+    // provider-different by construction here); tier tie-break; config-order final.
+    const pool = candidates.filter((c) => !deliberated.has(c.name));
+    if (pool.length === 0) {
+        return {
+            member: null,
+            annotation: 'Chairman: host (no non-panel member available)',
+        };
+    }
+    let best = pool[0] as ChairmanCandidate;
+    for (const c of pool.slice(1)) {
+        const bestTier = best.tier ?? Number.NEGATIVE_INFINITY;
+        const cTier = c.tier ?? Number.NEGATIVE_INFINITY;
+        if (cTier > bestTier) {
+            best = c; // strictly higher tier wins; equal/lower keeps config order
+        }
+    }
+    return { member: best.name, annotation: `Chairman: ${best.name} (auto)` };
+}
+
+function _q(v: string | null): string {
+    return v === null ? 'null' : `'${v}'`;
+}

package/src/scripts/ai_council/clients.ts

@@ -71,6 +71,21 @@ export const DEFAULT_GEMINI_MODEL = 'gemini-2.5-pro';
 export const DEFAULT_XAI_MODEL = 'grok-4';
 export const DEFAULT_PERPLEXITY_MODEL = 'sonar-pro';
 
+// Vendor CLI (subscription transport) default models. Omitting `model` in a
+// CLI client's options pins THESE values — a pin, not "latest"; the vendor
+// CLI's own default may be newer. Bump deliberately; never assume drift.
+//
+// These are SEPARATE from the API-transport `DEFAULT_*_MODEL` constants above
+// because API and CLI defaults can legitimately diverge — openai proves it
+// (API `gpt-4o` vs CLI `gpt-5`). The anthropic/gemini CLI values currently
+// coincide with their API defaults, but stay pinned independently so a future
+// divergence is a one-line change, not a hunt through inline literals.
+// (`xai` / `perplexity` CLI reuse their API constants: their CLIs are
+// community wrappers around the same paid API, so the values do not diverge.)
+export const DEFAULT_OPENAI_CLI_MODEL = 'gpt-5';
+export const DEFAULT_ANTHROPIC_CLI_MODEL = 'claude-sonnet-4-5';
+export const DEFAULT_GEMINI_CLI_MODEL = 'gemini-2.5-pro';
+
 // OpenAI-API-compatible endpoints. xAI and Perplexity both expose the
 // `/v1/chat/completions` shape, so their clients reuse the `openai` SDK with a
 // custom `base_url`. Gemini has its own SDK (`google-genai`).
@@ -1171,7 +1186,7 @@ export class AnthropicCliClient extends CliClient {
 
     constructor(opts: CliClientOptions = {}) {
         super({
-            model: opts.model ?? 'claude-sonnet-4-5',
+            model: opts.model ?? DEFAULT_ANTHROPIC_CLI_MODEL,
             binary: opts.binary,
             timeout_seconds: opts.timeout_seconds,
             max_calls_per_day: opts.max_calls_per_day,
@@ -1271,7 +1286,7 @@ export class OpenAICliClient extends CliClient {
 
     constructor(opts: CliClientOptions = {}) {
         super({
-            model: opts.model ?? 'gpt-5',
+            model: opts.model ?? DEFAULT_OPENAI_CLI_MODEL,
             binary: opts.binary,
             timeout_seconds: opts.timeout_seconds,
             max_calls_per_day: opts.max_calls_per_day,
@@ -1394,7 +1409,7 @@ export class GeminiCliClient extends CliClient {
 
     constructor(opts: CliClientOptions = {}) {
         super({
-            model: opts.model ?? 'gemini-2.5-pro',
+            model: opts.model ?? DEFAULT_GEMINI_CLI_MODEL,
             binary: opts.binary,
             timeout_seconds: opts.timeout_seconds,
             max_calls_per_day: opts.max_calls_per_day,