@event4u/agent-config 9.33.0 → 9.34.0

package/src/scripts/_lib/env_kill_switch.ts

@@ -0,0 +1,37 @@
+/**
+ * One definition of "is this env kill-switch on?".
+ *
+ * WHY THIS EXISTS: the predicate was written out twice, byte-for-byte —
+ * `ai_council/events_log.ts` and `ai_team/review_gate.ts` each carried a
+ * private `_kill_switch_active()` with the identical body AND the identical
+ * env var (`AGENT_CONFIG_NO_EVENTS_LOG`). `diff` over the two blocks was empty
+ * and no shared helper existed. Two copies of a boolean coercion is two places
+ * for the next accepted spelling to land in only one.
+ *
+ * The subtle half is why `'false'` is listed at all: `process.env` values are
+ * strings, so the obvious `Boolean(process.env.X)` reads the *string* `'false'`
+ * as true and silently arms a switch the operator explicitly disarmed. The
+ * off-set is therefore explicit — unset, `''`, `'0'`, `'false'`, `'False'` —
+ * and everything else is on, so a typo fails toward the safer direction (the
+ * switch suppresses a log; a spurious suppression is visible, a spurious write
+ * is not).
+ *
+ * SCOPE, stated because the source over-claimed it. `grep -rn "=== 'false'"
+ * src/scripts/` returns 10 hits; only the two migrated here share one
+ * predicate. The others are deliberately different and stay put:
+ * `orchestration_record.ts` is a CLI-flag coercion whose invalid-string
+ * fall-through is documented, `turn_end_gate_hook.ts` additionally accepts
+ * `yes`/`on`, and `validate_frontmatter.ts` is a YAML scalar parser. Folding
+ * those in would change three behaviours to remove three lines.
+ */
+
+/** The env values that mean "off". Everything else — including a typo — is on. */
+const _OFF_VALUES: ReadonlySet<string> = new Set(['', '0', 'false', 'False']);
+
+/**
+ * True when the named environment variable is set to anything outside the
+ * off-set. Unset reads as off.
+ */
+export function isEnvKillSwitchActive(name: string): boolean {
+    return !_OFF_VALUES.has(process.env[name] ?? '');
+}

package/src/scripts/_lib/security_lint.ts

@@ -408,10 +408,13 @@ export function* iter_corpus(
  * Exit 1 iff at least one finding `is_fail` (HIGH + full weight). WARN-level
  * (weighted-down or < HIGH) findings print but never fail the build.
  */
-export function report(findings: readonly Finding[], opts: { check_label: string }): number {
+export function report(
+    findings: readonly Finding[],
+    opts: { check_label: string; scanned_roots?: readonly string[] },
+): number {
     const check_label = opts.check_label;
     if (findings.length === 0) {
-        process.stdout.write(`✅  ${check_label}: clean (${_corpus_note()}).\n`);
+        process.stdout.write(`✅  ${check_label}: clean (${_corpus_note(opts.scanned_roots)}).\n`);
         return 0;
     }
 
@@ -459,8 +462,19 @@ function _pyG(n: number): string {
     return s;
 }
 
-function _corpus_note(): string {
-    return 'scanned ' + DEFAULT_SCAN_ROOTS.join(', ');
+// The clean-path line names the corpus the caller ACTUALLY walked, not the
+// shared default. Two of five callers diverge from `DEFAULT_SCAN_ROOTS`
+// (`lint_skill_frontmatter_safety` replaces the set outright,
+// `lint_mcp_config_security` appends `src/templates`), so a hardcoded note made
+// this gate report a scope in both directions at once: it claimed `src/rules`
+// and `dist/agent-src`, which it never reads, and omitted `src/subagents`,
+// which is the one root holding the artefact its over-broad-grant check exists
+// for. A reader verifying that root by running the gate read the opposite of
+// the truth. Same contract as `_lib/scan_scope.reportScanned` — the emitted
+// scope is the scope that was walked.
+function _corpus_note(scanned_roots?: readonly string[]): string {
+    const roots = scanned_roots && scanned_roots.length > 0 ? scanned_roots : DEFAULT_SCAN_ROOTS;
+    return 'scanned ' + roots.join(', ');
 }
 
 // ---------------------------------------------------------------------

package/src/scripts/_lib/self_repair.ts

@@ -538,6 +538,66 @@ export function fingerprint(defect_class: DefectClass, evidence: string): string
 }
 
 /** Fold a finding into an existing record, or open a new one. */
+// ── creation rate cap ──────────────────────────────────────────────
+//
+// `upsertFinding` folds on fingerprint, so a *recurring* defect increments one
+// record and adds no file. What nothing bounded is **creation**: the fingerprint
+// is `defect_class + evidence`, and evidence is a quoted span from the turn, so a
+// defect whose span varies per turn mints a fresh record every time. The only
+// cap in the module pair was `MAX_EVIDENCE`, which bounds a span's *length* and
+// says nothing about how many records may exist.
+//
+// The cap is per `source` because the two intake paths have different plausible
+// rates and a runaway on one must not consume the other's headroom: a
+// `user-reported` record needs the user to complain, and `self-detected` fires at
+// most once per turn per detector. `NEW_RECORDS_PER_SOURCE_PER_WINDOW` sits above
+// any plausible day (three detector classes, a few evidence variants each) and
+// far below a runaway (one per turn over a long session).
+export const NEW_RECORDS_PER_SOURCE_PER_WINDOW = 20;
+export const CREATION_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * How many records of `source` were CREATED inside the window ending at `now`.
+ * Counts `first_seen`, never `last_seen` — an old record still being folded into
+ * is not creation and must not consume the budget.
+ */
+export function recentCreations(
+    existing: readonly DefectRecord[],
+    source: DefectSource,
+    now: string,
+): number {
+    const end = Date.parse(now);
+    if (Number.isNaN(end)) {
+        return 0;
+    }
+    return existing.filter((r) => {
+        if (r.source !== source) {
+            return false;
+        }
+        const t = Date.parse(r.first_seen);
+        // An unparseable stamp is counted: a malformed record is exactly what a
+        // runaway writer produces, and failing open there would uncap the store.
+        return Number.isNaN(t) || (end - t < CREATION_WINDOW_MS && end - t >= 0);
+    }).length;
+}
+
+/**
+ * Whether opening a NEW record for `finding` is over budget. A fingerprint that
+ * already exists is a fold, never a creation, so it is never capped — the cap
+ * must not silence a defect the store is already tracking.
+ */
+export function creationCapReached(
+    existing: readonly DefectRecord[],
+    finding: DefectFinding,
+    now: string,
+): boolean {
+    const fp = fingerprint(finding.defect_class, finding.evidence);
+    if (existing.some((r) => r.fingerprint === fp)) {
+        return false;
+    }
+    return recentCreations(existing, finding.source, now) >= NEW_RECORDS_PER_SOURCE_PER_WINDOW;
+}
+
 export function mergeRecord(
     existing: DefectRecord | null,
     finding: DefectFinding,

package/src/scripts/_lib/self_repair_store.ts

@@ -11,7 +11,14 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { type DefectFinding, type DefectRecord, fingerprint, mergeRecord } from './self_repair.js';
+import {
+    creationCapReached,
+    type DefectFinding,
+    type DefectRecord,
+    type DefectSource,
+    fingerprint,
+    mergeRecord,
+} from './self_repair.js';
 
 export const STORE_REL = path.join('agents', 'runtime', 'self-repair');
 
@@ -61,7 +68,10 @@ export function listRecords(root: string): DefectRecord[] {
     }
     const out: DefectRecord[] = [];
     for (const n of names.sort()) {
-        if (!n.endsWith('.json')) {
+        // The overflow counter shares the directory and the extension but is not
+        // a record. `isRecord` would reject it anyway; naming it here keeps the
+        // exclusion intentional rather than incidental.
+        if (!n.endsWith('.json') || n === OVERFLOW_FILE) {
             continue;
         }
         const rec = readRecord(root, n.slice(0, -'.json'.length));
@@ -77,13 +87,63 @@ export function openRecords(root: string): DefectRecord[] {
     return listRecords(root).filter((r) => r.status === 'open');
 }
 
+/**
+ * Per-source counters for findings the creation cap refused. ONE file for the
+ * whole store, so the overflow record is bounded by construction — it is the
+ * counter a runaway writer increments instead of the file it would otherwise
+ * mint. Deliberately NOT a `DefectRecord`: an overflow is not a defect and must
+ * not need a `DefectClass`, an issue-form dropdown entry, or an egress route.
+ */
+export const OVERFLOW_FILE = '_overflow.json';
+
+export type OverflowCounts = Partial<Record<DefectSource, { dropped: number; last_seen: string }>>;
+
+function overflowPath(root: string): string {
+    return path.join(storeDir(root), OVERFLOW_FILE);
+}
+
+export function readOverflow(root: string): OverflowCounts {
+    try {
+        const parsed: unknown = JSON.parse(fs.readFileSync(overflowPath(root), 'utf-8'));
+        return typeof parsed === 'object' && parsed !== null ? (parsed as OverflowCounts) : {};
+    } catch {
+        return {};
+    }
+}
+
+function bumpOverflow(root: string, source: DefectSource, now: string): void {
+    const counts = readOverflow(root);
+    const prev = counts[source]?.dropped ?? 0;
+    counts[source] = { dropped: prev + 1, last_seen: now };
+    const dir = storeDir(root);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(overflowPath(root), `${JSON.stringify(counts, null, 2)}\n`, 'utf-8');
+}
+
 /**
  * Fold a finding into the store: increments the existing record when the
- * fingerprint matches, otherwise opens a new one. Returns the stored record.
+ * fingerprint matches, otherwise opens a new one. Returns the stored record, or
+ * `null` when the per-source creation cap refused to open a new one.
+ *
+ * A refusal is COUNTED, never silent — `readOverflow` carries the per-source
+ * drop tally, so "the cap fired" is a readable fact rather than a defect that
+ * disappeared. A cap that quietly discarded reports would break this loop's own
+ * Iron Law (a defect is queued, never shrugged off) in the name of bounding it.
  */
-export function upsertFinding(root: string, finding: DefectFinding, now: string): DefectRecord {
+export function upsertFinding(
+    root: string,
+    finding: DefectFinding,
+    now: string,
+): DefectRecord | null {
     const fp = fingerprint(finding.defect_class, finding.evidence);
-    const merged = mergeRecord(readRecord(root, fp), finding, now);
+    const existing = readRecord(root, fp);
+    // The fold path never consults the cap: a fingerprint already in the store
+    // adds no file, so capping it would silence a tracked defect for no bound.
+    if (existing === null && creationCapReached(listRecords(root), finding, now)) {
+        bumpOverflow(root, finding.source, now);
+        return null;
+    }
+    const merged = mergeRecord(existing, finding, now);
     writeRecord(root, merged);
     return merged;
 }

package/src/scripts/_lib/subagent_capsule.ts

@@ -232,10 +232,35 @@ export interface MainSessionRecycleEnvelope {
      * of silent. Required; an empty list is a claim, not a default.
      */
     not_carried_forward: string[];
-    /** Choices already made, each with its one-line rationale in the same line. */
+    /**
+     * Choices already made, each with its one-line rationale in the same line.
+     *
+     * A line MAY close with a reversibility tag — `[reversible]` or
+     * `[irreversible]` — so the successor can tell "we picked A over B, easy to
+     * revisit" from "we already migrated the data". The tag is OPTIONAL, so no
+     * committed envelope is retroactively invalid; when present its spelling is
+     * validated, which is what keeps it a checkable field rather than a doctrine
+     * nobody can verify. No claim is made that it improves resumption — that
+     * stays the registered, unmeasured `envelope_resume_success` metric.
+     */
     decisions?: string[];
     /** Binding constraints the successor must not silently re-open. */
     constraints?: string[];
+    /**
+     * Paths the successor must NOT modify — a parallel worktree, a file another
+     * session holds, a generated projection whose source lives elsewhere.
+     *
+     * Distinct from `constraints`, which carries decisions in prose: this is a
+     * list of path refs, so "was this path off limits?" is answerable by
+     * comparison instead of by reading. That checkability is the whole reason it
+     * is a field rather than a sentence — the same bar the handoff-envelope
+     * adjudication set (a field whose presence is checkable survives where a
+     * doctrine whose effect is unmeasured did not).
+     *
+     * Optional: an envelope with nothing off limits states nothing here, and an
+     * empty list is not a claim that everything is writable.
+     */
+    do_not_touch?: string[];
     /** Open worker CHECKPOINT envelopes by path — never inlined bodies. */
     open_worker_envelopes?: string[];
     /** Artifact paths (deliverables, notes, evidence) — refs, never bodies. */
@@ -444,6 +469,54 @@ export function hasBoundaryMarker(block: string): boolean {
     );
 }
 
+/** The two accepted reversibility tags, exact spellings. */
+export const DECISION_REVERSIBILITY_TAGS: readonly string[] = ['reversible', 'irreversible'];
+
+/**
+ * Validate the OPTIONAL trailing reversibility tag on a decision line.
+ *
+ * Fires only on a line that closes with a bracket whose content is trying to be
+ * one of the two tags — `[reversble]`, `[Irreversible!]`, `[reversible?]`. A
+ * bracket used for anything else (`[ADR-109]`, `[see #1273]`) is left alone, and
+ * a line with no bracket at all is the untagged default. So the check catches a
+ * typo in a tag someone MEANT to write, which is the only failure a
+ * presence-checkable optional field can actually have: a silently misspelled tag
+ * reads as "untagged" and loses the distinction the tag exists to carry.
+ */
+export function decisionTagErrors(decisions: unknown): string[] {
+    if (!Array.isArray(decisions)) {
+        return [];
+    }
+    const errors: string[] = [];
+    for (const line of decisions) {
+        if (typeof line !== 'string') {
+            continue;
+        }
+        const m = /\[([^\]]*)\]\s*$/.exec(line.trimEnd());
+        if (m === null) {
+            continue;
+        }
+        const inner = (m[1] ?? '').trim();
+        const lowered = inner.toLowerCase();
+        if (DECISION_REVERSIBILITY_TAGS.includes(lowered)) {
+            if (inner !== lowered) {
+                errors.push(
+                    `decisions: reversibility tag must be lower-case — got \`[${inner}]\`, expected \`[${lowered}]\``,
+                );
+            }
+            continue;
+        }
+        if (/^i?rr?ever[a-z]*[^a-z]*$/i.test(lowered)) {
+            errors.push(
+                `decisions: \`[${inner}]\` is not a reversibility tag — use exactly ` +
+                    DECISION_REVERSIBILITY_TAGS.map((t) => `\`[${t}]\``).join(' or ') +
+                    ', or drop the bracket',
+            );
+        }
+    }
+    return errors;
+}
+
 /** Every key `validateRecycleEnvelope` accepts — anything else is schema-invalid. */
 const RECYCLE_ENVELOPE_KEYS: ReadonlySet<string> = new Set([
     'capsule_version',
@@ -457,6 +530,7 @@ const RECYCLE_ENVELOPE_KEYS: ReadonlySet<string> = new Set([
     'not_carried_forward',
     'decisions',
     'constraints',
+    'do_not_touch',
     'open_worker_envelopes',
     'artifact_paths',
     'assumptions',
@@ -519,7 +593,10 @@ export function validateRecycleEnvelope(input: unknown): string[] {
     checkList(errors, 'remaining', e['remaining'], MAX_LINE_CHARS, true);
     checkList(errors, 'not_carried_forward', e['not_carried_forward'], MAX_LINE_CHARS, true);
     checkList(errors, 'decisions', e['decisions'], MAX_LINE_CHARS, false);
+    errors.push(...decisionTagErrors(e['decisions']));
     checkList(errors, 'constraints', e['constraints'], MAX_LINE_CHARS, false);
+    // Path refs, so the REF budget applies — not the prose one `constraints` uses.
+    checkList(errors, 'do_not_touch', e['do_not_touch'], MAX_REF_CHARS, false);
     checkList(errors, 'open_worker_envelopes', e['open_worker_envelopes'], MAX_REF_CHARS, false);
     checkList(errors, 'artifact_paths', e['artifact_paths'], MAX_REF_CHARS, false);
     checkList(errors, 'suggested_skills', e['suggested_skills'], MAX_REF_CHARS, false);

package/src/scripts/ai_council/events_log.ts

@@ -27,6 +27,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { isEnvKillSwitchActive } from '../_lib/env_kill_switch.js';
 import { isSoloConcluded, type QuorumResult } from './quorum.js';
 import type { AbsentReason } from './transport_resolver.js';
 
@@ -139,8 +140,7 @@ function _utf8Bytes(cp: number): string {
 }
 
 function _kill_switch_active(): boolean {
-    const value = process.env[_KILL_SWITCH_ENV] ?? '';
-    return !(value === '' || value === '0' || value === 'false' || value === 'False');
+    return isEnvKillSwitchActive(_KILL_SWITCH_ENV);
 }
 
 export interface AppendEventOptions {

package/src/scripts/ai_council/orchestrator.ts

@@ -58,6 +58,7 @@ import type { AdvisorPlan } from './advisors.js';
 import {
     advisor_system_prompt,
     ANTI_CONFORMITY_DIRECTIVE,
+    describe_verdict_mismatch,
     STANCE_LINE_CONTRACT,
     build_extraction_user_prompt,
     build_peer_review_user_prompt,
@@ -65,6 +66,7 @@ import {
     peer_review_synthesis_addendum,
     synthesis_template,
     system_prompt_for,
+    VERDICT_LINE_CONTRACT,
 } from './prompts.js';
 import { count_dissenters, dissent_quota_met, is_near_duplicate } from './debate_gates.js';
 import { parse_stance_line, render_vote_tally, tally_stances } from './stance_tally.js';
@@ -1927,6 +1929,23 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
         // addendum so both extensions stack predictably.
         template = template ? `${template}\n\n${CHAIRMAN_FIELDS_ADDENDUM}` : CHAIRMAN_FIELDS_ADDENDUM;
     }
+    if (opts.stance_tally === true && template !== '') {
+        // Phase 2.1: the synthesis owes the same machine-readable closing line
+        // the members owe. Appended only when a tally will be rendered — there
+        // is nothing to check a verdict against otherwise. Composed last so it
+        // is the final instruction, matching the contract's "and nothing after
+        // it". The template's own `VERDICT: <option-label>` placeholder is
+        // parsed as absent (see `parse_verdict_line`), so the un-summarised
+        // render stays green.
+        //
+        // The `template !== ''` guard is load-bearing: an empty template is
+        // `prose_synthesis: true`, documented at `:1859-1862` as a BARE slot.
+        // Appending here would replace `*to be summarised by the host agent*`
+        // with raw contract instructions and silently override an option the
+        // caller set on purpose — a creative-lens pass would start reading like
+        // a filled-in form.
+        template = `${template}\n\n${VERDICT_LINE_CONTRACT}`;
+    }
     let body: string;
     if (template) {
         body = template;
@@ -1951,6 +1970,25 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
                 .map((r) => ({ member: `${r.provider}:${r.model}`, text: r.text })),
         );
         blocks.push(render_vote_tally(tally));
+        // Phase 2.1: the verdict half of the same projection. A synthesis that
+        // states a `VERDICT:` line the tally did not clear is contradicting its
+        // own count, and the reader of the rendered pass is exactly who needs to
+        // see that.
+        //
+        // Surfaced, never thrown, and the ordering above is part of the fix: a
+        // throw here would discard the whole artifact — every member response,
+        // the peer review, the quorum bookkeeping — AFTER every provider call
+        // was paid for, which is the hazard this roadmap already recorded for
+        // the sibling shape check. `describe_verdict_mismatch` returns the
+        // string; `assert_synthesis_matches_tally` still throws for a caller
+        // holding a finished synthesis it can refuse.
+        //
+        // Conditional by construction: an absent verdict line yields null, so
+        // every synthesis written before the contract shipped stays byte-identical.
+        const mismatch = describe_verdict_mismatch(body, tally);
+        if (mismatch !== null) {
+            blocks.push(`> **Verdict/tally mismatch:** ${mismatch}`);
+        }
     }
     blocks.push(`## Convergence / Divergence\n\n${body}`);
     // Phase 4.1: closest to the synthesis it was extracted from — ahead of

package/src/scripts/ai_council/prompts.ts

@@ -460,9 +460,19 @@ export const REQUIRED_SYNTHESIS_SECTIONS = ['Kill criteria', 'Concrete next step
  * fills the Convergence / Divergence slot) — not the template prompt. Every
  * lens must close with a non-empty `### Kill criteria` and `### Concrete next
  * step`; a missing or placeholder-empty section throws `SynthesisRenderError`
- * naming the first offender. Called on the synthesis-emit path (the chairman
- * synthesis in Phase 2, and any future synthesis-record step); safe to call on
- * decision and creative lenses alike, since both now require the two sections.
+ * naming the first offender. Safe to call on decision and creative lenses
+ * alike, since both now require the two sections.
+ *
+ * **Not wired onto the emit path, deliberately.** This docstring used to claim
+ * it was "called on the synthesis-emit path"; measured, the function had zero
+ * production call sites and only the test imported it. Wiring it
+ * unconditionally into `render()` is not available either: with no chairman the
+ * rendered body is the literal `*to be summarised by the host agent*`, which
+ * carries neither section, so every templated render would throw (verified —
+ * the probe raises `missing the required "### Kill criteria" section`). A
+ * caller that HAS a completed synthesis calls this; the templated default path
+ * has nothing to validate. The tally check below is the half that could be
+ * wired, because it is conditional on a verdict line the template never emits.
  */
 export function assert_synthesis_sections(text: string): void {
     const lines = text.split('\n');
@@ -488,6 +498,158 @@ export function assert_synthesis_sections(text: string): void {
     }
 }
 
+/** The reserved verdict label a synthesis uses when the tally did not converge. */
+export const SPLIT_VERDICT_LABEL = 'split';
+
+// Mirrors `_STANCE_RE`'s shape discipline: an explicit, single-field closing
+// line, never read out of surrounding prose.
+//
+// **Case-SENSITIVE, deliberately.** The `i` flag was here and was wrong: the
+// pattern is line-anchored, so `Verdict: option A is the stronger choice` —
+// ordinary chairman prose opening a line — parsed as a machine-readable verdict
+// carrying the whole sentence as its label. That is precisely the prose
+// inference the paragraph above forbids, arriving through the regex instead of
+// through a fallback. `VERDICT_LINE_CONTRACT` asks for the literal uppercase
+// token, so requiring it costs a compliant author nothing and closes the class.
+const _VERDICT_RE = /^\s*VERDICT:\s*(.+?)\s*$/gm;
+
+/**
+ * Mandatory closing-line contract for a synthesis rendered alongside a stance
+ * tally. The synthesis states its verdict as a machine-readable label rather
+ * than leaving it to be mined out of the recommendation prose — the same
+ * discipline `STANCE_LINE_CONTRACT` imposes on members.
+ */
+export const VERDICT_LINE_CONTRACT = `Close the synthesis with EXACTLY this line, and nothing after it:
+VERDICT: <option-label>
+Use the SAME <option-label> the Vote Tally cleared. Use \`${SPLIT_VERDICT_LABEL}\` when no option cleared the threshold — an honest split is a verdict, and claiming a winner the tally did not record is a render error.`;
+
+/**
+ * Parse the synthesis verdict line. Returns the LAST match (the final,
+ * most-authoritative one) or `null` when no well-formed line exists.
+ *
+ * `null` is a repair marker, never a guess: this function does not fall back to
+ * reading agreement out of the prose. That is the invariant `stance_tally`
+ * states for members ("the tally never infers a stance from the surrounding
+ * prose") and the one `check_finding_dispositions` states for the release
+ * ledger ("a comment is mutable and unaudited; it is transport, not a record").
+ */
+export function parse_verdict_line(text: string): { label: string; display: string } | null {
+    _VERDICT_RE.lastIndex = 0;
+    let last: RegExpExecArray | null = null;
+    let m: RegExpExecArray | null;
+    while ((m = _VERDICT_RE.exec(text)) !== null) {
+        last = m;
+    }
+    if (last === null) {
+        return null;
+    }
+    const raw = (last[1] ?? '').trim();
+    if (raw.length === 0) {
+        return null;
+    }
+    // An angle-bracketed label is the CONTRACT's own placeholder, not a verdict.
+    // This matters on the templated path: with no chairman the rendered body IS
+    // `VERDICT_LINE_CONTRACT`'s template text, so a parser without this guard
+    // would read `<option-label>` as a claimed winner and throw on every
+    // un-summarised render. Same treatment `assert_synthesis_sections` gives a
+    // placeholder-empty section.
+    if (/^<.*>$/.test(raw)) {
+        return null;
+    }
+    return { label: raw.toLowerCase(), display: raw };
+}
+
+/**
+ * Validate a completed synthesis against the stance tally it was rendered
+ * beside: a verdict naming a winner the tally did not clear throws
+ * `SynthesisRenderError`, the same way a missing section does.
+ *
+ * The defect this closes: `assert_synthesis_sections` is a *shape* check, so a
+ * synthesis could report agreement over a tally that recorded dissent and
+ * nothing downstream disagreed. That is the class behind the recorded 9.14.0
+ * release failure, where the head read "Security and correctness: none" over a
+ * critical finding — `check_finding_dispositions.ts` is the same check on the
+ * release surface.
+ *
+ * **An absent verdict line does not throw.** It is a repair marker under the
+ * same rule as an unparseable stance: the fail-safe direction is to record that
+ * the claim was not made, never to infer one from prose. That also keeps every
+ * synthesis rendered before `VERDICT_LINE_CONTRACT` shipped green.
+ */
+export function assert_synthesis_matches_tally(text: string, tally: TallyView): void {
+    const mismatch = describe_verdict_mismatch(text, tally);
+    if (mismatch !== null) {
+        throw new SynthesisRenderError(mismatch);
+    }
+}
+
+/** The slice of a `StanceTallyResult` the verdict check reads. */
+export interface TallyView {
+    consensus: { label: string } | null;
+    split: boolean;
+    options: ReadonlyArray<{ label: string }>;
+}
+
+/**
+ * The same comparison as `assert_synthesis_matches_tally`, returning the
+ * mismatch as a string instead of throwing — `null` means "no contradiction".
+ *
+ * **Why both shapes exist.** Throwing is right for a caller holding a finished
+ * synthesis it can refuse. It is wrong on the render path: `render()` throws
+ * before the tally and the Convergence blocks are pushed, so a mismatch would
+ * destroy the ENTIRE artifact — every member response, the peer review, the
+ * quorum bookkeeping — *after* every provider call has already been paid for.
+ * The module's own answer for an unverifiable claim is the `needs_repair`
+ * marker `render_vote_tally` prints, not a discarded pass, and the roadmap had
+ * already recorded that unconditionally wiring the sibling shape check was
+ * unsafe for this same reason. So the render path surfaces the contradiction
+ * where a reader will see it and keeps the artifact.
+ */
+export function describe_verdict_mismatch(text: string, tally: TallyView): string | null {
+    const verdict = parse_verdict_line(text);
+    if (verdict === null) {
+        return null; // repair marker, not a guess
+    }
+    // The reserved sense of `split` yields to a real option that carries the
+    // same label (R2 finding 8): the label vocabulary is free text mined from
+    // member `STANCE:` lines, so nothing stops an option genuinely called
+    // `split`, and when the tally clears it the CORRECT verdict would otherwise
+    // read as a contradiction. Deciding by whether the tally actually holds
+    // that option keeps one namespace without an escape syntax authors would
+    // have to learn.
+    const optionNamedSplit = tally.options.some(
+        (o) => o.label.toLowerCase() === SPLIT_VERDICT_LABEL,
+    );
+    const claimsSplit = verdict.label === SPLIT_VERDICT_LABEL && !optionNamedSplit;
+
+    if (tally.consensus === null) {
+        if (claimsSplit) {
+            return null;
+        }
+        // `split` is the tally's own word for this state; reading it here rather
+        // than re-deriving "no consensus ⇒ split" keeps the message honest when
+        // the tally is empty (zero options is not a split across zero options).
+        const how = tally.split
+            ? `split across ${tally.options.length} option(s)`
+            : 'no option-level stances parsed';
+        return (
+            `synthesis claims "${verdict.display}" but the tally recorded no consensus ` +
+            `(${how}); use \`${SPLIT_VERDICT_LABEL}\` or re-run the round`
+        );
+    }
+
+    if (claimsSplit) {
+        return `synthesis claims a split but the tally cleared "${tally.consensus.label}"`;
+    }
+    if (verdict.label !== tally.consensus.label.toLowerCase()) {
+        return (
+            `synthesis claims "${verdict.display}" but the tally cleared ` +
+            `"${tally.consensus.label}"`
+        );
+    }
+    return null;
+}
+
 /**
  * Drop any *whole line* containing a host-agent identity substring.
  *

package/src/scripts/ai_council/quorum.ts

@@ -93,6 +93,16 @@ export function evaluateQuorum(
  * full-attendance one. Advisory render and telemetry only: no gate reads it,
  * and nothing downstream may branch on it without its own decision record.
  *
+ * ONE such record now exists, and it is deliberately narrow: ADR-224
+ * (`docs/decisions/ADR-224-gate-scoped-solo-attendance-floor.md`) authorizes a
+ * `min_present: 2` floor to branch on this predicate **for gate-class passes
+ * only**, decided against a measured 12.5 % solo-conclusion rate. Nothing has
+ * landed yet — no caller branches on it today — so the sentence above still
+ * describes the code. It is stated here so a reader finds the authorization
+ * instead of re-deriving the prohibition, and so the next branch is visibly a
+ * separate argument: the exception is gate-class passes, not solo status
+ * generally.
+ *
  * `total` is deliberately NOT consulted. A council configured with a single
  * member concludes solo by construction, and that is still a conclusion
  * reached on one voice — collapsing it into "not solo" would hide exactly

package/src/scripts/ai_team/review_gate.ts

@@ -42,6 +42,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { claude_config_dir, CODEX_MARKETPLACE_NAME, CODEX_PLUGIN_ID } from '../_lib/claude_plugin.js';
+import { isEnvKillSwitchActive } from '../_lib/env_kill_switch.js';
 import { atomic_write_json } from '../hooks/state_io.js';
 import { AI_TEAM_DEFAULTS, load_ai_team_config, type AiTeamConfig } from './config.js';
 
@@ -170,8 +171,7 @@ export function circuit_breaker_notice(bound: number): string {
 // ── ledger (events-log convention) ──────────────────────────────────
 
 function _kill_switch_active(): boolean {
-    const value = process.env[_KILL_SWITCH_ENV] ?? '';
-    return !(value === '' || value === '0' || value === 'false' || value === 'False');
+    return isEnvKillSwitchActive(_KILL_SWITCH_ENV);
 }
 
 function _iso_seconds_z(d: Date): string {