amicus 4.8.0 → 4.9.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.8.0",
+  "version": "4.9.0",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,361 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.0] - 2026-08-26
+
+*The council does new work.*
+
+### Added
+
+- **Task mode — the council stops being able only to critique (#134, #130, #146).**
+  `amicus council run --intent task`, or `intent: 'task'` on the `amicus_council_run` MCP tool,
+  points the whole pipeline at open-ended work instead of at a review. Every seat **produces the
+  deliverable** the briefing asks for — `briefings-task.js :: TASK_SEAT_ROLE` says it in as many
+  words, *"you are not reviewing the briefing, you are executing it"* — the Stage-2 judges rank
+  **which response best does the work** and adjudicate whether each declared claim holds, and the
+  chair synthesizes an **ANSWER**, never a verdict.
+  The two terminal scales are disjoint by construction: a review chair closes on
+  `Ship it | Fix these first | Fundamental rethink`
+  (`briefings-chair.js :: CHAIR_VERDICT_VALUES`, `parse-stage2.js :: CHAIR_VERDICTS`), a task chair
+  on `Converged | Split | Insufficient` (`briefings-chair-task.js :: CHAIR_ANSWER_VALUES`,
+  `parse-stage2.js :: CHAIR_ANSWERS`). They **share no value and no keyword** — `VERDICT:` and
+  `ANSWER:` — which is what lets each parser stay blind to the other's line, and it is
+  `parseChairTerminal(text, intent)` that picks between them. Each scale is spelled **five** times —
+  those two constants, the scale addendum, the chair repair prompt, and
+  `schemas/council-verdict.schema.json`'s `overallVerdict` enum, which now carries the review scale
+  followed by the task scale — and all five are drift-pinned together
+  (`tests/council/chair-scale-drift.test.js`, named mutant `ANSWERSCALEDRIFT`).
+  - **`intent` is emit-when-`task`, everywhere.** `review` is the default spelled out loud: both
+    transports strip it, and `run.js :: runCouncil` — a public door too — **normalizes** it to
+    absent (`delete`, never `= undefined`) rather than refusing it, so one input cannot mean two
+    things at two doors. Only a genuinely unknown value is `BAD_ARGS`. Nothing ever writes
+    `intent: "review"` onto `run.json`, `tally.json` or `verdict.json`, so every pre-v4.9 document
+    is already spelled correctly and no migration exists to need.
+  - **The Stage-1 contract does not fork.** The JSON skeleton, the
+    `blocker | major | minor | nit` enum and the required-non-empty `location` rule are review
+    mode's, verbatim; `findings.js` — one validator, one repair loop — changes by **zero executable
+    lines** (the only edits it took in this release are comments: a refreshed line citation, and the
+    empty-`findings[]` ruling now naming the task briefings' claims wording beside the review one).
+    Only the frame and the field glosses differ: in task mode `location` is the grounding
+    discipline, naming *what the claim rests on — a source, a computation, or the literal word
+    "assumption"*.
+  - **Intent selects the parser on the Stage-5 rebuild too**, where the run is long over and only
+    documents remain. Three carriers, because no one of them covers every leg — the record's own
+    `meta.intent`, `run.json`'s checkpoint, and the run folder's prior `verdict.json` — combined as
+    a **disjunction** (absence is no vote, not a vote for review). The two *document* reads carry the
+    same `!runId || doc.runId === runId` guard their siblings do — waived only when the *record* names
+    no run and never when the *document* does not. Without that guard a stale or foreign document in
+    the folder hands the rebuild another run's intent, which selects the chair parser. An
+    `overallVerdict` carried off the **wrong** scale is not trusted: it fails
+    `scale.includes(...)` and falls through to re-parse `chair-output.md`.
+  - **The renderers say what the run actually produced.** The primary heading is `## Answer summary`
+    on a task run and the exact old `## Verdict summary` on a review run; the tier table carries
+    *"Tiers report peer concurrence, never verification."* directly under the counts a skimmer
+    reads — task runs only, forked in **both** renderers and pinned separately per renderer so
+    neither can regress silently (mutants `SUMMARYLABEL`, `QUALIFIERDROP`). The fold
+    (`workspace/fold-format.js`) and the Workspace chip
+    (`electron/workspace-ui/workspace-matrix.js`) label the terminal line `ANSWER:` or `VERDICT:`
+    off the same key, matching on `=== 'task'` so a pre-v4.9 payload with no `intent` reads as
+    review instead of relabelling every legacy run. The chair's own briefing carries the caveat the
+    tier table cannot: *"Peer agreement on a claim is CONCURRENCE, not verification — models
+    correlate on priors."*
+  - **Task runs write zero reliability rows**, at two gates — `run-finish.js` (the engine's own
+    append) and `cli-handlers-council.js :: runTally` (the hand-assembled path) — and `council tally`
+    now **refuses** a `meta.intent` that is neither spelling rather than letting a near-miss
+    (`'Task'`) slide into the ledger, whatever `--no-ledger` says. The skip is **announced and
+    non-degrading**: a `Note:` on the new `ledger-skipped` channel, `kind: 'info'` — a third kind
+    beside `degrade`/`heal` that the degrade sink is structurally unable to flip `degraded.value`
+    on. ⚠️ It is emitted where it is *load-bearing*, not on every task run: the chair-fallback
+    promotion arm, which draws on ledger history a task run never fed. That arm is reached at most
+    once per `runChair`, and `runChair` runs once per run, so "announced once" is structural rather
+    than a flag's promise. `kind: 'info'` records get their own **Notes:** list in the report and
+    are kept out of the `## What was lost` heading — an announcement is not a loss.
+  - **`amicus council stats` on an empty ledger explains itself.** A fresh install and a task-only
+    install used to render the same blank table; the surface now names where rows come from
+    (*"reliability history comes from review runs; task runs never write rows here"*) rather than
+    asserting which of the two states the reader is in — an earlier wording claimed the latter and
+    was false on every fresh install.
+  - **`--claude-review` is refused with `--intent task`** — a file review is review machinery and
+    has no task-mode meaning.
+  - **Review runs are byte-identical *under the intent fork*.** Not "unchanged as far as we know":
+    the review path composes through the same dispatcher and is pinned at key *and* byte level, and
+    both report `.snap` documents are untouched by this release. Scoped deliberately — task mode
+    changes nothing a review run emits; two *other* items in this release do, and say so where they
+    land (the repair-attempt `runStats` conformance value, and the `tally-input.json` debate-row key
+    order the builder unification moves into agreement with `tally.json`).
+  - Limitations, ruled and recorded rather than discovered later: **one intent per run** (no mixed
+    bench), intent is **not pack-settable** (nothing in `src/pack/` reads it), and a task run builds
+    no reliability history by design. #130's *detector* half — the `location` heuristic that would
+    emit a divergence **observation** into `degrades[]` — is deliberately not in this release; what
+    ships is the declaration that removes its root cause, since the hard-coded review frame every
+    seat used to receive was #130's mechanical cause and #134's blocker at once.
+
+- **The engine speaks for itself (#133, pieces 2 and 3).** A `NO_OUTPUT_BACKSTOP` death report no
+  longer stops at what the deadline observed — it quotes **the engine's own newest ERROR line for
+  that session**, appended as ` — engine log: <excerpt>`. Bounded read, both log schemes,
+  boundary-anchored session matching (a line whose structural session field names someone else is
+  skipped even when our id appears elsewhere on it), and a **union across every candidate log
+  directory that exists**, not the first one — the dirs are alternative homes for the same engine's
+  logs, so a stale `$XDG_DATA_HOME` or an empty dir left by a previous install would otherwise
+  shadow the dir holding the answer. A matching line whose message part is empty keeps the walk
+  going instead of ending the file's scan, because the real failure and a terse message-less
+  teardown line are typically neighbours.
+  One lookup's scan is memoized per `fs` implementation for 10 s so a whole wave of seats shares it.
+  ⚠️ **That reuse serves hits only.** A **miss** re-lists and re-reads before it is believed, and
+  drops the live slot behind it, because the engine writes a leg's error *when that leg dies* —
+  possibly after the cached scan, possibly into a file it has only just rolled over to, so an
+  absence in a previous call's listing is not an absence on disk. The accepted residual runs the
+  other way and is stated rather than buried: a warm hit serves the newest line *as of when the slot
+  was built*, so the TTL bounds the missed window (≤10 s of new lines) and bounds nothing about the
+  **age** of what is served — a minutes-old genuine error for this leg can be quoted while a fatal
+  line written two seconds ago sits unread. Quoting a true older diagnostic is the trade; silence
+  while the cause sits on disk is the failure this module exists to end.
+  Where the answering server's version differs from the running install's engine, the report appends
+  ` (engine skew: server <a> ≠ installed <b>)` — tracked per server, refreshed on every session
+  create, with a remedy line that names the honest action and says why `doctor` cannot see this
+  class. Everything here is best-effort: every path returns `null` rather than throwing, because a
+  log read must never break a leg's death report. **#133 closes.**
+
+- **TTFT probe — probe, never derive (R12).** `ttftMs` is the elapsed time to the first
+  **substantive** tick, measured off the no-output backstop's *own* predicate. The distinction is
+  load-bearing and the plan's prose named the wrong one: `progressed` includes the empty assistant
+  placeholder OpenCode mints on prompt **acceptance**, so keying on it would stamp a
+  time-to-first-token on a leg that never produced a token. The probe and the backstop tick read one
+  shared `substantiveActivity` constant, and mutant `PROGRESSEDTWIN` pins the single fixture where
+  the two predicates disagree. It rides result docs, leg patches and `runStats` rows emit-when-set,
+  behind one validity rule — `utils/ttft.js :: isMeasuredTtft`, imported by three of the four gates
+  and hand-spelled by the fourth, `council/run-stats-entry.js`, which is pinned require-free (the
+  two spellings are held in step structurally, and a fifth site cannot appear unnoticed) — so an
+  unmeasured value is **dropped at the emit gate, never clamped**, and a leg with no measurement is
+  byte-identical to a pre-v4.9 one. The per-model backstop *derivation* deliberately waits for observations to derive
+  from (#135/#129 record).
+
+- **Alias-shadow warning (#135 C5 / #129's own side observation).** One notice per run when a
+  user-config alias **shadows** a curated alias with a different id — because everything keyed on
+  the alias *name* (per-model operating notes, a bench a workflow spells, a council preset) then
+  quietly describes a model the alias no longer resolves to, and by the time `resolveModel` sees an
+  id the two sources have already collapsed into one string. Compared in **canonical form**, so a
+  gateway spelling of the same id stays silent (mutant `GATEWAYFORM`). Diagnosis only: it resolves
+  nothing, changes no id, no exit code and no artifact — a local override winning is the documented
+  contract; this just says so out loud.
+  Wired at three measured sites, and the third exists because of a measured surface gap:
+  `cli-council-run-bench.js :: resolveBench` is the one bench-resolution helper **both** council
+  transports execute (bench, chair and critic all inspected there), but the council child's stderr
+  is not a pipe the MCP server reads — it is an fd on `<runDir>/debug.log` — so from that site alone
+  an MCP caller would have to open a log file to find the notice. `mcp-council-bench.js ::
+  auditBenchAliases` therefore writes it into the **tool result's notices array**, a different
+  surface rather than a second copy: the child still writes its line to `debug.log`, the parent
+  writes its own to the tool result, and no single surface shows it twice. The third site is
+  `amicus models --check`, the one call that passes no name list. Every third-party fragment the
+  notice quotes rides the house sanitizer (mutants `NOTICERAW`, `MESSAGERAW`, `THROWNRAW`), and the
+  stderr writer is armed against a closed pipe (`STREAMFATAL`, `STREAMDEAF`).
+
+- **`amicus list` finally shows council runs.** `amicus_list` has merged them since v4.0 §8; the
+  CLI never did, so a council launched from the terminal was invisible **to the terminal** —
+  `amicus list` reported *"No amicus sessions found."* in a project whose only work was a council.
+  The same enumerator now feeds both surfaces through `src/sidecar/list-council.js`: the MODEL cell
+  carries the live stage as `council(<stage>)`, mirroring the wave row's `wave(N legs)`, width-capped
+  so it can never butt against the STATUS column; `--search` reaches council material on both
+  surfaces. **Scope is stated rather than silent:** only the current project's council runs are
+  merged, `--all` included — council runs are found through per-project pointer files and there is
+  no cross-project council index to walk — so the human listing prints that disclosure, naming no
+  remedy because there is no flag that widens it. A merge that fails now **says so, with the cause**
+  (sanitized), instead of dropping every council row into output indistinguishable from a project
+  that has none.
+
+- **The Workspace dead-seat surface — an unbound seat stops being invisible (SI-02, R4).**
+  `deriveSeatLoss` and both Workspace consumers now admit the `seat-unbound` family behind **one
+  retry-family gate**, because `seat-unbound` is a shared channel — orphan-leg notes, re-vote
+  refusals and Stage-2 judge notes ride it too, and each is pinned *excluded* in every consumer.
+  The two LOSS reads spell that gate identically (`(retryWaveId || firstFailure) && (seatId ||
+  seat)`); the RETRIED read in `workspace-seats.js` is deliberately **narrower** — `retryWaveId`
+  alone, since a never-attempted seat carries a `firstFailure` and badging it *retried* would be
+  false. One loss rule, one narrowing, both pinned (mutants `SKIPRETRIED-A`/`-B`, one per direction
+  the widening could come back) rather than left to drift. The producer half was one line: the partial arm emits a seat id
+  beside the alias-valued seat, `null` for a slot it could not identify and never the alias.
+  The critic path keys on seat identity where the record and the run can both spell it, so a dead
+  bench twin beside a live critic twin renders one correctly-labelled row — it used to render
+  **nothing at all**, the silent 0-row erasure this project's product principle rates as severely as
+  a crash — and a both-dead pair renders two rows with one critic label. The known-wrong pins were
+  **flipped, not renamed**. The third street-cred renderer joins its seat-keyed siblings, and its
+  stated precondition was **measured false and struck rather than satisfied**: `labelOf` never
+  needed a seat id, and mutant `BLINDSEATLEAK` pins that the literally-planned spelling would have
+  leaked one into a blind render. The `seatTableRejected` banner now discloses the seats-vs-artifacts
+  document split in wording that was measured before it was written — the first draft's sentence
+  named the cost panel as a seat surface, which it is not, and would have shipped false.
+
+### Fixed
+
+- **W1's nine small repairs**, one wave, disjoint files, each TDD'd or pinned: the second-opinion
+  Stage-4 Confirmed gloss gains the lone-corroborating-peer case in both presentation headings;
+  `fmtProbeLine`'s silent parenthetical stops asserting endpoint acceptance and says only
+  *"(no output within the probe window)"*; the setup wizard's embedded alias tables are seeded
+  null-prototype **on the far side of the parse**, sibling tables and the `__proto__` alias-name
+  chain included; `MAX_CATALOG_AGE_MS` retires three copies to one exported source; repair-attempt
+  `runStats` rows stamp the **measured** outcome (refined twice by councils — the flat literal
+  mislabeled successful repairs, and the ch4 chair push had silently defaulted `clean`);
+  `KNOWN_VARIABLES` is single-sourced so validation and rendering derive from one exported set,
+  drift-tested — which satisfies the T3-m2 hard gate that composition's `{{input}}` was waiting on;
+  the MCP test-client timer leaks behind the standing *"Jest did not exit"* warning class are closed
+  in three suites (six open handles → zero, measured); a bare-id `model_not_found` carries the
+  doctor-repair hint when the OpenRouter twin classifies valid; and the setup TOCTOU is closed
+  **structurally** by consuming the same catalog snapshot the offer was built from — re-ruled twice
+  into per-window, session-scoped, read-without-consume offer sessions.
+- **The outbound fences neutralize both tag ends.** `utils/untrusted-fence.js ::
+  defangOutboundFenceTags` escapes open *and* close tags for the whole house fence vocabulary over
+  both outbound surfaces — the council briefing tail and the parent-conversation section — so a body
+  carrying the **sibling** surface's tags cannot smuggle them through the surface that does not
+  happen to emit them (mutants `CTXFENCEBREAKOUT`, `BRIEFFENCEBREAKOUT`). ⚠️ Stated as a disclosure,
+  not a caveat: an entity escape is a convention about how a reading model interprets bytes, not a
+  parser guarantee. This is defense in depth — it removes the literal tag so the escape stops being
+  free — and the load-bearing protection is still the preamble both fences carry.
+- **Curated pins move to the generation the bench actually runs** — `kimi` → `kimi-k3`, `qwen` →
+  `qwen3.8-max`, `glm` → `glm-5.3`. Not cosmetic: the review reproduced the standing alias-shadow
+  line the stale `glm` pin would have printed on every CI council run. Every old-id hit in the suite
+  was classified; no live pin of the old generation remains.
+
+### Internal
+
+- **The `runStats` builders unify (PR1F-2 closes).** Debate's `mk`, the re-vote `legRow` and the
+  Claude row fold into `buildRunStatsEntry`, so every non-primary row shares one key order, one
+  set of defaults, and one emit-when-set rule. (What the fold does **not** buy: propagation —
+  `mk` passes a synthetic five-field leg, so entry-param fields and future leg-sourced fields
+  still require widening `mk` itself; the widening is a filed candidate.) Done by measurement,
+  because every pre-existing pin proved
+  order-insensitive: 21 byte-order goldens were written **before** any fold (23 in the suite
+  now, after two post-fold additions), and mutant
+  `UNIFYDRIFT-mk` reddens exactly one test in the whole repo — the golden. A 137-invocation status
+  census showed the divergent `'unknown'` default **never fires and structurally cannot**, so it was
+  deleted as measured-dead rather than chosen between. ⚠️ The filing's own blast-radius claim was
+  **corrected** rather than inherited: `run.json` carries no `runStats`, and `tally.json`/
+  `verdict.json` were *already* in the entry's key order via tally's allowlist re-projection — the
+  fold moves `tally-input.json` **into** agreement with them.
+- **SI-16's three over-length council functions split at measured seams**, in-file and byte-faithful
+  (`runStage2` → `bindStage2Seats`, `runDebate` → `runDefenseWave`, `runRevoteWave` →
+  `repairRevoteLeg`), each mutant's red set recorded and each revert SHA-verified.
+- **`seatKey` consolidated to one exported definition** (SI-DUP disposition (b)): the two remaining
+  standalone copies of the seat-or-alias rule now import it, with the load-bearing hand-inlined
+  fallback and the two `keyOf` sibling forms deliberately untouched.
+- **MCP tool parameters re-measured and pinned** (F-1): 58 documented plus 2 allowlisted of 60 keys,
+  with the per-key rulings recorded in the test rather than in a comment that can rot. Separately
+  (F-5), `routing.tier` / `tier_onboarded` are documented from measurement, including the silent
+  `balanced` coercion.
+
+### CI
+
+- **Council backstop headroom.** `council-review.yml` sets `AMICUS_NO_OUTPUT_BACKSTOP_MS` to
+  `480000` on the council step, single-spelled and pinned by four workflow tests, with the measured
+  4.8.1-cycle stall evidence recorded in the comment beside it. The broader retry-policy question is
+  filed as issue 202 rather than guessed at here.
+- The CI bench moves with the pins above: `kimi` off the bench, `deepseek` seated, `gemini-pro`
+  chairs.
+
+## [4.8.1] - 2026-08-25
+
+### Fixed
+
+- **Setup Step 2 offered one card per curated model *family*, with no way to choose which model
+  within it — issue #138.** `pickCurrent` kept exactly one winner per namespace, so a family with
+  several live models collapsed to a single card, and the route pill it wrote stored a **provider**
+  id, never a **model** id, so nothing downstream could tell them apart either. The family regex
+  made this worse for one vendor outright: `/^deepseek-v[\d.]+(-pro)?$/` only matches a
+  version-numbered `-v` name with an optional `-pro` suffix, so `deepseek-r1`, `deepseek-chat`, and
+  `deepseek-flash` never had a route to *any* card — structurally excluded, not just hidden behind
+  the flagship. Both wizard surfaces — the Electron Settings window and the readline setup flow —
+  now offer a vendor-scoped drill-down after the family pick, built on the existing priced picker
+  via a new pure module, `model-shortlist.js`, which splits a vendor's rows into suggested/rest so
+  the UI can show a handful of recommended models plus an "all" escape hatch. Persistence is
+  unchanged: `config.aliases[<family>]` still holds a route-encoded id and `config.default` still
+  holds the alias *name* — only the picker got smarter, not the storage shape. Two review rounds on
+  this branch closed five further blockers before it shipped: a silent setup-fallback path, a
+  misleading model-count label, a false alias-deletion report, a same-run double-ask of the same
+  vendor's drill-down, and an unescaped catalog id.
+
+- **`chooseRowId` fabricated bare `<vendor>/<model>` ids for catalog rows that exist only on
+  OpenRouter — issue #195.** Once the user held that vendor's own API key, the fabricated id routed
+  `direct`-first and `catalogGate` rejected it as `model_not_found`. Measured against the live
+  catalog: 19 of 69 `google` rows and 51 of 175 `openai` rows. The picker unconditionally stripped
+  the `openrouter/` prefix off any non-`DIVERGENT_VENDORS` OR-only row, regardless of whether the
+  direct namespace actually carried that model. It now reuses `classifyModel` — never a
+  reimplementation of its rule — and synthesizes the bare form only when that id would *not*
+  classify `invalid` on `direct`; `deepseek`'s empty-namespace rows (14/14) still synthesize bare,
+  unchanged. The identical unconditional strip existed in two more places that would otherwise have
+  silently undone the fix at write time — `canonicalizeResolved` (preselection matching) and
+  `applyProviderDefault` (the actual persist-to-config path, reached from both the Electron IPC
+  handler and the readline flow) — both now carry the same guard. Persistence was hardened further
+  in review: a failed or empty catalog fetch at persist time used to degrade straight back to the
+  old unconditional strip (confirmed against the real 601-row catalog), so `applyProviderDefault`
+  now requires *positive* catalog evidence (`classifyModel` returning `valid`, not merely
+  non-`invalid`) before it will strip a prefix — an empty catalog is inert, never a silent fallback.
+  ⚠️ **`doctor --fix` can now rewrite your config, not just diagnose it.** A new narrow repair,
+  `findFabricatedAliasRepairs`, finds aliases already persisted by v4.8.0 as a fabricated bare id —
+  one that classifies `invalid` on `direct` and has an unambiguous OpenRouter twin via
+  `pairAcrossGateways` — and rewrites them to the id the fixed picker would offer today. It is
+  gated on a **fresh** catalog fetch (declines with an explanatory hint if the same doctor run's own
+  `catalog` check reports the cache as stale, rather than repairing from data it has already told
+  you not to trust), idempotent, converts only to the one id `pairAcrossGateways` names, and every
+  repair is announced through the existing doctor-fix `heal` degrade channel, naming the alias and
+  both the old and new id. Outside that one class — a typo, a retired model, a user-invented id, or
+  a `DIVERGENT_VENDORS` alias — `doctor --fix` leaves the config alone exactly as before.
+
+### CI
+
+- **Council review on this repo ran with whatever alias each seat's name happened to resolve to on
+  a bare runner, not the intended bench — #193.** A CI runner has no user config, so
+  `getEffectiveAliases()` returned exactly `DEFAULT_ALIASES` and every seat bound to the shipped
+  `curated-models.js` pin: `glm` reviewed at 5.1 while 5.2 and 5.3 had already shipped, and an alias
+  missing from that table was silently dropped by `classifyCouncilMembers` with only a `run.json`
+  note to show for it. It was invisible by construction — `run.json`, `events.jsonl`, and
+  `verdict.json` all record alias *names*, so they read identically whichever model actually
+  answered; `spend-ledger.jsonl`, written to `getConfigDir()`, is the only artifact that carries a
+  resolved id. `council-review.yml` now provisions `.github/amicus-ci-aliases.json` from the
+  **base** ref (a PR can never edit the map used to review it), validates it by shape, pre-flights
+  every seat before any spend, and uploads the ledger as the receipt; every fetch failure but a 404
+  now fails closed instead of silently swapping the bench. A companion job, `alias-pin-drift.yml`,
+  compares each curated pin against its newest same-vendor sibling on the same tier/variant and
+  opens a weekly bump issue — `models --check` alone is structurally blind to this, since it
+  validates a curated *family* against its own `idPattern`, not a flat cardless pin like
+  `glm`/`qwen`/`kimi`.
+- **The council briefing now includes the `env:` blocks a diff can't show — #194.** PR #193 was
+  reviewed twice, and both benches unanimously raised the same blocker: `$GH_REPO`, `$MODELS`, and
+  `$CHAIR` looked undefined in the `run:` step under review. They were defined — in a workflow- or
+  job-level `env:` block the PR never touched, so it never appeared in the diff. Four seats agreeing
+  was one shared blind spot, not four independent findings. The briefing now appends the workflow-
+  and job-level `env:` blocks of every changed workflow (fetched from the base ref, exactly like the
+  alias map above), labelled explicitly as context and not part of the diff; step-level `env:` is
+  excluded because it already travels with its own hunk. A literal value under a
+  `TOKEN`/`SECRET`/`PASSWORD`/`KEY`-shaped name is withheld from the briefing — a pure `${{ }}`
+  reference is kept, since it names a secret rather than exposing one.
+- **The council-review check is no longer hardcoded green — #197.** Its `none`-policy branch set
+  `CONCLUSION="success"` before the chair's verdict was even read, so three distinct outcomes — a
+  clean review, a review with real findings, and a review that never ran at all — rendered as the
+  identical green check. `fail_on` now defaults to `rethink`: the check fails only when the chair
+  returns "Fundamental rethink," and passes on both "Fix these first" and "Ship it" (a null or
+  absent chair verdict still maps to neutral, never failure). A stricter `fail_on: fix` default was
+  tried first and reverted within hours: three live runs against PR #196 each came back "Fix these
+  first," but of the confirmed findings only one was a real, reachable defect — several were
+  accurate statements about states the system cannot produce, and two rested on premises that were
+  factually wrong. Gating on that verdict would have blocked more good work than bad. `fail_on` is
+  spelled twice in `council-review.yml` — the `workflow_call` input default, and the `pull_request`
+  path's `||` fallback, which is the load-bearing one for every label-triggered review on this repo
+  — and both spellings moved together, with a drift test re-verified against the historical
+  one-site-only mutant at the new value. `none` (report-only) and `fix` (the stricter gate) both
+  remain available for a caller that wants them.
+
+### Internal
+
+- **Burned down the citation allowlist and re-anchored the citations the gate cannot see —
+  citation-burndown, #192.** Twelve stale citations corrected, `CONFIG.grandfathered` emptied to
+  zero. Five of the eight previously-allowlisted entries were born stale — wrong in the commit that
+  introduced them, not rotted afterward; the no-output-backstop comment among them was a truth
+  failure rather than a numbering one, since the guard it warned was missing had been added by the
+  very commit that wrote the warning, so it is now reframed as closed history instead of
+  renumbered. Separately, several source comments cited a bare `(:129)`/`(:293)` line number with no
+  `.js` immediately before the colon — a shape `check-citations.js` cannot parse and so silently
+  never checks — and those are now `file.js :: symbol` anchors instead, both correct today and
+  visible to the gate from now on; one of them (`run.js:293`) had already rotted to the wrong line
+  and is corrected to `run.js:279` in the same pass.
+
 ## [4.8.0] - 2026-08-23
 
 ### Fixed

package/README.md

@@ -132,12 +132,13 @@ The council is the hero — start with the everyday way, and reach for the more
 - **Headless, in CI, with no Claude runtime.** `amicus council run --prompt-file plan.md --council free` runs that same pipeline in one command — reviews → cross-review → tally → chair verdict — writing `verdict.json` and `report.html`. It needs no Claude session, so it drops straight into CI. → [Headless council (CI)](#headless-council-ci)
 - **With a debate round.** Add `--debate` and every Contested or Disputed finding goes back to its raiser to **defend, amend, or withdraw** while the disputing judges re-vote — exactly one rebuttal round, then the final tally. → [The Council](#the-council)
 - **On free, local, private models — at $0.** Point the council (and sidecars) at an OpenAI-compatible server already running on your machine — Ollama, LM Studio, or vLLM — with `amicus provider add`. No API key, no per-token bill, nothing leaves your machine, and it works offline. → [`amicus provider`](./docs/usage.md#amicus-provider)
+- **Pointed at the work itself, not at a review of it.** Add `--intent task` and the same bench *produces* the deliverable instead of critiquing one. → [Task mode (v4.9)](#task-mode-v49)
 
 <p align="center"><img src="./docs/cards/same-table.svg" width="520" alt="A local Ollama model seated as an equal council member at $0.00 — a member, not a mode"></p>
 
 ### Headless council (CI)
 
-The same pipeline runs with no Claude runtime at all: `amicus council run --prompt-file briefing.md --models gemini,glm --chair deepseek --json` executes the review waves, the anonymized cross-review, the tally, and the chair verdict in one command, and writes the full run directory (`verdict.json` with the chair's parsed `overallVerdict`, `report.html`, every review and judge output). That is what powers the repo's own **Council Review GitHub Action v2** — on PRs labeled `council-review` it posts an adjudicated verdict as a check run plus a sticky comment, uploads the run directory as an evidence artifact, and can optionally gate merges via its `fail_on` input (default: report-only). Reference: [docs/council.md](./docs/council.md#amicus-council-run).
+The same pipeline runs with no Claude runtime at all: `amicus council run --prompt-file briefing.md --models gemini,glm --chair deepseek --json` executes the review waves, the anonymized cross-review, the tally, and the chair verdict in one command, and writes the full run directory (`verdict.json` with the chair's parsed `overallVerdict`, `report.html`, every review and judge output). That is what powers the repo's own **Council Review GitHub Action v2** — on PRs labeled `council-review` it posts an adjudicated verdict as a check run plus a sticky comment, uploads the run directory as an evidence artifact, and gates merges by default via its `fail_on` input (fails only on a `Fundamental rethink` verdict; pass `fail_on: fix` to require `Ship it`, or `fail_on: none` for report-only). Reference: [docs/council.md](./docs/council.md#amicus-council-run).
 
 <p align="center"><img src="./docs/cards/ship-gate.svg" alt="A council gating a release pipeline: exit 0 ships it, exit 1 sends it back"></p>
 
@@ -168,6 +169,10 @@ amicus council run --pack review-bench --prompt-file plan.md --json
 
 Any flag you also type on that second line overrides just that value — a pack only fills in what you didn't say explicitly, and it's recorded on the run either way. Packs work the same way on `fanout`/`start` and on the `amicus_fanout`/`amicus_start`/`amicus_council_run` MCP tools. `amicus pack list`/`show`/`rm` manage them, and `--from-run <id>` builds one from a run you already liked instead of typing flags at all. Full reference: [docs/usage.md § Policy packs](./docs/usage.md#policy-packs).
 
+### Task mode (v4.9)
+
+A council reviews by default. `amicus council run --intent task --prompt-file brief.md` — or `intent: 'task'` on the `amicus_council_run` MCP tool — points the same pipeline at open-ended work instead: every seat **produces** the analysis, answer, or artifact the briefing asks for, the judges rank *which response best does the work* and adjudicate the claims each one declared, and the chair synthesizes an **answer** — `Converged | Split | Insufficient` — never a review verdict. The two scales share no value, so a task run can never report `Ship it` and a review run can never report `Converged`. Task runs deliberately write nothing to the reliability ledger (rankings there measure concurrence, not defect confirmation) and say so on the surfaces that would otherwise look empty; a review run is byte-identical to before. Full reference: [docs/council.md § Task mode](./docs/council.md#task-mode---intent-task).
+
 ### Briefing templates (v4.5)
 
 `--template <name> --artifact <file>` (plus repeatable `--var k=v`) renders a `{{prompt}}`/`{{artifact}}`-style Markdown template before it's sent, on `start`/`fanout`/`council run` alike — templates live in `~/.config/amicus/templates/`, and a pack's `briefing.template` is how one reaches an MCP-invoked run (MCP has no template param of its own). `amicus template list|show` manage them; v4.5 ships one built-in, `review`. Full reference: [docs/usage.md § Briefing templates](./docs/usage.md#briefing-templates).
@@ -275,7 +280,7 @@ This opens a graphical wizard:
 | Step | What it does |
 |------|--------------|
 | **1. API Keys** | Enter keys for OpenRouter, Google, OpenAI, Anthropic, and/or DeepSeek. Each is validated live against the provider's API. Written to `~/.config/amicus/.env` with `0600` permissions. |
-| **2. Default Model** | Pick your go-to model from a searchable live picker (backed by the catalog). Used whenever you omit `--model`. |
+| **2. Default Model** | Pick your go-to model from a searchable live picker (backed by the catalog) — each provider card also lets you drill down to a specific model instead of just the family default. Used whenever you omit `--model`. |
 | **3. Model Routing** | Decide which provider serves each model — e.g. route Gemini through a direct Google key and everything else through OpenRouter. |
 | **4. Review** | Confirm the configuration before saving. |
 
@@ -407,7 +412,7 @@ When you don't need a full council — just one other model's take — fork a co
 |---------|--------------|
 | `amicus start` | Launch a new session (interactive or `--no-ui`). |
 | `amicus fanout` | Run N models on the same prompt in parallel (headless). |
-| `amicus list` | Show previous sessions — shows the `--tag <t>` set at launch, `--search <q>` filters, `--limit <n>` caps the rows, `--all` spans every known project. |
+| `amicus list` | Show previous sessions — shows the `--tag <t>` set at launch, `--search <q>` filters, `--limit <n>` caps the rows, `--all` spans every known project (council runs: current project only — the CLI says so in-table). |
 | `amicus resume` | Reopen a previous session with full history. |
 | `amicus continue` | Start a new session building on a previous one. |
 | `amicus read` | Output a session's summary / conversation / metadata. |
@@ -450,13 +455,13 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.8.0",
+  "version": "4.9.0",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
 ```
 
-`amicus list --status` accepts `running`, `complete`, `error`, `timed-out`, `aborted`, `crashed`, `idle-timeout`. Rows carry a `TAG` column (set at launch with `--tag <t>`); `--search <q>` filters by id/tag/briefing substring, `--limit <n>` caps the row count (0 = unlimited), and `--all` lists across every known project. Full field-by-field docs (a running session's `messages`/`STALLED` reporting, wave-ID status shape, etc.) are in [docs/usage.md](./docs/usage.md).
+`amicus list --status` accepts `running`, `complete`, `error`, `timed-out`, `aborted`, `crashed`, `idle-timeout`. Rows carry a `TAG` column (set at launch with `--tag <t>`); `--search <q>` filters by id/tag/briefing substring, `--limit <n>` caps the row count (0 = unlimited), and `--all` lists across every known project (council runs stay scoped to the current project — no cross-project index exists, and the listing discloses that). Full field-by-field docs (a running session's `messages`/`STALLED` reporting, wave-ID status shape, etc.) are in [docs/usage.md](./docs/usage.md).
 
 ---
 

package/docs/CITATIONS.md

@@ -107,8 +107,16 @@ form; do not silently renumber it.
 
 ## The burn-down list
 
-`CONFIG.grandfathered` in `scripts/check-citations.js` holds citations that were
-already stale when the gate landed, so the gate could block from day one instead
-of shipping advisory. Every entry rotted when v4.8 PR0 split its target. Fix the
-citation, then **delete the entry** — a test asserts every entry still names a
-real citation, so the list cannot quietly accumulate dead weight.
+`CONFIG.grandfathered` in `scripts/check-citations.js` is the escape hatch for
+citations already stale when a gate change lands, so the gate can block from day
+one instead of shipping advisory. **It is empty, and should stay that way.** Fix
+the citation, then **delete the entry** — a test asserts every entry still names
+a real citation, so the list cannot quietly accumulate dead weight.
+
+The original eight were burned down in one pass. **Four were born stale** — wrong
+in the commit that wrote them, not rotted by later drift: three reused a line
+number from a split that had already landed (one from a split made in that very
+commit), and one wrote a symbol name with `.js` appended as if it were a path.
+The other four were ordinary rot from the PR0/PR5c splits. A gate that catches
+only decay would never have caught the first four — which is the case for
+`file.js :: symbol` being the default form.