amicus 4.4.1 → 4.5.0

package/docs/usage.md

@@ -42,6 +42,13 @@ amicus council run --prompt-file <b.md> --models a,b,c --chair <m> [--json]  # H
 amicus council save <name> --models a,b,c # Save a named council preset (>=2 resolvable members)
 amicus council list [--json]              # List saved councils + built-ins (free/budget/frontier)
 amicus council show <name> [--json]       # Resolve a council (saved or built-in) and show its members
+amicus template list [--json]              # List briefing templates (built-ins marked)
+amicus template show <name|path> [--json]  # Print a template's raw text
+amicus pack save <name> --kind council|fanout|solo [flags]  # Save a full run config (bench/options/template)
+amicus pack save <name> --from-run <id>    # ...or build one from an existing run/wave/session
+amicus pack list [--json]                  # List saved packs
+amicus pack show <name|path> [--json]      # Print a pack + its validation report
+amicus pack rm <name> [--json]             # Remove a saved pack
 ```
 
 ---
@@ -85,6 +92,10 @@ amicus start --model deepseek --prompt "Generate tests" --no-ui --timeout 30
 | `--setup` | Force-open configuration before launching. Does **not** relax the `--prompt`/`--prompt-file` requirement — `start --setup` still fails fast with "Error: --prompt or --prompt-file is required" if neither is given. | |
 | `--no-validate-model` | Skip model-catalog validation before launch. | validation on |
 | `--gateway <mode>` | Routing override for this launch: `auto` (direct-first), `direct` (require a direct provider key), or `openrouter` (force OpenRouter). Overrides `routing.prefer` for one call. | `auto` |
+| `--pack <name\|path>` | Load a saved [policy pack](#policy-packs) — its `model`/options/template fill in for anything you didn't type explicitly. | |
+| `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`). | |
+| `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. | |
+| `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. | |
 
 > Agents: **Chat** auto-approves reads and asks before writes/bash (interactive default); **Build** has full tool access (headless default); **Plan** is read-only analysis. `--agent Chat` is interactive-only and incompatible with `--no-ui`.
 
@@ -119,6 +130,10 @@ amicus fanout --council free --prompt "Review this design" --json
 | `--no-cost-gate` | Disable the budget gate (per-$/Mtok threshold + ceiling) for this run. |
 | `--no-validate-model` | Skip catalog validation. |
 | `--gateway <mode>` | Routing override applied to every leg: `auto` (direct-first), `direct`, or `openrouter`. |
+| `--pack <name\|path>` | Load a saved [policy pack](#policy-packs) — its bench/options/template fill in for anything you didn't type explicitly. |
+| `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`), shared by every leg. |
+| `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. |
+| `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
 
 **Shared per-leg knobs.** Every leg in the wave also accepts the same per-leg options as `start`:
 `--agent`, `--thinking`, `--timeout`, `--summary-length`, `--no-context`, `--context-*`, `--mcp*`,
@@ -180,6 +195,10 @@ amicus council run --prompt-file briefing.md --models gemini,glm --chair deepsee
 | `--debate` | Adds a Stage-2.5 rebuttal round (provisional tally → defense → re-vote → final tally) between cross-review and the final tally. |
 | `--claude-review <file>` | Enters Claude's own review from a file as judged review N+1 — no leg is ever launched for it; `claude` is a reserved seat name and may not also appear in `--models`, `--chair`, or `--critic` (pre-flight error). |
 | `--no-cost-gate` | Disable the per-leg price gate for the whole run (repairs + chair). |
+| `--pack <name\|path>` | Load a saved [policy pack](#policy-packs) — its bench/chair/critic/lenses/options/template fill in for anything you didn't type explicitly. |
+| `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`). |
+| `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. |
+| `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
 
 **Exit codes:** `0` full run · `2` degraded but reportable (fewer than 2 judges, chair failure —
 `overallVerdict: null` — a cost ceiling hit after the tally, or a `--max-cost` ceiling set over a
@@ -192,6 +211,14 @@ Field-by-field run-directory contents, the degradation table, and `verdict.json`
 `overallVerdict` are documented in **[docs/council.md](./council.md#amicus-council-run)**. This is
 the command the repo's Council Review GitHub Action (v2) runs on labeled PRs.
 
+**Auto-open the Council Workspace (v4.5).** When this run is launched through the `amicus_council_run`
+**MCP tool** from Claude Code (local), the same Council Workspace window that `amicus watch <runId>
+--ui` opens by hand also opens automatically, detached, right after the run starts — no extra call
+needed to watch it live. The plain CLI invocation above is unaffected either way: there is no MCP client to
+detect on that path. Full decision order (the `ui` MCP param, the `workspace.autoOpen` config key,
+and the four guards) is in **[docs/council.md's Council Workspace
+section](./council.md#council-workspace-gui)**.
+
 ---
 
 ## `amicus council save|list|show` — Council Presets
@@ -217,6 +244,129 @@ amicus council show budget [--json]                         # Works on built-ins
 
 ---
 
+## Briefing templates
+
+Render a `{{variable}}` briefing before it's sent — for `start`, `fanout`, and `council run` alike.
+
+```bash
+amicus template list [--json]              # Built-ins marked [built-in]; a same-named user file shadows one
+amicus template show review                # Print a template's raw text
+amicus start --model gemini --template review --artifact plan.md --var focus=performance --no-ui --json
+```
+
+**Known variables** (`src/template/render.js`): `{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}` (`YYYY-MM-DD`), `{{project}}`, `{{var.<key>}}` (from repeatable `--var key=value`). There is no `{{input}}` in v4.5 — that chaining variable, and the `critique`/`refine` built-ins that need it, arrive with v4.6's composable waves.
+
+**Strict by design — a typo fails loudly instead of silently dropping text:**
+
+| Situation | Result |
+|---|---|
+| Template uses `{{var.foo}}`, no `--var foo=...` given | Error (`TEMPLATE_RENDER`) |
+| `--var foo=...` given, template never uses `{{var.foo}}` | Notice (not an error) — printed to stderr |
+| Template uses `{{prompt}}`, no `--prompt`/`--prompt-file` given | Error |
+| `--prompt`/`--prompt-file` given, template has no `{{prompt}}` slot | Error — the text would be silently dropped |
+| Template uses `{{artifact}}`/`{{artifact_path}}`, no `--artifact` given | Error |
+| `--artifact` given, template has no `{{artifact}}`/`{{artifact_path}}` slot | Error |
+| An unrecognized `{{name}}` appears anywhere in the template | Error — lists the known variables |
+
+**Where templates live.** Markdown files in `~/.config/amicus/templates/<name>.md` — the name is the filename minus `.md`. A user file **shadows** a built-in of the same name (`amicus template list` marks it `[shadows built-in]`); there is no `template save`/`rm` — your editor is the manager. v4.5 ships one built-in, `review` (asks for a severity-tagged, artifact-grounded review ending in a one-paragraph verdict).
+
+**`--artifact <file>`** reads a file (256 KB cap) into `{{artifact}}` (its content) and `{{artifact_path}}` (its resolved path) — pass the plan/diff/design you want reviewed as a file instead of pasting it into `--prompt`.
+
+**MCP.** None of the three run tools (`amicus_start`, `amicus_fanout`, `amicus_council_run`) have a `template` param of their own — a [policy pack](#policy-packs)'s `briefing.template` is the only way a template reaches an MCP-invoked run, rendered against that call's own briefing text at the same single application point a typed `--template` would use.
+
+---
+
+## Policy packs
+
+Save a full run configuration — bench, chair/critic/lenses, options, briefing template — and invoke it by name instead of re-typing every flag.
+
+```bash
+amicus pack save <name> --kind council|fanout|solo [flags]   # build from flags
+amicus pack save <name> --from-run <id>                       # build from an existing run/wave/session
+amicus pack list [--json]
+amicus pack show <name|path> [--json]
+amicus pack rm <name> [--json]
+```
+
+Then invoke it with `--pack <name|path>` on `start` / `fanout` / `council run` — or the `pack` param on the `amicus_start` / `amicus_fanout` / `amicus_council_run` MCP tools.
+
+**What a pack can hold, per `kind`:**
+
+| Kind | Bench field | Kind-specific fields | Allowed `options.*` |
+|---|---|---|---|
+| `council` | `bench` (a saved council name, or an array of ≥2 members) | `chair`, `critic`, `lenses` | `timeout`, `maxCost`, `gateway`, `debate` |
+| `fanout` | `bench` (a saved council name, or an array of ≥2 members) | — | `timeout`, `maxCost`, `gateway`, `agent`, `thinking`, `summaryLength`, `noContext`, `contextTurns`, `contextMaxTokens` |
+| `solo` | `model` | — | `timeout`, `maxCost`, `gateway`, `agent`, `thinking`, `summaryLength`, `noUi`, `noContext`, `contextTurns`, `contextMaxTokens` |
+
+`council` packs do **not** accept `agent`, `thinking`, or `summaryLength` — they were inert on every surface (no council code path, CLI or MCP, ever reads a pack-filled one; the engine hardcodes agent `Plan`/summaryLength `verbose`), so they were dropped before release rather than shipped as dead weight a pack author would reasonably expect to work. A `council` pack that still sets one fails `pack save` with `PACK_INVALID`, naming the key. They remain valid, and functional, on `fanout`/`solo` packs.
+
+Every kind may also carry `description`, `version` (semver, default `1.0.0`), and `briefing.template` (a template **reference**, not rendered text — a pack never captures briefing prose).
+
+**Precedence: flag > pack > config default > built-in default.** A pack only fills in values you didn't type explicitly on the command line — anything you do pass always wins, and the pack is recorded on the run either way (see below), so a hand-tuned invocation of a saved pack is never ambiguous about what actually ran.
+
+**`--from-run <id>`** builds a pack from an existing council run, fanout wave, or solo session instead of flags — resolution order is council pointer → wave `metadata.json` → solo `metadata.json`. It captures the bench/model, chair/critic/lenses, and the run options that were actually used; **briefing text is never captured**, only a template *reference* when the source run recorded one.
+
+**Where packs live.** One JSON file per pack, `~/.config/amicus/packs/<name>.json`. Re-saving an unchanged pack is a no-op; saving a changed pack under an unchanged version string auto-bumps its patch version instead of silently overwriting history. Every pack also carries a content hash (sha256 of its canonical, sorted-key JSON form, first 12 hex chars) computed fresh on every read — a hand-edited pack whose `version` field you forgot to bump still gets a distinct hash on any run that used it.
+
+**Recorded on every run, whether or not any value was actually overridden:** `pack: {name, version, hash, source}` lands on the resulting solo session `metadata.json`, wave `metadata.json`/`wave.json`, or council `run.json` — `source` is `"dir"` for a saved pack invoked by name, `"path"` for one loaded by file path.
+
+**Error codes**, all through the standard `--json` error envelope:
+
+| Situation | Code |
+|---|---|
+| `pack show <missing>` | `PACK_NOT_FOUND` |
+| `pack rm <missing>` | `PACK_NOT_FOUND` |
+| `pack save` fails validation | `PACK_INVALID` (hard-fail; non-fatal warnings still print to stderr) |
+| `--pack <name>` at run time is the wrong `kind` (e.g. a `solo` pack passed to `council run`) | `PACK_KIND_MISMATCH` |
+| `pack save --from-run <unknown id>` | `BAD_SESSION` |
+
+**Over MCP, pack resolution happens entirely in-process** — `amicus_start`/`amicus_fanout`/`amicus_council_run` never spawn a child with `--pack`; the pack's values are merged onto that call's own input before validation, exactly as they would be for a typed param. Two knobs get special handling for CLI parity: a pack's `options.maxCost` and `briefing.template` have no schema param of their own on `amicus_start`/`amicus_fanout` (neither tool exposes either directly), but they still apply — forwarded to the spawned CLI child's argv as `--max-cost`/`--template` (`amicus_fanout` always spawns; `amicus_start`'s spawn-fallback path does the same), or, on `amicus_start`'s in-process shared-server path, applied via the same budget-gate/template-render code the CLI itself uses, before any session is created. (`amicus_council_run` already has real MCP params for both, so this forwarding never triggers there.) Any *other* pack knob with nowhere to land in a given tool's own MCP schema is never silently dropped either — it comes back as an explicit `Notice: pack '<name>' sets <key>, which <tool> does not support over MCP — ignored.` content block, naming the pack's own camelCase option key (e.g. `contextTurns`, never the CLI's `context-turns`). Concretely, `amicus_fanout` has no MCP destination for `options.contextTurns`/`options.contextMaxTokens` (both notice); `amicus_start` has real `contextTurns`/`contextMaxTokens` params, so no notice there. `council` packs cannot carry `agent`/`thinking`/`summaryLength` at all (see above), so there is nothing left to orphan on that surface.
+
+### Worked example — save, inspect, invoke
+
+Run end to end against the real CLI (a scratch config dir, so paths below are shown in their normal
+`~/.config/amicus` form rather than the test scratch path):
+
+```bash
+$ amicus pack save review-bench --kind council \
+    --bench gemini,deepseek,gpt --chair opus \
+    --timeout 20 --max-cost 2 --description "Standard 3-model review bench"
+Saved pack 'review-bench' v1.0.0 → ~/.config/amicus/packs/review-bench.json
+```
+
+```bash
+$ amicus pack show review-bench
+Pack 'review-bench' v1.0.0 [council] (dir: ~/.config/amicus/packs/review-bench.json)
+  hash: da084ba56162
+  description: Standard 3-model review bench
+  bench: gemini, deepseek, gpt
+  chair: opus
+  options: {"timeout":20,"maxCost":2}
+  validation: ok
+```
+
+```bash
+$ amicus council run --pack review-bench --prompt-file briefing.md --out-dir council-run --json
+```
+
+No `--models`/`--chair`/`--timeout`/`--max-cost` needed on that last line — they all came from the
+pack. Confirmed against the run's own `run.json` for this exact invocation (irrelevant keys elided):
+
+```json
+{
+  "bench": ["gemini", "deepseek", "gpt"],
+  "chair": "opus",
+  "pack": { "name": "review-bench", "hash": "da084ba56162", "source": "dir" },
+  "options": { "timeout": 20, "maxCost": 2, "gateway": "auto", "outDir": "..." }
+}
+```
+
+Adding an explicit flag overrides just that one value — `... --pack review-bench --chair gpt-pro`
+keeps the pack's bench and cost/timeout options but chairs with `gpt-pro` instead of `opus`, and the
+pack is still recorded on the run either way.
+
+---
+
 ## `amicus models` — The Model Catalog
 
 Amicus does **not** ship a frozen table of model names. Aliases and validation resolve against a **live catalog** fetched from provider APIs and cached at `~/.config/amicus/model-catalog.json` (24-hour TTL; the fetch works without an API key).
@@ -293,7 +443,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/electron/workspace-ui/workspace-app.js

@@ -27,6 +27,13 @@
                      // null on a non-debate run, an aborted/skipped debate, or a parse failure —
                      // drillIntoJudge's judge-*.md fallback covers all three.
     blind: false,
+    // Task 19 (RN-5) + fix-wave (RN-5 amendment): the (run id, status) pair renderDetail() last
+    // computed state.blind's default for. Together they gate the recompute (in renderDetail(),
+    // below) to a run CHANGE or a STATUS change only: a same-run/same-status re-render (the
+    // blind toggle) keeps the user's own choice, while a same-run/CHANGED-status re-render (the
+    // live loop's running -> terminal refresh, or the abort-confirm re-read) still auto-reveals.
+    detailRunId: null,
+    detailRunStatus: null,
     labelByModel: {},
     listTimer: null,
     liveTimer: null, // LIVE (Task 15)
@@ -103,8 +110,23 @@
       return;
     }
 
-    // blind default: computed ONCE per run-open from status (resolution 9)
-    state.blind = window.AmicusLive.defaultBlind(d.run.status);
+    // blind default: computed from status (resolution 9) — only on a run CHANGE or a STATUS
+    // change for the same run. Task 19 (RN-5): a same-run/same-status re-render
+    // (renderDetail_preserveBlind, below, calls straight back in here on every blind toggle)
+    // must keep the user's own choice instead of recomputing the default every call —
+    // recomputing unconditionally is what forced the old code to paint twice and, via
+    // wireLazyPanels() a few lines down, collapse any lazy panel the user had open.
+    // ⚠️ Fix-wave (RN-5 amendment, controller ruling): run id ALONE also suppressed the
+    // pre-existing running -> terminal auto-reveal, since the live loop's terminal refresh
+    // (workspace-verbs.js's startLiveLoop tick) and the abort-confirm re-read both call
+    // openRun() on the SAME run id — same run, but a real status transition. Keying on run id
+    // AND status recomputes (auto-reveals) on that transition while still preserving a same-
+    // run/same-status call (the blind toggle).
+    if (state.detailRunId !== d.runId || state.detailRunStatus !== d.run.status) {
+      state.blind = window.AmicusLive.defaultBlind(d.run.status);
+      state.detailRunId = d.runId;
+      state.detailRunStatus = d.run.status;
+    }
     $('blind-toggle').checked = state.blind;
     state.labelByModel = {};
     d.derived.names.forEach(function (p) { state.labelByModel[p.model] = p.label; });
@@ -178,7 +200,6 @@
   });
 
   function renderDetail_preserveBlind() {
-    var keep = state.blind;
     // ⚠️ Fix-wave item 1: renderDetail() itself early-returns safely for an unreadable run
     // (!d || d.error || !d.derived) — but this wrapper used to run past that guard
     // unconditionally, dereferencing the (nonexistent) derived model via renderSeatsPanel()
@@ -187,22 +208,22 @@
     // the error branch unhides #run-view before the derived-model guard, so the Blind
     // checkbox is live with nothing behind it.
     if (!state.detail || state.detail.error || !state.detail.derived) {
-      $('blind-toggle').checked = keep;
+      $('blind-toggle').checked = state.blind;
       return;
     }
+    // ⚠️ Task 19 (RN-5): this used to call renderDetail() (which unconditionally stomped
+    // state.blind back to the run's status default), restore the user's pre-call value,
+    // and then re-paint header chips/seats/matrix/verdict/cost a SECOND time to compensate
+    // for the first call having painted with the wrong (default) blind state — a double
+    // paint, and (via wireLazyPanels(), called inside that first renderDetail()) a collapse
+    // of any lazy panel the user had open. Fixed at the root instead of compensated for:
+    // renderDetail() now recomputes the blind default only on a run CHANGE or a STATUS change
+    // (state.detailRunId/state.detailRunStatus, above) — this call changes neither, so it
+    // keeps state.blind exactly as the change listener above just set it, and
+    // workspace-panels.js's wireLazyPanels() (its own same-run guard, `lastWiredRunId`)
+    // refreshes any open panel in place rather than collapsing it (fix-wave, Fix 1). One
+    // renderDetail() call now paints correctly the first time — nothing left to restore.
     renderDetail();
-    state.blind = keep;
-    $('blind-toggle').checked = keep;
-    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): renderDetail() (just
-    // called above) resets state.blind to the run's DEFAULT before this function restores the
-    // user's chosen `keep` value — renderHeaderChips was painted during that inner call with
-    // the (temporarily wrong) default blind state and, unlike seats/matrix/verdict/cost below,
-    // was never repainted afterward. Re-render it here too, now that state.blind is correct.
-    window.AmicusRender.renderHeaderChips($('run-chips'), state.detail.run, state.blind, labelOf);
-    P.renderSeatsPanel();
-    P.renderMatrixPanel();
-    P.renderVerdictPanel();
-    window.AmicusRender.renderCost($('cost-body'), state.detail.derived.cost, state.blind, labelOf);
   }
 
   $('run-list').addEventListener('keydown', function (e) {
@@ -227,7 +248,8 @@
 
   // ⚠️ PRE-FLIGHT (P4) + DE-ROT (F09): register the three prose `toggle` listeners exactly ONCE,
   // here at boot. wireLazyPanels() (called from renderDetail, on every run-open and blind-toggle)
-  // only rewrites the per-run `loaders` spec map from now on — it never adds a listener.
+  // rewrites the per-run `loaders` spec map every call and — fix-wave, Fix 1 — refreshes any
+  // already-open lazy panel in place on a same-run call; it never adds a listener.
   P.proseLoader('reviews-panel');
   P.proseLoader('bundle-panel');
   P.proseLoader('judges-panel');

package/electron/workspace-ui/workspace-panels.js

@@ -19,6 +19,24 @@
   // inverted back to the model id that keys state.labelByModel, so blind labels would break.
   function sanitizeName(model) { return String(model).replace(/[^a-zA-Z0-9._-]/g, '-'); }
 
+  // ⚠️ Task 18 (RN-1): review-/judge- filenames used to be recomputed here via a bare
+  // sanitizeName(model) call, which is NOT injective — two distinct bench models that sanitize
+  // to the same name would both resolve to the SAME filename, so drillIntoJudge's
+  // `[data-artifact="..."]` lookup handed back whichever section matched first (model A's prose
+  // rendered under model B's name). derived.artifactsByModel (src/workspace/artifact-guard.js's
+  // artifactAllowlist, threaded through by run-detail.js) already carries the disambiguated
+  // (possibly `~2`/`~3`-suffixed) name per raw model — consult it FIRST. Fall back to the legacy
+  // computation only when the map itself is absent: older detail payloads (pre-v4.5 runs,
+  // live-doc consumers not yet updated to build the map) never carry it, and re-deriving via
+  // sanitizeName is exactly what those payloads always did, so it stays correct for them too.
+  function resolveArtifactName(model, kind) {
+    var A = window.AmicusApp;
+    var map = A.state.detail.derived && A.state.detail.derived.artifactsByModel;
+    var entry = map && map[model];
+    if (entry && entry[kind]) { return entry[kind]; }
+    return kind + '-' + sanitizeName(model) + '.md';
+  }
+
   function renderSeatsPanel() {
     var A = window.AmicusApp;
     var d = A.state.detail;
@@ -60,12 +78,16 @@
   // ⚠️ PRE-FLIGHT (P4): the load is AWAITABLE — drillIntoJudge needs to know when it has
   // settled (the old code guessed with setTimeout(render, 300), which could fire before an
   // unbounded N-artifact IPC round trip finished and silently render nothing). loadPanel()
-  // is idempotent per panel id and returns its in-flight promise; both the promise cache
-  // (`loading`) and the per-run spec (`loaders`) are keyed by panel id and cleared/overwritten
-  // by wireLazyPanels() on every run-open — that clearing is what stops F09's stale-run
-  // artifact requests.
+  // is idempotent per panel id and returns its in-flight promise; the promise cache
+  // (`loading`) and the per-run spec (`loaders`) are both keyed by panel id, but only
+  // `loading` is cleared by wireLazyPanels() — on a run CHANGE only (Task 19, RN-5) — and
+  // that clearing is what stops F09's stale-run artifact requests.
   var loaders = {};  // panelId -> {bodyId, files}  (rewritten per run by wireLazyPanels)
   var loading = {};  // panelId -> Promise           (cleared per run by wireLazyPanels)
+  // Task 19 (RN-5): the run wireLazyPanels() last reset panels/loading for — gates the reset
+  // below to run CHANGES only. A same-run call (renderDetail() runs this on every blind toggle
+  // too, and on the live loop's terminal refresh) instead refreshes any open panel (Fix 1).
+  var lastWiredRunId = null;
 
   function loadPanel(panelId, bodyId, files) {
     var A = window.AmicusApp;
@@ -107,18 +129,31 @@
   }
 
   /**
-   * Rewrites the per-run spec map and drops the previous run's cached load promises — this
-   * is precisely what stops F09's stale-run artifact requests. Safe to call on every
-   * renderDetail() (run-open and blind-toggle alike); it registers no listeners itself.
+   * Rewrites the per-run spec map on every call. On a run CHANGE (tracked via the module-level
+   * `lastWiredRunId`, above), resets panel open/loaded state and drops the previous run's
+   * cached load promises — exactly what F09's stale-run protection needs. On a SAME-run call
+   * (Task 19, RN-5: renderDetail() calls this on every blind toggle too, and the live loop's
+   * terminal refresh) any panel the user already has open is instead refreshed in place — see
+   * Fix 1 below — never left showing stale-blind content, never collapsed. Registers no
+   * listeners itself.
    */
   function wireLazyPanels() {
     var A = window.AmicusApp;
-    ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
-      var p = A.$(id);
-      p.dataset.loaded = '0';
-      p.open = false;
-      delete loading[id];
-    });
+    // ⚠️ Fix-wave (Fix 4): keyed off `A.state.detail.runId`, not `A.state.runId` — the latter is
+    // set synchronously at the top of openRun(), before its workspace:get-run reply lands, so an
+    // out-of-order reply could make the two diverge. workspace-app.js's own run-change gate
+    // (renderDetail(), above `d.runId`) reads off the SAME `state.detail.runId`, so the two
+    // provably agree on whether this is a run change.
+    var sameRun = A.state.detail.runId === lastWiredRunId;
+    if (!sameRun) {
+      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
+        var p = A.$(id);
+        p.dataset.loaded = '0';
+        p.open = false;
+        delete loading[id];
+      });
+      lastWiredRunId = A.state.detail.runId;
+    }
     var bench = A.state.detail.run.bench || [];
     var debated = !!A.state.detail.run.debate;
     // ⚠️ CODE REVIEW (round 2, finding 2): readRunArtifact's error for a genuinely-missing
@@ -141,7 +176,7 @@
     loaders['reviews-panel'] = { bodyId: 'reviews-body', files: function () {
       return bench.map(function (m) {
         var label = A.state.labelByModel[m];
-        return { name: 'review-' + sanitizeName(m) + '.md', title: window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+        return { name: resolveArtifactName(m, 'review'), title: window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
       }).filter(function (f) { return present(f.name); });
     } };
     loaders['bundle-panel'] = { bodyId: 'bundle-body', files: function () {
@@ -157,7 +192,7 @@
     loaders['judges-panel'] = { bodyId: 'judges-body', files: function () {
       var files = bench.map(function (m) {
         var label = A.state.labelByModel[m];
-        return { name: 'judge-' + sanitizeName(m) + '.md', title: 'Judge ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+        return { name: resolveArtifactName(m, 'judge'), title: 'Judge ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
       });
       if (debated) {
         // ⚠️ DE-ROT (F38): on a --debate run, a matrix dispute cell can be a RE-VOTE whose
@@ -168,13 +203,31 @@
         // judge- titles above, which mirror the brief verbatim), so it goes through
         // AmicusRender.display() — the single blind-flip definition — rather than adding a
         // fourth hand-rolled copy of the same ternary.
+        // ⚠️ Task 18 fix-wave (RN-1, review finding 1): this name used to be recomputed via a
+        // bare sanitizeName(m) call, ignoring the disambiguation map entirely — for a colliding
+        // pair BOTH models resolved to the same bare revote-<sanitized>.md name, reintroducing
+        // for re-votes the exact cross-match bug Task 18 fixed for review-/judge-. Routed
+        // through resolveArtifactName(m, 'revote') like the other three sites; its built-in
+        // legacy fallback keeps older detail payloads (no artifactsByModel map) correct too.
         files = files.concat(bench.map(function (m) {
           var label = A.state.labelByModel[m];
-          return { name: 'revote-' + sanitizeName(m) + '.md', title: 'Re-vote ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+          return { name: resolveArtifactName(m, 'revote'), title: 'Re-vote ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
         }));
       }
       return files.filter(function (f) { return present(f.name); });
     } };
+    // ⚠️ Fix-wave (Fix 1, RN-9): a same-run call (the blind toggle, or the live loop's
+    // running -> terminal refresh) must re-render any panel the user already has open, or it
+    // keeps showing content painted under the PREVIOUS blind state. renderProseSections()
+    // (workspace-render.js) clears its container before repainting, so this replaces sections
+    // in place rather than appending duplicates. Drop the cached promise first so loadPanel()
+    // actually re-fetches instead of returning its already-settled one.
+    if (sameRun) {
+      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
+        var p = A.$(id);
+        if (p.open) { delete loading[id]; loadPanel(id, loaders[id].bodyId, loaders[id].files); }
+      });
+    }
   }
 
   // ⚠️ DE-ROT (F38): on a --debate run the FINAL tally.json is rebuilt from the debate's
@@ -194,9 +247,14 @@
       var rv = ((A.state.debate && A.state.debate.revotes) || []).find(function (r) {
         return r.judge === judgePair.model && r.id === findingId;
       });
+      // ⚠️ Task 18 fix-wave (RN-1, review finding 1): this branch used to recompute the name via
+      // bare sanitizeName(judgePair.model), independently of the (already-fixed) judge branch
+      // right below it — for a colliding pair, drilling a re-vote on the SECOND model resolved
+      // to the bare name and cross-matched the FIRST model's genuine revote section. Both arms
+      // of this ternary now go through the same disambiguation-aware helper.
       var artifactName = rv
-        ? 'revote-' + sanitizeName(judgePair.model) + '.md'
-        : 'judge-' + sanitizeName(judgePair.model) + '.md';
+        ? resolveArtifactName(judgePair.model, 'revote')
+        : resolveArtifactName(judgePair.model, 'judge');
       var section = A.$('judges-body').querySelector('[data-artifact="' + artifactName + '"]');
       // A genuinely absent artifact is not an error here — the panel renders its own
       // "<file> not written yet" empty state (spec §9, last row).

package/electron/workspace-ui/workspace-render.js

@@ -205,8 +205,18 @@
       cells.forEach(function (c, i) {
         var td = row.children[i];
         if (td && td.textContent !== c) { td.textContent = c; }
+        if (td) { td.className = i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : ''); }
       });
     });
+    // RN-11 (v4.5): the keyed update added and removed rows but never MOVED
+    // them, so table order was frozen at first render — wrong the moment a
+    // repair solo or new wave changes the composed doc's leg order mid-run.
+    seats.forEach(function (seat, i) {
+      var key = String(seat.id || seat.model);
+      var current = tbody.children[i];
+      var target = Array.prototype.slice.call(tbody.children).find(function (r) { return r.dataset.key === key; });
+      if (target && target !== current) { tbody.insertBefore(target, current || null); }
+    });
     Array.prototype.slice.call(tbody.children).forEach(function (row) {
       if (!seen[row.dataset.key]) { row.remove(); }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/council-run-live.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/BourbonDog/amicus/schemas/council-run-live.schema.json",
+  "$id": "https://raw.githubusercontent.com/BourbonDog/amicus/main/schemas/council-run-live.schema.json",
   "title": "Amicus composed live council-run doc (amicus_status/buildCouncilStatusPayload, view:'live')",
   "type": "object",
   "required": ["taskId", "type", "runId", "runDir", "status", "currentStage", "stages", "legsTotal", "legsComplete", "elapsed", "exitCode", "version"],

package/schemas/council-run.schema.json

@@ -30,8 +30,22 @@
     "chair": { "type": "string" },
     "critic": { "type": ["string", "null"] },
     "lenses": { "type": ["array", "null"], "items": { "type": "string" } },
+    "droppedMembers": {
+      "description": "Council preset members dropped during resolution before this run started (v4.5 Wave 2): an alias that no longer resolves, or a resolved id absent from a non-empty cached model catalog (a catalog-unknown/offline member is never dropped this way). Present only when at least one member was actually dropped; absent — never an empty array — otherwise. `bench` above already reflects the survivors only; this is purely an additional observability signal so a scripted/MCP caller can detect a shrunken bench without diffing `bench` against the preset's nominal member list.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["member", "reason"],
+        "properties": {
+          "member": { "type": "string" },
+          "reason": { "type": "string" }
+        }
+      }
+    },
     "labelMap": { "type": ["object", "null"], "additionalProperties": { "type": "string" } },
     "options": { "type": "object" },
+    "pack": { "type": "object" },
+    "template": { "type": "object" },
     "usage": { "type": "object" },
     "exitCode": { "type": ["number", "null"] },
     "budgetRefusals": {

package/schemas/error.schema.json

@@ -13,7 +13,7 @@
       "type": "object",
       "required": ["code", "message"],
       "properties": {
-        "code": { "enum": ["BAD_ARGS", "MISSING_PROMPT", "BAD_MODEL", "MISSING_KEY", "BAD_SESSION", "BUDGET_EXCEEDED", "INTERNAL", "COUNCIL_QUORUM", "COST_EXCEEDED", "COUNCIL_CLAUDE_REVIEW_INVALID"] },
+        "code": { "enum": ["BAD_ARGS", "MISSING_PROMPT", "BAD_MODEL", "MISSING_KEY", "BAD_SESSION", "BUDGET_EXCEEDED", "INTERNAL", "COUNCIL_QUORUM", "COST_EXCEEDED", "COUNCIL_CLAUDE_REVIEW_INVALID", "TEMPLATE_NOT_FOUND", "TEMPLATE_RENDER", "PACK_NOT_FOUND", "PACK_INVALID", "PACK_KIND_MISMATCH"] },
         "message": { "type": "string" },
         "hint": { "type": ["string", "null"] },
         "command": { "type": ["string", "null"] }

package/schemas/event.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/BourbonDog/amicus/schemas/event.schema.json",
+  "$id": "https://raw.githubusercontent.com/BourbonDog/amicus/main/schemas/event.schema.json",
   "title": "Amicus observability event (events.jsonl line)",
   "type": "object",
   "required": ["schemaVersion", "type", "event", "ts", "id"],

package/schemas/pack.schema.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/BourbonDog/amicus/main/schemas/pack.schema.json",
+  "title": "Amicus policy pack",
+  "type": "object",
+  "required": ["schemaVersion", "type", "name", "version", "kind"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "type": { "const": "pack" },
+    "name": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$" },
+    "version": { "type": "string" },
+    "kind": { "enum": ["council", "fanout", "solo"] },
+    "description": { "type": "string" },
+    "bench": {
+      "oneOf": [
+        { "type": "string" },
+        { "type": "array", "items": { "type": "string" }, "minItems": 2 }
+      ]
+    },
+    "model": { "type": "string" },
+    "chair": { "type": ["string", "null"] },
+    "critic": { "type": ["string", "null"] },
+    "lenses": { "type": ["array", "null"], "items": { "type": "string" } },
+    "options": { "type": "object" },
+    "briefing": {
+      "type": "object",
+      "properties": { "template": { "type": ["string", "null"] } }
+    }
+  }
+}

package/schemas/progress.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/BourbonDog/amicus/schemas/progress.schema.json",
+  "$id": "https://raw.githubusercontent.com/BourbonDog/amicus/main/schemas/progress.schema.json",
   "title": "Amicus leg/solo progress snapshot (progress.json)",
   "type": "object",
   "required": ["schemaVersion", "type", "stage", "updatedAt"],

package/schemas/run-live.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/BourbonDog/amicus/schemas/run-live.schema.json",
+  "$id": "https://raw.githubusercontent.com/BourbonDog/amicus/main/schemas/run-live.schema.json",
   "title": "Amicus composed live single-session doc (amicus_status, view:'live')",
   "description": "amicus_status's single-session response always stamps type:'run' (stampEnvelope); documented here as a const rather than the brief's 'may be absent' guess to match real output.",
   "type": "object",

package/schemas/run.schema.json

@@ -21,6 +21,7 @@
     "durationMs": { "type": ["number", "null"] },
     "sessionDir": { "type": ["string", "null"] },
     "opencodeSessionId": { "type": ["string", "null"] },
-    "usage": { "type": ["object", "null"] }
+    "usage": { "type": ["object", "null"] },
+    "pack": { "type": "object" }
   }
 }

package/schemas/wave-live.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/BourbonDog/amicus/schemas/wave-live.schema.json",
+  "$id": "https://raw.githubusercontent.com/BourbonDog/amicus/main/schemas/wave-live.schema.json",
   "title": "Amicus composed live wave doc (amicus_status, view:'live')",
   "type": "object",
   "required": ["taskId", "type", "status", "legs"],

package/schemas/wave.schema.json

@@ -28,6 +28,7 @@
     "completedAt": { "type": ["string", "null"] },
     "durationMs": { "type": ["number", "null"] },
     "usage": { "type": "object" },
-    "notices": { "type": "array", "items": { "type": "string" } }
+    "notices": { "type": "array", "items": { "type": "string" } },
+    "pack": { "type": "object" }
   }
 }