aiki-cli 0.3.0 → 0.3.2

package/dist/orchestration/url-sources.js

@@ -0,0 +1,200 @@
+import { createHash } from 'node:crypto';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { UrlSourceSet, } from '../schemas/index.js';
+const MAX_SOURCES = 5;
+const MAX_RESPONSE_BYTES = 500_000;
+const MAX_CONTENT_CHARS = 30_000;
+const MAX_REDIRECTS = 3;
+export function extractPublicUrls(input) {
+    const matches = input.match(/https?:\/\/[^\s<>"']+/gi) ?? [];
+    const seen = new Set();
+    const urls = [];
+    for (const match of matches) {
+        const cleaned = match.replace(/[.,;:!?\]\)}]+$/g, '');
+        if (seen.has(cleaned))
+            continue;
+        seen.add(cleaned);
+        urls.push(cleaned);
+        if (urls.length === MAX_SOURCES)
+            break;
+    }
+    return urls;
+}
+function isPrivateAddress(address) {
+    if (address === '::' || address === '::1')
+        return true;
+    if (address.toLowerCase().startsWith('fe80:') || address.toLowerCase().startsWith('fc') || address.toLowerCase().startsWith('fd'))
+        return true;
+    const mapped = address.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i)?.[1];
+    const ipv4 = mapped ?? (isIP(address) === 4 ? address : undefined);
+    if (!ipv4)
+        return false;
+    const [a, b] = ipv4.split('.').map(Number);
+    return a === 0
+        || a === 10
+        || a === 127
+        || (a === 169 && b === 254)
+        || (a === 172 && b >= 16 && b <= 31)
+        || (a === 192 && b === 168)
+        || (a === 100 && b >= 64 && b <= 127)
+        || a >= 224;
+}
+async function assertPublicUrl(url, resolveHostname) {
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new Error('only public http/https URLs are supported');
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+    if (hostname === 'localhost' || hostname.endsWith('.localhost') || hostname.endsWith('.local') || hostname === '169.254.169.254') {
+        throw new Error('private or local URLs are not allowed');
+    }
+    if (isIP(hostname) && isPrivateAddress(hostname))
+        throw new Error('private or local URLs are not allowed');
+    if (!resolveHostname || isIP(hostname))
+        return;
+    const addresses = await lookup(hostname, { all: true });
+    if (addresses.length === 0 || addresses.some(({ address }) => isPrivateAddress(address))) {
+        throw new Error('private or local URLs are not allowed');
+    }
+}
+function npmRegistryUrl(url) {
+    if (url.hostname !== 'npmjs.com' && url.hostname !== 'www.npmjs.com')
+        return undefined;
+    const match = url.pathname.match(/^\/package\/(.+?)\/?$/);
+    if (!match)
+        return undefined;
+    const name = decodeURIComponent(match[1]);
+    return `https://registry.npmjs.org/${encodeURIComponent(name)}/latest`;
+}
+function decodeHtml(value) {
+    const named = { amp: '&', apos: "'", gt: '>', lt: '<', nbsp: ' ', quot: '"' };
+    return value.replace(/&(#x[\da-f]+|#\d+|\w+);/gi, (entity, code) => {
+        if (code[0] === '#') {
+            const radix = code[1]?.toLowerCase() === 'x' ? 16 : 10;
+            const value = Number.parseInt(code.slice(radix === 16 ? 2 : 1), radix);
+            return Number.isFinite(value) ? String.fromCodePoint(value) : entity;
+        }
+        return named[code.toLowerCase()] ?? entity;
+    });
+}
+function readableHtml(html) {
+    const titleMatch = html.match(/<title\b[^>]*>([\s\S]*?)<\/title>/i);
+    const title = titleMatch ? decodeHtml(titleMatch[1].replace(/<[^>]+>/g, ' ')).replace(/\s+/g, ' ').trim() : undefined;
+    const content = decodeHtml(html
+        .replace(/<(script|style|noscript|svg)\b[^>]*>[\s\S]*?<\/\1>/gi, ' ')
+        .replace(/<[^>]+>/g, ' '))
+        .replace(/\s+/g, ' ')
+        .trim();
+    return { title: title || undefined, content };
+}
+function sha256(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+async function readLimited(response) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let bytes = 0;
+    let body = '';
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            return body + decoder.decode();
+        bytes += value.byteLength;
+        if (bytes > MAX_RESPONSE_BYTES) {
+            await reader.cancel();
+            throw new Error(`response exceeds ${MAX_RESPONSE_BYTES} bytes`);
+        }
+        body += decoder.decode(value, { stream: true });
+    }
+}
+function failure(id, url, accessedAt, status, error, finalUrl) {
+    return { id, url, final_url: finalUrl, status, accessed_at: accessedAt, error };
+}
+async function fetchWithRedirects(startUrl, fetchImpl, resolveHostname) {
+    let current = new URL(startUrl);
+    for (let redirect = 0; redirect <= MAX_REDIRECTS; redirect++) {
+        await assertPublicUrl(current, resolveHostname);
+        const response = await fetchImpl(current.toString(), {
+            redirect: 'manual',
+            headers: { accept: 'text/html,application/json,text/plain;q=0.9,*/*;q=0.1' },
+        });
+        if (response.status < 300 || response.status >= 400)
+            return { response, finalUrl: current.toString() };
+        const location = response.headers.get('location');
+        if (!location)
+            return { response, finalUrl: current.toString() };
+        if (redirect === MAX_REDIRECTS)
+            throw new Error(`more than ${MAX_REDIRECTS} redirects`);
+        current = new URL(location, current);
+    }
+    throw new Error('redirect limit exceeded');
+}
+async function snapshotOne(sourceUrl, index, options) {
+    const id = `U${index + 1}`;
+    const accessedAt = (options.now?.() ?? new Date()).toISOString();
+    const fetchImpl = options.fetchImpl ?? fetch;
+    try {
+        const original = new URL(sourceUrl);
+        await assertPublicUrl(original, options.fetchImpl === undefined);
+        const adapterUrl = npmRegistryUrl(original);
+        const { response, finalUrl } = await fetchWithRedirects(adapterUrl ?? sourceUrl, fetchImpl, options.fetchImpl === undefined);
+        const declaredLength = Number(response.headers.get('content-length') ?? 0);
+        if (declaredLength > MAX_RESPONSE_BYTES) {
+            return failure(id, sourceUrl, accessedAt, 'FAILED', `response exceeds ${MAX_RESPONSE_BYTES} bytes`, finalUrl);
+        }
+        const body = await readLimited(response);
+        const contentType = response.headers.get('content-type')?.split(';')[0]?.trim() || 'text/plain';
+        const blocked = response.status === 403
+            || response.status === 429
+            || response.status === 503
+            || /cdn-cgi\/challenge|just a moment|captcha|access denied/i.test(body);
+        if (blocked) {
+            return failure(id, sourceUrl, accessedAt, 'BLOCKED', `site blocked automated access (HTTP ${response.status})`, finalUrl);
+        }
+        if (!response.ok)
+            return failure(id, sourceUrl, accessedAt, 'FAILED', `HTTP ${response.status}`, finalUrl);
+        let title;
+        let content;
+        if (adapterUrl) {
+            const metadata = JSON.parse(body);
+            const name = typeof metadata.name === 'string' ? metadata.name : original.pathname.split('/').at(-1) ?? 'npm package';
+            const version = typeof metadata.version === 'string' ? metadata.version : 'unknown version';
+            title = `${name} ${version}`;
+            content = [
+                `Package: ${name}`,
+                `Version: ${version}`,
+                typeof metadata.description === 'string' ? `Description: ${metadata.description}` : '',
+                typeof metadata.homepage === 'string' ? `Homepage: ${metadata.homepage}` : '',
+                typeof metadata.readme === 'string' ? `README:\n${metadata.readme}` : '',
+            ].filter(Boolean).join('\n');
+        }
+        else if (contentType === 'text/html' || /<html\b|<body\b/i.test(body)) {
+            ({ title, content } = readableHtml(body));
+        }
+        else {
+            content = body.replace(/\s+/g, ' ').trim();
+        }
+        content = content.slice(0, MAX_CONTENT_CHARS).trim();
+        if (!content)
+            return failure(id, sourceUrl, accessedAt, 'FAILED', 'source contained no readable text', finalUrl);
+        return {
+            id,
+            url: sourceUrl,
+            final_url: finalUrl,
+            status: 'FETCHED',
+            title,
+            content_type: contentType,
+            accessed_at: accessedAt,
+            sha256: sha256(content),
+            content,
+        };
+    }
+    catch (error) {
+        return failure(id, sourceUrl, accessedAt, 'FAILED', error instanceof Error ? error.message : String(error));
+    }
+}
+export async function snapshotUrlSources(input, options = {}) {
+    const sources = await Promise.all(extractPublicUrls(input).map((url, index) => snapshotOne(url, index, options)));
+    return UrlSourceSet.parse({ sources });
+}

package/dist/schemas/index.js

@@ -19,6 +19,34 @@ export const TaskTypeSchema = z.enum(['idea-refinement', 'code-review', 'other']
 export const WorkflowIdSchema = z.enum(['idea-refinement', 'code-review']);
 /** Explicit user-selected idea protocol. There is deliberately no learned mode router. */
 export const IdeaModeSchema = z.enum(['quick', 'council', 'research']);
+export const RequestedOutputSchema = z.enum([
+    'DECISION',
+    'FEATURE_BACKLOG',
+    'IMPLEMENTATION_PLAN',
+]);
+export const UrlSourceStatusSchema = z.enum(['FETCHED', 'BLOCKED', 'FAILED']);
+export const UrlSourceSnapshot = z.object({
+    id: z.string().regex(/^U[1-5]$/),
+    url: z.string().url(),
+    final_url: z.string().url().optional(),
+    status: UrlSourceStatusSchema,
+    title: z.string().min(1).optional(),
+    content_type: z.string().min(1).optional(),
+    accessed_at: z.string().datetime(),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    content: z.string().min(1).optional(),
+    error: z.string().min(1).optional(),
+}).strict().superRefine((source, ctx) => {
+    if (source.status === 'FETCHED' && (!source.content || !source.sha256)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'FETCHED source requires content and sha256' });
+    }
+    if (source.status !== 'FETCHED' && !source.error) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `${source.status} source requires an error` });
+    }
+});
+export const UrlSourceSet = z.object({
+    sources: z.array(UrlSourceSnapshot).max(5),
+}).strict();
 export const DomainDimension = z
     .object({
     id: z.string().regex(/^D[1-5]$/),
@@ -46,6 +74,7 @@ export const DecisionContract = IntentContract.extend({
     core_rubric: z.array(z.string().min(1)).min(1),
     user_confirmed: z.boolean(),
     confirmation: z.enum(['user-confirmed', 'headless-defaulted']),
+    requested_outputs: z.array(RequestedOutputSchema).min(1).max(4).optional(),
 }).strict();
 /** Code review and old idea runs keep the smaller v1 contract. */
 export const DecisionContractArtifact = z.union([DecisionContract, IntentContract]);
@@ -88,7 +117,7 @@ const RunBriefDraftBase = z
     evidence_supplied: z.array(z.string().min(1)).max(8),
     missing_axes: z.array(z.string().min(1)).max(8),
     domain_dimensions: z.array(DomainDimension).min(3).max(5),
-    questions: z.array(RunBriefQuestion).min(3).max(4),
+    questions: z.array(RunBriefQuestion).max(4),
 })
     .strict();
 function checkQuestionIds(questions, ctx) {
@@ -121,7 +150,7 @@ export const GrillAnswer = z
 })
     .strict();
 export const RunBrief = RunBriefDraftBase.extend({
-    answers: z.array(GrillAnswer).min(3).max(4),
+    answers: z.array(GrillAnswer).max(4),
 }).superRefine((brief, ctx) => {
     checkQuestionIds(brief.questions, ctx);
     checkDomainDimensionIds(brief.domain_dimensions, ctx);
@@ -156,7 +185,8 @@ export const PreflightReading = z.object({
     evidence_supplied: z.array(z.string().min(1)).max(8),
     missing_evidence: z.array(z.string().min(1)).max(8),
     domain_dimensions: z.array(DomainDimension).min(3).max(5),
-    questions: z.array(RunBriefQuestion).min(3).max(4),
+    questions: z.array(RunBriefQuestion).max(4),
+    requested_outputs: z.array(RequestedOutputSchema).max(4).default([]),
 }).strict().superRefine((reading, ctx) => {
     checkQuestionIds(reading.questions, ctx);
     checkDomainDimensionIds(reading.domain_dimensions, ctx);
@@ -207,6 +237,7 @@ export const ClaimPosition = z
     dimension_id: z.string().min(1),
     stance: z.enum(['SUPPORT', 'OPPOSE', 'MIXED', 'UNKNOWN']),
     basis: z.enum(['EVIDENCE', 'INFERENCE', 'ASSUMPTION']),
+    nature: z.enum(['FACTUAL', 'JUDGMENT']).default('JUDGMENT'),
     load_bearing: z.boolean(),
     if_false: z.enum(['STOP', 'PIVOT', 'CONDITION', 'MINOR']),
     reasoning: z.string().min(1),
@@ -287,6 +318,14 @@ export const DecisionQuestion = z
     claim_ids: z.array(z.string().min(1)),
 })
     .strict();
+export const DeliverableProposal = z.object({
+    output: z.enum(['FEATURE_BACKLOG', 'IMPLEMENTATION_PLAN']),
+    title: z.string().min(1),
+    detail: z.string().min(1),
+    user_value: z.string().min(1),
+    why_distinctive: z.string().min(1),
+    evidence_ids: z.array(z.string().min(1)).max(6),
+}).strict();
 const IdeaRoleOutputBase = z
     .object({
     workflow: z.literal('idea-refinement'),
@@ -297,6 +336,7 @@ const IdeaRoleOutputBase = z
     calculations: z.array(CalculationLedger).max(8).default([]),
     coverage: z.array(CoverageEntry).max(18), // 13 core + up to 5 preflight domain dimensions
     decision_questions: z.array(DecisionQuestion).max(8),
+    deliverable_proposals: z.array(DeliverableProposal).max(8).default([]),
 })
     .strict();
 function checkSubmissionRefs(submission, ctx) {
@@ -366,6 +406,12 @@ function checkSubmissionRefs(submission, ctx) {
                 ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['decision_questions', index, 'claim_ids'], message: `unknown position id: ${id}` });
         }
     }
+    for (const [index, proposal] of submission.deliverable_proposals.entries()) {
+        for (const id of proposal.evidence_ids) {
+            if (!evidenceIds.has(id))
+                ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['deliverable_proposals', index, 'evidence_ids'], message: `unknown evidence id: ${id}` });
+        }
+    }
 }
 export const IdeaRoleOutput = IdeaRoleOutputBase.superRefine(checkSubmissionRefs);
 /** Defect categories a finding (and a seeded bug, T11) can carry. BENCHMARK.md's "defect class" match
@@ -498,6 +544,17 @@ export function salvageIdeaRoleOutputModel(input) {
             && calc.inputs.every((input) => input.evidence_ids.every((id) => keptEvidence.has(id))))
             .slice(0, 8)
         : output.calculations;
+    const deliverableProposals = parseOrDrop(output.deliverable_proposals, (item) => {
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            return DeliverableProposal.safeParse(item);
+        const proposal = item;
+        return DeliverableProposal.strip().safeParse({
+            ...proposal,
+            evidence_ids: Array.isArray(proposal.evidence_ids)
+                ? proposal.evidence_ids.filter((id) => keptEvidence.has(id))
+                : proposal.evidence_ids,
+        });
+    });
     return {
         ...output,
         evidence,
@@ -505,6 +562,7 @@ export function salvageIdeaRoleOutputModel(input) {
         calculations,
         coverage: parseOrDrop(scrubIds(output.coverage, 'position_ids'), (item) => CoverageEntryBase.strip().superRefine(checkCoverageEntry).safeParse(item)),
         decision_questions: parseOrDrop(scrubIds(output.decision_questions, 'claim_ids'), (item) => DecisionQuestion.strip().safeParse(item)),
+        deliverable_proposals: deliverableProposals,
     };
 }
 /** The model-facing S4 shape. Exact known enum aliases are canonicalized, then the strict schema validates
@@ -559,6 +617,7 @@ export const DecisionClaim = z.object({
     position_ids: z.array(z.string().min(1)).min(1),
     state: z.enum(['CONSENSUS', 'SHARED_CONCERN', 'DISAGREEMENT', 'UNIQUE', 'UNCERTAIN']),
     evidence_state: z.enum(['SUPPORTED', 'CONFLICTED', 'UNVERIFIED']),
+    nature: z.enum(['FACTUAL', 'JUDGMENT']).default('JUDGMENT'),
     load_bearing: z.boolean(),
     if_false: z.enum(['STOP', 'PIVOT', 'CONDITION', 'MINOR']),
     sensitivity: z.enum(['DECISIVE', 'MATERIAL', 'LOW']),
@@ -837,7 +896,65 @@ export const IdeaChairReportModel = JudgeReportModel.omit({ adjudications: true
     adjudications: z.array(IdeaChairRuling),
 });
 // ── S9b: ActionPlan (idea-refinement report v3) ─────────────────────────────
-export const ActionPlan = z
+export const FeatureBacklog = z.object({
+    must: z.array(z.object({
+        feature: z.string().min(1),
+        user_value: z.string().min(1),
+        rationale: z.string().min(1),
+        effort: z.enum(['S', 'M', 'L']),
+    }).strict()).min(1).max(6),
+    should: z.array(z.object({
+        feature: z.string().min(1),
+        user_value: z.string().min(1),
+        rationale: z.string().min(1),
+        effort: z.enum(['S', 'M', 'L']),
+    }).strict()).max(6),
+    later: z.array(z.object({
+        feature: z.string().min(1),
+        user_value: z.string().min(1),
+        rationale: z.string().min(1),
+        effort: z.enum(['S', 'M', 'L']),
+    }).strict()).max(6),
+    wont: z.array(z.object({
+        feature: z.string().min(1),
+        reason: z.string().min(1),
+    }).strict()).max(6),
+}).strict();
+export const ImplementationPlan = z.object({
+    milestones: z.array(z.object({
+        order: z.number().int().min(1),
+        timebox: z.string().min(1),
+        outcome: z.string().min(1),
+        tasks: z.array(z.string().min(1)).min(1).max(6),
+        acceptance_test: z.string().min(1),
+    }).strict()).min(1).max(7),
+}).strict();
+const ReaderBriefBase = z.object({
+    headline: z.string().min(1).max(160),
+    bottom_line: z.string().min(1).max(1200),
+    sections: z.array(z.object({
+        heading: z.string().min(1).max(120),
+        summary: z.string().min(1).max(1000),
+        bullets: z.array(z.string().min(1).max(500)).max(6),
+    }).strict()).min(2).max(6),
+    next_step: z.string().min(1).max(600),
+    caveats: z.array(z.string().min(1).max(500)).max(3),
+    source_ids: z.array(z.string().min(1)).max(8),
+}).strict();
+const READER_AUDIT_ENUM = /\b(?:UNVERIFIED|UNVERIFIABLE|PARTIAL|CONFLICTED)\b/;
+const READER_AUDIT_LANGUAGE = /\b(?:structural score|evidence coverage|verification coverage|claim ids?|graph ids?|provider calls?|model calls?|answer editor|reader_brief)\b/i;
+export const ReaderBrief = ReaderBriefBase.superRefine((brief, ctx) => {
+    const text = JSON.stringify(brief);
+    if (READER_AUDIT_ENUM.test(text) || READER_AUDIT_LANGUAGE.test(text)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'reader_brief contains internal audit language' });
+    }
+});
+/** Contextual reader-language check: only reject IDs that actually exist in this run. */
+export function readerBriefIssues(brief, knownIds) {
+    const text = JSON.stringify(brief);
+    return [...knownIds].filter((id) => new RegExp(`\\b${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`).test(text));
+}
+const ActionPlanBase = z
     .object({
     actions: z
         .array(z
@@ -850,11 +967,19 @@ export const ActionPlan = z
         kill_signal: z.string().min(1),
     })
         .strict())
-        .min(1)
         .max(7),
     sequencing_note: z.string().min(1),
+    feature_backlog: FeatureBacklog.optional(),
+    implementation_plan: ImplementationPlan.optional(),
+    // Optional only so pre-v5 run artifacts remain replayable. New decision contracts require it in S9b.
+    reader_brief: ReaderBrief.optional(),
 })
     .strict();
+export const ActionPlan = ActionPlanBase.superRefine((plan, ctx) => {
+    if (plan.actions.length === 0 && !plan.reader_brief) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['actions'], message: 'an empty action plan requires reader_brief' });
+    }
+});
 export const PlannerUnavailable = z.object({
     kind: z.literal('PlannerUnavailable'),
     reason: z.enum(['budget_exhausted', 'planner_failed']),
@@ -870,7 +995,7 @@ export const QuickDecisionModel = z.object({
     key_points: z.array(z.string().min(1)).min(2).max(8),
     dissent: z.array(z.string().min(1)).min(1).max(4),
     confidence_notes: z.string().min(1),
-    action_plan: ActionPlan,
+    action_plan: ActionPlanBase.extend({ reader_brief: ReaderBrief }),
 }).strict().superRefine((decision, ctx) => {
     const hasConditions = decision.conditions.length > 0;
     if (decision.recommendation === 'PROCEED_WITH_CONDITIONS' && !hasConditions) {
@@ -923,11 +1048,14 @@ export const RunMeta = z.object({
     flags: z.array(z.enum([
         'synthesis_suspect',
         'low_diversity',
+        'weak_seat',
         'plan_skipped',
         'plan_fallback',
         'headless_intent',
         'verification_skipped',
         'research_ungrounded',
+        'source_fallback_search',
+        'deliverable_gap',
         'single_model',
     ])).optional(),
 });

package/dist/skills/idea-refinement/analyst.md

@@ -1,11 +1,11 @@
-# Analyst playbook — pressure-test the idea
+# Analyst playbook — strengthen and pressure-test the idea
 
-You are an adversarial analyst on a decision panel. Your job is not to like the idea — it is to find
-where it breaks. Steelman it once, then attack it honestly.
+You are an independent analyst on a decision panel. Build the strongest useful version for your lane,
+then expose where it breaks. Creation and criticism are both required.
 
 ## Strongest version first
 - Before attacking, state the best honest version of the idea: who it is for and why it would win.
-- Attack THAT version, not a weak strawman. If the steelman is thin, that itself is a finding.
+- Test THAT version, not a weak strawman. If the steelman is thin, that itself is a finding.
 
 ## Positions — make the stance explicit
 - State each decision-critical proposition and take an explicit SUPPORT, OPPOSE, MIXED, or UNKNOWN
@@ -45,5 +45,5 @@ ownership; emit one explicit coverage entry for every owned dimension.
 - Phrase each so that a yes/no or a single number would actually flip your assessment.
 
 ## Do not
-- No motivational framing, no pitch language, no summarizing your own output.
+- No unsupported hype or generic feature wishlists. Explain the mechanism and user value.
 - No unanchored position or evidence. No proposition you cannot tie to the decision.

package/dist/skills/idea-refinement/chair.md

@@ -0,0 +1,18 @@
+# Chair playbook — rule on the real disagreement
+
+Add to your base instructions; the schema and caps are unchanged and always win.
+
+## Synthesis discipline
+- Count convergence only when seats reached the same conclusion independently with different evidence.
+  Two seats repeating the same hedge is not agreement.
+- Never smooth over a clash. State both readings, compare their evidence quality, and rule.
+- A strong dissent beats a weak majority. Side with the better-evidenced minority when warranted and
+  explain why in `key_points`.
+- Never answer "it depends". Choose the required verdict enum; put contingencies into concrete,
+  checkable conditions that name their claim.
+- Lead `key_points` with the evidence or result that would change the verdict.
+- Report a blind spot only when verification or rebuttal actually exposed it.
+
+## First action
+- Anchor the first action to the single cheapest check that could kill or confirm the decision.
+- Pick one thing first, not a list disguised as one action.

package/dist/skills/idea-refinement/economics-delivery.md

@@ -3,5 +3,16 @@
 Own unit economics and capital needs, technical and operational feasibility, supply constraints,
 legal and compliance exposure, scalability, failure modes, and the cheapest decisive kill criteria.
 
+Act as the skeptic/executor for requested deliverables. When FEATURE_BACKLOG is requested, produce 2–4
+`deliverable_proposals` that preserve the standout value while remaining credible under the stated deadline.
+When IMPLEMENTATION_PLAN is requested, propose the shortest build sequence with observable outcomes.
+
 Steelman the idea first. Cross into another lane only for a load-bearing issue. For every owned
 dimension, emit a `COVERED` entry anchored to positions or a reasoned `NOT_APPLICABLE` entry.
+
+## Lens discipline (council seat)
+- Contrarian: assume a fatal flaw and hunt it — the number that does not close, the unpriced dependency,
+  or the deadline that does not fit.
+- Executor: every recommendation must survive the question, "What do you do Monday morning?"
+- Stance strength must match evidence strength — a hunch is an UNKNOWN position with a question
+  attached, never a confident claim.

package/dist/skills/idea-refinement/market-adoption.md

@@ -3,5 +3,17 @@
 Own target-user urgency, alternatives and status quo, differentiation, distribution and procurement,
 timing, and the team's ability to execute the required adoption motion.
 
+Act as the visionary product strategist for requested deliverables. When FEATURE_BACKLOG is requested,
+produce 3–6 bold but concrete `deliverable_proposals` that create a memorable user or demo moment; say why
+each is distinctive rather than listing ordinary table-stakes UI.
+
 Steelman the idea first. Cross into another lane only for a load-bearing issue. For every owned
 dimension, emit a `COVERED` entry anchored to positions or a reasoned `NOT_APPLICABLE` entry.
+
+## Lens discipline (council seat)
+- Expansionist: lean fully into this lane instead of hedging toward balance; the other seat and verifier
+  cover the rest. Name the undervalued upside with a number and evidence ID, or mark it UNKNOWN.
+- Outsider: read the pitch with zero context. If its framing would confuse a fresh reader, that is a
+  market finding, not a presentation footnote.
+- Stance strength must match evidence strength — a hunch is an UNKNOWN position with a question
+  attached, never a confident claim.

package/dist/skills/idea-refinement/planner.md

@@ -1,25 +1,31 @@
-# Planner playbook — decisive validation
+# Answer editor playbook — useful first, honest throughout
 
-You write the next tests after the council has already judged the idea. Do not plan the build.
-Plan only the cheapest validation work that can change the decision.
+You turn the council's work into the answer the user actually asked for. Lead with a clear product
+recommendation, select the strongest ideas from both seats, and make the result practical enough to act on.
 
-## Order
-- Start with upheld HIGH risks. If one fails, the idea should stop or change shape before any other work.
-- Then cover blind spots that could hide a blocker.
-- Then answer open questions that would flip the verdict.
+## Reader answer
+- Answer the original task directly. Do not narrate the council process.
+- Prefer specific product language: what to build, why users care, what makes it memorable, and what to do first.
+- Combine complementary proposals; remove duplicates and cautious filler.
+- Explain the user value or demo payoff of each standout idea, not merely its feature name.
+- Keep facts inside supported findings and sources. Present unevidenced product choices as recommendations,
+  never as established market facts.
+- Chair output is decision reasoning, not evidence. Reframe its unsupported certainty as a recommendation,
+  risk, or hypothesis unless the proposition also appears in supported findings.
+- Use plain-language caveats only when they could change the recommendation.
 
-## Action quality
-- Every action must be concrete enough that a person can run it this week.
-- Prefer interviews, landing-page smoke tests, pricing tests, manual concierge trials, prototype probes,
-  competitor checks, and policy checks over implementation work.
-- Tie every action to exactly one anchor in `validates`.
+## Requested deliverables
+- When a feature backlog is requested, make MUST the smallest compelling golden path. Use SHOULD and LATER
+  for real prioritization; WONT protects the concept from scope creep.
+- When an implementation plan is requested, give an outcome-driven build sequence with observable acceptance tests.
+- The reader brief should summarize these deliverables rather than repeat every field verbatim.
 
-## Kill signals
-- A kill signal is not "learn more". It is the result that stops, pivots, or narrows the idea.
-- Make the signal observable: a count, threshold, refusal pattern, legal blocker, cost ceiling, or
-  behavior that contradicts the assumption.
+## Validation actions
+- Keep 1–4 actions. Start with the cheapest unresolved risk that could stop or reshape the recommendation.
+- Every action must be concrete enough to run this week and tie to exactly one supplied anchor.
+- A kill signal must be observable: a threshold, refusal pattern, blocker, cost ceiling, or failed behavior.
 
 ## Do not
-- No product roadmap, scaffolding plan, architecture plan, or feature list.
-- No action for a claim the chair already settled.
-- No vague market research. No unanchored action.
+- No graph ids, verification labels, confidence formulas, audit vocabulary, or model-process commentary in reader_brief.
+- No generic "do more research" action.
+- No invented source or unsupported hype.

package/dist/skills/idea-refinement/rebuttal.md

@@ -0,0 +1,15 @@
+# Rebuttal playbook — answer the strongest opposition
+
+Add to your base instructions; the schema and caps are unchanged and always win.
+
+## Review in this order
+1. Steelman the opposing position in one line before answering it.
+2. Name its biggest blind spot: the assumption it never checks. Attack that assumption with supplied
+   evidence IDs.
+3. Name what both sides missed. Use NARROW or UNRESOLVED instead of pretending it was covered.
+
+## Stance discipline
+- CONCEDE when the evidence beats your position. An early concession on a lost point preserves
+  credibility for the decision-critical dispute.
+- Never change a stance word without a supplied evidence ID.
+- Prefer a precise unresolved boundary over a broad defensive counterclaim.

package/dist/skills/idea-refinement/verifier.md

@@ -0,0 +1,17 @@
+# Verifier playbook — try to disprove the claim
+
+Add to your base instructions; the schema and caps are unchanged and always win.
+
+## Refute first
+- Assume each claim is wrong. Hunt for the disconfirming reading of the same supplied evidence.
+- Confirm only after a serious refutation attempt fails.
+- Agreement without attempted refutation is analytically NOT_CHECKED, not SUPPORTED; express that
+  uncertainty with the closest allowed schema status rather than returning VERIFIED.
+- Judge the evidence, never its author.
+
+## Evidence discipline
+- Treat CONFLICTED as a finding, not an output enum: use the allowed status and record the exact two
+  clashing readings in the reasoning.
+- Never verify a value judgment as fact. Numbers, deadlines, and rule text can be checked; taste and
+  strategy remain positions for the chair.
+- Include one concise sentence describing the method used for each verification.

package/dist/storage/runs.js

@@ -12,7 +12,7 @@
 //   an invalid payload throws and writes nothing.
 import { mkdir, rename, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { ActionPlanArtifact, DecisionContractArtifact, DecisionGraph, DisagreementMap, IdeaRoleOutput, JudgeReport, PreflightArtifact, RebuttalEventSet, ReviewMap, RoleOutput, RunBrief, RunMeta, VerificationArtifact } from '../schemas/index.js';
+import { ActionPlanArtifact, DecisionContractArtifact, DecisionGraph, DisagreementMap, IdeaRoleOutput, JudgeReport, PreflightArtifact, RebuttalEventSet, ReviewMap, RoleOutput, RunBrief, RunMeta, UrlSourceSet, VerificationArtifact } from '../schemas/index.js';
 export class OutOfOrderWriteError extends Error {
     constructor(slot, ord, maxOrd) {
         super(`out-of-order write: "${slot}" (stage ${ord}) after stage ${maxOrd} already written`);
@@ -28,6 +28,7 @@ export class DuplicateWriteError extends Error {
 /** JSON stage slots. Composites without a T4 core schema (misunderstanding-guard, drift, claims)
  *  are written as-is; their schemas land with S2/S5/S6 (T5–T6). */
 const JSON_SLOTS = {
+    'url-sources': { ord: 0.25, path: '00a-url-sources.json', schema: UrlSourceSet },
     'run-brief': { ord: 0.5, path: '00b-run-brief.json', schema: RunBrief },
     'intent-contract': { ord: 1, path: '01-intent-contract.json', schema: DecisionContractArtifact },
     'preflight-readings': { ord: 2, path: '02-preflight-readings.json', schema: PreflightArtifact },