amicus 4.8.1 → 4.9.0

package/src/utils/untrusted-fence.js

@@ -17,6 +17,16 @@
  * stays intact inside the fence. It must NOT be applied to CLI --json stdout
  * (the byte-parseable programmatic channel) or amicus_read mode=metadata —
  * structured data a caller parses, where wrapping would break the contract.
+ *
+ * This module ALSO hosts the OUTBOUND family's tag neutralizer
+ * (`defangOutboundFenceTags`, PR #200 tails B2/C2; close tags only until PR
+ * #206 round 3 B3b took it to open tags too). It lives here rather than
+ * beside either outbound builder because there are two of them — the council
+ * briefing tail (src/council/briefings-stage2-task.js :: fenceBriefing) and the
+ * parent-conversation section (src/prompt-builder.js :: buildContextSection) —
+ * in two directories that do not import each other, and this is the one module
+ * in the tree whose subject is fences and which both can reach without either
+ * depending on the other.
  */
 'use strict';
 
@@ -36,4 +46,104 @@ ${body}
 </untrusted_sidecar_output>`;
 }
 
-module.exports = { fenceSidecarOutput };
+/**
+ * Every OUTBOUND house fence's tag name. ONE list, deliberately: both surfaces
+ * run the neutralizer over their whole vocabulary, not just their own tag, so a
+ * fence added to the family is covered everywhere by editing this array — and a
+ * body that carries the SIBLING surface's tags (either end, since round 3)
+ * cannot smuggle them through the surface that does not happen to emit them.
+ * @see src/council/briefings-stage2-task.js :: BRIEFING_FENCE_CLOSE
+ * @see src/prompt-builder.js :: buildContextSection
+ */
+const OUTBOUND_FENCE_TAGS = ['council_briefing', 'previous_conversation'];
+
+/**
+ * `</council_briefing>` / `</previous_conversation>`, case-insensitively and
+ * tolerating whitespace ANYWHERE inside the angle brackets — including between
+ * the `<` and the `/` (round 3, C1: the round-2 pattern required those two to
+ * be adjacent, so `< /council_briefing>` rode through untouched, and a reading
+ * model honours that spelling exactly as readily as the tight one). The slash
+ * and its surrounding space are INSIDE the captured group, so the author's own
+ * spelling survives into the defanged form and nothing is hidden.
+ * ⚠️ Module-level and `g`-flagged: safe ONLY because its sole use is
+ * `String#replace`, which resets `lastIndex` around the call. A `.test()` on
+ * this object would carry `lastIndex` between calls and skip matches — build a
+ * fresh regex if one is ever needed. Same warning for the OPEN pattern below.
+ */
+const OUTBOUND_FENCE_CLOSE_RE =
+  new RegExp(`<(\\s*\\/\\s*(?:${OUTBOUND_FENCE_TAGS.join('|')})\\s*)>`, 'gi');
+
+/**
+ * The same families' OPEN tags, attributes and all (round 3, B3b).
+ *
+ * `\\b` after the name is what keeps this off tags that merely START with a
+ * house name — `<council_briefingx>` is somebody else's markup — and
+ * `[^<>]*` carries whatever attributes the author wrote through into the
+ * escaped form. It cannot match a CLOSE tag: `\\s*` does not consume the `/`.
+ */
+const OUTBOUND_FENCE_OPEN_RE =
+  new RegExp(`<(\\s*(?:${OUTBOUND_FENCE_TAGS.join('|')})\\b[^<>]*)>`, 'gi');
+
+/**
+ * Neutralize any outbound house fence tag inside a body about to be embedded in
+ * one (PR #200 tails B2/C2; round 3 B3b/C1 widened it from closes to both ends).
+ *
+ * Without this, untrusted text that contains the close tag ends the fence early
+ * in the reading model's eyes and everything after it reads as the engine
+ * speaking — the fence's entire purpose, undone by a string the author types.
+ * The replacement is an entity escape (`&lt;/council_briefing&gt;`), so the
+ * text stays legible as what the author wrote while no longer being a tag:
+ * nothing is deleted and nothing is silently swallowed.
+ *
+ * OPEN TAGS TOO, and round 2's reason for skipping them was wrong (B3b). That
+ * reason — "an open tag inside a fence cannot escape it" — holds for a STRICT
+ * parser and fails for the reader this fence is actually addressed to. A model
+ * that balances tags reads the attacker's `<council_briefing …>` and the
+ * engine's REAL `</council_briefing>` as one pair: the attacker's tag gets the
+ * close, and the engine's fence is left unterminated. Everything after the
+ * attacker's open reads as fenced material, and everything the ENGINE writes
+ * after the real close reads as still inside a fence. That is the same escape
+ * one tag along. MEASURED before widening (W12, re-verified round 3): nothing
+ * in the tree PARSES these tags — the only occurrences outside test assertions
+ * are the two producers' own literals — so escaping opens breaks no consumer.
+ *
+ * ⚠️ THE BOUNDARY IS SOFT, and this is a disclosure, not a caveat. An entity
+ * escape is a convention about how a READING MODEL should interpret bytes, not
+ * a parser guarantee: some models decode `&lt;/council_briefing&gt;` back to
+ * the tag while reading, and a model that does is not fenced by this. What this
+ * buys is defense in depth — it removes the LITERAL tag, so the escape stops
+ * being free and starts depending on a decoding step the attacker does not
+ * control. The load-bearing protection is still the preamble both fences carry
+ * (the enclosed text is reference material, not instructions); this hardens it,
+ * and does not replace it. Deleting the tag outright would be a stronger
+ * boundary and a worse product — the reader would silently lose text the author
+ * wrote, which is the failure the whole fence exists to avoid.
+ *
+ * Total over non-strings (returns its argument unchanged): callers hand it
+ * whatever they were given, and a missing body must never be a throw inside a
+ * prompt builder.
+ * @param {string} text the untrusted body about to be fenced
+ * @returns {string} the same bytes when it carries no house tag
+ */
+function defangOutboundFenceTags(text) {
+  if (typeof text !== 'string') { return text; }
+  // Closes first: once a close is escaped its `<` is gone, so the OPEN pattern
+  // cannot see it. (It could not match one anyway — see the pattern's note —
+  // but the order makes that independent of the pattern staying that way.)
+  return text
+    .replace(OUTBOUND_FENCE_CLOSE_RE, '&lt;$1&gt;')
+    .replace(OUTBOUND_FENCE_OPEN_RE, '&lt;$1&gt;');
+}
+
+// FUNCTIONS FIRST, constant last — the PR 201 round-2 workaround for
+// `scripts/generate-docs-helpers.js :: extractExports`, which renders EVERY
+// export as `name()` and keeps only the first five. Ordering conceals a
+// constant behind that cap; MEASURED here, it cannot, because this module
+// exports three names and the cap never fires. So CLAUDE.md's Key Exports cell
+// reads `OUTBOUND_FENCE_TAGS()` for what is an array — a known-defect instance
+// of the generator bug, not a claim this module makes, and the second one below
+// the workaround's floor after `utils/text-sanitize.js`. It goes away with the
+// generator ruling filed in BACKLOG.md; padding the export list to five to hide
+// it would not be a fix, and the list itself must stay exported —
+// tests/utils/outbound-fence-defang.test.js reads it as the LIVE vocabulary.
+module.exports = { fenceSidecarOutput, defangOutboundFenceTags, OUTBOUND_FENCE_TAGS };

package/src/workspace/fold-format.js

@@ -5,10 +5,11 @@
  * (src/headless.js `formatFoldOutput`, exported from src/headless.js and
  * re-exported from src/index.js) — byte-for-byte the same **7-line** head:
  * marker, Model, Session, Client, CWD, Mode, `---`. ⚠️ v4.4.1 DOC-5: this said
- * "8-line" for two releases. Line 8 (`VERDICT:`) is council's OWN addition and
+ * "8-line" for two releases. Line 8 (the terminal line — `VERDICT:` on a review
+ * run, `ANSWER:` on a task one since v4.9 W8) is council's OWN addition and
  * has no counterpart in formatFoldOutput, whose 8th element is the summary
  * body. Only the first 7 lines are the shared contract; anyone changing the
- * shared format must sync those and leave `VERDICT:` alone.
+ * shared format must sync those and leave the terminal line alone.
  * src/headless.js is the SOURCE OF TRUTH; keep the head in sync with it.
  * (Line numbers deliberately omitted — the previous `:775-789`/`:797` citation
  * had drifted by ~500 lines.) The duplication is deliberate:
@@ -24,7 +25,7 @@
  * The chair body is UNTRUSTED model text: it passes through stripFoldMarkers
  * before embedding, so chair prose containing a marker can never truncate or
  * spoof the fold (the exact hazard the nonce closure exists for).
- * Degradation mirrors the engine's ladder: no chair → VERDICT: none + tally
+ * Degradation mirrors the engine's ladder: no chair → `<terminal>: none` + tally
  * summary; pre-tally → stage/status summary. Never blocked, always labeled.
  */
 'use strict';
@@ -63,14 +64,34 @@ function buildFoldText(o) {
   // amicus_verdict MCP path types overallVerdict as a bare z.string().nullable()
   // — mcp-tools.js :: amicus_verdict), so a multi-line or marker-bearing value
   // must never reach the head verbatim: an embedded '\n' would shift every line below
-  // VERDICT: (a raw string containing '\n' becomes several elements once the
+  // the terminal line (a raw string containing '\n' becomes several elements once the
   // head array is '\n'-joined), and an embedded marker could spoof the fold.
-  // Safe on the shipped engine path (parseChairVerdict returns a canonical
-  // CHAIR_VERDICTS phrase) — this is defense-in-depth, not a fix for a real
+  // Safe on the shipped engine path (`run-chair.js :: runChair` parses the chair's
+  // terminal line with `parse-stage2.js :: parseChairTerminal`, which returns a
+  // canonical phrase of the run's OWN scale — CHAIR_VERDICTS on a review run,
+  // CHAIR_ANSWERS on a task one) — this is defense-in-depth, not a fix for a real
   // producer.
+  // ⚠️ DE-ROT (v4.9 W8): this said "parseChairVerdict returns a canonical
+  // CHAIR_VERDICTS phrase", true only until W7 added the second scale — after
+  // which it named the wrong parser for every task run.
   const overall = verdict && verdict.overallVerdict
     ? stripFoldMarkers(String(verdict.overallVerdict)).replace(/[\r\n]+/g, ' ').trim()
     : null;
+  // v4.9 W8: the terminal line names the SCALE its phrase belongs to. The two
+  // scales are disjoint by pinned construction (tests/council/chair-scale-drift.test.js),
+  // so labelling a CHAIR_ANSWERS phrase `VERDICT:` asserts a scale it is not on.
+  // `intent` is emit-when-'task' (verdict.js :: buildVerdict, the W5 ruling), so
+  // absence — and an explicit 'review' — keep the review fold byte-identical.
+  // ⚠️ v4.9 fix round 2 (council B2): `run.intent` is the SECOND carrier, and it
+  // is what covers the DEGRADED fold — the one a user reaches for precisely when
+  // a task run went wrong. With no verdict.json (or a parse-failed one) there is
+  // no verdict.intent, and the fold headed `VERDICT: none` on a run that was
+  // never on that scale. `o.run` is the parsed run.json, which checkpoints
+  // `intent: 'task'` at start (src/council/run.js :: runCouncil):
+  // electron/ipc-workspace.js passes `run: detail.run` and run-detail.js ::
+  // getRunDetail reads it straight from `<runDir>/run.json`.
+  // PR #200 round-5 B3: parens on the whole disjunction — behaviour-identical.
+  const terminalLabel = ((verdict && verdict.intent === 'task') || run.intent === 'task') ? 'ANSWER' : 'VERDICT';
   const tierCounts = (verdict && verdict.tierCounts) || (tally && tally.tierCounts) || null;
   const cost = run.usage && run.usage.cost ? run.usage.cost : null;
 
@@ -82,7 +103,7 @@ function buildFoldText(o) {
     `CWD: ${o.project}`,
     'Mode: council',
     '---',
-    `VERDICT: ${overall || 'none'}`,
+    `${terminalLabel}: ${overall || 'none'}`,
   ];
   if (tierCounts) {
     head.push(tierLine(tierCounts));

package/src/workspace/live-normalize.js

@@ -50,7 +50,8 @@ function seatOf(leg) {
     model: leg.model || null,
     modelInput: leg.modelInput || null,
     role: leg.role || null,
-    // ⚠️ v4.8 R5: the leg's seat id, and the reason live-dead-seats.js:209's
+    // ⚠️ v4.8 R5: the leg's seat id, and the reason live-dead-seats.js ::
+    // deadSeats' `if (s.seat)` suppression arm's
     // `if (s.seat)` arm is reachable at all. Null on a unique-alias bench, so the
     // guard there stays load-bearing — see the comment at that line.
     seat: leg.seat || null,

package/src/workspace/matrix-model.js

@@ -15,7 +15,8 @@
  * unconditionally (src/council/tally.js :: tally) — it is never a real source for
  * either the override badge or the post-override tier. Only `buildVerdict`
  * materializes `{from,to,reason}` and rewrites `tier` to `tierOverride.to`
- * (src/council/verdict.js:122-126). So both fields are joined in from
+ * (src/council/verdict.js :: buildVerdict's `findings` map — re-anchored BY SYMBOL at v4.9 W9,
+ * which shifted the old `:128-132`). So both fields are joined in from
  * verdict.findings[] by `id`; when verdict is absent/unparseable (caller
  * passes null/undefined, or a finding has no verdict-side counterpart) the
  * row falls back to tally's own (pre-override) tier and renders no badge.
@@ -183,7 +184,10 @@ function buildMatrixModel(tally, labelMap, verdict) {
       // ⚠️ DE-ROT (F29): v4.1 decorates tally.json findings in place with
       // `debate: {action, previousTier}` (src/council/debate.js :: decorateRecord; action ∈
       // defended|amended|withdrawn|no-response) and verdict.json carries it through
-      // (src/council/verdict.js:43). Consumed by electron/workspace-ui/workspace-matrix.js's
+      // (src/council/verdict.js :: buildVerdict's `if (f.debate)` carry-through — the old
+      // `:43` was ALREADY rotted onto summarizeSeatLoss, which has since left verdict.js
+      // altogether; re-anchored by symbol, not re-numbered). Consumed by
+      // electron/workspace-ui/workspace-matrix.js's
       // renderMatrix, which renders a `.debate-badge` in the tier cell (alongside the
       // thin/tierOverride badges) so a withdrawn/amended/defended/no-response finding never
       // renders as an ordinary live row. Absent on non-debate runs, hence `|| null`.

package/src/workspace/run-detail.js

@@ -124,7 +124,7 @@ function costPanel(run, tally) {
 
 // ⚠️ PRE-FLIGHT (P3): F04's correction is implemented here rather than left as prose.
 // VERIFIED on shipped main (Task 0): `finalize(exitCode, error)` writes `error: error || null`
-// (run-finalize.js :: writeRunTerminal), and `return finalize(degraded.value ? 2 : 0)` (run.js:279) is the ONLY
+// (run-finalize.js :: writeRunTerminal), and `return finalize(degraded.value ? 2 : 0)` (run.js:294) is the ONLY
 // exit-2 path — it passes NO error. Every error-bearing call is `finalize(1, …)`. So on a
 // `status:'partial'` run — precisely the run this panel exists to explain — `run.error` is
 // GUARANTEED null, and the old one-line formula rendered "undefined: undefined".
@@ -142,13 +142,32 @@ function degradedReason(run) {
   return null;
 }
 
+// v4.9 W8 T-B: `intent` rides this payload so the renderer can label a task run's
+// chip `ANSWER:` (electron/workspace-ui/workspace-matrix.js :: renderVerdict is a
+// plain browser script and cannot require() src/, so a fork key it cannot read is
+// a fork it cannot make). Unlike verdict.json — emit-when-'task' per the W5 ruling,
+// because that artifact has a byte-identity contract — this is an in-memory IPC
+// model whose literal is CLOSED and always materializes every key with a default,
+// so `intent` is materialized both ways and defaults to 'review'. The renderer
+// still treats an ABSENT key as review: pre-v4.9 payloads carry none.
+// ⚠️ v4.9 fix round 2 (council B2): sourced from `run` as well as `verdict`.
+// Reading `verdict.intent` ALONE meant the two panels that exist to explain a
+// broken run could not label it: on the narrow leg where a task run exits before
+// the verdict write — or leaves a truncated one — there is no verdict.intent to
+// read, and the panel defaulted to review, so the Workspace chip said "no chair
+// verdict" about a run that was never on that scale. `run.json` checkpoints
+// `intent: 'task'` at start (run.js :: runCouncil) and `run` is already this
+// function's first parameter, so the honest source costs nothing to reach.
 function verdictPanel(run, verdict) {
   const reason = degradedReason(run);
+  // PR #200 round-5 B3: parens on the whole disjunction — behaviour-identical.
+  const intent = ((verdict && verdict.intent === 'task') || (run && run.intent === 'task')) ? 'task' : 'review';
   if (!verdict || verdict.parseError) {
-    return { present: false, overallVerdict: null, tierCounts: null, streetCred: [], decisions: [], reason };
+    return { present: false, overallVerdict: null, tierCounts: null, streetCred: [], decisions: [], reason, intent };
   }
   return {
     present: true,
+    intent,
     overallVerdict: verdict.overallVerdict === undefined ? null : verdict.overallVerdict,
     tierCounts: verdict.tierCounts || null,
     streetCred: Array.isArray(verdict.streetCred) ? verdict.streetCred : [],
@@ -233,11 +252,18 @@ function getRunDetail(project, runId) {
       // of a copy of the question makes that divergence unrepresentable.
       seatSpace: isSeatTable(run.seats),
       // ⚠️ Fix-wave 3 (council-3 C2): seats[] is PRESENT but unusable, so the run silently
-      // lost per-seat behaviour — two seats on one model become indistinguishable in every
-      // panel. isSeatTable fails WHOLE (one malformed entry drops the entire table), which
-      // is the fail-safe direction but is exactly the correct-but-silent degrade the product
-      // principle rejects. Emitted here, beside the predicate that decides it, rather than
-      // re-derived renderer-side; workspace-app.js's renderBanners is its only consumer.
+      // lost per-seat ARTIFACT NAMING — two seats on one model become indistinguishable in
+      // the reviews/judges/re-vote panels, whose roster this flag sends back to `bench`
+      // (workspace-lazy.js :: roster). isSeatTable fails WHOLE (one malformed entry drops the
+      // entire table), which is the fail-safe direction but is exactly the correct-but-silent
+      // degrade the product principle rejects. Emitted here, beside the predicate that decides
+      // it, rather than re-derived renderer-side; workspace-banners.js is its only consumer.
+      // ⚠️ "in every panel" — what this comment said until v4.9 W9 — was already FALSE when
+      // written, and W9's PR5b-1 measured it: `costPanel` above maps `tally.runStats`, whose
+      // `seat` is stamped from the in-memory seat at assembly (run-stats-entry.js ::
+      // buildRunStatsEntry), so the seats panel keeps one row per seat no matter what
+      // run.seats looks like. Ruling V15 discloses that split in the banner rather than
+      // forcing the seats panel down to `seatSpace` for uniformity.
       // NOT the same as `!seatSpace`: a run with no seats[] at all is a legacy run, not a
       // broken one, and must not be bannered.
       seatTableRejected: Array.isArray(run.seats) && run.seats.length > 0 && !isSeatTable(run.seats),

package/src/workspace/seat-space.js

@@ -75,18 +75,22 @@ function isSeatTable(seats) {
  * bound seat a `rebuttal-` an orphan may have written, re-arming RN-1 in the debate
  * namespace (MEASURED; the one regression this fix wave introduced). The question is:
  * does the note POSITIVELY PROVE the orphan did NOT write this kind? Exactly one such
- * proof exists. `orphanLegNote` has three call sites — run-stages.js:71 and :140 (Stage-1
- * and its retry) and run-stage2.js:110 (the -s2 judge wave) — and `data.waveId` separates
- * them EXACTLY, not heuristically: run-stage2.js:67/69/90 build it as `${runId}-s2` from
+ * proof exists. `orphanLegNote` has three call sites — two in run-stages.js :: runStage1
+ * (Stage-1's own bind and its retry pass; cited `:71 and :140` until the v4.9 W9 fix round
+ * moved a builder out of that function and both numbers rotted — anchored by SYMBOL now, per
+ * the anti-rot rule) and run-stage2.js :: bindStage2Seats (the -s2 judge wave) — and
+ * `data.waveId` separates them EXACTLY, not heuristically: run-stage2.js :: bindStage2Seats
+ * and the launch site in run-stage2.js :: runStage2 both build it as `${runId}-s2` from
  * the runId this run.json carries. A -s2 note says the leg BOUND in Stage 1, so its review
  * landed under a SEAT name: `review-<alias>.md` is provably not its. Nothing else is
  * provable, and the near misses are why:
  *   - a Stage-1 note exonerates NOTHING, not even judge-: that orphan is re-admitted to
- *     Stage 2 under a PLACEHOLDER seat (run-stage2.js:92-97) that `judgeSeatOf` filters out
- *     (:105-107), so its judge leg takes the alias branch too — and emits no -s2 note,
+ *     Stage 2 under a PLACEHOLDER seat that stage1-bind.js :: bindPaddedWave pads in and
+ *     drops from `judgeSeatOf` (called from run-stage2.js :: bindStage2Seats since the
+ *     v4.9 W2 split), so its judge leg takes the alias branch too — and emits no -s2 note,
  *     because it BOUND. Measured: run-stages.test.js :: "M2: the placeholder never becomes…".
  *   - rebuttal-/revote- are never exonerated: a debate leg whose raiser/judge key names no
- *     seat takes materializeDebate's alias branch (run-debate.js :: runDebate;
+ *     seat takes materializeDebate's alias branch (run-debate.js :: runDefenseWave;
  *     run-debate-revote.js :: runRevoteWave, `seat = seatOf.get(leg) || null`). A rebuttal
  *     leg's unbound raiser still has no note recording it. A revote leg's unbound judge
  *     SOMETIMES gets one, since v4.8 T5.1 (channel `seat-unbound`, run-debate-revote.js's