@event4u/agent-config 9.28.0 → 9.30.0

package/src/scripts/ai_council/config.ts

@@ -21,9 +21,12 @@
  *    a locally-installed CLI under subscription auth (free for
  *    first-party CLIs, billable for community wrappers); `auto` = pick
  *    per provider per invocation (cli → api → unavailable), resolved by
- *    `transport_resolver.ts`. `auto` is opt-in — it is never the shipped
- *    default, because flipping it would move an existing user's spend
- *    from per-token dollars onto subscription quota with no config edit.
+ *    `transport_resolver.ts`. `auto` is the SHIPPED DEFAULT
+ *    (road-to-always-on-orchestration Phase 3.1 — CLI-first is the
+ *    owner-set transport doctrine: ride the vendor CLI under subscription
+ *    auth first, fall to the metered API only where no CLI resolves).
+ *    `manual` and a pinned `api`/`cli` remain valid explicit per-member or
+ *    per-invocation overrides — `auto` never displaces one.
  * 3. `members.<name>` keys are restricted to the known provider set.
  * 4. `cost_budget.*` numeric fields are >= 0.
  * 5. Enabled members carry a non-empty `model` and `api_key_ref` when
@@ -37,7 +40,18 @@
  * 8. `binary:` is only valid when the member's effective mode is `cli` or
  *    `auto` (auto may resolve to the cli rung);
  *    `cli_call_budget.max_calls_per_day.<provider>` keys must be valid
- *    providers.
+ *    providers. `max_calls_per_day` SHIPS POPULATED with a generous
+ *    per-provider default (50/day, road-to-always-on-orchestration
+ *    Phase 3.4) for every known provider — a guard against a silent
+ *    always-on pass exhausting a subscription's plan quota, not a brake;
+ *    an explicit per-provider entry overrides just that provider's default.
+ * 9. `quorum` ∈ {`"majority"`, a positive integer} (default `"majority"`,
+ *    road-to-always-on-orchestration Phase 3.3). `"majority"` at n members
+ *    resolves to `ceil(n / 2)` — a SIMPLE majority, deliberately NOT
+ *    "more than half": at n=2 that is 1-of-2, because 2-of-2 turns any
+ *    single absent member into a deadlocked release gate (council-verified
+ *    2026-08-09). See `quorum.ts` for the resolver a caller applies to its
+ *    own present/total member counts.
  *
  * Parity notes (intentional, documented):
  *   - YAML is parsed with `yaml` (npm) at `version: '1.1'`, matching
@@ -562,6 +576,15 @@ export interface CliCallBudgetConfig {
     readonly warn_at: number;
 }
 
+/**
+ * `"majority"` (default) or a positive integer k — the number of members a
+ * pass needs to conclude (road-to-always-on-orchestration Phase 3.3). See
+ * `quorum.ts::resolveQuorumThreshold` for how a caller turns this into a
+ * concrete threshold against its own total-member count, and the module
+ * docstring rule 9 for why `"majority"` is `ceil(n / 2)`, not `> n / 2`.
+ */
+export type QuorumSetting = 'majority' | number;
+
 export interface CouncilConfig {
     readonly enabled: boolean;
     readonly defaults: DefaultsConfig;
@@ -570,6 +593,7 @@ export interface CouncilConfig {
     readonly advisors: ReadonlyMap<string, AdvisorConfig>;
     readonly consensus_scoring: ConsensusScoringConfig;
     readonly cli_call_budget: CliCallBudgetConfig;
+    readonly quorum: QuorumSetting;
     readonly necessity_classifier: NecessityClassifierConfig;
     readonly model_downgrade: ModelDowngradeConfig;
     readonly debate: DebateConfig;
@@ -578,6 +602,7 @@ export interface CouncilConfig {
     readonly chairman: ChairmanConfig;
     readonly debate_gates: DebateGatesConfig;
     readonly restate: RestateConfig;
+    readonly critic_protocol: CriticProtocol;
     readonly decision_resolution: DecisionResolutionConfig;
     readonly routing: RoutingConfig;
     readonly low_impact: LowImpactConfig;
@@ -796,6 +821,7 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
     const cli_call_budget = _build_cli_call_budget(
         _asDict(_getOr(raw, 'cli_call_budget', {})),
     );
+    const quorum = _build_quorum(_get(raw, 'quorum', 'majority'));
     const necessity_classifier = _build_necessity_classifier(
         _asDict(_getOr(raw, 'necessity_classifier', {})),
     );
@@ -821,6 +847,7 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
         'debate_gates',
     );
     const restate = _build_restate(_asDict(_getOr(raw, 'restate', {})), 'restate');
+    const critic_protocol = _build_critic_protocol(_getOr(raw, 'critic_protocol', 'legacy'));
     const decision_resolution = _build_decision_resolution(
         _asDict(_getOr(raw, 'decision_resolution', {})),
     );
@@ -843,6 +870,7 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
         advisors,
         consensus_scoring: consensus,
         cli_call_budget,
+        quorum,
         necessity_classifier,
         model_downgrade,
         debate,
@@ -851,6 +879,7 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
         chairman,
         debate_gates,
         restate,
+        critic_protocol,
         decision_resolution,
         routing,
         low_impact,
@@ -1115,6 +1144,27 @@ function _build_restate(d: Dict, scope: string): RestateConfig {
     return { enabled: Boolean(enabled) };
 }
 
+/**
+ * `critic_protocol` (road-to-judgment-and-forensic-evidence Phase 2) — which
+ * critic posture adversarial/skeptic review passes use. `legacy` is the
+ * shipped free-hunt skeptic; `load_bearing` is the fixed protocol that must
+ * name the single load-bearing assumption and may return "holds". Default
+ * `legacy` regardless of the A/B outcome (promotion is a separate decision).
+ */
+export type CriticProtocol = 'legacy' | 'load_bearing';
+
+const _VALID_CRITIC_PROTOCOLS: ReadonlySet<string> = new Set(['legacy', 'load_bearing']);
+
+function _build_critic_protocol(v: unknown): CriticProtocol {
+    if (v === undefined || v === null) return 'legacy';
+    if (!(_isStr(v) && _VALID_CRITIC_PROTOCOLS.has(v))) {
+        throw new CouncilConfigError(
+            `\`critic_protocol\`=${_pyRepr(v)} not in ${_sortedListRepr(_VALID_CRITIC_PROTOCOLS)}.`,
+        );
+    }
+    return v as CriticProtocol;
+}
+
 const _VALID_RESOLUTION_MODES: ReadonlySet<string> = new Set([
     'agent',
     'council',
@@ -1427,7 +1477,11 @@ function _build_defaults(d: Dict): DefaultsConfig {
     if (!_isDict(d)) {
         throw new CouncilConfigError('`defaults` must be a mapping.');
     }
-    const mode = _get(d, 'mode', 'api');
+    // road-to-always-on-orchestration Phase 3.1: CLI-first is the shipped
+    // default (was `api`) — see the module docstring rule 2. `manual` and a
+    // pinned `api`/`cli` remain valid overrides at every layer resolve_mode
+    // checks; this only changes what a config that never sets `mode` gets.
+    const mode = _get(d, 'mode', 'auto');
     if (!(_isStr(mode) && _VALID_MODES.has(mode))) {
         throw new CouncilConfigError(
             `defaults.mode=${_pyRepr(mode)} not in ${_sortedListRepr(_VALID_MODES)}.`,
@@ -1630,7 +1684,13 @@ function _build_cost_budget(d: Dict): CostBudgetConfig {
 function _build_member(
     name: string,
     cfg: Dict,
-    default_mode = 'api',
+    // road-to-always-on-orchestration Phase 3.1: kept in sync with
+    // `_build_defaults`'s `auto` default for consistency. The sole call site
+    // (`_build_config`) always passes `defaults.mode` explicitly, so this
+    // parameter default is unreachable on the live path today; it exists so
+    // a future caller that omits the third argument observes the same
+    // doctrine rather than silently reverting to the retired `api` default.
+    default_mode = 'auto',
 ): MemberConfig {
     if (!_VALID_PROVIDERS.has(name)) {
         throw new CouncilConfigError(
@@ -1775,6 +1835,18 @@ function _build_member(
     };
 }
 
+/**
+ * Generous per-provider guard for `mode: cli` / `mode: auto` members
+ * (road-to-always-on-orchestration Phase 3.4). Before this default the map
+ * shipped empty and an unlisted provider ran uncapped — a plan-quota guard
+ * that only existed if the user remembered to opt in. Every known provider
+ * now carries this floor unless a config entry overrides it; sized as a
+ * GUARD against silent quota exhaustion on an always-on pass, not a brake on
+ * normal use (see the template's own worked-example sizing for the
+ * reasoning behind a TIGHTER per-provider number).
+ */
+const _DEFAULT_CLI_CALLS_PER_DAY = 50;
+
 function _build_cli_call_budget(d: Dict): CliCallBudgetConfig {
     if (!_isDict(d)) {
         throw new CouncilConfigError('`cli_call_budget` must be a mapping.');
@@ -1786,6 +1858,9 @@ function _build_cli_call_budget(d: Dict): CliCallBudgetConfig {
         );
     }
     const caps = new Map<string, number>();
+    for (const provider of _VALID_PROVIDERS) {
+        caps.set(provider, _DEFAULT_CLI_CALLS_PER_DAY);
+    }
     for (const [provider, value] of Object.entries(raw_caps)) {
         if (!_VALID_PROVIDERS.has(provider)) {
             throw new CouncilConfigError(
@@ -1817,6 +1892,19 @@ function _build_cli_call_budget(d: Dict): CliCallBudgetConfig {
     return { max_calls_per_day: caps, warn_at };
 }
 
+function _build_quorum(raw: Json): QuorumSetting {
+    if (raw === 'majority') {
+        return 'majority';
+    }
+    if (_isInt(raw) && !_isBool(raw) && (raw as number) >= 1) {
+        return raw as number;
+    }
+    throw new CouncilConfigError(
+        `\`quorum\`=${_pyRepr(raw)} must be 'majority' or an integer >= 1 ` +
+            `(got ${_pyTypeName(raw)}).`,
+    );
+}
+
 function _build_advisor(name: string, cfg: Dict): AdvisorConfig {
     if (!_isDict(cfg)) {
         throw new CouncilConfigError(`advisors.${name}: must be a mapping.`);

package/src/scripts/ai_council/handoff.ts

@@ -0,0 +1,113 @@
+/**
+ * Verdict → handoff envelope (Phase 4.1 of road-to-always-on-orchestration).
+ *
+ * A council pass produces a verdict a human currently has to read and
+ * re-type into whatever executes next. This module is the machine-readable
+ * bridge: an additive `HandoffEnvelope` — decision, rejected alternatives
+ * with reasons, binding constraints — injectable as the dispatched work
+ * order of an implementing subagent, so deliberation output becomes
+ * execution input without a human transcription step.
+ *
+ * ## The honesty constraint
+ *
+ * A council pass has exactly ONE place in this codebase where "the
+ * decision" is a discrete, machine-parsed value rather than free-text prose
+ * a human (or an NLP guess) would have to interpret: the option-level
+ * stance tally (`stance_tally.ts`, opt-in via `ai_council.stance_tally`).
+ * Every other synthesis path — the default template, a chairman's prose
+ * verdict, consensus scoring's qualitative Strong/Findings/Minority
+ * buckets — has no comparable discrete "decision" field to extract from
+ * without parsing prose, which is exactly the kind of confident-looking
+ * fabrication this module refuses to do.
+ *
+ * So: `buildHandoffFromStanceTally` is the ONLY builder this module ships.
+ * No tally (the common case — the flag defaults off) or a tally that split
+ * (no option cleared the consensus threshold) → every field is `null`,
+ * never a guessed decision. A future builder over a different structured
+ * source (a chairman synthesis that itself emits structured fields, a
+ * consensus-scoring extension) is additive — it does not change this one.
+ *
+ * @see docs/contracts/ai-council-config.md § Handoff envelope
+ */
+
+import type { StanceTallyResult } from './stance_tally.js';
+
+/** One option the tally counted but did not conclude on. */
+export interface RejectedAlternative {
+    readonly option: string;
+    /**
+     * A factual, derived-from-the-tally sentence — never invented prose.
+     * States the option's own backer count and weight against the
+     * threshold the winner had to clear, nothing else.
+     */
+    readonly reason: string;
+}
+
+/**
+ * The machine-readable work order a council verdict hands to whatever
+ * executes next. Every field is independently nullable: `null` means "no
+ * structured source existed to populate this field this pass", never a
+ * fabricated placeholder. A consumer checks for `null`, not for an empty
+ * array — an empty array would claim "checked, found none", which this
+ * module never asserts when it never actually checked.
+ */
+export interface HandoffEnvelope {
+    readonly decision: string | null;
+    readonly rejected_alternatives: readonly RejectedAlternative[] | null;
+    /**
+     * Binding constraints the decision carries. No structured source for
+     * this exists anywhere in the current synthesis pipeline (a
+     * dealbreaker count describes objection PRESSURE on an option, not a
+     * named constraint on the winner) — always `null` until one does.
+     */
+    readonly constraints: readonly string[] | null;
+}
+
+/** An envelope with every field `null` — the honest "nothing to hand off" shape. */
+export const EMPTY_HANDOFF: HandoffEnvelope = {
+    decision: null,
+    rejected_alternatives: null,
+    constraints: null,
+};
+
+/** True when every field is `null` — nothing worth rendering or dispatching. */
+export function isEmptyHandoff(h: HandoffEnvelope): boolean {
+    return h.decision === null && h.rejected_alternatives === null && h.constraints === null;
+}
+
+/**
+ * Build a `HandoffEnvelope` from a stance tally, or the honest empty
+ * envelope when there is nothing structured to extract:
+ *
+ * - `tally` is `null` — stance tally never ran this pass (the default,
+ *   opt-in-off case).
+ * - `tally.consensus` is `null` — the tally ran but split; no option
+ *   cleared the two-thirds threshold, so there is no decision to report,
+ *   only a split (which is quorum's/the render's job to surface, not this
+ *   module's).
+ *
+ * Otherwise: `decision` is the winning option's display label;
+ * `rejected_alternatives` lists every OTHER non-abstain option the tally
+ * counted, each with a reason sentence built strictly from that option's
+ * own tally numbers (backer count, weight, the threshold the winner
+ * cleared) — never a narrative guess at WHY members backed it.
+ */
+export function buildHandoffFromStanceTally(tally: StanceTallyResult | null): HandoffEnvelope {
+    if (tally === null || tally.consensus === null) {
+        return EMPTY_HANDOFF;
+    }
+    const winner = tally.consensus;
+    const rejected: RejectedAlternative[] = tally.options
+        .filter((o) => o !== winner)
+        .map((o) => ({
+            option: o.label,
+            reason:
+                `backed by ${o.backers.length} member(s), weight ${o.weight.toFixed(2)} of ` +
+                `${tally.threshold.toFixed(2)} needed to conclude`,
+        }));
+    return {
+        decision: winner.label,
+        rejected_alternatives: rejected.length > 0 ? rejected : null,
+        constraints: null,
+    };
+}

package/src/scripts/ai_council/modes.ts

@@ -33,21 +33,36 @@
  * conflated them. They are now named separately:
  *
  * - **Loader default** — when a config file omits `defaults.mode` entirely,
- *   `config.ts::_build_defaults` fills `api`. Unchanged; this is what every
- *   real config observes, because the loader always populates the key.
+ *   `config.ts::_build_defaults` fills `auto` (road-to-always-on-orchestration
+ *   Phase 3.1 — CLI-first is now the owner-set transport doctrine; before this
+ *   flip the loader default was `api`). This is what every real config
+ *   observes, because the loader always populates the key.
  * - **Built-in fallback** — when NO layer supplies a mode at all (a settings
  *   dict handed straight to the resolver, no config file involved), the answer
  *   is `manual`, below. That is the fail-closed direction the no-silent-spend
  *   Iron Law requires: a caller who supplied no transport preference has not
  *   asked to spend money, so the free transport wins.
+ *
+ * ### Why `DEFAULT_MODE` did NOT flip to `auto` alongside the loader default
+ *
+ * `auto` still resolves to a paying rung (the api fallback) when no CLI is
+ * usable — it is a routing rule, not a free transport. `DEFAULT_MODE` is only
+ * reached by a caller that bypasses the config loader entirely (no
+ * `.ai-council.yml`, a hand-built settings dict handed straight to
+ * `resolve_mode`/`resolve_modes`). Flipping it to `auto` would let such a
+ * caller spend money on a config that never asked for `auto` in the first
+ * place — the same no-silent-spend violation the built-in fallback exists to
+ * prevent. Every real, file-backed config always has `defaults.mode`
+ * populated by the loader (now `auto`), so `DEFAULT_MODE` is never consulted
+ * on that path — verified in modes.test.ts and config.test.ts.
  */
 
 export const VALID_MODES: ReadonlySet<string> = new Set(['api', 'manual', 'cli', 'auto']);
 
 /**
  * Built-in fallback when no layer supplies a mode. `manual` — free, no key,
- * no spend. NOT the same as the loader's `defaults.mode` default (`api`); see
- * the module header.
+ * no spend. NOT the same as the loader's `defaults.mode` default (`auto`
+ * since road-to-always-on-orchestration Phase 3.1); see the module header.
  */
 export const DEFAULT_MODE = 'manual';
 

package/src/scripts/ai_council/orchestrator.ts

@@ -69,6 +69,9 @@ import {
 import { count_dissenters, dissent_quota_met, is_near_duplicate } from './debate_gates.js';
 import { parse_stance_line, render_vote_tally, tally_stances } from './stance_tally.js';
 import { CHAIRMAN_FIELDS_ADDENDUM, render_deanonymization_block } from './blind_review.js';
+import type { AbsentReason } from './transport_resolver.js';
+import type { QuorumResult } from './quorum.js';
+import { isEmptyHandoff, type HandoffEnvelope } from './handoff.js';
 
 // ── Python-format / stdlib parity helpers ────────────────────────────────
 //
@@ -1811,6 +1814,38 @@ export interface RenderOptions {
      * directly in `chairman.text`. Default `null` → byte-identical.
      */
     blind?: { label_to_source: ReadonlyMap<string, string> } | null;
+    /**
+     * Phase 3.2 (road-to-always-on-orchestration): members that produced no
+     * usable response this pass, rendered as a trailing section so the
+     * human-readable report shows the same graded-degradation picture the
+     * session manifest carries structurally. Default `null`/empty →
+     * byte-identical — no existing caller passes this, so no existing
+     * output changes.
+     */
+    absent_members?: readonly RenderAbsentMember[] | null;
+    /**
+     * Phase 3.3: this pass's quorum verdict, rendered as one line right
+     * before the absent-members section (or standalone when there is
+     * nothing absent to report). Default `null` → byte-identical.
+     */
+    quorum?: QuorumResult | null;
+    /**
+     * Phase 4.1: the verdict → handoff envelope, rendered as a `### Handoff`
+     * section right after the Convergence/Divergence slot — closest to the
+     * synthesis it was extracted from, ahead of the trailing quorum/absent
+     * bookkeeping. Rendered only when at least one field is non-`null`
+     * (`isEmptyHandoff` — an all-null envelope has nothing worth a section
+     * for, same "only show when there's substance" call `absent_members`
+     * makes). Default `null` → byte-identical.
+     */
+    handoff?: HandoffEnvelope | null;
+}
+
+/** The minimal shape `render()` needs for one absent-member row. */
+export interface RenderAbsentMember {
+    readonly member: string;
+    readonly reason: AbsentReason | null;
+    readonly detail: string;
 }
 
 /**
@@ -1918,14 +1953,84 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
         blocks.push(render_vote_tally(tally));
     }
     blocks.push(`## Convergence / Divergence\n\n${body}`);
+    // Phase 4.1: closest to the synthesis it was extracted from — ahead of
+    // the de-anonymization map and the trailing quorum/absent bookkeeping.
+    // An all-null envelope renders nothing (`isEmptyHandoff`), so a caller
+    // that always attaches one (the common shape once a producer wires
+    // this in) does not spam every response with "nothing to hand off".
+    if (opts.handoff && !isEmptyHandoff(opts.handoff)) {
+        blocks.push(_render_handoff(opts.handoff));
+    }
     if (blind !== null) {
         // Ü1: de-anonymization AFTER the synthesis slot — blind is only at
         // decision time, never the archive.
         blocks.push(render_deanonymization_block('### De-anonymization map', blind.label_to_source));
     }
+    // Phase 3.2/3.3: trailing, opt-in sections — absent no caller passes
+    // either option, so the join below adds nothing and every existing
+    // render() output stays byte-identical.
+    if (opts.quorum) {
+        blocks.push(_render_quorum_line(opts.quorum));
+    }
+    const absent = opts.absent_members ?? [];
+    if (absent.length > 0) {
+        blocks.push(_render_absent_members(absent));
+    }
     return blocks.join('\n\n---\n\n');
 }
 
+/** One line naming the k-of-n outcome — machine-parseable, human-readable. */
+function _render_quorum_line(q: QuorumResult): string {
+    const verdict = q.status === 'concluded' ? 'concluded' : 'INCONCLUSIVE — release gate holds';
+    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.`;
+}
+
+/**
+ * `### Absent Members` — one row per member that never produced a usable
+ * response this pass, naming the machine-readable reason when classified.
+ */
+function _render_absent_members(absent: readonly RenderAbsentMember[]): string {
+    const lines = ['### Absent Members', ''];
+    for (const a of absent) {
+        const tag = a.reason !== null ? ` (${a.reason})` : '';
+        lines.push(`- **${a.member}**${tag} — ${a.detail}`);
+    }
+    return lines.join('\n');
+}
+
+/**
+ * `### Handoff` — the verdict → work-order envelope (Phase 4.1). Only
+ * called once the caller already confirmed `!isEmptyHandoff(h)`, so at
+ * least one field is populated; the other two still render their own
+ * honest "none recorded" line rather than being silently dropped, so a
+ * reader sees exactly what this pass did and did not extract.
+ */
+function _render_handoff(h: HandoffEnvelope): string {
+    const lines = ['### Handoff', ''];
+    lines.push(`**Decision:** ${h.decision ?? 'none recorded — no structured verdict this pass.'}`);
+    lines.push('');
+    if (h.rejected_alternatives !== null && h.rejected_alternatives.length > 0) {
+        lines.push('**Rejected alternatives:**');
+        lines.push('');
+        for (const alt of h.rejected_alternatives) {
+            lines.push(`- **${alt.option}** — ${alt.reason}`);
+        }
+    } else {
+        lines.push('**Rejected alternatives:** none recorded.');
+    }
+    lines.push('');
+    if (h.constraints !== null && h.constraints.length > 0) {
+        lines.push('**Constraints:**');
+        lines.push('');
+        for (const c of h.constraints) {
+            lines.push(`- ${c}`);
+        }
+    } else {
+        lines.push('**Constraints:** none recorded.');
+    }
+    return lines.join('\n');
+}
+
 /**
  * Render the peer-review block under deterministic Reviewer labels.
  *

package/src/scripts/ai_council/quorum.ts

@@ -0,0 +1,84 @@
+/**
+ * Quorum resolution for a council pass (Phase 3.3 of
+ * road-to-always-on-orchestration).
+ *
+ * A pass concludes when at least `k` of `n` enabled members produced a
+ * usable response ("present"); below `k` the pass is `inconclusive`. At a
+ * release gate an inconclusive pass HOLDS the gate for a human — it is
+ * NEVER silently downgraded to advisory (council-verified, 2026-08-09).
+ * Deciding what to DO with an `inconclusive` status (block a merge, retry,
+ * surface to the user) is the caller's job; this module only answers
+ * whether the threshold was met.
+ *
+ * `majority` is a SIMPLE majority — `ceil(n / 2)` — deliberately NOT the
+ * traditional "more than half" (`floor(n / 2) + 1`). At n=2 those two
+ * definitions diverge: `ceil(2/2)=1` vs `floor(2/2)+1=2`. The stricter
+ * 2-of-2 reading turns any single absent member into a deadlocked release
+ * gate, which is exactly the failure mode council members flagged for the
+ * n=2 case this module is built around — 1-of-2 is the deliberate choice,
+ * not an off-by-one.
+ *
+ * This module is pure — no filesystem, no environment, no config parsing.
+ * `config.ts::QuorumSetting` is the validated shape a loaded
+ * `.ai-council.yml` supplies; a caller reads `cfg.quorum` and passes it
+ * straight through to `evaluateQuorum`.
+ */
+
+import type { QuorumSetting } from './config.js';
+
+export type QuorumStatus = 'concluded' | 'inconclusive';
+
+export interface QuorumResult {
+    /** `concluded` when `present >= threshold`; `inconclusive` otherwise. */
+    readonly status: QuorumStatus;
+    /** The concrete k this pass needed, after resolving `setting` against `total`. */
+    readonly threshold: number;
+    /** Total enabled members configured for this pass — the `n`. */
+    readonly total: number;
+    /** Members that actually produced a usable response. */
+    readonly present: number;
+}
+
+/**
+ * Resolve `setting` into a concrete integer threshold for `total` members.
+ *
+ * `'majority'` → `ceil(total / 2)` (0 when `total` is 0 — there is nothing
+ * to require attendance from). A fixed numeric `setting` is clamped to
+ * `[1, total]` so neither a misconfigured cap above `total` (structurally
+ * unwinnable) nor one below 1 (would resolve trivially) can escape the
+ * config validation `config.ts::_build_quorum` already runs at load time —
+ * this is a second, cheap floor for any caller that builds a `QuorumSetting`
+ * by hand instead of through the loader.
+ */
+export function resolveQuorumThreshold(total: number, setting: QuorumSetting = 'majority'): number {
+    if (!Number.isInteger(total) || total < 0) {
+        throw new RangeError(
+            `resolveQuorumThreshold: total must be a non-negative integer (got ${total}).`,
+        );
+    }
+    if (total === 0) {
+        return 0;
+    }
+    if (setting === 'majority') {
+        return Math.ceil(total / 2);
+    }
+    return Math.min(Math.max(setting, 1), total);
+}
+
+/**
+ * Evaluate whether a pass met quorum.
+ *
+ * `present` is clamped into `[0, total]` before comparison — a caller that
+ * miscounts (more "present" than were ever configured) cannot manufacture a
+ * `concluded` verdict past what `total` actually allows.
+ */
+export function evaluateQuorum(
+    total: number,
+    present: number,
+    setting: QuorumSetting = 'majority',
+): QuorumResult {
+    const threshold = resolveQuorumThreshold(total, setting);
+    const clampedPresent = Math.min(Math.max(present, 0), total);
+    const status: QuorumStatus = clampedPresent >= threshold ? 'concluded' : 'inconclusive';
+    return { status, threshold, total, present: clampedPresent };
+}

package/src/scripts/ai_council/session.ts

@@ -46,6 +46,24 @@ import { PyFloat, py_json_dumps_indent2 } from '../_lib/security_lint.js';
 import { pyRound } from '../_lib/value_ladder.js';
 import { CouncilResponse } from './clients.js';
 import { render } from './orchestrator.js';
+import type { AbsentReason } from './transport_resolver.js';
+import type { QuorumResult } from './quorum.js';
+
+/**
+ * A member that produced no usable response this pass
+ * (road-to-always-on-orchestration Phase 3.2) — never constructed (no CLI +
+ * no key), or constructed but lost mid-run (timeout, quota exhaustion). The
+ * caller assembling the manifest is the one that knows which; this record
+ * only carries what it decided.
+ */
+export interface AbsentMemberRecord {
+    /** Provider name (or "provider/model" — whatever the caller's roster used). */
+    readonly member: string;
+    /** Machine-readable bucket, or `null` when the failure did not classify. */
+    readonly reason: AbsentReason | null;
+    /** Human-readable detail — the CLI-hints / install-instructions text. */
+    readonly detail: string;
+}
 
 // src/scripts/ai_council/session.py → parents[3] == repo root.
 const _HERE = fileURLToPath(import.meta.url);
@@ -76,6 +94,19 @@ export class SessionManifest {
     rounds: number;
     cost_usd_estimated: number;
     cost_usd_actual: number;
+    /**
+     * Members that never produced a usable response this pass (Phase 3.2).
+     * Empty by default — a caller that never populates it (every caller
+     * before this field existed) writes the same manifest shape it always
+     * did, plus one empty array.
+     */
+    absent_members: AbsentMemberRecord[];
+    /**
+     * Quorum verdict for this pass (Phase 3.3), or `null` when the caller
+     * did not evaluate one (e.g. a single-member solo dispatch, where
+     * quorum has nothing to say).
+     */
+    quorum: QuorumResult | null;
     extra: Record<string, unknown>;
 
     constructor(opts: {
@@ -86,6 +117,8 @@ export class SessionManifest {
         rounds?: number;
         cost_usd_estimated?: number;
         cost_usd_actual?: number;
+        absent_members?: AbsentMemberRecord[];
+        quorum?: QuorumResult | null;
         extra?: Record<string, unknown>;
     }) {
         this.mode = opts.mode;
@@ -95,6 +128,8 @@ export class SessionManifest {
         this.rounds = opts.rounds ?? 1;
         this.cost_usd_estimated = opts.cost_usd_estimated ?? 0.0;
         this.cost_usd_actual = opts.cost_usd_actual ?? 0.0;
+        this.absent_members = opts.absent_members ?? [];
+        this.quorum = opts.quorum ?? null;
         // Python dataclass uses `field(default_factory=dict)` — each instance
         // gets its own fresh dict.
         this.extra = opts.extra ?? {};
@@ -504,6 +539,15 @@ export function save(opts: {
         responses_per_round: rounds_data.map((round_responses) =>
             round_responses.map((r) => _serialise_response(r)),
         ),
+        // Phase 3.2/3.3 — graded degradation + quorum, both machine-readable.
+        // Empty array / `null` when the caller never populated them, so an
+        // old caller's manifest keeps its existing keys plus these two.
+        absent_members: manifest.absent_members.map((a) => ({
+            member: a.member,
+            reason: a.reason,
+            detail: a.detail,
+        })),
+        quorum: manifest.quorum,
         ...manifest.extra,
     };