amicus 4.7.1 → 4.8.1

package/README.md

@@ -75,7 +75,7 @@ Claude is the orchestrator. The council and chat skills run *on top of* the engi
 **The flow, in five beats:**
 
 1. **Independent reviews.** Each council model reviews the artifact on its own (one parallel wave), producing a structured findings list — claim, severity (`blocker | major | minor | nit`), location, rationale.
-2. **Anonymized cross-review.** Claude relabels every review (Review A, B, C…) and sends the identical bundle to every model. Each model ranks the reviews and adjudicates every finding (`agree | dispute | neutral`) — *unknowingly judging its own*, so self-bias washes out. This yields a **street-cred** ranking and sorts findings into **Disputed / Confirmed / Contested / Singleton** tiers.
+2. **Anonymized cross-review.** Claude relabels every review (Review A, B, C…) and sends the identical bundle to every model. Each model ranks the reviews and adjudicates every finding (`agree | dispute | neutral`) — *unknowingly judging its own*, so self-bias washes out. This yields a **street-cred** ranking and sorts findings into **Disputed / Confirmed / Contested / Singleton** tiers. Self-bias is washed out per **seat**: if you deliberately seat one model twice, each seat's vote on the *other* seat's finding is counted as the real peer vote it is, and the finding is flagged when its only corroboration came from its own twin.
 3. **Chair verdict.** A designated **non-Claude** chair receives the de-anonymized picture — all reviews, rankings, and adjudications — and synthesizes an independent verdict. Claude presents it verbatim; Claude does not synthesize.
 4. **Tiered decisions.** Confirmed findings get one bulk accept/deny; Contested and Singleton findings are decided one at a time (accept / deny / modify).
 5. **Outputs applied.** Accepted findings are written into a reviewed copy of the source; the full run is captured in the run folder.
@@ -137,7 +137,7 @@ The council is the hero — start with the everyday way, and reach for the more
 
 ### Headless council (CI)
 
-The same pipeline runs with no Claude runtime at all: `amicus council run --prompt-file briefing.md --models gemini,glm --chair deepseek --json` executes the review waves, the anonymized cross-review, the tally, and the chair verdict in one command, and writes the full run directory (`verdict.json` with the chair's parsed `overallVerdict`, `report.html`, every review and judge output). That is what powers the repo's own **Council Review GitHub Action v2** — on PRs labeled `council-review` it posts an adjudicated verdict as a check run plus a sticky comment, uploads the run directory as an evidence artifact, and can optionally gate merges via its `fail_on` input (default: report-only). Reference: [docs/council.md](./docs/council.md#amicus-council-run).
+The same pipeline runs with no Claude runtime at all: `amicus council run --prompt-file briefing.md --models gemini,glm --chair deepseek --json` executes the review waves, the anonymized cross-review, the tally, and the chair verdict in one command, and writes the full run directory (`verdict.json` with the chair's parsed `overallVerdict`, `report.html`, every review and judge output). That is what powers the repo's own **Council Review GitHub Action v2** — on PRs labeled `council-review` it posts an adjudicated verdict as a check run plus a sticky comment, uploads the run directory as an evidence artifact, and gates merges by default via its `fail_on` input (fails only on a `Fundamental rethink` verdict; pass `fail_on: fix` to require `Ship it`, or `fail_on: none` for report-only). Reference: [docs/council.md](./docs/council.md#amicus-council-run).
 
 <p align="center"><img src="./docs/cards/ship-gate.svg" alt="A council gating a release pipeline: exit 0 ships it, exit 1 sends it back"></p>
 
@@ -275,7 +275,7 @@ This opens a graphical wizard:
 | Step | What it does |
 |------|--------------|
 | **1. API Keys** | Enter keys for OpenRouter, Google, OpenAI, Anthropic, and/or DeepSeek. Each is validated live against the provider's API. Written to `~/.config/amicus/.env` with `0600` permissions. |
-| **2. Default Model** | Pick your go-to model from a searchable live picker (backed by the catalog). Used whenever you omit `--model`. |
+| **2. Default Model** | Pick your go-to model from a searchable live picker (backed by the catalog) — each provider card also lets you drill down to a specific model instead of just the family default. Used whenever you omit `--model`. |
 | **3. Model Routing** | Decide which provider serves each model — e.g. route Gemini through a direct Google key and everything else through OpenRouter. |
 | **4. Review** | Confirm the configuration before saving. |
 
@@ -450,7 +450,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.7.1",
+  "version": "4.8.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
@@ -594,6 +594,7 @@ LOG_LEVEL=debug amicus start --model gemini --prompt "test" --no-ui
 | [docs/troubleshooting.md](./docs/troubleshooting.md) | Extended troubleshooting. |
 | [docs/electron-testing.md](./docs/electron-testing.md) | Chrome DevTools Protocol patterns for UI testing. |
 | [docs/testing.md](./docs/testing.md) | Test suite layout and how to run it. |
+| [docs/CITATIONS.md](./docs/CITATIONS.md) | How to cite one file from another so the citation cannot rot, and what the citation gate enforces. |
 | [docs/publishing.md](./docs/publishing.md) | Release and publish process. |
 | [docs/SHIMS.md](./docs/SHIMS.md) | v2.0.0 removal record for the pre-rebrand `sidecar*` compatibility shims — what was removed and how to migrate. |
 | [skills/second-opinion/SKILL.md](./skills/second-opinion/SKILL.md) | The LLM Council skill. |

package/docs/CITATIONS.md

@@ -0,0 +1,122 @@
+# Citing one file from another
+
+Comments, tests and planning docs in this repo cite other files. Those
+citations rot silently whenever the cited file changes, and the rot is
+expensive: PR #171 produced roughly thirty review findings and **not one was in
+the code** — every one was a stale or false statement *about* the code, and the
+majority were rotted citations. Five consecutive fix rounds on a single task
+went entirely to citations, and fixing them moved lines, which falsified more.
+
+## The forms
+
+| Form | Use it for | Enforced by |
+|---|---|---|
+| `file.js :: symbolName` | **Default.** Any claim about current code. | the symbol must appear in the target, dotted paths **as written** |
+| `file.js:NNN` / `file.js:NNN-MMM` | A claim no symbol can carry (a line inside a function, a specific guard). | target resolves, line in range |
+| `file.js@<ref>:NNN` | Provenance — "moved verbatim from", "was true at". | line in range **in the file at that ref** |
+
+**Prefer the symbol anchor.** A corrected line number is true until the next
+edit and then silently false; a symbol anchor survives every move. Measured in
+PR #171: symbol-anchoring one file removed it from the citation-rot class
+entirely.
+
+Use the `@ref` form rather than deleting or "correcting" a provenance
+statement. `run-finish.js` says its body was *moved verbatim from
+`run.js@6b0c3b6b:242-288`* — that range is past EOF in today's `run.js` and
+looks exactly like rot, but it is true at the pre-split commit, and the gate
+verifies it there. Pin the ref to a commit reachable from `main`.
+
+**`@ref` needs full history.** `actions/checkout` defaults to a shallow clone
+(`fetch-depth: 1`), where the historical commit is simply absent — which is
+indistinguishable from a bogus ref. On a shallow clone the gate SKIPS those
+checks and prints exactly which ones it skipped; it never fails them, and never
+passes them silently. The `quality` CI job checks out full history
+(`fetch-depth: 0`), so every `@ref` is really verified once per push, while the
+six test legs stay shallow and cheap.
+
+## What the gate checks
+
+`scripts/check-citations.js` runs in `.husky/pre-commit` and in the `quality`
+CI job (`npm run check:citations`).
+
+**Pre-commit reads the git INDEX, not the working tree** — the index is what the
+commit will actually contain. This is true of all three pre-commit gates
+(`check-secrets`, `check-file-sizes`, `check-citations`), which share
+`scripts/git-index.js`. Reading the working copy meant staging a violation and
+then cleaning the working copy let the violation through, and — just as bad — a
+*valid staged fix* could be blocked by an unstaged edit that was never going to
+ship, which is how people learn to reach for `--no-verify`. `--all` deliberately
+still reads the working tree: it audits the checkout as it stands, and CI has no
+staging area to differ from.
+
+Per commit it checks the union of two scopes:
+
+- **IN** — citations living in the files the commit changed.
+- **TO** — citations anywhere in live code that *point at* a file the commit changed.
+
+A commit's changed set deliberately includes **deletions**, and a **rename
+contributes both of its paths**. `git diff --name-only` reports a rename as its
+new path alone, which would leave the renaming commit unable to see the
+citations to the old path it just broke — the same hole deletions had. This is
+why the gate uses `--diff-filter=ACMRD` and `--name-status` where its sibling
+gates use plain `ACM`: a deleted file needs no size or secret scan, but deleting
+or renaming one is among the surest ways to falsify *other* files' citations.
+
+**What the symbol check is, honestly.** It is a text search on identifier
+boundaries, not a parse. `file.js :: foo.bar` requires the literal `foo.bar` to
+appear in the target; it does not prove `bar` is a property of `foo`, and it
+cannot see a symbol reached through destructuring or a computed key. It catches
+the case that actually rots — a renamed or removed symbol — and it will not be
+fooled by an unrelated `foo` and an unrelated `bar` merely coexisting.
+
+**TO is not optional.** Measured across PR #171's 38 commits, 119 corrected
+citations split 66 IN-scope / 18 TO-scope-only. A gate scoped to changed files
+alone would have shipped all 18 — including every `run-retry.js` citation in
+`src/headless.js` and three test files that the extraction commit never had
+open. An extraction moves *one* file's lines and falsifies citations in files it
+never touches.
+
+## What the gate does not check
+
+Only live code (`src/`, `electron/`, `tests/`) is scanned. `BACKLOG.md` and
+`docs/` hold 3639 of the repo's 4128 citations and are **out of scope by
+design**.
+
+**Doc-tree citations are dated historical record. Read them as history, not as
+claims about the current tree.** In particular `docs/superpowers/plans/*` and
+`docs/superpowers/specs/*` are snapshots: their filenames carry the date they
+were written, and their citations were true against the tree of that date.
+
+Do not bulk-rewrite them. In PR #171 `BACKLOG.md:1820` looked like rot and was
+**true as of tag v4.7.0** — merely undated. It was annotated, not overwritten. A
+codemod would have destroyed a true statement. When a doc citation is genuinely
+misleading, annotate it with the ref it was true at, or convert it to `@ref`
+form; do not silently renumber it.
+
+## Fixing a stale citation
+
+1. **Open the cited line.** Never derive a correction by offset arithmetic —
+   extractions do not shift a file uniformly. PR #171 measured offsets of
+   0/-1/-9/-10/-32 within one commit, and 0/+10/+15 within a single file in
+   another. Applying one offset shipped fresh wrong values twice.
+2. Re-anchor by symbol wherever the claim allows it.
+3. **Sweep every file your commit touches**, not just the one you set out to
+   fix — a comment-only edit still moves line numbers. This exact miss caused
+   two fix rounds in #171.
+4. Prefer line-count-neutral edits. That is what finally stopped the cascade.
+
+## The burn-down list
+
+`CONFIG.grandfathered` in `scripts/check-citations.js` is the escape hatch for
+citations already stale when a gate change lands, so the gate can block from day
+one instead of shipping advisory. **It is empty, and should stay that way.** Fix
+the citation, then **delete the entry** — a test asserts every entry still names
+a real citation, so the list cannot quietly accumulate dead weight.
+
+The original eight were burned down in one pass. **Four were born stale** — wrong
+in the commit that wrote them, not rotted by later drift: three reused a line
+number from a split that had already landed (one from a split made in that very
+commit), and one wrote a symbol name with `.js` appended as if it were a path.
+The other four were ordinary rot from the PR0/PR5c splits. A gate that catches
+only decay would never have caught the first four — which is the case for
+`file.js :: symbol` being the default form.

package/docs/ROADMAP.md

@@ -136,7 +136,7 @@ as hard as a crash.
   (`runStats` consumers keying by model must exclude `role: 'judge'`).
 - **Docs** — the full record is `CHANGELOG.md` §4.6.0; spec
   `docs/superpowers/specs/2026-08-01-degrade-announcement-invariant-design.md`; plans 1–4 under
-  `docs/superpowers/plans/` (`2026-08-0*-v4.6-degrade-invariant-plan-*.md`).
+  the v4.6 degrade-invariant plans (pruned at the release cut; see git history for the branch).
 > Why it jumped the queue (2026-08-01): the v4.5.x field reports showed the engine was not losing
 > legs (11 four-seat council runs on v4.5.4, 10 clean) — but when a seat *was* lost, nothing told
 > the user which one. That silent-degrade class was ruled a north-star violation and took the rev
@@ -196,9 +196,18 @@ list. Two findings drove it:
    that makes the numbers right.
 2. **`runStats` is a cost source, not just a record.** Verified at `8d0584a`:
    `cli-handlers-council.js:56` computes `amicus council stats` cost as
-   `sumWaveUsage(r.runStats).cost` with **no fallback**; `council/report.js:79` falls back to
-   `sumWaveUsage(runStats).cost` when wave usage is absent; `council/ledger.js:24` joins street-cred
-   off the same array. So CA-4's omissions are not a schema nicety — they under-report spend on the
+   `sumWaveUsage(r.runStats).cost` with **no fallback**; `council/report.js@8d0584a:79` falls back to
+   `sumWaveUsage(runStats).cost` when wave usage is absent; `council/ledger.js@8d0584a:24` joins street-cred
+   off the same array. ⚠️ **Two of the three pinned to `@8d0584a` on 2026-08-20 (v4.8 T2.4); the
+   first deliberately NOT pinned, because it never rotted.** Opened at all three refs,
+   `cli-handlers-council.js:56` is byte-identical — `const cost = sumWaveUsage(r.runStats || []).cost;`
+   at `8d0584a`, at `ed5c0c02` and at the current tree — so it is a **live-true** citation and
+   pinning it to a historical ref would have made a correct present-tense claim read as history.
+   An earlier draft of this note said *"all three had already rotted"*; that universal is false and
+   is corrected here. The other two HAD already rotted before T2.4 began (`report.js:79` and
+   `ledger.js:24` are comments at `ed5c0c02`), so their drift is pre-existing, not this release's.
+   The report fallback is now at `src/council/report.js :: toModel`'s `total`; all three claims
+   themselves still hold. So CA-4's omissions are not a schema nicety — they under-report spend on the
    surface the owner relies on, which collides with the cost-truth principle (*reported > estimated
    > unknown; never fabricate $0*). An omitted leg is not "unknown" — it renders as money never
    spent on legs that spent money.
@@ -326,6 +335,25 @@ release whose scope was explicitly locked. The patch already carries two behavio
 LC-10) that stretch the definition; a third that pops a GUI window would not be defensible as a
 patch. Sits naturally beside v4.5's existing **GUI power ergonomics (F10)** line.
 
+### v4.7.1 — the diagnostics stop lying *(patch)* — ✅ SHIPPED v4.7.1, 2026-08-09
+Nine fix/test-hardening items and one mandatory extraction. No new commands; three declared
+behaviour changes.
+- **`doctor` stops grading the engine on presence** — the install record gains a version and skew
+  is reported as a WARN. Underneath it, `npm root -g` could never resolve on Windows, so amicus had
+  never been able to see a global install at all — which also blinded `doctor --fix`'s donor
+  selection — #133
+- **The NO_OUTPUT_BACKSTOP message stops guessing** — it asserted a cause it had no evidence for,
+  which misdirected 30 minutes of a real incident. It now states only what the deadline
+  observed — #129, #133
+- **Retries can heal a slow model** — the once-only Stage-1 retry doubles its window, clamped to the
+  leg timeout so a low `--timeout` cannot silently reclassify the failure class — #129
+- **Tags stop being dropped** — `continue`, `resume` and `--retry-failed` inherit the parent tag, so
+  `spend --group-by tag` stops mis-bucketing continued work under `(unattributed)`. `--tag` is now
+  rejected on continue/resume rather than silently ignored *(behaviour change)*
+- **The engine is pinned exactly** — `opencode-ai` and `@opencode-ai/sdk` at 1.18.15, moving dev and
+  CI off 1.2.20. First release whose suite ran against the engine users actually get
+- Plus a `sidecar/reopen-spend.js` extraction, a dead-code deletion, and three documentation gates
+
 ## Backlog (tracked, not scheduled)
 
 ### Enterprise-readiness *(unscheduled — gated on funding / cofounder)*
@@ -383,7 +411,7 @@ first. The prose-panel and blind-masking nits (RN-2, RN-5, the `T19-*`/`T20-*` f
 - **E7** — Prompt dedup cache (exact-dup, opt-in, excludes council/fanout) — minor cost optimization.
 - **E6** — Cost-per-quality metric (withdrawn in debate; revisit if street-cred stabilizes).
 - **`amicus key --local` picker** *(S)* — a default local-provider picker so `amicus key` sets/clears a bearer without naming the provider id: auto-select (and announce) when exactly one local provider is configured, a numbered prompt when several, and a hard error under `--json`/non-interactive rather than guessing a secret's destination. Register `--local` as a boolean flag. Deferred out of v4.2.1 as feature material (a new CLI surface, not a patch fix).
-- **Headless no-output fast-fail backstop** *(M)* — fail a headless run fast (env-tunable `AMICUS_NO_OUTPUT_BACKSTOP_MS`, ~120s default) when a misconfigured local model produces zero output, reasoning, and tool-calls, instead of polling to the request/overall timeout. Disarms permanently on the first token/reasoning/tool_use, so a legit slow cold-prefill local model (30–90s is normal) is never affected. Deferred out of v4.2.1 as new runtime behavior.
+- ~~**Headless no-output fast-fail backstop** *(M)*~~ — **SHIPPED** (#99; the live default is **300 s**, not the ~120 s proposed here, and a Stage-1 retry doubles it to 600 s). Fail a headless run fast (env-tunable `AMICUS_NO_OUTPUT_BACKSTOP_MS`) when a misconfigured local model produces zero output, reasoning, and tool-calls, instead of polling to the request/overall timeout. Disarms permanently on the first token/reasoning/tool_use, so a legit slow cold-prefill local model (30–90s is normal) is never affected. (Was deferred out of v4.2.1 as new runtime behavior; it landed later.)
 
 ## What changed vs. the council's flat top-10
 - Split the flat list into a **benefit-themed 4.x point-release line** (v4.0 → v4.2 → v4.3 → v4.4 → v4.5).

package/docs/SHIMS.md

@@ -59,4 +59,4 @@ Removed across the following commits on `p18/shim-removal` (#19):
 - `c3de5bf` — dead `sidecar-config-hash` comment-parse tolerance (test-only tolerance removal — `config.js` never had dual-parse code; the skill-text acceptance instruction is fixed by this docs sweep)
 - `9273dd1` — `SIDECAR_MAX_SESSIONS` → `AMICUS_MAX_SESSIONS` rename (the last legacy-prefixed env var read anywhere in the codebase)
 
-See the rebrand plan for the original shim rationale: `docs/superpowers/plans/2026-06-08-amicus-rebrand.md`.
+The original shim rationale is in the 2026-06-08 rebrand plan, pruned at its release cut; see git history.

package/docs/configuration.md

@@ -1,6 +1,6 @@
 # Configuration Reference
 
-`amicus setup` is the recommended way to configure Amicus. It opens a graphical wizard that validates your API keys live, lets you pick a default model from the live catalog, and saves everything to `~/.config/amicus/.env` (permissions `0600`). The environment variables below are for overrides and advanced tuning — most users only need the API keys section.
+`amicus setup` is the recommended way to configure Amicus. It opens a graphical wizard that validates your API keys live, lets you pick a default model from the live catalog — down to a specific model per provider, not just the family default — and saves everything to `~/.config/amicus/.env` (permissions `0600`). The environment variables below are for overrides and advanced tuning — most users only need the API keys section.
 
 ---
 
@@ -108,7 +108,7 @@ These variables control the polling loop that drives headless sessions. The defa
 | `AMICUS_STABLE_IDLE_POLLS` | Number of consecutive idle polls required when no explicit completion signal is received (approximately 60 s at the 2 s default). This is the fallback heuristic for models or SDK versions that don't emit a clean completion event. | `30` |
 | `AMICUS_MAX_CONSECUTIVE_POLL_FAILURES` | Consecutive poll failures before the headless runner bails. At the 2 s interval this is approximately 30 s. Prevents a dead server from burning the full session timeout on futile polls. | `15` |
 | `AMICUS_TOOL_CALL_STALL_MS` | How long a tool call may sit pending with **no** result and no output growth before the leg is failed with `Tool call stalled: <tool>` and its OpenCode session aborted. This is the wedge guard: it targets a leg producing nothing at all, and it is skipped while a tool-settle deferral is active (`AMICUS_TOOL_SETTLE_GRACE_MS` owns that decision instead, and ends in a completion rather than a failure). **`0` is ignored** — it falls back to the default rather than disabling the guard, because a `0` threshold would kill every leg on its first poll. There is no way to switch this off; raise it if you legitimately run very long single tool calls. | `180000` |
-| `AMICUS_NO_OUTPUT_BACKSTOP_MS` | Fail a headless leg fast when the model has produced no output, reasoning, or tool calls for this long — the "accepted but not serving" class. Disarms permanently on the first sign of activity, so slow cold-prefill local models are unaffected. **Set `0` (or negative) to disable the backstop entirely** — silent legs then run to the ordinary timeout. | `120000` |
+| `AMICUS_NO_OUTPUT_BACKSTOP_MS` | Fail a headless leg fast when the model has produced no output, reasoning, or tool calls for this long — the "accepted but not serving" class. Disarms permanently on the first sign of activity, so slow cold-prefill local models are unaffected. **Set `0` (or negative) to disable the backstop entirely** — silent legs then run to the ordinary timeout. | `300000` |
 | `AMICUS_USAGE_SETTLE_POLLS` | How many extra `getMessages` reads run **after** a leg has already finished, to catch provider usage/cost that lands milliseconds after the completion signal (measured: real paid legs losing their cost by 29 ms and 155 ms). The loop breaks early as soon as every assistant message carries usage, so the common case is one extra read. **Set to `0` to disable the reconciliation entirely** — legs then report whatever usage was present at completion, which can be `$0` on a leg that really did cost money. | `3` |
 | `AMICUS_USAGE_SETTLE_INTERVAL_MS` | Delay between those settle reads. **`0` is honoured and means no delay** — the reads run back to back. It does **not** disable the reconciliation (that is `AMICUS_USAGE_SETTLE_POLLS=0`); it only removes the gap between attempts. | `400` |
 | `AMICUS_USAGE_SETTLE_CALL_TIMEOUT_MS` | Per-call deadline for a settle read and for the child-session (subagent) spend walk. Deliberately much tighter than `AMICUS_POLL_CALL_TIMEOUT_MS`: the leg is already finished, so a hung read must not add 30 s × 3 to a run's wall time. The effective value is the **smaller** of this and `AMICUS_POLL_CALL_TIMEOUT_MS`, so raising it above that has no effect. **`0` is honoured and means no timer is armed at all** — a hung settle read or subtree walk would then wait indefinitely. | `5000` |
@@ -238,7 +238,7 @@ Everything lives under `~/.config/amicus/` (`getConfigDir()` in `src/utils/confi
 | `.env` | `amicus setup` / `amicus key` | API keys (`OPENROUTER_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `DEEPSEEK_API_KEY`). `0600` permissions. |
 | `model-catalog.json` | `refreshCatalog()` (`src/utils/model-catalog.js`) | The cached provider model list, schema-versioned, with a **24-hour TTL**. Also carries refresh-outcome fields — `lastRefreshAttempt` and `lastRefreshError` — stamped on a *failed* refresh without touching the last-good `models`/`fetchedAt` (a bad fetch never clobbers a good cache). Human-readable JSON; safe to delete, it rebuilds on next use. |
 | `sessions-index.json` | `session-index.js` (`recordSession`, written at session start) | A **global** map of `taskId → project path`, consulted only when a per-project session lookup misses (e.g. an MCP server whose cwd differs from where the session was created). Navigation aid only, never authoritative — a corrupt index degrades to "no entry," never a crash. |
-| `council-ledger.jsonl` | `src/council/ledger.js` (`appendRun`), on every `council tally` | One row per council model per run — findings raised, severity breakdown, street-cred, conformance. At `LEDGER_SCHEMA_VERSION` **2** (v4.7 GOA-7), rows may also carry `resolvedModel` (the executable id that served); legacy-read, no migration — a row without one (all pre-v2 history, plus leg-less rows) aggregates under its alias, and a group is marked `legacy` only when every row in it lacks `resolvedModel`. Read back by `amicus council stats`. |
+| `council-ledger.jsonl` | `src/council/ledger.js` (`appendRun`), on every `council tally` | One row per distinct (council model, resolved executable) pair per run — findings raised, severity breakdown, street-cred, conformance. On an ordinary bench that is one row per council model; where **one alias** was served by one executable across more than one seat (a repeated alias, or a chair that is also a bench seat *when its chair and seat legs resolved to the same executable*) those seats collapse into a single row (v4.8), and an alias whose seats resolved differently gets one row per executable. Two *distinct* aliases sharing one resolution still write **two** rows — one per alias — which `amicus council stats` then aggregates into a single executable-keyed group. `runs` in `amicus council stats` counts distinct `meta.runId` values, not rows. At `LEDGER_SCHEMA_VERSION` **2** (v4.7 GOA-7), rows may also carry `resolvedModel` (the executable id that served); legacy-read, no migration — a row without one (all pre-v2 history, plus leg-less rows) aggregates under its alias, and a group is marked `legacy` only when every row in it lacks `resolvedModel`. Read back by `amicus council stats`. |
 | `spend-ledger.jsonl` | `src/utils/spend-ledger.js` (`appendSpend`), new in Phase 16 | One row per completed run/leg — tokens + resolved cost. Read back by `amicus spend` for the cross-run rollup. Append is best-effort and can never fail the run it's recording; safe to delete (starts fresh, loses history only). |
 | `packs/<name>.json` (v4.5) | `amicus pack save` (`src/pack/pack-store.js`) | One JSON file per saved policy pack — bench/model, chair/critic/lenses, options, and a briefing-template *reference*. Peer directory of `templates/` below. Safe to inspect, hand-edit, or delete individually; see [Policy packs](./usage.md#policy-packs). |
 | `templates/<name>.md` (v4.5) | You, by hand (your editor is the manager) | User-authored briefing templates; a file here shadows a built-in of the same name. Amicus itself never writes into this directory — there is no `template save`/`rm`. See [Briefing templates](./usage.md#briefing-templates). |