@rune-kit/rune 2.24.0 → 2.25.0

package/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <strong>Less skills. Deeper connections.</strong><br>
   A lean, interconnected skill ecosystem for AI coding assistants.<br>
-  65 skills · 204 connections · 43 signals · 13 platforms · MIT
+  66 skills · 206 connections · 45 signals · 13 platforms · MIT
 </p>
 
 <p align="center">
@@ -23,7 +23,7 @@
 
 Most skill ecosystems are either **too many isolated skills** (540+ that don't talk to each other) or **rigid pipelines** (A → B → C, if B fails everything stops).
 
-Rune is a **mesh** — 65 skills with 204 connections + 43 signals across a 5-layer architecture. Skills call each other bidirectionally, forming resilient workflows that adapt when things go wrong.
+Rune is a **mesh** — 66 skills with 206 connections + 45 signals across a 5-layer architecture. Skills call each other bidirectionally, forming resilient workflows that adapt when things go wrong.
 
 ```
 Pipeline:  A → B → C → D         (B fails = stuck)
@@ -103,7 +103,11 @@ Plus **9 domain packs** (product, sales, data-science, support, growth, media, p
 
 ---
 
-## What's New (v2.24.0 — Market Refresh)
+## What's New (v2.25.0 — Council)
+
+> **v2.25.0 (2026-07-11):** New **`council`** L3 primitive — genuinely decorrelated multi-perspective gathering. Detects installed AI CLIs, fans a question across distinct model families (external CLIs when present, subagents when not), gates off-topic/malformed voices, normalizes claims (anchor-first + shared-evidence arbiter fallback — prose similarity never counts), and arbitrates inline with an honest `NO_DECORRELATION` stamp when fewer than 2 real model families answered. Wired into 4 consumers: `adversary` (CRITICAL-tier plans), `review` (high-blast-radius diffs), `brainstorm` (Design-It-Twice candidate judgment), `problem-solver` (high-stakes conclusions) — every integration explicitly refuses to launder a same-family run as independent confirmation. **Live-dogfooded same day**: a real 3-voice self-test (external `grok` dispatch + 2 subagent fallbacks) independently converged on a real gap — "confirmed" `model_family` was CLI-brand identity, not verified backend identity, letting two CLIs redirected to the same backend (BYOK/proxy override) defeat the gate — fixed before shipping. **Pro**: `council-cockpit` (separate repo) adds a read-only live panel + cost-aware allocation + history-informed family weighting, PRE-council advisory only — Free never depends on Pro. Mesh now 66 skills / 208 connections / 45 signals.
+
+### Previous (v2.24.0 — Market Refresh)
 
 > **v2.24.0 (2026-07-11):** Model lineup + platform adapters refreshed to the mid-2026 landscape. Claude tiers across the mesh → **Opus 4.8 / Sonnet 5 / Haiku 4.5**; the **Codex** adapter → **GPT-5.6** `sol` / `terra` / `luna` (verified against codex-cli 0.144.1), with a suggested tier→`model_reasoning_effort` mapping in the generated `AGENTS.md`. **Fable 5** is positioned as an API-only frontier **oracle** target rather than a routing tier (opus stays the ceiling). **Windsurf → Devin Desktop** rebrand documented (emission kept on `.windsurf/`, which Devin still reads). New **goal-first advisory** in `plan`/`ba` to leverage native `/goal` + Managed Agents Outcomes. CI 1572/1572.
 
@@ -249,7 +253,7 @@ cook ───emit:phase.complete────→ session-bridge
 
 ## What Rune Is (and Isn't)
 
-Rune started as a **Claude Code plugin** and now compiles to **every major AI IDE**. Same 65 skills, same mesh connections, same workflows — zero knowledge loss across platforms.
+Rune started as a **Claude Code plugin** and now compiles to **every major AI IDE**. Same 66 skills, same mesh connections, same workflows — zero knowledge loss across platforms.
 
 | | Rune Provides | Claude Code Provides |
 |---|---|---|
@@ -341,14 +345,14 @@ npx @rune-kit/rune init --platform windsurf
 npx @rune-kit/rune init --platform antigravity
 ```
 
-This compiles all 65 skills into your IDE's rules format. Same knowledge, same workflows.
+This compiles all 66 skills into your IDE's rules format. Same knowledge, same workflows.
 
 ### Platform Comparison
 
 | Feature | Claude Code | Cursor / Windsurf / Others |
 |---------|-------------|---------------------------|
-| Skills available | 64/64 | 64/64 |
-| Mesh connections | 204 sync + 43 signals (programmatic) | 204 sync + 43 signals (rule references) |
+| Skills available | 66/66 | 66/66 |
+| Mesh connections | 206 sync + 45 signals (programmatic) | 206 sync + 45 signals (rule references) |
 | Workflows & HARD-GATEs | Full | Full |
 | Extension packs | 14 | 14 |
 | Subagent parallelism | Native | Sequential fallback |
@@ -702,7 +706,7 @@ See [docs/MULTI-PLATFORM.md](docs/MULTI-PLATFORM.md) for the full architecture.
 | Doc | What's inside |
 |-----|---------------|
 | [`docs/GETTING_STARTED.md`](docs/GETTING_STARTED.md) | Your first 5 minutes with Rune — install to first `/rune cook` |
-| [`docs/SKILLS.md`](docs/SKILLS.md) | All 65 skills, searchable by intent and layer |
+| [`docs/SKILLS.md`](docs/SKILLS.md) | All 66 skills, searchable by intent and layer |
 | [`docs/SIGNALS.md`](docs/SIGNALS.md) | Canonical signal inventory — 25 events, emit/listen graph |
 | [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) | 5-layer mesh architecture reference |
 | [`docs/VISION.md`](docs/VISION.md) | Philosophy — what Rune is and isn't |
@@ -715,10 +719,10 @@ See [docs/MULTI-PLATFORM.md](docs/MULTI-PLATFORM.md) for the full architecture.
 ## Numbers
 
 ```
-Core Skills:       64 (L0: 1 │ L1: 5 │ L2: 30 │ L3: 28)
+Core Skills:       66 (L0: 1 │ L1: 5 │ L2: 30 │ L3: 30)
 Extension Packs:   14 free + 9 pro + 4 business
-Mesh Connections:  203 sync calls (rune doctor)
-Mesh Signals:      43 signals · 55 emit/listen edges (rune doctor)
+Mesh Connections:  206 sync calls (rune doctor)
+Mesh Signals:      45 signals · 55 emit/listen edges (rune doctor)
 Connections/Skill: 3.2 avg
 Platforms:         8 (Claude Code, Cursor, Windsurf, Antigravity, Codex, OpenCode, OpenClaw, Generic)
 Compiler:          ~1400 LOC (parser + 8 transforms + 8 adapters + CLI)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "description": "65-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 204 connections + 43 signals, multi-platform compiler. converge (L3) scans spec vs code so dead-button/frontend-only implementations can't ship.",
   "type": "module",
   "bin": {

package/skills/adversary/SKILL.md

@@ -3,7 +3,7 @@ name: adversary
 description: "Pre-implementation red-team analysis. Use when a plan is high-risk, critical path, or expensive to reverse. Challenges plans before code is written — finds edge cases, security holes, scalability bottlenecks, error propagation risks, and integration conflicts. Catches flaws at plan time (10x cheaper than post-implementation)."
 metadata:
   author: runedev
-  version: "0.4.0"
+  version: "0.5.0"
   layer: L2
   model: opus
   group: quality
@@ -41,6 +41,7 @@ Every finding MUST reference the specific plan section, file, or assumption it c
 - `hallucination-guard` (L3): verify that APIs, packages, or patterns referenced in the plan actually exist
 - `context-engine` (L3): (oracle-mode) emit `context.preview` before bundle build to gate token cost
 - `session-bridge` (L3): (oracle-mode) detach protocol when target model is opus-class for non-blocking dispatch
+- `council` (L3): Step 0.6 — decorrelated multi-perspective critique for CRITICAL-tier plans (one-way-door decisions, auth/payment/crypto/user-data), mode=critique
 
 ## Called By (inbound)
 
@@ -58,6 +59,7 @@ Every finding MUST reference the specific plan section, file, or assumption it c
 - `adversary` → `perf` — scalability concern raised → perf quantifies the bottleneck
 - `adversary` → `scout` — integration risk flagged → scout finds affected code
 - `adversary` → `plan` — CRITICAL findings → plan revises before implementation
+- `adversary` → `council` — CRITICAL-tier plan (one-way-door decision, or auth/payment/crypto/user-data) → decorrelated critique before red-teaming
 
 ## Execution
 
@@ -93,6 +95,35 @@ produces concrete remediations (likely HARDEN), but maps to REVISE if it exposes
 structural flaw in the chosen approach; Socratic's surfaced assumptions and Pre-mortem's
 narratives become findings.
 
+### Step 0.6: Decorrelated Multi-Perspective Gathering (council, CRITICAL-tier only)
+
+adversary's own single pass is one model's opinion, however rigorous. For the subset of plans
+where being wrong is expensive enough to justify it, call `rune:council` (mode=critique) before
+Steps 1-5, instead of (or in addition to) solo analysis.
+
+**Trigger — call council when ANY of:**
+- Step 0.5 selected the **Dialectic** or **Pre-mortem** lens (one-way-door architecture/vendor
+  decisions, irreversible migrations — exactly the cases where a second architecture's blind
+  spots differing from yours has the highest expected value)
+- The plan touches auth, payment, crypto, or user data at a severity that would otherwise
+  trigger mandatory `sentinel` escalation (Step 2)
+- The user explicitly asks for a second opinion or "gut check" before committing
+
+**Do NOT call council for**: Quick Challenge mode plans, plans under 3 files with no
+auth/payment/data logic, or routine feature work — council is opt-in overhead, not a default
+tax on every adversary run (see council's own Sharp Edges: never auto-fires on every plan).
+
+**Request**: `{ question: <steelmanned thesis + the specific risk being tested>, mode: "critique",
+n: 3, diversity: { prefer_model_families: true }, evidence_required: [reasoning, citation] }`.
+The question MUST be self-contained — council's voices have no access to this conversation.
+
+**Consume**: fold `CouncilResult.agreement.consensus_claims` into the relevant dimension's
+findings below, tagged `[council-verified]`. Fold `agreement.dissent` into that dimension's
+findings too, but tagged `[council-dissent]` — dissent is information, not something to
+resolve by picking a side. If `decorrelation: NO_DECORRELATION`, do not describe the result as
+a second opinion in the report — say plainly that no independent model family was reachable and
+the additional voices were same-family subagents.
+
 ### Step 1: Edge Case Analysis
 
 Challenge the plan's handling of boundary conditions.
@@ -212,6 +243,9 @@ Synthesize all findings into an actionable report.
 - 3+ HIGH findings → **REVISE**
 - HIGH findings with clear remediations → **HARDEN** (add remediations to plan, then proceed)
 - Only MEDIUM/LOW findings → **PROCEED** (note findings for implementation awareness)
+- If council was invoked (Step 0.6) and returned `needs_decision: true` → the verdict cannot be
+  PROCEED regardless of adversary's own findings; surface the unresolved dissent to the user
+  instead of silently picking a side
 
 After reporting:
 - If verdict is REVISE: return to `plan` with findings attached as constraints
@@ -225,6 +259,7 @@ After reporting:
 - **Plan analyzed**: [path to plan file]
 - **Dimensions checked**: [which of the 5 were relevant]
 - **Reasoning lens**: [Red Team | Pre-mortem | Evidence Audit | Dialectic | Socratic — and why]
+- **Council**: [not invoked | MULTI_FAMILY (N families) | NO_DECORRELATION — same-family subagents only]
 - **Findings**: [count by severity]
 - **Verdict**: REVISE | HARDEN | PROCEED
 
@@ -347,6 +382,8 @@ See `references/oracle-mode.md` for the full protocol and integration with `debu
 | (cross-model) External CLI invoked without authorization or in non-interactive run | CRITICAL | Per-call user authorization required; non-interactive → skip + announce. See `references/cross-model-escalation.md` |
 | (cross-model) Bundle interpolated into shell args — embedded `$(...)` executes | CRITICAL | Always pass via stdin from a temp file; read-only sandbox. Never inline `-p "<bundle>"` |
 | (cross-model) Rubber-stamping the external reviewer's verdict | MEDIUM | Reply is data, not ruling — reconcile against the artifact; classify each finding |
+| (council) Reporting council output as consensus when decorrelation is NO_DECORRELATION | CRITICAL | Step 0.6 consume rule: report the decorrelation stamp plainly, never imply independent validation from same-family subagents |
+| (council) Calling council on every plan, not just CRITICAL-tier | MEDIUM | Step 0.6 trigger list is explicit — Dialectic/Pre-mortem lens, auth/payment/crypto/user-data, or explicit user request only |
 
 ## Done When
 
@@ -358,6 +395,7 @@ See `references/oracle-mode.md` for the full protocol and integration with `debu
 - Findings formatted for consumption by cook Phase 3 (if PROCEED) or plan (if REVISE)
 - Strength Notes section acknowledges well-designed aspects of the plan
 - (oracle-mode) If dispatched: response cited file:line for each claim, or `oracle.failed` emitted with rejection reason
+- (council) If CRITICAL-tier trigger matched: council invoked before Steps 1-5, its decorrelation stamp reported plainly, consensus/dissent folded into the relevant dimension findings
 
 ## Returns
 
@@ -371,6 +409,6 @@ See `references/oracle-mode.md` for the full protocol and integration with `debu
 
 ## Cost Profile
 
-~4000-8000 tokens input (plan + codebase context), ~2000-3000 tokens output. Opus model for adversarial depth. Runs once per feature plan — high cost justified by preventing wasted implementation cycles.
+~4000-8000 tokens input (plan + codebase context), ~2000-3000 tokens output. Opus model for adversarial depth. Runs once per feature plan — high cost justified by preventing wasted implementation cycles. When Step 0.6 fires (CRITICAL-tier only): add council's cost profile (~1500-4000 tokens per voice × 2-5 voices) — reserved for the minority of plans where being wrong is expensive.
 
 **Scope guardrail:** adversary reviews THE PLAN only — never audits existing codebase quality or rewrites code.

package/skills/brainstorm/SKILL.md

@@ -3,7 +3,7 @@ name: brainstorm
 description: "Creative ideation and solution exploration. Generates multiple approaches with trade-offs, uses structured frameworks (SCAMPER, First Principles), and hands off to plan for structuring."
 metadata:
   author: runedev
-  version: "0.7.0"
+  version: "0.8.0"
   layer: L2
   model: opus
   group: creation
@@ -57,6 +57,7 @@ Activated when exploring alternative *interface shapes* for a deepening candidat
 3. Diversity score MUST be >= 0.4 before presenting (re-spawn once if below)
 4. Recommendation MUST be opinionated with a concrete hedge condition — "it depends" is BLOCKED
 5. Hybrid synthesis (Step 4.5) is opt-in when 2 designs have complementary strengths
+6. council (Step 3.75) is opt-in per the narrow trigger — MUST NOT fire on every design-it-twice run, and its output MUST NOT replace the diversity-score mechanism, only supplement it
 
 Full doctrine: [references/design-it-twice.md](references/design-it-twice.md).
 
@@ -110,6 +111,7 @@ Direct API call ≠ Wrapper/middleware layer ≠ Reverse engineering ≠ Browser
 - `trend-scout` (L3): market context and trends for product-oriented brainstorming
 - `problem-solver` (L3): structured reasoning frameworks (SCAMPER, First Principles, 6 Hats)
 - `sequential-thinking` (L3): evaluating approaches with many variables
+- `council` (L3): Step 3.75 — decorrelated judgment on which Design-It-Twice candidate is strongest, narrow trigger only (Design-It-Twice Mode)
 
 ## Called By (inbound)
 
@@ -126,6 +128,7 @@ Direct API call ≠ Wrapper/middleware layer ≠ Reverse engineering ≠ Browser
 
 - `brainstorm` ↔ `plan` — bidirectional: brainstorm generates options → plan structures the chosen one, plan needs exploration → brainstorm ideates
 - `brainstorm` → `ba` — a standalone brainstorm that picks an approach for a NEW feature with no requirements spec routes to `ba` first (WHAT before HOW). Suppressed when `ba` is the caller — that direction is `ba` → `brainstorm` and re-invoking would loop.
+- `brainstorm` → `council` — Design-It-Twice candidates ready + high-stakes trigger fires (Step 3.75) → decorrelated judgment on the strongest candidate before Step 4 Recommend
 
 ## Reasoning Frameworks
 
@@ -300,6 +303,21 @@ diversity = 1 - mean(pairwise_jaccard(feature_vectors))
 
 Emit `diversity_score` in chain_metadata.
 
+### Step 3.75 — Decorrelated Judgment (council, Design-It-Twice Mode only)
+
+The diversity score (Step 3.5) measures how DIFFERENT the candidate designs are — it says nothing about which one is BEST. For high-stakes interface decisions, that judgment call benefits from a second architecture's opinion, the same discipline `adversary` Step 0.6 and `review` Step 1.6 already apply.
+
+**Trigger — call council (mode=judge) when ANY of:**
+- N=4 was spawned (dependency category `remote-owned` or `true-external`, per Step 2.5 — the same tier that already signals higher stakes)
+- Diversity landed in the 0.4–0.59 marginal band (Step 3.5) and a re-spawn still didn't clearly separate the candidates
+- User explicitly asks for a second opinion on which design to pick
+
+**Do NOT call council for**: routine Design-It-Twice runs where diversity ≥ 0.6 on an in-process/local-substitutable dependency (N=3) — this is opt-in overhead on top of the existing subagent fan-out, not a default tax on every design-it-twice run.
+
+**Request**: `{ question: <the candidate designs' interface/usage/tradeoffs YAML + "which design is strongest given constraints X">, mode: "judge", n: 3, diversity: { prefer_model_families: true }, evidence_required: [reasoning] }`. Self-contained — council's voices never saw the subagent spawns.
+
+**Consume**: fold `agreement.consensus_claims` into Step 4's recommendation as a `[council-verified]` signal alongside (never instead of) the diversity score. Fold `agreement.dissent` into the hedge condition, tagged `[council-dissent]`. If `decorrelation: NO_DECORRELATION`, say so plainly — do NOT describe the judgment as independent confirmation from same-family subagents; the diversity-score mechanism remains the primary signal in that case.
+
 ### Step 4 — Recommend
 
 Select ONE approach as the recommendation. State:
@@ -419,6 +437,7 @@ If the user rejects the recommendation, return to Step 2 with adjusted constrain
 9. [Design-It-Twice Mode] MUST spawn parallel subagents with one constraint pinned per agent — fake diversity (one agent producing N options) is BLOCKED
 10. [Design-It-Twice Mode] MUST emit `diversity_score` and re-spawn (once) if below 0.4 floor
 11. [Design-It-Twice Mode] MUST NOT produce "it depends" recommendations — pick one design with a concrete hedge condition
+12. [Design-It-Twice Mode] MUST NOT call council on every run — narrow trigger only (N=4 remote/external dependency, marginal diversity band, or explicit user request); when invoked, council output supplements (never replaces) the diversity-score mechanism
 
 ## Output Format
 
@@ -486,6 +505,7 @@ Known failure modes for this skill. Check these before declaring done.
 | [Design-It-Twice] Diversity score below 0.4 ignored | HIGH | Step 3.5 gate — re-spawn once; if still low, present with explicit "low-diversity" warning |
 | [Design-It-Twice] "It depends" recommendation | HIGH | Step 4 — must pick one with a hedge; if genuinely tied, propose hybrid (Step 4.5) and recommend that |
 | [Design-It-Twice] Forgetting to include CONTEXT.md domain terms in subagent prompt | MEDIUM | Step 2.5 spawn template requires domain glossary be passed through |
+| [Design-It-Twice] Reporting council output as consensus when decorrelation is NO_DECORRELATION | CRITICAL | Step 3.75 consume rule: report the decorrelation stamp plainly, never imply independent confirmation from same-family subagents |
 
 ## Done When
 
@@ -496,6 +516,7 @@ Known failure modes for this skill. Check these before declaring done.
 - Constraints for plan phase listed explicitly
 - Step 5 spec-presence gate evaluated — routed to `ba` (new feature, no spec, standalone) or `plan` (spec exists, or ba/cook was the caller, or no new behavior)
 - Next skill (`ba` or `plan`) called with the approved approach and constraints
+- (Design-It-Twice) If council's high-stakes trigger matched (Step 3.75): council invoked before Step 4, decorrelation stamp reported plainly, consensus/dissent folded into the recommendation alongside the diversity score
 
 ## Cost Profile
 

package/skills/brainstorm/references/design-it-twice.md

@@ -107,8 +107,9 @@ diversity = 1 - mean(similarity(d_i, d_j) for all i < j)
    - **Locality** — where change concentrates
    - **Seam placement** — internal vs external; ports yes/no
    - **Common-case trivial-ness** — how much work for the default path
-3. **Opinionated recommendation** — strongest design + concrete hedge condition for when to pick a different one
-4. **Hybrid synthesis (optional Step 4.5)** — if 2 designs have complementary strengths, propose a 4th synthesized option that combines them
+3. **Council check (SKILL.md Step 3.75)** — if the narrow high-stakes trigger fired, note `[council-verified]`/`[council-dissent]` tags inline in the comparison table or as a short addendum. If `decorrelation: NO_DECORRELATION`, say so plainly — never present it as a second opinion.
+4. **Opinionated recommendation** — strongest design + concrete hedge condition for when to pick a different one
+5. **Hybrid synthesis (optional Step 4.5)** — if 2 designs have complementary strengths, propose a 4th synthesized option that combines them
 
 Skip the comparison table if N=2 (just 1 contrast, prose handles it).
 
@@ -152,4 +153,6 @@ chain_metadata:
     constraints_used: [C1, C2, C4]
     recommendation: <design-id>
     hybrid_proposed: <true|false>
+    council_invoked: <true|false>
+    council_decorrelation: <MULTI_FAMILY|NO_DECORRELATION|null>
 ```

package/skills/council/SKILL.md

@@ -0,0 +1,222 @@
+---
+name: council
+description: "Gathers N independent, decorrelated perspectives across model families (external CLIs when present, subagents when not) and arbitrates inline. Use when a decision needs genuine debate — not same-model echo — for critique, review, or judge calls. Honest about degradation: never claims 'consensus' from a single model family."
+user-invocable: true
+metadata:
+  author: runedev
+  version: "0.1.0"
+  layer: L3
+  model: sonnet
+  group: reasoning
+  tools: "Read, Write, Bash, Grep, Glob, Task"
+  emit: council.dispatched, council.result
+---
+
+# council
+
+## Purpose
+
+One coordination primitive that gathers N INDEPENDENT perspectives for any skill needing debate or multi-view judgment. Detects installed AI CLIs → fans a question across distinct model families → degrades gracefully to subagents when no bridge exists → gates off-topic/malformed voices → normalizes claims → **arbitrates INLINE** (no separate arbiter skill — single producer→single consumer is YAGNI).
+
+Council's entire value proposition is *decorrelated* model bias — two different architectures independently reaching the same conclusion is signal; two instances of the same model agreeing is an echo. council refuses to launder the second case as the first.
+
+<HARD-GATE>
+If fewer than 2 distinct real `model_family` values answered (excluding `is_fallback` voices AND voices with `model_family: "unknown"` — unconfirmed wrapper-CLI backends, see `references/dispatch-protocol.md` §Detect), council MUST stamp the run `NO_DECORRELATION` and the Arbitrate step MUST NOT use consensus language ("voices agree", "consensus view", "the panel concludes"). Say what happened instead: "N subagents of the same model family produced overlapping output — treat as one perspective, not independent confirmation."
+</HARD-GATE>
+
+## Triggers
+
+- Called by `adversary` — Step 0.6, mode=critique, for plans flagged high-risk/critical-path/expensive-to-reverse
+- Called by `review` — Step 1.6, mode=review, when blast radius is 50+ callers with a HIGH-severity change
+- Called by `brainstorm` — Step 3.75, mode=judge, Design-It-Twice Mode only, when N=4 spawned for a remote/external dependency, diversity landed in the 0.4-0.59 marginal band, or the user requests a second opinion on which candidate design is strongest
+- Called by `problem-solver` — Step 6.5, mode=judge, when a one-way-door decision has a high-impact top solution, or the ethical dimension check surfaced a severe harm/fairness concern
+- `/rune council <question>` — manual multi-perspective gathering on any question
+- Auto-trigger: none (always explicit — council is expensive relative to a single pass, callers opt in)
+
+## Calls (outbound)
+
+None at the skill level — council dispatches via `Bash` (external CLI bridge) and `Task` (subagent fallback) directly. It does not call other Rune skills.
+
+## Called By (inbound)
+
+- `adversary` (L2): Step 0.6 — decorrelated critique before red-teaming a high-risk plan
+- `review` (L2): Step 1.6 — decorrelated bug-finding when blast radius escalation fires
+- `brainstorm` (L2): Step 3.75 — decorrelated judgment on which Design-It-Twice candidate is strongest, narrow trigger only
+- `problem-solver` (L3): Step 6.5 — decorrelated judgment on whether a high-stakes framework conclusion holds (documented L3→L3 coordination)
+- User: `/rune council` direct invocation
+
+## Data Flow
+
+### Feeds Into →
+
+- `adversary` (L2): `CouncilResult.agreement` → seeds Step 6 Verdict with cross-family-verified findings instead of (or alongside) single-pass analysis
+- `review` (L2): `CouncilResult.agreement` → seeds Step 6 Report's CRITICAL/HIGH findings for the escalated symbol
+- `brainstorm` (L2): `CouncilResult.agreement` → seeds Step 4 Recommend with cross-family-verified judgment on the strongest candidate design, alongside (never replacing) the diversity score
+- `problem-solver` (L3): `CouncilResult.agreement` → seeds Step 6's top solution with a cross-family-verified soundness check before Step 7 communication structuring
+- `.rune/council/run-*.json`: every run's full result — free tier owns this schema; Pro Council Cockpit (deferred, Phase 2) reads it for a live panel
+
+### Fed By ←
+
+- Caller's `PerspectiveRequest` — question, mode, n, diversity constraints, evidence requirements (see `.rune/council-voice-contract.md`)
+- `.rune/runtimes.json` — cached CLI detection from the current session
+
+## Workflow
+
+Contract source of truth: `.rune/council-voice-contract.md` (Voice v2). This section is the executable protocol; the contract file is the schema. If the two disagree, the contract wins — update this file to match, don't silently drift.
+
+### Step 1: DETECT
+
+1. Check for a cached runtime report at `.rune/runtimes.json`. If it exists and is from the current session (same date), reuse it — skip to Step 2.
+2. Otherwise probe for the `1devtool-agent` bridge (the local CLI that fans prompts out to installed AI coding agents — Claude, Codex, Gemini, Antigravity, Cline, Amp, OpenCode, Qwen, Grok, Aider). Detection and family-mapping details: `references/dispatch-protocol.md` §Detect.
+3. Write `.rune/runtimes.json`: `{ detected: [{runtime, status, model_family, version}], checked_at: <session marker>, bridge_path: <resolved path> }` — exact field list owned by `references/dispatch-protocol.md` §Detect, keep the two in sync.
+4. No bridge found → `runtime_report.detected = []`. This is not an error — proceed straight to subagent-only mode (Step 3 DEGRADE).
+
+### Step 2: ALLOCATE
+
+1. Read `request.n` (2-5) and `request.diversity.prefer_model_families`.
+2. Rank available runtimes by distinct `model_family` — prefer 1 voice per distinct family before doubling up on any family.
+3. Reserve mandatory slots per the Voice Contract's correlated-agreement guards, scaled to `n`:
+   - **`n >= 3`**: reserve both — **Perturbation slot** (inverted framing — argue the opposite starting position) and **Devil's-advocate slot** (mandated to argue AGAINST the majority as it forms; voices run independently/blind, so this is a *framing* instruction, not a sequencing one).
+   - **`n == 2`**: reserve the Perturbation slot only, leave the second slot answering the question plainly. Reserving both at `n=2` would leave zero voices reading the question at face value, which starves ARBITRATE of a baseline reading to compare the perturbation against.
+4. If falling back to subagents for some/all slots (Step 3), pin each subagent to a distinct persona/constraint using the `brainstorm` Design-It-Twice technique (each subagent pinned to exactly ONE stance — enforced via prompt template) — this does NOT create real decorrelation (same model family), but it reduces prose-verbatim groupthink, which matters for the correlated-agreement guards in Step 5.
+5. Compose each voice's prompt as **fully self-contained** — external voices have zero conversation context. Include: the question, the mode, evidence requirements, and (for critique/review modes) the artifact or plan text inline. Never say "see above" or "as discussed."
+
+### Step 3: DISPATCH + DEGRADE
+
+0. **Skeleton write** (live-status entry point): before dispatching anything, write `.rune/council/run-<request.id>.json` with every allocated slot present and `status: "queued"` (no claims yet). This is what makes the run file useful for a live reader (e.g. Pro Council Cockpit, deferred to Phase 2) — without this write, a run in progress is indistinguishable from a run that hasn't started.
+
+For each allocated slot:
+
+1. **External slot** (`source: external-cli`): update that voice's `status: "running"` in the run file, dispatch per `references/dispatch-protocol.md` §Dispatch with `budget.per_voice_timeout_s` enforced. On timeout or non-zero exit → mark `is_fallback: true` and immediately dispatch a subagent for that slot instead (do not drop the slot) — update `status` back to `"running"` for the fallback attempt, not straight to failed.
+2. **Subagent slot** (`source: subagent`): update `status: "running"`, dispatch via `Task` with the persona/constraint from Step 2.4 baked into the prompt. `runtime: "internal"`, `model_family: "anthropic"`, `is_fallback: false` if this was the slot's original allocation, `is_fallback: true` if it's covering a dead external slot.
+3. Run all slots in parallel (single message, multiple tool calls) — sequential dispatch defeats the purpose of gathering independent perspectives at reasonable cost.
+4. As each slot resolves (raw response received, whether or not it will later pass GATE), record `latency_ms` and update that voice's `status: "complete"` in the run file — GATE (Step 4) may still later flip a completed voice to `"dropped"`, but "complete" at this point means "produced a raw answer," not "counted toward the result." Populate `runtime_report.used` / `runtime_report.degraded_to_subagent` at the same time.
+5. **Write after every status transition**, not just at the end — overwrite `.rune/council/run-<request.id>.json` each time a voice moves `queued → running → complete`. This is a small file; the incremental writes are what make "live per-voice status" (per the Voice Contract) real rather than aspirational. A caller or Cockpit reading the file mid-run sees genuine progress, not a stale skeleton.
+
+### Step 4: GATE
+
+For each raw voice response, before it counts toward anything:
+
+1. **Well-formed check**: does the response parse into the expected Voice shape (stance + claims, each claim with `text` and optionally `anchor`/`evidence`)? Malformed → `validity.well_formed: fail`, `dropped_by: "council.gate"`, add to `voices_dropped[]` with the raw-output reason. Do not attempt to salvage a malformed response by re-prompting mid-run — that's a retry loop the contract doesn't budget for.
+2. **On-topic check (the Agy fix)**: extract what the voice *thinks* it answered into `question_echo`, compare against `request.question`. If the voice answered a different question than asked (common failure mode for wrapper CLIs that inject their own system framing) → `validity.on_topic: fail`, `dropped_by: "council.gate"`, drop it.
+3. Every dropped voice MUST appear in `voices_dropped[]` with `{runtime, reason, dropped_by}` — no silent drops. A voice that fails gate is not "missing," it's "dropped for reason X" — the caller and any human reading the run file need to know a slot was spent and produced nothing usable.
+4. Flip that voice's `status: "complete" → "dropped"` in the run file for anything gated out here (per Step 3.5's incremental-write convention) — a live reader should see the drop, not just infer it from the voice being absent later.
+
+### Step 5: NORMALIZE (claim-matching)
+
+Determines whether two voices made "the same claim" — meaningless until defined, so apply this exact strategy, in order:
+
+1. **Anchor match (deterministic, cheap)**: two claims match if they share the same `anchor` (`file:line`, `plan-step-id`, or `symbol`). No inference needed.
+2. **Arbiter cluster (fallback for keyless claims)**: for claims without a matching anchor, group by semantic similarity — but a cluster is only a valid match if the grouped claims **share at least one `evidence.ref`**. Prose/wording similarity ALONE never establishes a match — two voices using similar phrasing because they were trained on similar data is exactly the correlation this primitive exists to detect and discount, not average away.
+3. Record `matched_by: {method: "anchor"|"arbiter", model: <this council run's identity>}` on every match.
+4. **Verification gate**: a claim's `evidence.verified` MUST be set by a `verified_by` that is NOT the voice that produced the claim (mechanical check — run the test/repro yourself, or have a different-family voice check it — never trust self-certification). Claims with `verified: unchecked` or self-certified `verified_by` do not count toward consensus, regardless of how many voices repeated them.
+5. **Correlated-agreement penalty**: if 2+ voices' claim text is near-verbatim (same phrasing, same examples), treat this as a correlation signal — **regardless of what `model_family` label those voices carry.** Do NOT gate this check on "same family or unknown family" — `model_family` is itself an unverified, CLI-brand-based label (see Sharp Edges: "confirmed" family is not runtime-verified), so requiring the labels to already look correlated before checking for textual correlation defeats the one heuristic that could catch a family-label error behaviorally. Near-verbatim text from voices with DIFFERENT confirmed families is not proof of a mislabeling, but it is not free confirmation either — flag it in `agreement.dissent` as "near-verbatim across confirmed-distinct families — either genuine convergent reasoning or a sign the family labels don't reflect the actual backends" and do NOT let it anchor a `consensus_claims` entry on textual similarity alone (Step 5.2's anchor/shared-evidence.ref requirement still applies). Near-verbatim text from the same family or an unconfirmed wrapper is the stronger, unambiguous case — note it in `agreement.dissent` even if the claim itself is correct, so the caller doesn't over-weight it.
+
+### Step 6: ARBITRATE (inline)
+
+1. Apply the min-decorrelation gate (see HARD-GATE above): count distinct real `model_family` values among voices that passed GATE, **excluding both `is_fallback` voices AND voices with `model_family: "unknown"`** (unconfirmed wrapper-CLI backends — see `references/dispatch-protocol.md` §Detect; an unconfirmed wrapper is not evidence of a distinct architecture, it may be the same backend as another voice in the run). `< 2` → `decorrelation: NO_DECORRELATION`. `>= 2` → `decorrelation: MULTI_FAMILY`.
+2. Build `agreement.consensus_claims`: clusters (from Step 5) with **>= 2 voices from >= 2 distinct, confirmed `model_family` (never `unknown`), all evidence `verified: true`**. Anything short of this bar is NOT consensus — label it `unverified agreement` and put it in `agreement.dissent` with that label, not in `consensus_claims`.
+3. Build `agreement.dissent`: everything else — genuine disagreement, unverified agreement, single-voice claims, and the correlated-agreement-penalty notes from Step 5.5. Dissent is surfaced, NEVER averaged away or silently dropped in favor of a "majority view."
+4. Check the perturbation slot (Step 2.3): did the claims that survive the inverted framing match the claims from the standard framing? Agreement that survives inversion is trustworthy; agreement that doesn't is flagged in dissent as "framing-sensitive."
+5. Check the devil's-advocate slot (skip if `n == 2` — no such slot was reserved per Step 2.3): if it produced no substantive counter-claims after genuinely trying, note that in Strength Notes-equivalent (the forming majority held up under a mandated attack) — this is useful positive signal, not a wasted slot.
+6. Set `needs_decision: true` if dissent contains a CRITICAL/HIGH-severity claim that no consensus resolves — the caller (adversary/review) should surface this to the user rather than silently picking a side.
+7. Final write of `.rune/council/run-<request.id>.json` with the full `CouncilResult` (schema: `.rune/council-voice-contract.md`) — this overwrites the skeleton/incremental versions from Step 3.0/3.5/4.4 with the complete arbitrated result; every voice's `status` should now read `complete` or `dropped`, never `queued`/`running`.
+8. Emit `council.dispatched` at Step 3 start, `council.result` after Step 6 write completes.
+
+## Output Format
+
+```
+## Council Result: [request.id]
+- **Question**: [request.question]
+- **Mode**: critique | generate | judge | review
+- **Decorrelation**: MULTI_FAMILY | NO_DECORRELATION
+- **Voices**: [voices_valid]/[voices_requested] valid ([N] dropped)
+- **Runtime**: [detected families] → [used] (degraded: [N])
+
+### Consensus (verified, cross-family)
+- [claim] — voices: [ids], families: [list]
+
+### Dissent
+- [claim] — [voice id] — [reason: disagreement | unverified | correlated-penalty | framing-sensitive]
+
+### Needs Decision
+[If true: the specific unresolved CRITICAL/HIGH claim, framed for the caller to surface to the user]
+```
+
+## Returns
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `result` | CouncilResult (JSON) | Full structured result per Voice Contract v2 — see `.rune/council-voice-contract.md` |
+| `decorrelation` | enum | `MULTI_FAMILY` \| `NO_DECORRELATION` — the honesty stamp, always present |
+| `agreement.consensus_claims` | array | Only cross-family, verified claims — may be empty |
+| `agreement.dissent` | array | Never empty if any voice disagreed or agreement was unverified/correlated |
+| `voices_dropped` | array | Every gated-out voice with reason — never silent |
+| `run_file` | path | `.rune/council/run-<id>.json` — full artifact for caller or Pro Cockpit |
+
+## Constraints
+
+1. MUST stamp `NO_DECORRELATION` and strip consensus language when < 2 distinct real model families answered — this is the HARD-GATE, not a suggestion
+2. MUST NOT count prose/wording similarity alone as a claim match — anchor or shared evidence.ref only
+3. MUST NOT accept self-certified verification — `verified_by` must differ from the producing voice
+4. MUST record every dropped voice in `voices_dropped[]` with a reason — no silent drops
+5. MUST run all allocated voices in parallel, not sequentially — the value is independence, not throughput, but sequential dispatch adds latency without adding independence
+6. MUST NOT retry a malformed or off-topic voice mid-run — drop it via GATE and move on; retries reintroduce correlation with the prompt that just failed
+7. MUST NOT dispatch an external CLI without going through `references/dispatch-protocol.md` safety properties (authorization, read-only sandbox, stdin-not-args, binary preflight)
+8. MUST operate in JUDGMENT mode only (critique/review/judge) — `generate` mode is declared in the contract but deferred; if a caller requests `mode: generate`, respond with `NOT_IMPLEMENTED` rather than improvising artifact generation across voices
+
+## Mesh Gates
+
+| Gate | Requires | If Missing |
+|------|----------|------------|
+| Request Gate | Caller supplies a self-contained `PerspectiveRequest` (question, mode, n) | Cannot run — ask caller for a well-formed request |
+| Runtime Gate | None — council works with zero external CLIs by design | N/A — subagent-only mode is a valid, first-class outcome |
+
+## Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| Caller (or a future reader) treats `NO_DECORRELATION` output as consensus anyway | CRITICAL | HARD-GATE strips consensus wording at the source; Output Format always prints the decorrelation stamp first line |
+| Wrapper CLI (Cline/Amp/OpenCode/Aider) misreported as a distinct model family when its backend is actually Claude | HIGH | `references/dispatch-protocol.md` family map defaults unconfirmed wrapper backends to `unknown` — excluded from distinct-family count until confirmed |
+| Prose-similarity claims counted as consensus because arbiter clustering got lazy | CRITICAL | Step 5.2 hard requirement: shared `evidence.ref`, not text similarity, gates the arbiter-cluster match |
+| Self-certified verification (voice grades its own claim) | CRITICAL | Step 5.4: `verified_by` must differ from producing voice, mechanically checked |
+| Off-topic voice counted toward `n` because its answer merely looked substantive | HIGH | Step 4.2 `question_echo` vs `request.question` gate — the Agy fix — before anything downstream sees the voice |
+| External CLI hangs past `per_voice_timeout_s`, stalling the whole run | MEDIUM | Step 3.1: timeout triggers immediate subagent fallback for that slot, not a wait-and-retry |
+| Devil's-advocate/perturbation slots quietly reused as regular voices under time pressure | MEDIUM | Step 2.3 reserves them explicitly in ALLOCATE — Step 6.4/6.5 checks they were actually applied before arbitrating |
+| Bundle/prompt interpolated into shell args for external dispatch | CRITICAL | `references/dispatch-protocol.md` inherits adversary's stdin-only transport — never inline `-p "<bundle>"` |
+| Council invoked for every trivial decision, burning cost on low-stakes calls | MEDIUM | Triggers section: council is opt-in per caller (adversary high-risk gate, review blast-radius gate, brainstorm Design-It-Twice high-stakes gate, problem-solver one-way-door/ethics gate) — never auto-fires on every plan/diff/design/analysis |
+| **"Confirmed" `model_family` is CLI-brand identity, not verified runtime-backend identity** — a user pointing 2+ "confirmed" CLIs (e.g. `claude` + `codex`, or an IDE CLI like `agy` with a model picker) at the same actual backend via BYOK/proxy/gateway override collapses the real distinct-family count without tripping the `is_fallback`/`unknown` exclusions. Found via a real council self-test dispatch (2026-07-11, grok + 2 subagent voices independently converged on this). | CRITICAL, currently UNCLOSED | Step 5.5's near-verbatim check now fires regardless of family label (previous version only fired for same-family/unknown, which this exact scenario bypassed). There is no mechanical way to verify a CLI's actual serving backend from user-space today — council cannot cryptographically close this gap, only flag the behavioral symptom. Documented here rather than falsely claimed solved. |
+| GATE's `question_echo` on-topic check is self-reported by the same voice being graded — a shallow-but-parseable non-answer that echoes the question passes | MEDIUM | Partial: the arbiter reads the echoed question against the actual answer content at Step 6, not just the schema shape, so an echo with no substantive claims behind it still contributes little to consensus/dissent even if it technically passes GATE |
+
+## Self-Validation
+
+```
+SELF-VALIDATION (run before emitting output):
+- [ ] Decorrelation stamp computed from ACTUAL distinct model_family count, excluding is_fallback AND model_family:"unknown" (unconfirmed wrapper CLIs), not assumed
+- [ ] Every voice that reached ARBITRATE passed GATE (on_topic: pass, well_formed: pass)
+- [ ] Every dropped voice appears in voices_dropped[] with a reason
+- [ ] Every consensus_claims entry has >=2 voices from >=2 distinct CONFIRMED families (never unknown), all verified:true
+- [ ] No consensus_claims entry backed only by prose similarity (check matched_by.method)
+- [ ] No claim's verified_by equals its producing voice id
+- [ ] Perturbation slot dispatched with its reserved framing; devil's-advocate slot too (unless n==2, where only perturbation is reserved per Step 2.3)
+- [ ] .rune/council/run-<id>.json written with full CouncilResult
+- [ ] Run file was written incrementally (skeleton at Step 3.0, status updates through 3.5/4.4), not only once at the end — a live reader mid-run would have seen real progress
+IF ANY check fails → fix before reporting done. Do NOT defer to completion-gate.
+```
+
+## Done When
+
+- All allocated voices dispatched in parallel (external where available, subagent fallback where not)
+- Every voice gated (dropped or valid, never ambiguous)
+- Claims normalized via anchor-first/arbiter-cluster-with-shared-evidence strategy
+- Decorrelation honestly stamped (`MULTI_FAMILY` or `NO_DECORRELATION`)
+- Consensus built only from cross-family, mechanically-verified claims; everything else in dissent
+- `.rune/council/run-<id>.json` written
+- `council.result` emitted
+- Self-Validation checklist: all checks passed
+
+## Cost Profile
+
+~1500-4000 tokens input per voice (self-contained prompt, no shared conversation context) × N voices (2-5), plus ~500-1000 tokens for arbitration. External-CLI voices cost real wall-clock (subject to `per_voice_timeout_s`) but zero incremental Claude token cost. Sonnet model for the orchestrating pass (gate/normalize/arbitrate reasoning); dispatched voices use whatever model each runtime/subagent resolves to.
+
+**Scope guardrail**: council gathers and arbitrates perspectives — it does not implement fixes, does not rewrite the artifact under discussion, and does not run in `generate` mode (deferred to Phase 2 cockpit work). If asked to produce code or a revised plan, hand the arbitrated findings back to the caller (`adversary`/`review`) to act on.

package/skills/council/references/dispatch-protocol.md

@@ -0,0 +1,77 @@
+# Council Dispatch Protocol
+
+Concrete mechanics for Step 1 (DETECT) and Step 3 (DISPATCH) of `council`'s Workflow. This reference exists because the safe-transport rules are shared with `adversary`'s oracle-mode cross-model escalation — read that file first; this one adds council-specific detection, family mapping, and N-voice timeout/fallback handling on top.
+
+Base safety properties (do not duplicate — inherit): `../../adversary/references/cross-model-escalation.md` — explicit per-invocation authorization, read-only sandbox, stdin-not-inline-args, binary preflight, reconcile-as-data-not-verdict.
+
+## §Detect
+
+council's bridge is the `1devtool-agent` shim — a local CLI that fans a prompt out to whichever AI coding CLIs are actually installed (Claude, Codex, Gemini, Antigravity, Cline, Amp, OpenCode, Qwen, Grok, Aider) and returns the response. It ships as part of the user's local tooling, not as a Rune dependency — treat it as opportunistic and never assume it exists.
+
+1. Try `1devtool-agent list --json` on PATH.
+2. If not found on PATH, check the conventional per-user install location for the current OS (e.g. `~/.1devtool/bin/1devtool-agent` on POSIX, `%USERPROFILE%\.1devtool\bin\1devtool-agent.cmd` on Windows). Do not hardcode a specific user's path into the skill — resolve relative to the current user's home directory at run time.
+3. Neither found → `runtime_report.detected = []`. This is the expected, common case. Proceed to subagent-only mode. Do not surface this as a warning or error to the user — it's a normal degradation, not a misconfiguration.
+4. Found → run `list --json`, parse the returned CLI statuses (`detected` / `not-found` / version), map each `detected` entry's `--to=` id to its `model_family` per the table below, and cache:
+
+```json
+{
+  "checked_at": "<session-scoped marker, not a wall-clock timestamp>",
+  "bridge_path": "<resolved path>",
+  "detected": [
+    { "runtime": "codex", "status": "detected", "model_family": "openai", "version": "..." },
+    { "runtime": "gemini", "status": "detected", "model_family": "google", "version": "..." }
+  ]
+}
+```
+
+to `.rune/runtimes.json` — this is the canonical schema; `skills/council/SKILL.md` Step 1.3 must match it field-for-field. Reuse this cache for the rest of the session — do not re-run `list` on every council invocation. Only entries with `status: "detected"` are eligible for allocation in Step 2.
+
+### Model family map
+
+`1devtool-agent run --to=<agent>` accepts: `claude | codex | gemini | agy | cline | amp | opencode | qwen | grok | aider`. Map to `model_family` for the decorrelation count:
+
+| `--to=` value | `model_family` | Confidence |
+|---|---|---|
+| `claude` | `anthropic` | confirmed |
+| `codex` | `openai` | confirmed |
+| `gemini` | `google` | confirmed |
+| `agy` (Antigravity) | `google` | confirmed (Gemini-based) |
+| `grok` | `xai` | confirmed |
+| `qwen` | `alibaba` | confirmed |
+| `cline` / `amp` / `opencode` / `aider` | `unknown` | **wrapper CLI — backend model is user-configured and not reported by `list --json`** |
+
+Wrapper CLIs (`cline`, `amp`, `opencode`, `aider`) route to whatever backend model the user configured for them — frequently Claude or GPT. Labeling one of these as a distinct family without confirmation is exactly the "decorrelation theater" the min-decorrelation gate exists to prevent. Default `model_family: "unknown"` for these and **exclude `unknown` from the distinct-family count** in council's Step 6 ARBITRATE, same as `is_fallback` voices. If a future version can read the wrapper's actual configured backend (e.g. from its config file), promote it to a confirmed family — until then, treat it as unconfirmed.
+
+**"Confirmed" here means "this CLI is vendor-dedicated by product design," not "this specific invocation's response was verified to come from that vendor's model."** The distinction matters: any of the six "confirmed" rows above can, in principle, be redirected to a different backend by the user (BYOK / base-URL override / corporate LLM gateway) or, for IDE-style CLIs, a built-in model picker — and `1devtool-agent list --json` reports CLI identity, not the identity of the model that actually generated a given response. This table has no mechanism to detect that redirection; it is a real, currently-unclosed limitation (see `skills/council/SKILL.md` Sharp Edges), not something resolved by this table alone. Do not extend the `unknown` treatment to these six rows without confirmed evidence a specific one is commonly reconfigured — that would just move the same unverified-assumption problem, not fix it — but do not read "confirmed" here as cryptographically verified either.
+
+## §Dispatch
+
+For each external slot allocated in Step 2:
+
+1. Write the fully self-contained voice prompt (question + mode + evidence requirements + inline artifact) to a temp file. Never inline it into a shell argument.
+2. Invoke:
+
+```bash
+printf '%s' "$VOICE_PROMPT" | 1devtool-agent run --to=<agent> --prompt-stdin --timeout=<budget.per_voice_timeout_s> --json
+```
+
+   `--json` so the response comes back as a structured envelope council can parse into the Voice shape, rather than free text requiring re-parsing.
+3. Per-call authorization: dispatching through `1devtool-agent` is council's normal operating mode (not a rare escalation like adversary's oracle-mode), so it does not require a fresh user confirmation on every single voice within one council run — but the FIRST time in a session that council is about to dispatch to any external CLI, confirm with the user that fanning this question out to their installed AI CLIs is expected. In non-interactive contexts (CI, `/loop`, scheduled runs) skip external dispatch entirely and run subagent-only — announce the skip in the output, do not silently downgrade.
+4. Exit code 0 → parse the JSON envelope into a Voice (see main SKILL.md Step 4 GATE for validation). Non-zero exit or timeout → `is_fallback: true`, immediately dispatch a subagent for this slot instead (Step 3.2 in the main workflow). Do not retry the same external CLI a second time in the same run — one failure per slot is enough signal to fall back.
+5. Record `latency_ms` from dispatch to response (or to timeout) regardless of outcome.
+
+## Hard caps (inherited + council-specific)
+
+- Per-voice prompt ≤ 4k chars for the inline artifact portion (same cap as oracle-mode bundles) — truncate with an explicit `... [truncated]` marker rather than silently cutting content.
+- Max 5 voices per council run (contract's `n: 2..5`) — if a caller requests more, cap at 5 and note the cap in the output.
+- `per_voice_timeout_s` comes from the caller's `PerspectiveRequest.budget`; council does not invent its own default beyond what the contract specifies for the mode.
+
+## Checklist (dispatch-time)
+
+- [ ] Bridge detection cached in `.rune/runtimes.json` for this session — not re-probed per voice
+- [ ] Wrapper CLI family defaulted to `unknown` unless backend confirmed
+- [ ] Prompt delivered via stdin from a temp file — never inline-interpolated
+- [ ] First external dispatch this session confirmed with the user (not per-voice)
+- [ ] Non-interactive context → external dispatch skipped entirely, announced, subagent-only
+- [ ] Timeout or non-zero exit → immediate subagent fallback for that slot, no same-CLI retry
+- [ ] `latency_ms` recorded for every voice, success or failure

package/skills/problem-solver/SKILL.md

@@ -3,7 +3,7 @@ name: problem-solver
 description: "Structured reasoning frameworks for complex problems. 19 analytical frameworks, 12 cognitive bias detectors, 10 decomposition methods, 10 mental models, Cynefin domain classification, ethical dimension check, and 6 communication patterns. McKinsey-grade problem solving for AI coding assistants."
 metadata:
   author: runedev
-  version: "0.4.0"
+  version: "0.5.0"
   layer: L3
   model: sonnet
   group: reasoning
@@ -20,7 +20,7 @@ Inspired by McKinsey problem-solving methodology and cognitive science research
 
 ## Calls (outbound)
 
-None — pure L3 reasoning utility.
+- `council` (L3): Step 6.5 — decorrelated judgment on whether a high-stakes framework conclusion holds, narrow trigger only (documented L3→L3 coordination — see Step 6.5)
 
 ## Called By (inbound)
 
@@ -281,6 +281,21 @@ From the framework output, derive 2-3 actionable solutions. For each:
 
 Rank solutions by impact/effort ratio.
 
+### Step 6.5 — Decorrelated Judgment (council, high-stakes only)
+
+Step 2's bias check and Step 4's framework application are one model's reasoning, however structured. For the subset of problems where being wrong is expensive and hard to undo, call `rune:council` (mode=judge) on the tentative conclusion before Step 7's communication structuring — the same discipline `adversary` Step 0.6 applies to plans.
+
+**Trigger — call council when ANY of:**
+- Step 3b's Reversibility Filter classified the decision as a one-way door (irreversible) AND the top-ranked solution from Step 6 has `impact: high`
+- Step 5.5's Ethical Dimension Check surfaced a Harm or Fairness concern rated severe
+- User explicitly asks for a second opinion or "gut check" before committing to the conclusion
+
+**Do NOT call council for**: two-way-door decisions, decompositions, root-cause analyses, or any solution ranked `impact: low`/`medium` — council is opt-in overhead reserved for high-stakes/irreversible judgment calls, not a default tax on every problem-solver invocation.
+
+**Request**: `{ question: <problem statement + selected framework + reasoning chain + top-ranked solution — self-contained>, mode: "judge", n: 3, diversity: { prefer_model_families: true }, evidence_required: [reasoning] }`.
+
+**Consume**: fold `agreement.consensus_claims` into Step 6's top solution as a `[council-verified]` note that the framework's application and conclusion hold up under independent scrutiny. Fold `agreement.dissent` into that solution's "Bias risk" line, tagged `[council-dissent]` — dissent is surfaced, not resolved by picking a side. If `decorrelation: NO_DECORRELATION`, state plainly that no independent model family was reachable — do not claim the conclusion was externally validated.
+
 ### Step 7 — Select Communication Structure
 
 Choose how to present the analysis based on audience:
@@ -305,6 +320,7 @@ Structure the output report using the selected pattern.
 - Do not produce more than 3 recommended solutions — prioritize quality over quantity
 - Max 5 evaluation criteria in Weighted Matrix — more causes choice overload
 - Decompositions MUST pass MECE test — no overlapping or missing branches
+- [council] MUST NOT call council for every high-stakes-looking problem — narrow trigger only (one-way-door decision with a high-impact solution, or a severe ethical concern); when invoked, council output supplements Step 6, it does not replace bias-check/framework discipline
 
 ## Output Format
 
@@ -314,6 +330,7 @@ Structure the output report using the selected pattern.
 - **Domain**: [Clear / Complicated / Complex / Chaotic / Confused] — [one-line justification]
 - **Framework**: [chosen framework and reason]
 - **Confidence**: high | medium | low
+- **Council**: [not invoked | MULTI_FAMILY (N families) | NO_DECORRELATION — same-family subagents only]
 
 ### Bias Warnings
 - ⚠️ [Bias 1]: [how it might affect this analysis] → [debiasing action taken]
@@ -362,6 +379,7 @@ Structure the output report using the selected pattern.
 | Strawmanning the least-favored option | MEDIUM | Steel Manning: build strongest case for option you dislike before dismissing |
 | Running full PESTLE on a purely technical problem | LOW | PESTLE is for macro-environment — skip for algorithm/implementation choices |
 | Skipping ethics check on user-facing decisions | MEDIUM | Step 5.5: lightweight check — warnings not gates, but don't skip for stakeholder-affecting decisions |
+| (council) Reporting council output as consensus when decorrelation is NO_DECORRELATION | CRITICAL | Step 6.5 consume rule: report the decorrelation stamp plainly, never imply independent validation from same-family subagents |
 
 ## Done When
 
@@ -374,6 +392,7 @@ Structure the output report using the selected pattern.
 - 2-3 solutions ranked by impact/effort ratio with bias risk noted
 - Next Action identified (single most important immediate step)
 - Analysis Report emitted with communication structure
+- (council) If high-stakes trigger matched (Step 6.5): council invoked before Step 7, decorrelation stamp reported plainly, consensus/dissent folded into the top solution
 
 ## Cost Profile
 

package/skills/review/SKILL.md

@@ -3,7 +3,7 @@ name: review
 description: "Code quality review — patterns, security, performance, correctness. Finds bugs, suggests improvements, triggers fix for issues found. Escalates to opus for security-critical code."
 metadata:
   author: runedev
-  version: "1.3.0"
+  version: "1.4.0"
   layer: L2
   model: sonnet
   group: development
@@ -44,6 +44,7 @@ Every review MUST cite at least one specific concern, suggestion, or explicit ap
 - `sast` (L3): static analysis security scan on reviewed code
 - L4 extension packs: domain-specific review patterns when context matches (e.g., @rune/ui for frontend, @rune/security for auth code)
 - `neural-memory` | After review complete | Capture code quality insight
+- `council` (L3): Step 1.6 — decorrelated bug-finding on the diff when blast radius is 50+ callers with a HIGH-severity change, mode=review
 
 ## Called By (inbound)
 
@@ -63,6 +64,7 @@ Every review MUST cite at least one specific concern, suggestion, or explicit ap
 - `review` → `improve-architecture` — when reviewer flag mentions "shallow", "wrapper", "indirection", or pass-through pattern
 - `review` ← `fix` — complex fix requests self-review
 - `review` → `sentinel` — security-critical code → sentinel deep scan
+- `review` → `council` — blast radius 50+ callers with HIGH-severity change → decorrelated bug-finding on the diff
 
 ## Execution
 
@@ -95,6 +97,31 @@ Use Grep to count direct callers/importers of each modified symbol:
 Modifying a symbol with 50+ callers + HIGH severity change (logic, types, behavior) → adversarial analysis REQUIRED. Quick review is NOT sufficient for high-blast-radius changes.
 </HARD-GATE>
 
+### Step 1.6: Decorrelated Bug-Finding (council, high-blast-radius only)
+
+review's own pass is one model reading the diff once. For the same 50+ caller / HIGH-severity
+symbols that trigger the Step 1.5 HARD-GATE, call `rune:council` (mode=review) on the diff
+itself BEFORE writing up Step 2's findings — a second architecture reading the same code
+independently catches bugs a single pass rationalizes past.
+
+This is complementary to (not a replacement for) the existing adversary escalation: council
+here examines the ALREADY-WRITTEN diff for bugs; adversary examines plan-level risk before
+code exists. Both can fire on the same high-blast-radius change.
+
+**Request**: `{ question: <the diff, symbol name, and blast radius context — self-contained>,
+mode: "review", n: 3, diversity: { prefer_model_families: true },
+evidence_required: [repro, reasoning] }`.
+
+**Consume**: fold `agreement.consensus_claims` into Step 2's CRITICAL/HIGH findings, tagged
+`[council-verified]`. Fold `agreement.dissent` into MEDIUM findings or the report's NEEDS
+DISCUSSION section, tagged `[council-dissent]`. If `decorrelation: NO_DECORRELATION`, do not
+claim independent confirmation in the report — say plainly that no second model family was
+reachable.
+
+**Skip if**: blast radius is under 50 callers, or the change is not HIGH-severity — council is
+opt-in overhead reserved for the same tier that already requires adversarial escalation, not a
+default tax on every review.
+
 ### Step 2: Logic Check (Production-Critical Focus)
 
 Read each changed file. Prioritize bugs that **pass CI but break production** — these are the highest-value findings because linters and type checkers already catch the rest.
@@ -577,6 +604,7 @@ LOW       — style inconsistency, naming suggestion, minor refactor opportunity
 - **Files Reviewed**: [count]
 - **Findings**: [count by severity]
 - **Review Commit**: [git hash at time of review]
+- **Council**: [not invoked | MULTI_FAMILY (N families) | NO_DECORRELATION — same-family subagents only]
 - **Overall**: APPROVE | REQUEST CHANGES | NEEDS DISCUSSION
 
 ### Spec Compliance
@@ -672,6 +700,8 @@ chain_metadata:
 | Review loop exceeds 3 iterations without resolution | MEDIUM | Cap at 3 review loops. After 3rd iteration with unresolved findings → surface to user with "these findings persist after 3 fix attempts — needs human decision" |
 | Auto-fixing something that should have been ASK | HIGH | When in doubt, ASK. AUTO-FIX only for mechanical issues (dead imports, console.log). Anything involving intent or trade-offs = ASK |
 | Scope drift flagged on intentional refactoring | LOW | Scope drift is informational, not blocking. User can override with "intentional" — don't re-flag after override |
+| (council) Reporting council output as consensus when decorrelation is NO_DECORRELATION | CRITICAL | Step 1.6 consume rule: report the decorrelation stamp plainly, never imply independent confirmation from same-family subagents |
+| (council) Calling council on every review, not just high-blast-radius | MEDIUM | Step 1.6 skip condition matches the existing Step 1.5 HARD-GATE threshold exactly — no separate lower bar |
 
 ## Done When
 
@@ -681,7 +711,8 @@ chain_metadata:
 - Test coverage gaps identified and documented
 - UI anti-pattern checks ran for any frontend files in diff (or confirmed not applicable)
 - Structured report emitted with APPROVE / REQUEST CHANGES / NEEDS DISCUSSION verdict
+- (council) If blast radius 50+ with HIGH severity: council invoked on the diff, decorrelation stamp reported plainly, consensus/dissent folded into findings
 
 ## Cost Profile
 
-~3000-6000 tokens input, ~1000-2000 tokens output. Sonnet default, opus for security-critical reviews. Runs once per implementation cycle.
+~3000-6000 tokens input, ~1000-2000 tokens output. Sonnet default, opus for security-critical reviews. Runs once per implementation cycle. When Step 1.6 fires (high-blast-radius only): add council's cost profile (~1500-4000 tokens per voice × 2-5 voices) — reserved for the same tier that already requires adversarial escalation.