@twinsearth/w2m-dsh-plugin 0.10.4 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,107 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.0] — 2026-10-15
+
+**Committee governance (roadmap v4.10.0): one decision engine, ordered phases, weighted votes, retained dissent.**
+
+### Built now, wired to nothing — and that is the roadmap's own instruction
+
+ROADMAP §3 says a governance layer above a fleet *that has no disagreements yet* is indistinguishable from
+a delay, and that the council earns its place when two fleets want the same machine. So `council.mjs` ships
+as the decision engine, tested in isolation, with no caller. Building it now is justified because its
+semantics are testable; deploying it now would not be.
+
+### The three falsifying tests the roadmap names, as the suite's actual cases
+
+1. **A phase cannot be skipped.** `advance()` takes no argument, so there is no way to name a destination;
+   `goTo`/`setPhase`/`jumpTo` do not exist and a test asserts their absence. A vote before the vote phase
+   refuses with `COUNCIL_UNCLEARED_TO_VOTE`, and the message says why: *a vote on nothing*.
+2. **A vote's weights are reproducible from stored inputs.** `weightOf()` is a pure function of two stored
+   integers, so `recount()` reproduces an outcome on any machine. The falsification is in the suite: a
+   tampered weight is **detected** rather than reproduced, and the tally is asserted order-independent.
+3. **A decision is retrievable *with* its dissent.** Dissent is part of the `Decision` value, not a log
+   line, and `unanimous` is an explicit flag because an empty dissent list alone cannot distinguish
+   unanimous from unrecorded. A test seals a decision and checks that dropping a ballot changes the seal.
+
+### The design choice worth naming
+
+`weight = authority × (1 + reputation/100)`, so reputation is a bounded multiplier in `[1, 2)` and **can
+never overturn authority**: authority 49 at perfect reputation (98) still loses to a bare authority 99. A
+governance layer that let reputation outvote the authority model would be a second, undeclared authority
+model, and v4.7.0 already owns that question. A tie is a **refusal**, not a coin toss, because a split
+council is exactly the case a person must see — and the refusal carries the tally that shows the split.
+
+### Two design bugs the suite caught, both the same mistake
+
+`record()` sets the seal, and `adjourn` comes **after** `record`. Deriving "sealed" from `decision !== null`
+made `record()` block `advance()`, so the final phase was unreachable; and then having `advance()` consult
+the seal at all was self-contradictory for the same reason. The fix is the distinction the module now states
+explicitly: **the seal protects the decision, not the phase machine**. Conflating "decided" with "sealed"
+produced a state nobody could reach — twice.
+
+**28 tests, 0 failures.**
+
+## [0.10.5] — 2026-10-15
+
+**FLEET-RULES.md enters the tree, with this host's reachability measured and written down.**
+
+### What was actually wrong
+
+The 1.0.0 objective starts with *"local Windows and MacMini jointly"*, and on inspection the Windows host
+had never been a git participant at all: its working copy was not a repository, and every release so far had
+been published through the GitHub REST API rather than through git. That is a real gap and it was recorded
+as one rather than glossed over.
+
+### Why it was that way, measured rather than assumed
+
+`github.com:443` is unreachable from this host while every other GitHub endpoint answers. Three consecutive
+`git fetch` attempts failed after ~21 s each, and from the same process minutes apart:
+
+| Endpoint | Result |
+|---|---|
+| `github.com:443` | **TIMEOUT** |
+| `api.github.com:443` | OPEN 73 ms |
+| `codeload.github.com:443` | OPEN 77 ms |
+| `ssh.github.com:443` | OPEN 95 ms |
+| `objects.githubusercontent.com:443` | OPEN 228 ms |
+
+The blocking is **per hostname, not per port** — `ssh.github.com` answers on the same 443 that `github.com`
+does not. It is also **intermittent at the TCP layer**: a raw `net.connect` to `20.205.243.166:443` timed out
+while a `tls.connect` to the same IP with `servername: 'github.com'` completed `authorized: true` on TLS 1.3.
+An intermittent block is worse than a solid one, because a single success is not evidence the path works.
+
+The first two attempts at this treated the failure as a configuration problem and tried proxy settings and
+retries. Both were wrong, and both cost a round. The measurements are cheaper to read than to repeat, which
+is why they are now rule 8 of `FLEET-RULES.md` rather than a note in a session log.
+
+### What now works, and what the evidence is
+
+The repository is materialised from a `codeload` tarball (the one path that is reachable), giving a real git
+work tree containing exactly `main` — verified by hashing both trees: **227 files, 0 differences,
+`IDENTICAL`**. `scripts/fleet-sync.mjs` then ran against a real repository for the first time, having only
+ever been tested against a temporary one:
+
+| Step | Result |
+|---|---|
+| initial | `state=up-to-date action=none` |
+| local commit | `state=ahead action=push ahead=1` |
+| `--write` | `performed: true - pushed 1 commit(s)`; mirror and HEAD agree |
+| peer commit arrives | `state=behind action=fast-forward behind=1` |
+| `--write` | `performed: true - now at d42d5c0`; 228 files, peer file present |
+| final | `state=up-to-date action=none` |
+
+The same run also demonstrated the refusal path for free: when a fast-forward was rejected by git, the
+result was `performed: false`, the tree was **left untouched**, and the state stayed `behind` — an automatic
+sync that fails must not half-apply.
+
+### Stated plainly rather than implied
+
+This host can *pull* the truth and can *run* the sync machinery, but it **cannot push over git**. A round
+that needs a commit published must use the API, and a round that exercises `fleet-sync` must do it against a
+local bare remote. That is a real test of the state machine and **not** a test of the network, and the
+difference is written into the rule so it is not mistaken for one.
+
 ## [0.10.4] — 2026-10-15
 
 **A result channel over exit codes, for machines whose text cannot be read back.**

package/FLEET-RULES.md

@@ -0,0 +1,146 @@
+# Fleet working rules
+
+Standing rules for every machine and every session in this fleet. These are **rules**, not notes: a
+session that finds itself working around one of these is either misreading it or should be proposing an
+amendment, not quietly making an exception.
+
+Established 2026-10-14/15. Amended by appending with a date and a reason — never by deleting, because
+*"we believed X until we measured Y"* is itself knowledge, and it is what stops the same wrong conclusion
+being reached twice.
+
+---
+
+## 1. Broadcast, sync, merge — automatically, in the same fleet
+
+**Added 2026-10-15 at the operator's instruction.**
+
+Any machine that is in the same fleet **broadcasts its state, syncs from the fleet, and merges without
+being asked**. This is not an optimisation; it is the rule that removes the class of work that produced
+2026-10-14's largest time sink — a session holding one copy of the truth on one machine while another
+machine held a different copy, and a human having to notice.
+
+### What the rule means concretely
+
+| Verb | Obligation |
+|---|---|
+| **Broadcast** | Before finishing a unit of work, publish what changed to the shared record — commit to the remote, not to a local branch nobody else can see. |
+| **Sync** | On starting a unit of work, fetch. A machine that has not fetched does not know what it is working on. |
+| **Merge** | Reconcile rather than choose. Two machines that both changed something must end with one tree, not with one machine's version silently winning. |
+
+### The shared record is the remote
+
+One repository, one remote, `main` as the integration point. Local-only work is not broadcast, and a
+branch that is not pushed is a branch no other machine can sync from — which is why a work-in-progress
+reaches another machine as a **pushed branch**, never as a file copied by hand.
+
+### What must never be merged
+
+- **A tree that has not passed its own tests.** Merge is not the place to discover a failing suite. The
+  rule is: run the suite where the change will land, and merge after it is green.
+- **Generated or machine-local state.** `dist/`, `node_modules/`, `memory.jsonl`, state directories and
+  credentials are per-machine facts; broadcasting them would spread one machine's local state over
+  another's. The repository already excludes these at the release boundary, and the same list applies
+  here.
+- **Anything a machine could not itself verify.** An unverified claim is broadcast as *unverified*, never
+  as a fact — see rule 4.
+
+### Why the rule is safe to apply automatically
+
+Git's fast-forward is the common case: one machine ahead, everyone else behind. A genuine divergence is
+the case that needs judgement, so the automation is: **fast-forward automatically, rebase automatically
+when the local work is not yet published, and stop and report when both sides have published** — because
+that is the only case where merging could discard someone's verified work.
+
+---
+
+## 2. Do not claim a mechanism works from a scheduling record
+
+Added 2026-10-14, after two mistakes in one session.
+
+A dispatch being accepted, a lease being granted, and a verdict arriving are three different
+observations. The reliable evidence is **a side effect on the target machine**, or **an exit code that
+nothing else would produce**. "The relay said `exit_code: 0`" is not evidence that a command ran until
+something else corroborates it.
+
+## 3. Run the suite where the change will land
+
+Added 2026-10-14. A green suite on the development host and a green suite on the target machine are
+different claims, and only the second one supports a merge. `scripts/` and `test/` are absent from the
+published tarball by design, so "it passes at home" cannot be checked from an installed copy.
+
+## 4. Mark what could not be verified
+
+Added 2026-10-14. If a check cannot run here — no network, no installation, no credential — it is reported
+as `UNVERIFIED` with the reason, never as a pass. An unverifiable check is not a passing check.
+
+## 5. Facts carry their date and how they were measured
+
+Added 2026-10-14, from `fleet-memory.md`.
+
+A fact without provenance is a rumour that outlives the person who could have checked it. Correct in
+place with a note rather than deleting: the correction is part of the record.
+
+## 6. Machine roles are not interchangeable
+
+Added 2026-10-14.
+
+| Machine | Role | Constraint |
+|---|---|---|
+| the Linux relay host | relay, STUN, archive, and the development shell over SSH | no personal data |
+| MacMini | real-machine work: deploy, run, test, verify, report, and now development | no personal data |
+| `ToFuture` (the DSH host) | orchestration | **hard-protected**: nothing outside the session workspace or non-system `C:` folders without the operator typing the password |
+| other Windows hosts | as MacMini | — |
+
+## 7. A note about the rule itself
+
+Rule 1 says merge automatically. That is a real transfer of authority from the human to the machines, and
+it is only defensible while the checks in rules 2, 3 and 4 hold: **automatic merging is safe exactly to
+the extent that "green" is trustworthy.** If a suite is ever found to pass without testing what it names
+— which happened twice on 2026-10-14, once in a cycle-detection test that asserted nothing — then this
+rule is the thing that spreads the damage. So a test that does not test is not a small defect here; it is
+a hole in the merge gate.
+
+---
+
+## 8. This host's reachability, measured — do not re-derive it
+
+**Added 2026-10-15 after round 3 of the 1.0.0 goal, because the same wrong assumption cost three rounds.**
+
+The Windows host that writes this file cannot reach `github.com:443`. Measured, not inferred: three
+consecutive `git fetch` attempts each failed after ~21 s with *"Failed to connect ... Could not connect to
+server"*, while the following, probed from the same process minutes apart, all succeeded:
+
+| Endpoint | Result |
+|---|---|
+| `github.com:443` | **TIMEOUT** |
+| `api.github.com:443` | OPEN 73 ms |
+| `codeload.github.com:443` | OPEN 77 ms |
+| `ssh.github.com:443` | OPEN 95 ms |
+| `objects.githubusercontent.com:443` | OPEN 228 ms |
+
+The blocking is **per hostname, not per port** — `ssh.github.com` answers on the same 443 that
+`github.com` does not. It is also **intermittent at the TCP layer**: a raw `net.connect` to
+`20.205.243.166:443` timed out while a `tls.connect` to the same IP with `servername: 'github.com'`
+completed with `authorized: true` and TLS 1.3. An intermittent block is worse than a solid one, because a
+single success is not evidence that the path works.
+
+### What this means in practice, so the next session does not repeat it
+
+* **`git clone` / `git fetch` / `git push` over HTTPS do not work on this host.** Do not build a plan
+  around them and do not retry them hoping for a different result.
+* **The working path to materialise the repository is a tarball from `codeload`**:
+  `https://codeload.github.com/TwinsEarth/dsh-windows2macos/tar.gz/refs/heads/main`, unpacked with
+  `tar --strip-components=1` into a directory that is then `git init`-ed. That yields a real work tree
+  containing exactly `main`, which is what `fleet-sync` needs.
+* **Publishing from this host goes through the REST API**, not through git. Every release so far was
+  pushed that way.
+* **The consequence to state plainly:** this host can *pull* the truth and can *run* the sync machinery, but
+  it cannot *push* over git. A round that needs a commit published must use the API, and a round that needs
+  `fleet-sync` exercised must do it against a local bare remote — which is a real test of the state
+  machine, and is **not** a test of the network.
+
+### Why this is a rule and not a note
+
+The first two attempts at "make Windows a git participant" assumed the failure was a configuration problem
+and tried proxy settings and retries. Both were wrong, and both cost a round. **The measurements above are
+cheaper to read than to repeat.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.10.4",
+  "version": "0.11.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",
@@ -29,6 +29,7 @@
     "CHANGELOG.md",
     "HANDOFF.md",
     "ROADMAP.md",
+    "FLEET-RULES.md",
     "LICENSE",
     "PROTOCOL.md",
     "PROTOCOL-v0.1.2.md",
@@ -112,13 +113,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -134,7 +135,8 @@
     "test:fleet-sync": "node --test --test-force-exit test/fleet-sync.test.mjs",
     "test:health": "node --test --test-force-exit test/health.test.mjs",
     "test:storage": "node --test --test-force-exit test/storage.test.mjs",
-    "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs"
+    "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",
+    "test:council": "node --test --test-force-exit test/council.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/src/agent/council.mjs

@@ -0,0 +1,347 @@
+/**
+ * The council: one decision engine with ordered phases, weighted votes, and retained dissent.
+ *
+ * ## What this is for, and what it refuses to be
+ *
+ * The source design describes a six-role council and the ROADMAP's own §3 is explicit that a governance
+ * layer above a fleet **that has no disagreements yet** is indistinguishable from a delay. So this module is
+ * not wired into anything: it is the decision engine itself, built and tested, waiting for the measurement
+ * that earns it a caller. Building it now is justified because its *semantics* are testable in isolation;
+ * deploying it now would not be, and is not done.
+ *
+ * ## The three properties the ROADMAP names, and how each is enforced
+ *
+ * 1. **A phase cannot be skipped.** Phases are an ordered list and `advance()` moves exactly one step, to
+ *    the declared next phase or nowhere. There is no `goTo(phase)` and no way to open a vote before the
+ *    deliberation phase has closed, because the vote reads the arguments it claims to have considered.
+ * 2. **A vote's weights are reproducible from stored inputs.** `weightOf()` is a pure function of an
+ *    authority level and a reputation, both of which are stored on the ballot. Nothing about a weight comes
+ *    from the wall clock, the environment, or the order votes arrived in — so `recount()` on a stored
+ *    decision reproduces the original outcome, and a discrepancy is detectable rather than arguable.
+ * 3. **A decision with recorded dissent is retrievable *with* the dissent.** Dissent is not a log line; it
+ *    is part of the `Decision` value. A reader who asks for a decision gets the losing arguments, because
+ *    "what did the people who disagreed say" is the question that makes a decision auditable later.
+ *
+ * ## Why dissent is retained even when it changes nothing
+ *
+ * A council that records only outcomes cannot answer "was this contested?" after the fact, and the answer
+ * determines whether a decision should be revisited or trusted. Losing arguments are the *reason* the
+ * majority is a majority, so discarding them discards the only evidence that the question was hard.
+ *
+ * ## Design choices that are deliberately narrow
+ *
+ * * **Reputation is an input, not an inference.** This module never computes a reputation from past
+ *   behaviour, because a reputation derived here would be a second, hidden authority model competing with
+ *   v4.7.0's. A caller supplies it; the ballot records it; the recount reproduces it.
+ * * **A tie is a refusal, not a coin toss.** Returning *some* outcome for a tie would hide that the council
+ *   is split, and a split council is precisely the case a human must see.
+ */
+import { createHash } from 'node:crypto';
+
+/** The seven phases, in order. Index is the position; there is no other ordering. */
+export const PHASES = Object.freeze([
+  'convene',      // the question is stated and the council is formed
+  'frame',        // the question is bounded: what is in scope, what is not
+  'deliberate',   // arguments are recorded, for and against
+  'vote',         // weighted votes are cast
+  'decide',       // the outcome is fixed and dissent is attached
+  'record',       // the decision is sealed with a hash over its inputs
+  'adjourn',      // the council closes; nothing further may be added
+]);
+
+/** The six roles of the AURA council. A role is a hat, not a machine: one machine may hold several. */
+export const ROLES = Object.freeze(['strategist', 'analyst', 'critic', 'auditor', 'executor', 'operator']);
+
+/** Refusal codes, so a caller branches on a value rather than on prose. */
+export const COUNCIL_REFUSAL = Object.freeze({
+  UNKNOWN_PHASE: 'COUNCIL_UNKNOWN_PHASE',
+  WRONG_PHASE: 'COUNCIL_WRONG_PHASE',
+  ALREADY_SEALED: 'COUNCIL_ALREADY_SEALED',
+  UNKNOWN_ROLE: 'COUNCIL_UNKNOWN_ROLE',
+  UNCLEARED_TO_VOTE: 'COUNCIL_UNCLEARED_TO_VOTE',
+  ALREADY_VOTED: 'COUNCIL_ALREADY_VOTED',
+  BAD_WEIGHT_INPUT: 'COUNCIL_BAD_WEIGHT_INPUT',
+  TIED: 'COUNCIL_TIED',
+  NOT_FOUND: 'COUNCIL_NOT_FOUND',
+});
+
+export class CouncilRefusal extends Error {
+  constructor(code, detail, extra = {}) {
+    super(`${code}: ${detail}`);
+    this.name = 'CouncilRefusal';
+    this.code = code;
+    this.detail = detail;
+    Object.assign(this, extra);
+  }
+}
+
+/** Authority bands, taken from v4.7.0: 0-49 ordinary, 50-69 captain, 70-89 org admin, 90+ system admin. */
+export const AUTHORITY_MAX = 100;
+
+/**
+ * The weight of one participant, as a pure function of the two numbers on its ballot.
+ *
+ * **This is the whole reproducibility property.** Every input is a stored integer, so the same ballot
+ * recounts to the same weight on any machine and at any time. The formula is deliberately simple and
+ * deliberately *not* clever:
+ *
+ *   weight = authority × (1 + reputation/100)
+ *
+ * Authority is the primary term because v4.7.0 already defines what it means and this module has no standing
+ * to reinterpret it. Reputation is a bounded multiplier in `[1, 2)`, so reputation can promote a voice but
+ * **can never outvote authority**: a participant at authority 40 with a perfect reputation weighs 80, which
+ * is still less than a bare authority of 90. That ordering is the point — a governance layer that let
+ * reputation overturn the authority model would be a second, undeclared authority model.
+ *
+ * @param {{authority: number, reputation: number}} ballot
+ * @returns {number} the weight, exact and reproducible
+ */
+export function weightOf({ authority, reputation } = {}) {
+  if (!Number.isInteger(authority) || authority < 0 || authority > AUTHORITY_MAX) {
+    throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, `authority must be an integer in 0..${AUTHORITY_MAX}, got ${JSON.stringify(authority)}`);
+  }
+  if (!Number.isFinite(reputation) || reputation < 0 || reputation > 100) {
+    throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, `reputation must be a number in 0..100, got ${JSON.stringify(reputation)}`);
+  }
+  // Rounded to 6 places so a floating-point tail cannot make two equal ballots differ in a recount.
+  return Math.round(authority * (1 + reputation / 100) * 1e6) / 1e6;
+}
+
+/**
+ * A stable hash over everything a decision depended on.
+ *
+ * Exists so "the weights are reproducible" is checkable rather than assertable: recompute the seal from the
+ * stored inputs and compare. The fields are sorted and JSON-encoded with no spacing, so the seal does not
+ * depend on property order.
+ */
+export function sealOf(decision) {
+  const inputs = {
+    question: decision.question,
+    phase_reached: decision.phase_reached,
+    outcomes: (decision.ballots ?? []).map((b) => ({
+      participant: b.participant, role: b.role, authority: b.authority,
+      reputation: b.reputation, choice: b.choice, weight: b.weight, reason: b.reason,
+    })),
+    arguments: (decision.arguments ?? []).map((a) => ({ participant: a.participant, stance: a.stance, text: a.text })),
+  };
+  return createHash('sha256').update(JSON.stringify(inputs)).digest('hex');
+}
+
+/**
+ * Open a council.
+ *
+ * @param {object} options
+ * @param {string} options.question what is being decided
+ * @param {string[]} [options.participants] who is in the room, before roles are assigned
+ * @param {() => number} [options.now] injected clock
+ */
+export function convene({ question, participants = [], now = () => Date.now() } = {}) {
+  if (typeof question !== 'string' || question.trim() === '') throw new TypeError('convene: question is required');
+
+  /** @type {Array<{participant: string, role: string|null}>} */
+  const members = participants.map((p) => ({ participant: p, role: null }));
+  let phaseIndex = 0;
+  const arguments_ = [];
+  const ballots = [];
+  let decision = null;
+  /**
+   * Whether the decision has been *sealed*, which is not the same as whether it exists.
+   *
+   * The first version derived this from `decision !== null`, and that made `record()` block `advance()` —
+   * so the council could never reach `adjourn`, which comes after `record`. The tests caught it in two
+   * places. The distinction is worth keeping explicit: a decided-but-unsealed outcome is still open to being
+   * recorded, and only a sealed one is closed to every change.
+   */
+  let isSealed = false;
+  const openedAt = new Date(now()).toISOString();
+
+  const currentPhase = () => PHASES[phaseIndex];
+  const refuseIfSealed = () => {
+    if (isSealed) throw new CouncilRefusal(COUNCIL_REFUSAL.ALREADY_SEALED, 'the council has adjourned; a sealed decision is not modified');
+  };
+
+  /** Assign a role. Roles are additive, so one participant may hold several -- a fact worth allowing. */
+  function assign(participant, role) {
+    refuseIfSealed();
+    if (!ROLES.includes(role)) throw new CouncilRefusal(COUNCIL_REFUSAL.UNKNOWN_ROLE, `${JSON.stringify(role)} is not one of ${ROLES.join(', ')}`);
+    if (phaseIndex > 0) throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `roles are assigned during "convene"; the council is in "${currentPhase()}"`);
+    const existing = members.find((m) => m.participant === participant);
+    if (existing) existing.role = existing.role === null ? role : `${existing.role},${role}`;
+    else members.push({ participant, role });
+    return { participant, role };
+  }
+
+  /**
+   * Move exactly one phase forward.
+   *
+   * There is no way to move two phases or to name a destination. A phase cannot be skipped because the only
+   * transition available is to the declared successor -- and that is the ROADMAP's first falsifying test,
+   * enforced structurally rather than by a check a caller could bypass.
+   *
+   * **`advance()` deliberately does not consult the seal.** The seal protects the *decision* from being
+   * changed; it is not a lock on the phase machine. Tying the two together is self-contradictory, because
+   * `record` seals and `adjourn` comes after it -- so a seal that blocked advancement would make the final
+   * phase unreachable. Two tests caught that, which is the second time in this module that conflating
+   * "decided" with "sealed" produced a state nobody could reach.
+   */
+  function advance() {
+    if (phaseIndex >= PHASES.length - 1) return { phase: currentPhase(), moved: false, detail: 'already in the final phase' };
+    phaseIndex += 1;
+    return { phase: currentPhase(), moved: true };
+  }
+
+  /** Record an argument. Only during `deliberate`, because arguments exist to be considered by the vote. */
+  function argue({ participant, stance, text }) {
+    refuseIfSealed();
+    if (currentPhase() !== 'deliberate') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `arguments are recorded during "deliberate"; the council is in "${currentPhase()}"`);
+    }
+    if (stance !== 'for' && stance !== 'against') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `stance must be "for" or "against", got ${JSON.stringify(stance)}`);
+    }
+    const entry = { participant, stance, text: String(text ?? '') };
+    arguments_.push(entry);
+    return entry;
+  }
+
+  /** Cast a weighted vote. Only during `vote`, and only after the deliberation phase has closed. */
+  function vote({ participant, role = null, authority, reputation, choice, reason = null }) {
+    refuseIfSealed();
+    if (currentPhase() !== 'vote') {
+      throw new CouncilRefusal(
+        COUNCIL_REFUSAL.UNCLEARED_TO_VOTE,
+        `votes are cast during "vote"; the council is in "${currentPhase()}". A vote before deliberation would be a vote on nothing.`,
+      );
+    }
+    if (!Number.isInteger(authority)) throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, 'authority must be an integer');
+    const weight = weightOf({ authority, reputation });
+    if (ballots.some((b) => b.participant === participant)) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.ALREADY_VOTED, `${participant} has already voted; a second ballot would let one participant vote twice`);
+    }
+    const ballot = { participant, role, authority, reputation, choice, weight, reason, cast_at: new Date(now()).toISOString() };
+    ballots.push(ballot);
+    return ballot;
+  }
+
+  /**
+   * Fix the outcome and attach the dissent.
+   *
+   * A tie is refused rather than broken. Returning *some* outcome for a tie would hide that the council is
+   * split, and a split council is exactly the case a person must see.
+   */
+  function decide() {
+    refuseIfSealed();
+    if (currentPhase() !== 'decide') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `the outcome is fixed during "decide"; the council is in "${currentPhase()}"`);
+    }
+    const tally = {};
+    for (const b of ballots) tally[b.choice] = Math.round(((tally[b.choice] ?? 0) + b.weight) * 1e6) / 1e6;
+    const ranked = Object.entries(tally).sort((a, b) => b[1] - a[1]);
+    if (ranked.length === 0) throw new CouncilRefusal(COUNCIL_REFUSAL.TIED, 'no votes were cast, so there is no outcome to fix');
+    if (ranked.length > 1 && ranked[0][1] === ranked[1][1]) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.TIED, `a tie between ${ranked[0][0]} and ${ranked[1][0]} at weight ${ranked[0][1]}; a split council needs a person`, { tally });
+    }
+    const [outcome, weight] = ranked[0];
+    const dissent = ballots
+      .filter((b) => b.choice !== outcome)
+      .map((b) => ({
+        participant: b.participant,
+        role: b.role,
+        choice: b.choice,
+        weight: b.weight,
+        // The arguing text is carried alongside the ballot where the participant supplied one, because a
+        // dissent without its reason is a number rather than a position.
+        text: arguments_.filter((a) => a.participant === b.participant).map((a) => a.text).join(' ').trim() || null,
+      }));
+    decision = {
+      question,
+      opened_at: openedAt,
+      decided_at: new Date(now()).toISOString(),
+      phase_reached: 'decide',
+      outcome,
+      weight,
+      tally,
+      ballots: [...ballots],
+      arguments: [...arguments_],
+      dissent,
+      unanimous: dissent.length === 0,
+    };
+    return decision;
+  }
+
+  /** Seal the decision. After this the council refuses every mutation. */
+  function record() {
+    refuseIfSealed();
+    if (currentPhase() !== 'record') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `the decision is sealed during "record"; the council is in "${currentPhase()}"`);
+    }
+    if (decision === null) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, 'there is no decision to seal; decide() must run before record()');
+    }
+    decision.phase_reached = 'record';
+    decision.seal = sealOf(decision);
+    decision.sealed_at = new Date(now()).toISOString();
+    isSealed = true;
+    return decision;
+  }
+
+  return {
+    get phase() { return currentPhase(); },
+    get phases() { return [...PHASES]; },
+    get members() { return members.map((m) => ({ ...m })); },
+    get votes() { return ballots.map((b) => ({ ...b })); },
+    get arguments() { return arguments_.map((a) => ({ ...a })); },
+    get decision() { return decision; },
+    assign,
+    argue,
+    vote,
+    decide,
+    record,
+    advance,
+  };
+}
+
+/**
+ * Recompute a stored decision's outcome from its stored inputs.
+ *
+ * This is what makes "the weights are reproducible" checkable instead of merely claimed: hand it a decision
+ * that was recorded earlier -- possibly on another machine -- and it either reproduces the outcome or says
+ * by how much it disagrees. It trusts nothing but the ballot fields.
+ *
+ * @param {object} decision
+ * @returns {{reproduced: boolean, outcome: string|null, weight: number|null, seal_matches: boolean, detail: string}}
+ */
+export function recount(decision) {
+  if (decision === null || typeof decision !== 'object') {
+    return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: 'no decision supplied' };
+  }
+  const tally = {};
+  for (const b of decision.ballots ?? []) {
+    let weight;
+    try {
+      weight = weightOf({ authority: b.authority, reputation: b.reputation });
+    } catch (e) {
+      return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: `ballot for ${b.participant} has inputs a weight cannot be computed from: ${e.message}` };
+    }
+    if (weight !== b.weight) {
+      return {
+        reproduced: false, outcome: null, weight: null, seal_matches: false,
+        detail: `ballot for ${b.participant} records weight ${b.weight} but its stored inputs give ${weight}`,
+      };
+    }
+    tally[b.choice] = Math.round(((tally[b.choice] ?? 0) + weight) * 1e6) / 1e6;
+  }
+  const ranked = Object.entries(tally).sort((a, b) => b[1] - a[1]);
+  if (ranked.length === 0) return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: 'no ballots to recount' };
+  const sealMatches = decision.seal === undefined ? false : sealOf(decision) === decision.seal;
+  const same = ranked[0][0] === decision.outcome && ranked[0][1] === decision.weight;
+  return {
+    reproduced: same,
+    outcome: ranked[0][0],
+    weight: ranked[0][1],
+    seal_matches: sealMatches,
+    detail: same
+      ? `outcome ${ranked[0][0]} at weight ${ranked[0][1]} reproduced from ${(decision.ballots ?? []).length} stored ballot(s)`
+      : `stored outcome was ${decision.outcome} at ${decision.weight}; the stored inputs give ${ranked[0][0]} at ${ranked[0][1]}`,
+  };
+}

package/src/plugin/tools.mjs

@@ -185,7 +185,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.10.4';
+const PLUGIN_VERSION = '0.11.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;