amicus 4.4.1 → 4.5.1

package/src/cli.js

@@ -44,6 +44,7 @@ function parseArgs(argv) {
     _: [],
     ...DEFAULTS
   };
+  result.__explicit = new Set();
 
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
@@ -63,19 +64,22 @@ function parseArgs(argv) {
       // Boolean flags (no value expected)
       if (isBooleanFlag(key)) {
         result[key] = true;
+        result.__explicit.add(key);
         continue;
       }
 
       // If --key=value was used, use the inline value directly
       if (inlineValue !== undefined) {
         result[key] = parseValue(key, inlineValue);
+        result.__explicit.add(key);
         continue;
       }
 
       // Array accumulation flags
-      if (key === 'exclude-mcp' && next && !next.startsWith('--')) {
-        result['exclude-mcp'] = result['exclude-mcp'] || [];
-        result['exclude-mcp'].push(next);
+      if ((key === 'exclude-mcp' || key === 'var') && next && !next.startsWith('--')) {
+        result[key] = result[key] || [];
+        result[key].push(next);
+        result.__explicit.add(key);
         i++;
         continue;
       }
@@ -85,6 +89,7 @@ function parseArgs(argv) {
       // boolean so it can never swallow the following positional as a value.
       if (key.startsWith('no-')) {
         result[key] = true;
+        result.__explicit.add(key);
         continue;
       }
 
@@ -95,6 +100,7 @@ function parseArgs(argv) {
       } else {
         result[key] = true;
       }
+      result.__explicit.add(key);
     } else if (arg === '-o') {
       // Single short-flag alias, scoped to exactly '-o' (council verdict's
       // --out shorthand). No general short-flag support is implemented —
@@ -106,6 +112,7 @@ function parseArgs(argv) {
       } else {
         result.out = true;
       }
+      result.__explicit.add('out');
     } else {
       result._.push(arg);
     }
@@ -428,6 +435,10 @@ Options for 'start':
   --no-validate-model          Skip model-catalog validation before launch
   --gateway <mode>             Routing: auto (direct-first), direct, or openrouter
   --position <pos>             Window position: right (default), left, center
+  --template <name|path>       Render a briefing template ({{prompt}}, {{artifact}}, {{var.*}})
+  --artifact <file>            File whose content fills {{artifact}} (256 KB cap; needs --template)
+  --var <k=v>                  Template variable, repeatable (needs --template)
+  --pack <name|path>           Load a saved pack (model/options/template); explicit flags override it
 `,
   fanout: `
 Options for 'fanout':
@@ -459,6 +470,10 @@ Options for 'fanout':
                                 RESULT_FILE/EVENTS_FILE/COST/PROJECT), never model
                                 text. Child stdout/stderr go to amicus stderr.
                                 Never changes the wave's exit code, docs, or events.
+  --template <name|path>       Render a briefing template ({{prompt}}, {{artifact}}, {{var.*}})
+  --artifact <file>            File whose content fills {{artifact}} (256 KB cap; needs --template)
+  --var <k=v>                  Template variable, repeatable (needs --template)
+  --pack <name|path>           Load a saved pack (bench/options/template); explicit flags override it
   Shared per-leg knobs: --agent, --thinking, --timeout, --summary-length,
   --no-context, --context-*, --mcp*, --no-validate-model, --cwd
   Exit codes: 0 all legs complete, 2 partial, 1 none complete / hard failure
@@ -545,6 +560,8 @@ Subcommands for 'council':
       [--gateway auto|direct|openrouter] [--no-validate-model]
       [--debate] [--claude-review <file>] [--no-cost-gate] [--follow]
       [--fallback] [--no-fallback] [--on-complete <cmd>]
+      [--template <name|path>] [--artifact <file>] [--var <k=v>]
+      [--pack <name|path>]
                                 Run the full headless council engine (v4.0).
                                 Chair default: deepseek (must NOT be a bench seat).
                                 --critic and --lenses are mutually exclusive.
@@ -567,6 +584,13 @@ Subcommands for 'council':
                                 EVENTS_FILE/COST/PROJECT), never model text. Child
                                 stdout/stderr go to amicus stderr. Never changes
                                 the run's exit code, docs, or events.
+                                --template <name|path> renders a briefing from
+                                {{prompt}}, {{artifact}}, {{var.*}}; --artifact
+                                fills {{artifact}} (256 KB cap); --var sets
+                                {{var.*}} (repeatable). Both require --template.
+                                --pack <name|path> loads a saved pack (bench,
+                                chair, critic/lenses, options, template);
+                                explicit flags always override the pack's values.
                                 Exit: 0 full run, 2 degraded, 1 quorum/cost/validation.
   save <name> --models a,b,c    Save a named council preset (>=2 resolvable members)
     --json                     Machine-readable output
@@ -639,6 +663,43 @@ Options for 'init':
   Runs skill install + MCP registration on demand (for plugin-channel /
   --ignore-scripts installs, a failed postinstall, or repairing deleted
   ~/.claude state). No flags registers both Claude Code and Claude Desktop.
+`,
+  template: `
+Options for 'template':
+  amicus template list [--json]           List templates (built-ins marked)
+  amicus template show <name|path> [--json]  Print a template
+`,
+  pack: `
+Options for 'pack':
+  amicus pack save <name> --kind council|fanout|solo [flags]
+                                Save a pack built from flags:
+                                --bench <a,b,c|name>    council/fanout: comma-
+                                                         separated members, or a
+                                                         saved council name
+                                --model <model>          solo kind only
+                                --chair/--critic/--lenses    council kind only
+                                --timeout/--max-cost/--gateway   shared run
+                                                         options
+                                --agent/--thinking/--summary-length   fanout/
+                                                         solo kind only
+                                --debate / --no-debate   council kind only
+                                --template <name|path>   briefing template
+                                                         reference (not rendered)
+                                --version <semver>       default 1.0.0 (an
+                                                         unchanged re-save is a
+                                                         no-op; a changed one
+                                                         auto-bumps the patch)
+                                --description <text>
+  amicus pack save <name> --from-run <id>
+                                Build a pack from an existing council run /
+                                fanout wave / solo session instead of flags
+                                (models, options, and a template REFERENCE only
+                                — briefing text is never captured)
+  amicus pack list [--json]    List saved packs
+  amicus pack show <name|path> [--json]
+                                Print a pack plus its validation report (never
+                                fails on an invalid pack — see 'validation')
+  amicus pack rm <name> [--json]   Remove a saved pack
 `
 };
 

package/src/council/findings.js

@@ -95,7 +95,7 @@ function bodyReadings(rest) {
  * it has one) body is returned rather than null — deliberately. A malformed emit must
  * not look like an absent one: callers key off that distinction (validateFindings
  * reports NOT_PARSEABLE with a real body instead of NO_FENCED_BLOCK;
- * countAttemptedFindings returns null vs 0, which repairCanHonorContract then reads).
+ * countAttemptedFindings returns null vs 0, a distinction downstream callers key off).
  *
  * Every Stage-1/Stage-2 extractor funnels through here — validateFindings,
  * countAttemptedFindings, and parse-stage2's parseJudgeOutput / parseDebateDefense
@@ -156,9 +156,9 @@ function validateFindings(jsonText) {
   //
   // NOT_PARSEABLE, not NO_FENCED_BLOCK: the distinction is load-bearing. The model
   // emitted something broken, not nothing — and countAttemptedFindings must keep
-  // answering null (unverifiable) rather than 0 (a declared empty set), because
-  // repairCanHonorContract reads exactly that difference. It does: its own JSON.parse
-  // succeeds on `null`, and `Array.isArray(null.findings)` throws into its catch.
+  // answering null (unverifiable) rather than 0 (a declared empty set): its own
+  // JSON.parse succeeds on `null`, and `Array.isArray(null.findings)` throws into
+  // its catch.
   if (!parsed) {
     return { ok: false, findings: [], errors: [{ code: 'NOT_PARSEABLE',
       detail: `block body is ${JSON.stringify(parsed)}, not an object` }] };
@@ -233,42 +233,6 @@ function countAttemptedFindings(text) {
   } catch { return null; }
 }
 
-/**
- * A canonical repair that HONORS the contract for a review which declared zero
- * findings: the same (empty) set, with a real `overall`. Probe only — it is never
- * sent to a model.
- */
-const EMPTY_SET_REPAIR_PROBE =
-  '```json\n{"overall":"I read the material and found nothing to report.","findings":[]}\n```';
-
-/**
- * Can a repair that honors the count contract pass validation at all, given the
- * count the ORIGINAL declared?
- *
- * ⚠️ v4.4.1 review F2. The repair prompt's contract is "the same findings, fixed —
- * do not add or remove findings", and run-stages.js refuses a repair that changed
- * the count. When the original declared ZERO findings, the only contract-honoring
- * repair is another empty set — so if the validator rejects an empty set, every
- * outcome of that repair wave is predetermined: a compliant repair fails
- * validation, a non-compliant one is refused on the count. Up to two PAID solo
- * legs whose only reachable end state is 'unstructured'. Don't buy it.
- *
- * The answer is ASKED of the validator instead of hard-coded so the two rules can
- * never drift. Task 3 (LC-10) makes a well-formed empty set valid; the day it
- * lands this predicate starts returning true on its own, and the malformed empty
- * original (blank or missing `overall`) enters the repair loop again — where a
- * repair can now succeed by re-emitting zero findings with a real `overall`.
- *
- * @param {number|null} attemptedCount countAttemptedFindings(originalText)
- * @returns {boolean} false ⇒ skip the repair loop; the spend cannot buy an outcome.
- *   null (nothing to compare) is always repairable — that is the wave's main
- *   legitimate use.
- */
-function repairCanHonorContract(attemptedCount) {
-  if (attemptedCount !== 0) { return true; }
-  return validateFindings(EMPTY_SET_REPAIR_PROBE).ok;
-}
-
 /**
  * v4.0 §7: stamp the council v2 envelope onto a validateFindings result
  * (additive — ok/findings/errors stay top-level; existing key-readers keep
@@ -283,5 +247,4 @@ function buildValidateDoc(result) {
 
 module.exports = {
   validateFindings, buildValidateDoc, SEVERITIES, lastJsonBlock, countAttemptedFindings,
-  repairCanHonorContract,
 };

package/src/council/presets-cli.js

@@ -56,7 +56,8 @@ function runSave(name, modelsArg, useJson) {
 
 function renderSave(doc) {
   const notice = doc.overwritten ? ' (overwritten)' : '';
-  return `Saved council '${doc.name}'${notice}: ${doc.models.join(', ')}\n`;
+  return `Saved council '${doc.name}'${notice}: ${doc.models.join(', ')}\n` +
+    "  for full run configuration — chair, options, templates — see 'amicus pack'\n";
 }
 
 /**
@@ -102,6 +103,16 @@ function renderList(entries) {
  * which fails outright below 2 usable members), `show` is diagnostic-only:
  * it always reports the full resolved/dropped split, even for a council
  * that currently has fewer than 2 usable members.
+ *
+ * v4.5 Wave 2 (post-HOLD chip, task-23-report.md Anomaly 1): the resolved/
+ * dropped split now REUSES `classifyCouncilMembers` — the exact alias +
+ * catalog-membership + local-provider-tri-state check `resolveCouncilMembers`
+ * applies on every real run — instead of a parallel check that only asked
+ * "does the alias map to SOME id?" and never consulted the catalog at all
+ * (so a member whose alias resolved to a catalog-absent id read as healthy
+ * here while every real run silently dropped it). `droppedMembers` carries
+ * each dropped member's reason, distinguishing an unresolvable alias from a
+ * catalog-absent id — the same distinction `resolveCouncilMembers` computes.
  * @param {string|undefined} name
  * @param {boolean} useJson
  * @returns {number} exit code
@@ -111,7 +122,7 @@ function runShow(name, useJson) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'council show needs a <name>',
       hint: 'amicus council show <name> [--json]' });
   }
-  const { getCouncilWithSource, getEffectiveAliases } = require('../utils/config');
+  const { getCouncilWithSource, classifyCouncilMembers } = require('../utils/config');
   const { readCache } = require('../utils/model-catalog');
   const catalog = (readCache() || {}).models || [];
   const { members, builtin } = getCouncilWithSource(name, catalog);
@@ -119,14 +130,8 @@ function runShow(name, useJson) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Unknown council '${name}'`,
       hint: "'amicus council list' shows available councils, or 'amicus council save' to create one" });
   }
-  const aliases = getEffectiveAliases();
-  const resolved = [];
-  const dropped = [];
-  for (const member of members) {
-    const id = member.includes('/') ? member : aliases[member];
-    (id ? resolved : dropped).push(member);
-  }
-  const doc = { name, builtin, members, resolved, dropped };
+  const { models, dropped, droppedMembers } = classifyCouncilMembers(members, catalog);
+  const doc = { name, builtin, members, resolved: models, dropped, droppedMembers };
   process.stdout.write(useJson ? JSON.stringify(doc, null, 2) + '\n' : renderShow(doc));
   return 0;
 }
@@ -134,7 +139,14 @@ function runShow(name, useJson) {
 function renderShow(doc) {
   const tag = doc.builtin ? ' [built-in]' : '';
   let out = `Council '${doc.name}'${tag}\n  members: ${doc.members.join(', ')}\n  resolved: ${doc.resolved.join(', ')}\n`;
-  if (doc.dropped.length) { out += `  dropped: ${doc.dropped.join(', ')}\n`; }
+  if (doc.dropped.length) {
+    // Per-member reason (v4.5 Wave 2) when available; falls back to the bare
+    // ref list so this never throws on a hand-built doc missing the new field.
+    const detail = (doc.droppedMembers && doc.droppedMembers.length)
+      ? doc.droppedMembers.map(d => `${d.member} (${d.reason})`).join(', ')
+      : doc.dropped.join(', ');
+    out += `  dropped: ${detail}\n`;
+  }
   return out;
 }
 

package/src/council/run-stages.js

@@ -17,7 +17,7 @@
  * review still gets ranked in Stage 2).
  */
 
-const { validateFindings, countAttemptedFindings, repairCanHonorContract } = require('./findings');
+const { validateFindings, countAttemptedFindings } = require('./findings');
 const briefings = require('./briefings');
 const { materializeReviews, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
@@ -179,14 +179,17 @@ async function runStage1(ctx) {
     // prose actually narrates. null = absent/unparseable, so unverifiable — see
     // the push below.
     const attemptedCount = countAttemptedFindings(m.text);
-    // ⚠️ Review F2: never pay for a repair whose every outcome is already decided.
-    // An original declaring ZERO findings can only honor the contract by returning
-    // zero — so while the validator rejects an empty set (EMPTY_FINDINGS), a
-    // compliant repair fails validation and a non-compliant one is refused on the
-    // count below. Predicate, not a constant: Task 3 (LC-10) flips that validator
-    // rule, and this guard stops firing on its own when it does.
-    const repairable = repairCanHonorContract(attemptedCount);
-    while (!res.ok && repairable && attempts < 2 && !ctx.overBudget()) {
+    // ⚠️ Review F2 (RESOLVED — deleted v4.5, owner-ruled 2026-07-27): a
+    // repairCanHonorContract predicate used to sit here so a review declaring
+    // ZERO findings never paid for a repair while EMPTY_FINDINGS rejected empty
+    // sets — every outcome of that wave was predetermined. LC-10 (v4.4.1) made a
+    // well-formed empty set VALID, which flipped the predicate constant-true by
+    // its own design, so it was removed rather than left as a dead guard someone
+    // deletes silently later. ⚠️ If you ever make validateFindings reject empty
+    // sets again, you are re-arming the F2 deadlock: restore a repairability
+    // check here first. tests/council/run-stages.test.js "never pays for a
+    // repair" pins the observable behavior.
+    while (!res.ok && attempts < 2 && !ctx.overBudget()) {
       attempts += 1;
       repairSeq += 1;
       const waveId = `${o.runId}-p${repairSeq}`;

package/src/council/run-state.js

@@ -101,6 +101,23 @@ function initCouncilRun(o) {
     // "no debate key" contract and fail the object-typed schema), and with a VALID
     // outcome from the first write so a run killed mid-debate stays schema-valid.
     ...(o.debate ? { debate: { enabled: true, outcome: 'nothing-to-debate' } } : {}),
+    // F9 (v4.5): additive-only — absent (not null) without --template; the MCP
+    // seed (mcp-council-run.js, initRun directly) never sets this in v4.5.
+    ...(o.template ? { template: o.template } : {}),
+    // v4.5 Task 12 (B7/F5): additive-only — absent (not null) without --pack.
+    // Preserved across a later MCP-child initRun whose own seed omits it —
+    // mergeRun's plain shallow merge never drops a key patch doesn't mention.
+    ...(o.pack ? { pack: o.pack } : {}),
+    // v4.5 Wave 2 (post-HOLD chip, task-23-report.md Anomaly 1): additive-only
+    // — absent (never an empty array) when nothing was dropped. Handler-computed
+    // (cli-handlers-council-run.js's resolveBench, via resolveCouncilMembers) so
+    // a scripted/--json/MCP caller has a signal a bench member vanished without
+    // diffing `bench` against the preset's nominal member list. Same
+    // preserved-across-a-later-MCP-child-seed precedent as `pack` above — the
+    // MCP handler pre-seeds this directly (mcp-council-run.js) before spawning
+    // the CLI child, whose own seed (bench already expanded to --models) never
+    // recomputes it and so never mentions the key.
+    ...(o.droppedMembers && o.droppedMembers.length ? { droppedMembers: o.droppedMembers } : {}),
     options: { timeout: o.timeout || null, maxCost: o.maxCost, gateway: o.gateway || 'auto', outDir: o.runDir },
     usage: null, pid: process.pid, createdAt: new Date().toISOString(),
   });

package/src/council/run.js

@@ -49,7 +49,7 @@ const { writeRunTerminal, resolveTerminalExit, SIGNAL_EXIT } = require('./run-fi
  */
 async function runCouncil(options, deps = {}) {
   const o = { critic: null, lenses: null, maxCost: null, debate: false, claudeReviewFile: null,
-    noCostGate: false, councilName: null, ...options };
+    noCostGate: false, councilName: null, template: null, pack: null, ...options };
   o.follow = o.follow ? require('../observe/follow').createFollowPrinter({ json: o.json }) : null; // Task 13: stderr mirror
   const appendRunFn = deps.appendRunFn || require('./ledger').appendRun;
   const statsFn = deps.statsFn || require('./ledger').deriveReliability;

package/src/headless.js

@@ -11,7 +11,7 @@ const { logger } = require('./utils/logger');
 const { ensureNodeModulesBinInPath } = require('./utils/path-setup');
 const { ensurePortAvailable } = require('./utils/server-setup');
 const { mapAgentToOpenCode } = require('./utils/agent-mapping');
-const { writeProgress } = require('./sidecar/progress');
+const { writeProgress, writeTerminalProgressSafe } = require('./sidecar/progress');
 const { writeFileAtomic } = require('./utils/atomic-write');
 const { createMirrorState, mirrorMessages, logMessage, getPendingToolCalls,
   getLiveToolCalls, mirrorUsageOnly, allAssistantUsagePresent } = require('./sidecar/conversation-mirror');
@@ -289,6 +289,11 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       logger.debug('Server started', { url: server.url });
     } catch (error) {
       logger.error('Failed to start OpenCode server', { error: error.message });
+      // FR-1: this return predates the outer try — A3's terminal write never ran
+      // for it, leaving 'initializing' on disk while metadata said 'error'.
+      if (!writeTerminalProgressSafe(sessionDir, `Failed to start server: ${error.message}`)) {
+        logger.debug('terminal progress write failed on server-start failure (best-effort)', { taskId });
+      }
       return {
         summary: '',
         completed: false,
@@ -314,6 +319,10 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
 
       if (!serverReady) {
         await server.close();
+        // FR-1: returns out of the outer try — the A3 catch never sees it.
+        if (!writeTerminalProgressSafe(sessionDir, 'OpenCode server failed to start')) {
+          logger.debug('terminal progress write failed on server-not-ready (best-effort)', { taskId });
+        }
         return {
           summary: '',
           completed: false,
@@ -351,6 +360,12 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       } catch (error) {
         if (watchdog) { watchdog.cancel(); }
         if (!externalServer) { await server.close(); }
+        // FR-1: the one path a council leg can hit under T0.5's shared server —
+        // pre-fix, the Workspace showed the seat perpetually live off a
+        // non-terminal 'server_ready' while metadata.json said 'error'.
+        if (!writeTerminalProgressSafe(sessionDir, error.message)) {
+          logger.debug('terminal progress write failed on createSession failure (best-effort)', { taskId });
+        }
         return {
           summary: '',
           completed: false,
@@ -1192,19 +1207,8 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // assistant entries directly and only falls back to `messagesReceived` when there are none, so
     // restating a stale count on an exception — where conversation.jsonl is the more truthful,
     // already-mirrored source — could only disagree with the file it exists to summarize.
-    try {
-      let priorUsage = null;
-      try {
-        const prior = JSON.parse(fs.readFileSync(path.join(sessionDir, 'progress.json'), 'utf-8'));
-        if (prior && prior.usage) { priorUsage = prior.usage; }
-      } catch { /* no readable prior record: write the terminal stage without usage */ }
-      const { resolveTerminalState } = require('./sidecar/session-finalize');
-      const stage = resolveTerminalState({ error: error.message }).status;
-      writeProgress(sessionDir, stage, priorUsage ? { usage: priorUsage } : {});
-    } catch (progressErr) {
-      logger.debug('terminal progress write failed after exception (best-effort)', {
-        taskId, error: progressErr.message,
-      });
+    if (!writeTerminalProgressSafe(sessionDir, error.message)) {
+      logger.debug('terminal progress write failed after exception (best-effort)', { taskId });
     }
     const { emptyUsageTotals } = require('./utils/pricing');
     return {

package/src/mcp-council-run.js

@@ -24,6 +24,22 @@ function textResult(text, isError) {
   return result;
 }
 
+/**
+ * v4.5 Task 15 (B7/F5): maps amicus_council_run's MCP input keys to the CLI
+ * arg-key names applyPackToArgs's knob tables use (pack-resolve.js), so
+ * applyPackToMcpInput can reuse those tables unchanged. `template` has no
+ * Zod-declared counterpart on this tool (MCP has no template param of its
+ * own — template/apply.js's own docblock: "MCP has no template params of its
+ * own") — a pack's briefing.template is the ONLY way a template reaches this
+ * handler, carried through as a plain (non-schema) `input.template` property
+ * consumed by the render step below.
+ */
+const COUNCIL_PACK_PARAM_MAP = {
+  models: 'models', council: 'council', chair: 'chair', critic: 'critic', lenses: 'lenses',
+  debate: 'debate', timeoutMinutes: 'timeout', maxCost: 'max-cost', gateway: 'gateway',
+  template: 'template',
+};
+
 /**
  * Resolve the bench: models XOR council preset (amicus_fanout parity).
  * Also returns `presetName` (v4.3 Task 3, spec §7.1): the trimmed council
@@ -45,9 +61,11 @@ function resolveBenchInput(input) {
     const presetName = input.council.trim();
     const expanded = resolveCouncilMembers(presetName, catalog);
     if (expanded.error) { return { error: expanded.error }; }
-    return { bench: expanded.models, presetName };
+    // v4.5 Wave 2: the child never re-resolves (bench is spawned pre-expanded
+    // to --models) — the pre-seed below is the only place this is recorded.
+    return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
   }
-  return { bench: inputModels, presetName: null };
+  return { bench: inputModels, presetName: null, droppedMembers: [] };
 }
 
 /**
@@ -55,7 +73,8 @@ function resolveBenchInput(input) {
  * {runId, runDir} immediately (fenced).
  * @param {object} input tool input
  * @param {string} project resolved project dir
- * @param {{spawnFn: Function, clientName: string}} helpers injected by mcp-server
+ * @param {{spawnFn: Function, clientName: string, autoOpen?: {decide: Function, launch: Function}}} helpers
+ *   injected by mcp-server; `autoOpen` is a v4.5 test seam (real modules used when absent)
  */
 async function handleCouncilRunTool(input, project, helpers) {
   // Task 15 (spec §5.3): validate onComplete FIRST, before any run dir is
@@ -74,10 +93,45 @@ async function handleCouncilRunTool(input, project, helpers) {
   if (briefing.charCodeAt(0) === 0xFEFF) { briefing = briefing.slice(1); }
   if (!briefing.trim()) { return textResult(`briefingFile ${input.briefingFile} is empty.`, true); }
 
+  // v4.5 Task 15 (B7/F5): resolve `pack` IN-PROCESS, before bench/chair/etc
+  // resolution, so a pack-filled input.models/council/chair/critic/lenses/
+  // timeoutMinutes/maxCost/gateway/debate flows through the SAME validation
+  // below a typed value would (single-resolution rule: never spawn --pack —
+  // this is the only place the pack is resolved).
+  let packRecord = null;
+  const notices = [];
+  if (input.pack !== undefined) {
+    const { applyPackToMcpInput } = require('./pack/pack-resolve');
+    const pr = applyPackToMcpInput({
+      packRef: input.pack, expectedKind: 'council', input, paramMap: COUNCIL_PACK_PARAM_MAP,
+    });
+    // v4.5 final-review T15-m1: amicus_start's own pack-error branch
+    // (mcp-server.js) keeps code+hint via buildErrorDoc's JSON envelope; this
+    // handler's error surface is plain text (born-fenced, not JSON), so the
+    // hint (e.g. PACK_NOT_FOUND's 'amicus pack list') is appended to the
+    // message instead of being converted into a JSON envelope, which would
+    // change this tool's established response shape.
+    if (pr.error) { return textResult(pr.error.message + (pr.error.hint ? `\n${pr.error.hint}` : ''), true); }
+    packRecord = pr.packRecord;
+    notices.push(...pr.notices);
+  }
+  // MCP has no template param of its own — a pack's briefing.template (merged
+  // onto input.template above) is the only way one reaches this handler.
+  // {{prompt}} = the briefingFile content; the RENDERED text is what lands in
+  // briefing.md below (mirrors the CLI's single template-application point).
+  if (input.template !== undefined) {
+    const { applyTemplate } = require('./template/apply');
+    const t = applyTemplate({ templateRef: input.template, prompt: briefing, project });
+    if (t.error) { return textResult(t.error.message, true); }
+    briefing = t.prompt;
+    notices.push(...t.notices);
+  }
+
   const benchRes = resolveBenchInput(input);
   if (benchRes.error) { return textResult(benchRes.error, true); }
   const bench = benchRes.bench;
   const presetName = benchRes.presetName;
+  const droppedMembers = benchRes.droppedMembers || [];
   if (bench.length < 2) { return textResult('A council needs at least 2 seats.', true); }
   const chair = (typeof input.chair === 'string' && input.chair.trim()) ? input.chair.trim() : CHAIR_DEFAULT;
   if (bench.includes(chair)) {
@@ -121,6 +175,14 @@ async function handleCouncilRunTool(input, project, helpers) {
         maxCost: (typeof input.maxCost === 'number') ? input.maxCost : null,
         gateway: input.gateway || 'auto', outDir: runDir,
       },
+      // v4.5 Task 15: additive-only — absent (not null) without a pack. The
+      // spawned child's own seed omits `pack` (never passed --pack); initRun's
+      // plain shallow merge (run-state.js) preserves this pre-seeded value —
+      // pinned behavior, Task 12.
+      ...(packRecord ? { pack: packRecord } : {}),
+      // v4.5 Wave 2: additive, same preserved-across-the-child's-own-initRun
+      // precedent as `pack` above — absent (never []) when nothing dropped.
+      ...(droppedMembers.length ? { droppedMembers } : {}),
       usage: null, createdAt: new Date().toISOString(),
     });
     runState.writePointer(project, runId, runDir);
@@ -170,14 +232,58 @@ async function handleCouncilRunTool(input, project, helpers) {
   // the only code that later sees this council run reach terminal state.
   if (oc.mode === 'mcp-notify') { requestMcpNotify(runId); }
 
+  // ★ v4.5 auto-open (spec §6): decide via the pure helper, launch detached,
+  // never await, never fail the run. helpers.autoOpen is a test seam.
+  const ao = helpers.autoOpen || {
+    decide: (ctx) => require('./sidecar/workspace-auto-open').shouldAutoOpenWorkspace(ctx),
+    launch: (opts) => require('./sidecar/workspace-window').launchWorkspaceWindowDetached(opts),
+  };
+  let workspaceOpened = false;
+  let workspaceOpenReason = null;
+  try {
+    const { probeElectronState } = require('./sidecar/electron-state');
+    const { getWorkspaceAutoOpen } = require('./utils/config');
+    const es = probeElectronState(); // 3-state (#76): splits absent vs broken
+    const decision = ao.decide({
+      client: helpers.clientName,
+      electronState: es.state,
+      electronDir: es.electronDir,
+      platform: process.platform,
+      env: process.env,
+      autoOpenConfig: getWorkspaceAutoOpen(),
+      uiParam: input.ui,
+    });
+    if (decision.open) {
+      const r = ao.launch({ project, runId });
+      if (r && r.launched === false) {
+        workspaceOpenReason = r.reason;
+      } else {
+        workspaceOpened = true;
+      }
+    } else {
+      workspaceOpenReason = decision.reason;
+    }
+  } catch (err) {
+    workspaceOpenReason = `auto-open-failed: ${err.message}`;
+  }
+
   const body = JSON.stringify({
     schemaVersion: 2, type: 'council-run', runId, runDir, status: 'running',
     message: 'Council run started. Preferred: call amicus_wait with the runId — one blocking ' +
       'call replaces polling; re-call it while it returns timedOut: true. Fallback: poll ' +
       'amicus_status with the runId. Artifacts land in runDir (verdict.json, report.html).',
+    workspaceOpened,
+    ...(workspaceOpenReason ? { workspaceOpenReason } : {}),
+    // v4.5 Wave 2: otherwise invisible here short of separately reading run.json.
+    ...(droppedMembers.length ? { droppedMembers } : {}),
   });
   // Born-fenced (spec §8): council MCP tool text is wrapped like amicus_read.
-  return textResult(fenceSidecarOutput(body));
+  const content = [{ type: 'text', text: fenceSidecarOutput(body) }];
+  // v4.5 Task 15: pack/template notices (e.g. a bench-override) are non-fatal —
+  // surfaced as extra unfenced content blocks, same precedent as
+  // mcp-server.js's routeResult.notice (amicus_start).
+  for (const n of notices) { content.push({ type: 'text', text: n }); }
+  return { content };
 }
 
 // The council-awareness helpers live in their own module; re-exported here so