@event4u/agent-config 9.32.0 → 9.34.0

package/src/scripts/ai_council/clients.ts

@@ -195,10 +195,34 @@ export function assertCacheBreakpointOrder(ttls: readonly PromptCacheTtl[]): voi
     }
 }
 
+/**
+ * The model id a provider reports on its own response, or `''` when it reports
+ * none.
+ *
+ * `field` is a parameter because the name is NOT uniform across providers:
+ * Gemini reports it as `model_version`, so a literal single-field read would
+ * leave Gemini silently empty — which is indistinguishable from a transport
+ * that genuinely reports nothing. Non-string values collapse to `''` rather
+ * than being coerced: a guess is worse than an honest blank here, because the
+ * whole point of the field is detecting a substitution.
+ */
+function _servedModel(response: unknown, field = 'model'): string {
+    const value = _getattr(response, field, '');
+    return typeof value === 'string' ? value : '';
+}
+
 /** Normalised output from a single council member (dataclass `CouncilResponse`). */
 export class CouncilResponse {
     provider: string;
     model: string;
+    // The model id the provider reported serving, when it reports one. NEVER
+    // overwrites `model`: that is the REQUESTED id, and it is what the tier
+    // decision was made against — keeping both is what makes a silent alias or
+    // provider substitution detectable at all. Attribution-only; no consumer
+    // may route on it. Defaults to '' (the honest value for a transport that
+    // reports no served id, e.g. every CLI client) so existing callers and the
+    // persisted response JSON stay backward-compatible.
+    model_served: string;
     text: string;
     input_tokens: number;
     output_tokens: number;
@@ -215,6 +239,7 @@ export class CouncilResponse {
     constructor(opts: {
         provider: string;
         model: string;
+        model_served?: string;
         text: string;
         input_tokens?: number;
         output_tokens?: number;
@@ -226,6 +251,7 @@ export class CouncilResponse {
     }) {
         this.provider = opts.provider;
         this.model = opts.model;
+        this.model_served = opts.model_served ?? '';
         this.text = opts.text;
         this.input_tokens = opts.input_tokens ?? 0;
         this.output_tokens = opts.output_tokens ?? 0;
@@ -616,6 +642,7 @@ export class AnthropicClient extends ExternalAIClient {
         return new CouncilResponse({
             provider: this.name,
             model: this.model,
+            model_served: _servedModel(response),
             text,
             input_tokens: usage ? (_getattr(usage, 'input_tokens', 0) as number) : 0,
             output_tokens: usage ? (_getattr(usage, 'output_tokens', 0) as number) : 0,
@@ -719,6 +746,7 @@ export class OpenAIClient extends ExternalAIClient {
         return new CouncilResponse({
             provider: this.name,
             model: this.model,
+            model_served: _servedModel(response),
             text: (text as string) || '',
             input_tokens: usage ? (_getattr(usage, 'prompt_tokens', 0) as number) : 0,
             output_tokens: usage ? (_getattr(usage, 'completion_tokens', 0) as number) : 0,
@@ -796,6 +824,8 @@ export class GeminiClient extends ExternalAIClient {
         return new CouncilResponse({
             provider: this.name,
             model: this.model,
+            // Gemini names it `model_version`, not `model`.
+            model_served: _servedModel(response, 'model_version'),
             text,
             input_tokens: usage ? (_getattr(usage, 'prompt_token_count', 0) as number) : 0,
             output_tokens: usage ? (_getattr(usage, 'candidates_token_count', 0) as number) : 0,
@@ -878,6 +908,7 @@ export class _OpenAICompatibleClient extends ExternalAIClient {
         return new CouncilResponse({
             provider: this.name,
             model: this.model,
+            model_served: _servedModel(response),
             text: (text as string) || '',
             input_tokens: usage ? (_getattr(usage, 'prompt_tokens', 0) as number) : 0,
             output_tokens: usage ? (_getattr(usage, 'completion_tokens', 0) as number) : 0,

package/src/scripts/ai_council/events_log.ts

@@ -3,9 +3,11 @@
  *
  * Ported from the retired Python `src/scripts/ai_council/events_log.py` (ADR-200 —
  * Python→TS migration, Phase 1). Appends one JSON line per council event to
- * `<project_root>/agents/runtime/council/events.log`. Schema v1 carries the
- * minimum needed to answer the "why did the council skip / block this?"
- * question at retro time without leaking prompt content.
+ * `<project_root>/agents/runtime/council/events.log`. The schema carries the
+ * minimum needed to answer "why did the council skip / block this?" and,
+ * since v2, "who actually attended?" — at retro time, without leaking prompt
+ * content. v2 added the `quorum_result` action and nothing else; see
+ * `appendQuorumEvent`.
  *
  * Privacy floor:
  *     `original_ask` is never written verbatim — the caller passes the raw
@@ -25,14 +27,25 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-export const SCHEMA_VERSION = 1;
+import { isEnvKillSwitchActive } from '../_lib/env_kill_switch.js';
+import { isSoloConcluded, type QuorumResult } from './quorum.js';
+import type { AbsentReason } from './transport_resolver.js';
 
-export type EventAction = 'proceed' | 'skip_necessity' | 'block_quota';
+/**
+ * v2 adds the `quorum_result` action (and nothing else) — see
+ * `appendQuorumEvent`. Every schema-v1 field keeps its name, type and
+ * position, so a v1 reader parses a v2 necessity line unchanged; only the
+ * action vocabulary widened.
+ */
+export const SCHEMA_VERSION = 2;
+
+export type EventAction = 'proceed' | 'skip_necessity' | 'block_quota' | 'quorum_result';
 
 const _VALID_ACTIONS: ReadonlySet<string> = new Set([
     'proceed',
     'skip_necessity',
     'block_quota',
+    'quorum_result',
 ]);
 
 /**
@@ -127,8 +140,7 @@ function _utf8Bytes(cp: number): string {
 }
 
 function _kill_switch_active(): boolean {
-    const value = process.env[_KILL_SWITCH_ENV] ?? '';
-    return !(value === '' || value === '0' || value === 'false' || value === 'False');
+    return isEnvKillSwitchActive(_KILL_SWITCH_ENV);
 }
 
 export interface AppendEventOptions {
@@ -194,7 +206,7 @@ export function appendEvent(
         original_ask_hash: _hash_original_ask(rawAsk),
     };
     // Pass-through for any caller-supplied diagnostic fields that are not in
-    // the schema-v1 reserved set. The schema-v1 fields above always win on
+    // the reserved set. The reserved fields above always win on
     // collision.
     const reserved = new Set([...Object.keys(record), 'original_ask']);
     for (const [k, v] of Object.entries(event)) {
@@ -215,6 +227,116 @@ export function defaultLogPath(): string {
     return _DEFAULT_LOG_PATH;
 }
 
+// ── quorum attendance (schema v2) ───────────────────────────────────
+
+/**
+ * Which of the two `evaluateQuorum` call sites produced the record.
+ *
+ * `pre_run` is `build_members`' construction-time reading — who could be
+ * built at all. `post_run` is `_postRunQuorum`'s re-derivation over what
+ * actually returned a usable response. One pass emits BOTH, and they
+ * disagree whenever a member constructs and then fails mid-flight, so a
+ * consumer that counts attendance without splitting on this field
+ * double-counts every pass.
+ */
+export type QuorumEventPhase = 'pre_run' | 'post_run';
+
+/**
+ * One absent member, in the vocabulary the tree actually uses:
+ * `AbsentReason` plus the two runtime fallbacks the CLI writes directly —
+ * `'unavailable'` (transport resolved to ∅) and `'binary_missing'` (a CLI
+ * client refused to construct).
+ */
+export type QuorumAbsentReason = AbsentReason | 'unavailable' | 'binary_missing';
+
+export interface QuorumAbsence {
+    readonly member: string;
+    readonly reason: QuorumAbsentReason;
+}
+
+/**
+ * Which CLI path produced the line. `estimate` spends nothing — it is a cost
+ * preview — so every rate computed over these lines must exclude it, and it
+ * is recorded rather than suppressed so the exclusion is the consumer's
+ * explicit act instead of an invisible one.
+ */
+export type QuorumCommand = 'run' | 'estimate' | 'debate';
+
+/**
+ * `single` means `--single` filtered the roster down to one member BEFORE
+ * the pass ran. Without this field a deliberate solo dispatch is byte-identical
+ * to a configured one-member council, and the solo-conclusion rate cannot tell
+ * the two apart — which is the one distinction it exists to make.
+ */
+export type QuorumDispatch = 'full' | 'single';
+
+export interface QuorumEventInput {
+    readonly lens: string;
+    readonly invocation: string;
+    readonly phase: QuorumEventPhase;
+    readonly command: QuorumCommand;
+    readonly dispatch: QuorumDispatch;
+    /**
+     * Enabled members in the config, BEFORE `--single` / `--siblings`
+     * filtering and before construction failures. `result.total` is the
+     * roster that survived; when the two differ, the gap is exactly the
+     * "council degraded by configuration" case a post_run-only reading is
+     * otherwise blind to.
+     */
+    readonly configuredTotal: number;
+    readonly result: QuorumResult;
+    readonly absent: readonly QuorumAbsence[];
+}
+
+/**
+ * Append one `quorum_result` line — the attendance record that makes a
+ * solo-concluded pass distinguishable from a full-attendance one.
+ *
+ * Privacy floor, by construction: `QuorumAbsence` carries a member name and
+ * a closed-vocabulary reason and has **no field able to hold free-form
+ * content**. The CLI's own absent entries carry a `detail` string built from
+ * provider error text (which can embed paths and prompts); it is dropped
+ * here rather than scrubbed, so there is no scrubber to fail.
+ *
+ * Fail-open: attendance telemetry must never be able to kill a council
+ * pass, so every error is swallowed and reported as `false`. The reachable
+ * ones are filesystem errors from `appendEvent`'s own `mkdirSync` /
+ * `appendFileSync` — an unwritable path, ENOTDIR, a full disk. Its other
+ * throw (an invalid action) is unreachable from here, since this function
+ * supplies the action itself.
+ */
+export function appendQuorumEvent(
+    input: QuorumEventInput,
+    opts: AppendEventOptions = {},
+): boolean {
+    try {
+        return appendEvent(
+            {
+                lens: input.lens,
+                invocation: input.invocation,
+                action: 'quorum_result',
+                verdict: input.result.status,
+                phase: input.phase,
+                command: input.command,
+                dispatch: input.dispatch,
+                threshold: input.result.threshold,
+                configured_total: input.configuredTotal,
+                total: input.result.total,
+                present: input.result.present,
+                // Written by the predicate, never re-derived from the numbers
+                // downstream: one definition of "concluded on a single voice",
+                // in `quorum.ts`, so a change to it cannot leave a consumer's
+                // copy silently stale.
+                solo: isSoloConcluded(input.result),
+                absent: input.absent.map((a) => ({ member: a.member, reason: a.reason })),
+            },
+            opts,
+        );
+    } catch {
+        return false;
+    }
+}
+
 // ── helpers ─────────────────────────────────────────────────────────
 
 /**

package/src/scripts/ai_council/orchestrator.ts

@@ -58,6 +58,7 @@ import type { AdvisorPlan } from './advisors.js';
 import {
     advisor_system_prompt,
     ANTI_CONFORMITY_DIRECTIVE,
+    describe_verdict_mismatch,
     STANCE_LINE_CONTRACT,
     build_extraction_user_prompt,
     build_peer_review_user_prompt,
@@ -65,12 +66,13 @@ import {
     peer_review_synthesis_addendum,
     synthesis_template,
     system_prompt_for,
+    VERDICT_LINE_CONTRACT,
 } from './prompts.js';
 import { count_dissenters, dissent_quota_met, is_near_duplicate } from './debate_gates.js';
 import { parse_stance_line, render_vote_tally, tally_stances } from './stance_tally.js';
 import { CHAIRMAN_FIELDS_ADDENDUM, render_deanonymization_block } from './blind_review.js';
 import type { AbsentReason } from './transport_resolver.js';
-import type { QuorumResult } from './quorum.js';
+import { isSoloConcluded, type QuorumResult } from './quorum.js';
 import { isEmptyHandoff, type HandoffEnvelope } from './handoff.js';
 
 // ── Python-format / stdlib parity helpers ────────────────────────────────
@@ -1927,6 +1929,23 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
         // addendum so both extensions stack predictably.
         template = template ? `${template}\n\n${CHAIRMAN_FIELDS_ADDENDUM}` : CHAIRMAN_FIELDS_ADDENDUM;
     }
+    if (opts.stance_tally === true && template !== '') {
+        // Phase 2.1: the synthesis owes the same machine-readable closing line
+        // the members owe. Appended only when a tally will be rendered — there
+        // is nothing to check a verdict against otherwise. Composed last so it
+        // is the final instruction, matching the contract's "and nothing after
+        // it". The template's own `VERDICT: <option-label>` placeholder is
+        // parsed as absent (see `parse_verdict_line`), so the un-summarised
+        // render stays green.
+        //
+        // The `template !== ''` guard is load-bearing: an empty template is
+        // `prose_synthesis: true`, documented at `:1859-1862` as a BARE slot.
+        // Appending here would replace `*to be summarised by the host agent*`
+        // with raw contract instructions and silently override an option the
+        // caller set on purpose — a creative-lens pass would start reading like
+        // a filled-in form.
+        template = `${template}\n\n${VERDICT_LINE_CONTRACT}`;
+    }
     let body: string;
     if (template) {
         body = template;
@@ -1951,6 +1970,25 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
                 .map((r) => ({ member: `${r.provider}:${r.model}`, text: r.text })),
         );
         blocks.push(render_vote_tally(tally));
+        // Phase 2.1: the verdict half of the same projection. A synthesis that
+        // states a `VERDICT:` line the tally did not clear is contradicting its
+        // own count, and the reader of the rendered pass is exactly who needs to
+        // see that.
+        //
+        // Surfaced, never thrown, and the ordering above is part of the fix: a
+        // throw here would discard the whole artifact — every member response,
+        // the peer review, the quorum bookkeeping — AFTER every provider call
+        // was paid for, which is the hazard this roadmap already recorded for
+        // the sibling shape check. `describe_verdict_mismatch` returns the
+        // string; `assert_synthesis_matches_tally` still throws for a caller
+        // holding a finished synthesis it can refuse.
+        //
+        // Conditional by construction: an absent verdict line yields null, so
+        // every synthesis written before the contract shipped stays byte-identical.
+        const mismatch = describe_verdict_mismatch(body, tally);
+        if (mismatch !== null) {
+            blocks.push(`> **Verdict/tally mismatch:** ${mismatch}`);
+        }
     }
     blocks.push(`## Convergence / Divergence\n\n${body}`);
     // Phase 4.1: closest to the synthesis it was extracted from — ahead of
@@ -1979,10 +2017,19 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
     return blocks.join('\n\n---\n\n');
 }
 
-/** One line naming the k-of-n outcome — machine-parseable, human-readable. */
+/**
+ * One line naming the k-of-n outcome — machine-parseable, human-readable.
+ *
+ * The `solo` marker is the artifact half of the signal the `quorum_result`
+ * event carries in the log: a pass concluded by ONE voice otherwise reads
+ * identically to a full-attendance one, and the reader of a rendered pass is
+ * exactly who needs to see the difference. Derived through `isSoloConcluded`
+ * so the predicate keeps one definition and the renderer does not restate it.
+ */
 function _render_quorum_line(q: QuorumResult): string {
     const verdict = q.status === 'concluded' ? 'concluded' : 'INCONCLUSIVE — release gate holds';
-    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.`;
+    const solo = isSoloConcluded(q) ? ' · **solo** — one voice concluded this pass' : '';
+    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${solo}`;
 }
 
 /**

package/src/scripts/ai_council/pricing.ts

@@ -49,8 +49,55 @@ export interface PriceTable {
     prices: Map<string, Price>; // keyed by priceKey(provider, model)
 }
 
+/**
+ * Price for (provider, model) — exact key first, then the longest matching
+ * key PREFIX within the same provider.
+ *
+ * Exact match stays the first hit, so no call that resolves today changes
+ * path or price. The fallback exists because vendors ship dated aliases:
+ * `claude-sonnet-4-5-20260101` missed a `claude-sonnet-4-5` row and priced at
+ * **nothing** — a silent zero, not an error. Longest-first means a more
+ * specific row always wins over a shorter one that also prefixes the id
+ * (`claude-opus-4-1` over a hypothetical `claude-opus`).
+ *
+ * The prefix must be followed by a separator (`-`, `.`, `:`, `@`) or end the
+ * id, so `claude-opus-4-1` never matches a `claude-opus-4-15` row: a bare
+ * `startsWith` would price one model at another's rate, which is worse than
+ * the zero it replaces because it looks correct.
+ *
+ * Provider is part of the composite key, so cross-provider bleed is
+ * impossible by construction.
+ */
 export function lookup(table: PriceTable, provider: string, model: string): Price | null {
-    return table.prices.get(priceKey(provider, model)) ?? null;
+    const exact = table.prices.get(priceKey(provider, model));
+    if (exact !== undefined) {
+        return exact;
+    }
+    // Derived from `priceKey`, never hand-rebuilt: it owns the composite-key
+    // encoding, and a second copy here would let a separator change follow the
+    // exact-match path while this loop silently matched nothing — regressing to
+    // the very silent zero the fallback exists to remove.
+    const prefix = priceKey(provider, '');
+    let best: Price | null = null;
+    let bestLen = -1;
+    for (const [key, price] of table.prices) {
+        if (!key.startsWith(prefix)) {
+            continue;
+        }
+        const candidate = key.slice(prefix.length);
+        if (!candidate || !model.startsWith(candidate)) {
+            continue;
+        }
+        const next = model.charAt(candidate.length);
+        if (next !== '' && next !== '-' && next !== '.' && next !== ':' && next !== '@') {
+            continue;
+        }
+        if (candidate.length > bestLen) {
+            best = price;
+            bestLen = candidate.length;
+        }
+    }
+    return best;
 }
 
 // ── token + cost arithmetic ────────────────────────────────────────

package/src/scripts/ai_council/prompts.ts

@@ -460,9 +460,19 @@ export const REQUIRED_SYNTHESIS_SECTIONS = ['Kill criteria', 'Concrete next step
  * fills the Convergence / Divergence slot) — not the template prompt. Every
  * lens must close with a non-empty `### Kill criteria` and `### Concrete next
  * step`; a missing or placeholder-empty section throws `SynthesisRenderError`
- * naming the first offender. Called on the synthesis-emit path (the chairman
- * synthesis in Phase 2, and any future synthesis-record step); safe to call on
- * decision and creative lenses alike, since both now require the two sections.
+ * naming the first offender. Safe to call on decision and creative lenses
+ * alike, since both now require the two sections.
+ *
+ * **Not wired onto the emit path, deliberately.** This docstring used to claim
+ * it was "called on the synthesis-emit path"; measured, the function had zero
+ * production call sites and only the test imported it. Wiring it
+ * unconditionally into `render()` is not available either: with no chairman the
+ * rendered body is the literal `*to be summarised by the host agent*`, which
+ * carries neither section, so every templated render would throw (verified —
+ * the probe raises `missing the required "### Kill criteria" section`). A
+ * caller that HAS a completed synthesis calls this; the templated default path
+ * has nothing to validate. The tally check below is the half that could be
+ * wired, because it is conditional on a verdict line the template never emits.
  */
 export function assert_synthesis_sections(text: string): void {
     const lines = text.split('\n');
@@ -488,6 +498,158 @@ export function assert_synthesis_sections(text: string): void {
     }
 }
 
+/** The reserved verdict label a synthesis uses when the tally did not converge. */
+export const SPLIT_VERDICT_LABEL = 'split';
+
+// Mirrors `_STANCE_RE`'s shape discipline: an explicit, single-field closing
+// line, never read out of surrounding prose.
+//
+// **Case-SENSITIVE, deliberately.** The `i` flag was here and was wrong: the
+// pattern is line-anchored, so `Verdict: option A is the stronger choice` —
+// ordinary chairman prose opening a line — parsed as a machine-readable verdict
+// carrying the whole sentence as its label. That is precisely the prose
+// inference the paragraph above forbids, arriving through the regex instead of
+// through a fallback. `VERDICT_LINE_CONTRACT` asks for the literal uppercase
+// token, so requiring it costs a compliant author nothing and closes the class.
+const _VERDICT_RE = /^\s*VERDICT:\s*(.+?)\s*$/gm;
+
+/**
+ * Mandatory closing-line contract for a synthesis rendered alongside a stance
+ * tally. The synthesis states its verdict as a machine-readable label rather
+ * than leaving it to be mined out of the recommendation prose — the same
+ * discipline `STANCE_LINE_CONTRACT` imposes on members.
+ */
+export const VERDICT_LINE_CONTRACT = `Close the synthesis with EXACTLY this line, and nothing after it:
+VERDICT: <option-label>
+Use the SAME <option-label> the Vote Tally cleared. Use \`${SPLIT_VERDICT_LABEL}\` when no option cleared the threshold — an honest split is a verdict, and claiming a winner the tally did not record is a render error.`;
+
+/**
+ * Parse the synthesis verdict line. Returns the LAST match (the final,
+ * most-authoritative one) or `null` when no well-formed line exists.
+ *
+ * `null` is a repair marker, never a guess: this function does not fall back to
+ * reading agreement out of the prose. That is the invariant `stance_tally`
+ * states for members ("the tally never infers a stance from the surrounding
+ * prose") and the one `check_finding_dispositions` states for the release
+ * ledger ("a comment is mutable and unaudited; it is transport, not a record").
+ */
+export function parse_verdict_line(text: string): { label: string; display: string } | null {
+    _VERDICT_RE.lastIndex = 0;
+    let last: RegExpExecArray | null = null;
+    let m: RegExpExecArray | null;
+    while ((m = _VERDICT_RE.exec(text)) !== null) {
+        last = m;
+    }
+    if (last === null) {
+        return null;
+    }
+    const raw = (last[1] ?? '').trim();
+    if (raw.length === 0) {
+        return null;
+    }
+    // An angle-bracketed label is the CONTRACT's own placeholder, not a verdict.
+    // This matters on the templated path: with no chairman the rendered body IS
+    // `VERDICT_LINE_CONTRACT`'s template text, so a parser without this guard
+    // would read `<option-label>` as a claimed winner and throw on every
+    // un-summarised render. Same treatment `assert_synthesis_sections` gives a
+    // placeholder-empty section.
+    if (/^<.*>$/.test(raw)) {
+        return null;
+    }
+    return { label: raw.toLowerCase(), display: raw };
+}
+
+/**
+ * Validate a completed synthesis against the stance tally it was rendered
+ * beside: a verdict naming a winner the tally did not clear throws
+ * `SynthesisRenderError`, the same way a missing section does.
+ *
+ * The defect this closes: `assert_synthesis_sections` is a *shape* check, so a
+ * synthesis could report agreement over a tally that recorded dissent and
+ * nothing downstream disagreed. That is the class behind the recorded 9.14.0
+ * release failure, where the head read "Security and correctness: none" over a
+ * critical finding — `check_finding_dispositions.ts` is the same check on the
+ * release surface.
+ *
+ * **An absent verdict line does not throw.** It is a repair marker under the
+ * same rule as an unparseable stance: the fail-safe direction is to record that
+ * the claim was not made, never to infer one from prose. That also keeps every
+ * synthesis rendered before `VERDICT_LINE_CONTRACT` shipped green.
+ */
+export function assert_synthesis_matches_tally(text: string, tally: TallyView): void {
+    const mismatch = describe_verdict_mismatch(text, tally);
+    if (mismatch !== null) {
+        throw new SynthesisRenderError(mismatch);
+    }
+}
+
+/** The slice of a `StanceTallyResult` the verdict check reads. */
+export interface TallyView {
+    consensus: { label: string } | null;
+    split: boolean;
+    options: ReadonlyArray<{ label: string }>;
+}
+
+/**
+ * The same comparison as `assert_synthesis_matches_tally`, returning the
+ * mismatch as a string instead of throwing — `null` means "no contradiction".
+ *
+ * **Why both shapes exist.** Throwing is right for a caller holding a finished
+ * synthesis it can refuse. It is wrong on the render path: `render()` throws
+ * before the tally and the Convergence blocks are pushed, so a mismatch would
+ * destroy the ENTIRE artifact — every member response, the peer review, the
+ * quorum bookkeeping — *after* every provider call has already been paid for.
+ * The module's own answer for an unverifiable claim is the `needs_repair`
+ * marker `render_vote_tally` prints, not a discarded pass, and the roadmap had
+ * already recorded that unconditionally wiring the sibling shape check was
+ * unsafe for this same reason. So the render path surfaces the contradiction
+ * where a reader will see it and keeps the artifact.
+ */
+export function describe_verdict_mismatch(text: string, tally: TallyView): string | null {
+    const verdict = parse_verdict_line(text);
+    if (verdict === null) {
+        return null; // repair marker, not a guess
+    }
+    // The reserved sense of `split` yields to a real option that carries the
+    // same label (R2 finding 8): the label vocabulary is free text mined from
+    // member `STANCE:` lines, so nothing stops an option genuinely called
+    // `split`, and when the tally clears it the CORRECT verdict would otherwise
+    // read as a contradiction. Deciding by whether the tally actually holds
+    // that option keeps one namespace without an escape syntax authors would
+    // have to learn.
+    const optionNamedSplit = tally.options.some(
+        (o) => o.label.toLowerCase() === SPLIT_VERDICT_LABEL,
+    );
+    const claimsSplit = verdict.label === SPLIT_VERDICT_LABEL && !optionNamedSplit;
+
+    if (tally.consensus === null) {
+        if (claimsSplit) {
+            return null;
+        }
+        // `split` is the tally's own word for this state; reading it here rather
+        // than re-deriving "no consensus ⇒ split" keeps the message honest when
+        // the tally is empty (zero options is not a split across zero options).
+        const how = tally.split
+            ? `split across ${tally.options.length} option(s)`
+            : 'no option-level stances parsed';
+        return (
+            `synthesis claims "${verdict.display}" but the tally recorded no consensus ` +
+            `(${how}); use \`${SPLIT_VERDICT_LABEL}\` or re-run the round`
+        );
+    }
+
+    if (claimsSplit) {
+        return `synthesis claims a split but the tally cleared "${tally.consensus.label}"`;
+    }
+    if (verdict.label !== tally.consensus.label.toLowerCase()) {
+        return (
+            `synthesis claims "${verdict.display}" but the tally cleared ` +
+            `"${tally.consensus.label}"`
+        );
+    }
+    return null;
+}
+
 /**
  * Drop any *whole line* containing a host-agent identity substring.
  *

package/src/scripts/ai_council/quorum.ts

@@ -82,3 +82,33 @@ export function evaluateQuorum(
     const status: QuorumStatus = clampedPresent >= threshold ? 'concluded' : 'inconclusive';
     return { status, threshold, total, present: clampedPresent };
 }
+
+/**
+ * Did this pass conclude on a single voice?
+ *
+ * Derived — deliberately NOT a third `QuorumStatus`. `ceil(n / 2)` makes
+ * 1-of-2 a legitimate `concluded`, which is the intended behaviour (see the
+ * module header); this predicate does not dispute it, it only makes the
+ * shape visible so a reader can tell a one-member conclusion from a
+ * full-attendance one. Advisory render and telemetry only: no gate reads it,
+ * and nothing downstream may branch on it without its own decision record.
+ *
+ * ONE such record now exists, and it is deliberately narrow: ADR-224
+ * (`docs/decisions/ADR-224-gate-scoped-solo-attendance-floor.md`) authorizes a
+ * `min_present: 2` floor to branch on this predicate **for gate-class passes
+ * only**, decided against a measured 12.5 % solo-conclusion rate. Nothing has
+ * landed yet — no caller branches on it today — so the sentence above still
+ * describes the code. It is stated here so a reader finds the authorization
+ * instead of re-deriving the prohibition, and so the next branch is visibly a
+ * separate argument: the exception is gate-class passes, not solo status
+ * generally.
+ *
+ * `total` is deliberately NOT consulted. A council configured with a single
+ * member concludes solo by construction, and that is still a conclusion
+ * reached on one voice — collapsing it into "not solo" would hide exactly
+ * the passes a solo-conclusion rate is measured to find. A consumer that
+ * cares about the distinction reads `result.total` alongside.
+ */
+export function isSoloConcluded(result: QuorumResult): boolean {
+    return result.status === 'concluded' && result.present === 1;
+}

package/src/scripts/ai_council/session.ts

@@ -189,6 +189,17 @@ function _serialise_response(r: CouncilResponse): Record<string, unknown> {
     const payload: Record<string, unknown> = {
         provider: r.provider,
         model: r.model,
+        // `model` stays the REQUESTED id — the tier decision was made against
+        // it. `model_served` is what the provider reported answering with, so a
+        // silent alias or substitution is visible instead of being recorded as
+        // the model that never ran. Attribution-only: no consumer routes on it.
+        //
+        // Additive on the MANIFEST's own response row, which is this artefact —
+        // NOT a `cost-summary/v1` field: that contract describes
+        // `agents/cost-tracking/sessions.jsonl`, a different file with a
+        // different producer. Absent on manifests written before this, and `''`
+        // for every transport that reports no served id.
+        model_served: r.model_served,
         input_tokens: r.input_tokens,
         output_tokens: r.output_tokens,
         latency_ms: r.latency_ms,

package/src/scripts/ai_team/review_gate.ts

@@ -42,6 +42,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { claude_config_dir, CODEX_MARKETPLACE_NAME, CODEX_PLUGIN_ID } from '../_lib/claude_plugin.js';
+import { isEnvKillSwitchActive } from '../_lib/env_kill_switch.js';
 import { atomic_write_json } from '../hooks/state_io.js';
 import { AI_TEAM_DEFAULTS, load_ai_team_config, type AiTeamConfig } from './config.js';
 
@@ -170,8 +171,7 @@ export function circuit_breaker_notice(bound: number): string {
 // ── ledger (events-log convention) ──────────────────────────────────
 
 function _kill_switch_active(): boolean {
-    const value = process.env[_KILL_SWITCH_ENV] ?? '';
-    return !(value === '' || value === '0' || value === 'false' || value === 'False');
+    return isEnvKillSwitchActive(_KILL_SWITCH_ENV);
 }
 
 function _iso_seconds_z(d: Date): string {