amicus 4.9.3 → 4.9.5

package/docs/architecture-map.md

@@ -0,0 +1,736 @@
+# Architecture Map
+
+Generated inventory of this repository: the directory tree and the module table.
+
+The sections between `<!-- AUTO:... -->` markers are maintained by
+`scripts/generate-docs.js` and regenerated by the pre-commit hook. Do NOT edit
+them by hand -- run `node scripts/generate-docs.js` instead.
+
+This file lists **what exists**. For **how it connects** -- which test suites drive
+a source file, what a module reaches -- query the graphify index instead; see
+[Finding Things in This Repo](../CLAUDE.md#finding-things-in-this-repo).
+
+---
+
+## Directory Structure
+
+<!-- AUTO:tree -->
+bin/
+└── amicus.js  # Amicus CLI Entry Point
+src/
+├── council/
+│   ├── anonymize.js
+│   ├── briefings-chair-task.js
+│   ├── briefings-chair.js
+│   ├── briefings-debate.js
+│   ├── briefings-stage2-task.js
+│   ├── briefings-stage2.js
+│   ├── briefings-task.js
+│   ├── briefings.js
+│   ├── chair-fallback.js
+│   ├── debate.js
+│   ├── findings.js
+│   ├── ledger-join.js
+│   ├── ledger-stats.js
+│   ├── ledger.js
+│   ├── parse-stage2.js
+│   ├── peer-split.js
+│   ├── presets-cli.js
+│   ├── report-cost.js
+│   ├── report-html.js
+│   ├── report-md.js
+│   ├── report.js
+│   ├── run-assemble.js
+│   ├── run-budget.js
+│   ├── run-chair.js
+│   ├── run-debate-revote.js
+│   ├── run-debate-stage.js
+│   ├── run-debate.js
+│   ├── run-degrade.js
+│   ├── run-finalize.js
+│   ├── run-finish.js
+│   ├── run-launch.js
+│   ├── run-retry-group.js
+│   ├── run-retry-keys.js
+│   ├── run-retry-launch.js
+│   ├── run-retry-notes.js
+│   ├── run-retry-window.js  # The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay
+│   ├── run-retry.js
+│   ├── run-server.js
+│   ├── run-stage1-launch.js  # Stage-1 launch pass for the council engine.
+│   ├── run-stage1-rows.js
+│   ├── run-stage1-superseded.js
+│   ├── run-stage2.js
+│   ├── run-stages.js
+│   ├── run-state.js
+│   ├── run-stats-entry.js
+│   ├── run-verdict-files.js
+│   ├── run.js
+│   ├── seats.js
+│   ├── stage1-bind.js
+│   ├── street-cred.js
+│   ├── tally.js
+│   ├── verdict-seat-loss.js
+│   ├── verdict-seats-reviewed.js  # #202: the bench-seat census for verdict.json, as a spreadable fragment.
+│   └── verdict.js
+├── design/
+│   ├── fonts/
+│   │   ├── IBMPlexMono-400.ttf
+│   │   ├── IBMPlexMono-500.ttf
+│   │   ├── IBMPlexMono-600.ttf
+│   │   ├── Outfit-300.ttf
+│   │   ├── Outfit-400.ttf
+│   │   ├── Outfit-500.ttf
+│   │   ├── Outfit-600.ttf
+│   │   ├── Outfit-700.ttf
+│   │   └── Outfit-800.ttf
+│   ├── tokens.css
+│   └── tokens.js
+├── observe/
+│   ├── council-legs.js
+│   ├── events.js
+│   ├── follow.js
+│   ├── live-doc.js
+│   ├── on-complete.js
+│   └── watch-render.js
+├── pack/
+│   ├── pack-cli.js
+│   ├── pack-forward.js
+│   ├── pack-resolve.js
+│   ├── pack-store.js
+│   └── pack-validate.js
+├── prompts/
+│   └── cowork-agent-prompt.js  # Cowork Agent Prompt
+├── sidecar/
+│   ├── budget.js
+│   ├── child-sessions.js
+│   ├── context-builder.js  # Context Builder Module
+│   ├── continue.js  # Sidecar Continue Operations - Handles continuing from previous sessions
+│   ├── conversation-mirror.js
+│   ├── crash-handler.js  # Crash Handler - Updates metadata to 'error' on uncaught exceptions
+│   ├── electron-cache.js  # Electron download-cache root resolution (#53 helper).
+│   ├── electron-ensure.js  # ensureElectron() — lazy first-GUI provisioning (#55).
+│   ├── electron-install.js  # Electron self-heal primitive (#53, #59).
+│   ├── electron-lock.js  # Stale-aware single-flight lock for the electron self-heal (#53).
+│   ├── electron-provision.js  # Electron CONTROLLED provision — the pinned download, and what happens to a
+│   ├── electron-quarantine.js  # AV / antivirus quarantine detection for the electron self-heal (#53).
+│   ├── electron-state.js  # Electron install-state probes (#76).
+│   ├── electron-trust.js  # Electron artifact TRUST core — the digest anchor, the gate, and the env scrub.
+│   ├── fallback-chains.js
+│   ├── fanout-budget.js
+│   ├── fanout-leg-fallback.js
+│   ├── fanout-leg.js
+│   ├── fanout-output.js
+│   ├── fanout-retry.js
+│   ├── fanout-signals.js
+│   ├── fanout-validate.js
+│   ├── fanout-wave-io.js
+│   ├── fanout.js
+│   ├── interactive-abort.js
+│   ├── interactive-mirror.js
+│   ├── interactive-process.js  # Sidecar Interactive Process Helpers - Electron probe/env/process-exit plumbing
+│   ├── interactive.js  # Sidecar Interactive Mode - Electron GUI session management
+│   ├── leg-ids.js
+│   ├── list-council.js  # Council rows on the CLI `amicus list` surface (v4.9 W12).
+│   ├── list-limit.js  # The `--limit` core behind `amicus list` (v4.7 PR3 rider).
+│   ├── list-search.js  # The `--search` core behind both list surfaces (F8 D15, errata E-PR3-5).
+│   ├── models-ceiling-line.js  # The one `Ceilings:` line `amicus models --refresh` prints (#218 P3).
+│   ├── models-probe.js
+│   ├── models-render.js  # Presentation helpers for `amicus models` -- pure string formatting, no I/O.
+│   ├── models.js  # `amicus models` (F5) — list/search the catalog, refresh it, audit aliases.
+│   ├── progress-fields.js  # Derived, agent-facing progress fields shared by the MCP status/list
+│   ├── progress.js  # Sidecar Progress Reader
+│   ├── read.js  # Sidecar Read Operations Module
+│   ├── reopen-notices.js  # The stderr Notice a reopen owes the user for the effort level it does NOT carry (#218 PR 4, council #235 r5 J1/A3).
+│   ├── reopen-spend.js  # Spend finalization for a REOPENED session (continue/resume). Split out of
+│   ├── resume.js  # Sidecar Resume Operations - Handles resuming previous sidecar sessions
+│   ├── session-finalize.js
+│   ├── session-utils.js  # Sidecar Session Utilities - Shared functionality for session management
+│   ├── setup-local.js  # The readline setup wizard's local / self-hosted provider add step (v4.2 §4.6, Task 12).
+│   ├── setup-window.js  # Setup Window Launcher
+│   ├── setup.js  # Sidecar Setup Wizard
+│   ├── start-metadata.js
+│   ├── start.js  # Sidecar Start Operations - Handles starting new sidecar sessions
+│   ├── tool-part.js
+│   ├── unzip.js  # Robust unzip for the electron self-heal (#53 follow-up; extract-zip-node24).
+│   ├── wave-progress.js
+│   ├── workspace-auto-open.js  # Workspace Auto-Open Decision Helper
+│   └── workspace-window.js  # Council Workspace launcher (v4.4 §4.3/§4.4) — setup-window.js pattern:
+├── template/
+│   ├── apply.js
+│   ├── render.js
+│   └── store.js
+├── utils/
+│   ├── abort-coordinator.js
+│   ├── abort-result.js  # The abort-result document builder for `abort <taskId|--all> --json` (B21-rest).
+│   ├── activity-poller.js
+│   ├── agent-mapping.js  # Agent Mapping Module
+│   ├── alias-audit.js  # Alias Audit (F5) — report + suggest for most classes; doctor --fix auto-repairs one narrow, mechanically-unambiguous class (B3).
+│   ├── alias-resolver.js  # Alias Resolver Utilities
+│   ├── alias-shadow-writer.js  # The alias-shadow notice's WRITE half: say it without ever sinking the run.
+│   ├── alias-shadow.js  # Alias-shadow self-diagnosis — name a local alias that repoints a curated one.
+│   ├── api-key-store.js  # API Key Store — reading, saving, and validating API keys.
+│   ├── api-key-validation.js  # API Key Validation — test API keys against provider endpoints.
+│   ├── atomic-write.js  # Atomic file write helper.
+│   ├── auth-json.js  # Auth JSON Reader
+│   ├── base-url-classify.js  # v4.6.2 PR1 (spec §4, D1/D2): ANTHROPIC_BASE_URL classification, the
+│   ├── claude-register.js  # Registration core for amicus: skill install (chat skill + LLM Council),
+│   ├── cli-preflight.js  # Tiny shared preflight guards used by more than one CLI run handler
+│   ├── client-detect.js  # Detects which caller (Claude Code vs. Cowork/Claude Desktop) spawned this
+│   ├── config.js  # Amicus Config Module
+│   ├── council-presets.js  # Built-in council benches (B23).
+│   ├── curated-models.js  # Family definitions + pinned fallbacks for the wizard model picker (v2).
+│   ├── degrade.js
+│   ├── doctor-alias-check.js
+│   ├── doctor-base-url-check.js  # v4.6.2 PR1 (spec §4): the 'anthropic-base-url' doctor row.
+│   ├── doctor-credit-check.js  # The `openrouter-credit` doctor row (#43), split out of
+│   ├── doctor-degrade.js
+│   ├── doctor-electron-mcp-check.js  # The `electron-mcp` doctor check ("Electron (MCP launch path)"), split out of
+│   ├── doctor-engine-check.js  # The `engine-mcp` doctor check ("OpenCode engine (MCP launch path)"), split out
+│   ├── doctor-key-auth-check.js  # The `key-auth` doctor row (issue #210), split out of src/cli-handlers-doctor.js
+│   ├── doctor-local-providers-check.js  # The `local-providers` doctor check (v4.2 §4.7 C8), split out of
+│   ├── doctor-mcp-checks.js  # B14/Task 4.3: the two MCP-registration doctor checks ('mcp' and
+│   ├── doctor-output-budget-check.js  # #218 PR 2: the 'output-budget' doctor row.
+│   ├── doctor-summary.js  # Compact doctor summary (v4.2 §4.7 C8). All-ok -> one line; otherwise the
+│   ├── engine-ensure.js  # ensureEngine() — runtime engine self-heal at server start (report #2).
+│   ├── engine-install-scan.js  # Discover + probe every amicus install that could serve the MCP (running,
+│   ├── engine-lock.js  # Stale-aware single-flight lock for the engine self-heal (report #2).
+│   ├── engine-log-parse.js  # Line-shape parsing for the engine log: level, session, message.
+│   ├── engine-log-tail.js  # One engine-log FILE: read its tail, find the newest usable excerpt in it.
+│   ├── engine-log.js  # Resolve the OpenCode engine's own error line for one session.
+│   ├── engine-output-flag.js  # #218 PR 2 — the one engine env flag amicus sets: OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX.
+│   ├── engine-repair.js  # Engine self-heal primitive (report #2): make the opencode engine present ON
+│   ├── engine-skew-records.js  # Server identity and the bounded store of standing engine-skew records.
+│   ├── engine-skew.js  # Runtime detection of an opencode ENGINE version skew: server vs installed.
+│   ├── engine-variants.js  # The effort lever (#218 PR 4): --thinking sent as the engine's variant field, validated against the engine's own declaration.
+│   ├── env-loader.js  # Credential Loader
+│   ├── env-num.js
+│   ├── env-raw-store.js  # Arbitrary-env-var writes to the amicus .env (local-provider bearers, v4.2 §4.6).
+│   ├── error-classify.js
+│   ├── error-doc.js
+│   ├── fold-marker.js  # Fold marker construction/parsing helpers — shared by prompt-builder.js
+│   ├── format-duration.js
+│   ├── free-models.js  # Free OpenRouter model detection (Unit A).
+│   ├── gateway-route-audit.js  # Per-gateway-form audit for curated DEFAULT aliases (Task 6, #gwid).
+│   ├── gateway-route-catalog.js  # Conservative cross-gateway catalog pairing helper (Task 5, #gwid).
+│   ├── gateway-router.js  # Pure gateway router (#61). Decides direct vs OpenRouter for a request using
+│   ├── http-get.js  # One HTTPS GET, always resolved, never rejected — the timer/destroy/failure
+│   ├── idle-watchdog.js  # IdleWatchdog - BUSY/IDLE state machine with self-terminating timer.
+│   ├── input-validators.js
+│   ├── known-flags.js
+│   ├── legacy-mcp-migration.js
+│   ├── lifecycle.js
+│   ├── live-probes.js  # The single gate on outbound AUTHENTICATED network probes made by diagnostics
+│   ├── local-probe.js
+│   ├── local-providers.js
+│   ├── logger.js  # Structured Logger Module
+│   ├── mcp-discovery.js  # MCP Discovery - Discovers MCP servers from parent LLM configuration
+│   ├── mcp-self-identity.js
+│   ├── mcp-validators.js  # MCP Validators
+│   ├── model-canonicalization.js  # Direct-first id canonicalization, guarded by `classifyModel`
+│   ├── model-catalog.js  # OpenRouter model catalog cache (F3 #18 / F5 foundation).
+│   ├── model-ceilings-modelsdev.js  # #218 P3 — output ceilings for the direct-provider catalog rows.
+│   ├── model-classification.js  # Tri-state catalog classification (#61).
+│   ├── model-descriptor.js  # Model-descriptor grammar + RouteResult factories (#61).
+│   ├── model-fetcher.js  # Model Fetcher
+│   ├── model-input-default.js
+│   ├── model-output-limit.js  # Issue #218 — the per-model `limit` descriptor amicus hands opencode.
+│   ├── model-shortlist.js  # Vendor model shortlist (#138) -- the family -> model second level.
+│   ├── model-tiers.js  # Per-vendor cost tiers (economy/balanced/frontier) + resolution against the
+│   ├── model-validator.js  # Model Validator
+│   ├── no-output-backstop.js  # v4.6.2 PR2 (spec §5, D4): fail a headless leg fast when the model produces
+│   ├── node-version-guard.js
+│   ├── openrouter-credit.js  # The OpenRouter credit/limit probe, split out of api-key-validation.js to keep
+│   ├── output-length.js  # #218 PR 3: name the "Mode 2" death.
+│   ├── path-fence.js  # Shared realpath-containment fence.
+│   ├── path-setup.js
+│   ├── port-pid.js  # Cross-platform listener-PID lookup.
+│   ├── pricing.js
+│   ├── project-path.js  # Canonical project-path helper.
+│   ├── project-root-sanity.js
+│   ├── prompt-source.js
+│   ├── provider-default-picker.js  # Provider-default picker core (Part 2, Task 4).
+│   ├── provider-default-prompt.js  # Provider-default prompt flow (Part 2, Task 6/7 shared helper).
+│   ├── provider-registry.js  # Provider-capability registry — the single source of truth for provider
+│   ├── quick-picks.js  # Quick-pick resolution (wizard Step 2) — resolves each curated family to
+│   ├── read-slice.js  # Byte-bounded slicing for amicus_read (15a.3 / B17).
+│   ├── remediation-hints.js
+│   ├── result-schema-rebuild.js
+│   ├── result-schema-version.js  # The single SCHEMA_VERSION constant shared by result-schema.js and
+│   ├── result-schema.js
+│   ├── route-error.js  # Shared renderer (#61 Task 6.1): turns a router RouteResult — an error or a
+│   ├── route-launch.js  # Route-launch views (#61 gateway routing integration, Task 4.2).
+│   ├── route-suggestions.js
+│   ├── server-setup.js  # Server Setup Utilities
+│   ├── session-abort.js  # Session abort utilities: signal handler installation and terminal metadata writes.
+│   ├── session-index-prune.js
+│   ├── session-index-tmp-sweep.js
+│   ├── session-index.js  # Global session index (issue #40).
+│   ├── session-lock.js
+│   ├── session-metadata-tmp-sweep.js
+│   ├── session-path.js  # Session path resolution.
+│   ├── session-status.js  # #202: render the engine's SESSION STATUS as a clause on a leg's death report.
+│   ├── shared-server.js
+│   ├── spend-ledger.js
+│   ├── start-helpers.js  # Start Command Helpers
+│   ├── text-sanitize.js  # One third-party string, safe to render: no escapes, no bidi, one short line.
+│   ├── thinking-validators.js  # Thinking Level Validators
+│   ├── ttft.js  # The one honesty predicate for the time-to-first-token probe (v4.9 W13).
+│   ├── untrusted-fence.js  # Untrusted sidecar output fence.
+│   ├── update-notice.js  # The MCP server is the one entry point that skips bin/amicus.js's update
+│   ├── update-notifier-loader.js  # update-notifier Loader
+│   ├── updater.js  # Updater Module
+│   ├── validators.js  # Input Validators
+│   └── version-info.js  # After an `npm i -g amicus` upgrade, a long-lived MCP server process keeps
+├── workspace/
+│   ├── artifact-guard.js  # Council Workspace — artifact read guard (v4.4 §4.5 workspace:read-artifact).
+│   ├── artifact-names.js  # Council Workspace — artifact NAME derivation (v4.8 PR5a).
+│   ├── blind-mode.js  # Council Workspace — blind-mode name mapping (v4.4 §6.3).
+│   ├── fold-format.js  # Council Workspace — fold payload builder (v4.4 §7).
+│   ├── live-normalize.js  # Council Workspace — live-doc normalization (v4.4 §3 A1/A2/A4 seam).
+│   ├── matrix-model.js  # Council Workspace — adjudication matrix view model (v4.4 §5.2).
+│   ├── run-detail.js  # Council Workspace — run detail: defensive parse of run.json / tally.json /
+│   ├── run-scan.js  # Council Workspace — run discovery (v4.4 spec §4.3 / §5.1).
+│   └── seat-space.js  # Council Workspace — the seat-space PREDICATES (v4.8 PR5b).
+├── cli-council-run-bench.js  # Bench and input resolution for the council run command.
+├── cli-council-run-render.js
+├── cli-handlers-abort.js  # CLI Abort Handler (B21-rest extraction)
+├── cli-handlers-council-run.js
+├── cli-handlers-council.js
+├── cli-handlers-doctor.js
+├── cli-handlers-fanout.js  # CLI handler for the fanout command (multi-model parallel runs).
+├── cli-handlers-init.js  # `amicus init [--claude] [--desktop] [--json]` (v4.2 §4.8, C2). Re-runs the
+├── cli-handlers-key-local.js  # amicus key <localId> — bearer lifecycle for a config-defined local /
+├── cli-handlers-pack.js
+├── cli-handlers-provider.js  # `amicus provider add|list|test|remove` (v4.2 §4.6): configure local /
+├── cli-handlers-resume-continue.js  # CLI Resume/Continue Handlers (B21-rest extraction)
+├── cli-handlers-run.js  # CLI Run Handlers (WS-2 extraction)
+├── cli-handlers-spend.js
+├── cli-handlers-status.js  # `amicus status <task_id>` — one-shot human/JSON status for a session or wave.
+├── cli-handlers-template.js
+├── cli-handlers-watch.js
+├── cli-handlers.js  # CLI Command Handlers
+├── cli-template-args.js
+├── cli.js  # CLI Argument Parser
+├── conflict.js  # File Conflict Detection Module
+├── context-compression.js  # Context Compression Module
+├── context.js  # Context Filtering Module
+├── drift.js  # Context Drift Detection Module
+├── environment.js  # Environment Detection Module
+├── headless.js  # Headless Mode Runner
+├── index.js  # Amicus - Main Module
+├── jsonl-parser.js  # JSONL Parser
+├── mcp-council-awareness.js
+├── mcp-council-bench.js
+├── mcp-council-run.js
+├── mcp-notify.js  # Pure helpers + in-process registry for the MCP `onComplete: 'mcp-notify'`
+├── mcp-server.js  # @module mcp-server — Amicus MCP Server (stdio transport)
+├── mcp-spend.js
+├── mcp-tools.js  # MCP Tool Definitions for Amicus
+├── mcp-wait.js  # Engine for the amicus_wait MCP tool: blocks inside one tool call until a session/wave reaches a terminal state or the wait window closes.
+├── opencode-client.js  # OpenCode SDK Client Wrapper
+├── project-root-allowlist.js  # The MCP `project` / cwd input becomes the session-store parent AND the spawned
+├── prompt-builder.js  # System Prompt Builder
+├── session-manager.js  # Session Manager Module
+├── session.js  # Session Resolver
+└── spend-query.js
+electron/
+├── assets/
+│   ├── icon.png
+│   └── icon.svg
+├── workspace-ui/
+│   ├── index.html
+│   ├── live-dead-seats.js
+│   ├── live-model.js  # Council Workspace — pure renderer-side view logic (poll cadence, seat row
+│   ├── live-seats.js
+│   ├── md-lite.js  # markdown-lite — dependency-free renderer for untrusted model prose
+│   ├── workspace-app.js  # Council Workspace — application state + wiring (v4.4 §5).
+│   ├── workspace-banners.js  # Council Workspace — the run-detail banner ladder (v4.4 §9, spec's "graceful when present").
+│   ├── workspace-lazy.js  # Council Workspace — lazy prose-panel loading (v4.4 §5.2). v4.7 PR7 extraction of the
+│   ├── workspace-matrix.js  # Council Workspace — adjudication matrix + verdict panel painters.
+│   ├── workspace-panels.js  # Council Workspace — name resolution + the matrix/verdict/seats panel adapters
+│   ├── workspace-render.js  # Council Workspace — DOM painters (run list, header, stage rail, seats,
+│   ├── workspace-seats.js  # Council Workspace — seats panel painter (v4.4 §5). D8 extraction (Task 1, v4.6.2 PR4): moved
+│   ├── workspace-verbs.js  # Council Workspace — action verbs (v4.4 §5, ⚠️ DE-ROT F05 split of
+│   └── workspace.css
+├── close-guard.js  # Close Guard — auto-fold on window close (backlog B01)
+├── fold.js  # Fold Logic
+├── ipc-guard.js  # IPC Guard Helpers
+├── ipc-setup-local.js  # IPC handlers for the Electron wizard's "Local server" card (Task 13, v4.2 §4.6).
+├── ipc-setup.js  # IPC Setup Handlers
+├── ipc-workspace.js  # Council Workspace IPC (v4.4 §4.5) — all seven workspace: channels.
+├── load-failsafe.js  # Load Failsafe
+├── main.js  # Amicus Electron Shell - v3
+├── offer-session.js  # Offer-session catalog snapshots for the setup wizard's provider-default
+├── opencode-theme.js
+├── preload-content.js  # Content Preload - OpenCode WebContentsView (minimal, no privileged bridge)
+├── preload-setup.js  # Sidecar Preload - Setup Mode
+├── preload-workspace.js  # Council Workspace Preload — minimal typed IPC bridge (v4.4 §4.2/§4.5).
+├── preload.js  # Sidecar Preload - v3 Minimal
+├── session-route.js  # Web-UI session route builder (#45).
+├── setup-ui-alias-groups.js  # Setup UI - Alias grouping rule (issue 213)
+├── setup-ui-alias-script.js  # Setup UI - Alias Editor Script
+├── setup-ui-aliases.js  # Setup UI - Alias Editor
+├── setup-ui-council.js  # Setup UI — Free OpenRouter council picker (mounted on the Models step).
+├── setup-ui-keys-script.js  # Setup UI - Step 1 Key Management Script
+├── setup-ui-keys.js  # Setup UI - Step 1: API Keys
+├── setup-ui-local-script.js  # Setup UI — Local server widget runtime script (Task 13, v4.2 §4.6).
+├── setup-ui-local.js  # Setup UI — "Local server" step-1 add-on widget (Task 13, v4.2 §4.6).
+├── setup-ui-model.js  # Setup UI - Step 2: Default Model Selection
+├── setup-ui-provider-default.js  # Setup UI — Per-provider default model picker (Part 2, Task 8).
+├── setup-ui-styles.js  # Setup UI - Shared CSS Styles (clay/gold token-driven)
+├── setup-ui.js  # Setup UI - Wizard Orchestrator: API Keys → Models → Aliases → Review
+├── summary.js  # Summary Generation via OpenCode API
+├── toolbar.js  # Amicus Toolbar HTML Builder
+├── window-position.js  # Window Position Calculator
+└── workspace-shell.js  # Council Workspace window (v4.4 §4.1/§4.2) — the third Electron mode's
+scripts/
+├── benchmark-api-direct.js  # Direct OpenRouter API Benchmark for Thinking Levels
+├── benchmark-thinking.js  # Benchmark Thinking Levels
+├── check-ci-alias-pins.js  # Drift gate for the CI alias map (.github/amicus-ci-aliases.json).
+├── check-citations.js  # Cross-file citation enforcement for the pre-commit hook and the whole-tree
+├── check-file-sizes.js  # File size enforcement for the pre-commit hook and the whole-tree CI gate (--all).
+├── check-global-install.js  # CI assertion (Windows install-smoke job, #35): after a REAL global install
+├── check-html.js
+├── check-secrets.js  # Secret detection for the pre-commit hook and the whole-tree CI gate (--all).
+├── check-tarball-lifecycle.js  # CI guard: assert every script referenced by an npm *lifecycle* hook actually
+├── check-ui.js
+├── debug-cdp.js
+├── eval-with-monitoring.sh
+├── extract-workflow-env.js  # Extract the workflow-level and job-level `env:` blocks of a GitHub Actions
+├── generate-docs-helpers.js  # Helper functions for generate-docs.js.
+├── generate-docs.js  # Auto-generate documentation sections from source code.
+├── generate-icon.js  # Generate app icon PNG from SVG source.
+├── git-index.js  # Read file content from the git INDEX rather than the working tree, and list
+├── integration-test.sh
+├── mark-test-passed.js  # Writes the current git HEAD SHA to .test-passed for the pre-push SHA cache
+├── postinstall.js  # Post-install script for amicus
+├── probe-max-tokens.js  # Wire probe for issue #218: what max_tokens / reasoning / thinking does the
+├── run-integration-keyless.js
+├── setup-hooks.js  # Configure git to run the version-controlled hooks in .husky/.
+├── test-tools.sh
+├── validate-docs.js  # CLAUDE.md drift detection script.
+├── validate-thinking.js
+└── validate-ui.js
+evals/
+├── tests/
+│   ├── claude_runner.test.js
+│   ├── eval_tasks.test.js
+│   ├── evaluator.test.js
+│   ├── result_writer.test.js
+│   └── transcript_parser.test.js
+├── claude_runner.js
+├── eval_tasks.json
+├── evaluator.js
+├── README.md
+├── result_writer.js
+├── run_eval.js  # Sidecar Agentic Eval Runner
+└── transcript_parser.js  # Parse Claude Code stream-json output into structured transcript.
+<!-- /AUTO:tree -->
+
+---
+
+## Key Modules
+
+<!-- AUTO:modules -->
+| Module | Purpose | Key Exports |
+|--------|---------|-------------|
+| `cli-council-run-bench.js` | Bench and input resolution for the council run command. | `resolveBench()`, `resolveChair()`, `resolveCritic()`, `CHAIR_DEFAULT()`, `parseList()` |
+| `cli-council-run-render.js` |  | `renderRunHuman()` |
+| `cli-handlers-abort.js` | CLI Abort Handler (B21-rest extraction) | `handleAbort()` |
+| `cli-handlers-council-run.js` |  | `handleCouncilRun()`, `renderRunHuman()`, `CHAIR_DEFAULT()` |
+| `cli-handlers-council.js` |  | `handleCouncil()` |
+| `cli-handlers-doctor.js` |  | `runDoctorChecks()`, `handleDoctor()`, `MAX_CATALOG_AGE_MS()` |
+| `cli-handlers-fanout.js` | CLI handler for the fanout command (multi-model parallel runs). | `handleFanout()` |
+| `cli-handlers-init.js` | `amicus init [--claude] [--desktop] [--json]` (v4.2 §4.8, C2). Re-runs the | `handleInit()` |
+| `cli-handlers-key-local.js` | amicus key <localId> — bearer lifecycle for a config-defined local / | `handleLocalKey()`, `formatLocalKeyList()`, `maskKey()` |
+| `cli-handlers-pack.js` |  | `handlePack()` |
+| `cli-handlers-provider.js` | `amicus provider add|list|test|remove` (v4.2 §4.6): configure local / | `handleProvider()`, `isLoopbackUrl()`, `isPlaintextRemote()` |
+| `cli-handlers-resume-continue.js` | CLI Resume/Continue Handlers (B21-rest extraction) | `handleResume()`, `handleContinue()` |
+| `cli-handlers-run.js` | CLI Run Handlers (WS-2 extraction) | `handleStart()`, `handleFanout()`, `handleRead()` |
+| `cli-handlers-spend.js` |  | `handleSpend()`, `aggregateSpend()`, `buildSpendDoc()`, `parseSinceDays()`, `filterRows()` |
+| `cli-handlers-status.js` | `amicus status <task_id>` — one-shot human/JSON status for a session or wave. | `handleStatus()`, `formatRunHuman()`, `formatWaveHumanStatus()`, `formatCouncilHuman()` |
+| `cli-handlers-template.js` |  | `handleTemplate()` |
+| `cli-handlers-watch.js` |  | `handleWatch()`, `resolveWatchTarget()` |
+| `cli-handlers.js` | CLI Command Handlers | `handleSetup()`, `handleAbort()`, `handleUpdate()`, `handleMcp()`, `handleKey()` |
+| `cli-template-args.js` |  | `applyTemplateForArgs()`, `NEEDS_TEMPLATE_MSG()` |
+| `cli.js` | CLI Argument Parser | `parseArgs()`, `validateStartArgs()`, `getUsage()`, `getCommandNames()`, `getBooleanFlags()` |
+| `conflict.js` | File Conflict Detection Module | `detectConflicts()`, `formatConflictWarning()` |
+| `context-compression.js` | Context Compression Module | `compressContext()`, `estimateTokenCount()`, `buildPreamble()`, `DEFAULT_TOKEN_LIMIT()` |
+| `context.js` | Context Filtering Module | `filterContext()`, `parseDuration()`, `estimateTokens()`, `takeLastNTurns()` |
+| `drift.js` | Context Drift Detection Module | `calculateDrift()`, `formatDriftWarning()`, `countTurnsSince()`, `isDriftSignificant()` |
+| `environment.js` | Environment Detection Module | `inferClient()`, `getSessionRoot()`, `detectEnvironment()`, `VALID_CLIENTS()` |
+| `headless.js` | Headless Mode Runner | `runHeadless()`, `waitForServer()`, `withTimeout()`, `extractSummary()`, `findTrailingFoldMarker()` |
+| `index.js` | Amicus - Main Module | `startAmicus()`, `listAmicus()`, `resumeAmicus()`, `continueAmicus()`, `readAmicus()` |
+| `jsonl-parser.js` | JSONL Parser | `parseJSONLLine()`, `readJSONL()`, `extractTimestamp()`, `formatMessage()`, `formatContext()` |
+| `mcp-council-awareness.js` |  | `subWaveIds()`, `countWaveLegs()`, `elapsedOf()`, `enginePid()`, `buildCouncilStatusPayload()` |
+| `mcp-council-bench.js` |  | `resolveBenchInput()`, `auditBenchAliases()` |
+| `mcp-council-run.js` |  | `handleCouncilRunTool()`, `COUNCIL_PACK_PARAM_MAP()`, `buildCouncilStatusPayload()`, `listCouncilRuns()`, `abortCouncilRun()` |
+| `mcp-notify.js` | Pure helpers + in-process registry for the MCP `onComplete: 'mcp-notify'` | `validateOnComplete()`, `buildNotifyPayload()`, `requestMcpNotify()`, `consumeMcpNotify()` |
+| `mcp-server.js` | @module mcp-server — Amicus MCP Server (stdio transport) | `handlers()`, `startMcpServer()`, `getProjectDir()`, `resolveProjectDir()`, `getClientRoot()` |
+| `mcp-spend.js` |  | `amicus_spend()`, `buildSpendResult()` |
+| `mcp-tools.js` | MCP Tool Definitions for Amicus | `getTools()`, `getGuideText()`, `safeTaskId()`, `safeModel()` |
+| `mcp-wait.js` | Engine for the amicus_wait MCP tool: blocks inside one tool call until a session/wave reaches a terminal state or the wait window closes. | `runWait()`, `registerInProcessRun()`, `settleInProcessRun()`, `hasInProcessRun()`, `clampTimeout()` |
+| `opencode-client.js` | OpenCode SDK Client Wrapper | `INSUFFICIENT_CREDITS_REASON()`, `providerErrorReason()`, `parseModelString()`, `createClient()`, `createSession()` |
+| `project-root-allowlist.js` | The MCP `project` / cwd input becomes the session-store parent AND the spawned | `isAllowedProjectRoot()`, `isPathInside()`, `allowedRoots()` |
+| `prompt-builder.js` | System Prompt Builder | `buildSystemPrompt()`, `buildPrompts()`, `buildEnvironmentSection()`, `getSummaryTemplate()`, `SUMMARY_TEMPLATE()` |
+| `session-manager.js` | Session Manager Module | `createSession()`, `updateSession()`, `getSession()`, `saveConversation()`, `saveSummary()` |
+| `session.js` | Session Resolver | `encodeProjectPath()`, `getSessionDirectory()`, `getSessionId()`, `resolveSession()` |
+| `spend-query.js` |  | `filterRows()`, `groupRows()`, `computeWasted()`, `emptyTokens()`, `addTokens()` |
+| `council/anonymize.js` |  | `assignLabels()`, `toGlobalId()`, `toGlobalFindings()`, `rankingToOrder()`, `LETTERS()` |
+| `council/briefings-chair-task.js` |  | `CHAIR_ANSWER_VALUES()`, `ANSWER_SCALE_ADDENDUM()`, `TASK_CHAIR_SYNTHESIS()`, `TASK_CHAIR_SYNTHESIS_NO_CLAIMS()`, `TASK_CONCURRENCE_CAVEAT()` |
+| `council/briefings-chair.js` |  | `dateLine()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `chairRepairPromptFor()`, `CHAIR_VERDICT_VALUES()`, `VERDICT_SCALE_ADDENDUM()` |
+| `council/briefings-debate.js` |  | `DEBATE_NO_TOOLS_PREAMBLE()`, `DEFENSE_CONTRACT()`, `REVOTE_CONTRACT()`, `buildDefenseBrief()`, `buildRevoteBundle()` |
+| `council/briefings-stage2-task.js` |  | `TASK_JUDGE_FRAME()`, `TASK_JUDGE_A()`, `TASK_JUDGE_B()`, `TASK_JUDGE_B_NO_CLAIMS()`, `NO_CLAIMS_INDEX()` |
+| `council/briefings-stage2.js` |  | `JUDGE_NO_TOOLS_PREAMBLE()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `CHAIR_VERDICT_VALUES()`, `JUDGE_OUTPUT_CONTRACT()`, `VERDICT_SCALE_ADDENDUM()` |
+| `council/briefings-task.js` |  | `TASK_ANTI_SYCOPHANCY_CLAUSE()`, `TASK_FINDINGS_JSON_SHAPE()`, `TASK_FINDINGS_CONTRACT()`, `buildTaskSeatBriefing()`, `buildTaskCriticBriefing()` |
+| `council/briefings.js` |  | `ANTI_SYCOPHANCY_CLAUSE()`, `FINDINGS_CONTRACT()`, `FINDINGS_JSON_SHAPE()`, `FINDINGS_TWO_PART_FRAMING()`, `buildSeatBriefing()` |
+| `council/chair-fallback.js` |  | `pickFallbackChair()`, `classifyChairAttempt()` |
+| `council/debate.js` |  | `applyDebate()`, `decorateRecord()`, `debateRunStatsRows()`, `PAST_TENSE()`, `DEBATE_ROLES()` |
+| `council/findings.js` |  | `validateFindings()`, `buildValidateDoc()`, `SEVERITIES()`, `lastJsonBlock()`, `countAttemptedFindings()` |
+| `council/ledger-join.js` |  | `benchLegs()`, `credFor()`, `splitFindingsBySeat()`, `meanCred()` |
+| `council/ledger-stats.js` |  | `LEDGER_FILE()`, `readRows()`, `avg()`, `countRuns()`, `deriveReliability()` |
+| `council/ledger.js` |  | `buildLedgerRows()`, `appendRun()`, `deriveReliability()`, `buildStatsDoc()`, `LEDGER_FILE()` |
+| `council/parse-stage2.js` |  | `parseJudgeOutput()`, `parseChairVerdict()`, `CHAIR_VERDICTS()`, `JUDGE_VERDICTS()`, `parseChairAnswer()` |
+| `council/peer-split.js` |  | `peersOf()`, `unattributedPeerDrops()` |
+| `council/presets-cli.js` |  | `runSave()`, `runList()`, `runShow()` |
+| `council/report-cost.js` |  | `buildCostModel()` |
+| `council/report-html.js` |  | `renderHtml()` |
+| `council/report-md.js` |  | `renderMd()` |
+| `council/report.js` |  | `buildReport()`, `toModel()`, `TIER_ORDER()`, `SYMBOL()`, `isSeatSpace()` |
+| `council/run-assemble.js` |  | `buildRunStatsEntry()`, `worseConformance()`, `buildTallyInput()`, `writeTallyFiles()`, `writeVerdictFiles()` |
+| `council/run-budget.js` |  | `createBudget()` |
+| `council/run-chair.js` |  | `runChair()`, `pickFallbackChair()`, `classifyChairAttempt()` |
+| `council/run-debate-revote.js` |  | `legOpts()`, `legRow()`, `runRevoteWave()` |
+| `council/run-debate-stage.js` |  | `runDebateStage()` |
+| `council/run-debate.js` |  | `runDebate()`, `nothingToDebate()`, `disputingJudges()`, `debateTargets()` |
+| `council/run-degrade.js` |  | `createDegradeSink()` |
+| `council/run-finalize.js` |  | `statusForExit()`, `resolveTerminalExit()`, `writeRunTerminal()`, `SIGNAL_EXIT()` |
+| `council/run-finish.js` |  | `finishRun()` |
+| `council/run-launch.js` |  | `createLaunchers()`, `materializeReviews()`, `materializeDebate()`, `sanitizeName()`, `isAbortExit()` |
+| `council/run-retry-group.js` |  | `lensIndexOf()`, `recordFailure()`, `groupStage1Losses()`, `planStillDeadSources()`, `seatKey()` |
+| `council/run-retry-keys.js` |  | `seatKey()`, `twinAliases()`, `legLossKey()`, `srcLegClaimer()` |
+| `council/run-retry-launch.js` |  | `briefingFor()`, `bindRetryWave()` |
+| `council/run-retry-notes.js` |  | `waveStillDeadNote()`, `skippedWaveNote()`, `srcLegStillDeadNote()`, `retryLegStillDeadNote()`, `missingLegStillDeadNote()` |
+| `council/run-retry-window.js` | The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay | `retryBackstopMs()` |
+| `council/run-retry.js` |  | `groupStage1Losses()`, `retryStage1Losses()` |
+| `council/run-server.js` |  | `acquireRunServer()`, `releaseRunServer()`, `resolveRunServerModels()`, `recordServerFate()` |
+| `council/run-stage1-launch.js` | Stage-1 launch pass for the council engine. | `launchStage1()` |
+| `council/run-stage1-rows.js` |  | `pushDeadSeatRows()`, `supersededRows()` |
+| `council/run-stage1-superseded.js` |  | `supersededRows()` |
+| `council/run-stage2.js` |  | `runStage2()` |
+| `council/run-stages.js` |  | `runStage1()`, `runStage2()`, `isAbortExit()`, `slug()`, `roleFor()` |
+| `council/run-state.js` |  | `RUN_FILE()`, `readRun()`, `initRun()`, `initCouncilRun()`, `checkpoint()` |
+| `council/run-stats-entry.js` |  | `buildRunStatsEntry()` |
+| `council/run-verdict-files.js` |  | `writeVerdictFiles()` |
+| `council/run.js` |  | `runCouncil()`, `pickFallbackChair()`, `SIGNAL_EXIT()` |
+| `council/seats.js` |  | `buildSeats()`, `roleAt()`, `bindSeats()`, `artifactName()`, `displayName()` |
+| `council/stage1-bind.js` |  | `bindStage1Waves()`, `orphanLegNote()`, `missingSeatDeadWave()`, `bindPaddedWave()` |
+| `council/street-cred.js` |  | `computeStreetCred()`, `rankPositions()`, `credSeats()` |
+| `council/tally.js` |  | `assignTier()`, `computeStreetCred()`, `tally()`, `COUNCIL_SCHEMA_VERSION()` |
+| `council/verdict-seat-loss.js` |  | `summarizeSeatLoss()`, `deriveSeatLoss()` |
+| `council/verdict-seats-reviewed.js` | #202: the bench-seat census for verdict.json, as a spreadable fragment. | `seatsReviewedOf()` |
+| `council/verdict.js` |  | `buildVerdict()`, `summarizeSeatLoss()`, `deriveSeatLoss()`, `readOverallVerdict()`, `readPriorVerdictSurfaces()` |
+| `design/tokens.js` |  | `tokenCss()`, `TOKENS()` |
+| `observe/council-legs.js` |  | `buildLegRows()` |
+| `observe/events.js` |  | `appendEvent()`, `createEventTail()`, `EVENTS_FILE()`, `EVENTS_SCHEMA_VERSION()`, `emitWaveStarted()` |
+| `observe/follow.js` |  | `createFollowPrinter()` |
+| `observe/live-doc.js` |  | `enrichLegUsage()`, `markLive()`, `rollupWaveUsage()`, `TERMINAL()` |
+| `observe/on-complete.js` |  | `buildHookEnv()`, `runOnComplete()`, `fireWaveOnComplete()`, `fireCouncilOnComplete()`, `HOOK_TIMEOUT_MS()` |
+| `observe/watch-render.js` |  | `renderTable()`, `renderPlainLines()`, `mapExitCode()`, `emitJsonChange()`, `runWatchLoop()` |
+| `pack/pack-cli.js` |  | `applyPackOrExit()` |
+| `pack/pack-forward.js` |  | `prepareForward()` |
+| `pack/pack-resolve.js` |  | `applyPackToArgs()`, `applyPackToMcpInput()` |
+| `pack/pack-store.js` |  | `packsDir()`, `canonicalHash()`, `resolvePackRef()`, `readPack()`, `writePack()` |
+| `pack/pack-validate.js` |  | `validatePack()`, `KIND_OPTIONS()`, `KINDS()` |
+| `prompts/cowork-agent-prompt.js` | Cowork Agent Prompt | `buildCoworkAgentPrompt()` |
+| `sidecar/budget.js` |  | `checkBudget()`, `formatBudgetError()`, `DEFAULT_MAX_COST_PER_MTOK()`, `ASSUMED_OUTPUT_TOKENS()` |
+| `sidecar/child-sessions.js` |  | `collectSubtreeUsage()`, `subtreeIsUnknown()`, `SUBTREE_MAX_DEPTH()`, `SUBTREE_MAX_SESSIONS()` |
+| `sidecar/context-builder.js` | Context Builder Module | `buildContext()`, `parseDuration()`, `resolveSessionFile()`, `applyContextFilters()`, `findCoworkSession()` |
+| `sidecar/continue.js` | Sidecar Continue Operations - Handles continuing from previous sessions | `loadPreviousSession()`, `buildContinuationContext()`, `createContinueSessionMetadata()`, `continueSidecar()` |
+| `sidecar/conversation-mirror.js` |  | `createMirrorState()`, `mirrorMessages()`, `logMessage()`, `mirrorUsageOnly()`, `allAssistantUsagePresent()` |
+| `sidecar/crash-handler.js` | Crash Handler - Updates metadata to 'error' on uncaught exceptions | `installCrashHandler()` |
+| `sidecar/electron-cache.js` | Electron download-cache root resolution (#53 helper). | `resolveCacheRoots()`, `defaultCacheRoot()` |
+| `sidecar/electron-ensure.js` | ensureElectron() — lazy first-GUI provisioning (#55). | `ensureElectron()`, `_resetEnsureElectron()` |
+| `sidecar/electron-install.js` | Electron self-heal primitive (#53, #59). | `resolveElectronBinary()`, `isElectronUsable()`, `cachedZip()`, `repairElectron()`, `platformExe()` |
+| `sidecar/electron-lock.js` | Stale-aware single-flight lock for the electron self-heal (#53). | `acquireRepairLock()`, `isStaleLock()`, `lockPathFor()`, `STALE_MS()` |
+| `sidecar/electron-provision.js` | Electron CONTROLLED provision — the pinned download, and what happens to a | `cacheRootFor()`, `controlledProvision()`, `mayDeleteRejectedZip()`, `rejectCachedZip()`, `isUnsafeArchive()` |
+| `sidecar/electron-quarantine.js` | AV / antivirus quarantine detection for the electron self-heal (#53). | `avHint()`, `quarantineReason()`, `verifyExtractOutcome()` |
+| `sidecar/electron-state.js` | Electron install-state probes (#76). | `electronDirFor()`, `probeElectronState()` |
+| `sidecar/electron-trust.js` | Electron artifact TRUST core — the digest anchor, the gate, and the env scrub. | `electronTrustPolicy()`, `resolveAnchor()`, `expectedDigest()`, `verifyArtifact()`, `sha256File()` |
+| `sidecar/fallback-chains.js` |  | `resolveFallbackConfig()`, `deriveChain()`, `vendorOf()`, `DEFAULT_MAX_SUBSTITUTIONS()` |
+| `sidecar/fanout-budget.js` |  | `preflightBudget()` |
+| `sidecar/fanout-leg-fallback.js` |  | `runLegWithFallback()`, `recordAttemptSpend()`, `sumAttemptUsage()` |
+| `sidecar/fanout-leg.js` |  | `legStatusFromResult()`, `writeLegPatch()`, `runLeg()`, `buildRoutingFailureLeg()`, `runSingleAttempt()` |
+| `sidecar/fanout-output.js` |  | `formatWaveHuman()`, `fmtDuration()` |
+| `sidecar/fanout-retry.js` |  | `ELIGIBLE_RETRY()`, `parseInitialContext()`, `buildRetryPlan()`, `retryFailedWave()` |
+| `sidecar/fanout-signals.js` |  | `installWaveAbort()`, `WAVE_FORCE_EXIT_MS()` |
+| `sidecar/fanout-validate.js` |  | `parseModelsList()`, `DEFAULT_MAX_LEGS()`, `validateFanoutModels()` |
+| `sidecar/fanout-wave-io.js` |  | `writeWaveMetadata()`, `writeWaveDoc()`, `finishWave()`, `stampLegAttribution()` |
+| `sidecar/fanout.js` |  | `parseModelsList()`, `deriveLegIds()`, `validateFanoutModels()`, `DEFAULT_MAX_LEGS()`, `runFanout()` |
+| `sidecar/interactive-abort.js` |  | `startAbortWatch()`, `markResultAborted()`, `readAbortedMarker()`, `DEFAULT_INTERVAL_MS()` |
+| `sidecar/interactive-mirror.js` |  | `startInteractiveMirror()` |
+| `sidecar/interactive-process.js` | Sidecar Interactive Process Helpers - Electron probe/env/process-exit plumbing | `getElectronPath()`, `checkElectronAvailable()`, `buildElectronEnv()`, `handleElectronProcess()` |
+| `sidecar/interactive.js` | Sidecar Interactive Mode - Electron GUI session management | `runInteractive()` |
+| `sidecar/leg-ids.js` |  | `deriveLegIds()` |
+| `sidecar/list-council.js` | Council rows on the CLI `amicus list` surface (v4.9 W12). | `padModel()`, `modelCell()`, `mergeCouncilRows()`, `councilScopeNotice()` |
+| `sidecar/list-limit.js` | The `--limit` core behind `amicus list` (v4.7 PR3 rider). | `normalizeLimit()`, `truncationNotice()` |
+| `sidecar/list-search.js` | The `--search` core behind both list surfaces (F8 D15, errata E-PR3-5). | `searchSessions()` |
+| `sidecar/models-ceiling-line.js` | The one `Ceilings:` line `amicus models --refresh` prints (#218 P3). | `fmtCeilingLine()` |
+| `sidecar/models-probe.js` |  | `probeStoredAliases()`, `selectStoredAliases()`, `PROBE_WINDOW_MS()`, `PROBE_PROMPT()` |
+| `sidecar/models-render.js` | Presentation helpers for `amicus models` -- pure string formatting, no I/O. | `perMtok()`, `fmtRow()`, `fmtGatewayFinding()`, `PROBE_LABELS()`, `fmtProbeCost()` |
+| `sidecar/models.js` | `amicus models` (F5) — list/search the catalog, refresh it, audit aliases. | `handleModels()`, `buildFallbackDriftReport()` |
+| `sidecar/progress-fields.js` | Derived, agent-facing progress fields shared by the MCP status/list | `sanitizePreview()`, `latestAssistantPreview()`, `deriveStage()`, `COARSE_STAGES()`, `TERMINAL_PROGRESS_STAGES()` |
+| `sidecar/progress.js` | Sidecar Progress Reader | `readProgress()`, `writeProgress()`, `writeTerminalProgressSafe()`, `extractLatest()`, `computeLastActivity()` |
+| `sidecar/read.js` | Sidecar Read Operations Module | `formatAge()`, `enumerateSessions()`, `enumerateAllProjects()`, `searchSessions()`, `listSidecars()` |
+| `sidecar/reopen-notices.js` | The stderr Notice a reopen owes the user for the effort level it does NOT carry (#218 PR 4, council #235 r5 J1/A3). | `formatDroppedLevelNotice()`, `noticeDroppedLevel()` |
+| `sidecar/reopen-spend.js` | Spend finalization for a REOPENED session (continue/resume). Split out of | `finalizeSpendForReopen()` |
+| `sidecar/resume.js` | Sidecar Resume Operations - Handles resuming previous sidecar sessions | `loadSessionMetadata()`, `loadInitialContext()`, `checkFileDrift()`, `buildDriftWarning()`, `buildResumeUserMessage()` |
+| `sidecar/session-finalize.js` |  | `resolveTerminalState()`, `finalizeHeadlessResult()` |
+| `sidecar/session-utils.js` | Sidecar Session Utilities - Shared functionality for session management | `HEARTBEAT_INTERVAL()`, `SessionPaths()`, `saveInitialContext()`, `finalizeSession()`, `outputSummary()` |
+| `sidecar/setup-local.js` | The readline setup wizard's local / self-hosted provider add step (v4.2 §4.6, Task 12). | `addLocalProviderInteractive()` |
+| `sidecar/setup-window.js` | Setup Window Launcher | `launchSetupWindow()` |
+| `sidecar/setup.js` | Sidecar Setup Wizard | `addAlias()`, `addLocalProviderInteractive()`, `createDefaultConfig()`, `deriveFreeAlias()`, `detectApiKeys()` |
+| `sidecar/start-metadata.js` |  | `createSessionMetadata()` |
+| `sidecar/start.js` | Sidecar Start Operations - Handles starting new sidecar sessions | `generateTaskId()`, `createSessionMetadata()`, `buildMcpConfig()`, `checkElectronAvailable()`, `runInteractive()` |
+| `sidecar/tool-part.js` |  | `TERMINAL_TOOL_STATUSES()`, `LIVE_TOOL_STATUSES()`, `isToolPart()`, `toolPartName()`, `toolPartInput()` |
+| `sidecar/unzip.js` | Robust unzip for the electron self-heal (#53 follow-up; extract-zip-node24). | `robustExtract()`, `nativeUnzipPlan()`, `IDLE_MS()`, `MAX_MS()` |
+| `sidecar/wave-progress.js` |  | `formatWaveProgress()`, `readLegState()`, `createWaveHeartbeat()`, `WAVE_HEARTBEAT_INTERVAL()` |
+| `sidecar/workspace-auto-open.js` | Workspace Auto-Open Decision Helper | `shouldAutoOpenWorkspace()` |
+| `sidecar/workspace-window.js` | Council Workspace launcher (v4.4 §4.3/§4.4) — setup-window.js pattern: | `launchWorkspaceWindow()`, `launchWorkspaceWindowDetached()` |
+| `template/apply.js` |  | `applyTemplate()`, `ARTIFACT_CAP_BYTES()` |
+| `template/render.js` |  | `renderTemplate()`, `KNOWN_VARIABLES()` |
+| `template/store.js` |  | `templatesDir()`, `resolveTemplate()`, `listTemplates()`, `BUILTIN_TEMPLATES()` |
+| `utils/abort-coordinator.js` |  | `abortGraceMs()`, `isAlive()`, `killPidBestEffort()`, `killPidHard()`, `waitThenKill()` |
+| `utils/abort-result.js` | The abort-result document builder for `abort <taskId|--all> --json` (B21-rest). | `buildAbortResult()` |
+| `utils/activity-poller.js` |  | `createActivityPoller()`, `killIfAlive()` |
+| `utils/agent-mapping.js` | Agent Mapping Module | `PRIMARY_AGENTS()`, `OPENCODE_AGENTS()`, `HEADLESS_SAFE_AGENTS()`, `mapAgentToOpenCode()`, `isValidAgent()` |
+| `utils/alias-audit.js` | Alias Audit (F5) — report + suggest for most classes; doctor --fix auto-repairs one narrow, mechanically-unambiguous class (B3). | `collectAliasSources()`, `findStaleAliases()`, `findDriftedStoredAliases()`, `suggestReplacements()`, `findFabricatedAliasRepairs()` |
+| `utils/alias-resolver.js` | Alias Resolver Utilities | `autoRepairAlias()` |
+| `utils/alias-shadow-writer.js` | The alias-shadow notice's WRITE half: say it without ever sinking the run. | `safeWrite()`, `armStream()`, `writeNoticeToStderr()` |
+| `utils/alias-shadow.js` | Alias-shadow self-diagnosis — name a local alias that repoints a curated one. | `findAliasShadows()`, `formatAliasShadow()`, `noteAliasShadows()`, `auditAliasShadows()` |
+| `utils/api-key-store.js` | API Key Store — reading, saving, and validating API keys. | `getEnvPath()`, `loadEnvEntries()`, `readApiKeys()`, `readApiKeyHints()`, `readApiKeyValues()` |
+| `utils/api-key-validation.js` | API Key Validation — test API keys against provider endpoints. | `validateApiKey()`, `redactSecret()`, `validateOpenRouterKey()`, `checkOpenRouterCredit()`, `OPENROUTER_NO_CREDIT_WARNING()` |
+| `utils/atomic-write.js` | Atomic file write helper. | `writeFileAtomic()` |
+| `utils/auth-json.js` | Auth JSON Reader | `readAuthJsonKeys()`, `importFromAuthJson()`, `checkAuthJson()`, `removeFromAuthJson()`, `AUTH_JSON_PATH()` |
+| `utils/base-url-classify.js` | v4.6.2 PR1 (spec §4, D1/D2): ANTHROPIC_BASE_URL classification, the | `classifyBaseUrl()`, `resolveBaseUrlOverride()`, `announceBaseUrlNormalizationOnce()`, `_resetBaseUrlNotice()` |
+| `utils/claude-register.js` | Registration core for amicus: skill install (chat skill + LLM Council), | `MCP_CONFIG()`, `addMcpToConfigFile()`, `installSkill()`, `installCouncilSkill()`, `readPrevClaudeCodeAmicusEntry()` |
+| `utils/cli-preflight.js` | Tiny shared preflight guards used by more than one CLI run handler | `requireNoUiForJson()`, `requireValidTaskId()`, `packSaveVersionConflict()` |
+| `utils/client-detect.js` | Detects which caller (Claude Code vs. Cowork/Claude Desktop) spawned this | `detectClient()`, `matchClientName()` |
+| `utils/config.js` | Amicus Config Module | `getConfigDir()`, `getConfigPath()`, `loadConfig()`, `saveConfig()`, `getDefaultAliases()` |
+| `utils/council-presets.js` | Built-in council benches (B23). | `BUDGET_ALIASES()`, `FRONTIER_ALIASES()`, `resolveBuiltinCouncil()`, `listBuiltinCouncilNames()` |
+| `utils/curated-models.js` | Family definitions + pinned fallbacks for the wizard model picker (v2). | `getFamilies()`, `toDefaultAliases()`, `stripGatewayPrefix()`, `listCuratedRoutes()`, `toGatewayRoutes()` |
+| `utils/degrade.js` |  | `makeDegrade()`, `formatDegrade()`, `DEGRADE_CHANNELS()` |
+| `utils/doctor-alias-check.js` |  | `evaluateAliasesCheck()`, `repairAlias()` |
+| `utils/doctor-base-url-check.js` | v4.6.2 PR1 (spec §4): the 'anthropic-base-url' doctor row. | `evaluateAnthropicBaseUrl()` |
+| `utils/doctor-credit-check.js` | The `openrouter-credit` doctor row (#43), split out of | `evaluateOpenRouterCredit()` |
+| `utils/doctor-degrade.js` |  | `collectDoctorDegrades()` |
+| `utils/doctor-electron-mcp-check.js` | The `electron-mcp` doctor check ("Electron (MCP launch path)"), split out of | `scanElectronInstalls()`, `evaluateElectronInstalls()`, `evaluateElectronMcp()`, `evaluateElectronInteractive()` |
+| `utils/doctor-engine-check.js` | The `engine-mcp` doctor check ("OpenCode engine (MCP launch path)"), split out | `evaluateEngineInstalls()`, `evaluateEngineMcp()` |
+| `utils/doctor-key-auth-check.js` | The `key-auth` doctor row (issue #210), split out of src/cli-handlers-doctor.js | `evaluateKeyAuth()`, `classifyProbeFailure()`, `probeApiKey()`, `probeOpenRouterCredit()`, `liveProbesDisabled()` |
+| `utils/doctor-local-providers-check.js` | The `local-providers` doctor check (v4.2 §4.7 C8), split out of | `evaluateLocalProviders()` |
+| `utils/doctor-mcp-checks.js` | B14/Task 4.3: the two MCP-registration doctor checks ('mcp' and | `evaluateMcpRegistration()`, `evaluateLegacyMcpEntry()` |
+| `utils/doctor-output-budget-check.js` | #218 PR 2: the 'output-budget' doctor row. | `evaluateOutputBudget()` |
+| `utils/doctor-summary.js` | Compact doctor summary (v4.2 §4.7 C8). All-ok -> one line; otherwise the | `summarizeDoctor()` |
+| `utils/engine-ensure.js` | ensureEngine() — runtime engine self-heal at server start (report #2). | `ensureEngine()`, `_resetEnsureEngine()` |
+| `utils/engine-install-scan.js` | Discover + probe every amicus install that could serve the MCP (running, | `listAmicusInstalls()`, `scanEngineInstalls()`, `classifyLaunch()`, `resolveNpmRootG()` |
+| `utils/engine-lock.js` | Stale-aware single-flight lock for the engine self-heal (report #2). | `acquireRepairLock()`, `isStaleLock()`, `lockPathFor()`, `STALE_MS()` |
+| `utils/engine-log-parse.js` | Line-shape parsing for the engine log: level, session, message. | `isErrorLine()`, `extractMessage()`, `collapseExcerpt()`, `mentionsSession()`, `lineIsAboutSession()` |
+| `utils/engine-log-tail.js` | One engine-log FILE: read its tail, find the newest usable excerpt in it. | `newestExcerptInFile()` |
+| `utils/engine-log.js` | Resolve the OpenCode engine's own error line for one session. | `engineErrorForSession()`, `engineLogDirCandidates()`, `isErrorLine()`, `extractMessage()`, `collapseExcerpt()` |
+| `utils/engine-output-flag.js` | #218 PR 2 — the one engine env flag amicus sets: OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX. | `withOutputTokenFlag()`, `outputTokenFlagValue()`, `OUTPUT_TOKEN_FLAG()`, `ENGINE_DEFAULT_OUTPUT_TOKENS()`, `PLAIN_OUTPUT_TOKEN_FLAG()` |
+| `utils/engine-repair.js` | Engine self-heal primitive (report #2): make the opencode engine present ON | `repairEngine()`, `findDonor()`, `engineSourceRoot()`, `copyEnginePackages()`, `runningPkgDir()` |
+| `utils/engine-skew-records.js` | Server identity and the bounded store of standing engine-skew records. | `serverKeyForClient()`, `currentEngineSkew()`, `skewForKey()`, `rememberSkew()`, `forgetSkew()` |
+| `utils/engine-skew.js` | Runtime detection of an opencode ENGINE version skew: server vs installed. | `noteSessionVersion()`, `currentEngineSkew()`, `serverKeyForClient()`, `formatSkewWarning()`, `formatSkewSuffix()` |
+| `utils/engine-variants.js` | The effort lever (#218 PR 4): --thinking sent as the engine's variant field, validated against the engine's own declaration. | `VARIANT_LEVELS()`, `VariantRefusedError()`, `readModelDeclaration()`, `checkVariant()`, `formatUnverifiedVariantNote()` |
+| `utils/env-loader.js` | Credential Loader | `loadCredentials()` |
+| `utils/env-num.js` |  | `envNumber()` |
+| `utils/env-raw-store.js` | Arbitrary-env-var writes to the amicus .env (local-provider bearers, v4.2 §4.6). | `saveRawEnv()`, `removeRawEnv()`, `upsertEnvLine()`, `deleteEnvLine()` |
+| `utils/error-classify.js` |  | `classifyLegError()`, `isRetryable()` |
+| `utils/error-doc.js` |  | `ERROR_CODES()`, `buildErrorDoc()`, `failJson()` |
+| `utils/fold-marker.js` | Fold marker construction/parsing helpers — shared by prompt-builder.js | `FOLD_MARKER_PREFIX()`, `generateFoldNonce()`, `buildFoldMarker()`, `trailingFoldMarkerRegex()`, `extractNonceFromText()` |
+| `utils/format-duration.js` |  | `formatDuration()` |
+| `utils/free-models.js` | Free OpenRouter model detection (Unit A). | `isFreeModel()`, `listFreeModels()`, `suggestFreeCouncil()`, `PINNED_FREE_MODELS()` |
+| `utils/gateway-route-audit.js` | Per-gateway-form audit for curated DEFAULT aliases (Task 6, #gwid). | `auditGatewayRoutes()` |
+| `utils/gateway-route-catalog.js` | Conservative cross-gateway catalog pairing helper (Task 5, #gwid). | `pairAcrossGateways()` |
+| `utils/gateway-router.js` | Pure gateway router (#61). Decides direct vs OpenRouter for a request using | `gatewayOf()`, `resolveRoute()` |
+| `utils/http-get.js` | One HTTPS GET, always resolved, never rejected — the timer/destroy/failure | `httpGetText()`, `getJson()`, `DEFAULT_TIMEOUT_MS()`, `DEFAULT_MAX_BYTES()`, `MAX_REDIRECTS()` |
+| `utils/idle-watchdog.js` | IdleWatchdog - BUSY/IDLE state machine with self-terminating timer. | `IdleWatchdog()`, `resolveTimeout()` |
+| `utils/input-validators.js` |  | `validateStartInputs()`, `levenshteinDistance()`, `suggestCommand()` |
+| `utils/known-flags.js` |  | `getKnownFlags()`, `unknownFlags()`, `INTERNAL_FLAGS()` |
+| `utils/legacy-mcp-migration.js` |  | `claudeCodeConfigPath()`, `claudeDesktopConfigPath()`, `inspectLegacySidecarEntry()`, `removeLegacySidecarEntry()`, `inspectAllLegacySidecarEntries()` |
+| `utils/lifecycle.js` |  | `isOneShotCommand()`, `armExitWatchdog()`, `exitReaping()`, `ONE_SHOT_COMMANDS()` |
+| `utils/live-probes.js` | The single gate on outbound AUTHENTICATED network probes made by diagnostics | `enableLiveProbes()`, `liveProbesAllowed()`, `_resetLiveProbes()` |
+| `utils/local-probe.js` |  | `probeLocalProvider()`, `listLocalModels()` |
+| `utils/local-providers.js` |  | `getLocalProviders()`, `isLocalProvider()`, `deriveKeyEnv()`, `validateProviderEntry()`, `resolveLocalRouteInputs()` |
+| `utils/logger.js` | Structured Logger Module | `logger()`, `LOG_LEVELS()` |
+| `utils/mcp-discovery.js` | MCP Discovery - Discovers MCP servers from parent LLM configuration | `discoverParentMcps()`, `discoverClaudeCodeMcps()`, `discoverCoworkMcps()`, `hasAmicusRegistration()`, `readAmicusMcpConfig()` |
+| `utils/mcp-self-identity.js` |  | `SELF_MCP_NAMES()`, `isAmicusMcpConfig()`, `stripSelfMcpEntries()`, `normalizeToken()` |
+| `utils/mcp-validators.js` | MCP Validators | `validateMcpSpec()`, `validateMcpConfigFile()` |
+| `utils/model-canonicalization.js` | Direct-first id canonicalization, guarded by `classifyModel` | `directFormIfSafe()`, `directFormIfProven()`, `namespaceFetchFailed()`, `vendorOfId()` |
+| `utils/model-catalog.js` | OpenRouter model catalog cache (F3 #18 / F5 foundation). | `getCatalog()`, `refreshCatalog()`, `catalogPath()`, `getCatalogInfo()`, `readCache()` |
+| `utils/model-ceilings-modelsdev.js` | #218 P3 — output ceilings for the direct-provider catalog rows. | `enrichCeilings()`, `fillCeilings()`, `needsFillCount()`, `limitsFromModelsDev()`, `emptyOutcome()` |
+| `utils/model-classification.js` | Tri-state catalog classification (#61). | `classifyModel()` |
+| `utils/model-descriptor.js` | Model-descriptor grammar + RouteResult factories (#61). | `GATEWAY_MODES()`, `parseDescriptor()`, `resolved()`, `selectionRequired()`, `routeError()` |
+| `utils/model-fetcher.js` | Model Fetcher | `fetchModelsFromProvider()`, `fetchAllModels()`, `fetchAllModelsDetailed()`, `fetchModelsFromProviderDetailed()`, `providersToFetch()` |
+| `utils/model-input-default.js` |  | `resolveModelInputOrDefault()` |
+| `utils/model-output-limit.js` | Issue #218 — the per-model `limit` descriptor amicus hands opencode. | `normalizeOutputBudget()`, `buildLimitLookup()`, `computeModelLimit()`, `positiveCount()` |
+| `utils/model-shortlist.js` | Vendor model shortlist (#138) -- the family -> model second level. | `buildModelShortlist()`, `compareShortlistRows()`, `SHORTLIST_LIMIT()` |
+| `utils/model-tiers.js` | Per-vendor cost tiers (economy/balanced/frontier) + resolution against the | `TIERS()`, `TIER_ORDER()`, `resolveTier()` |
+| `utils/model-validator.js` | Model Validator | `filterRelevantModels()`, `normalizeModelId()`, `validateAgainstCatalog()`, `warnIfNotInCatalog()`, `promptRouteSelection()` |
+| `utils/no-output-backstop.js` | v4.6.2 PR2 (spec §5, D4): fail a headless leg fast when the model produces | `resolveNoOutputBackstopMs()`, `createNoOutputBackstop()`, `DEFAULT_NO_OUTPUT_BACKSTOP_MS()` |
+| `utils/node-version-guard.js` |  | `checkNodeVersion()`, `MIN_NODE()` |
+| `utils/openrouter-credit.js` | The OpenRouter credit/limit probe, split out of api-key-validation.js to keep | `checkOpenRouterCredit()`, `OPENROUTER_NO_CREDIT_WARNING()`, `OPENROUTER_FREE_TIER_WARNING()` |
+| `utils/output-length.js` | #218 PR 3: name the "Mode 2" death. | `OUTPUT_LENGTH_PREFIX()`, `isOutputLengthDeath()`, `formatOutputLengthReason()` |
+| `utils/path-fence.js` | Shared realpath-containment fence. | `isRealpathContained()`, `containsOnDisk()` |
+| `utils/path-setup.js` |  | `ensureNodeModulesBinInPath()`, `hasOpencodeBinary()`, `opencodeRoots()` |
+| `utils/port-pid.js` | Cross-platform listener-PID lookup. | `findListenerPid()` |
+| `utils/pricing.js` |  | `emptyUsageTotals()`, `sumPerMessageUsage()`, `lookupPricing()`, `hasObservedTokens()`, `resolveLegCost()` |
+| `utils/project-path.js` | Canonical project-path helper. | `canonicalProjectPath()` |
+| `utils/project-root-sanity.js` |  | `assessProjectRoot()`, `looksLikeInstallDir()`, `INSTALL_PATTERNS()` |
+| `utils/prompt-source.js` |  | `resolvePromptSource()` |
+| `utils/provider-default-picker.js` | Provider-default picker core (Part 2, Task 4). | `buildProviderDefaultChoices()`, `applyProviderDefault()`, `pricePerMInputFrom()`, `directFormIfSafe()`, `directFormIfProven()` |
+| `utils/provider-default-prompt.js` | Provider-default prompt flow (Part 2, Task 6/7 shared helper). | `runProviderDefaultFlow()`, `formatPrice()`, `formatRow()` |
+| `utils/provider-registry.js` | Provider-capability registry — the single source of truth for provider | `PROVIDERS()`, `getProvider()`, `isDirectProvider()`, `listDirectProviders()`, `PROVIDER_ENV_MAP()` |
+| `utils/quick-picks.js` | Quick-pick resolution (wizard Step 2) — resolves each curated family to | `compareIdsDesc()`, `canonicalRoutesFor()`, `pickCurrent()`, `resolveQuickPicks()`, `toLiveSeedAliases()` |
+| `utils/read-slice.js` | Byte-bounded slicing for amicus_read (15a.3 / B17). | `sliceForRead()`, `READ_CAP_BYTES()` |
+| `utils/remediation-hints.js` |  |  |
+| `utils/result-schema-rebuild.js` |  | `buildRunResultFromSession()`, `buildWaveResultFromSession()` |
+| `utils/result-schema-version.js` | The single SCHEMA_VERSION constant shared by result-schema.js and | `SCHEMA_VERSION()` |
+| `utils/result-schema.js` |  | `SCHEMA_VERSION()`, `TERMINAL_STATUSES()`, `durationBetween()`, `statusFromResult()`, `buildRunResult()` |
+| `utils/route-error.js` | Shared renderer (#61 Task 6.1): turns a router RouteResult — an error or a | `toStructuredError()`, `toCliMessage()`, `toErrorDocFields()`, `REASON_TEXT()`, `ROUTE_ERROR_REASONS()` |
+| `utils/route-launch.js` | Route-launch views (#61 gateway routing integration, Task 4.2). | `buildLaunchKeys()`, `getRouteCatalogInfo()`, `resolveRouteForLaunch()`, `buildSuggestions()`, `ROUTE_VERSION()` |
+| `utils/route-suggestions.js` |  | `buildSuggestions()`, `applySuggestions()` |
+| `utils/server-setup.js` | Server Setup Utilities | `DEFAULT_PORT()`, `LOCK_RETRY_DELAYS_MS()`, `isPortInUse()`, `getPortPid()`, `killPortProcess()` |
+| `utils/session-abort.js` | Session abort utilities: signal handler installation and terminal metadata writes. | `markTerminal()`, `markAborted()`, `installSignalAbort()`, `idleBackstopTeardown()` |
+| `utils/session-index-prune.js` |  | `listStaleSessionIndexEntries()`, `pruneStaleSessionIndexEntries()`, `evaluateSessionIndexPrune()` |
+| `utils/session-index-tmp-sweep.js` |  | `AGE_THRESHOLD_MS()`, `listSessionIndexTmpFiles()`, `unlinkSessionIndexTmp()`, `evaluateSessionIndexTmpSweep()` |
+| `utils/session-index.js` | Global session index (issue #40). | `INDEX_FILENAME()`, `recordSession()`, `lookupSessionProject()`, `readIndex()` |
+| `utils/session-lock.js` |  | `acquireLock()`, `releaseLock()`, `isLockStale()`, `isPidAlive()` |
+| `utils/session-metadata-tmp-sweep.js` |  | `AGE_THRESHOLD_MS()`, `listSessionMetadataTmpFiles()`, `unlinkSessionMetadataTmp()`, `evaluateSessionMetadataTmpSweep()` |
+| `utils/session-path.js` | Session path resolution. | `safeSessionDir()`, `safeSessionDirUnder()` |
+| `utils/session-status.js` | #202: render the engine's SESSION STATUS as a clause on a leg's death report. | `formatSessionStatusSuffix()`, `MAX_STATUS_MESSAGE_CHARS()` |
+| `utils/shared-server.js` |  | `SharedServerManager()` |
+| `utils/spend-ledger.js` |  | `appendSpend()`, `readSpendRows()`, `SPEND_LEDGER_FILE()`, `SPEND_LEDGER_SCHEMA_VERSION()` |
+| `utils/start-helpers.js` | Start Command Helpers | `resolveLaunchModel()`, `deriveAlias()`, `maybeOfferProviderDefaults()` |
+| `utils/text-sanitize.js` | One third-party string, safe to render: no escapes, no bidi, one short line. | `collapseExcerpt()`, `MAX_EXCERPT_CHARS()` |
+| `utils/thinking-validators.js` | Thinking Level Validators | `VARIANT_LEVELS()`, `validateThinkingLevel()` |
+| `utils/ttft.js` | The one honesty predicate for the time-to-first-token probe (v4.9 W13). | `isMeasuredTtft()` |
+| `utils/untrusted-fence.js` | Untrusted sidecar output fence. | `fenceSidecarOutput()`, `defangOutboundFenceTags()`, `OUTBOUND_FENCE_TAGS()` |
+| `utils/update-notice.js` | The MCP server is the one entry point that skips bin/amicus.js's update | `classifySelfInstall()`, `upgradeInstruction()`, `buildUpdateNotice()`, `maybeAppendUpdateNotice()`, `guideUpdateLine()` |
+| `utils/update-notifier-loader.js` | update-notifier Loader | `loadUpdateNotifier()` |
+| `utils/updater.js` | Updater Module | `initUpdateCheck()`, `getUpdateInfo()`, `notifyUpdate()`, `performUpdate()` |
+| `utils/validators.js` | Input Validators | `VALID_AGENT_MODES()`, `PROVIDER_KEY_MAP()`, `VARIANT_LEVELS()`, `TASK_ID_PATTERN()`, `validateTaskId()` |
+| `utils/version-info.js` | After an `npm i -g amicus` upgrade, a long-lived MCP server process keeps | `RUNNING_VERSION()`, `readOnDiskVersion()`, `versionWarning()`, `PKG_PATH()` |
+| `workspace/artifact-guard.js` | Council Workspace — artifact read guard (v4.4 §4.5 workspace:read-artifact). | `artifactAllowlist()`, `isSeatTable()`, `readRunArtifact()`, `isRealpathContained()`, `FIXED_ARTIFACTS()` |
+| `workspace/artifact-names.js` | Council Workspace — artifact NAME derivation (v4.8 PR5a). | `artifactAllowlist()`, `isSeatTable()`, `orphanExonerations()`, `FIXED_ARTIFACTS()`, `DEBATE_ARTIFACTS()` |
+| `workspace/blind-mode.js` | Council Workspace — blind-mode name mapping (v4.4 §6.3). | `buildNamePairs()`, `labelFor()`, `pairFor()` |
+| `workspace/fold-format.js` | Council Workspace — fold payload builder (v4.4 §7). | `buildFoldText()` |
+| `workspace/live-normalize.js` | Council Workspace — live-doc normalization (v4.4 §3 A1/A2/A4 seam). | `normalizeLive()` |
+| `workspace/matrix-model.js` | Council Workspace — adjudication matrix view model (v4.4 §5.2). | `buildMatrixModel()` |
+| `workspace/run-detail.js` | Council Workspace — run detail: defensive parse of run.json / tally.json / | `getRunDetail()`, `costPanel()`, `TERMINAL_STATUSES()`, `STAGE_LABELS()` |
+| `workspace/run-scan.js` | Council Workspace — run discovery (v4.4 spec §4.3 / §5.1). | `scanCouncilRuns()`, `readPointer()`, `POINTER_RE()` |
+| `workspace/seat-space.js` | Council Workspace — the seat-space PREDICATES (v4.8 PR5b). | `isSeatTable()`, `orphanExonerations()` |
+<!-- /AUTO:modules -->
+
+---