@event4u/agent-config 9.28.0 → 9.29.0

package/src/scripts/ai_council/orchestrator.ts

@@ -69,6 +69,9 @@ import {
 import { count_dissenters, dissent_quota_met, is_near_duplicate } from './debate_gates.js';
 import { parse_stance_line, render_vote_tally, tally_stances } from './stance_tally.js';
 import { CHAIRMAN_FIELDS_ADDENDUM, render_deanonymization_block } from './blind_review.js';
+import type { AbsentReason } from './transport_resolver.js';
+import type { QuorumResult } from './quorum.js';
+import { isEmptyHandoff, type HandoffEnvelope } from './handoff.js';
 
 // ── Python-format / stdlib parity helpers ────────────────────────────────
 //
@@ -1811,6 +1814,38 @@ export interface RenderOptions {
      * directly in `chairman.text`. Default `null` → byte-identical.
      */
     blind?: { label_to_source: ReadonlyMap<string, string> } | null;
+    /**
+     * Phase 3.2 (road-to-always-on-orchestration): members that produced no
+     * usable response this pass, rendered as a trailing section so the
+     * human-readable report shows the same graded-degradation picture the
+     * session manifest carries structurally. Default `null`/empty →
+     * byte-identical — no existing caller passes this, so no existing
+     * output changes.
+     */
+    absent_members?: readonly RenderAbsentMember[] | null;
+    /**
+     * Phase 3.3: this pass's quorum verdict, rendered as one line right
+     * before the absent-members section (or standalone when there is
+     * nothing absent to report). Default `null` → byte-identical.
+     */
+    quorum?: QuorumResult | null;
+    /**
+     * Phase 4.1: the verdict → handoff envelope, rendered as a `### Handoff`
+     * section right after the Convergence/Divergence slot — closest to the
+     * synthesis it was extracted from, ahead of the trailing quorum/absent
+     * bookkeeping. Rendered only when at least one field is non-`null`
+     * (`isEmptyHandoff` — an all-null envelope has nothing worth a section
+     * for, same "only show when there's substance" call `absent_members`
+     * makes). Default `null` → byte-identical.
+     */
+    handoff?: HandoffEnvelope | null;
+}
+
+/** The minimal shape `render()` needs for one absent-member row. */
+export interface RenderAbsentMember {
+    readonly member: string;
+    readonly reason: AbsentReason | null;
+    readonly detail: string;
 }
 
 /**
@@ -1918,14 +1953,84 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
         blocks.push(render_vote_tally(tally));
     }
     blocks.push(`## Convergence / Divergence\n\n${body}`);
+    // Phase 4.1: closest to the synthesis it was extracted from — ahead of
+    // the de-anonymization map and the trailing quorum/absent bookkeeping.
+    // An all-null envelope renders nothing (`isEmptyHandoff`), so a caller
+    // that always attaches one (the common shape once a producer wires
+    // this in) does not spam every response with "nothing to hand off".
+    if (opts.handoff && !isEmptyHandoff(opts.handoff)) {
+        blocks.push(_render_handoff(opts.handoff));
+    }
     if (blind !== null) {
         // Ü1: de-anonymization AFTER the synthesis slot — blind is only at
         // decision time, never the archive.
         blocks.push(render_deanonymization_block('### De-anonymization map', blind.label_to_source));
     }
+    // Phase 3.2/3.3: trailing, opt-in sections — absent no caller passes
+    // either option, so the join below adds nothing and every existing
+    // render() output stays byte-identical.
+    if (opts.quorum) {
+        blocks.push(_render_quorum_line(opts.quorum));
+    }
+    const absent = opts.absent_members ?? [];
+    if (absent.length > 0) {
+        blocks.push(_render_absent_members(absent));
+    }
     return blocks.join('\n\n---\n\n');
 }
 
+/** One line naming the k-of-n outcome — machine-parseable, human-readable. */
+function _render_quorum_line(q: QuorumResult): string {
+    const verdict = q.status === 'concluded' ? 'concluded' : 'INCONCLUSIVE — release gate holds';
+    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.`;
+}
+
+/**
+ * `### Absent Members` — one row per member that never produced a usable
+ * response this pass, naming the machine-readable reason when classified.
+ */
+function _render_absent_members(absent: readonly RenderAbsentMember[]): string {
+    const lines = ['### Absent Members', ''];
+    for (const a of absent) {
+        const tag = a.reason !== null ? ` (${a.reason})` : '';
+        lines.push(`- **${a.member}**${tag} — ${a.detail}`);
+    }
+    return lines.join('\n');
+}
+
+/**
+ * `### Handoff` — the verdict → work-order envelope (Phase 4.1). Only
+ * called once the caller already confirmed `!isEmptyHandoff(h)`, so at
+ * least one field is populated; the other two still render their own
+ * honest "none recorded" line rather than being silently dropped, so a
+ * reader sees exactly what this pass did and did not extract.
+ */
+function _render_handoff(h: HandoffEnvelope): string {
+    const lines = ['### Handoff', ''];
+    lines.push(`**Decision:** ${h.decision ?? 'none recorded — no structured verdict this pass.'}`);
+    lines.push('');
+    if (h.rejected_alternatives !== null && h.rejected_alternatives.length > 0) {
+        lines.push('**Rejected alternatives:**');
+        lines.push('');
+        for (const alt of h.rejected_alternatives) {
+            lines.push(`- **${alt.option}** — ${alt.reason}`);
+        }
+    } else {
+        lines.push('**Rejected alternatives:** none recorded.');
+    }
+    lines.push('');
+    if (h.constraints !== null && h.constraints.length > 0) {
+        lines.push('**Constraints:**');
+        lines.push('');
+        for (const c of h.constraints) {
+            lines.push(`- ${c}`);
+        }
+    } else {
+        lines.push('**Constraints:** none recorded.');
+    }
+    return lines.join('\n');
+}
+
 /**
  * Render the peer-review block under deterministic Reviewer labels.
  *

package/src/scripts/ai_council/quorum.ts

@@ -0,0 +1,84 @@
+/**
+ * Quorum resolution for a council pass (Phase 3.3 of
+ * road-to-always-on-orchestration).
+ *
+ * A pass concludes when at least `k` of `n` enabled members produced a
+ * usable response ("present"); below `k` the pass is `inconclusive`. At a
+ * release gate an inconclusive pass HOLDS the gate for a human — it is
+ * NEVER silently downgraded to advisory (council-verified, 2026-08-09).
+ * Deciding what to DO with an `inconclusive` status (block a merge, retry,
+ * surface to the user) is the caller's job; this module only answers
+ * whether the threshold was met.
+ *
+ * `majority` is a SIMPLE majority — `ceil(n / 2)` — deliberately NOT the
+ * traditional "more than half" (`floor(n / 2) + 1`). At n=2 those two
+ * definitions diverge: `ceil(2/2)=1` vs `floor(2/2)+1=2`. The stricter
+ * 2-of-2 reading turns any single absent member into a deadlocked release
+ * gate, which is exactly the failure mode council members flagged for the
+ * n=2 case this module is built around — 1-of-2 is the deliberate choice,
+ * not an off-by-one.
+ *
+ * This module is pure — no filesystem, no environment, no config parsing.
+ * `config.ts::QuorumSetting` is the validated shape a loaded
+ * `.ai-council.yml` supplies; a caller reads `cfg.quorum` and passes it
+ * straight through to `evaluateQuorum`.
+ */
+
+import type { QuorumSetting } from './config.js';
+
+export type QuorumStatus = 'concluded' | 'inconclusive';
+
+export interface QuorumResult {
+    /** `concluded` when `present >= threshold`; `inconclusive` otherwise. */
+    readonly status: QuorumStatus;
+    /** The concrete k this pass needed, after resolving `setting` against `total`. */
+    readonly threshold: number;
+    /** Total enabled members configured for this pass — the `n`. */
+    readonly total: number;
+    /** Members that actually produced a usable response. */
+    readonly present: number;
+}
+
+/**
+ * Resolve `setting` into a concrete integer threshold for `total` members.
+ *
+ * `'majority'` → `ceil(total / 2)` (0 when `total` is 0 — there is nothing
+ * to require attendance from). A fixed numeric `setting` is clamped to
+ * `[1, total]` so neither a misconfigured cap above `total` (structurally
+ * unwinnable) nor one below 1 (would resolve trivially) can escape the
+ * config validation `config.ts::_build_quorum` already runs at load time —
+ * this is a second, cheap floor for any caller that builds a `QuorumSetting`
+ * by hand instead of through the loader.
+ */
+export function resolveQuorumThreshold(total: number, setting: QuorumSetting = 'majority'): number {
+    if (!Number.isInteger(total) || total < 0) {
+        throw new RangeError(
+            `resolveQuorumThreshold: total must be a non-negative integer (got ${total}).`,
+        );
+    }
+    if (total === 0) {
+        return 0;
+    }
+    if (setting === 'majority') {
+        return Math.ceil(total / 2);
+    }
+    return Math.min(Math.max(setting, 1), total);
+}
+
+/**
+ * Evaluate whether a pass met quorum.
+ *
+ * `present` is clamped into `[0, total]` before comparison — a caller that
+ * miscounts (more "present" than were ever configured) cannot manufacture a
+ * `concluded` verdict past what `total` actually allows.
+ */
+export function evaluateQuorum(
+    total: number,
+    present: number,
+    setting: QuorumSetting = 'majority',
+): QuorumResult {
+    const threshold = resolveQuorumThreshold(total, setting);
+    const clampedPresent = Math.min(Math.max(present, 0), total);
+    const status: QuorumStatus = clampedPresent >= threshold ? 'concluded' : 'inconclusive';
+    return { status, threshold, total, present: clampedPresent };
+}

package/src/scripts/ai_council/session.ts

@@ -46,6 +46,24 @@ import { PyFloat, py_json_dumps_indent2 } from '../_lib/security_lint.js';
 import { pyRound } from '../_lib/value_ladder.js';
 import { CouncilResponse } from './clients.js';
 import { render } from './orchestrator.js';
+import type { AbsentReason } from './transport_resolver.js';
+import type { QuorumResult } from './quorum.js';
+
+/**
+ * A member that produced no usable response this pass
+ * (road-to-always-on-orchestration Phase 3.2) — never constructed (no CLI +
+ * no key), or constructed but lost mid-run (timeout, quota exhaustion). The
+ * caller assembling the manifest is the one that knows which; this record
+ * only carries what it decided.
+ */
+export interface AbsentMemberRecord {
+    /** Provider name (or "provider/model" — whatever the caller's roster used). */
+    readonly member: string;
+    /** Machine-readable bucket, or `null` when the failure did not classify. */
+    readonly reason: AbsentReason | null;
+    /** Human-readable detail — the CLI-hints / install-instructions text. */
+    readonly detail: string;
+}
 
 // src/scripts/ai_council/session.py → parents[3] == repo root.
 const _HERE = fileURLToPath(import.meta.url);
@@ -76,6 +94,19 @@ export class SessionManifest {
     rounds: number;
     cost_usd_estimated: number;
     cost_usd_actual: number;
+    /**
+     * Members that never produced a usable response this pass (Phase 3.2).
+     * Empty by default — a caller that never populates it (every caller
+     * before this field existed) writes the same manifest shape it always
+     * did, plus one empty array.
+     */
+    absent_members: AbsentMemberRecord[];
+    /**
+     * Quorum verdict for this pass (Phase 3.3), or `null` when the caller
+     * did not evaluate one (e.g. a single-member solo dispatch, where
+     * quorum has nothing to say).
+     */
+    quorum: QuorumResult | null;
     extra: Record<string, unknown>;
 
     constructor(opts: {
@@ -86,6 +117,8 @@ export class SessionManifest {
         rounds?: number;
         cost_usd_estimated?: number;
         cost_usd_actual?: number;
+        absent_members?: AbsentMemberRecord[];
+        quorum?: QuorumResult | null;
         extra?: Record<string, unknown>;
     }) {
         this.mode = opts.mode;
@@ -95,6 +128,8 @@ export class SessionManifest {
         this.rounds = opts.rounds ?? 1;
         this.cost_usd_estimated = opts.cost_usd_estimated ?? 0.0;
         this.cost_usd_actual = opts.cost_usd_actual ?? 0.0;
+        this.absent_members = opts.absent_members ?? [];
+        this.quorum = opts.quorum ?? null;
         // Python dataclass uses `field(default_factory=dict)` — each instance
         // gets its own fresh dict.
         this.extra = opts.extra ?? {};
@@ -504,6 +539,15 @@ export function save(opts: {
         responses_per_round: rounds_data.map((round_responses) =>
             round_responses.map((r) => _serialise_response(r)),
         ),
+        // Phase 3.2/3.3 — graded degradation + quorum, both machine-readable.
+        // Empty array / `null` when the caller never populated them, so an
+        // old caller's manifest keeps its existing keys plus these two.
+        absent_members: manifest.absent_members.map((a) => ({
+            member: a.member,
+            reason: a.reason,
+            detail: a.detail,
+        })),
+        quorum: manifest.quorum,
         ...manifest.extra,
     };
 

package/src/scripts/ai_council/transport_resolver.ts

@@ -48,10 +48,22 @@ import {
     type BillingClass,
     type EnvironmentReport,
 } from '../_lib/environment_detector.js';
+import { resolve_mode } from './modes.js';
 
 /** A concrete transport a member can actually run on. `auto` is not one. */
 export type Transport = 'api' | 'manual' | 'cli';
 
+/**
+ * Machine-readable reason a member is `absent` from a pass
+ * (road-to-always-on-orchestration Phase 3.2). The static half — `no_binary`
+ * / `no_auth` — is decided here, at resolution time, before any provider
+ * call is attempted. The runtime half — `timeout` / `quota` — only exists
+ * once a call was actually attempted and failed; see
+ * `absentReasonFromCliFailure` below for the mapping FROM the mid-flight
+ * `CliFailureClass` a caller already classifies its errors into.
+ */
+export type AbsentReason = 'no_binary' | 'no_auth' | 'timeout' | 'quota';
+
 /** The accepted values of the `mode` key, including the resolver-only `auto`. */
 export const VALID_TRANSPORT_MODES: ReadonlySet<string> = new Set([
     'api',
@@ -73,6 +85,16 @@ export interface ResolvedTransport {
     readonly makesProviderCall: boolean;
     /** One-line reason. Non-empty exactly when `available` is false. */
     readonly reason: string | null;
+    /**
+     * Machine-readable classification of `reason`, for a pass artifact that
+     * needs to bucket absent members without parsing prose (Phase 3.2).
+     * Non-null for the two STATIC auto-chain failures this function can
+     * classify (`no_binary` / `no_auth`); `null` when `available` is true,
+     * and also `null` for the "unknown mode" validation-error path below —
+     * that is a config bug, not a missing-capability finding, so it does not
+     * belong in this enum.
+     */
+    readonly absentReason: AbsentReason | null;
 }
 
 export interface ResolveTransportOptions {
@@ -149,6 +171,7 @@ export function resolveTransport(opts: ResolveTransportOptions): ResolvedTranspo
             authSource,
             makesProviderCall: false,
             reason: null,
+            absentReason: null,
         };
     }
 
@@ -160,6 +183,7 @@ export function resolveTransport(opts: ResolveTransportOptions): ResolvedTranspo
             authSource,
             makesProviderCall: true,
             reason: null,
+            absentReason: null,
         };
     }
 
@@ -185,6 +209,7 @@ export function resolveTransport(opts: ResolveTransportOptions): ResolvedTranspo
             authSource,
             makesProviderCall: true,
             reason: null,
+            absentReason: null,
         };
     }
 
@@ -197,16 +222,80 @@ export function resolveTransport(opts: ResolveTransportOptions): ResolvedTranspo
             authSource,
             makesProviderCall: true,
             reason: null,
+            absentReason: null,
         };
     }
 
-    return unavailable(provider, billing, autoUnavailableReason(provider, binary, cliAuthed));
+    return unavailable(
+        provider,
+        billing,
+        autoUnavailableReason(provider, binary, cliAuthed),
+        classifyStaticAbsentReason(binary),
+    );
+}
+
+export interface ResolveMemberTransportOptions {
+    readonly provider: string;
+    /** The single read-only environment report `resolveTransport` needs. */
+    readonly report: EnvironmentReport;
+    /** e.g. `/council mode:manual`. Highest precedence layer. */
+    readonly invocationMode?: string | null;
+    /** The member's own config sub-dict (`ai_council.members.<name>`). */
+    readonly memberSettings?: ReadonlyMap<string, unknown> | Record<string, unknown> | null;
+    /** `ai_council.mode` / `defaults.mode`, already extracted by the caller. */
+    readonly globalMode?: string | null;
+    readonly binaryOverride?: string | null;
+    readonly apiKeyPresent?: boolean;
+}
+
+export interface ResolvedMemberTransport extends ResolvedTransport {
+    /** The mode `resolve_mode` chose BEFORE any `auto` expansion. */
+    readonly configuredMode: string;
+}
+
+/**
+ * The single reconciled entry point for "given this member's config, what
+ * transport does it actually run on" (road-to-always-on-orchestration
+ * Phase 3.1). Composes `modes.ts::resolve_mode` (which layer decided the
+ * mode) with `resolveTransport` (what `auto` expands to on THIS machine) so
+ * a caller never has to replicate either step by hand.
+ *
+ * This exists because the two functions previously lived at arm's length:
+ * `resolve_mode` can legitimately return the literal string `'auto'`, and
+ * nothing forced a caller to then route that value through
+ * `resolveTransport` — a hand-rolled `mode === 'api' | 'cli' | 'manual'`
+ * switch (the shape `council_cli.ts::build_members` still uses today) has
+ * no `'auto'` case and treats it as an unrecognised transport instead of
+ * expanding it. `resolveMemberTransport` is the fix: there is no longer a
+ * gap between "which mode was configured" and "which transport that becomes"
+ * for any caller that uses it instead of the two functions separately.
+ */
+export function resolveMemberTransport(
+    opts: ResolveMemberTransportOptions,
+): ResolvedMemberTransport {
+    const configuredMode = resolve_mode(opts.provider, {
+        invocationMode: opts.invocationMode ?? null,
+        memberSettings: opts.memberSettings ?? null,
+        globalMode: opts.globalMode ?? null,
+    });
+    const resolved = resolveTransport({
+        provider: opts.provider,
+        mode: configuredMode,
+        report: opts.report,
+        binaryOverride: opts.binaryOverride ?? null,
+        // `exactOptionalPropertyTypes` rejects an explicit `undefined` for an
+        // optional-boolean field, so the key is omitted entirely rather than
+        // forwarded as `apiKeyPresent: undefined`.
+        ...(opts.apiKeyPresent !== undefined ? { apiKeyPresent: opts.apiKeyPresent } : {}),
+    });
+    return { ...resolved, configuredMode };
 }
 
 function unavailable(
     _provider: string,
     billing: BillingClass,
     reason: string,
+    absentReason: AbsentReason | null = null,
 ): ResolvedTransport {
     return {
         available: false,
@@ -217,9 +306,21 @@ function unavailable(
         authSource: null,
         makesProviderCall: false,
         reason,
+        absentReason,
     };
 }
 
+/**
+ * `no_binary` when the CLI binary itself never resolved (whether or not a
+ * credential was found — a credential with nothing to run it against is
+ * still "the binary is missing" from the caller's point of view); `no_auth`
+ * when the binary IS present but neither the cli-auth nor the key rung
+ * resolved. Mirrors `autoUnavailableReason`'s three-way branch below.
+ */
+function classifyStaticAbsentReason(binary: string | null): AbsentReason {
+    return binary === null ? 'no_binary' : 'no_auth';
+}
+
 /** The one-line reason `auto` prints when no rung resolved. */
 function autoUnavailableReason(
     provider: string,
@@ -298,6 +399,31 @@ export function isFallbackEligible(failure: CliFailureClass): boolean {
     return FALLBACK_ELIGIBLE.has(failure);
 }
 
+/**
+ * Maps a mid-flight `CliFailureClass` (a call was actually attempted and
+ * failed) onto the same `AbsentReason` enum a static resolution failure
+ * uses (road-to-always-on-orchestration Phase 3.2/3.4), so a pass artifact
+ * can bucket every absent member — whether it never got a transport at all
+ * or lost one partway through — under one vocabulary. Returns `null` for a
+ * failure class outside the four-value enum (`cli_unsupported`,
+ * `server_error`, `other`); a caller falls back to the raw failure detail
+ * for those rather than mis-classifying them.
+ */
+export function absentReasonFromCliFailure(failure: CliFailureClass): AbsentReason | null {
+    switch (failure) {
+        case 'binary_missing':
+            return 'no_binary';
+        case 'auth_rejected':
+            return 'no_auth';
+        case 'timeout':
+            return 'timeout';
+        case 'quota_exhausted':
+            return 'quota';
+        default:
+            return null;
+    }
+}
+
 /**
  * One-shot, per-provider fallback ledger for a single invocation.
  *

package/src/scripts/ai_team/availability.ts

@@ -0,0 +1,110 @@
+/**
+ * `/team` availability — CLI-first, not settings-gated
+ * (road-to-always-on-orchestration Phase 1, Step 1.3).
+ *
+ * `ai_team.enabled` — the former master switch — was DELETED. `/team`'s
+ * on/off state is now a FACT resolved from the machine, the same doctrine
+ * already applied to the subagent and council layers (Phase 1): the codex
+ * CLI binary must resolve on `$PATH`, AND some auth for the `openai`
+ * provider must be detectable (subscription login, API key, key file, or
+ * env key — the same transport-preference order `auto` walks via
+ * `strongestAuth`). Reuses the existing, read-only, zero-spend,
+ * per-process-cached detector (`_lib/environment_detector.ts`); this module
+ * adds NO new probing and NO new cache of its own.
+ *
+ * `ai_team.allow_delegate` is UNCHANGED by this module: a distinct,
+ * write-access authorization gate that stacks ON TOP of availability, never
+ * a replacement for it (`assert_delegate_allowed` in `team_dispatch.ts`
+ * still checks it separately, after availability).
+ */
+import { detectEnvironment, strongestAuth } from '../_lib/environment_detector.js';
+import { load_agent_settings, type SettingsDict } from '../_lib/agent_settings.js';
+import { _team_codex_binary_name, shutilWhich } from '../_cli/cmd_doctor.js';
+
+/** Tool id `environment_detector` uses for the codex CLI (`install/toolDetection.ts`). */
+const CODEX_HOST_ID = 'codex';
+
+/** Provider id `environment_detector` / `PROVIDER_CLI_META` uses for the codex CLI. */
+const CODEX_PROVIDER = 'openai';
+
+/** The provider default `_team_codex_binary_name` falls back to with no override configured. */
+const DEFAULT_CODEX_BINARY = 'codex';
+
+export interface TeamAvailability {
+    readonly available: boolean;
+    /** One clear line for the user — populated only when `available` is false. */
+    readonly reason: string | null;
+}
+
+/**
+ * codex CLI binary + auth presence — the availability half of the `/team`
+ * gate. Cached per process via `detectEnvironment()`'s own no-argument memo
+ * (`resetEnvironmentCache()` in tests); this function adds no caching of
+ * its own.
+ *
+ * m5 fix (independent-review finding) — `detectEnvironment()`'s host probe
+ * is hardcoded to the literal binary name `codex`; it has no way to be told
+ * "check this other name/path instead". So an operator who set
+ * `members.openai.binary:` in `.ai-council.yml` (honoured under an
+ * effective mode of `cli` OR `auto` — `cmd_doctor.ts::_mayRunOverCli`) was
+ * invisible to this check: `/team` could report "codex CLI not available"
+ * even with a working, custom-named/pathed binary configured and
+ * functional. `_team_codex_binary_name` (shared with `cmd_doctor.ts`'s own
+ * `council-cli` / `team` checks, so the override-resolution logic has one
+ * source) resolves the SAME name `cmd_doctor` would use; when it differs
+ * from the provider default, this probes that name directly instead of
+ * trusting the fixed-name host detector.
+ */
+export function checkCodexAvailability(project_root: string = process.cwd()): TeamAvailability {
+    const report = detectEnvironment();
+    const configuredBinary = _team_codex_binary_name(project_root);
+    const installed =
+        configuredBinary !== DEFAULT_CODEX_BINARY
+            ? shutilWhich(configuredBinary) !== null
+            : (report.hosts.find((h) => h.id === CODEX_HOST_ID)?.installed ?? false);
+    if (!installed) {
+        return {
+            available: false,
+            reason:
+                'codex CLI not available — /team needs the codex CLI installed and ' +
+                'authenticated. Install: `npm install -g @openai/codex`, then run ' +
+                '`codex login`. Verify with `agent-config doctor --check team`.',
+        };
+    }
+    if (strongestAuth(report, CODEX_PROVIDER) === null) {
+        return {
+            available: false,
+            reason:
+                'codex CLI not available — no auth detected for it. Run `codex login` ' +
+                '(or set `OPENAI_API_KEY`). Verify with `agent-config doctor --check team`.',
+        };
+    }
+    return { available: true, reason: null };
+}
+
+/**
+ * `emergency.orchestration_halt` — the one audited incident switch over the
+ * always-on orchestration stack (subagents, council, TEAM). Reads the
+ * project settings cascade fresh (or an injected dict for tests) on every
+ * call — no cache of its own, so an armed halt takes effect on the very
+ * next read, same as every other `orchestration_halt` reader in the tree
+ * (`routing_doctor.ts`, `delegation_nudge_hook.ts`).
+ */
+export function isOrchestrationHalted(
+    settings?: SettingsDict | null,
+    cwd?: string | null,
+): boolean {
+    const merged = settings ?? load_agent_settings({ cwd: cwd ?? process.cwd() });
+    const emergency = (merged as Record<string, unknown>)['emergency'];
+    if (typeof emergency !== 'object' || emergency === null || Array.isArray(emergency)) {
+        return false;
+    }
+    return (emergency as Record<string, unknown>)['orchestration_halt'] === true;
+}
+
+/** The one-line halt notice — `/team` prints this verbatim when halted. */
+export const ORCHESTRATION_HALT_MESSAGE =
+    '/team is halted (`emergency.orchestration_halt: true`) — the always-on ' +
+    'orchestration stack (subagents, council, team) is paused for incident ' +
+    'response. Resume: set `orchestration_halt: false` with a non-empty ' +
+    '`orchestration_halt_justification` in `.agent-settings.yml`.';