amicus 4.8.1 → 4.9.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.8.1",
+  "version": "4.9.1",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,322 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.1] - 2026-08-27
+
+*A silent provider failure, and the unservable model ids it produced.*
+
+A session on `deepseek` failed with `you passed deepseek-v4-flash-0731`. Tracing that one error
+found a chain: a provider fetch failed silently, the empty namespace it left behind was
+indistinguishable from "never fetched", and that ambiguity licensed the wizard to synthesise and
+persist a direct model id nothing serves.
+
+### Fixed
+
+- **Per-provider catalog fetch failures are reported instead of collapsing to `[]` (#209).**
+  `fetchAllModels()` returned a flat row array, so a provider whose fetch was REJECTED could not be
+  told apart from one that legitimately serves no models — all four failure modes (non-200, timeout,
+  network error, parse error) resolved to a bare `[]`, and the existing reporting fired only when
+  *every* provider returned nothing. A 401ing key silently zeroed that vendor's namespace and every
+  picker then offered gateway-only routes with no indication why. `fetchAllModelsDetailed()` now
+  carries `{rows, failures}`, the cache persists `providerFailures` alongside the rows they
+  describe, and `amicus models --check` prints
+  `PROVIDER FETCH FAILED: <provider> (HTTP 401)` (`--json` carries the array).
+  `fetchAllModels()` keeps its signature as a rows-only wrapper.
+- **A rejected namespace no longer yields a fabricated direct model id (#208).**
+  `classifyModel` returns `'unknown'` for an empty namespace because it could not distinguish
+  "never fetched" from "fetch rejected", and that licensed `directFormIfSafe` to strip the
+  `openrouter/` prefix and produce an id the direct API does not serve. Optimism is now suppressed
+  when *that vendor's* namespace fetch was rejected, and preserved when it was simply never
+  attempted. Threaded through the picker, the shortlist, both Electron wizard entry points and the
+  CLI setup path — the picker rebuilds its own `catalogInfo`, so without threading the guard was
+  live in unit tests and dead in production.
+- **The persistence path requires catalog evidence (#214).**
+  `toStorableRoute` — whose result is written straight into `config.aliases` and used to seed fresh
+  configs — decided direct-vs-gateway with no catalog evidence at all. It now routes through
+  `directFormIfSafe`, and `toLiveSeedAliases` stops discarding evidence it was already handed.
+- **Alias drift is computed against the same evidence the writer uses.**
+  `findDriftedStoredAliases` resolved its "current" value without `providerFailures`, so a rejected
+  namespace produced false drift whose suggested repair would have written back the very id #208
+  removed.
+- **Guards no longer depend on an optional argument.** `directFormIfSafe`/`directFormIfProven`
+  keyed both the `DIVERGENT_VENDORS` and namespace-rejection checks on a caller-supplied `vendor`
+  that the API marks optional, while the catalog check derived its own — so a caller using the
+  documented shape silently lost two of three guards. The vendor is now derived from the id when
+  omitted.
+- **The setup wizard keeps direct-first routing when the catalog is unavailable.** With no catalog,
+  quick picks fell back to raw `openrouter/…` routes, which Amicus treats as an explicit
+  force-OpenRouter literal — an offline setup would have pinned the user to the gateway
+  permanently.
+- **`pre-commit` no longer fails on a clone that has never stashed.** The hook gated its
+  lint-staged workaround on being inside a worktree; the real trigger is a missing `refs/stash`,
+  which is true of any fresh clone whose first commit precedes its first `git stash`.
+
+### Changed
+
+- **`toCanonicalDefault` is renamed `stripGatewayPrefix`** (`src/utils/curated-models.js`). The old
+  name read as the correct answer and three separate callers took it at its word and persisted ids
+  the direct API may not serve. It cannot be made evidence-taking — it *produces* the candidate
+  `classifyModel` checks — so the name now says what it is. Callers deriving an id that will be
+  called or stored must use `directFormIfSafe`/`directFormIfProven`. Internal utility, not a
+  documented API surface, but importers reaching into `src/utils/` will need the new name.
+- **Route canonicalisation for the setup wizard is decided in the main process.** The renderer
+  carried a hand-copy of `toCanonicalDefault` that had neither of the real primitive's guards; it is
+  deleted, and the safe form now ships to the page as data. Routing policy no longer reaches the
+  renderer at all.
+- **`gatewayOf(id)`** replaces three verbatim copies of the gateway-classification one-liner.
+- An ESLint rule now bans hand-rolled `openrouter/` prefix stripping outside an audited allowlist.
+- CI council bench: `qwen` moves from `qwen3.8-max` to `qwen3.8-27b` — same 1M context, ~4.8x
+  cheaper input. Bench-only; the shipped alias table is unchanged.
+
+## [4.9.0] - 2026-08-26
+
+*The council does new work.*
+
+### Added
+
+- **Task mode — the council stops being able only to critique (#134, #130, #146).**
+  `amicus council run --intent task`, or `intent: 'task'` on the `amicus_council_run` MCP tool,
+  points the whole pipeline at open-ended work instead of at a review. Every seat **produces the
+  deliverable** the briefing asks for — `briefings-task.js :: TASK_SEAT_ROLE` says it in as many
+  words, *"you are not reviewing the briefing, you are executing it"* — the Stage-2 judges rank
+  **which response best does the work** and adjudicate whether each declared claim holds, and the
+  chair synthesizes an **ANSWER**, never a verdict.
+  The two terminal scales are disjoint by construction: a review chair closes on
+  `Ship it | Fix these first | Fundamental rethink`
+  (`briefings-chair.js :: CHAIR_VERDICT_VALUES`, `parse-stage2.js :: CHAIR_VERDICTS`), a task chair
+  on `Converged | Split | Insufficient` (`briefings-chair-task.js :: CHAIR_ANSWER_VALUES`,
+  `parse-stage2.js :: CHAIR_ANSWERS`). They **share no value and no keyword** — `VERDICT:` and
+  `ANSWER:` — which is what lets each parser stay blind to the other's line, and it is
+  `parseChairTerminal(text, intent)` that picks between them. Each scale is spelled **five** times —
+  those two constants, the scale addendum, the chair repair prompt, and
+  `schemas/council-verdict.schema.json`'s `overallVerdict` enum, which now carries the review scale
+  followed by the task scale — and all five are drift-pinned together
+  (`tests/council/chair-scale-drift.test.js`, named mutant `ANSWERSCALEDRIFT`).
+  - **`intent` is emit-when-`task`, everywhere.** `review` is the default spelled out loud: both
+    transports strip it, and `run.js :: runCouncil` — a public door too — **normalizes** it to
+    absent (`delete`, never `= undefined`) rather than refusing it, so one input cannot mean two
+    things at two doors. Only a genuinely unknown value is `BAD_ARGS`. Nothing ever writes
+    `intent: "review"` onto `run.json`, `tally.json` or `verdict.json`, so every pre-v4.9 document
+    is already spelled correctly and no migration exists to need.
+  - **The Stage-1 contract does not fork.** The JSON skeleton, the
+    `blocker | major | minor | nit` enum and the required-non-empty `location` rule are review
+    mode's, verbatim; `findings.js` — one validator, one repair loop — changes by **zero executable
+    lines** (the only edits it took in this release are comments: a refreshed line citation, and the
+    empty-`findings[]` ruling now naming the task briefings' claims wording beside the review one).
+    Only the frame and the field glosses differ: in task mode `location` is the grounding
+    discipline, naming *what the claim rests on — a source, a computation, or the literal word
+    "assumption"*.
+  - **Intent selects the parser on the Stage-5 rebuild too**, where the run is long over and only
+    documents remain. Three carriers, because no one of them covers every leg — the record's own
+    `meta.intent`, `run.json`'s checkpoint, and the run folder's prior `verdict.json` — combined as
+    a **disjunction** (absence is no vote, not a vote for review). The two *document* reads carry the
+    same `!runId || doc.runId === runId` guard their siblings do — waived only when the *record* names
+    no run and never when the *document* does not. Without that guard a stale or foreign document in
+    the folder hands the rebuild another run's intent, which selects the chair parser. An
+    `overallVerdict` carried off the **wrong** scale is not trusted: it fails
+    `scale.includes(...)` and falls through to re-parse `chair-output.md`.
+  - **The renderers say what the run actually produced.** The primary heading is `## Answer summary`
+    on a task run and the exact old `## Verdict summary` on a review run; the tier table carries
+    *"Tiers report peer concurrence, never verification."* directly under the counts a skimmer
+    reads — task runs only, forked in **both** renderers and pinned separately per renderer so
+    neither can regress silently (mutants `SUMMARYLABEL`, `QUALIFIERDROP`). The fold
+    (`workspace/fold-format.js`) and the Workspace chip
+    (`electron/workspace-ui/workspace-matrix.js`) label the terminal line `ANSWER:` or `VERDICT:`
+    off the same key, matching on `=== 'task'` so a pre-v4.9 payload with no `intent` reads as
+    review instead of relabelling every legacy run. The chair's own briefing carries the caveat the
+    tier table cannot: *"Peer agreement on a claim is CONCURRENCE, not verification — models
+    correlate on priors."*
+  - **Task runs write zero reliability rows**, at two gates — `run-finish.js` (the engine's own
+    append) and `cli-handlers-council.js :: runTally` (the hand-assembled path) — and `council tally`
+    now **refuses** a `meta.intent` that is neither spelling rather than letting a near-miss
+    (`'Task'`) slide into the ledger, whatever `--no-ledger` says. The skip is **announced and
+    non-degrading**: a `Note:` on the new `ledger-skipped` channel, `kind: 'info'` — a third kind
+    beside `degrade`/`heal` that the degrade sink is structurally unable to flip `degraded.value`
+    on. ⚠️ It is emitted where it is *load-bearing*, not on every task run: the chair-fallback
+    promotion arm, which draws on ledger history a task run never fed. That arm is reached at most
+    once per `runChair`, and `runChair` runs once per run, so "announced once" is structural rather
+    than a flag's promise. `kind: 'info'` records get their own **Notes:** list in the report and
+    are kept out of the `## What was lost` heading — an announcement is not a loss.
+  - **`amicus council stats` on an empty ledger explains itself.** A fresh install and a task-only
+    install used to render the same blank table; the surface now names where rows come from
+    (*"reliability history comes from review runs; task runs never write rows here"*) rather than
+    asserting which of the two states the reader is in — an earlier wording claimed the latter and
+    was false on every fresh install.
+  - **`--claude-review` is refused with `--intent task`** — a file review is review machinery and
+    has no task-mode meaning.
+  - **Review runs are byte-identical *under the intent fork*.** Not "unchanged as far as we know":
+    the review path composes through the same dispatcher and is pinned at key *and* byte level, and
+    both report `.snap` documents are untouched by this release. Scoped deliberately — task mode
+    changes nothing a review run emits; two *other* items in this release do, and say so where they
+    land (the repair-attempt `runStats` conformance value, and the `tally-input.json` debate-row key
+    order the builder unification moves into agreement with `tally.json`).
+  - Limitations, ruled and recorded rather than discovered later: **one intent per run** (no mixed
+    bench), intent is **not pack-settable** (nothing in `src/pack/` reads it), and a task run builds
+    no reliability history by design. #130's *detector* half — the `location` heuristic that would
+    emit a divergence **observation** into `degrades[]` — is deliberately not in this release; what
+    ships is the declaration that removes its root cause, since the hard-coded review frame every
+    seat used to receive was #130's mechanical cause and #134's blocker at once.
+
+- **The engine speaks for itself (#133, pieces 2 and 3).** A `NO_OUTPUT_BACKSTOP` death report no
+  longer stops at what the deadline observed — it quotes **the engine's own newest ERROR line for
+  that session**, appended as ` — engine log: <excerpt>`. Bounded read, both log schemes,
+  boundary-anchored session matching (a line whose structural session field names someone else is
+  skipped even when our id appears elsewhere on it), and a **union across every candidate log
+  directory that exists**, not the first one — the dirs are alternative homes for the same engine's
+  logs, so a stale `$XDG_DATA_HOME` or an empty dir left by a previous install would otherwise
+  shadow the dir holding the answer. A matching line whose message part is empty keeps the walk
+  going instead of ending the file's scan, because the real failure and a terse message-less
+  teardown line are typically neighbours.
+  One lookup's scan is memoized per `fs` implementation for 10 s so a whole wave of seats shares it.
+  ⚠️ **That reuse serves hits only.** A **miss** re-lists and re-reads before it is believed, and
+  drops the live slot behind it, because the engine writes a leg's error *when that leg dies* —
+  possibly after the cached scan, possibly into a file it has only just rolled over to, so an
+  absence in a previous call's listing is not an absence on disk. The accepted residual runs the
+  other way and is stated rather than buried: a warm hit serves the newest line *as of when the slot
+  was built*, so the TTL bounds the missed window (≤10 s of new lines) and bounds nothing about the
+  **age** of what is served — a minutes-old genuine error for this leg can be quoted while a fatal
+  line written two seconds ago sits unread. Quoting a true older diagnostic is the trade; silence
+  while the cause sits on disk is the failure this module exists to end.
+  Where the answering server's version differs from the running install's engine, the report appends
+  ` (engine skew: server <a> ≠ installed <b>)` — tracked per server, refreshed on every session
+  create, with a remedy line that names the honest action and says why `doctor` cannot see this
+  class. Everything here is best-effort: every path returns `null` rather than throwing, because a
+  log read must never break a leg's death report. **#133 closes.**
+
+- **TTFT probe — probe, never derive (R12).** `ttftMs` is the elapsed time to the first
+  **substantive** tick, measured off the no-output backstop's *own* predicate. The distinction is
+  load-bearing and the plan's prose named the wrong one: `progressed` includes the empty assistant
+  placeholder OpenCode mints on prompt **acceptance**, so keying on it would stamp a
+  time-to-first-token on a leg that never produced a token. The probe and the backstop tick read one
+  shared `substantiveActivity` constant, and mutant `PROGRESSEDTWIN` pins the single fixture where
+  the two predicates disagree. It rides result docs, leg patches and `runStats` rows emit-when-set,
+  behind one validity rule — `utils/ttft.js :: isMeasuredTtft`, imported by three of the four gates
+  and hand-spelled by the fourth, `council/run-stats-entry.js`, which is pinned require-free (the
+  two spellings are held in step structurally, and a fifth site cannot appear unnoticed) — so an
+  unmeasured value is **dropped at the emit gate, never clamped**, and a leg with no measurement is
+  byte-identical to a pre-v4.9 one. The per-model backstop *derivation* deliberately waits for observations to derive
+  from (#135/#129 record).
+
+- **Alias-shadow warning (#135 C5 / #129's own side observation).** One notice per run when a
+  user-config alias **shadows** a curated alias with a different id — because everything keyed on
+  the alias *name* (per-model operating notes, a bench a workflow spells, a council preset) then
+  quietly describes a model the alias no longer resolves to, and by the time `resolveModel` sees an
+  id the two sources have already collapsed into one string. Compared in **canonical form**, so a
+  gateway spelling of the same id stays silent (mutant `GATEWAYFORM`). Diagnosis only: it resolves
+  nothing, changes no id, no exit code and no artifact — a local override winning is the documented
+  contract; this just says so out loud.
+  Wired at three measured sites, and the third exists because of a measured surface gap:
+  `cli-council-run-bench.js :: resolveBench` is the one bench-resolution helper **both** council
+  transports execute (bench, chair and critic all inspected there), but the council child's stderr
+  is not a pipe the MCP server reads — it is an fd on `<runDir>/debug.log` — so from that site alone
+  an MCP caller would have to open a log file to find the notice. `mcp-council-bench.js ::
+  auditBenchAliases` therefore writes it into the **tool result's notices array**, a different
+  surface rather than a second copy: the child still writes its line to `debug.log`, the parent
+  writes its own to the tool result, and no single surface shows it twice. The third site is
+  `amicus models --check`, the one call that passes no name list. Every third-party fragment the
+  notice quotes rides the house sanitizer (mutants `NOTICERAW`, `MESSAGERAW`, `THROWNRAW`), and the
+  stderr writer is armed against a closed pipe (`STREAMFATAL`, `STREAMDEAF`).
+
+- **`amicus list` finally shows council runs.** `amicus_list` has merged them since v4.0 §8; the
+  CLI never did, so a council launched from the terminal was invisible **to the terminal** —
+  `amicus list` reported *"No amicus sessions found."* in a project whose only work was a council.
+  The same enumerator now feeds both surfaces through `src/sidecar/list-council.js`: the MODEL cell
+  carries the live stage as `council(<stage>)`, mirroring the wave row's `wave(N legs)`, width-capped
+  so it can never butt against the STATUS column; `--search` reaches council material on both
+  surfaces. **Scope is stated rather than silent:** only the current project's council runs are
+  merged, `--all` included — council runs are found through per-project pointer files and there is
+  no cross-project council index to walk — so the human listing prints that disclosure, naming no
+  remedy because there is no flag that widens it. A merge that fails now **says so, with the cause**
+  (sanitized), instead of dropping every council row into output indistinguishable from a project
+  that has none.
+
+- **The Workspace dead-seat surface — an unbound seat stops being invisible (SI-02, R4).**
+  `deriveSeatLoss` and both Workspace consumers now admit the `seat-unbound` family behind **one
+  retry-family gate**, because `seat-unbound` is a shared channel — orphan-leg notes, re-vote
+  refusals and Stage-2 judge notes ride it too, and each is pinned *excluded* in every consumer.
+  The two LOSS reads spell that gate identically (`(retryWaveId || firstFailure) && (seatId ||
+  seat)`); the RETRIED read in `workspace-seats.js` is deliberately **narrower** — `retryWaveId`
+  alone, since a never-attempted seat carries a `firstFailure` and badging it *retried* would be
+  false. One loss rule, one narrowing, both pinned (mutants `SKIPRETRIED-A`/`-B`, one per direction
+  the widening could come back) rather than left to drift. The producer half was one line: the partial arm emits a seat id
+  beside the alias-valued seat, `null` for a slot it could not identify and never the alias.
+  The critic path keys on seat identity where the record and the run can both spell it, so a dead
+  bench twin beside a live critic twin renders one correctly-labelled row — it used to render
+  **nothing at all**, the silent 0-row erasure this project's product principle rates as severely as
+  a crash — and a both-dead pair renders two rows with one critic label. The known-wrong pins were
+  **flipped, not renamed**. The third street-cred renderer joins its seat-keyed siblings, and its
+  stated precondition was **measured false and struck rather than satisfied**: `labelOf` never
+  needed a seat id, and mutant `BLINDSEATLEAK` pins that the literally-planned spelling would have
+  leaked one into a blind render. The `seatTableRejected` banner now discloses the seats-vs-artifacts
+  document split in wording that was measured before it was written — the first draft's sentence
+  named the cost panel as a seat surface, which it is not, and would have shipped false.
+
+### Fixed
+
+- **W1's nine small repairs**, one wave, disjoint files, each TDD'd or pinned: the second-opinion
+  Stage-4 Confirmed gloss gains the lone-corroborating-peer case in both presentation headings;
+  `fmtProbeLine`'s silent parenthetical stops asserting endpoint acceptance and says only
+  *"(no output within the probe window)"*; the setup wizard's embedded alias tables are seeded
+  null-prototype **on the far side of the parse**, sibling tables and the `__proto__` alias-name
+  chain included; `MAX_CATALOG_AGE_MS` retires three copies to one exported source; repair-attempt
+  `runStats` rows stamp the **measured** outcome (refined twice by councils — the flat literal
+  mislabeled successful repairs, and the ch4 chair push had silently defaulted `clean`);
+  `KNOWN_VARIABLES` is single-sourced so validation and rendering derive from one exported set,
+  drift-tested — which satisfies the T3-m2 hard gate that composition's `{{input}}` was waiting on;
+  the MCP test-client timer leaks behind the standing *"Jest did not exit"* warning class are closed
+  in three suites (six open handles → zero, measured); a bare-id `model_not_found` carries the
+  doctor-repair hint when the OpenRouter twin classifies valid; and the setup TOCTOU is closed
+  **structurally** by consuming the same catalog snapshot the offer was built from — re-ruled twice
+  into per-window, session-scoped, read-without-consume offer sessions.
+- **The outbound fences neutralize both tag ends.** `utils/untrusted-fence.js ::
+  defangOutboundFenceTags` escapes open *and* close tags for the whole house fence vocabulary over
+  both outbound surfaces — the council briefing tail and the parent-conversation section — so a body
+  carrying the **sibling** surface's tags cannot smuggle them through the surface that does not
+  happen to emit them (mutants `CTXFENCEBREAKOUT`, `BRIEFFENCEBREAKOUT`). ⚠️ Stated as a disclosure,
+  not a caveat: an entity escape is a convention about how a reading model interprets bytes, not a
+  parser guarantee. This is defense in depth — it removes the literal tag so the escape stops being
+  free — and the load-bearing protection is still the preamble both fences carry.
+- **Curated pins move to the generation the bench actually runs** — `kimi` → `kimi-k3`, `qwen` →
+  `qwen3.8-max`, `glm` → `glm-5.3`. Not cosmetic: the review reproduced the standing alias-shadow
+  line the stale `glm` pin would have printed on every CI council run. Every old-id hit in the suite
+  was classified; no live pin of the old generation remains.
+
+### Internal
+
+- **The `runStats` builders unify (PR1F-2 closes).** Debate's `mk`, the re-vote `legRow` and the
+  Claude row fold into `buildRunStatsEntry`, so every non-primary row shares one key order, one
+  set of defaults, and one emit-when-set rule. (What the fold does **not** buy: propagation —
+  `mk` passes a synthetic five-field leg, so entry-param fields and future leg-sourced fields
+  still require widening `mk` itself; the widening is a filed candidate.) Done by measurement,
+  because every pre-existing pin proved
+  order-insensitive: 21 byte-order goldens were written **before** any fold (23 in the suite
+  now, after two post-fold additions), and mutant
+  `UNIFYDRIFT-mk` reddens exactly one test in the whole repo — the golden. A 137-invocation status
+  census showed the divergent `'unknown'` default **never fires and structurally cannot**, so it was
+  deleted as measured-dead rather than chosen between. ⚠️ The filing's own blast-radius claim was
+  **corrected** rather than inherited: `run.json` carries no `runStats`, and `tally.json`/
+  `verdict.json` were *already* in the entry's key order via tally's allowlist re-projection — the
+  fold moves `tally-input.json` **into** agreement with them.
+- **SI-16's three over-length council functions split at measured seams**, in-file and byte-faithful
+  (`runStage2` → `bindStage2Seats`, `runDebate` → `runDefenseWave`, `runRevoteWave` →
+  `repairRevoteLeg`), each mutant's red set recorded and each revert SHA-verified.
+- **`seatKey` consolidated to one exported definition** (SI-DUP disposition (b)): the two remaining
+  standalone copies of the seat-or-alias rule now import it, with the load-bearing hand-inlined
+  fallback and the two `keyOf` sibling forms deliberately untouched.
+- **MCP tool parameters re-measured and pinned** (F-1): 58 documented plus 2 allowlisted of 60 keys,
+  with the per-key rulings recorded in the test rather than in a comment that can rot. Separately
+  (F-5), `routing.tier` / `tier_onboarded` are documented from measurement, including the silent
+  `balanced` coercion.
+
+### CI
+
+- **Council backstop headroom.** `council-review.yml` sets `AMICUS_NO_OUTPUT_BACKSTOP_MS` to
+  `480000` on the council step, single-spelled and pinned by four workflow tests, with the measured
+  4.8.1-cycle stall evidence recorded in the comment beside it. The broader retry-policy question is
+  filed as issue 202 rather than guessed at here.
+- The CI bench moves with the pins above: `kimi` off the bench, `deepseek` seated, `gemini-pro`
+  chairs.
+
 ## [4.8.1] - 2026-08-25
 
 ### Fixed

package/README.md

@@ -132,6 +132,7 @@ The council is the hero — start with the everyday way, and reach for the more
 - **Headless, in CI, with no Claude runtime.** `amicus council run --prompt-file plan.md --council free` runs that same pipeline in one command — reviews → cross-review → tally → chair verdict — writing `verdict.json` and `report.html`. It needs no Claude session, so it drops straight into CI. → [Headless council (CI)](#headless-council-ci)
 - **With a debate round.** Add `--debate` and every Contested or Disputed finding goes back to its raiser to **defend, amend, or withdraw** while the disputing judges re-vote — exactly one rebuttal round, then the final tally. → [The Council](#the-council)
 - **On free, local, private models — at $0.** Point the council (and sidecars) at an OpenAI-compatible server already running on your machine — Ollama, LM Studio, or vLLM — with `amicus provider add`. No API key, no per-token bill, nothing leaves your machine, and it works offline. → [`amicus provider`](./docs/usage.md#amicus-provider)
+- **Pointed at the work itself, not at a review of it.** Add `--intent task` and the same bench *produces* the deliverable instead of critiquing one. → [Task mode (v4.9)](#task-mode-v49)
 
 <p align="center"><img src="./docs/cards/same-table.svg" width="520" alt="A local Ollama model seated as an equal council member at $0.00 — a member, not a mode"></p>
 
@@ -168,6 +169,10 @@ amicus council run --pack review-bench --prompt-file plan.md --json
 
 Any flag you also type on that second line overrides just that value — a pack only fills in what you didn't say explicitly, and it's recorded on the run either way. Packs work the same way on `fanout`/`start` and on the `amicus_fanout`/`amicus_start`/`amicus_council_run` MCP tools. `amicus pack list`/`show`/`rm` manage them, and `--from-run <id>` builds one from a run you already liked instead of typing flags at all. Full reference: [docs/usage.md § Policy packs](./docs/usage.md#policy-packs).
 
+### Task mode (v4.9)
+
+A council reviews by default. `amicus council run --intent task --prompt-file brief.md` — or `intent: 'task'` on the `amicus_council_run` MCP tool — points the same pipeline at open-ended work instead: every seat **produces** the analysis, answer, or artifact the briefing asks for, the judges rank *which response best does the work* and adjudicate the claims each one declared, and the chair synthesizes an **answer** — `Converged | Split | Insufficient` — never a review verdict. The two scales share no value, so a task run can never report `Ship it` and a review run can never report `Converged`. Task runs deliberately write nothing to the reliability ledger (rankings there measure concurrence, not defect confirmation) and say so on the surfaces that would otherwise look empty; a review run is byte-identical to before. Full reference: [docs/council.md § Task mode](./docs/council.md#task-mode---intent-task).
+
 ### Briefing templates (v4.5)
 
 `--template <name> --artifact <file>` (plus repeatable `--var k=v`) renders a `{{prompt}}`/`{{artifact}}`-style Markdown template before it's sent, on `start`/`fanout`/`council run` alike — templates live in `~/.config/amicus/templates/`, and a pack's `briefing.template` is how one reaches an MCP-invoked run (MCP has no template param of its own). `amicus template list|show` manage them; v4.5 ships one built-in, `review`. Full reference: [docs/usage.md § Briefing templates](./docs/usage.md#briefing-templates).
@@ -407,7 +412,7 @@ When you don't need a full council — just one other model's take — fork a co
 |---------|--------------|
 | `amicus start` | Launch a new session (interactive or `--no-ui`). |
 | `amicus fanout` | Run N models on the same prompt in parallel (headless). |
-| `amicus list` | Show previous sessions — shows the `--tag <t>` set at launch, `--search <q>` filters, `--limit <n>` caps the rows, `--all` spans every known project. |
+| `amicus list` | Show previous sessions — shows the `--tag <t>` set at launch, `--search <q>` filters, `--limit <n>` caps the rows, `--all` spans every known project (council runs: current project only — the CLI says so in-table). |
 | `amicus resume` | Reopen a previous session with full history. |
 | `amicus continue` | Start a new session building on a previous one. |
 | `amicus read` | Output a session's summary / conversation / metadata. |
@@ -450,13 +455,13 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.8.1",
+  "version": "4.9.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
 ```
 
-`amicus list --status` accepts `running`, `complete`, `error`, `timed-out`, `aborted`, `crashed`, `idle-timeout`. Rows carry a `TAG` column (set at launch with `--tag <t>`); `--search <q>` filters by id/tag/briefing substring, `--limit <n>` caps the row count (0 = unlimited), and `--all` lists across every known project. Full field-by-field docs (a running session's `messages`/`STALLED` reporting, wave-ID status shape, etc.) are in [docs/usage.md](./docs/usage.md).
+`amicus list --status` accepts `running`, `complete`, `error`, `timed-out`, `aborted`, `crashed`, `idle-timeout`. Rows carry a `TAG` column (set at launch with `--tag <t>`); `--search <q>` filters by id/tag/briefing substring, `--limit <n>` caps the row count (0 = unlimited), and `--all` lists across every known project (council runs stay scoped to the current project — no cross-project index exists, and the listing discloses that). Full field-by-field docs (a running session's `messages`/`STALLED` reporting, wave-ID status shape, etc.) are in [docs/usage.md](./docs/usage.md).
 
 ---
 

package/docs/ROADMAP.md

@@ -13,10 +13,10 @@ lives under **Backlog (tracked, not scheduled)** with everything else that is re
 Nothing about the content changed and no judgment about its value is implied; only its status. When
 an org buyer and the org to support them exist, it earns a number then.
 
-Amicus is at **v4.7.0** (tagged 2026-08-08). Each 4.x rev below leads with the benefit, not the
+Amicus is at **v4.9.0** (2026-08-26). Each 4.x rev below leads with the benefit, not the
 plumbing.
 
-**Status:** v4.0 through **v4.7.0** have **shipped** — everything on this page is a record of what
+**Status:** v4.0 through **v4.9.0** have **shipped** — everything on this page is a record of what
 landed, not a plan. Composition — the scope that
 carried the number v4.6 here until the degrade-announcement-invariant milestone took the v4.6.0
 release (2026-08-02) — is now an unscheduled candidate for the next rev, tabled in its own section
@@ -206,7 +206,8 @@ list. Two findings drove it:
    An earlier draft of this note said *"all three had already rotted"*; that universal is false and
    is corrected here. The other two HAD already rotted before T2.4 began (`report.js:79` and
    `ledger.js:24` are comments at `ed5c0c02`), so their drift is pre-existing, not this release's.
-   The report fallback is now at `src/council/report.js :: toModel`'s `total`; all three claims
+   The report fallback is now at `src/council/report-cost.js :: buildCostModel`'s `total` (it was
+   `report.js :: toModel`'s until v4.9 W8 extracted the cost table); all three claims
    themselves still hold. So CA-4's omissions are not a schema nicety — they under-report spend on the
    surface the owner relies on, which collides with the cost-truth principle (*reported > estimated
    > unknown; never fabricate $0*). An omitted leg is not "unknown" — it renders as money never
@@ -222,9 +223,9 @@ list. Two findings drove it:
   (`run-assemble.js:180-184`) and one `repair` row per `-q<N>` solo, failed ones included
   (`run-stage2.js:122`).
   ⚠️ **Scope correction:** the failed-chair third of the original CA-4 is **closed** — v4.6.2's
-  `chairAttempts[]` records every attempt on `run.json` (`run-chair.js:133` cites LC-5 by name), and
+  `chairAttempts[]` records every attempt on `run.json` (`run-chair.js:71` cites LC-5 by name), and
   failed-chair cost already reaches `runStats` too: a failed ch1–ch3 attempt gets its own
-  `chair-attempt` row there carrying that leg's real `usage` (`run-chair.js:154-156`), so no third
+  `chair-attempt` row there carrying that leg's real `usage` (`run-chair.js:91-95`), so no third
   row class was needed.
 - **GOA-7 prerequisite — segment the ledger by RESOLVED model, not alias** *(S–M)*: **shipped.**
   `ledger.js:124` now keys on `row.resolvedModel || row.model` and `LEDGER_SCHEMA_VERSION` is 2.
@@ -256,7 +257,9 @@ list. Two findings drove it:
 > *Next-rev hard gates*: the tight-file extraction pass (`cli-handlers-council-run.js` is at
 > **299/300 exactly**, `run-debate.js` at 299, two files **at 300**), and KNOWN_VARIABLES
 > single-sourcing **only if** `{{input}}` is ever scoped — it is not in this rev, so that gate
-> travels with composition rather than blocking here.
+> travels with composition rather than blocking here. *(Update 2026-08-25: the KNOWN_VARIABLES
+> gate is now satisfied — landed in v4.9 W1 ahead of any composition work. The tight-file
+> numbers in this note are a dated snapshot; re-measure with `npm run check:sizes`.)*
 
 ### Deferred out of v4.4.1 into v4.5 (2026-07-27)
 
@@ -276,7 +279,7 @@ a proposed disposition — v4.5 ride-along / v4.6 / backlog — tabled for rulin
 | **CA-4** | `tally.json`'s `runStats` omits Stage-2 judges, repair solos and failed chair attempts (5 rows for 11 real legs in `wsgate04`) | `M` — a schema question, not a fix |
 | **CA-5** | `isSubagentToolCall` is still a `name === 'task'` string proxy | `M`, and **reduced** by v4.4.0: it is now only the fallback when the real subtree walk finds nothing |
 | **LC-1** | B53's stall kill is skipped while a tool-settle deferral is active | `S–M` — shipped deliberately; the author wants a second opinion, which needs data from real runs |
-| ~~**LC-5**~~ | ~~A chair fallback leaves no trace in `run.json`~~ — ✅ **CLOSED by v4.6.2**: `chairAttempts[]` records every attempt (`{waveId, model, outcome, reason}`), checkpointed after each; `run-chair.js:113` cites LC-5 by name. **Do not re-file.** | — |
+| ~~**LC-5**~~ | ~~A chair fallback leaves no trace in `run.json`~~ — ✅ **CLOSED by v4.6.2**: `chairAttempts[]` records every attempt (`{waveId, model, outcome, reason}`), checkpointed after each; `run-chair.js@v4.6.2:113` cites LC-5 by name. **Do not re-file.** | — |
 | **RN-1** | `sanitizeName` collisions surface as a banner rather than a refusal | `S` + a product decision that was already argued once |
 | **RN-2** | `renderRunList` blind masking is best-effort — only the open run resolves labels | `M` |
 | **RN-5** | A blind-mode flip closes every open prose panel and repaints twice | `S–M` |
@@ -354,6 +357,93 @@ behaviour changes.
   CI off 1.2.20. First release whose suite ran against the engine users actually get
 - Plus a `sidecar/reopen-spend.js` extraction, a dead-code deletion, and three documentation gates
 
+## v4.8 — "Every seat counts as itself" *(seat identity)* — ✅ SHIPPED v4.8.0, 2026-08-23
+**Benefit:** seat a model twice and the council finally treats the two seats as two reviewers —
+each with its own vote, its own row, its own file and its own dead-seat badge. Before this rev a
+repeated alias was a bench that quietly disagreed with itself about how many reviewers were in the
+room.
+
+**Scope note.** The design spec behind this number
+(`docs/superpowers/specs/2026-08-10-v4.8-ask-anything-count-everyone-design.md`) carried two halves,
+*ask anything* and *count everyone*. v4.8.0 shipped **count everyone** — the seat-identity spine —
+across the `v48-*` PR train; **ask anything** (task mode, #134/#130, with #146 folded in) was sized
+and moved whole to v4.9 rather than carried half-done. That is the ruling, not a slip.
+
+- **Seats are first-class.** A seat id *is* its alias on every bench with no repeated `--models`
+  entry; where an alias occupies more than one position the seats are `<alias>#1`, `<alias>#2`, and
+  the artifacts follow (`review-<alias>-1.md`, and the same rule for `judge-`/`rebuttal-`/`revote-`).
+  `meta.seats` rides the tally/verdict documents index-parallel with `meta.models` *(L)*
+- **⚠️ The peers-only filter excludes the raiser by SEAT, and findings on a repeated-alias bench
+  change tier in BOTH directions** — a genuine twin's corroboration is no longer discarded, and a
+  twin's *dispute* now demotes. Deliberate, measured case-by-case, and disclosed with its permanent
+  cost: `Disputed` feeds the append-only ledger's `factErrorRate`, which is never migrated.
+  Distinct-alias benches are byte-for-byte unaffected *(M)*
+- **Two new honesty marks on `tally.json`/`verdict.json`** — `findings[].sameModelCorroboration`
+  (corroboration that came from another seat of the same model, so it is not independent) and
+  `findings[].unattributedPeerDrops` (a count of votes excluded from `basis` that the engine could
+  not attribute to anyone). Both emit-when-set; both shipped with their own wrong-in-two-directions
+  disclosures rather than as clean wins *(M)*
+- **Prototype pollution closed across the alias tables** — a member literally named `toString`,
+  `constructor`, `valueOf` or `hasOwnProperty` is no longer a valid alias at any of five gates, and
+  `resolveModel('toString')` throws instead of returning the function itself. One table was not
+  enough: a spread into a plain `{}` re-creates the inherited prototype, so all three builders are
+  seeded *(M)*
+- **A finding with no named raiser stops corroborating itself**, on one principle applied in order —
+  *attribute when you can, mark only when you cannot* — with seat ids deciding first *(M)*
+- **The Workspace stops collapsing dead seats**, and a live seat no longer erases its dead twin;
+  dead rows, retry badges and DOM keys are keyed on the seat, with the producer emitting `null`
+  rather than the alias for a seat it could not identify. Residuals pinned by tests asserting the
+  known-wrong behaviour so they cannot rot silently *(M)*
+- **`streetCred[]` stops dropping or inventing rows** when a hand-assembled `meta.seats` disagrees
+  with `meta.models`, and a mixed reliability-ledger pair group stops reading narrower than one with
+  no seat information at all *(S–M)*
+> Why here: seat identity is a prerequisite, not a feature. Every surface that says *which model
+> said what* — the peer split, street-cred, the ledger join, the Workspace panels, the artifact
+> filenames — was keyed on the alias, so all of them told the same lie on the same bench shape.
+> Fixing them one at a time would have been six half-fixes; the spine makes all six the same fix.
+>
+> **Lineage.** v4.6 made a loss announce itself, v4.7 made the accounting match reality, v4.8 makes
+> the *attribution* match reality. Same invariant family, applied to identity.
+
+**v4.8.1 (shipped 2026-08-25):** the fast-follow patch — setup Step 2 offered one card per curated
+model *family* with no way to choose within it, and the route pill it wrote stored a **provider** id
+rather than a model id, so nothing downstream could tell two models of one family apart either
+(#138). Both wizard surfaces now offer a vendor-scoped drill-down on a new pure `model-shortlist.js`.
+
+## v4.9 — "The council does new work" *(task mode)* — ✅ SHIPPED v4.9.0, 2026-08-26
+**Benefit:** the council stops being able only to critique. Point it at open-ended work with
+`--intent task` and every seat *produces* the deliverable, the judges rank which response best does
+the work, and the chair synthesizes an **answer** — `Converged | Split | Insufficient` — instead of
+a verdict about a review that never happened.
+
+- **★ Task mode** — the *ask anything* half deferred out of v4.8, shipped whole: intent plumbing,
+  Stage-1 task frames at every dispatch site, task judging and the task chair, honest renderers on
+  every surface, and zero reliability rows written by a task run. **Closes #134, #130 and #146** —
+  `--intent task` on the CLI, `intent: 'task'` over MCP, and a review run that is byte-identical
+  everywhere *(L)*
+- **The engine speaks for itself** — a `NO_OUTPUT_BACKSTOP` death report now quotes the engine's own
+  newest ERROR line for that session, and names a server-vs-install engine skew when there is one,
+  with a remedy that says why `doctor` cannot see this class. **Closes #133** *(M)*
+- **Bench signals** — the `ttftMs` probe (measured off the backstop's own substantive-activity
+  predicate, never derived), and a one-per-run warning when a local alias shadows a curated one with
+  a different id, surfaced on the CLI, over MCP and in `models --check` *(M)*
+- **The dead-seat surface finishes the v4.8 job** — an unbound seat stops being invisible in the
+  Workspace, and the critic path keys on seat identity, closing the dead-bench-twin-beside-live-critic
+  erasure v4.8 disclosed as a residual *(M)*
+- **`amicus list` shows council runs on the CLI**, as `amicus_list` has over MCP since v4.0, with
+  the current-project-only scope stated out loud rather than left silent *(S–M)*
+- **Docs update** — task mode in `README.md`, `docs/council.md` and `docs/usage.md`; the `runStats`
+  builder unification, the SI-16 splits and the `seatKey` consolidation carry the internal half *(S)*
+> Why here: #130 and #134 are the same problem from two directions — #130 is the bug report of what
+> happens when a generative brief meets a review-shaped pipeline, #134 is the request to support
+> generative briefs properly — and both trace to one hard-coded frame telling every seat it was a
+> reviewer. One declaration serves both, which is why they were designed together and shipped
+> together rather than as a detector and a feature.
+>
+> **Lineage.** v4.6 through v4.8 each made the council *more honest about a run it already knew how
+> to do* — announcing losses, counting money, attributing seats. v4.9 changes what a council can be
+> asked for in the first place, which is a different kind of rev and is scoped as one.
+
 ## Backlog (tracked, not scheduled)
 
 ### Enterprise-readiness *(unscheduled — gated on funding / cofounder)*
@@ -388,9 +478,10 @@ consumer today (the Council Review GitHub Action) runs a single review per PR, n
 agent driving it, or the `critique`/`refine` built-ins are wanted on their own — those are a much
 smaller slice than the chaining machinery and could ship independently of F6.
 
-⚠️ **Carries its own hard gate:** KNOWN_VARIABLES single-sourcing (`src/template/render.js:45` keeps
-two hand-maintained copies of the known-variable set) must land **before** `{{input}}` does. See
-`BACKLOG.md` *Next-rev hard gates* — that gate travels with this item, not with v4.7.
+⚠️ **Its hard gate is already satisfied:** KNOWN_VARIABLES single-sourcing landed in v4.9 W1
+(2026-08-25) — `src/template/render.js` now derives both validation and rendering from
+`KNOWN_VARIABLES`, drift-tested, so `{{input}}` no longer waits on it. See `BACKLOG.md`
+*Next-rev hard gates* (ticked).
 
 ### GUI power ergonomics (F10) *(unscheduled — dropped from v4.7, 2026-08-05)*
 Focus-follows-fold hotkey, distinguishable window titles, tiling presets *(S each)*.

package/docs/configuration.md

@@ -78,6 +78,52 @@ not on every launch, and not when you explicitly chose the gateway with `--gatew
 `routing.prefer: "openrouter"` (or pass `--gateway openrouter` per call) to keep routing everything
 through OpenRouter as before.
 
+### Cost tier
+
+`routing.tier` is your standing answer to "when a vendor offers several models, which end of its
+range do you want by default?" It lives under `routing` for filing reasons only — **it does not
+change how a call is routed**, and it is not a gateway knob. Its one and only effect is which row
+the **cost-aware default picker** preselects (`src/utils/provider-default-picker.js`).
+
+| Tier | Means | Example (Anthropic) |
+|---|---|---|
+| `"frontier"` | the most capable / most expensive of the vendor's line | `claude-opus-*` |
+| `"balanced"` | the middle of the range — **the default** | `claude-sonnet-*` |
+| `"economy"` | the cheapest of the line | `claude-haiku-*` |
+
+Absent, misspelled or set to anything outside those three, the tier **coerces silently to
+`"balanced"`** — a junk value never errors and never blocks a launch. Per-vendor tier resolution
+lives in `src/utils/model-tiers.js`; when a vendor's catalog has no model matching the tier, the
+picker falls back to the cheapest priced row, then the first row.
+
+**`routing.tier` is hand-edited only.** No wizard step, CLI command or GUI control writes it — set
+it yourself in `~/.config/amicus/config.json` (the same rule as [`maxCostPerMtok`](#cost-gate)
+below):
+
+```jsonc
+{ "routing": { "prefer": "direct", "tier": "economy" } }
+```
+
+**Where the picker actually runs.** It offers you that vendor's models, priced, with the tier's pick
+flagged as recommended, and writes your choice to `aliases.<vendor>` (seeding `config.default` when
+that is still unset). Three surfaces reach it:
+
+- `amicus key <provider> <key>` — after a successful **cloud**-vendor key save (local-provider
+  bearer saves skip it).
+- `amicus setup` — the readline wizard runs it once per keyed provider, in detection order.
+- The **Electron setup window** — the same picker, with a family → model drill-down.
+
+Non-interactively (`--json`, `--quiet`, or no TTY) the picker takes the recommended pick silently and
+prints a one-line summary instead of prompting. It is also a graceful no-op for `openrouter`, which
+is a gateway rather than a model vendor.
+
+**`routing.tier_onboarded`** is bookkeeping, not a setting: a boolean written automatically the
+first time `amicus start` prints the one-time tip pointing existing users at the picker
+(`src/utils/start-helpers.js`). The tip only fires on an interactive run that already has a direct
+provider key and has not used the picker yet, and the flag is set only when the line actually
+printed — so a `--json` run never burns it. Don't hand-edit it; delete it if you want the tip once
+more.
+
 ---
 
 ## Behavior
@@ -343,12 +389,16 @@ level includes everything above it.
   },
 
   // Gateway routing policy (see Routing above). `prefer` defaults to "direct"
-  // when this key is absent entirely. `migration_notified` is written
-  // automatically the first time the one-time direct-migration notice fires
-  // for a vendor — don't hand-edit it.
+  // when this key is absent entirely. `tier` is the cost-tier preference the
+  // model picker preselects on ("frontier" | "balanced" | "economy"; anything
+  // else coerces to "balanced") — hand-edited only, see Cost tier above.
+  // `migration_notified` and `tier_onboarded` are both written automatically
+  // when their one-time notices fire — don't hand-edit either.
   "routing": {
     "prefer": "direct",
-    "migration_notified": { "openai": true }
+    "tier": "balanced",
+    "migration_notified": { "openai": true },
+    "tier_onboarded": true
   },
 
   // User-defined local / OpenAI-compatible providers (v4.2) — written by