amicus 4.9.7 → 4.10.0

package/src/council/run-seat-tools.js

@@ -0,0 +1,274 @@
+// src/council/run-seat-tools.js
+'use strict';
+
+/**
+ * @module council/run-seat-tools
+ * `runCouncil`'s seat-tools wiring (spec 2026-09-11 §4, PR 2 of 3), split out of
+ * run.js under controller ruling P2-R14 (the 300-line size gate: run.js sat at
+ * exactly 300 lines with no headroom for this task's ~20 lines of logic). The
+ * engine-rendering tripwire's own pure pieces, plus `verificationDirectories`'
+ * one side effect — the best-effort `_scratch` mkdir it documents —
+ * (`listEngineAgents`, `verifyAgentRendering`, `verifyAgentFields`,
+ * `verificationDirectories`) live in the sibling module run-seat-tools-verify.js
+ * (council #247 round 3, same size gate; `verifyAgentFields` added round 6);
+ * `listEngineAgents`/`verifyAgentRendering`/`verifyAgentFields` are re-exported
+ * below so every existing importer keeps requiring them from here.
+ *
+ * Two pure-ish steps, called from run.js on either side of `acquireRunServer`:
+ *   - `preflightSeatTools` (BEFORE the server): shape + refusals need no
+ *     engine, and the run-directory placement rule for a local tool is a
+ *     property of the tool id alone (seat-tools.js :: isLocal) — so both are
+ *     decided, and refused, at ZERO SPEND. Its `councilAgents` output feeds
+ *     `acquireRunServer`'s `agents` config, which is why it must run first.
+ *   - `validateSeatToolsAgainstEngine` (AFTER the server, before any launch):
+ *     the opt-in ids are checked against the engine's OWN declared tool list
+ *     (run-server.js :: listEngineToolIds), so the accepted set is never
+ *     hand-listed and never launched unvalidated.
+ *
+ * Neither function calls `finalize` — that stays run.js's job (the single exit
+ * every terminal outcome funnels through) — they return `{error}` and run.js
+ * decides what to do with it.
+ */
+
+/**
+ * The seat-tools `intent` argument both functions derive from `o.intent`
+ * (`'task'` or absent — never a bare boolean or the raw `o.intent` string).
+ * One helper so the two derivations can never drift apart.
+ * @param {{intent?: string}} o @returns {'task'|undefined}
+ */
+function seatIntentOf(o) { return o.intent === 'task' ? 'task' : undefined; }
+
+/**
+ * Decide the run's seat-tools policy before the server starts. Pure except for
+ * the two lazy `require`s (seat-tools.js, project-root-allowlist.js), which
+ * carry no state of their own.
+ * @param {{agent?: string, intent?: string, tools?: string[], runDir: string, project: string}} o
+ * @returns {{error: {code: string, message: string}}|{error: null, seatTools: string[],
+ *   seatToolsLocal: boolean, councilAgents: object|null}}
+ */
+function preflightSeatTools(o) {
+  const seatTools = require('./seat-tools');
+  // Review r1: not-null-and-not-undefined (not just `!== undefined`), so
+  // `agent: null` — the CLI house style for an unset option (run.js's own `o`
+  // seed spreads `critic: null, lenses: null, maxCost: null, ...` the same
+  // way) — is treated as absent, not as an invalid override. Every OTHER
+  // `o.agent` check in this module already does this for free (`null` is
+  // falsy), so this guard was the one place stricter than the rest of the
+  // module. `!= null` would say the same thing in one operator, but the
+  // repo's eqeqeq('always') lint rule bans loose equality outright.
+  if (o.agent !== null && o.agent !== undefined && o.agent !== 'Plan' && o.agent !== 'Build') {
+    return { error: { code: 'BAD_ARGS', message: `Error: agent must be Plan or Build; got '${o.agent}'` } };
+  }
+  // Named mutant TOOLSNOTARRAY: dropping this check lets a non-array `tools`
+  // (a bare string, say) reach resolveSeatTools below, where
+  // `Array.isArray(o.tools) ? o.tools : []` silently discards it as `[]`
+  // instead of refusing the run. Pinned by run-tools.test.js's `tools: 'read'`
+  // case (BAD_ARGS naming the received type; nothing launches).
+  if (o.tools !== undefined && o.tools !== null && !Array.isArray(o.tools)) {
+    return { error: { code: 'BAD_ARGS', message: 'Error: tools must be an array of tool ids (got ' + typeof o.tools + ')' } };
+  }
+  // Ruling P2-R28 (supersedes P2-R25): --tools/--agent are refused together on
+  // every door. Named mutant AGENTTOOLSCONFLICT: dropping this check reddens
+  // the runCouncil conflict test (agent + a non-empty tools array must exit 1
+  // naming "cannot be combined", never reach a launch).
+  const conflict = seatTools.agentToolsConflict(o.agent, o.tools);
+  if (conflict) { return { error: { code: 'BAD_ARGS', message: `Error: ${conflict}` } }; }
+  // The --agent escape hatch wins: no council agents, every leg runs on the
+  // engine's own agent — so --tools is never even consulted under it. Pinned
+  // by run-tools.test.js's "--agent Build short-circuits resolveSeatTools
+  // even under task intent" case — review intent alone can't tell the
+  // short-circuit apart from an unconditional resolveSeatTools call (both
+  // give `tools: []`), only the task default (`['webfetch']`) can.
+  const seatPolicy = o.agent
+    ? { ok: true, tools: [], local: false }
+    : seatTools.resolveSeatTools({ intent: seatIntentOf(o), optIn: Array.isArray(o.tools) ? o.tools : [] });
+  if (!seatPolicy.ok) { return { error: { code: seatPolicy.code, message: `Error: ${seatPolicy.message}` } }; }
+  if (seatPolicy.local) {
+    // Defensive refusal: with a local tool and a falsy o.project,
+    // isPathInside(runDir, undefined) is false, so the placement rule below
+    // would PASS, and run-launch.js's directory fallback
+    // (`(opts.role === 'seat' && opts.directory) || opts.project`) resolves to
+    // the run dir itself — a direct caller (bypassing the CLI's required
+    // --project) could scope a seat to the very dir holding its own sibling
+    // sessions, exactly what the placement rule below exists to prevent.
+    // Named mutant NOPROJECTSCOPE: dropping this guard lets that through.
+    // Pinned by run-tools.test.js's "project: undefined" case.
+    if (!o.project) {
+      return { error: { code: 'BAD_ARGS', message: 'Error: a local tool needs a project directory to scope the seats to' } };
+    }
+    // Run-directory placement (spec §4): a seat that can read the project tree
+    // must not be able to read this run's sibling sessions, so the run dir must
+    // sit OUTSIDE the tree (and still under a root amicus is willing to write to).
+    // Named mutant DIRPLACEDROP: dropping the `isPathInside(...) ||` conjunct
+    // (keeping only the allowed-root half) would accept a runDir NESTED inside
+    // the project as long as the project itself sits under an allowed root —
+    // exactly the escape this rule exists to close. Pinned by run-tools.test.js's
+    // "run dir INSIDE the project" case (allowed root, still refused) and by its
+    // "outside the project" case (same allowed root, not refused once sibling).
+    const { isPathInside, isAllowedProjectRoot } = require('../project-root-allowlist');
+    // Ruling P2-R54 (C1, round 6): `isPathInside` compares canonicalized
+    // STRINGS only, and run-dir creation follows a symlinked ancestor — so an
+    // `--out-dir` that is (or sits under) a symlink/junction into the project
+    // passed this rule lexically while landing physically inside the tree
+    // (measured 2026-09-13). Named mutant SYMLINKBLIND: dropping the
+    // `isPhysicallyInside(...) ||` conjunct restores that escape.
+    const { isPhysicallyInside } = require('./run-seat-tools-verify');
+    if (isPathInside(o.runDir, o.project) || isPhysicallyInside(o.runDir, o.project) || !isAllowedProjectRoot(o.runDir)) {
+      // C5 (P2-R35): name the ids THIS run classed local (seat-tools.js's own
+      // NON_LOCAL_TOOL_IDS, not a hand-rolled copy) — a typo'd id (e.g.
+      // `webfetsh`) is classed local by the same not-explicitly-remote rule.
+      const localIds = seatPolicy.tools.filter((id) => !seatTools.NON_LOCAL_TOOL_IDS.includes(id));
+      return {
+        error: {
+          code: 'BAD_ARGS',
+          message: `Error: --tools with a local tool (${localIds.join(', ')}) needs --out-dir OUTSIDE the project tree `
+            + '(a seat that can read the tree must not be able to read the run\'s sibling sessions; a run directory '
+            + 'that resolves inside the project through a symlink counts as inside) and under your home, tmp or '
+            + 'AMICUS_PROJECT_ROOTS',
+        },
+      };
+    }
+  }
+  return {
+    error: null,
+    seatTools: seatPolicy.tools,
+    seatToolsLocal: seatPolicy.local,
+    councilAgents: o.agent ? null : seatTools.buildCouncilAgents({ tools: seatPolicy.tools }),
+  };
+}
+
+/**
+ * Validate the run's seat tools against the engine's own declaration, after
+ * the server is up and before any Stage-1 leg launches. Two independent
+ * checks:
+ *
+ * 1. Declared tool ids (ruling P2-R30): runs for the intent's DEFAULT too,
+ *    not only an explicit opt-in — a defaults-only run is never launched
+ *    against an engine that does not actually declare a tool it would use. A
+ *    no-op whenever there is nothing to validate (`--agent`, or a review run
+ *    with no tools). When the engine cannot be asked at all (no shared
+ *    server), an explicit `--tools` opt-in still refuses, but a
+ *    defaults-only run degrades quietly — nobody opted into this check.
+ *
+ * 2. The engine-rendered agents (ruling P2-R33), gated on `o.councilAgents &&
+ *    canVerify`. Ruling P2-R38 (B1, round 3) DROPS the P2-R30 asymmetry for
+ *    this half: once verification can run, a null agent list REFUSES
+ *    regardless of whether `--tools` was ever typed — never launch council
+ *    agents this run could not verify. `canVerify` is true when this run owns
+ *    its server (production never injects `deps.launchers`; run.js only
+ *    acquires the shared server when `!deps.launchers`) OR a test supplies
+ *    its own lister (`deps.listEngineAgentsFn`). With injected launchers and
+ *    no lister there is no real server to ask and the launchers ARE the
+ *    test's own transport, so the check is skipped rather than judged against
+ *    a null it could never have resolved. In production `deps.launchers` is
+ *    never injected, so verification always runs and a missing list always
+ *    refuses. When verifiable, every directory in run-seat-tools-verify.js ::
+ *    verificationDirectories (ruling P2-R39 adds `_scratch`) is checked
+ *    against council-seat/council-support's rendered rules
+ *    (run-seat-tools-verify.js :: verifyAgentRendering). Named mutant
+ *    TRIPWIREOFF: skipping this whole block leaves a widened agent undetected.
+ * @param {object} o intent/tools/seatTools/seatToolsLocal/councilAgents/runDir/project
+ * @param {{serverClient: object}|null} sharedServer
+ * @param {{listEngineToolIdsFn?: Function, listEngineAgentsFn?: Function,
+ *   launchers?: object}} deps test seams; `launchers` gates `canVerify` (see above)
+ * @returns {Promise<{error: {code: string, message: string}|null}>}
+ */
+async function validateSeatToolsAgainstEngine(o, sharedServer, deps = {}) {
+  // Named mutant DEFAULTSUNCHECKED: narrowing this to `Array.isArray(o.tools)
+  // && o.tools.length` (the pre-P2-R30 guard) would skip a task-intent run
+  // with NO explicit --tools even when the engine declares no `webfetch` at
+  // all. Pinned by run-tools.test.js's "no tools, engine has no webfetch" case.
+  if (Array.isArray(o.seatTools) && o.seatTools.length) {
+    const seatTools = require('./seat-tools');
+    const listIds = deps.listEngineToolIdsFn || require('./run-server').listEngineToolIds;
+    const declared = await listIds(sharedServer, o.project);
+    if (!declared) {
+      // No way to ask: an explicit opt-in is refused (as before P2-R30); a
+      // defaults-only run's declared-id check is skipped instead — nobody
+      // opted into it and the shared-server degrade is recorded elsewhere —
+      // but the run still falls through to the agent-rendering tripwire
+      // below (ruling P2-R38): a defaults-only run is refused there too once
+      // a null agent list comes back. Named mutant EARLYRETURN: restoring
+      // `return { error: null }` here lets a task-intent default run launch
+      // unverified when the engine lists no tool ids.
+      if (Array.isArray(o.tools) && o.tools.length) {
+        return {
+          error: {
+            code: 'BAD_ARGS',
+            message: 'Error: --tools could not be validated: the run\'s engine did not list its tools '
+              + '(no shared server, or the tool-ids endpoint failed); nothing was launched',
+          },
+        };
+      }
+    } else {
+      // This second resolveSeatTools call is a GATE, not a recompute:
+      // `o.seatTools` (preflightSeatTools's result) is already authoritative
+      // and unchanged by this check, so `checked.tools`/`checked.local` are
+      // deliberately discarded here — only `checked.ok` (declared-id
+      // refusals, now over the default too) is consulted.
+      const checked = seatTools.resolveSeatTools({ intent: seatIntentOf(o), optIn: o.tools || [], declaredIds: declared });
+      if (!checked.ok) { return { error: { code: checked.code, message: `Error: ${checked.message}` } }; }
+    }
+  }
+  // Ruling P2-R38: the run owns its server (production never injects
+  // `launchers`) OR a test injects its own lister — either way there is
+  // something real to judge a null answer against. See the docblock above.
+  const canVerify = !!deps.listEngineAgentsFn || !deps.launchers;
+  if (o.councilAgents && canVerify) {
+    const { listEngineAgents, verifyAgentRendering, verifyAgentFields, verificationDirectories } = require('./run-seat-tools-verify');
+    const agentsFn = deps.listEngineAgentsFn || listEngineAgents;
+    // Shared by both checks below (permission rendering and, ruling P2-R53,
+    // the non-permission surface) so their refusal is byte-identical either
+    // way — a caller cannot tell which check caught the tree from the message.
+    const renderMismatch = (reason, dir) => ({
+      error: {
+        code: 'BAD_ARGS',
+        message: 'Error: the engine rendered the council agents differently from what this run registered '
+          + `(${reason}, directory ${dir}) — an opencode.json or .opencode/agent file the engine `
+          + 'loads for that directory (the tree\'s, or your global config) defines council-seat/'
+          + 'council-support and alters them; remove those entries, or run with --agent Plan to use the '
+          + 'engine\'s own agent knowingly (v4.9.7 behaviour). Nothing was launched.',
+      },
+    });
+    const directories = verificationDirectories(o);
+    for (const dir of directories) {
+      const list = await agentsFn(sharedServer, dir);
+      if (!list) {
+        // Ruling P2-R38: never launch council agents this run could not
+        // verify — a defaults-only run now refuses exactly like an explicit
+        // opt-in; there is no quiet degrade left to fall back on.
+        return {
+          error: {
+            code: 'BAD_ARGS',
+            message: 'Error: the council agents could not be verified against the run\'s engine '
+              + `(${sharedServer ? 'the shared server answered without an agent list' : 'no shared server was available to answer the agent list'}); `
+              + 'nothing was launched; --agent Plan runs every leg on the engine\'s own Plan agent as v4.9.7 did '
+              + '(reads, searches and shell allowed; edits denied), knowingly and without the allowlist',
+          },
+        };
+      }
+      for (const [name, allowlist] of [['council-seat', o.seatTools || []], ['council-support', []]]) {
+        const agent = list.find((a) => a.name === name);
+        if (!agent) {
+          return { error: { code: 'BAD_ARGS', message: `Error: the engine did not register ${name}` } };
+        }
+        const verified = verifyAgentRendering(Array.isArray(agent.permission) ? agent.permission : [], allowlist);
+        if (!verified.ok) { return renderMismatch(verified.reason, dir); }
+        // Ruling P2-R53 (B1, round 6): verifyAgentRendering only ever checked
+        // `permission` — a tree can ALSO set a council agent's prompt, model,
+        // sampling, options and mode (measured 2026-09-13). Named mutant
+        // FIELDSBLIND (in verifyAgentFields itself): returning {ok:true}
+        // unconditionally there reddens this call site's own coverage too.
+        const fieldsVerified = verifyAgentFields(agent);
+        if (!fieldsVerified.ok) { return renderMismatch(fieldsVerified.reason, dir); }
+      }
+    }
+  }
+  return { error: null };
+}
+
+const { listEngineAgents, verifyAgentRendering, verifyAgentFields } = require('./run-seat-tools-verify');
+
+module.exports = {
+  preflightSeatTools, validateSeatToolsAgainstEngine, listEngineAgents, verifyAgentRendering, verifyAgentFields,
+};

package/src/council/run-server.js

@@ -21,10 +21,12 @@
  *      (opencode-client.js) passes only hostname/port/signal/config to
  *      `createOpencodeServer`. The server is directory-agnostic.
  *   2. Scoping is PER CALL: run-launch.js sets `directory: opts.project` on
- *      every launch, fanout threads it to each leg, and runHeadless turns it
- *      into `query.directory` on create/prompt/messages/status/abort (dirArgs,
- *      headless.js). A judge's calls carry `_scratch`; a Stage-1 leg's carry the
- *      run dir. One server answers both, scoped per request.
+ *      every launch except a stage-1 seat launch (`opts.role === 'seat'`,
+ *      P2-R11) that passes `opts.directory` — never a judge/debate/chair
+ *      leg's. fanout threads it to each leg, and runHeadless turns it into
+ *      `query.directory` on create/prompt/messages/status/abort (dirArgs,
+ *      headless.js). A judge's calls carry `_scratch`; a Stage-1 leg's carry
+ *      the run dir. One server answers both, scoped per request.
  *   3. The MCP surface is identical for both stages already: every council
  *      launch passes `noMcp: true` and nothing else MCP-related, and fanout's
  *      buildMcpConfig call receives no `projectDir`, so its result is a pure
@@ -216,7 +218,12 @@ async function acquireRunServer(o, deps = {}) {
   for (const notice of notices) { process.stderr.write(`Notice: ${notice}\n`); }
 
   try {
-    const { client, server } = await startFn(mcpServers, { models });
+    const { client, server } = await startFn(mcpServers, {
+      models,
+      // Spec 2026-09-11 §4: the run's two council agents (run.js computes them
+      // from the intent and --tools before this call).
+      ...(o.councilAgents ? { agents: o.councilAgents } : {}),
+    });
     logger.info('Council run using ONE shared OpenCode server',
       { runId: o.runId, url: server.url, models: models.length });
     // The POSITIVE, durable signal (see the ⚠️ above). `goPid` is the field that
@@ -227,6 +234,7 @@ async function acquireRunServer(o, deps = {}) {
       sharedServer: {
         acquired: true, at: new Date().toISOString(),
         goPid: (server && server.goPid) || null, models: models.length,
+        agents: Object.keys(o.councilAgents || {}),
       },
     }, 'sharedServer');
     return { serverClient: client, server };
@@ -262,4 +270,31 @@ async function releaseRunServer(shared) {
   try { await shared.server.close(); } catch { /* best-effort: the run is over */ }
 }
 
-module.exports = { acquireRunServer, releaseRunServer, resolveRunServerModels, recordServerFate };
+/**
+ * The tool ids the run's engine declares (spec 2026-09-11 §4): what `--tools`
+ * is validated against, read from the engine itself so the accepted set is
+ * never hand-listed. Best-effort and never throws: null means "could not ask"
+ * (no shared server, an engine without the endpoint, a transport error), and
+ * run.js refuses `--tools` on null rather than launching unvalidated.
+ * Measured 2026-09-12 on the pinned SDK 1.18.15 with a keyless server start
+ * (`GET /experimental/tool/ids`); the keyless probe suite
+ * `tests/council-agents-engine.integration.test.js`, added later in this PR,
+ * pins it in CI (P2-R12: this citation named that file before it existed).
+ * @param {{serverClient: object}|null} shared
+ * @param {string} directory the project directory the query is scoped to
+ * @returns {Promise<string[]|null>}
+ */
+async function listEngineToolIds(shared, directory) {
+  const client = shared && shared.serverClient;
+  if (!client || !client.tool || typeof client.tool.ids !== 'function') { return null; }
+  try {
+    const res = await client.tool.ids({ query: { directory } });
+    return (res && Array.isArray(res.data)) ? res.data.slice() : null;
+  } catch (err) {
+    const { logger } = require('../utils/logger');
+    logger.debug('Engine tool list unavailable', { error: err.message });
+    return null;
+  }
+}
+
+module.exports = { acquireRunServer, releaseRunServer, resolveRunServerModels, recordServerFate, listEngineToolIds };

package/src/council/run-stage1-launch.js

@@ -33,6 +33,11 @@ async function launchStage1(ctx) {
     // the chair (run-chair.js) and debate legs (run-debate.js) never receive
     // this, so they never substitute via chains.
     fallback: o.fallback, catalog: o.catalog,
+    // Spec 2026-09-11 §4: stage-1 legs are SEATS (council-seat); with a local
+    // tool opted in they are scoped to the project tree while their metadata
+    // stays in the run dir (`project: o.runDir` above).
+    role: 'seat',
+    ...(o.seatToolsLocal ? { directory: o.project } : {}),
   };
   const launches = [];
   const seated = []; // parallel to `launches`: what each one was SUPPOSED to seat
@@ -47,7 +52,7 @@ async function launchStage1(ctx) {
       seated.push({ waveId, models: [m], roster: seats.slice(i, i + 1) });
       launches.push(launchers.launchSolo({
         ...common, model: m, waveId, seats: seated[seated.length - 1].roster,
-        prompt: briefings.stage1LensBriefing(o.intent, { lens: o.lenses[i], briefing: o.briefing, date: o.date }),
+        prompt: briefings.stage1LensBriefing(o.intent, { lens: o.lenses[i], briefing: o.briefing, date: o.date, tools: o.seatTools, agent: o.agent }),
       }));
     });
   } else {
@@ -61,7 +66,7 @@ async function launchStage1(ctx) {
         roster: seats.filter(s => s.alias !== o.critic) });
       launches.push(launchers.launchWave({
         ...common, models: seats1, waveId: `${o.runId}-s1`, seats: seated[seated.length - 1].roster,
-        prompt: briefings.stage1SeatBriefing(o.intent, { briefing: o.briefing, date: o.date }),
+        prompt: briefings.stage1SeatBriefing(o.intent, { briefing: o.briefing, date: o.date, tools: o.seatTools, agent: o.agent }),
       }));
     }
     if (o.critic) {
@@ -70,7 +75,7 @@ async function launchStage1(ctx) {
         roster: seats.filter(s => s.alias === o.critic).slice(0, 1) });
       launches.push(launchers.launchSolo({
         ...common, model: o.critic, waveId: `${o.runId}-c1`, seats: seated[seated.length - 1].roster,
-        prompt: briefings.stage1CriticBriefing(o.intent, { briefing: o.briefing, date: o.date }),
+        prompt: briefings.stage1CriticBriefing(o.intent, { briefing: o.briefing, date: o.date, tools: o.seatTools, agent: o.agent }),
       }));
     }
   }

package/src/council/run.js

@@ -38,13 +38,13 @@ const { finishRun } = require('./run-finish');
 /**
  * @param {object} options {briefing, models, chair, critic?, lenses?, project, runId,
  *   runDir, timeout?, maxCost?, gateway?, noValidateModel?, date, debate?, noCostGate?,
- *   councilName?, fallback?, catalog?} councilName (v4.3 Task 3) = preset name when
- *   launched via `--council <preset>`, else null — threaded via ctx.o into every
- *   launchWave/launchSolo for leg ledger attribution. fallback/catalog (v4.3 Task 18
- *   §6.2): ctx.o carries both, but only run-stages.js's stage launches read them —
- *   the chair/debate legs never substitute via chains.
+ *   councilName?, fallback?, catalog?, tools?: string[], agent?: 'Plan'|'Build'} councilName
+ *   (v4.3 Task 3) = preset name when launched via `--council <preset>`, else null —
+ *   threaded via ctx.o into every launchWave/launchSolo for leg ledger attribution.
+ *   fallback/catalog (v4.3 Task 18 §6.2): ctx.o carries both, but only run-stages.js's
+ *   stage launches read them — the chair/debate legs never substitute via chains.
  * @param {object} [deps] {launchers?, appendRunFn?, statsFn?, installSignalAbortFn?,
- *   startOpenCodeServerFn? (v4.4.1 Task 0.5 test seam, see ./run-server)}
+ *   startOpenCodeServerFn?, listEngineToolIdsFn? (v4.4.1 Task 0.5 / spec 2026-09-11 §4 test seams, see ./run-server)}
  * @returns {Promise<{exitCode: number, run: object}>}
  */
 async function runCouncil(options, deps = {}) {
@@ -70,22 +70,13 @@ async function runCouncil(options, deps = {}) {
   // below (a getter, because the launchers are built first); null = as before.
   let sharedServer = null;
   const launchers = deps.launchers
-    || createLaunchers({ remainingBudget, reserveBudget, onBudgetRefusal: noteBudgetRefusal, sharedServer: () => sharedServer });
+    || createLaunchers({ remainingBudget, reserveBudget, onBudgetRefusal: noteBudgetRefusal, sharedServer: () => sharedServer,
+      councilAgents: () => o.councilAgents || null, agentOverride: () => o.agent }); // spec 2026-09-11 §4: getters, decided below.
 
   runState.initCouncilRun(o); // run.json seed + sessions-dir pointer (run-state.js)
 
-  // dropped-members (spec §5, Plan 4): a seat the user's preset requested that
-  // never resolved is a lost seat — announced like every other loss. Fires
-  // once per member, before any launch (zero spend), for BOTH transports.
-  for (const dm of o.droppedMembers || []) {
-    degrade.note({
-      channel: 'dropped-members',
-      what: `seat ${dm.member} was not seated`,
-      why: dm.reason,
-      effect: 'the bench is smaller than the preset requested; the run will exit degraded (2)',
-      data: { member: dm.member, reason: dm.reason },
-    });
-  }
+  // dropped-members announcement lives in ./run-degrade (300-line gate, P2-R14).
+  require('./run-degrade').noteDroppedMembers(degrade, o.droppedMembers);
 
   emitRunStarted(o.runDir, o.runId, { bench: o.models, chair: o.chair }, o.follow);
 
@@ -113,8 +104,15 @@ async function runCouncil(options, deps = {}) {
     return { exitCode: code, run };
   };
 
+  // Spec 2026-09-11 §4 (PR 2): seat tools decided + refused pre-spend, checked below.
+  const st = require('./run-seat-tools').preflightSeatTools(o);
+  if (st.error) { return finalize(1, st.error); }
+  Object.assign(o, { seatTools: st.seatTools, seatToolsLocal: st.seatToolsLocal, councilAgents: st.councilAgents });
+
   // Injected launchers bring their own transport. Never throws — degrades to null.
   if (!deps.launchers) { sharedServer = await require('./run-server').acquireRunServer({ ...o, degrade }, deps); }
+  const ev = await require('./run-seat-tools').validateSeatToolsAgainstEngine(o, sharedServer, deps);
+  if (ev.error) { return finalize(1, ev.error); }
 
   const ctx = { o, launchers, addWave, overBudget, degrade, scratchDir: path.join(o.runDir, '_scratch') };
 
@@ -142,11 +140,13 @@ async function runCouncil(options, deps = {}) {
     o.seats = seatPre.seats;
     o.criticSeat = seatPre.criticSeat;
     runState.checkpoint(o.runDir, { seats: o.seats, criticSeat: o.criticSeat,
-      ...(o.intent === 'task' ? { intent: 'task' } : {}) });   // v4.9 W5.3: emit-when-'task', never 'review'
+      ...(o.intent === 'task' ? { intent: 'task' } : {}),   // v4.9 W5.3: emit-when-'task', never 'review'
+      // spec §4: seatTools emit-when-non-empty, agentOverride emit-when-set.
+      ...(o.seatTools && o.seatTools.length ? { seatTools: o.seatTools } : {}), ...(o.agent ? { agentOverride: o.agent } : {}) });
 
     // Composed Stage-1 seat briefing persisted for auditability (spec §4 layout).
     fs.writeFileSync(path.join(o.runDir, 'briefing-stage1.md'),
-      briefings.stage1SeatBriefing(o.intent, { briefing: o.briefing, date: o.date }), { mode: 0o600 });
+      briefings.stage1SeatBriefing(o.intent, { briefing: o.briefing, date: o.date, tools: o.seatTools, agent: o.agent }), { mode: 0o600 });
 
     // ---- Stage 1: independent reviews ----
     // Lens mode launches one solo per seat instead of a `-s1` seat wave, so it