amicus 1.3.0 → 1.5.0

package/electron/toolbar.js

@@ -5,6 +5,8 @@
  * Supports two modes: 'sidecar' (default) and 'setup'.
  */
 
+const { tokenCss } = require('../src/design/tokens');
+
 const TOOLBAR_H = 40;
 
 /**
@@ -36,6 +38,7 @@ function buildToolbarHTML(options = {}) {
   const brandName = getBrandName(client);
 
   const baseStyles = `
+  ${tokenCss({ absoluteFontUrls: true })}
   * { margin: 0; padding: 0; box-sizing: border-box; }
   body {
     position: fixed;
@@ -43,40 +46,41 @@ function buildToolbarHTML(options = {}) {
     left: 0;
     right: 0;
     height: ${TOOLBAR_H}px;
-    background: #2D2B2A;
+    background: var(--surface-1);
     display: flex;
     align-items: center;
     justify-content: space-between;
     padding: 0 14px;
-    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
-    border-top: 1px solid #3D3A38;
+    font-family: var(--font-sans), -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+    border-top: 1px solid var(--border);
     -webkit-app-region: no-drag;
     user-select: none;
   }
   .info {
-    color: #A09B96;
+    color: var(--text-2);
     font-size: 12px;
     display: flex;
     align-items: center;
     gap: 12px;
   }
   .brand {
-    color: #D97757;
+    color: var(--accent);
     font-size: 11px;
     font-weight: 600;
     letter-spacing: 0.8px;
     text-transform: uppercase;
   }
-  .sep { color: #3D3A38; font-size: 14px; }
+  .logo path { stroke: var(--accent); }
+  .sep { color: var(--border-strong); font-size: 14px; }
   .detail, .timer {
-    color: #7A756F;
+    color: var(--text-3);
     font-size: 11px;
-    font-family: 'SF Mono', Menlo, Monaco, monospace;
+    font-family: var(--font-mono), 'SF Mono', Menlo, Monaco, monospace;
   }
   .action-btn {
     padding: 5px 14px;
-    background: #D97757;
-    color: #FFF;
+    background: var(--accent);
+    color: var(--on-accent);
     border: none;
     border-radius: 4px;
     font-size: 12px;
@@ -84,15 +88,15 @@ function buildToolbarHTML(options = {}) {
     cursor: pointer;
     transition: background 0.15s;
   }
-  .action-btn:hover { background: #C4623F; }
+  .action-btn:hover { background: var(--accent-hover); }
   .action-btn:disabled { opacity: 0.5; cursor: default; }
   .icon-btn {
-    background: none; border: 1px solid #3D3A38;
-    border-radius: 4px; color: #A09B96; cursor: pointer;
+    background: none; border: 1px solid var(--border);
+    border-radius: 4px; color: var(--text-2); cursor: pointer;
     font-size: 14px; padding: 3px 8px; transition: all 0.15s;
     display: flex; align-items: center;
   }
-  .icon-btn:hover { border-color: #D97757; color: #D97757; }
+  .icon-btn:hover { border-color: var(--accent); color: var(--accent); }
   .right-actions { display: flex; align-items: center; gap: 8px; }
   .update-banner {
     position: fixed;
@@ -100,41 +104,41 @@ function buildToolbarHTML(options = {}) {
     left: 0;
     right: 0;
     height: 32px;
-    background: #3D3A38;
-    border-bottom: 1px solid #4D4A48;
+    background: var(--surface-2);
+    border-bottom: 1px solid var(--border-strong);
     display: none;
     align-items: center;
     justify-content: center;
     gap: 10px;
     font-size: 12px;
-    color: #D4D0CC;
+    color: var(--text-1);
     z-index: 100;
   }
   .update-banner .update-btn {
     padding: 2px 10px;
-    background: #D97757;
-    color: #FFF;
+    background: var(--accent);
+    color: var(--on-accent);
     border: none;
     border-radius: 3px;
     font-size: 11px;
     cursor: pointer;
     transition: background 0.15s;
   }
-  .update-banner .update-btn:hover { background: #C4623F; }
+  .update-banner .update-btn:hover { background: var(--accent-hover); }
   .update-banner .update-btn:disabled { opacity: 0.5; cursor: default; }
   .update-banner .dismiss-btn {
     background: none;
     border: none;
-    color: #7A756F;
+    color: var(--text-3);
     cursor: pointer;
     font-size: 14px;
     padding: 0 4px;
   }
-  .update-banner .dismiss-btn:hover { color: #D4D0CC; }`;
+  .update-banner .dismiss-btn:hover { color: var(--text-1); }`;
 
-  const logoSvg = `<svg width="16" height="16" viewBox="0 0 16 16" fill="none">
-      <path d="M3 2v12" stroke="#D97757" stroke-width="2" stroke-linecap="round"/>
-      <path d="M10 2v5c0 2-3 3-7 5" stroke="#D97757" stroke-width="2" stroke-linecap="round" stroke-opacity="0.6"/>
+  const logoSvg = `<svg class="logo" width="16" height="16" viewBox="0 0 16 16" fill="none">
+      <path d="M3 2v12" stroke-width="2" stroke-linecap="round"/>
+      <path d="M10 2v5c0 2-3 3-7 5" stroke-width="2" stroke-linecap="round" stroke-opacity="0.6"/>
     </svg>`;
 
   if (mode === 'setup') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
     "claude",

package/skills/second-opinion/MODEL-NOTES.md

@@ -79,6 +79,12 @@ This section keeps only per-model **qualitative quirks** and **structural-confor
 - **gpt** — thorough but verbose; peers have dinged it for volume-over-judgment. Self-ranked its own review #1 in the 2026-06-04 run → the peers-only street-cred rule (now enforced by `tally`) mitigates this. Conforms cleanly. Accessible via OpenRouter.
 - **gemini** — fast, very large context; tends toward absolute severity labels ("blocker" inflation vs peers). Conforms cleanly; watch for preamble narration — instruct it to emit the JSON block verbatim after the prose.
 
+## Free-tier models (OpenRouter `:free`)
+- Heavily rate-limited (shared daily pool); a 3-leg parallel wave + cross-review can 429 mid-run.
+- Quality-variable; weaker at strict structured (findings JSON) output.
+- Some `:free` models 404 unless the account enables data-sharing at openrouter.ai/settings/privacy.
+- No reliability history — chair selection can't use `council stats`; pick the strongest free model and disclose lower confidence.
+
 ## Cost guardrail
 - The budget gate enforces this in code: a per-$/Mtok threshold (ON by default)
   refuses o3/o3-pro-class models before a wave launches. This replaces the old

package/skills/second-opinion/SKILL.md

@@ -56,6 +56,22 @@ in this run is written here. Use its absolute path in all `--prompt-file` argume
 
 **Pick the council.** Default: **3 models from different families (non-Claude)**. Recommend them ranked by fit, consulting both the reviewer-reliability data from `amicus council stats` (the authoritative quantitative source — runs, avg peers-only street-cred, confirm-rate, fact-error rate) and the qualitative quirks in `MODEL-NOTES.md`. State the estimated cost. The estimate is the budget gate's pre-flight figure (per-$/Mtok pricing from the cached catalog; direct-provider legs without catalog pricing are disclosed as "cost unknown"). State it as an estimate, not a guarantee. **Disclose the run shape up front** before asking for confirmation — e.g.:
 
+**Free council (zero-cost).** If the user asks for a "free council" / "zero-cost council",
+read `councils.free` from `~/.config/amicus/config.json` and run
+`amicus fanout --council free --prompt-file <briefing>`. Free-tier handling:
+- Cost ≈ $0 — skip the paid-run cost framing (the budget gate is a no-op at zero price).
+- No reliability history: free models have no `amicus council stats` / `MODEL-NOTES` record,
+  so don't rank on street-cred. Pick the most capable free model as chair and state lower confidence.
+- Weak structured output: small free models are less reliable at the strict findings JSON; expect
+  more `validateFindings` repair-loop hits.
+- Throttled/truncated legs: a mid-stream 429 can yield a leg marked `complete` with a truncated,
+  unparseable review. When a free-council leg is `complete` but `validateFindings` returns
+  `NO_FENCED_BLOCK`/`NOT_PARSEABLE`, treat it as suspect/throttled — don't burn the repair loop on the
+  same throttled model; disclose it and apply the ≥2-reviews-survive wave-degrade rule.
+- Prerequisite: free models require enabling data-sharing in OpenRouter privacy settings
+  (openrouter.ai/settings/privacy) or legs 404 at run time — catalog validation cannot catch this.
+  State this up front.
+
 > This run uses 3 council models across 2 fanout waves + 1 chair call (~7 model runs), ~10 min.
 
 Then **wait for confirmation**. Never launch without it. The budget gate enforces the cost guardrail in code: by default it refuses any leg whose price exceeds the per-$/Mtok threshold (the o3/o3-pro guard). To run an intentionally expensive model the user explicitly asked for by name, pass `--no-cost-gate`; to raise only the total ceiling, pass `--max-cost <$>`.
@@ -314,7 +330,7 @@ This stage updates `MODEL-NOTES.md` to make future runs better. **Nothing is wri
 
 Draft new or updated entries for the per-model sections of `MODEL-NOTES.md` that capture what was learned.
 
-**Ledger auto-append (automatic — no approval required).** After `verdict.json` is written, the ledger row is appended automatically when the tally record is finalized — `ledger.appendRun(record)` writes one row per (run × model) to the append-only `council-ledger.jsonl` under `getConfigDir()`. The run summary shows the appended row. This is a deterministic, content-free model-level record (no finding text, no claim strings, no artifact body content). The quantitative reviewer-reliability data in `MODEL-NOTES.md` is now sourced entirely from `amicus council stats` (which aggregates the ledger) — **do not hand-edit reliability numbers in MODEL-NOTES**.
+**Ledger auto-append (automatic — no approval required).** Running `amicus council tally` (the Stage-2 finalize call) appends one row per (run × model) to the append-only `council-ledger.jsonl` under `getConfigDir()` — no separate step is needed. Pass `--no-ledger` to compute a tally record *without* recording it (e.g. a re-tally that shouldn't double-count). The run summary shows the appended row. This is a deterministic, content-free model-level record (no finding text, no claim strings, no artifact body content). The quantitative reviewer-reliability data in `MODEL-NOTES.md` is now sourced entirely from `amicus council stats` (which aggregates the ledger) — **do not hand-edit reliability numbers in MODEL-NOTES**.
 
 **Compose the proposed MODEL-NOTES diff.** Combine the run-lessons updates and the reviewer-reliability table updates into a single proposed diff (old → new for every changed section). **Write the full diff to a file in the run folder** — `_tmp-proposed-model-notes-update.md` — so the user can open and review it before deciding. Presenting the diff as chat text alone is **not sufficient**: an approval dialog can hide the chat transcript, so the user may be asked to decide on a diff they never saw.
 

package/src/cli-handlers-council.js

@@ -2,15 +2,15 @@
 'use strict';
 const fs = require('fs');
 const { tally } = require('./council/tally');
-const { deriveReliability } = require('./council/ledger');
+const { deriveReliability, appendRun } = require('./council/ledger');
 const { sumWaveUsage, formatCost } = require('./utils/pricing');
 const { failJson, ERROR_CODES } = require('./utils/error-doc');
 const { buildReport } = require('./council/report');
 
-function runTally(inputPath, useJson) {
+function runTally(inputPath, useJson, opts = {}) {
   if (!inputPath) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'council tally needs an <input.json> path',
-      hint: 'amicus council tally <input.json> [--json]' });
+      hint: 'amicus council tally <input.json> [--json] [--no-ledger]' });
   }
   let input;
   try { input = JSON.parse(fs.readFileSync(inputPath, 'utf-8')); }
@@ -24,6 +24,13 @@ function runTally(inputPath, useJson) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `malformed tally input: ${e.message}`,
       hint: 'input needs meta.models, findings[], adjudications[], rankings[]' });
   }
+  // Auto-append the run to the reliability ledger (consumed by `amicus council
+  // stats`). Tally is the council's finalize step, so this is where the row is
+  // recorded. Best-effort: a ledger write failure must not fail the tally.
+  if (opts.append !== false) {
+    try { appendRun(record); }
+    catch (e) { process.stderr.write(`Notice: council ledger append failed: ${e.message}\n`); }
+  }
   process.stdout.write(useJson ? JSON.stringify(record, null, 2) + '\n' : renderRecord(record));
   return 0;
 }
@@ -84,7 +91,7 @@ function runReport(args, useJson) {
 async function handleCouncil(args) {
   const sub = args._[1];
   const useJson = !!args.json;
-  if (sub === 'tally') { return runTally(args._[2], useJson); }
+  if (sub === 'tally') { return runTally(args._[2], useJson, { append: !args['no-ledger'] }); }
   if (sub === 'stats') { return runStats(useJson); }
   if (sub === 'report') { return runReport(args, useJson); }
   return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,

package/src/cli-handlers-run.js

@@ -108,8 +108,30 @@ async function handleFanout(args) {
   if (promptRes.error) {
     process.exit(failJson(useJson, { code: ERROR_CODES.MISSING_PROMPT, message: promptRes.error }));
   }
-  if (typeof args.models !== 'string' || !args.models.trim()) {
-    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --models is required (comma-separated aliases or provider/model IDs)' }));
+  // Council preset: expand a saved council into args.models (mutually exclusive with --models).
+  const hasModels = typeof args.models === 'string' && args.models.trim();
+  const hasCouncil = args.council !== undefined && args.council !== false;
+  if (hasModels && hasCouncil) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: pass exactly one of --models / --council, not both' }));
+  }
+  if (!hasModels && !hasCouncil) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --models is required (comma-separated aliases or provider/model IDs), or use --council <name>' }));
+  }
+  if (hasCouncil) {
+    if (typeof args.council !== 'string' || !args.council.trim()) {
+      process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --council requires a council name (e.g. --council free)' }));
+    }
+    const { resolveCouncilMembers } = require('./utils/config');
+    const { readCache } = require('./utils/model-catalog');
+    const catalog = (readCache() || {}).models || [];
+    const expanded = resolveCouncilMembers(args.council.trim(), catalog);
+    if (expanded.error) {
+      process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: ${expanded.error}` }));
+    }
+    if (expanded.dropped && expanded.dropped.length && !useJson) {
+      process.stderr.write(`Notice: dropped unavailable council member(s): ${expanded.dropped.join(', ')}\n`);
+    }
+    args.models = expanded.models.join(',');
   }
   if (args['wave-id']) {
     const check = validateTaskId(String(args['wave-id']));

package/src/cli.js

@@ -113,6 +113,7 @@ function isBooleanFlag(key) {
      'no-validate-model',
      'remove',               // used by 'key' command only; other handlers ignore it
      'no-cost-gate',         // disable the budget gate for this run
+     'no-ledger',            // council tally: compute the record without appending to the reliability ledger
      'html',                 // council report: emit a self-contained HTML page
      'md',                   // council report: emit Markdown (default)
    ];
@@ -356,6 +357,7 @@ Options for 'start':
 
 Options for 'fanout':
   --models <a,b,c>             Required. Comma-separated aliases or provider/model IDs
+  --council <name>             Run a saved council instead of --models (e.g. free). Mutually exclusive with --models
   --prompt <text>              Task briefing (or use --prompt-file)
   --prompt-file <path>         Read the briefing from a UTF-8 file (avoids the
                                ~32KB Windows argument cap). Mutually exclusive

package/src/council/report-html.js

@@ -9,8 +9,20 @@
 
 const { formatCost } = require('../utils/pricing');
 const { TIER_ORDER, SYMBOL } = require('./report');
+const { tokenCss } = require('../design/tokens');
 
-const TIER_COLOR = { Disputed: '#fde2e1', Contested: '#fef3c7', Confirmed: '#dcfce7', Singleton: '#e5e7eb' };
+const TIER_VAR = {
+  Disputed: 'var(--tier-disputed)',
+  Contested: 'var(--tier-contested)',
+  Confirmed: 'var(--tier-confirmed)',
+  Singleton: 'var(--tier-singleton)',
+};
+const TIER_INK = {
+  Disputed: 'var(--tier-disputed-ink)',
+  Contested: 'var(--tier-contested-ink)',
+  Confirmed: 'var(--tier-confirmed-ink)',
+  Singleton: 'var(--tier-singleton-ink)',
+};
 
 function esc(s) {
   return String(s === null || s === undefined ? '' : s)
@@ -27,9 +39,10 @@ function renderHtml(m) {
       const v = f.byJudge[j];
       return `<td class="c">${v ? SYMBOL[v] : ''}${j === f.raiser ? '<sup>*</sup>' : ''}</td>`;
     }).join('');
-    return `<tr style="background:${TIER_COLOR[f.tier] || '#fff'}">` +
+    return `<tr style="background:${TIER_VAR[f.tier] || '#fff'}">` +
       `<td>${esc(f.id)}</td><td>${esc(f.severity)}</td><td>${esc(f.raiser)}</td>${cells}` +
-      `<td>${esc(f.tier)}</td><td>${esc(f.decision || '')}</td></tr>`;
+      `<td style="color:${TIER_INK[f.tier] || 'inherit'};font-weight:600">${esc(f.tier)}</td>` +
+      `<td>${esc(f.decision || '')}</td></tr>`;
   }).join('');
   const credRows = m.streetCred.map(s =>
     `<tr><td>${esc(s.model)}</td><td>${num(s.peersOnly)}</td><td>${num(s.withSelf)}</td></tr>`).join('');
@@ -45,12 +58,29 @@ function renderHtml(m) {
 <html lang="en"><head><meta charset="utf-8">
 <title>Council Report — ${esc(h.runId)}</title>
 <style>
-  body { font: 14px/1.5 system-ui, sans-serif; max-width: 1000px; margin: 2rem auto; padding: 0 1rem; color: #1f2937; }
-  h1 { font-size: 1.5rem; } h2 { margin-top: 2rem; border-bottom: 1px solid #e5e7eb; padding-bottom: .25rem; }
-  table { border-collapse: collapse; width: 100%; margin: .5rem 0; }
-  th, td { border: 1px solid #e5e7eb; padding: .35rem .5rem; text-align: left; }
-  th { background: #f9fafb; } td.c { text-align: center; } .meta { color: #6b7280; }
-  .legend { color: #6b7280; font-size: .85rem; }
+${tokenCss()}
+:root {
+  /* Council tiers — light-ground palette + ink. Intentionally re-declared
+     here with the SAME values tokenCss() emits (self-documenting + robust to
+     a loader refactor; the cascade resolves identically). */
+  --tier-confirmed: #d7ead0;
+  --tier-contested: #efe4c4;
+  --tier-disputed: #ecd4ec;
+  --tier-singleton: #e2e0ea;
+  --tier-confirmed-ink: #15803d;
+  --tier-contested-ink: #b45309;
+  --tier-disputed-ink: #a21caf;
+  --tier-singleton-ink: #4b5563;
+}
+body { font: 14px/1.6 'Outfit', ui-sans-serif, system-ui, -apple-system, sans-serif; max-width: 1000px; margin: 2rem auto; padding: 0 1rem; color: #1f2937; background: #fff; }
+h1 { font-family: 'Outfit', ui-sans-serif, system-ui, -apple-system, sans-serif; font-size: 1.5rem; font-weight: 700; letter-spacing: -.02em; }
+h2 { font-family: 'Outfit', ui-sans-serif, system-ui, -apple-system, sans-serif; margin-top: 2rem; font-weight: 600; border-bottom: 1px solid #e5e7eb; padding-bottom: .25rem; }
+table { border-collapse: collapse; width: 100%; margin: .5rem 0; }
+th, td { border: 1px solid #e5e7eb; padding: .35rem .5rem; text-align: left; }
+th { background: #f9fafb; font-family: 'Outfit', ui-sans-serif, system-ui, -apple-system, sans-serif; font-weight: 600; }
+td.c { text-align: center; }
+.meta, .legend { color: #6b7280; font-family: 'IBM Plex Mono', ui-monospace, monospace; }
+.legend { font-size: .85rem; }
 </style></head><body>
 <h1>Council Report — ${esc(h.runType)} (${esc(h.runId)})</h1>
 <p class="meta">${meta}</p>

package/src/design/tokens.css

@@ -0,0 +1,134 @@
+/* ==========================================================================
+   Amicus — shared design tokens (clay/gold, neutral-black)
+   Single source of truth for the Electron app, council report, and site.
+   Re-tinted from the "Spectrum" design export to the shipped clay→gold brand
+   on the site's canonical neutral-black ramp. Injected by src/design/tokens.js.
+   ========================================================================== */
+
+/* ---- Webfonts (bundled, self-hosted) ---------------------------------- */
+/* Paths are relative to THIS file (src/design/tokens.css). The loader
+   rewrites them to absolute file-protocol URLs for the Electron app. */
+@font-face { font-family: 'Outfit'; font-style: normal; font-weight: 300; font-display: swap; src: url('./fonts/Outfit-300.ttf') format('truetype'); }
+@font-face { font-family: 'Outfit'; font-style: normal; font-weight: 400; font-display: swap; src: url('./fonts/Outfit-400.ttf') format('truetype'); }
+@font-face { font-family: 'Outfit'; font-style: normal; font-weight: 500; font-display: swap; src: url('./fonts/Outfit-500.ttf') format('truetype'); }
+@font-face { font-family: 'Outfit'; font-style: normal; font-weight: 600; font-display: swap; src: url('./fonts/Outfit-600.ttf') format('truetype'); }
+@font-face { font-family: 'Outfit'; font-style: normal; font-weight: 700; font-display: swap; src: url('./fonts/Outfit-700.ttf') format('truetype'); }
+@font-face { font-family: 'Outfit'; font-style: normal; font-weight: 800; font-display: swap; src: url('./fonts/Outfit-800.ttf') format('truetype'); }
+@font-face { font-family: 'IBM Plex Mono'; font-style: normal; font-weight: 400; font-display: swap; src: url('./fonts/IBMPlexMono-400.ttf') format('truetype'); }
+@font-face { font-family: 'IBM Plex Mono'; font-style: normal; font-weight: 500; font-display: swap; src: url('./fonts/IBMPlexMono-500.ttf') format('truetype'); }
+@font-face { font-family: 'IBM Plex Mono'; font-style: normal; font-weight: 600; font-display: swap; src: url('./fonts/IBMPlexMono-600.ttf') format('truetype'); }
+
+:root {
+  /* ---- Brand accent · clay (re-tinted from violet) ------------------- */
+  --accent-500: #d97757;   /* the one brand accent (re-tinted from Spectrum violet) */
+  --accent-400: #e8a07c;   /* lighter tint — hover text                  */
+  --accent-600: #c45c3f;   /* pressed / hover fill; spec value — intentionally supersedes the app's old clay-600 */
+  --accent-soft: rgba(217, 119, 87, 0.10);  /* tint wash / selected — site --asoft */
+  --accent-glow: rgba(217, 119, 87, 0.05);  /* radial glow — site --aglow */
+  --accent-line: rgba(217, 119, 87, 0.28);  /* dashed connectors, borders */
+
+  /* ---- Counter-accent · gold (re-tinted from lime) ------------------- */
+  --gold-400: #e8b24a;   /* counter-accent (re-tinted from Spectrum lime) */
+  --gold-500: #d49a2e;   /* deeper gold                                  */
+  --gold-soft: rgba(232, 178, 74, 0.12);
+  --gold-line: rgba(232, 178, 74, 0.28);
+
+  /* ---- Neutral-black ramp (site :root — canonical) ------------------- */
+  --bg: #0a0a0a;             /* page / window background                */
+  --surface-1: #111113;      /* card / input / inset (site --s1)        */
+  --surface-2: #161618;      /* raised / hover (site --s2)              */
+  --surface-3: #1c1c1f;      /* inset row (site --s3)                   */
+  --surface-sel: #1e1613;    /* selected row (app-additive, provisional)*/
+  --border: #222225;         /* hairline                                */
+  --border-strong: #2c2c30;  /* hover / focus hairline (site --border2) */
+  --text-1: #f5f5f3;         /* primary text                            */
+  --text-2: #a1a1a0;         /* secondary text                          */
+  --text-3: #666666;         /* tertiary / muted (site --t3 #666)       */
+  --text-4: #3a3a3e;         /* disabled / faint (app-additive)         */
+
+  /* ---- Semantic status (unchanged from export) ---------------------- */
+  --ok: #6BBF6B;
+  --ok-bright: #4ade80;
+  --warn: #FBBF24;
+  --danger: #E05252;
+  --running: #4ade80;
+
+  /* ---- Council verdict tiers (report tables, light ground) ----------- */
+  --tier-confirmed: #d7ead0;
+  --tier-contested: #efe4c4;
+  --tier-disputed: #ecd4ec;
+  --tier-singleton: #e2e0ea;
+  --tier-confirmed-ink: #15803d;
+  --tier-contested-ink: #b45309;
+  --tier-disputed-ink: #a21caf;
+  --tier-singleton-ink: #4b5563;
+
+  /* ---- Severity ----------------------------------------------------- */
+  --sev-blocker: #E05252;
+  --sev-major: #FBBF24;
+  --sev-minor: #a1a1a0;
+  --sev-nit: #666666;
+
+  /* ---- Provider brand colors (fixed external brands) ----------------- */
+  --pv-anthropic: #D97757;
+  --pv-google: #4285F4;
+  --pv-openai: #10A37F;
+  --pv-deepseek: #4D6BFE;
+  --pv-meta: #0081FB;
+  --pv-xai: #ECE9F5;
+  --pv-openrouter: #6566F1;
+
+  /* ---- Semantic aliases --------------------------------------------- */
+  --surface: var(--surface-1);
+  --surface-hover: var(--surface-2);
+  --text: var(--text-1);
+  --text-muted: var(--text-2);
+  --text-faint: var(--text-3);
+  --text-disabled: var(--text-4);
+  --accent: #d97757;
+  --accent-hover: var(--accent-600);
+  --accent-2: #e8b24a;
+  --accent-text: #ffffff;
+  --on-accent: #ffffff;
+  --focus-ring: var(--accent-500);
+
+  /* ---- Typography --------------------------------------------------- */
+  --font-sans: 'Outfit', system-ui, -apple-system, 'Segoe UI', sans-serif;
+  --font-mono: 'IBM Plex Mono', 'SF Mono', Menlo, Monaco, Consolas, monospace;
+  --w-light: 300; --w-regular: 400; --w-medium: 500;
+  --w-semibold: 600; --w-bold: 700; --w-extra: 800;
+  --fs-9: 9px; --fs-10: 10px; --fs-11: 11px; --fs-12: 12px;
+  --fs-13: 13px; --fs-15: 15px; --fs-18: 18px; --fs-22: 22px;
+  --lh-tight: 1.08; --lh-snug: 1.3; --lh-body: 1.6; --lh-relaxed: 1.7; --lh-display: 0.92;
+  --ls-display: -0.05em; --ls-tight: -0.03em; --ls-normal: -0.01em;
+  --ls-eyebrow: 0.14em; --ls-label: 0.5px; --ls-brand: 0.8px;
+
+  /* ---- Radii / borders / shadows / motion (color-free, from export) -- */
+  --r-2: 2px; --r-3: 3px; --r-4: 4px; --r-6: 6px; --r-7: 7px;
+  --r-8: 8px; --r-10: 10px; --r-12: 12px; --r-full: 999px;
+  --bd: 1px solid var(--border);
+  --bd-strong: 1px solid var(--border-strong);
+  --bd-accent: 1px solid var(--accent-500);
+  --bd-dashed: 1px dashed var(--border);
+  --bd-connector: 0.8px dashed var(--accent-line);
+  --shadow-none: none;
+  --shadow-card: 0 1px 2px rgba(0,0,0,0.25);
+  --shadow-pop: 0 8px 24px rgba(0,0,0,0.45);
+  --shadow-glow: 0 0 0 3px var(--accent-soft);
+  --ease-out: cubic-bezier(.16, 1, .3, 1);
+  --ease-std: ease;
+  --dur-fast: 0.15s; --dur-mid: 0.25s; --dur-slow: 0.7s;
+
+  /* ---- Spacing ------------------------------------------------------ */
+  --space-1: 2px; --space-2: 4px; --space-3: 6px; --space-4: 8px;
+  --space-5: 10px; --space-6: 12px; --space-7: 14px; --space-8: 16px;
+  --space-10: 20px; --space-12: 24px; --space-16: 32px;
+  --space-20: 40px; --space-24: 48px; --space-32: 64px;
+  --pad-pill: 3px 8px;
+  --pad-btn-sm: 5px 14px;
+  --pad-btn: 7px 12px;
+  --pad-input: 7px 10px;
+  --pad-card: 12px 16px;
+  --toolbar-h: 40px;
+  --gap-row: 8px;
+}

package/src/design/tokens.js

@@ -0,0 +1,51 @@
+'use strict';
+
+/**
+ * Shared design-token loader.
+ *
+ * tokenCss(opts)  -> the full :root{} + @font-face CSS string from tokens.css.
+ *                    opts.absoluteFontUrls (default false) rewrites the
+ *                    relative ./fonts/*.ttf URLs to absolute file:// URLs so
+ *                    the Electron app (which injects this inline into data:
+ *                    URLs) resolves the bundled webfonts. The report/site
+ *                    leave them relative.
+ * TOKENS          -> flat map of the canonical hex/rgba values, used by the
+ *                    site drift-guard test.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { pathToFileURL } = require('url');
+
+const TOKENS_CSS_PATH = path.join(__dirname, 'tokens.css');
+const FONTS_DIR = path.join(__dirname, 'fonts');
+
+const TOKENS = {
+  accent: '#d97757',
+  gold: '#e8b24a',
+  bg: '#0a0a0a',
+  surface1: '#111113',
+  surface2: '#161618',
+  surface3: '#1c1c1f',
+  border: '#222225',
+  borderStrong: '#2c2c30',
+  text1: '#f5f5f3',
+  text2: '#a1a1a0',
+  text3: '#666666',
+  accentSoft: 'rgba(217, 119, 87, 0.10)',
+  accentGlow: 'rgba(217, 119, 87, 0.05)',
+  running: '#4ade80'
+};
+
+function tokenCss(opts = {}) {
+  let css = fs.readFileSync(TOKENS_CSS_PATH, 'utf8');
+  if (opts.absoluteFontUrls) {
+    css = css.replace(/url\('\.\/fonts\/([^']+)'\)/g, (_m, file) => {
+      const abs = pathToFileURL(path.join(FONTS_DIR, file)).href;
+      return `url('${abs}')`;
+    });
+  }
+  return css;
+}
+
+module.exports = { tokenCss, TOKENS };

package/src/mcp-server.js

@@ -531,9 +531,38 @@ const handlers = {
   async amicus_fanout(input, project) {
     const cwd = project || getProjectDir(input.project);
     const { generateTaskId } = require('./sidecar/start');
-    const { deriveLegIds } = require('./sidecar/fanout');
+    const { deriveLegIds, DEFAULT_MAX_LEGS } = require('./sidecar/fanout');
+
+    // Resolve a single effective models list (council OR models), validated
+    // BEFORE any wave dir / metadata is written so a bad request never strands
+    // a pid-less 'running' orphan wave.
+    const inputModels = Array.isArray(input.models) ? input.models : [];
+    const hasModels = inputModels.length > 0;
+    const hasCouncil = typeof input.council === 'string' && input.council.trim();
+    if (hasModels && hasCouncil) {
+      return textResult("Pass exactly one of 'models' / 'council', not both.", true);
+    }
+    let effectiveModels;
+    if (hasCouncil) {
+      const { resolveCouncilMembers } = require('./utils/config');
+      const { readCache } = require('./utils/model-catalog');
+      const catalog = (readCache() || {}).models || [];
+      const expanded = resolveCouncilMembers(input.council.trim(), catalog);
+      if (expanded.error) { return textResult(expanded.error, true); }
+      effectiveModels = expanded.models;
+    } else if (hasModels) {
+      effectiveModels = inputModels;
+    } else {
+      return textResult("Provide 'models' or 'council'.", true);
+    }
+    const envCap = Number(process.env.AMICUS_FANOUT_MAX_LEGS);
+    const maxLegs = (Number.isInteger(envCap) && envCap > 0) ? envCap : DEFAULT_MAX_LEGS;
+    if (effectiveModels.length > maxLegs) {
+      return textResult(`Council/model list exceeds the fan-out cap of ${maxLegs} legs.`, true);
+    }
+
     const waveId = generateTaskId();
-    const legIds = deriveLegIds(waveId, input.models.length);
+    const legIds = deriveLegIds(waveId, effectiveModels.length);
     const waveDir = getSessionDir(cwd, waveId);
 
     let briefingPath;
@@ -545,14 +574,14 @@ const handlers = {
       fs.writeFileSync(briefingPath, input.prompt, { mode: 0o600 });
       fs.writeFileSync(path.join(waveDir, 'metadata.json'), JSON.stringify({
         taskId: waveId, type: 'wave', status: 'running', legs: legIds,
-        models: input.models, headless: true, createdAt: new Date().toISOString(),
+        models: effectiveModels, headless: true, createdAt: new Date().toISOString(),
       }, null, 2), { mode: 0o600 });
     } catch (err) {
       return textResult(`Failed to prepare fan-out wave: ${err.message}`, true);
     }
 
     const args = [
-      'fanout', '--models', input.models.join(','),
+      'fanout', '--models', effectiveModels.join(','),
       '--prompt-file', briefingPath, '--wave-id', waveId,
       '--json', '--client', 'cowork', '--cwd', cwd,
     ];
@@ -584,7 +613,11 @@ const handlers = {
   async amicus_council_tally(input) {
     try {
       const { tally } = require('./council/tally');
-      return textResult(JSON.stringify(tally(input)));
+      const record = tally(input);
+      // Auto-append to the reliability ledger (parity with `amicus council
+      // tally`). Best-effort: a ledger write failure must not fail the tally.
+      try { require('./council/ledger').appendRun(record); } catch { /* best-effort */ }
+      return textResult(JSON.stringify(record));
     } catch (err) { return textResult(`council tally failed: ${err.message}`, true); }
   },