amicus 4.9.7 → 4.10.0

package/docs/council.md

@@ -22,6 +22,7 @@ orchestration recipe. This page is the reference for the artifacts that recipe p
 - [The pipeline, end to end](#the-pipeline-end-to-end)
 - [`amicus council run`](#amicus-council-run)
   - [Task mode (`--intent task`)](#task-mode---intent-task)
+  - [Tool access per usage (`--tools`)](#tool-access-per-usage---tools)
   - [Debate mode](#debate-mode)
 - [Council Workspace (GUI)](#council-workspace-gui)
   - [Auto-open on `amicus_council_run` (v4.5)](#auto-open-on-amicus_council_run-v45)
@@ -114,6 +115,7 @@ amicus council run --prompt-file <briefing.md>
     [--template <name|path>] [--artifact <file>] [--var k=v]  # v4.5, see docs/usage.md#briefing-templates
     [--pack <name|path>]                                       # v4.5, see docs/usage.md#policy-packs
     [--intent review|task]                                     # v4.9, see Task mode below
+    [--tools <a,b,c>] [--agent Plan|Build]                    # v4.9.8, see Tool access below
 ```
 
 **The headless engine (v4.0).** Everything the `second-opinion` skill orchestrates by hand in
@@ -372,6 +374,101 @@ empty-section wordings — is used verbatim in both intents. One vocabulary, two
 - **Task runs build no reliability history**, so they never contribute to — and never benefit from —
   `amicus council stats`, including the ledger-driven chair-fallback promotion.
 
+### Tool access per usage (`--tools`)
+
+Tool access is a property of the **run**, set by the caller according to whether the seats
+must go and get their material — not a property of the mode (spec 2026-09-11 §2). Every
+council leg runs as one of two agents the run's own OpenCode server registers:
+
+- **`council-seat`** — stage-1 seats (the bench wave, the critic, the lenses) and their retries.
+  Its tools are the intent's default ∪ `--tools`: **task mode** defaults to `webfetch` (the
+  co-worker can research); **review mode** defaults to none (the artifact under review arrives
+  in the briefing — `--artifact`, `--pack`, or pasted). `--tools read,grep,glob,bash` opts local
+  tools in, even for task mode — opt-in is deliberate.
+- **`council-support`** — repair re-prompts, the Stage-2 judges, debate legs and the chair.
+  No tools, ever: their briefings already say so, and the agent now enforces it.
+  The wildcard deny also covers the engine's own doom-loop and question prompts, so the engine
+  never blocks a headless leg on a tool-level prompt; a model that asks its question in prose
+  simply ends its turn (what a leg does after a refusal is the §7 live check).
+
+`task` and `skill` are refused (`task` spawns child sessions amicus cannot observe; `skill` is
+where a seat starts reading the harness instead of the brief), as are `edit`, `write`,
+`apply_patch` (a seat never modifies the tree), `question` (a headless leg has no human) and
+`invalid`. Every seat tool — the intent's default included — is validated against the engine's
+declared list when the engine lists its tools; an unknown id is `BAD_ARGS` naming what the engine
+declares. `--agent Plan|Build` is the escape hatch: every leg runs on the engine's own agent, no
+council agents, no allowlist; it cannot be combined with `--tools`. Its legs run with the run
+directory (inside the project) as their working directory, so a seat can read the run's own
+records, the label map included — use it only where that is acceptable.
+`Build` is edit-capable: unlike the council agents' fenced allowlist, it can edit files and run
+commands over that directory (the CLI prints a Notice when you opt into it); `Plan` is the
+pre-4.9.8 default: it denies edits but allows reads, searches and the shell (measured on the
+pinned engine), so it is the escape hatch that restores v4.9.7's behaviour exactly, and the CLI
+prints a Notice for it too (every leg — judges and the chair included — can run commands).
+
+Refusals land in a run directory that already exists, so the refusal itself is recorded (the same
+order the other pre-spend checks use); nothing is launched and nothing is spent. When the engine
+cannot list its tools at all, a defaults-only run continues on the recorded degrade while an
+explicit opt-in is refused — in practice this only decides a defaults-only run's outcome when the
+shared server is otherwise up and only the tool-ids endpoint itself fails; a server that cannot
+start at all is now caught by the engine-rendered verification below regardless of intent (ruling
+P2-R38).
+
+**Engine-rendered verification.** After registration, the run reads back what the engine actually
+rendered for `council-seat`/`council-support` — the run directory, its `_scratch` support-leg
+directory, and the project tree too when a local tool is opted in (ruling P2-R39) — and refuses
+before any launch if an `opencode.json` or `.opencode/agent` file the engine loads for that
+directory (the tree's, or your global config) altered them — naming that config as the cause
+and `--agent` as the knowingly-unprotected alternative (ruling P2-R33). An `external_directory`
+allow after the wildcard deny is exempted only when it is the engine's own tool-output cache
+under its own XDG-first data directory (`$XDG_DATA_HOME/opencode` when set, else
+`~/.local/share/opencode` — ruling P2-R42, matching how `src/utils/auth-json.js`/
+`src/utils/engine-log.js` already resolve it); any other one reads as a widened agent too
+(ruling P2-R40). Unverifiable (no shared server to ask) REFUSES whenever
+verification can run at all — a defaults-only run included, no more quiet degrade (ruling
+P2-R38); it is skipped only when a caller supplies its own transport with no way to ask the
+engine at all (test-only — production always VERIFIES and refuses when it has no server to ask).
+When the run's own shared OpenCode server fails to start, that IS "no server to ask": a default
+(non-`--agent`) run now refuses before any launch rather than falling back — the per-wave
+fallback servers that used to absorb a shared-server failure for every run now serve only an
+`--agent` run, whose verification is skipped by design and so never has to ask at all (ruling
+P2-R43). `--agent Plan` restores v4.9.7's per-wave behaviour exactly.
+
+**Run-directory placement with a local tool.** A seat that can read the project tree must
+not be able to read this run's sibling sessions, so with any local tool opted in the run dir
+must sit **outside** the project tree (`--out-dir`), under your home, tmp or
+`AMICUS_PROJECT_ROOTS`; the seats are then scoped to the project tree (`external_directory:
+deny`) while their metadata stays in the run dir. Over MCP the run dir stays inside the
+project, so local tools are refused there with the CLI named; tools that never touch the tree
+(`webfetch`, `websearch`, `todowrite`) over MCP are fine.
+
+**What the seat is told.** With no tools it gets the same no-tools sentence as the chair
+(`Do NOT use any tools or read any files; …`), with tools one line naming exactly them, and
+under `--agent` a line saying it runs as the engine's named agent with its own tool set. The
+config enforces; the sentence informs — study run E1 showed gemini makes zero tool calls when
+told not to.
+
+**Secrets.** With `read` opted in, the seat agent denies `.env`, `.env.*` and `.envrc` files at
+the engine (the match is case-sensitive on Linux; no other spelling is fenced) — the seat gets a
+refusal and the leg continues (the deny rules are measured to render after the seat's own
+`read=allow`, and CI now models the engine's own evaluator — transcribed from its source — over
+the real rendering, confirming `.env`/`.env.*`/`.envrc` deny and an ordinary file allows; the
+refusal itself is exercised by the release ritual's live `--tools read` run, not by the probe).
+The CLI prints a Notice for `read` too, naming those three fenced names and asking you to keep
+other secrets out.
+`grep`, `glob` and `bash` have no per-file fence: opting them in trusts every seat with
+everything in the tree, `.env` included — grep returns its contents, glob lists its name — and
+the CLI prints a Notice when you opt any of grep, glob or bash in. Keep secrets out of any tree
+you point a `bash`, `grep` or `glob` seat at.
+With a local tool the seat's engine session is rooted at the project tree, so the engine also
+loads that tree's own opencode config; do not point a local-tools seat at a tree you do not trust.
+
+`bash` is outside every fence: a bash seat runs commands as you — it can reach the run
+directory outside the tree (this run's own records included: the label map that anonymizes the
+bench and every review already on disk, so bench anonymity and independence do not hold under
+bash), your home directory and the network, and the `webfetch` deny does not bind a shell. Opt
+it in only where that is acceptable; the CLI prints a Notice when you do.
+
 ### Debate mode
 
 `--debate` adds a **Stage-2.5 rebuttal round** between cross-review and the final tally
@@ -594,6 +691,19 @@ things make that safe:
   that is present and empty counts as "I found nothing" — the same line `countAttemptedFindings`
   draws when it checks a repair against the count the original declared.
 
+**When the original carried no block at all there is nothing to check the repair against**, so
+the repair is accepted and the seat's `runStats` row carries `findingsUnverified: true` — the
+seat is counted as reviewed, its findings are tallied, and nothing verified them. Since v4.9.8
+(#242) that fact is surfaced rather than merely recorded: `verdict.json`'s `seatsReviewed`
+counts the seat under `unverified`, and the report's **What was lost** gains a row for it
+(*seat X's findings came from a repair of a response with no findings block — nothing verified
+them*). A repair that returned a **different number** of findings than the original declared is
+refused instead — `repairRefused: {code, detail}` on the row, `conformance: unstructured`, no
+findings tallied, the seat's own prose still reaching the judges — and gets a `repair-refused`
+row naming the code. Since council #248 round 2 it is also counted under `seatsReviewed.refused`,
+printed on the check title and sticky comment as `(N refused)`, and named on the end-of-run
+stderr line.
+
 This closes a contradiction that used to be shipped in every run: the anti-sycophancy clause in
 each Stage-1 briefing says "An empty severity category is a valid result", while the validator
 rejected exactly that answer — so the only way for a reviewer to satisfy the schema was to
@@ -669,7 +779,7 @@ under "Stage-2 → tally assembly recipe"). It needs **all five top-level keys**
 | `findings[]` | array | One entry per finding across all reviews: `{id, raiser, severity}` (`claim` may ride along but isn't required by the tally engine). `id` is the run-global label (e.g. `A1`, `B2`) assigned during Stage-2 assembly, not the reviewer's local integer id. `raiserSeat?` (**v4.8**) — the raising **seat's** id (`deepseek#1`), emit-only-when-it-differs-from-the-alias, so a bench with no repeated alias never carries it. `raiser` stays the alias in every case. |
 | `adjudications[]` | array | One entry per (judge × finding): `{findingId, judge, verdict}`, `verdict ∈ {agree, dispute, neutral}`. `seat?` (**v4.8**) — the judging **seat's** id, on the same emit-when-different terms as `findings[].raiserSeat`; `judge` stays the alias. Include every judge's verdict on every finding, **including the raiser's own adjudication of its own finding** — the engine excludes it automatically when scoring (don't pre-filter it). ⚠️ **v4.8: that exclusion is seat-conditional.** When a vote *and* its finding both carry a seat id, the engine compares **seats** (`v.seat !== f.raiserSeat`), so on a bench that repeats an alias a twin's genuine vote on its twin's finding is now counted instead of discarded. When either side carries no seat id — a legacy document, a hand-assembled one, or a real run whose leg failed to bind to its seat — it falls back to comparing **aliases**, which is the pre-v4.8 behaviour and still drops that twin's vote. Never fill in a seat id you did not observe just to unlock the seat compare. ⚠️ **`""` is not a model id.** The schema accepts an empty string for `raiser` and for `judge`, but the engine cannot identify a vote it has no name for: when a finding's `raiser` is empty or missing, every vote whose `judge` is also empty or missing is excluded from `basis` and counted in `findings[].unattributedPeerDrops`. A **seat id on both sides overrides this** — it is a stronger identity than either name, so a seated vote is scored (or excluded as the raiser's own) regardless of what `raiser` and `judge` say. Send the real alias, or expect the vote not to be scored. |
 | `rankings[]` | array | One entry per judge: `{judge, order}`. `order` is that judge's `FINAL RANKING:` block translated to model ids, e.g. `["gpt", "deepseek"]` (ties may use a nested array, e.g. `[["gpt","deepseek"], "mistral"]`). `seat?` (**v4.8**) — the judge's own seat id, on the same emit-when-different terms as `adjudications[].seat`; `judge` stays the alias. `orderSeats?` (**v4.8**) — the seat-valued parallel of `order`, slot for slot (a tied slot is a nested array there too): each slot is a seat id where the ranked model's seat is known, `null` where it is not, and the whole key is emitted only when at least one slot is non-null. **Two consumers read it.** Street cred keys on `orderSeats` when present and falls back to the alias otherwise — the mechanism that lets a twin bench's two street-cred rows diverge instead of collapsing into one. **v4.8** — the **chair packet** is the second: its peer-rankings block zips `orderSeats` onto `order` slot for slot, so the chair reads seat ids where the run knows them and the ranked alias where it does not. A tied slot is zipped element by element, and a `null` slot renders the alias rather than the word `null`. |
-| `runStats[]` | array | One row per paid launch (v4.7 spec §5 D1/D2 — no longer capped at one row per model; see the role roster below): `{model, role, wasChair, conformance, status, durationMs, usage, waveId?, resolvedModel?, seat?}`. `seat?` (**v4.8**) is the row's seat **id**, emit-only-when-it-differs-from-that-seat's-own-alias — so only a bench that repeats an alias carries it. Only the two producers that *have* a seat pass one: the primary reviewing-seat rows and the dead-seat rows. A `judge`, `chair-attempt`, `repair` or `superseded` row never carries it (all four are excluded from the ledger join, so a seat stamp there could never win it), and neither do the off-bench chair rows or the synthetic `claude` row, which have no seat at all. Two seats of one alias that **both** died usually get **two** rows: each carries its own `seat` id where the run bound that seat's leg, and **no** `seat` where it could not — an unidentified dead seat is counted but never named. They still collapse into a **single** row in two cases, both of them seats the run genuinely cannot tell apart: both legs missing a task id, and a run with no seat table behind it — the deliberate floor, since inventing an identity there would be a guess. A retry wave that came back with **fewer legs than it launched** was a third such case and is **no longer**: v4.8 T-A4 made the retry reconcile count a key's SLOTS rather than test its presence, so both twins get a row (measured end to end through `runStage1`: 1 primary dead-seat row before, 2 after, with the superseded rows unchanged at 2 — one of the two rows carries `usage: null`, and **which one is arbitrary**: neither row names a seat, so the alias's billed total is split across its anonymous rows by row ORDER, never by identity). ⚠️ **Corrected in v4.8** — this cell previously claimed the two *always* collapse into one row carrying no `seat`. That was already wrong for **bound** twins the day it was written (the two-row behaviour landed 2026-08-13, this sentence 2026-08-14), and v4.8 closed the unbound half for every retry outcome, the partial return included (that last one in T-A4). May be `[]`. Any leg with no run document gets `durationMs: null, usage: null` — never invent a value. `waveId` is emit-only-when-set. `resolvedModel?` (v4.7) — the executable id that actually served the row's leg, emit-only-when-set; leg-less rows (the give-up chair row, dead seats with no leg, the claude row) never carry it. `model` stays the council alias. ⚠️ **One row shape carries `usage` with NO `waveId`, `resolvedModel` or `durationMs` (v4.8)**: an unidentified dead seat on an alias the bench repeats, where the run holds a billed retry leg it cannot attribute to either twin. The cost is real and is counted in the run total, but every per-seat execution fact is withheld rather than guessed — so do **not** assume `usage` implies `waveId`, and do not treat a null `durationMs` as "this seat cost nothing". |
+| `runStats[]` | array | One row per paid launch (v4.7 spec §5 D1/D2 — no longer capped at one row per model; see the role roster below): `{model, role, wasChair, conformance, status, durationMs, usage, waveId?, resolvedModel?, seat?}` — plus `findingsUnverified?: true` / `repairRefused?: {code, detail}` (the two halves of the repair contract's outcome, see the repair paragraph under `amicus council validate`) and `ttftMs?` (v4.9 W13). `seat?` (**v4.8**) is the row's seat **id**, emit-only-when-it-differs-from-that-seat's-own-alias — so only a bench that repeats an alias carries it. Only the two producers that *have* a seat pass one: the primary reviewing-seat rows and the dead-seat rows. A `judge`, `chair-attempt`, `repair` or `superseded` row never carries it (all four are excluded from the ledger join, so a seat stamp there could never win it), and neither do the off-bench chair rows or the synthetic `claude` row, which have no seat at all. Two seats of one alias that **both** died usually get **two** rows: each carries its own `seat` id where the run bound that seat's leg, and **no** `seat` where it could not — an unidentified dead seat is counted but never named. They still collapse into a **single** row in two cases, both of them seats the run genuinely cannot tell apart: both legs missing a task id, and a run with no seat table behind it — the deliberate floor, since inventing an identity there would be a guess. A retry wave that came back with **fewer legs than it launched** was a third such case and is **no longer**: v4.8 T-A4 made the retry reconcile count a key's SLOTS rather than test its presence, so both twins get a row (measured end to end through `runStage1`: 1 primary dead-seat row before, 2 after, with the superseded rows unchanged at 2 — one of the two rows carries `usage: null`, and **which one is arbitrary**: neither row names a seat, so the alias's billed total is split across its anonymous rows by row ORDER, never by identity). ⚠️ **Corrected in v4.8** — this cell previously claimed the two *always* collapse into one row carrying no `seat`. That was already wrong for **bound** twins the day it was written (the two-row behaviour landed 2026-08-13, this sentence 2026-08-14), and v4.8 closed the unbound half for every retry outcome, the partial return included (that last one in T-A4). May be `[]`. Any leg with no run document gets `durationMs: null, usage: null` — never invent a value. `waveId` is emit-only-when-set. `resolvedModel?` (v4.7) — the executable id that actually served the row's leg, emit-only-when-set; leg-less rows (the give-up chair row, dead seats with no leg, the claude row) never carry it. `model` stays the council alias. ⚠️ **One row shape carries `usage` with NO `waveId`, `resolvedModel` or `durationMs` (v4.8)**: an unidentified dead seat on an alias the bench repeats, where the run holds a billed retry leg it cannot attribute to either twin. The cost is real and is counted in the run total, but every per-seat execution fact is withheld rather than guessed — so do **not** assume `usage` implies `waveId`, and do not treat a null `durationMs` as "this seat cost nothing". |
 
 **`runStats[].role` roster (v4.7 row-per-launch).** Every leg the run budget counts gets exactly
 one row, so a seat that needed a repair or lost a leg to a retry can now show up more than once.
@@ -852,6 +962,7 @@ named here. That is why the v4.8 keys below each needed their own line.
 - `seats` — **v4.8**, optional. The tally record's `meta.seats` (same `{id, alias, role, lens, position}` shape), promoted to the top level next to `seatLoss`. Present only when the tally record carried one, i.e. only when the bench repeated an alias. It is what makes the `alias#N` ids on `findings[].raiserSeat`, `adjudications[].seat` and `runStats[].seat` resolvable from the verdict **alone** — before v4.8 the verdict named seats it could not resolve. `council report` reads it to give each seat its own adjudication-matrix column; when it is absent, or is not an array of objects each carrying a string `id`, the **adjudication matrix** falls back to alias space whole and renders exactly as it did before v4.8. ⚠️ **That fallback is the matrix's alone — it is not a whole-document guarantee.** The street-cred table beside it labels each row from `streetCred[].seat` whenever the row carries one, a predicate independent of this key, so a verdict with seated `streetCred[]` rows and no usable `seats` renders seat ids in the street-cred table and aliases in the matrix (measured on an absent `seats`, a non-array `seats`, and an array-of-strings `seats`). In-process both fields come from the same twin bench and travel together; the split is reachable on a hand-assembled or externally-supplied record, which `buildVerdict`'s own docblock names. A verdict written before v4.8 carries no `streetCred[].seat` at all and is unaffected.
 - `findings[].raiserSeat` — **v4.8**, optional. The raising seat's id, carried through from the tally record; absent unless the bench repeated an alias. `findings[].raiser` stays the alias.
 - `findings[].sameModelCorroboration` — **v4.8**, optional, `true` only. Carried through from the tally record; see the tally-record notes above for the stamp's meaning **and for the two directions in which it is wrong** (it misses one model behind two aliases, and it fires falsely on one alias behind two executables).
+- `seatsReviewed` — **#202**, optional: `{reviewed, unverified, refused, of}`, derived from `runStats` at build time (never passed in) and emitted only when the record carries at least one bench-role row (`seat`, `critic`, `lens:<slug>`), so `0 of 0` is never written. `of` counts bench seats post-retry (a healed seat once — its first attempt is `role:'superseded'`), `reviewed` those whose leg completed, and `unverified` (**v4.9.8**, #242) those among them whose findings came from a repair of a response with no parseable findings block (`runStats[].findingsUnverified`); the tally scored those findings, nothing verified the repair, and the flag is not a stub detector (a real review whose trailing JSON block was malformed carries it too). `refused` (**v4.9.8**, council #248 round 2) counts those whose repair was refused (`runStats[].repairRefused`): the seat contributed no findings at all and would otherwise read as a full reviewer on every gate surface. Both are always written with the census and never more than `reviewed` — the census and the report share one predicate (a bench role, a completed leg, and the literal `true` or a plain-object `repairRefused`), so a flagged row that is not a completed bench seat is counted nowhere and rendered nowhere. The report's `unverified-repair` and `repair-refused` rows name such seats; the check title and sticky comment print `(N unverified)` and `(N refused)` only when non-zero; at the end of a run whose counts are non-zero the CLI prints one `Notice:` line on stderr naming the seats.
 - All other keys (`runId`, `council`, `findings`, `streetCred`, `runStats`, `tierCounts`) are passed through unchanged from the tally record.
 
 **Write path:** always atomic — a `<out>.tmp-<pid>` file is written first, then renamed over the
@@ -897,8 +1008,12 @@ tier-count summary table — headed **Verdict summary** on a review run and **An
 task run, since a task run produces an answer, not a verdict, and on a task run followed by the
 one-line concurrence qualifier (*tiers report peer concurrence, never verification*) — a
 **What was lost** section
-when the run degraded (plus a **Notes** list for informational records, e.g. a task run's
-ledger-skipped announcement), the **adjudication matrix** (finding × judge, `✓`/`✗`/`–` with
+when the run degraded — and, since v4.9.8 (#242), one row per seat whose findings came from a
+repair of a response with no findings block (channel `unverified-repair`) and one per refused
+repair (channel `repair-refused`, naming the code), derived from `runStats[]` when the report is
+built, so re-rendering an older `verdict.json` shows them too — plus a **Notes** list for
+informational records (e.g. a task run's ledger-skipped announcement), the **adjudication
+matrix** (finding × judge, `✓`/`✗`/`–` with
 `*` marking the raiser's own vote), the **peers-only street-cred table**, **findings grouped by
 tier** (Disputed first), and a **cost table** (per-model status/duration/cost + wave total,
 sourced from `runStats[].usage`).
@@ -1263,6 +1378,28 @@ need Claude or a live council run to regenerate it.
 
 ---
 
+## Leg completion and `session.status`
+
+A headless leg ends on the first of: the engine reporting `idle`; its last message
+finalizing (two stable polls); the no-output backstop; the tool-stall detector; the
+tool-settle ceiling (when a tool call never settles); a retry the engine schedules
+past the leg deadline (`RETRY_BEYOND_DEADLINE`); or the leg `--timeout`. The
+flat-output heuristic that used to end a leg after 30 stable polls now runs only
+when `session.status` reports anything other than a working engine (busy or retry)
+— unavailable, unrecognised — **or** when a tool call is live (where the bounded
+ceiling governs). A finalized message always ends on the stable-finished path, whatever
+the status. A busy (or retrying) engine with no live tool is a model still answering
+— the poller cannot see its text until the message finalizes — so the leg waits. A
+busy-but-wedged session therefore ends by `--timeout`, and is named that. At debug
+level the trace names the veto once per flat stretch (and again whenever a non-zero
+count is reset) and the exit line records the last engine status. When the fallback
+heuristic ends an unfinalized message, the leg logs a warning (warn level) naming the
+status it saw. A retry whose next attempt lies beyond the leg deadline ends the leg
+at once as `RETRY_BEYOND_DEADLINE` — unless the last message has already finalized (the
+leg completes normally) or a tool call is live (the bounded tool-settle ceiling governs).
+
+---
+
 ## See also
 
 - **[skills/second-opinion/SKILL.md](../skills/second-opinion/SKILL.md)** — the orchestration

package/docs/usage.md

@@ -21,6 +21,8 @@ amicus abort --all [--json]
 # Setup & maintenance
 amicus setup                              # Full wizard: keys, default model, aliases
 amicus setup --api-keys                   # Open just the API-key step
+amicus aliases                      # your aliases: following (shipped pin) / pinned (yours)
+amicus aliases --review             # walk the proposals — no copy-paste
 amicus setup --add-alias fast=google/gemini-3.1-flash-lite-preview  # bare canonical, direct-first
 amicus models                             # List the live catalog
 amicus models --search gemini             # Filter by substring
@@ -98,7 +100,7 @@ amicus start --model deepseek --prompt "Generate tests" --no-ui --timeout 30
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. | |
 | `--tag <t>` | Label this session for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; invalid values are rejected, never silently cleaned). | *(none)* |
 
-> Agents: **Chat** auto-approves reads and asks before writes/bash (interactive default); **Build** has full tool access (headless default); **Plan** is read-only analysis. `--agent Chat` is interactive-only and incompatible with `--no-ui`.
+> Agents: **Chat** auto-approves reads and asks before writes/bash (interactive default); **Build** has full tool access (headless default); **Plan** denies edits (reads, searches and shell allowed). `--agent Chat` is interactive-only and incompatible with `--no-ui`.
 
 **Catalog validation.** For an explicit `--model`, the model is checked against the live catalog before launch — a typo'd name fails fast with same-vendor suggestions. For a model inherited from a previous session (`continue`/`resume` without `--model`), validation is **advisory**: a warning is printed but the session starts anyway. Skip with `--no-validate-model`.
 
@@ -204,6 +206,8 @@ amicus council run --prompt-file briefing.md --models gemini,glm --chair deepsee
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
 | `--tag <t>` | Label this run for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; rejected, not cleaned). Every stage's sub-waves (Stage-1, critic/lens solos, Stage-2, chair, debate) carry the same tag on their wave metadata. |
 | `--intent <review\|task>` | The run's intent (v4.9). `review` — the default — is never stored; `task` marks a task-mode run, recorded as `intent: "task"` on `run.json`/`verdict.json` and kept out of the reliability ledger. Over MCP: the `intent` param on `amicus_council_run`, and a hand-assembled `amicus_council_tally` input may carry `meta.intent` the same emit-when-`task` way. What forks stage by stage — and what stays byte-identical — is in [docs/council.md § Task mode](./council.md#task-mode---intent-task). |
+| `--tools <a,b,c>` | Tool ids stage-1 seats may use, by the engine's own ids (v4.9.8). Task mode defaults to `webfetch`, review to none; `task`/`skill`/`edit`/`write`/`apply_patch`/`question`/`invalid` are refused; anything else is validated against the engine before launch. A local tool (anything that is not `webfetch`/`websearch`/`todowrite` — `read`, `grep`, `glob`, `bash`, …) needs `--out-dir` outside the project tree. With `read` opted in, `.env`, `.env.*` and `.envrc` files are denied at the engine (case-sensitive on Linux; no other spelling is fenced), and the CLI prints a Notice for `read` too, naming those three fenced names and asking you to keep other secrets out; `grep`, `glob` and `bash` have no such per-file fence (grep returns `.env` contents, glob lists `.env` names) and the CLI prints a Notice when you opt any of them in. `bash` is outside every fence (run directory, home, network — including this run's own records: the label map and every review already on disk, so bench anonymity and independence do not hold under bash). Cannot be combined with `--agent`. Over MCP: the `tools` param (tools that never touch the tree — `webfetch`, `websearch`, `todowrite` — only). See [docs/council.md § Tool access](./council.md#tool-access-per-usage---tools). |
+| `--agent <Plan\|Build>` | Escape hatch: run every leg on the engine's own agent instead of the council agents (no allowlist). Its legs run with the run directory (inside the project) as their working directory, so a seat can read the run's own records, the label map included — use it only where that is acceptable. `Build` is edit-capable — it can edit files and run commands there, and the CLI prints a Notice when you opt into it; `Plan` denies edits but allows reads, searches and the shell — the pre-4.9.8 default, so it restores v4.9.7's behaviour, and the CLI prints a Notice for it too (every leg, judges and the chair included, can run commands). Cannot be combined with `--tools`. Over MCP: the `agent` param. |
 
 **Exit codes:** `0` full run · `2` degraded but reportable (fewer than 2 judges, chair failure —
 `overallVerdict: null` — a cost ceiling hit after the tally, or a `--max-cost` ceiling set over a
@@ -303,7 +307,7 @@ Then invoke it with `--pack <name|path>` on `start` / `fanout` / `council run`
 | `fanout` | `bench` (a saved council name, or an array of ≥2 members) | — | `timeout`, `maxCost`, `gateway`, `agent`, `thinking`, `summaryLength`, `noContext`, `contextTurns`, `contextMaxTokens` |
 | `solo` | `model` | — | `timeout`, `maxCost`, `gateway`, `agent`, `thinking`, `summaryLength`, `noUi`, `noContext`, `contextTurns`, `contextMaxTokens` |
 
-`council` packs do **not** accept `agent`, `thinking`, or `summaryLength` — they were inert on every surface (no council code path, CLI or MCP, ever reads a pack-filled one; the engine hardcodes agent `Plan`/summaryLength `verbose`), so they were dropped before release rather than shipped as dead weight a pack author would reasonably expect to work. A `council` pack that still sets one fails `pack save` with `PACK_INVALID`, naming the key. They remain valid, and functional, on `fanout`/`solo` packs. Those releases recorded `medium` on EVERY session's metadata, **a fanout leg's included**, whether or not the flag was typed (a level nothing ever sent), so a pack saved with `pack save --from-run` on 4.9.3 or earlier copied it into `options.thinking` on **fanout packs as well as solo ones** — where it then applies to every seat of the bench at once. Such a pack now SENDS it: refused on every model that does not declare `medium` (kimi-k3, Haiku 4.5, deepseek-v4-pro among the curated routes), and on a model that DOES declare it the level really goes out — so a pack that was inert can now change a run's cost and behaviour. Delete the key or re-save the pack from a run that requested a level.
+`council` packs do **not** accept `agent`, `thinking`, or `summaryLength` — they were inert on every surface (no council code path, CLI or MCP, ever reads a pack-filled one; `--agent` / the MCP `agent` param are the only way to set a council run's agent — v4.9.8 — and summaryLength is hardcoded `verbose`), so they were dropped before release rather than shipped as dead weight a pack author would reasonably expect to work. A `council` pack that still sets one fails `pack save` with `PACK_INVALID`, naming the key. They remain valid, and functional, on `fanout`/`solo` packs. Those releases recorded `medium` on EVERY session's metadata, **a fanout leg's included**, whether or not the flag was typed (a level nothing ever sent), so a pack saved with `pack save --from-run` on 4.9.3 or earlier copied it into `options.thinking` on **fanout packs as well as solo ones** — where it then applies to every seat of the bench at once. Such a pack now SENDS it: refused on every model that does not declare `medium` (kimi-k3, Haiku 4.5, deepseek-v4-pro among the curated routes), and on a model that DOES declare it the level really goes out — so a pack that was inert can now change a run's cost and behaviour. Delete the key or re-save the pack from a run that requested a level.
 
 Every kind may also carry `description`, `version` (semver, default `1.0.0`), and `briefing.template` (a template **reference**, not rendered text — a pack never captures briefing prose).
 
@@ -395,7 +399,24 @@ direct namespace while the OpenRouter route still serves — a gateway-only rout
 no direct sibling is a routing choice, not staleness. Deliberately gateway-only
 entries (e.g. `gpt-pro`) are annotated as such and are never offered a retarget.
 
-**Drifted aliases.** `--check` (and the `doctor` aliases row) also flags **`DRIFTED:`** stored aliases — a stored alias whose target is still catalog-listed but no longer matches any route its family currently resolves to (the v4.6.1 `gemini` release-gate class, where `doctor` stayed green while the model behind it had moved on). Each drift line prints the exact `amicus setup --add-alias <alias>=<current>` refresh command. Drift is informational only by default and does not change the exit code — pass `--strict` alongside `--check` to make curated per-gateway drift (stale or divergent direct/OpenRouter forms) exit non-zero too.
+### Aliases: following vs pinned
+
+A curated alias (`gemini`, `gpt`, `opus`, `deepseek`, …) absent from `config.aliases` **follows** the pin Amicus ships and moves to the new target on every release; a present key **pins** it to that exact id and makes it reviewable.
+
+```bash
+amicus aliases            # every alias: following (shipped pin) / pinned (yours), by vendor
+amicus aliases --review   # walk outdated pins in a numbered picker — no copy-paste
+amicus aliases --unpin <name>   # remove a pin: a curated name goes back to following, a custom name is deleted
+amicus aliases --json     # the same document, for scripts
+```
+
+`--review` offers, per outdated pin: accept a newer same-tier sibling, follow the shipped pin again, choose another catalog id, skip, or never ask again for that pairing — it needs a terminal (without one it prints the list and exits 1). Picking "follow the shipped pin" removes the key from `config.aliases`, and typing that SAME shipped id into "choose another" follows too — unconditionally, whether or not the catalog carries it or is fresh, since it is the same `follow` action either way. A newer same-tier sibling is judged by vendor path, prefix and suffix around the version number; a size or variant token glued to a number (`20b`, `8x22b`) is never read as part of that version, so a differently-sized variant of a model is never offered as a "newer" sibling of it. `amicus setup` no longer seeds all 21 curated ids — it pins only the default alias you chose, and only when its live flagship differs from the shipped pin, and says so.
+
+Accepting a catalog-vouched id needs a catalog fresher than 24 hours — the picker refreshes it inline first (an authenticated model-list call to each provider you hold a key for, the same call `amicus models --refresh` makes); `follow` never needs the catalog.
+
+`--unpin <name>` refuses instead of writing when `name` is also your `config.default` and is not a curated alias — deleting it would leave the default pointing at a key that no longer resolves, so pick a new default first (`amicus setup`) or unpin a different alias. A curated default is unaffected: it keeps resolving from the shipped table after the unpin, same as any other curated unpin.
+
+**Drifted aliases.** `--check` (and the `doctor` aliases row) also flags **`DRIFTED:`** stored aliases — a stored alias whose target is still catalog-listed but no longer matches any route its family currently resolves to (the v4.6.1 `gemini` release-gate class, where `doctor` stayed green while the model behind it had moved on). Each drift line points at `amicus aliases --review`. Drift is informational only by default and does not change the exit code — pass `--strict` alongside `--check` to make curated per-gateway drift (stale or divergent direct/OpenRouter forms) exit non-zero too.
 
 **Live probe (`--check --live`).** Presence in the catalog is not proof of service — a stored alias can point at a model id the catalog still lists but the provider has quietly stopped serving (the v4.6.1 `gemini` incident). `--check` alone can't see that; `--live` can, by actually asking. Scope is **stored aliases only** (`amicus setup --add-alias`) — curated defaults follow the catalog by construction and have no "was it actually served" question for a live probe to answer. **This spends real money — one tiny leg per stored alias** — every probed alias gets one ordinary engine leg on a single quiet fan-out wave, with a real session dir and a real spend-ledger row, exactly as if you'd run it yourself.
 
@@ -415,7 +436,7 @@ Each stored alias resolves to one of three outcomes:
 
 **Validation on launch.** `start` and `fanout` validate the model against the catalog before launching. For an explicit `--model` on `continue`/`resume` this is **blocking** (a typo'd model fails fast with suggestions); for a model *inherited* from a prior session it's **advisory**. Skip it any time with `--no-validate-model`, or fix the catalog with `amicus models --refresh`.
 
-**Aliases are a curated seed, not a fixed list.** `amicus setup` seeds a curated set of short aliases (e.g. `gemini`, `gpt`, `opus`, `deepseek`), and you add or override them with `amicus setup --add-alias name=provider/model`. To see exactly what resolves on *your* machine, run `amicus models` — that is the source of truth.
+**Curated aliases follow the shipped pins unless you pin them.** The curated aliases (`gemini`, `gpt`, `opus`, …) are shipped and follow the package's pins unless you pin them — pin one, or add an entirely new one, with `amicus setup --add-alias name=provider/model`. To see exactly what resolves on *your* machine, run `amicus aliases` — that is the source of truth.
 
 **Full-id passthrough.** You can always bypass aliases and name a model directly. Bare `provider/model` is the canonical, policy-routed form; `openrouter/provider/model` is an explicit override. See [Routing](../README.md#routing) for the full explanation — summary:
 
@@ -540,7 +561,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.7",
+  "version": "4.10.0",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
@@ -970,6 +991,8 @@ Every tool below also takes an optional `project` — an absolute path naming th
 - `debate` — add a Stage-2.5 rebuttal round before the chair synthesizes.
 - `claudeReviewFile` — path to Claude's own review, included as a judged entry. Claude is reviewed and ranked like a seat, but never judges or chairs.
 - `intent` — `task` marks a task-mode run (recorded on `run.json`/`verdict.json`, kept out of the reliability ledger): seats produce the deliverable and the chair closes with `ANSWER:` on a disjoint scale. `review` is the default and is never stored. See [docs/council.md § Task mode](./council.md#task-mode---intent-task).
+- `tools` — tool ids stage-1 seats may use, by the engine's own ids (task mode defaults to `webfetch`, review to none). Over MCP only tools that never touch the tree (`webfetch`, `websearch`, `todowrite`) can be opted in: the MCP run directory stays inside the project, so a seat with a local tool (`read`, `grep`, `glob`, `bash`, …) is refused with a message naming the CLI's `--tools` + `--out-dir` (outside the project) instead. `task`, `skill`, `question`, `invalid`, `edit`, `write` and `apply_patch` are always refused. Cannot be combined with `agent`.
+- `agent` — escape hatch: run every leg on the engine's own agent instead of the council agents, with no tool allowlist. `Plan` or `Build` only — unlike `amicus_start`'s `agent`, `Chat` is not accepted here. Cannot be combined with `tools`.
 - `ui` — auto-open the Council Workspace window for this run. Default: opens under Claude Code (local) when Electron and a display exist and `workspace.autoOpen` is not `false`.
 - `onComplete`, `pack`, `tag` — as on `amicus_fanout`.
 
@@ -987,7 +1010,7 @@ The `--agent` option controls which OpenCode agent drives the session:
 |-------|-------------|-------------|
 | **Chat** | Interactive conversation | Reads freely, asks before writes/bash |
 | **Build** | Full-access primary agent (headless default) | Read, write, bash, task |
-| **Plan** | Read-only analysis | Read-only |
+| **Plan** | Analysis without edits | Read, search, bash; no edits |
 
 `--agent Chat` is interactive-only and incompatible with `--no-ui`. Custom agents defined in `~/.config/opencode/agents/` or `.opencode/agents/` are also supported.
 

package/electron/ipc-setup.js

@@ -176,21 +176,18 @@ function registerSetupHandlers(getMainWindow, { ipcMain = require('electron').ip
   });
 
   // Read-modify-write: never rewrite an alias the renderer didn't send.
-  // aliasWrites values: string = set, null = delete. First run seeds live.
+  // aliasWrites values: string = set, null = delete. First run starts from
+  // an empty alias map (issue 238 Q9).
   // councilPicks (optional): when length >= 2, seeds the free council via seedFreeCouncil.
   ipcMain.handle('sidecar:save-config', async (_event, defaultModel, aliasWrites, councilPicks) => {
     try {
       const { loadConfig, saveConfig } = require('../src/utils/config');
       let cfg = loadConfig();
       if (!cfg) {
-        const { toLiveSeedAliases } = require('../src/utils/quick-picks');
-        // issue 214: getCatalogInfo, not getCatalog -- toLiveSeedAliases PERSISTS
-        // these routes, so it must see which namespaces were rejected.
-        let catalogInfo = { models: [] };
-        try {
-          catalogInfo = await require('../src/utils/model-catalog').getCatalogInfo();
-        } catch (_err) { /* offline: pinned seeds */ }
-        cfg = { aliases: toLiveSeedAliases(catalogInfo) };
+        // issue 238 Q9: nothing is seeded — a curated alias follows the
+        // shipped pin by being absent (D1). Only the renderer's explicit
+        // writes land.
+        cfg = { aliases: {} };
       }
       if (!cfg.aliases) { cfg.aliases = {}; }
       if (defaultModel) { cfg.default = defaultModel; }

package/electron/setup-ui-alias-groups.js

@@ -1,138 +1,42 @@
 /**
  * Setup UI - Alias grouping rule (issue 213)
  *
- * The Step 3 alias editor used to bucket rows with a hardcoded list of alias
- * NAMES, and `Other` was itself a fixed key list rather than a catch-all — so
- * any alias whose name was not on the list (a local-provider route, a `free-*`
- * council member, a case variant like `GLM`) rendered nowhere at all.
+ * The grouping rule itself (groupAliases / aliasVendorOf / vendorLabel /
+ * titleCaseVendor / PREFERRED_VENDOR_ORDER) now lives in
+ * src/utils/alias-groups.js (issue 238 PR1 fix wave F5): `src/sidecar/aliases.js`
+ * (the CLI `amicus aliases` list) needed the same grouping, and `src/`
+ * requiring from `electron/` is a layering violation the whole-branch review
+ * caught. This file re-exports exactly those five symbols -- groupAliases,
+ * aliasVendorOf, vendorLabel, titleCaseVendor, PREFERRED_VENDOR_ORDER -- so
+ * electron/setup-ui-aliases.js, electron/setup-ui-alias-script.js and every
+ * existing test keep working untouched, and keeps its own genuinely UI-only
+ * export (NEW_ROUTES_GROUP_LABEL) defined here. `ALIAS_VENDOR_LABELS` (the
+ * vendor -> display-name table `vendorLabel` looks up) stayed
+ * module-private to alias-groups.js -- it is not one of the five and
+ * nothing imports it directly (issue 249 review round 1, finding D2).
  *
- * Grouping is now derived from the alias's ROUTE VENDOR, which every alias has.
- *
- * REUSE NOTE: the vendor parse is `vendorOf` from src/sidecar/fallback-chains.js
- * — the existing primitive, imported, not re-implemented. It PARSES a vendor
- * segment (it never emits an id that gets called), which is the same
- * ban-exempt category as the other allowlisted `vendorOf` callers in
- * .eslintrc.js. `groupModelsByFamily` (src/utils/model-fetcher.js) is
- * deliberately NOT reused: it keys on `id.split('/')[0]`, so every
- * `openrouter/...` alias would collapse into a single "OpenRouter" bucket —
- * exactly the grouping this file exists to avoid. Its DISPLAY half
- * (PROVIDER_FAMILY_NAMES) is reused below.
- *
- * SHARED-WITH-THE-BROWSER NOTE — deliberately NOT shared. The wizard's inline
- * script cannot `require`, so the browser could only get this rule as a copy:
- * hand-written (silent divergence — a 3-segment direct id like `a/b/c` already
- * splits differently under the two obvious spellings) or serialised from the
- * source below (which would put `slice('openrouter/'.length)` back into the
+ * SHARED-WITH-THE-BROWSER NOTE (still applies to the grouping rule, wherever
+ * it lives) — deliberately NOT shared. The wizard's inline script cannot
+ * `require`, so the browser could only get this rule as a copy: hand-written
+ * (silent divergence — a 3-segment direct id like `a/b/c` already splits
+ * differently under the two obvious spellings) or serialised from the
+ * source (which would put `slice('openrouter/'.length)` back into the
  * page). The page carrying its own gateway-prefix strip is the exact shape
  * issue 214 removed and that tests/setup-ui.test.js still guards
  * ("ships no routing policy to the page: ... no prefix derivation"), because
  * that copy is how a direct id gets fabricated for a namespace that never
  * served it.
  *
- * So there is ONE grouping rule and it lives here, server-side. The client
- * (setup-ui-alias-script.js) never derives a vendor: a route added during the
- * session goes into its own clearly-labelled "New routes" group, and vendor
- * filing happens when the server next renders the editor.
- */
-
-const { vendorOf } = require('../src/sidecar/fallback-chains');
-const { PROVIDER_FAMILY_NAMES, listDirectProviders } = require('../src/utils/provider-registry');
-
-/**
- * Display names for vendors seen in alias routes.
- *
- * DISPLAY ONLY — deliberately not folded into provider-registry's PROVIDERS,
- * which is a *capability* registry (env var, direct-vs-gateway, live fetch).
- * KNOWN_PROVIDERS / PROVIDER_ENV_MAP are derived from that list, so adding
- * `z-ai` there would claim Amicus can hold a z-ai API key. The five real
- * providers keep their single source of truth via PROVIDER_FAMILY_NAMES.
- */
-const ALIAS_VENDOR_LABELS = {
-  ...PROVIDER_FAMILY_NAMES,
-  // Vendors reachable through the gateway (curated + commonly pinned)
-  'qwen': 'Qwen',
-  'mistralai': 'Mistral AI',
-  'z-ai': 'Z.AI',
-  'minimax': 'MiniMax',
-  'x-ai': 'xAI',
-  'moonshotai': 'Moonshot AI',
-  'bytedance-seed': 'ByteDance Seed',
-  'thinkingmachines': 'Thinking Machines',
-  'cognitivecomputations': 'Cognitive Computations',
-  'inclusionai': 'InclusionAI',
-  'nvidia': 'NVIDIA',
-  'cohere': 'Cohere',
-  'meta-llama': 'Meta Llama',
-  'nousresearch': 'Nous Research',
-  'perplexity': 'Perplexity',
-  'microsoft': 'Microsoft',
-  'ai21': 'AI21',
-  'amazon': 'Amazon',
-  // Local providers (src/utils/local-providers.js PRESETS / VALID_FLAVORS)
-  'ollama': 'Ollama',
-  'lmstudio': 'LM Studio',
-  'vllm': 'vLLM',
-};
-
-/** `some-new-vendor` -> `Some New Vendor`, so an unmapped vendor is not a raw slug. */
-function titleCaseVendor(vendor) {
-  return String(vendor).split(/[-_]/).filter(Boolean)
-    .map(w => w.charAt(0).toUpperCase() + w.slice(1)).join(' ');
-}
-
-/**
- * Vendor key for an alias route. Wraps the shared `vendorOf` with the two
- * normalisations issue 213 flagged: case, and the leading `~` of a floating
- * OpenRouter id (`openrouter/~z-ai/glm-latest` must not form a second group
- * next to `z-ai`).
- * @param {string} route @returns {string} '' when there is no usable route
+ * So there is ONE grouping rule and it lives server-side (now in
+ * src/utils/alias-groups.js). The client (setup-ui-alias-script.js) never
+ * derives a vendor: a route added during the session goes into its own
+ * clearly-labelled "New routes" group, and vendor filing happens when the
+ * server next renders the editor.
  */
-function aliasVendorOf(route) {
-  const v = vendorOf(route).toLowerCase();
-  return v.charAt(0) === '~' ? v.slice(1) : v;
-}
 
-/**
- * Display label for a vendor key.
- * hasOwnProperty, not a bare lookup: vendor is derived from a user-editable
- * route, and `__proto__`/`constructor` would otherwise return prototype junk.
- * @param {string} vendor @returns {string}
- */
-function vendorLabel(vendor) {
-  if (!vendor) { return 'Other'; }
-  const hit = Object.prototype.hasOwnProperty.call(ALIAS_VENDOR_LABELS, vendor)
-    ? ALIAS_VENDOR_LABELS[vendor] : null;
-  return hit || titleCaseVendor(vendor);
-}
-
-/** Direct-route vendors render first; everything else sorts by label. */
-const PREFERRED_VENDOR_ORDER = listDirectProviders();
-
-/**
- * Bucket an alias map by route vendor.
- * INVARIANT: every own key of `aliases` lands in exactly one returned group —
- * there is no whitelist to miss, and the empty vendor is a real catch-all.
- * Order within a group follows the config's own key order.
- * @param {Object<string,string>} aliases
- * @returns {Array<{vendor: string, label: string, keys: string[]}>}
- */
-function groupAliases(aliases) {
-  const byVendor = new Map();
-  for (const key of Object.keys(aliases || {})) {
-    const vendor = aliasVendorOf(aliases[key]);
-    if (!byVendor.has(vendor)) { byVendor.set(vendor, []); }
-    byVendor.get(vendor).push(key);
-  }
-  const rank = (vendor) => {
-    if (!vendor) { return Number.MAX_SAFE_INTEGER; } // catch-all group last
-    const i = PREFERRED_VENDOR_ORDER.indexOf(vendor);
-    return i === -1 ? PREFERRED_VENDOR_ORDER.length : i;
-  };
-  return Array.from(byVendor.entries())
-    .map(([vendor, keys]) => ({ vendor, label: vendorLabel(vendor), keys }))
-    .sort((a, b) => rank(a.vendor) - rank(b.vendor) ||
-      a.label.toLowerCase().localeCompare(b.label.toLowerCase()));
-}
+const {
+  groupAliases, aliasVendorOf, vendorLabel, titleCaseVendor, PREFERRED_VENDOR_ORDER,
+} = require('../src/utils/alias-groups');
 
 /**
  * Heading for the client-side group that holds routes added during THIS
@@ -153,9 +57,10 @@ function groupAliases(aliases) {
 const NEW_ROUTES_GROUP_LABEL = 'New routes (this session)';
 
 module.exports = {
-  ALIAS_VENDOR_LABELS,
   NEW_ROUTES_GROUP_LABEL,
   aliasVendorOf,
   vendorLabel,
   groupAliases,
+  titleCaseVendor,
+  PREFERRED_VENDOR_ORDER,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.7",
+  "version": "4.10.0",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/council-verdict.schema.json

@@ -231,9 +231,11 @@
     },
     "seatsReviewed": {
       "type": "object",
-      "description": "#202, optional. How much of the BENCH actually reviewed, derived from runStats: `of` counts every BENCH-role row — `seat`, `critic`, or `lens:<slug>`, exactly the roles seats.js :: buildSeats mints (one per bench seat POST-retry, so a healed seat is counted once and its first attempt is `role:'superseded'`), and `reviewed` counts those whose leg completed. Judges, chair and repair rows are not bench seats and are excluded. EMIT-WHEN-SET: a record with no bench rows carries no key at all, because `0 of 0` would read as a measurement of an empty bench rather than as the absence it is. WHY IT EXISTS: the sibling `seatLoss` above is present only when --critic was requested, and CI runs none — so seat loss was structurally absent from every CI verdict while a two-seat bench published a four-model street-cred table whose dead seats rendered `n/a`, indistinguishable from the legend's neutral (MEASURED, run 4424218c). No `additionalProperties: false` at the top level of this schema means an additive field was always accepted here; this documents the shape rather than changing what is accepted.",
+      "description": "#202, optional. How much of the BENCH actually reviewed, derived from runStats: `of` counts every BENCH-role row — `seat`, `critic`, or `lens:<slug>`, exactly the roles seats.js :: buildSeats mints (one per bench seat POST-retry, so a healed seat is counted once and its first attempt is `role:'superseded'`), and `reviewed` counts those whose leg completed. Judges, chair and repair rows are not bench seats and are excluded. EMIT-WHEN-SET: a record with no bench rows carries no key at all, because `0 of 0` would read as a measurement of an empty bench rather than as the absence it is. WHY IT EXISTS: the sibling `seatLoss` above is present only when --critic was requested, and CI runs none — so seat loss was structurally absent from every CI verdict while a two-seat bench published a four-model street-cred table whose dead seats rendered `n/a`, indistinguishable from the legend's neutral (MEASURED, run 4424218c). No `additionalProperties: false` at the top level of this schema means an additive field was always accepted here; this documents the shape rather than changing what is accepted. v4.9.8 (#242): `unverified` (bench seats among `reviewed` whose findings came from a repair of a response with no parseable findings block — runStats[].findingsUnverified) and, since council #248 round 2, `refused` (those whose repair was refused — runStats[].repairRefused) join the census. buildVerdict writes it whenever it writes the census, since that version (0 is a measurement); it is declared, not required, so documents written before it still validate.",
       "properties": {
         "reviewed": { "type": "integer", "minimum": 0, "description": "Bench seats whose leg completed." },
+        "unverified": { "type": "integer", "minimum": 0, "description": "v4.9.8 (#242): bench seats, counted in `reviewed` too, whose findings came from a repair of a response with no parseable findings block — the tally scored those findings and nothing verified the repair. Not a stub count. A refused repair (runStats[].repairRefused) is not counted here. Never more than `reviewed`: the census and the report share one predicate (a bench role, a completed leg, the literal true), so a flagged row that is not a completed bench seat is counted nowhere and rendered nowhere." },
+        "refused": { "type": "integer", "minimum": 0, "description": "v4.9.8 (#242; council #248 round 2): bench seats, counted in `reviewed` too, whose repair was refused (runStats[].repairRefused) — the repair broke its count contract, so the seat contributed NO findings; visible here because a seat that contributed nothing must not read as a full reviewer on the gate. Always written with the census since v4.9.8; never more than `reviewed` (the census and the report share one predicate)." },
         "of": { "type": "integer", "minimum": 1, "description": "Bench seats benched, post-retry." }
       },
       "required": ["reviewed", "of"],

package/skills/second-opinion/SEAT-BRIEFS.md

@@ -27,6 +27,12 @@ the deliverable rests on (same JSON shape, same severity enum, `location` = sour
 the word `assumption`); the judge's ranking axis becomes *how well the work was done* rather than
 how accurate a critique was; and the chair closes on the ANSWER scale below.
 
+**v4.9.8 — tools are per run.** The engine registers two agents per council run (`council-seat`
+for stage-1 legs, `council-support` for everything else) and composes the seat's tools sentence
+itself: no tools → the shared no-tools sentence; tools → *"Your tools: webfetch. You have no
+others — …"* (`src/council/seat-tools.js :: seatToolsSentence`). The manual path copies that
+line into each seat's `_tmp-*` briefing; see `docs/council.md § Tool access`.
+
 ---
 
 ## Standard anti-sycophancy clause (ALL Stage-1 briefings — not an optional element)