alphacouncil-agent 1.0.3 → 1.0.13

package/README.md

@@ -31,7 +31,7 @@
 <p>
   <a href="docs/INSTALL.md"><b>Install</b></a> ·
   <a href="#-usage"><b>Usage</b></a> ·
-  <a href="#-tools--27-all-keyless"><b>Tools</b></a> ·
+  <a href="#-tools--31-all-keyless"><b>Tools</b></a> ·
   <a href="#-the-bench--27-investor-method-lenses"><b>The bench</b></a> ·
   <a href="#-architecture"><b>Architecture</b></a> ·
   <a href="CHANGELOG.md"><b>Changelog</b></a> ·
@@ -44,9 +44,9 @@
 
 <div align="center">
 
-<img src="assets/run-example.png" alt="A real AlphaCouncil run: six master lenses reaching the same call for different reasons" width="100%" />
+<img src="assets/demo.gif" alt="AlphaCouncil live: a council of analyst agents researching a ticker and debating to a verdict" width="100%" />
 
-<sub><i>A real run. Six lenses, none constructive — and the disagreement is in the reasons, not the call.</i></sub>
+<sub><i>A real run, in real time. Want the still version? <a href="assets/run-example.png">Six lenses reaching the same call for different reasons</a> · <a href="docs/examples/final_report.SOX.zh.md">a complete real report</a> (SOX, full council, zh)</i></sub>
 
 </div>
 
@@ -63,7 +63,7 @@ AlphaCouncil Agent is a Codex and Claude Code plugin for public-equity research
 | 🌏 **What else you are betting on** | Correlation to the broad market, to KOSPI, to KOSDAQ and to the semiconductor cycle, plus dispersion across the eleven sector SPDRs. Sessions pair by date, because Korea and the United States keep different holidays. |
 | 💵 **Fund flow that refuses to be faked** | Creations minus redemptions, priced. Only a filed share count or the issuer's own assets-over-NAV identity may price a flow; a count reconstructed from positions is refused, because a difference cancels the number and keeps the error. |
 | 🐂🐻 **Adversarial by design** | Full runs a three-round bull/bear cross-exam and the visible/deep path can add three adversarial verifiers. Quick runs one parallel bull/bear statement round and a short PM; it checks scoped source IDs but explicitly does not claim adversarial verification. |
-| ⏱️ **Bounded full headless run** | Plugin-managed full starts all eight analysts together, runs Bull/Bear together inside each round, and persists a terminal run within 30 minutes. Provider failures produce an explicit `incomplete` result, never silently missing seats. |
+| ⏱️ **You pick the depth: 15, 30 or 60 minutes** | The run asks before it starts and shows the expected time beside the hard ceiling for each tier — you never type a speed. All three are the same full contract: eight analysts, three debate rounds, the PM. What changes is how long each seat may think, and a tier shapes the output too, because a shorter fuse on the same prompt buys unfinished work rather than faster work. Plugin-managed full starts all eight analysts together, runs Bull/Bear together inside each round, and persists a terminal run inside the chosen tier. Provider failures produce an explicit `incomplete` result, never silently missing seats. |
 | 🔍 **Auditable, never hallucinated** | Every claim maps to a source ID. A screen rule with missing inputs is `skipped`, never a pass. An undated headline is excluded, not shown as recent. Gaps are a section, not an omission. |
 | 🧭 **Company, ETF and index routing** | The symbol is classified before research. Companies use issuer financials; ETFs use dated holdings look-through; indices use aggregate methodology. QQQ/SPY are never treated as companies with their own revenue or EPS. |
 | 💰 **Entry price bands, not one number** | Three conditional bands with what each depends on. "The cycle position is undetermined" changes what the bands are conditional on; it does not excuse leaving them out. |
@@ -86,11 +86,14 @@ somewhere across a mixed set of symbols, with no contract failures. A basket tha
 path at all** — `SOX` was in neither registry — now produces 40-plus typed facts, and the seats
 that read them are running the same methods they run on a company.
 
-Seats carry the `operator_lens` admission level. Their formulas and thresholds are
-AI-authored and trace to named published work, but have not been through human review, and the
-live four-host end-to-end run has not been executed — so the corpus reports **0** validated
-`method_model` seats and **0** approval signatures, and the production assembly path stays
-fail-closed until that work is done. `npm run check` prints exactly where that stands.
+Honesty note: seat formulas are AI-authored reconstructions of named published methods,
+pending human review — the governance status and what remains open are tracked in
+[the v1.0.0 release contract](docs/releases/v1.0.0.md), and `npm run check` prints
+exactly where that stands.
+
+Trust posture: zero runtime dependencies, no install scripts, no telemetry, every data
+source keyless and public; analyst workers run in a read-only sandbox
+(`codex exec -s read-only -a never --ephemeral`). Details in [SECURITY.md](SECURITY.md).
 
 See [the v1.0.0 release contract](docs/releases/v1.0.0.md) for the exact ETF/index and full/quick
 boundary and [the report contract](docs/report-contract.md) for `quick_v1` versus `full_v2`.
@@ -123,6 +126,19 @@ codex plugin marketplace add Zhao73/alphacouncil-agent
 /reload-plugins
 ```
 
+**First run, 30 seconds, zero model spend** — before committing to a full council,
+verify the data layer works:
+
+```text
+/alpha AAPL news
+```
+
+That calls only keyless data tools and spawns no subagents. When it returns dated
+headlines and filings, the install is good; then try a full council with `/alpha AAPL`.
+Note the headless full/quick paths additionally need an authenticated **Codex CLI**
+(each analyst worker runs as `codex exec`) — Claude Code without Codex uses the
+visible host-subagent path instead, see [docs/INSTALL.md](docs/INSTALL.md).
+
 ## 🚀 Usage
 
 Just talk to it. Mention the agent and a ticker or a question:
@@ -164,7 +180,7 @@ rather than four in a menu of a hundred.
 
 | Invocation | What runs | Model spend |
 |---|---|---|
-| `/alpha <ticker>` | Shows every master, confirms `1..N`/ranges/`all`, then full; plugin-managed headless is ≤30m | deterministic stance + one isolated voice worker per selected v3 seat |
+| `/alpha <ticker>` | Asks the depth tier with its expected time, shows every master, confirms `1..N`/ranges/`all`, then full; headless is bounded by the chosen tier (15/30/60m) | deterministic stance + one isolated voice worker per v3 seat that reached a stance; a frozen abstention is published without one |
 | `/alpha <ticker> quick` | Shows all 27, confirms 1-4 (no `all`), then plugin-managed `quick_v1` (≤10m) | varies with selection |
 | `/alpha <ticker> screen` | Mechanical filings screen only | **none** |
 | `/alpha <ticker> options` | IV term structure, skew, positioning | **none** |
@@ -182,19 +198,46 @@ show the catalog and confirm a fresh, one-use, mode-bound receipt before researc
 Any listed equity: `/alpha AAPL` · `/alpha 0700.HK quick` · `/alpha 7203.T news` · `/alpha market rates`.
 Filings-based modes need a US filer; other markets are reported through `market_coverage` rather than silently returning nothing.
 
-### Full v2 — 30-minute plugin-managed bound
-
-Plugin-managed headless `analyze_symbol(council_mode="full")` uses one global maximum of
-**1800000 ms** from durable queueing through terminal artifact persistence. All eight
-mandatory evidence workers start in one parallel wave. After the evidence barrier, each
-selected physical v3 method freezes its deterministic stance and gets one isolated voice
-worker that can explain, but cannot change, that result. Bull and Bear run in parallel within
-each of the three rounds, with a barrier between rounds, followed by the PM.
-
-At expiry the server persists `incomplete` with every timed-out, failed and skipped role.
-Thirty minutes is a terminal-persistence guarantee, not a promise that search, model
-transport or data providers will let every seat succeed. A visible-host `plan_visible_run`
-is scheduled outside the plugin and cannot be force-stopped, so it has no 30-minute claim.
+### Full v2 — three depth tiers, chosen at the gate
+
+The run asks how deep to go before it asks which methods to seat. You never type a speed:
+`begin_council_selection` returns the menu, with the expected time and the hard ceiling for each
+tier side by side.
+
+| tier | expected | ceiling | evidence / seat | debate / round / side |
+| --- | --- | --- | --- | --- |
+| `fast` | ~12 min | 15 min | 3.5 min | 90 s |
+| `normal` (default) | ~20 min | 30 min | 6 min | 150 s |
+| `slow` | ~44 min | 60 min | 12 min | 6 min |
+
+**All three are the same `full_v2` contract** — eight evidence seats, every selected method,
+three debate rounds, the PM. A tier changes how long each seat may think, never which seats run.
+Both numbers are published because a ceiling shown alone reads as the estimate, and then every
+fast run looks like it takes fifteen minutes.
+
+A tier moves every per-stage cap together with the total, and it also shapes what each worker is
+asked to produce. That second half matters: a cap on its own is a timeout, and the same prompt
+with a shorter fuse buys a packet the worker could not finish rather than a faster good one.
+Since an LLM call's wall clock is dominated by the tokens it generates, `fast` asks for the same
+information in less prose — claims, figures, scoped source IDs, required report sections and the
+decision are never what gets cut; restatement is. `slow` buys room to write a derivation out
+step by step.
+
+The chosen tier binds into the one-use `selection_receipt`, so an execution call may repeat it
+but never change it: a run approved as fifteen minutes cannot become an hour, and `status.json`
+records which tier produced it. Quick has no tier — it is a smaller contract, not a slower one.
+
+All eight mandatory evidence workers start in one parallel wave. After the evidence barrier,
+each selected physical v3 method freezes its deterministic stance; a method that reached a
+stance gets one isolated voice worker that can explain, but cannot change, that result, while a
+frozen abstention is published from its deterministic record without spending a worker. Bull and
+Bear run in parallel within each of the three rounds, with a barrier between rounds, followed by
+the PM.
+
+At expiry the server persists `incomplete` with every timed-out, failed and skipped role. The
+tier's ceiling is a terminal-persistence guarantee, not a promise that search, model transport or
+data providers will let every seat succeed. A visible-host `plan_visible_run` is scheduled
+outside the plugin and cannot be force-stopped, so it carries no time claim at all.
 
 The resulting full handoff names every selected stable master ID and all eight analysts, and
 includes a system-owned price snapshot or explicit unavailable-data record. Method-seat
@@ -298,11 +341,11 @@ failure mode** — a seat that cannot name how it goes wrong will not flag it wh
 | Quant | Simons · Asness · Thorp |
 | Options | Taleb · Natenberg · Sinclair |
 | Modern | Aschenbrenner |
-| v3 expansion | Damodaran · Ackman · Cathie Wood · Pabrai · Jhunjhunwala |
+| v3 expansion | Damodaran · Ackman · Cathie Wood · Pabrai · Bogle · Jhunjhunwala |
 
 The `solo_test` catalog has 27 selectable physical v3 packs, but **27 physical packs is
 not 27 approved method models**. Every seat is a provisional `operator_lens` backed by
-project-derived proxy material; the 52 tools are executable test proxies, not human-approved
+project-derived proxy material; the 54 tools are executable test proxies, not human-approved
 formula attribution. Operational and `method_model` counts are both zero, and production GA
 remains fail-closed.
 
@@ -346,7 +389,7 @@ flowchart TD
     PM --> R[["final_report.md<br/>verdict + entry price bands"]]
 ```
 
-The masters branch off the facts, not off the packets. Feeding 26 lenses one analyst's
+The masters branch off the facts, not off the packets. Feeding 27 lenses one analyst's
 selection of what mattered would give them all the same blind spot — a large and perfectly
 correlated error — and would remove the reason for having a bench at all.
 
@@ -365,7 +408,7 @@ For full council, both editions share the same workflow, JSON packet contract, a
 
 | | Codex edition | Claude Code edition |
 |---|---|---|
-| Council execution | plugin-managed `codex exec` workers; full headless ≤30m | Host-owned `Task` subagents; no plugin-enforced deadline |
+| Council execution | plugin-managed `codex exec` workers; full headless ≤15/30/60m by chosen tier | Host-owned `Task` subagents; no plugin-enforced deadline at all |
 | Quick `quick_v1` | Plugin-managed headless `analyze_symbol` | Same plugin-managed headless `analyze_symbol` |
 | Per-analyst context | Separate process | Separate subagent, full isolated context window |
 | Evidence | `codex exec --search` | `WebSearch` + `WebFetch` in each analyst's own context |

package/README.zh-CN.md

@@ -35,9 +35,9 @@
 
 <div align="center">
 
-<img src="assets/run-example.png" alt="A real AlphaCouncil run: six master lenses reaching the same call for different reasons" width="100%" />
+<img src="assets/demo-zh.gif" alt="AlphaCouncil 实时运行:分析师委员会取证、辩论并给出裁决" width="100%" />
 
-<sub><i>一次真实运行。六位大师无一支持买入 —— 而分歧不在结论，在理由。</i></sub>
+<sub><i>一次真实运行的实录。静态版:<a href="assets/run-example.png">六位大师殊途同归</a> · <a href="docs/examples/final_report.SOX.zh.md">一份完整真实报告</a>(SOX,full council)</i></sub>
 
 </div>
 
@@ -49,10 +49,10 @@ AlphaCouncil Agent 是一个面向**上市股票研究**的 Codex / Claude Code
 |---|---|
 | 🏛️ **是委员会,不是一家之言** | 完整模式默认 8 个证据席、最多 11 个；quick 固定 4 个并行证据席。两者都在研究前完整展示 27 个方法席。 |
 | 🐂🐻 **天生对抗式** | 完整模式跑三轮多空交叉质询；quick 只跑一轮并行 Bull/Bear 陈述和短 PM，且明确不声称完成对抗 verifier。 |
-| ⏱️ **完整 headless 有硬时限** | 插件托管 full 将 8 个分析师同波启动、每轮 Bull/Bear 同时启动，并在 30 分钟内保存终态；外部服务故障会明确 `incomplete`，不会静默漏席。 |
+| ⏱️ **完整 headless 有硬时限，且有三档深度** | 开场问答里选 fast / normal / slow（预计 ~12 / ~20 / ~44 分钟，上限 15 / 30 / 60），三档都是同一个完整契约，只改每席能想多久。8 个分析师同波启动、每轮 Bull/Bear 同时启动、在所选档位内保存终态；外部服务故障会明确 `incomplete`，不会静默漏席。 |
 | 🔍 **可审计,不瞎编** | 每条结论都映射到 source ID;缺失数据写进「数据缺口」章节,绝不隐藏。 |
 | ⏱️ **多周期结论** | 买入/持有/卖出,外加独立的 1-4 周、3-6 月、12 月判断。 |
-| 🔑 **不依赖金融 API,无需任何密钥** | 不需要金融数据 API、行情源或券商账号。分析师通过代理自带的联网搜索实时取证(**Codex 网页搜索** / **Claude Code 的 WebSearch + WebFetch**),只消耗你已有的 Codex / Claude Code 订阅额度。MIT 开源。 |
+| 🔑 **31 个工具,零 API 密钥,零依赖** | 数据全部来自免密钥公开源(SEC EDGAR、CBOE、Yahoo/Stooq、21 组宏观序列),不需要付费行情或券商账号;分析师另通过代理自带的联网搜索实时取证(**Codex 网页搜索** / **Claude Code 的 WebSearch + WebFetch**),只消耗你已有的 Codex / Claude Code 订阅额度。MIT 开源。 |
 | 📚 **内置研究方法论** | 股票研究与投行事件分析的方法论以**本地 skill** 形式打包(`skills/public-equity-investing`、`skills/investment-banking`)——不依赖 Codex 专属远程工作流,Claude Code 也能获得同等研究深度。 |
 | 📈 **真实行情兜底,免 key** | 内置 `get_quote` 通过 Yahoo + Stooq 拉延迟(~15分钟)的指数 / 股指期货(含夜盘)/ 汇率 / 利率 / 波动率 / 商品 / 个股点位——不用 API key,分析师引用真实数字而非猜测。 |
 | 🧭 **公司、ETF 与指数正确分流** | 先识别资产再研究：公司走发行人财务，ETF 走带时点持仓穿透，指数走聚合方法；QQQ/SPY 不会再被当成有自身营收和 EPS 的公司。 |
@@ -100,6 +100,17 @@ codex plugin marketplace add Zhao73/alphacouncil-agent
 /reload-plugins
 ```
 
+**装完先花 30 秒零成本验证** —— 在跑完整委员会之前,先确认数据层通了:
+
+```text
+/alpha AAPL news
+```
+
+这条只调用免密钥数据工具、不派生任何子代理,返回带日期的新闻和公告即说明安装成功;
+然后再跑 `/alpha AAPL` 完整委员会。注意 headless 全量/快速路径还需要已登录的
+**Codex CLI**(每个分析师 worker 都是 `codex exec`);只有 Claude Code 时走可见
+子代理路径,见 [docs/INSTALL.md](docs/INSTALL.md)。
+
 ## 🚀 用法
 
 直接对它说话,@ 一下代理,带上代码或问题:
@@ -138,7 +149,7 @@ codex plugin marketplace add Zhao73/alphacouncil-agent
 
 | 输入 | 跑什么 | 额度消耗 |
 |---|---|---|
-| `/alpha <ticker>` | 逐人展示全部大师，确认后运行 full；插件托管 headless ≤30 分钟 | 每个所选 v3 席为确定性立场 + 一个独立 voice worker |
+| `/alpha <ticker>` | 先问跑多深（三档，带预计时间），再逐人展示全部大师，确认后运行 full | 每个达成立场的 v3 席为确定性立场 + 一个独立 voice worker；弃权席直接发布 |
 | `/alpha <ticker> quick` | 展示全部 27 席，确认 1-4 席（禁用 `all`），再跑插件托管 `quick_v1`（≤10 分钟） | 随选择数量变化 |
 | `/alpha <ticker> screen` | 只跑机械筛选 | **零** |
 | `/alpha <ticker> options` | 隐含波动率期限结构、偏斜、持仓分布 | **零** |
@@ -151,17 +162,39 @@ codex plugin marketplace add Zhao73/alphacouncil-agent
 任何上市股票：`/alpha AAPL` · `/alpha 0700.HK quick` · `/alpha 7203.T news` · `/alpha market rates`。
 基于申报的模式需要美国申报主体；其他市场会通过 `market_coverage` 说明覆盖情况，而不是静默返回空结果。
 
-### Full v2 —— 插件托管 30 分钟硬上限
+### Full v2 —— 三档深度，在开场问答里选
+
+运行会**先问你要跑多深**，再问要坐哪些方法席。你不需要输入任何速度关键词：
+`begin_council_selection` 会返回菜单，每档并列给出预计耗时与硬上限。
+
+| 档位 | 预计 | 硬上限 | 每证据席 | 每轮辩论每侧 |
+| --- | --- | --- | --- | --- |
+| `fast` 快速 | ~12 分钟 | 15 分钟 | 3.5 分钟 | 90 秒 |
+| `normal` 标准（默认） | ~20 分钟 | 30 分钟 | 6 分钟 | 150 秒 |
+| `slow` 深入 | ~44 分钟 | 60 分钟 | 12 分钟 | 6 分钟 |
+
+**三档都是同一个 `full_v2` 契约**——同样 8 个证据席、同样跑完所有所选方法、同样三轮辩论、
+同样 PM。档位只改**每席能想多久**，不改跑哪些席。两个数字都给，是因为只给上限会被读成预估，
+于是每次 fast 都看起来要 15 分钟。
+
+档位同时抬升总额与**每个分段上限**，并且还会调整对 worker 的产出要求。后半句很关键：光有上限
+只是超时，同一份提示词配更短的引信买到的是**没写完的包**，不是更快的好包。LLM 单次调用的
+墙钟时间主要由它生成的 token 决定，所以 `fast` 是**用更少的散文要同样的信息**——主张、数字、
+作用域来源 ID、必需报告章节和结论本身永远不在被砍之列，被砍的是复述。`slow` 买到的则是把
+推导逐步写完的空间。
+
+所选档位会绑进一次性 `selection_receipt`：执行调用可以重复它，但**不能改**它——批准了 15 分钟
+的运行不会变成一小时，`status.json` 也记录是哪一档跑出来的。quick 没有档位，它是更小的契约，
+不是更慢的。
 
-插件托管 headless `analyze_symbol(council_mode="full")` 从持久化 queued 状态到终态工件落盘，
-全局硬上限为 **1800000 ms**。8 个必需证据席同波并行。证据门禁通过后，每个所选物理 v3
-方法先运行确定性政策并冻结立场，再启动一个只属于该 stable ID 的独立 voice worker；它可以
-解释立场，但不能改立场或补造 typed fact。三轮中每轮 Bull/Bear 同时启动，二者都完成后才
-进入下一轮，最后才运行 PM。
+8 个必需证据席同波并行。证据门禁通过后，每个所选物理 v3 方法先运行确定性政策并冻结立场；
+**达成立场**的席位会获得一个只属于该 stable ID 的独立 voice worker（可以解释立场，但不能改
+立场或补造 typed fact），而**冻结为弃权**的席位直接用其确定性记录发布，不再消耗 worker。
+三轮中每轮 Bull/Bear 同时启动，二者都完成后才进入下一轮，最后才运行 PM。
 
-时限到达时，系统以 `incomplete` 保存终态，并逐项列出超时、失败和跳过的席位。30 分钟保证
-的是“必有可审计终态”，不是搜索、模型传输或数据源恶化时仍保证全席成功。visible-host 的
-`plan_visible_run` 由外部宿主调度，插件无法强制终止其子代理，因此不享有这个硬时限。
+时限到达时，系统以 `incomplete` 保存终态，并逐项列出超时、失败和跳过的席位。档位上限保证
+的是"必有可审计终态"，不是搜索、模型传输或数据源恶化时仍保证全席成功。visible-host 的
+`plan_visible_run` 由外部宿主调度，插件无法强制终止其子代理，因此**完全不享有任何时限承诺**。
 
 full 的交付摘要必须列出全部所选 stable master ID、全部 8 个分析师，以及系统行情快照或
 明确的不可用缺口。方法席 voice 是本次运行记录的 provisional lens 解释，**不是真人原话、
@@ -239,7 +272,7 @@ Claude Code、OpenCode、Grok Build 装完即可用。Codex 的 prompts 是用
 - **无可解析时间戳的新闻条目被剔除**，不会被展示为「最新」。
 - **报 `iv = 0` 的合约被丢弃** —— CBOE 对已过期和深度实值合约返回 0，而 0 混进均值不像缺失值，像一只很平静的股票。
 
-## 🏛️ 大师议席 —— 26 位
+## 🏛️ 大师议席 —— 27 位
 
 这是对公开方法论的重构，**不是本人的任何表述**。每一位都写明自己怎么思考、最先注意什么、典型追问是什么，以及**自己的失败模式** —— 说不出自己怎么错的席位，出错时不会举手。
 
@@ -251,10 +284,10 @@ Claude Code、OpenCode、Grok Build 装完即可用。Codex 的 prompts 是用
 | 量化 | 西蒙斯 · Asness · 索普 |
 | 期权 | 塔勒布 · 纳坦伯格 · 辛克莱 |
 | 现代 | Aschenbrenner |
-| v3 扩展 | 达莫达兰 · 阿克曼 · 凯茜·伍德 · Pabrai · 琼琼瓦拉 |
+| v3 扩展 | 达莫达兰 · 阿克曼 · 凯茜·伍德 · Pabrai · 博格 · 琼琼瓦拉 |
 
 1.0.0 `solo_test` 目录已有 27 个可选的物理 v3 包，但 **27 个物理包不等于 27 个已获批的
-方法模型**。所有 27 席都只是 provisional `operator_lens`；52 个工具是可执行的
+方法模型**。所有 27 席都只是 provisional `operator_lens`；54 个工具是可执行的
 `provisional_derived_proxy` 测试代理，不是经过人工审批的公式归因。`operational` 与
 `method_model` 数量均为 0，正式生产 GA 继续 fail-closed。
 
@@ -269,7 +302,7 @@ Bull/Bear 陈述和短 PM；它不运行图中的 verifier 节点。
 flowchart TD
     U["@alphacouncil-agent"] --> G[("Established facts<br/>filings · quotes · macro · options")]
     G --> AG{{"Analyst council"}}
-    G --> MS{{"Master bench<br/>26 lenses"}}
+    G --> MS{{"Master bench<br/>27 lenses"}}
     AG --> A1["Market data"]
     AG --> A2["Earnings"]
     AG --> A3["Valuation"]
@@ -294,7 +327,7 @@ flowchart TD
     PM --> R[["final_report.md"]]
 ```
 
-大师从事实分叉，而非从分析师的证据包分叉。让 26 位大师共用一位分析师对「什么重要」的取舍，会给他们同一个盲区 —— 一个又大又完全相关的误差 —— 也就取消了设立议席的理由。
+大师从事实分叉，而非从分析师的证据包分叉。让 27 位大师共用一位分析师对「什么重要」的取舍，会给他们同一个盲区 —— 一个又大又完全相关的误差 —— 也就取消了设立议席的理由。
 
 关键文件:
 
@@ -311,7 +344,7 @@ flowchart TD
 
 | | Codex 版 | Claude Code 版 |
 |---|---|---|
-| 委员会执行 | 插件托管 `codex exec` worker；full headless ≤30 分钟 | 宿主调度 `Task` 子代理；插件无法强制时限 |
+| 委员会执行 | 插件托管 `codex exec` worker；full headless 按所选档位 ≤15/30/60 分钟 | 宿主调度 `Task` 子代理；插件无法强制时限 |
 | 每个分析师上下文 | 独立进程 | 独立子代理,各自完整独立上下文窗口 |
 | 取证 | `codex exec --search` | 每个分析师在自己上下文里用 `WebSearch` + `WebFetch` |
 | 证据 → 辩论 | 8 席同波并行后经过硬 barrier | 基于运行相位机的硬性 barrier 门控 |

package/SECURITY.md

@@ -20,9 +20,19 @@ AlphaCouncil Agent runs an autonomous research workflow. Be aware that:
   captured from third-party pages. These are **not** committed (ignored by
   `.gitignore`) — mind what you share.
 - Never commit API keys, tokens, brokerage credentials, or private filings.
+- `preflight_permissions` reads the host's own configuration files
+  (`~/.claude/settings.json`, `~/.claude/settings.local.json`, OpenCode config)
+  **read-only**, to detect whether background agents would silently lose web
+  search and degrade into unsourced reports. Nothing is written and nothing
+  leaves the machine.
+- Worker subprocesses are launched sandboxed: `codex exec` runs with
+  `-s read-only -a never --ephemeral --ignore-user-config`, so an analyst
+  worker cannot write to disk, auto-approve actions, or recursively load the
+  user's own MCP configuration.
 - This software is for educational/research use only and is **not investment
   advice** (see the README disclaimer).
 
 ## Supported versions
 
-This project is pre-1.0. Only the latest `main` is supported.
+Only the latest published release (npm `latest`) and the current `main` branch
+are supported. Older versions receive no fixes.

package/commands/alpha.md

@@ -1,6 +1,6 @@
 ---
 description: Equity research council — full run, quick read, mechanical screen, or market narrative
-argument-hint: [ticker] [quick|screen|market|options|news] · or just a question
+argument-hint: [ticker] [fast|slow|quick|screen|market|options|news] · or just a question
 ---
 
 # /alpha
@@ -12,7 +12,8 @@ Request: **$ARGUMENTS**
 | `$ARGUMENTS` looks like | Do this |
 |---|---|
 | *(empty)* | Print the mode table below and stop. Do not start a run. |
-| a ticker alone, or a question | **Full council.** Go to "Full council" below. Plugin-managed headless has a hard 30-minute queue-to-terminal bound; visible-host execution does not. |
+| a ticker alone, or a question | **Full council** at the `normal` pace. Go to "Full council" below. Plugin-managed headless is bound by the selected pace; visible-host execution has no bound at all. |
+| ticker + `fast` / `slow` / `deep` | Full council with that tier **prefilled**. Still show the pace menu and take the answer, exactly as with a named master. |
 | ticker + `quick` | The plugin-managed headless `quick_v1` council: 4 fixed analysts, 1-4 selected methods, one parallel bull/bear round and a short PM inside a hard 10-minute ceiling. |
 | ticker + `screen` | `screen_ticker` only. No language-model judgment, no subagents. |
 | ticker + `options` | `get_options_chain` only. |
@@ -22,15 +23,22 @@ Request: **$ARGUMENTS**
 When `$ARGUMENTS` is empty, print exactly this and stop:
 
 ```
-/alpha <TICKER>          full council — shows every master; headless run is bounded <=30m
+/alpha <TICKER>          full council — asks how deep to go, then shows every master
+/alpha <TICKER> fast     same, with the 15-minute tier prefilled
+/alpha <TICKER> slow     same, with the 60-minute tier prefilled
 /alpha <TICKER> quick    quick_v1: 4 analysts incl. news + 1-4 masters + 1 parallel debate round (<=10m)
 /alpha <TICKER> screen   mechanical filings screen only        (no model spend)
 /alpha <TICKER> options  IV term structure, skew, positioning  (no model spend)
 /alpha <TICKER> news     dated filings and headlines           (no model spend)
 /alpha market <theme>    what the market is talking about      (no model spend)
 
+you do not have to type a speed: the run asks, and shows the predicted time for each
+tier. all three tiers are the same full_v2 contract at three depths; quick is a SMALLER
+contract (4 analysts, 1 debate round) and is never full-equivalent
+
 examples
   /alpha AAPL            /alpha 0700.HK quick     /alpha 7203.T news
+  /alpha NVDA slow       /alpha MSFT fast
   /alpha NVDA screen     /alpha market rates      /alpha "is TSM cheap?"
 ```
 
@@ -51,24 +59,40 @@ the same in Claude Code, Codex, OpenCode and Grok Build.
 1. Call `begin_council_selection` with the symbol, original request, language, host and the
    intended `council_mode` (`full` by default; exactly `quick` for quick mode). If
    the request explicitly names masters, also pass those stable IDs as
-   `preselected_master_ids`; this highlights them but does not confirm them.
-2. Show **every returned master individually, in the returned order and with its stable
+   `preselected_master_ids`; if it named a speed, pass `council_pace`. Both highlight a choice
+   without confirming it.
+2. **Ask how deep to go first**, from the returned `pace_options`. It is a three-option
+   question and the catalog is long, so it goes above the catalog. Show BOTH numbers per tier
+   — the expected time and the hard ceiling — because a ceiling alone reads as the estimate:
+
+   ```
+   本次分析要跑多深？（默认 2）
+     1. 快速   预计 ~12 分钟（上限 15）  每证据席 3.5 分钟，每轮辩论每侧 90 秒
+     2. 标准   预计 ~20 分钟（上限 30）  每证据席 6 分钟，每轮辩论每侧 150 秒   ← 默认
+     3. 深入   预计 ~44 分钟（上限 60）  每证据席 12 分钟，每轮辩论每侧 360 秒
+   三档都是完整评议：同样 8 个证据席、同样三轮辩论、同样 PM，只是每席能想多久不同。
+   ```
+
+   Quick returns an empty menu and rejects the field; say so rather than offering a tier.
+3. Show **every returned master individually, in the returned order and with its stable
    number**. Each row must include `identity`, `method`, `best_for` and `maturity`; a school
    name or a count is not a substitute for the individual catalog.
-3. Ask for one submission. In full mode accept one number from `1..N`, combinations,
+4. Ask for one submission covering both the tier and the seats. In full mode accept one number from `1..N`, combinations,
    ranges, stable IDs/names, or `all`. In quick mode the same complete 26-seat catalog is
    displayed, but the submission must contain **1..4 seats** and `all` / `select_all` is
    forbidden. A host-native multi-select is a convenience only. If it is unavailable or
    cannot show the full catalog, use the numbered text table and plain reply on every host.
-4. If the original full-mode request already named masters or said `all`, prefill that choice but
+5. If the original full-mode request already named masters or said `all`, prefill that choice but
    **still show the full catalog and require this run's submission**. Do not silently reuse a
    prior choice. For quick, prefill at most four named methods and ask the user to reduce an
    oversized/`all` request to 1-4. The submitted choice is the confirmation; do not ask a
    second confirmation.
-5. Call `confirm_master_selection` with the returned `selection_id`, `catalog_hash`,
-   `display_ack: true`, and exactly one of `selected_master_ids`, `select_all: true`, or
-   `selection`. Retain the returned one-use `selection_receipt`.
-6. Only now call `plan_visible_run` (full only), `collect_evidence` (full only), or
+6. Call `confirm_master_selection` with the returned `selection_id`, `catalog_hash`,
+   `display_ack: true`, the answered `council_pace` (omit to accept `normal`), and exactly one
+   of `selected_master_ids`, `select_all: true`, or `selection`. Retain the returned
+   one-use `selection_receipt`. The pace binds into it: an execution call may repeat the confirmed tier
+   but never change it, so a user who approved 15 minutes cannot end up running an hour.
+7. Only now call `plan_visible_run` (full only), `collect_evidence` (full only), or
    `analyze_symbol`, passing that `selection_receipt` and the same symbol, prompt, language
    and `council_mode`. Quick must use `analyze_symbol`. Do not also pass `masters` or
    `masters_roster`; the receipt is authoritative and mode-bound. A full receipt cannot start
@@ -97,14 +121,19 @@ master-selection contract.
    fails after its bounded parse repair, do not spend more model calls on masters, bull/bear
    or PM. Persist an `incomplete` run naming the failed evidence and skipped downstream roles.
 7. For the hard runtime contract, call plugin-managed headless `analyze_symbol` once with
-   `council_mode:"full"`, `wait_for_completion:false`, the full-mode receipt and optionally
-   `total_timeout_ms` no greater than `1800000`. Poll the same durable `run_id` to terminal.
-   All eight mandatory evidence roles start in one wave; every selected v3 method gets a
-   frozen deterministic stance plus its own isolated voice worker; Bull/Bear run in parallel
-   within each of three rounds with a barrier between rounds; then the PM runs. Queueing,
-   retries and final persistence share the 30-minute clock. At expiry the saved run is
-   `incomplete`, never silently shortened or relabeled complete. This guarantees terminal
-   persistence, not all-seat success during search/model/data-provider degradation.
+   `council_mode:"full"`, `wait_for_completion:false`, the full-mode receipt, and
+   `council_pace` when the arguments asked for a speed: `fast` for 15 minutes, `slow` (or
+   `deep`) for 60, omitted for the 30-minute default. Poll the same durable `run_id` to
+   terminal. All eight mandatory evidence roles start in one wave; every selected v3 method
+   gets a frozen deterministic stance plus its own isolated voice worker; Bull/Bear run in
+   parallel within each of three rounds with a barrier between rounds; then the PM runs.
+   Queueing, retries and final persistence share the selected tier's clock. At expiry the
+   saved run is `incomplete`, never silently shortened or relabeled complete. This guarantees
+   terminal persistence, not all-seat success during search/model/data-provider degradation.
+   Pass `total_timeout_ms` only to LOWER the tier's budget; above it the call is rejected.
+   Tell the user which pace ran and what it bought: the tier raises every per-stage cap, so
+   `slow` gives each evidence seat 12 minutes instead of 6 and each debate round 6 minutes per
+   side instead of 150 seconds. All three paces are the same `full_v2` contract.
 8. `plan_visible_run` is owned by the external host. The plugin cannot force-stop its Task
    agents, so visible-host full must not be advertised as meeting the 30-minute deadline.
 9. The terminal full handoff must include the system price snapshot (or explicit unavailable

package/data/build-profile.v1.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "channel": "solo_test",
-  "package_version": "1.0.3",
+  "package_version": "1.0.13",
   "persona_pack_version": "0.9.4",
   "pack_root": "knowledge/solo-test/masters",
   "assurance_class": "provisional_derived_proxy",

package/docs/INSTALL.md

@@ -16,11 +16,11 @@ plain MCP server in the Claude desktop app.
 npm install -g alphacouncil-agent
 ```
 
-That is 1.0.0. To pin the version or install straight from the tag:
+That installs the current release. To pin a version or install straight from a tag:
 
 ```bash
-npm install -g alphacouncil-agent@1.0.0
-npm install -g github:Zhao73/alphacouncil-agent#v1.0.0
+npm install -g alphacouncil-agent@latest
+npm install -g github:Zhao73/alphacouncil-agent#main
 ```
 
 `npm view alphacouncil-agent dist-tags --json` shows what each channel currently serves.
@@ -83,8 +83,11 @@ voice is a recorded provisional method result, not the named person's words.
 ### What full headless means
 
 Full remains `full_v2`. When launched through plugin-managed headless
-`analyze_symbol(council_mode="full")`, it has a hard maximum of 1800000 ms from durable
-queueing through terminal artifact persistence:
+`analyze_symbol(council_mode="full")`, it runs at one of three depth tiers selected with
+`council_pace` -- `fast` 15 minutes, `normal` (default) 30, `slow` 60 -- measured from durable
+queueing through terminal artifact persistence. The tier raises every per-stage cap with the
+total, which is where the depth difference lives; all three are the same eight-seat,
+three-round `full_v2` contract:
 
 - all eight mandatory evidence workers start in one parallel wave;
 - after the fail-closed evidence barrier, each selected physical v3 method freezes its
@@ -112,7 +115,7 @@ runs full. It is managed by the plugin's headless `analyze_symbol` path so the M
 enforce a wall-clock deadline. `plan_visible_run` rejects `council_mode=quick` rather than
 pretending an external host Task can be force-stopped by the plugin.
 
-- Stage 0 still displays the complete 26-seat catalog, but quick accepts exactly 1-4 selected
+- Stage 0 still displays the complete 27-seat catalog, but quick accepts exactly 1-4 selected
   methods and forbids `all` / `select_all`.
 - The receipt is bound to symbol, prompt, language and `council_mode`; it cannot be reused
   across quick and full.