amicus 4.4.1 → 4.5.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,136 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.5.0] - 2026-07-28
+
+"Save and share your councils" — complex run configurations become one command, repeatable and
+shareable, and the flagship Council Workspace stops being opt-in on its best client.
+
+### Added
+
+- **Policy packs — save a full run configuration and invoke it by name.** `amicus pack save <name>
+  --kind council|fanout|solo [flags]` (or `--from-run <id>`, which captures an existing council
+  run / fanout wave / solo session instead of typing flags) writes one JSON file per pack to
+  `~/.config/amicus/packs/<name>.json`; `pack list` / `pack show` / `pack rm` manage them. `--pack
+  <name|path>` on `amicus start` / `fanout` / `council run` — and the new `pack` param on the
+  `amicus_start` / `amicus_fanout` / `amicus_council_run` MCP tools — loads a pack's bench,
+  chair/critic/lenses, options, and briefing template as this run's defaults. **Explicit flags
+  always override the pack's values, and the pack is recorded either way** — `pack: {name,
+  version, hash, source}` lands on the resulting session `metadata.json`, wave `metadata.json` /
+  `wave.json`, or council `run.json`. Precedence throughout: **flag > pack > config default >
+  built-in default**. A pack is validated on save (hard-fail — `PACK_INVALID` — with any
+  non-fatal warnings printed to stderr) and again whenever it's used to launch a run; `pack show`
+  never fails on an invalid pack, only reports what's wrong with it; `pack show` and `pack rm` both
+  return `PACK_NOT_FOUND` for a missing pack. New `schemas/pack.schema.json`.
+- **MCP pack semantics.** Over MCP, `pack` resolves entirely **in-process**, on the same call that
+  reads it — a resolved pack is never forwarded as `--pack` to a spawned child. Two knobs get
+  special-cased handling for CLI parity: a pack's `options.maxCost` and `briefing.template` have no
+  MCP schema param of their own on `amicus_start`/`amicus_fanout`, but they still apply — forwarded
+  to the spawned CLI child's argv as `--max-cost`/`--template` (`amicus_fanout` always spawns;
+  `amicus_start`'s spawn-fallback path does the same), or, on `amicus_start`'s in-process
+  shared-server path, applied via the same budget-gate/template-render code the CLI itself uses,
+  before any session is created — so a shared pack's spend cap and briefing template never silently
+  vanish over MCP. (`amicus_council_run` already has real MCP params for both.) Any *other* pack
+  knob with no destination in a tool's own MCP input schema is never silently dropped either: it
+  surfaces as an explicit `Notice: pack '<name>' sets <key>, which <tool> does not support over
+  MCP — ignored.` content block, naming the pack's own camelCase option key (e.g. `contextTurns`,
+  never the CLI's `context-turns`). Concretely, `amicus_fanout` has no MCP destination for
+  `options.contextTurns` / `options.contextMaxTokens` (both notice); `amicus_start` has real params
+  for both, so neither does.
+- **Council packs do not accept `agent`/`thinking`/`summaryLength`.** They were inert on every
+  surface — no council code path, CLI or MCP, ever reads a pack-filled one; the engine hardcodes
+  agent `Plan`/summaryLength `verbose` regardless of what a pack says — so `KIND_OPTIONS.council`
+  never accepted them; a council pack that sets one fails `pack save` (`PACK_INVALID`), naming the
+  offending key. They remain valid, and functional, on `fanout`/`solo` packs.
+- **Briefing templates.** `amicus template list|show`, plus `--template <name|path>` / `--artifact
+  <file>` / `--var <k=v>` (repeatable) on `start` / `fanout` / `council run`, render a
+  `{{variable}}` briefing before it's sent. Templates are Markdown files in
+  `~/.config/amicus/templates/` — a same-named user file shadows a built-in, the same precedent
+  saved councils already use — and v4.5 ships one built-in, `review`. Known variables: `{{prompt}}`,
+  `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.<key>}}`. Rendering is
+  strict by design: an unknown variable, a slot with no data behind it, or data passed with no slot
+  to receive it are all hard errors (`TEMPLATE_RENDER`) rather than a silently dropped value. MCP
+  has no `template` param of its own on any of the three run tools — a pack's `briefing.template` is
+  the only way a template reaches an MCP-invoked run.
+- **The Council Workspace auto-opens on `amicus_council_run` from Claude Code (local).** When the
+  MCP tool `amicus_council_run` is invoked from Claude Code (local), the same Electron window that
+  `amicus watch <runId> --ui` has always opened by hand now launches automatically, detached, right
+  after the run starts — no more separate `--ui` call to see the flagship v4.4 surface. The CLI
+  `amicus council run` is unaffected (there is no MCP client to detect on that path). Decision
+  order: an explicit `ui: false` param beats everything; the hard guards (Electron not installed —
+  this path never installs it; Linux with no `DISPLAY`) beat even an explicit `ui: true`; `ui: true`
+  then overrides both the new `workspace.autoOpen` config key and the client check; short of an
+  explicit param, `workspace.autoOpen === false` disables it, and any client other than Claude Code
+  (local) simply doesn't auto-open. New `workspace.autoOpen` config key (`config.json`, default on
+  — only an explicit `false` turns it off). The tool response carries `workspaceOpened: boolean`
+  and, only when it did not open, `workspaceOpenReason` (`param-suppressed`, `electron-absent`,
+  `no-display`, `config-disabled`, `client-not-code-local`, or a `spawn-failed:` /
+  `auto-open-failed:` detail).
+
+### Fixed
+
+- **A failed council seat no longer renders as perpetually live.** `createSession`'s early return
+  under a shared server bypassed the terminal `progress.json` write, leaving a stage marked
+  in-progress in `progress.json` after `metadata.json` had already recorded the error. The
+  terminal-write logic is now one shared helper (`writeTerminalProgressSafe`), called at all three
+  early-return sites plus the original one, so the paths can no longer drift apart.
+- **Collided artifact names no longer misattribute one model's prose to another's.** Two bench
+  models whose sanitized filenames collide (e.g. `vendor/a` and `vendor?a` both → `vendor-a`) share
+  one physical file on disk; the Council Workspace compounded that with a rendering bug that showed
+  the first model's review/judge prose under the *second* model's panel — including, in a `--debate`
+  run, the rebuttal/re-vote drill-in. Collided names now get a deterministic suffix (`~2`, `~3`,
+  …), and every Workspace file lookup consults the resulting name map instead of recomputing a bare
+  sanitized name — the second colliding model's row is now correctly dropped by the existing
+  presence filter (its suffixed name was never physically written) instead of showing the wrong
+  model's text, and a run-integrity banner names the collision so the gap reads as a known
+  limitation rather than missing data.
+- **A blind-mode toggle no longer collapses every open prose panel or repaints twice.** Flipping
+  Blind mid-run used to unconditionally recompute the blind default, forcing one paint with the
+  wrong value, a restore, and a second compensating repaint — and reset every lazy-loaded panel's
+  open/loaded state along the way, closing whatever the user had expanded. Blind state and
+  lazy-panel state now key off whether the run — and, separately, its status — actually changed
+  since the last render, so a same-run toggle updates in place and paints once without closing any
+  open panel; a run reaching its terminal status still recomputes the blind default and auto-reveals
+  exactly as before.
+- **`renderSeats` now reorders rows to match the composed run document.** The keyed seat-table
+  update already added and removed rows on change but never moved one, so the table's row order
+  froze at first render — visibly wrong once a repair solo or a new wave changed the underlying leg
+  order mid-run. Existing rows are now moved into place at the end of every render pass.
+- **`amicus council show` no longer reports a catalog-delisted bench member as healthy, and a
+  dropped member is no longer invisible to scripted/MCP callers.** `show`'s resolved/dropped split
+  checked only whether a member's alias mapped to *some* id, never whether that id was still in
+  the cached catalog — so a preset member whose alias now resolves to a catalog-absent id (e.g. a
+  direct-vendor route with no matching cached row) read as fully healthy in `show` while the real
+  run path (`resolveCouncilMembers`) silently dropped it on every actual run. `show` now reuses
+  that exact check — alias resolution, then catalog membership, with the same local-provider/
+  offline-catalog rule that a catalog it cannot consult never blocks a member, only a non-empty
+  catalog that omits it does. Separately, `council run --json` already suppressed the human-mode
+  `Notice: dropped unavailable council member(s): ...` line, and `run.json` carried no field for
+  it at all — a JSON-mode or MCP caller had zero signal a bench member vanished short of diffing
+  `bench` against the preset's nominal member list. `run.json` now carries an additive
+  `droppedMembers: [{member, reason}]` array (present only when at least one member was actually
+  dropped), reaching the `--json` envelope and the `amicus_council_run` MCP response body for
+  free. Resolution behavior itself — which members run, exit codes, spend — is unchanged; this is
+  observability only.
+
+### Changed
+
+- **`amicus_start` / `amicus_fanout`'s MCP schemas no longer declare a JSON-Schema `default` for
+  `agent`, `noUi`, or `includeContext`.** Client-visible metadata only — nothing behavioral: the
+  defaults are still applied at the same read sites they always were, and are still stated in each
+  param's own description. (`amicus_resume` / `amicus_continue`'s `noUi` keep their schema-level
+  default; they were not part of this pass.)
+
+### Removed
+
+- **The inert `repairCanHonorContract` guard.** 4.4.1's empty-findings acceptance flipped this
+  predicate permanently true by its own design, so `run-stages.js`'s `repairable &&` check could no
+  longer short-circuit on it and no test failed if the function were deleted outright — a
+  silent-deletion hazard that would otherwise re-arm the deadlock it used to guard against the day
+  empty-set validation tightens again. Removed deliberately instead: the underlying reasoning moved
+  to its call site, and the zero-findings regression test's comment now explains why the case it
+  covers still holds without the guard.
+
 ## [4.4.1] - 2026-07-27
 
 A fast-follow patch on 4.4.0. Every item is a correction to something already shipped, and almost all of it was measured against real paid council runs rather than reasoned about — the five gate councils that certified the Council Workspace are also what found these. Five behaviour changes ride along and are called out under **Changed**, because a user upgrading a patch should not discover them by surprise.

package/README.md

@@ -52,7 +52,7 @@ One install delivers six things that work together:
 - **The `amicus` CLI (with an `am` alias) and an MCP server.** The engine underneath both skills: launches sessions, shares context, runs parallel waves, and exposes the same surface to Claude as MCP tools.
 - **A self-updating model catalog.** Aliases and validation resolve against a live catalog fetched from provider APIs (cached locally), so model names stay current without a hard-coded table.
 - **Observability.** `amicus watch <id>` renders any live or finished run (fan-out or council) from any terminal; `--follow` streams milestones as they happen; `--on-complete` fires a hook when a run lands; `--retry-failed` plus opt-in cheaper-model fallbacks recover dead legs without relaunching the whole wave; `amicus spend` answers "what did this cost, and where" with per-run attribution.
-- **Council Workspace.** `amicus watch <runId> --ui`: a window that shows a council *thinking* — live seats, the anonymized judge packet, the adjudication matrix, dissent drill-in, chair verdict, and cost-by-seat — for both live and historical runs.
+- **Council Workspace.** `amicus watch <runId> --ui`: a window that shows a council *thinking* — live seats, the anonymized judge packet, the adjudication matrix, dissent drill-in, chair verdict, and cost-by-seat — for both live and historical runs. It also **auto-opens** on an MCP-invoked council run from Claude Code (local), so you no longer have to remember the flag (see [The Council](#the-council)).
 
 Claude is the orchestrator. The council and chat skills run *on top of* the engine; you talk to Claude, and Claude drives Amicus.
 
@@ -267,6 +267,17 @@ The `amicus_fanout` MCP tool takes the same `council` parameter, and the `second
 
 **Council presets.** Save your own named member lists with `amicus council save <name> --models a,b,c` (≥2 resolvable aliases or `provider/model` IDs), then run them with `--council <name>` anywhere a council runs. `amicus council list` shows saved presets plus three built-in benches that work with no setup at all — `free` (the same zero-cost dynamic pick described above, used when you haven't seeded `councils.free`), `budget` (cheap workhorses, one per vendor family), and `frontier` (premium flagships, one per vendor family). `amicus council show <name>` resolves any of them (saved or built-in) and reports which members are currently usable. A saved council always shadows a built-in of the same name — exactly how the wizard's `councils.free` seeding already worked.
 
+**Policy packs (v4.5).** A council preset only saves the bench. A **pack** saves the whole run — bench, chair, critic/lenses, cost/timeout options, and a briefing template — as one named, shareable JSON file:
+
+```bash
+amicus pack save review-bench --kind council --bench gemini,deepseek,gpt --chair opus --timeout 20 --max-cost 2
+amicus council run --pack review-bench --prompt-file plan.md --json
+```
+
+Any flag you also type on that second line overrides just that value — a pack only fills in what you didn't say explicitly, and it's recorded on the run either way. Packs work the same way on `fanout`/`start` and on the `amicus_fanout`/`amicus_start`/`amicus_council_run` MCP tools. `amicus pack list`/`show`/`rm` manage them, and `--from-run <id>` builds one from a run you already liked instead of typing flags at all. Full reference: [docs/usage.md § Policy packs](./docs/usage.md#policy-packs).
+
+**Briefing templates (v4.5).** `--template <name> --artifact <file>` (plus repeatable `--var k=v`) renders a `{{prompt}}`/`{{artifact}}`-style Markdown template before it's sent, on `start`/`fanout`/`council run` alike — templates live in `~/.config/amicus/templates/`, and a pack's `briefing.template` is how one reaches an MCP-invoked run (MCP has no template param of its own). `amicus template list|show` manage them; v4.5 ships one built-in, `review`. Full reference: [docs/usage.md § Briefing templates](./docs/usage.md#briefing-templates).
+
 ---
 
 ## The parallel window
@@ -323,6 +334,8 @@ amicus update
 | `amicus provider` | Add/list/test/remove local, OpenAI-compatible providers (LM Studio, Ollama, vLLM) — configured with `--preset` or `--url`, at **$0** marginal cost (`--json` on every subcommand). |
 | `amicus council` | Council math: `tally <input.json>` (deterministic tiers + ledger append), `stats` (reviewer reliability), `report <verdict.json> [--md\|--html]`, `validate <file>` (findings-block check, exit 0/2/1), `verdict <tally.json> [--decisions <d.json>] [-o <out.json>]` (build + write verdict.json). Presets: `save <name> --models a,b,c`, `list [--json]`, `show <name> [--json]` — see [The Council](#the-council) for the built-in `free`/`budget`/`frontier` benches. |
 | `amicus council run` | The headless council engine: Stage-1 reviews → anonymized cross-review → deterministic tally → non-Claude chair verdict, in one command with no Claude runtime. Add `--debate` for a Stage-2.5 rebuttal round (raisers defend/amend/withdraw, disputing judges re-vote) and `--claude-review <file>` to enter Claude's own review as judged review N+1. Writes a run directory with `verdict.json` (including `overallVerdict`) and `report.html` — see [docs/council.md](./docs/council.md#amicus-council-run). |
+| `amicus pack` | Save a full run configuration — bench, chair/critic/lenses, options, briefing template — and invoke it by name: `save <name> --kind council\|fanout\|solo [flags]` (or `--from-run <id>`), `list`, `show <name>`, `rm <name>`. `--pack <name>` on `start`/`fanout`/`council run` loads one; explicit flags always override it. See [docs/usage.md § Policy packs](./docs/usage.md#policy-packs). |
+| `amicus template` | `list`/`show <name>` a briefing template. `--template <name> [--artifact <file>] [--var k=v]` on `start`/`fanout`/`council run` renders one before the briefing is sent. See [docs/usage.md § Briefing templates](./docs/usage.md#briefing-templates). |
 | `amicus abort` | Abort a running session (or `--all`). |
 | `amicus setup` | Configure default model, API keys, and aliases. |
 | `amicus update` | Update to the latest version. |
@@ -351,7 +364,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/bin/amicus.js

@@ -152,6 +152,16 @@ async function main() {
       case 'update':
         await handleUpdate();
         break;
+      case 'template': {
+        const { handleTemplate } = require('../src/cli-handlers-template');
+        exitCode = await handleTemplate(args);
+        break;
+      }
+      case 'pack': {
+        const { handlePack } = require('../src/cli-handlers-pack');
+        exitCode = await handlePack(args);
+        break;
+      }
       default: {
         console.error(`Unknown command: ${command}`);
         // suggestCommand honors a cap-3 contract (up to 3 candidates, closest

package/docs/ROADMAP.md

@@ -11,7 +11,9 @@ Amicus is at **v4.4.1** (2026-07-27), the fast-follow patch on v4.4.0 (tagged 20
 4.x rev below leads with the benefit, not the plumbing.
 
 **Status:** v4.0 through **v4.4.1** have **shipped** — everything down to the v4.5 heading is a
-record of what landed, not a plan. **v4.5 (policy packs + composition) is the next rev.** v5.0
+record of what landed, not a plan. **v4.5 (packs + templates + auto-open) is the next rev**, with
+**v4.6 (composition + tagging + GUI ergonomics)** behind it — the former combined v4.5 scope,
+split 2026-07-27 (design: `docs/superpowers/specs/2026-07-27-v4.5-save-and-share-design.md`). v5.0
 remains forward-looking.
 
 > 📁 **Reading this from an npm install?** Some references below point at working documents that
@@ -85,18 +87,38 @@ and a review that honestly finds nothing stops being an error.
 > repo's working notes (`.superpowers/sdd/v441/backlog-and-proposal.md`, local-only) and in the
 > repo's root `BACKLOG.md` — neither ships in the npm package; see the note at the top.
 
-## v4.5 — "Save, share, and compose your councils"
-**Benefit:** complex councils become one-command, repeatable, and chainable.
+## v4.5 — "Save and share your councils" *(scope split 2026-07-27 — composition moved to v4.6)*
+**Benefit:** complex councils become one-command, repeatable, and shareable — and the flagship GUI
+stops hiding. Design: `docs/superpowers/specs/2026-07-27-v4.5-save-and-share-design.md`.
 - **★ Auto-open the Council Workspace on a council run (Christian, 2026-07-26)** — when a council is
-  invoked from Claude Desktop and Electron is already present, the Workspace window opens by
+  invoked from Claude Code (local) and Electron is already present, the Workspace window opens by
   default instead of requiring a separate `amicus watch <runId> --ui`. Today the GUI is opt-in and
   discoverable only from `watch --help`, so the flagship v4.4 surface goes unseen on the very
   client best able to show it. *(S–M; the pieces exist — see the design notes below.)*
 - **Council policy packs + full run-profiles** (bench + lenses + options + briefing template, invoke by name) — B7/F5 *(M)*
-- **Composable/chained waves** (`--input-from <waveId>` / pipe) for generate→critique→refine — F6 *(M)*
-- **Briefing templates + library** (F9), **session/wave tagging + `--search` + grouped history** (F8), **GUI power ergonomics** (F10) *(S–M)*
-- **README + docs update** — policy packs, chained waves, and the briefing-template library in `README.md` and `docs/` *(S)*
-> Why here: velocity multipliers that only pay off once councils are a command (v4.0) and observable (v4.3/v4.4).
+- **Briefing templates + library** (F9) *(S–M)* — the foundation packs reference; the `{{input}}`
+  chaining variable and the `critique`/`refine` built-ins arrive with v4.6
+- **Ride-along fixes** — FR-1 (a failed council seat can render perpetually live), the FR-2 ruling,
+  RN-1/RN-5/RN-11 Workspace renderer fixes, TST-3 real-CDP abort pass *(S each; dispositions for
+  all 17 open items are tabled in the design doc's §8)*
+- **README + docs update** — policy packs, the template library, and auto-open in `README.md` and `docs/` *(S)*
+> Why here: save/share velocity multipliers that only pay off once councils are a command (v4.0)
+> and observable (v4.3/v4.4); auto-open makes the v4.4 surface discoverable on its best client.
+
+## v4.6 — "Compose your councils" *(specced after v4.5 ships — anti-rot rule)*
+**Benefit:** councils chain — generate → critique → refine with no manual copy-paste — and history
+becomes navigable.
+- **Composable/chained waves** (`--input-from <id>` / `--prompt-file -` pipe + per-source digests) —
+  F6 *(M)* — brings the `{{input}}` template variable + the `critique`/`refine` built-ins
+- **Session/wave tagging + `--search` + grouped history** (F8) *(S–M)*
+- **GUI power ergonomics** (F10: focus-follows fold hotkey, distinguishable window titles, tiling
+  presets) *(S each)*
+- Deferred-item candidates per the v4.5 design doc's §8: RN-2, TST-1/TST-2, REL-2, CA-4, LC-5,
+  remainder of TST-7
+- **README + docs update** *(S)*
+> The 2026-07-19 combined spec (`2026-07-19-v4.5-policy-packs-composition-design.md`) holds the
+> approved chaining/tagging/F10 design detail and is the primary input to the v4.6 brainstorm; it
+> is NOT executed as-written — v4.6 gets its own spec + fresh plan once v4.5 ships.
 
 ### Deferred out of v4.4.1 into v4.5 (2026-07-27)
 
@@ -107,6 +129,10 @@ disposition that put them here in `.superpowers/sdd/v441/backlog-and-proposal.md
 those notes, read that backlog's Appendix A (settled decisions) and Appendix B (known false
 positives) before re-filing anything from this list.**
 
+**Disposition update (2026-07-27):** every item below (plus FR-1/2/3 from `BACKLOG.md`) now carries
+a proposed disposition — v4.5 ride-along / v4.6 / backlog — tabled for ruling in §8 of
+`docs/superpowers/specs/2026-07-27-v4.5-save-and-share-design.md`.
+
 | ID | What | Why not 4.4.1 |
 |---|---|---|
 | **CA-4** | `tally.json`'s `runStats` omits Stage-2 judges, repair solos and failed chair attempts (5 rows for 11 real legs in `wsgate04`) | `M` — a schema question, not a fix |
@@ -154,9 +180,9 @@ rather than re-deriving them.
 | Is Electron usable | `src/sidecar/electron-install.js` `isElectronUsable` / `resolveElectronBinary` |
 | Current entry point | `amicus watch <runId> --ui` (`src/cli-handlers-watch.js:87`) |
 
-**"Claude Desktop" maps to `code-local`.** ⚠️ But `detectClient` reads the MCP client's
+**"Claude Code (local)" maps to `code-local`.** ⚠️ But `detectClient` reads the MCP client's
 `getClientVersion().name`, so it **only works on the MCP path** — `amicus_council_run`, which is
-exactly the Claude Desktop case. A `council run` typed into a terminal has no MCP server, so
+exactly the Claude Code (local) case. A `council run` typed into a terminal has no MCP server, so
 detection there falls through to the env override or the `cowork` status-quo default. Do not build
 this on the CLI path expecting detection to work; either gate it on the MCP entry point or thread
 an explicit client tag through. (Related: the Phase 12 backlog item about persisting the client tag

package/docs/configuration.md

@@ -220,6 +220,8 @@ Everything lives under `~/.config/amicus/` (`getConfigDir()` in `src/utils/confi
 | `sessions-index.json` | `session-index.js` (`recordSession`, written at session start) | A **global** map of `taskId → project path`, consulted only when a per-project session lookup misses (e.g. an MCP server whose cwd differs from where the session was created). Navigation aid only, never authoritative — a corrupt index degrades to "no entry," never a crash. |
 | `council-ledger.jsonl` | `src/council/ledger.js` (`appendRun`), on every `council tally` | One row per council model per run — findings raised, severity breakdown, street-cred, conformance. Read back by `amicus council stats`. |
 | `spend-ledger.jsonl` | `src/utils/spend-ledger.js` (`appendSpend`), new in Phase 16 | One row per completed run/leg — tokens + resolved cost. Read back by `amicus spend` for the cross-run rollup. Append is best-effort and can never fail the run it's recording; safe to delete (starts fresh, loses history only). |
+| `packs/<name>.json` (v4.5) | `amicus pack save` (`src/pack/pack-store.js`) | One JSON file per saved policy pack — bench/model, chair/critic/lenses, options, and a briefing-template *reference*. Peer directory of `templates/` below. Safe to inspect, hand-edit, or delete individually; see [Policy packs](./usage.md#policy-packs). |
+| `templates/<name>.md` (v4.5) | You, by hand (your editor is the manager) | User-authored briefing templates; a file here shadows a built-in of the same name. Amicus itself never writes into this directory — there is no `template save`/`rm`. See [Briefing templates](./usage.md#briefing-templates). |
 
 **Tmp-file pattern.** Several writers (`model-catalog.json`, `sessions-index.json`, session
 metadata) use an atomic write: a temp file named `.<target>.<pid>.<random>.tmp` is written
@@ -328,6 +330,16 @@ level includes everything above it.
       "apiKeyEnv": "VLLM_LAB_API_KEY",
       "pricing": { "prompt": 0.0000005, "completion": 0.0000015 }
     }
+  },
+
+  // v4.5: opt out of auto-opening the Council Workspace window on an
+  // MCP-invoked `amicus_council_run` from Claude Code (local). Absent, null,
+  // or anything other than a literal `false` leaves auto-open ON — only an
+  // explicit `false` here disables it. See docs/council.md's Council
+  // Workspace section for the full decision order (the `ui` MCP param and
+  // the hard guards both take precedence over this key either way).
+  "workspace": {
+    "autoOpen": false
   }
 }
 ```
@@ -337,6 +349,18 @@ A provider id may not shadow one of the five built-in vendors — `openrouter`,
 An alias whose value is missing, `null`, or not a string is stripped on the next `saveConfig()`
 call, with a notice printed to stderr — `config.json` never accumulates dead aliases silently.
 
+**Policy pack precedence.** A saved [policy pack](./usage.md#policy-packs) sits between your flags
+and whatever this repo's existing default logic already was for a given knob — the resolution
+order everywhere a pack applies is **flag > pack > config default > built-in default.** A pack only
+fills in a value you did not type explicitly on the command line; everything below that layer is
+unchanged from before packs existed. `--gateway` is the clearest example with all four tiers live
+today: an explicit `--gateway` wins, then a pack's `options.gateway`, then `routing.prefer` in
+`config.json` (this section, above), then the hard-coded `"auto"` fallback. Most other pack-fillable
+options (`timeout`, `maxCost`, `agent`, `thinking`, …) have no `config.json`-level default yet — just
+a hard-coded built-in (`DEFAULTS` in `src/cli.js`) — so for those the chain is effectively **flag >
+pack > built-in** today. See [Policy packs](./usage.md#policy-packs) for the full per-kind field
+reference.
+
 ### Uninstall instructions
 
 `npm uninstall -g amicus` removes the package and its bin shims. It does **not** clean up everything

package/docs/council.md

@@ -23,6 +23,7 @@ orchestration recipe. This page is the reference for the artifacts that recipe p
 - [`amicus council run`](#amicus-council-run)
   - [Debate mode](#debate-mode)
 - [Council Workspace (GUI)](#council-workspace-gui)
+  - [Auto-open on `amicus_council_run` (v4.5)](#auto-open-on-amicus_council_run-v45)
 - [`amicus council validate`](#amicus-council-validate)
 - [`amicus council tally`](#amicus-council-tally)
 - [`amicus council verdict`](#amicus-council-verdict)
@@ -103,6 +104,8 @@ amicus council run --prompt-file <briefing.md>
     [--out-dir <dir>]                       # default ./council-<runId>/
     [--json] [--max-cost <usd>] [--timeout <min>]
     [--gateway auto|direct|openrouter] [--no-validate-model]
+    [--template <name|path>] [--artifact <file>] [--var k=v]  # v4.5, see docs/usage.md#briefing-templates
+    [--pack <name|path>]                                       # v4.5, see docs/usage.md#policy-packs
 ```
 
 **The headless engine (v4.0).** Everything the `second-opinion` skill orchestrates by hand in
@@ -118,6 +121,12 @@ Key semantics:
 - `--prompt-file` is **required** — councils always have real briefings (no inline `--prompt`).
 - Seat/chair/critic/lens validation happens **pre-flight** and fails through the error envelope
   (exit 1) before any spend. The chair must not be a bench seat.
+- **`--pack <name|path>` (v4.5)** loads a saved bench/chair/critic/lenses/options/template as this
+  run's defaults — any flag you also typed always overrides the pack's value for that field, and
+  the pack is recorded on `run.json` (`pack: {name, version, hash, source}`) either way. When a
+  pre-flight error names a value the pack supplied (e.g. "chair is a bench seat"), the message adds
+  `(set by pack '<name>')` so a pack-caused failure is never mistaken for a typo in your own flags.
+  Full reference: [docs/usage.md § Policy packs](./usage.md#policy-packs).
 - `--timeout` is the **per-leg** timeout (existing fanout semantics); there is no run-level
   watchdog in v4.0 — bound the aggregate with your CI job timeout.
 - `--max-cost` is a **whole-run** ceiling checked before each paid stage launch (Stage-1 wave,
@@ -154,6 +163,17 @@ Key semantics:
     proceeded** on one server per wave, the configuration that races. Also printed as a
     `Notice:`. It does not change the exit code; treat its presence as "expect degraded
     results".
+- **A `--council <preset>` member that resolution drops is recorded on `run.json`, not just
+  printed.** A preset member whose alias no longer resolves, or whose resolved id has fallen out
+  of the cached model catalog, is silently excluded from `bench` (the same graceful-degradation
+  `resolveCouncilMembers` applies everywhere) — human mode also prints a `Notice: dropped
+  unavailable council member(s): ...`, but `--json` mode (every scripted/MCP caller) printed
+  nothing at all. `run.json` now carries an additive `droppedMembers: [{member, reason}]` array —
+  present only when at least one member was actually dropped. The `--json` envelope carries it
+  via the same run.json serialization; the `amicus_council_run` MCP response body includes it
+  via an explicit conditional spread (`...(droppedMembers.length ? { droppedMembers } : {})`),
+  hand-built separate from run.json. `amicus council show <name>` reports the identical resolved/dropped split (and the
+  same per-member reason) as a preview, before you spend anything.
 - Chair failure recovery: one retry of the same chair → promote the highest peers-only
   street-cred model (from `amicus council stats`) that is not a bench seat → give up and write
   the verdict with `overallVerdict: null`.
@@ -367,6 +387,45 @@ gated by a 7-channel allowlist, a CSP with **no network directive at all** (`def
 and every model-derived string reaches the DOM through `textContent`/`createTextNode` only —
 never `innerHTML`, enforced by a static source scan in the test suite.
 
+### Auto-open on `amicus_council_run` (v4.5)
+
+The window above no longer needs a separate `amicus watch <runId> --ui` call every time. When the
+**MCP tool** `amicus_council_run` is invoked from **Claude Code (local)**, Amicus launches this same
+Council Workspace window automatically, detached, right after the run starts — the flagship v4.4
+surface is no longer opt-in on the client best able to show it. The plain CLI `amicus council run`
+is unaffected: `detectClient` (`src/utils/client-detect.js`) only resolves from the MCP `initialize`
+handshake, so a terminal invocation has no client to detect and never auto-opens; use
+`amicus watch <runId> --ui` there as before.
+
+**Decision order** (`shouldAutoOpenWorkspace`, `src/sidecar/workspace-auto-open.js`) — read top to
+bottom, first match wins:
+
+1. The tool's `ui: false` param — **beats everything**, including every guard below.
+2. The hard guards, which beat even an explicit `ui: true`: Electron is not installed (this path
+   **never** installs it — that would be a surprise ~100 MB download on someone's first MCP council
+   run) → does not open; on Linux, no `DISPLAY` in the environment → does not open.
+3. The tool's `ui: true` param — overrides both the config key and the client check below (but
+   never a hard guard above).
+4. `workspace.autoOpen === false` in `config.json` (see
+   [Configuration § Config file format](./configuration.md#config-file-format)) → does not open.
+5. The caller isn't Claude Code (local) (i.e. `client !== 'code-local'` — Claude Desktop/Cowork and
+   Claude Code web are deliberately excluded from the default) → does not open.
+6. Otherwise → opens.
+
+**Response fields.** `amicus_council_run`'s result always carries `workspaceOpened: boolean`, and,
+**only when it did not open**, `workspaceOpenReason` — one of `param-suppressed`, `electron-absent`,
+`no-display`, `config-disabled`, `client-not-code-local`, or a `spawn-failed:`/`auto-open-failed:`
+detail if the decision said to open but the launch itself failed. The launch is fire-and-forget: it
+never blocks the tool's response, and a launch failure never fails the council run itself — the run
+proceeds exactly as it would with no Workspace at all, and `amicus watch <runId> --ui` still works
+as the manual fallback.
+
+**The `ui` param and the `workspace.autoOpen` config key are independent knobs, not aliases of each
+other** — `ui` is a **per-call** override (either direction), while `workspace.autoOpen` sets the
+**standing default** every call without an explicit `ui` falls back to. Turning the config default
+off does not stop you from asking for the window on one particular run with `ui: true`, and leaving
+the default on does not stop you from suppressing it on one noisy run with `ui: false`.
+
 ---
 
 ## `amicus council validate`

package/docs/schemas.md

@@ -27,6 +27,7 @@ Schemas leave `additionalProperties` open for exactly this reason — a doc with
 | [`error.schema.json`](../schemas/error.schema.json) | every `--json` pre-flight/validation/route failure (stdout, exit 1) and every MCP error tool-text |
 | [`spend.schema.json`](../schemas/spend.schema.json) | `spend --json` |
 | [`model-catalog.schema.json`](../schemas/model-catalog.schema.json) | `models --json` |
+| [`pack.schema.json`](../schemas/pack.schema.json) | policy pack configuration files (council, fanout, or solo) |
 | [`alias-audit.schema.json`](../schemas/alias-audit.schema.json) | `models --check --json` |
 | [`doctor.schema.json`](../schemas/doctor.schema.json) | `doctor --json` |
 | [`council-tally.schema.json`](../schemas/council-tally.schema.json) | `council tally --json`; `amicus_council_tally` |