amicus 4.9.7 → 4.9.8

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.7",
+  "version": "4.9.8",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,100 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.8] - 2026-09-13
+
+### Changed
+
+- **Council legs run as two per-run agents with an explicit tool allowlist.** Stage-1 seats and
+  their retries run as `council-seat` — task mode defaults to `webfetch`, review mode to no tools,
+  and `--tools <a,b,c>` (MCP: `tools`) opts more in, validated against the engine's own declared
+  ids before any leg launches; repair, judge, debate and chair legs run as `council-support` with
+  no tools at all. `task` and `skill` are refused (they spawn or escape the session), as are
+  `edit`/`write`/`apply_patch`/`question`/`invalid`; `--agent Plan|Build` is the escape hatch
+  (`Plan` = the pre-4.9.8 behaviour: edits denied, reads/searches/shell allowed). A local tool
+  needs `--out-dir` outside the project tree and scopes the seats to the tree with
+  `external_directory: deny`. With `read` opted in the seat is denied `.env`, `.env.*` and
+  `.envrc` files at the engine (the match is case-sensitive on Linux; the deny rules are
+  measured to render after the seat's own read allow; the refusal itself is exercised by the
+  release ritual's live run); `grep` and `bash` have no per-file fence. `bash` is outside
+  every fence (run directory, home, network) and the CLI says so when it is opted in; the CLI
+  also prints a Notice for `grep`/`glob` (no per-file fence) and for `--agent Plan` (every leg
+  can run commands); `tools: null` is treated as unset like `agent: null`; an `--agent` run's
+  directory stays inside the project; `--tools` and `--agent` cannot be combined; `todowrite`
+  counts as a tool that never touches the tree. After registration, the run also reads back
+  what the engine actually rendered for each council agent — over the run directory, its
+  `_scratch` support-leg directory, and the project tree when local — and refuses before
+  launch if an `opencode.json`/`.opencode/agent` file the engine loads for that directory (the
+  tree's, or your global config) widened it, or if the engine cannot be asked at all
+  once verification can run — including when the run's own shared OpenCode server fails to
+  start: a default (non-`--agent`) run now refuses before any launch instead of falling back,
+  and the per-wave fallback servers that used to absorb that failure for every run now serve
+  only an `--agent` run, whose verification is skipped by design; a reviewed tree's own config
+  was measured to merge into the registered agent by key order (ruling P2-R33; the
+  unconditional refusal on an unverifiable engine, a failed shared-server start included, is
+  P2-R38/P2-R43, `_scratch` coverage is P2-R39, and the external_directory exemption for the
+  engine's own tool-output cache — resolved XDG-first, matching `auth-json.js`/`engine-log.js`
+  — is narrowed by P2-R40/P2-R42). The tripwire also verifies the council agents' non-permission
+  surface (prompt, model, sampling, options, mode) as rendered, since a tree can set those too
+  (P2-R53); a council agent is registered by replacing any same-name entry; the local-tool
+  placement rule compares physical paths, so a run directory reached through a symlink into the
+  project is refused (P2-R54); the CLI prints a Notice for `read` naming its exact fence;
+  `tools: null` over MCP is unset (P2-R55).
+  Two of the three leg-loss classes in the 2026-09-11 study shared one
+  precondition — a seat reached for a tool it did not need (gemini `grep`/`glob` over the global
+  install, cohere `task {}`) — and this closes that door. Previously every leg ran as the engine's
+  `Plan` agent, which denies file edits but leaves the rest of the tool set available (the
+  study saw seats reach for `grep`, `glob` and `task` under it). (`docs/council.md` § Tool
+  access; spec §4; PR 2 of 3.)
+
+### Fixed
+
+- **Headless legs are no longer declared complete while the engine is still answering.**
+  The stable-idle heuristic (`headless.js`, the v4.4 B4 "measured defect site") now
+  defers to `session.status`: while the engine reports `busy` (or `retry`, provider
+  backoff) and no tool call is live, flat output is treated as activity rather than
+  silence, and the leg waits for its message to finalize. In-flight reasoning and text
+  are invisible to the poller, so a seat that narrated between tool calls and then
+  answered for longer than 60 s was harvested mid-answer — three complete council
+  deliverables were discarded 39–107 s before they finished in the 2026-09-11
+  study (run D0), and the run reported `complete` with no degrades. The B4 bounded
+  tool-settle ceiling is unchanged and still governs whenever a tool call is live. When
+  `session.status` is unavailable the heuristic runs as the fallback it was always meant
+  to be. The trade is explicit: a busy-but-wedged (or permanently retrying) leg that
+  already produced output now runs to its `--timeout` (15 min default) and is named
+  `timeout`, instead of being declared complete at 60 s on a stub; the debug trace
+  names the veto once per flat stretch (and again whenever a non-zero count is reset,
+  e.g. a status flip-flop) and the exit line records the last engine status. When the
+  fallback heuristic ends an unfinalized message the leg logs a warning naming the
+  status it saw, and a retry whose next attempt lies beyond the leg deadline ends the
+  leg at once as `RETRY_BEYOND_DEADLINE` instead of holding the seat (never once the
+  last message has finalized — that leg completes normally — and never while a tool
+  call is live, where the tool-settle ceiling governs).
+  (`docs/superpowers/specs/2026-09-11-council-leg-completion-design.md` §3; PR 1 of 3.)
+- **A seat whose findings nothing could verify is now visible in the report and in the verdict
+  census.** When a Stage-1 response carried no parseable findings block and the bounded repair
+  supplied one, the seat's `runStats` row has carried `findingsUnverified: true` since the repair
+  contract landed (LC-11) — through `tally.json` and `verdict.json` — and died at the renderer:
+  `report.html`'s **What was lost** table held only the degrade sink's records (dead legs and the
+  like), and `seatsReviewed` counted the seat as a full reviewer. Now the report (Markdown and
+  HTML) gains one **What was lost** row per such seat (channel `unverified-repair`: *seat X's
+  findings came from a repair of a response with no findings block — nothing verified them*) and
+  one per refused repair (channel `repair-refused`, naming the code), derived from `runStats` when
+  the report is built — so `amicus council report` on an older `verdict.json` shows them too, and
+  nothing in `run.json`, the exit code or the degrade sink changes. `verdict.json`'s census gains
+  two numbers, `seatsReviewed: {reviewed, unverified, refused, of}` (always written, never more
+  than `reviewed`; older documents still validate) — `refused` (council #248 round 2) counts
+  seats whose repair was refused: they tallied no findings and would otherwise read as full
+  reviewers on every gate surface, and the council-review check title and sticky comment print
+  `(N unverified)` and `(N refused)` when non-zero. A run also prints one `Notice:` line on
+  stderr at the end naming its unverified and refused seats, so a local run is no longer silent
+  about them; the exit code and every artifact are unchanged. The wording never says "stub":
+  the flag also fires on a real review whose trailing JSON block was malformed. Study run D0
+  (three narration stubs, three repairs) now reads `{reviewed: 3, unverified: 3, refused: 0,
+  of: 3}` in `verdict.json` — `seats reviewed: 3 of 3 (3 unverified)` in the sticky comment
+  — with three rows in the report, where it read `{reviewed: 3, of: 3}` and nothing. (#242;
+  `docs/superpowers/specs/2026-09-11-council-leg-completion-design.md` §5; PR 3 of 3.)
+
 ## [4.9.7] - 2026-09-09
 
 Three findings deferred from the v4.9.6 cut, and the two open questions filed beside them. The

package/README.md

@@ -455,7 +455,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.7",
+  "version": "4.9.8",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/docs/ROADMAP.md

@@ -13,13 +13,13 @@ lives under **Backlog (tracked, not scheduled)** with everything else that is re
 Nothing about the content changed and no judgment about its value is implied; only its status. When
 an org buyer and the org to support them exist, it earns a number then.
 
-Amicus is at **v4.9.7** (2026-09-09). Each 4.x rev below leads with the benefit, not the
+Amicus is at **v4.9.8** (2026-09-13). Each 4.x rev below leads with the benefit, not the
 plumbing; the patch releases since v4.9.0 carry no section of their own, because each corrected a
 defect rather than adding scope — where one added a surface (v4.9.4's `--thinking` refusals and
-`output-budget` doctor row, v4.9.5's Electron digest gate, v4.9.6's artifact custody, v4.9.7's dual name-table rescue boundary) it did so to
+`output-budget` doctor row, v4.9.5's Electron digest gate, v4.9.6's artifact custody, v4.9.7's dual name-table rescue boundary, v4.9.8's per-run seat tool allowlist and its unverified/refused seat census) it did so to
 make an existing promise true, not to widen it. See `CHANGELOG.md` for what each one contained.
 
-**Status:** v4.0 through **v4.9.0** have **shipped**, plus the v4.9.1–v4.9.7 patch releases —
+**Status:** v4.0 through **v4.9.0** have **shipped**, plus the v4.9.1–v4.9.8 patch releases —
 everything on this page is a record of what landed, not a plan. Composition — the scope that
 carried the number v4.6 here until the degrade-announcement-invariant milestone took the v4.6.0
 release (2026-08-02) — is now an unscheduled candidate for the next rev, tabled in its own section

package/docs/architecture-map.md

@@ -38,6 +38,7 @@ src/
 │   ├── presets-cli.js
 │   ├── report-cost.js
 │   ├── report-html.js
+│   ├── report-lost-rows.js
 │   ├── report-md.js
 │   ├── report.js
 │   ├── run-assemble.js
@@ -56,6 +57,8 @@ src/
 │   ├── run-retry-notes.js
 │   ├── run-retry-window.js  # The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay
 │   ├── run-retry.js
+│   ├── run-seat-tools-verify.js  # The engine-rendering tripwire's pure pieces, plus `verificationDirectories`'
+│   ├── run-seat-tools.js
 │   ├── run-server.js
 │   ├── run-stage1-launch.js  # Stage-1 launch pass for the council engine.
 │   ├── run-stage1-rows.js
@@ -66,6 +69,7 @@ src/
 │   ├── run-stats-entry.js
 │   ├── run-verdict-files.js
 │   ├── run.js
+│   ├── seat-tools.js
 │   ├── seats.js
 │   ├── stage1-bind.js
 │   ├── street-cred.js
@@ -135,6 +139,7 @@ src/
 │   ├── fanout-validate.js
 │   ├── fanout-wave-io.js
 │   ├── fanout.js
+│   ├── heartbeat.js
 │   ├── interactive-abort.js
 │   ├── interactive-mirror.js
 │   ├── interactive-process.js  # Sidecar Interactive Process Helpers - Electron probe/env/process-exit plumbing
@@ -308,6 +313,7 @@ src/
 │   └── seat-space.js  # Council Workspace — the seat-space PREDICATES (v4.8 PR5b).
 ├── cli-council-run-bench.js  # Bench and input resolution for the council run command.
 ├── cli-council-run-render.js
+├── cli-council-run-tools.js  # `--tools`/`--agent` validation and the v4.7 out-dir fence for `council run`.
 ├── cli-handlers-abort.js  # CLI Abort Handler (B21-rest extraction)
 ├── cli-handlers-council-run.js
 ├── cli-handlers-council.js
@@ -336,6 +342,7 @@ src/
 ├── jsonl-parser.js  # JSONL Parser
 ├── mcp-council-awareness.js
 ├── mcp-council-bench.js
+├── mcp-council-pack-map.js  # COUNCIL_PACK_PARAM_MAP, split out of mcp-council-run.js for the 300-line size gate (P2-R16).
 ├── mcp-council-run.js
 ├── mcp-notify.js  # Pure helpers + in-process registry for the MCP `onComplete: 'mcp-notify'`
 ├── mcp-server.js  # @module mcp-server — Amicus MCP Server (stdio transport)
@@ -419,6 +426,7 @@ scripts/
 ├── integration-test.sh
 ├── mark-test-passed.js  # Writes the current git HEAD SHA to .test-passed for the pre-push SHA cache
 ├── postinstall.js  # Post-install script for amicus
+├── probe-council-agents.js  # Spec 2026-09-11 §4 — the ENGINE side of the council agents (ruling P2-R21).
 ├── probe-darwin-extract.js
 ├── probe-max-tokens.js  # Wire probe for issue #218: what max_tokens / reasoning / thinking does the
 ├── run-integration-keyless.js
@@ -452,6 +460,7 @@ evals/
 |--------|---------|-------------|
 | `cli-council-run-bench.js` | Bench and input resolution for the council run command. | `resolveBench()`, `resolveChair()`, `resolveCritic()`, `CHAIR_DEFAULT()`, `parseList()` |
 | `cli-council-run-render.js` |  | `renderRunHuman()` |
+| `cli-council-run-tools.js` | `--tools`/`--agent` validation and the v4.7 out-dir fence for `council run`. | `checkCouncilRunTools()` |
 | `cli-handlers-abort.js` | CLI Abort Handler (B21-rest extraction) | `handleAbort()` |
 | `cli-handlers-council-run.js` |  | `handleCouncilRun()`, `renderRunHuman()`, `CHAIR_DEFAULT()` |
 | `cli-handlers-council.js` |  | `handleCouncil()` |
@@ -480,6 +489,7 @@ evals/
 | `jsonl-parser.js` | JSONL Parser | `parseJSONLLine()`, `readJSONL()`, `extractTimestamp()`, `formatMessage()`, `formatContext()` |
 | `mcp-council-awareness.js` |  | `subWaveIds()`, `countWaveLegs()`, `elapsedOf()`, `enginePid()`, `buildCouncilStatusPayload()` |
 | `mcp-council-bench.js` |  | `resolveBenchInput()`, `auditBenchAliases()` |
+| `mcp-council-pack-map.js` | COUNCIL_PACK_PARAM_MAP, split out of mcp-council-run.js for the 300-line size gate (P2-R16). | `COUNCIL_PACK_PARAM_MAP()` |
 | `mcp-council-run.js` |  | `handleCouncilRunTool()`, `COUNCIL_PACK_PARAM_MAP()`, `buildCouncilStatusPayload()`, `listCouncilRuns()`, `abortCouncilRun()` |
 | `mcp-notify.js` | Pure helpers + in-process registry for the MCP `onComplete: 'mcp-notify'` | `validateOnComplete()`, `buildNotifyPayload()`, `requestMcpNotify()`, `consumeMcpNotify()` |
 | `mcp-server.js` | @module mcp-server — Amicus MCP Server (stdio transport) | `handlers()`, `startMcpServer()`, `getProjectDir()`, `resolveProjectDir()`, `getClientRoot()` |
@@ -494,7 +504,7 @@ evals/
 | `spend-query.js` |  | `filterRows()`, `groupRows()`, `computeWasted()`, `emptyTokens()`, `addTokens()` |
 | `council/anonymize.js` |  | `assignLabels()`, `toGlobalId()`, `toGlobalFindings()`, `rankingToOrder()`, `LETTERS()` |
 | `council/briefings-chair-task.js` |  | `CHAIR_ANSWER_VALUES()`, `ANSWER_SCALE_ADDENDUM()`, `TASK_CHAIR_SYNTHESIS()`, `TASK_CHAIR_SYNTHESIS_NO_CLAIMS()`, `TASK_CONCURRENCE_CAVEAT()` |
-| `council/briefings-chair.js` |  | `dateLine()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `chairRepairPromptFor()`, `CHAIR_VERDICT_VALUES()`, `VERDICT_SCALE_ADDENDUM()` |
+| `council/briefings-chair.js` |  | `dateLine()`, `CHAIR_NO_TOOLS_LEAD()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `chairRepairPromptFor()`, `CHAIR_VERDICT_VALUES()` |
 | `council/briefings-debate.js` |  | `DEBATE_NO_TOOLS_PREAMBLE()`, `DEFENSE_CONTRACT()`, `REVOTE_CONTRACT()`, `buildDefenseBrief()`, `buildRevoteBundle()` |
 | `council/briefings-stage2-task.js` |  | `TASK_JUDGE_FRAME()`, `TASK_JUDGE_A()`, `TASK_JUDGE_B()`, `TASK_JUDGE_B_NO_CLAIMS()`, `NO_CLAIMS_INDEX()` |
 | `council/briefings-stage2.js` |  | `JUDGE_NO_TOOLS_PREAMBLE()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `CHAIR_VERDICT_VALUES()`, `JUDGE_OUTPUT_CONTRACT()`, `VERDICT_SCALE_ADDENDUM()` |
@@ -511,6 +521,7 @@ evals/
 | `council/presets-cli.js` |  | `runSave()`, `runList()`, `runShow()` |
 | `council/report-cost.js` |  | `buildCostModel()` |
 | `council/report-html.js` |  | `renderHtml()` |
+| `council/report-lost-rows.js` |  | `lostRowsOf()` |
 | `council/report-md.js` |  | `renderMd()` |
 | `council/report.js` |  | `buildReport()`, `toModel()`, `TIER_ORDER()`, `SYMBOL()`, `isSeatSpace()` |
 | `council/run-assemble.js` |  | `buildRunStatsEntry()`, `worseConformance()`, `buildTallyInput()`, `writeTallyFiles()`, `writeVerdictFiles()` |
@@ -519,7 +530,7 @@ evals/
 | `council/run-debate-revote.js` |  | `legOpts()`, `legRow()`, `runRevoteWave()` |
 | `council/run-debate-stage.js` |  | `runDebateStage()` |
 | `council/run-debate.js` |  | `runDebate()`, `nothingToDebate()`, `disputingJudges()`, `debateTargets()` |
-| `council/run-degrade.js` |  | `createDegradeSink()` |
+| `council/run-degrade.js` |  | `createDegradeSink()`, `noteDroppedMembers()` |
 | `council/run-finalize.js` |  | `statusForExit()`, `resolveTerminalExit()`, `writeRunTerminal()`, `SIGNAL_EXIT()` |
 | `council/run-finish.js` |  | `finishRun()` |
 | `council/run-launch.js` |  | `createLaunchers()`, `materializeReviews()`, `materializeDebate()`, `sanitizeName()`, `isAbortExit()` |
@@ -529,7 +540,9 @@ evals/
 | `council/run-retry-notes.js` |  | `waveStillDeadNote()`, `skippedWaveNote()`, `srcLegStillDeadNote()`, `retryLegStillDeadNote()`, `missingLegStillDeadNote()` |
 | `council/run-retry-window.js` | The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay | `retryBackstopMs()` |
 | `council/run-retry.js` |  | `groupStage1Losses()`, `retryStage1Losses()` |
-| `council/run-server.js` |  | `acquireRunServer()`, `releaseRunServer()`, `resolveRunServerModels()`, `recordServerFate()` |
+| `council/run-seat-tools-verify.js` | The engine-rendering tripwire's pure pieces, plus `verificationDirectories`' | `verificationDirectories()`, `listEngineAgents()`, `verifyAgentRendering()`, `verifyAgentFields()`, `resolvePhysicalPath()` |
+| `council/run-seat-tools.js` |  | `preflightSeatTools()`, `validateSeatToolsAgainstEngine()`, `listEngineAgents()`, `verifyAgentRendering()`, `verifyAgentFields()` |
+| `council/run-server.js` |  | `acquireRunServer()`, `releaseRunServer()`, `resolveRunServerModels()`, `recordServerFate()`, `listEngineToolIds()` |
 | `council/run-stage1-launch.js` | Stage-1 launch pass for the council engine. | `launchStage1()` |
 | `council/run-stage1-rows.js` |  | `pushDeadSeatRows()`, `supersededRows()` |
 | `council/run-stage1-superseded.js` |  | `supersededRows()` |
@@ -539,12 +552,13 @@ evals/
 | `council/run-stats-entry.js` |  | `buildRunStatsEntry()` |
 | `council/run-verdict-files.js` |  | `writeVerdictFiles()` |
 | `council/run.js` |  | `runCouncil()`, `pickFallbackChair()`, `SIGNAL_EXIT()` |
+| `council/seat-tools.js` |  | `REFUSED_TOOL_IDS()`, `REMOTE_TOOL_IDS()`, `NON_LOCAL_TOOL_IDS()`, `SEAT_READ_DENY_PATTERNS()`, `defaultToolsFor()` |
 | `council/seats.js` |  | `buildSeats()`, `roleAt()`, `bindSeats()`, `artifactName()`, `displayName()` |
 | `council/stage1-bind.js` |  | `bindStage1Waves()`, `orphanLegNote()`, `missingSeatDeadWave()`, `bindPaddedWave()` |
 | `council/street-cred.js` |  | `computeStreetCred()`, `rankPositions()`, `credSeats()` |
 | `council/tally.js` |  | `assignTier()`, `computeStreetCred()`, `tally()`, `COUNCIL_SCHEMA_VERSION()` |
 | `council/verdict-seat-loss.js` |  | `summarizeSeatLoss()`, `deriveSeatLoss()` |
-| `council/verdict-seats-reviewed.js` | #202: the bench-seat census for verdict.json, as a spreadable fragment. | `seatsReviewedOf()` |
+| `council/verdict-seats-reviewed.js` | #202: the bench-seat census for verdict.json, as a spreadable fragment. | `seatsReviewedOf()`, `isBenchRole()`, `isUnverifiedSeat()`, `isRefusedSeat()`, `seatLabel()` |
 | `council/verdict.js` |  | `buildVerdict()`, `summarizeSeatLoss()`, `deriveSeatLoss()`, `readOverallVerdict()`, `readPriorVerdictSurfaces()` |
 | `design/tokens.js` |  | `tokenCss()`, `TOKENS()` |
 | `observe/council-legs.js` |  | `buildLegRows()` |
@@ -592,6 +606,7 @@ evals/
 | `sidecar/fanout-validate.js` |  | `parseModelsList()`, `DEFAULT_MAX_LEGS()`, `validateFanoutModels()` |
 | `sidecar/fanout-wave-io.js` |  | `writeWaveMetadata()`, `writeWaveDoc()`, `finishWave()`, `stampLegAttribution()` |
 | `sidecar/fanout.js` |  | `parseModelsList()`, `deriveLegIds()`, `validateFanoutModels()`, `DEFAULT_MAX_LEGS()`, `runFanout()` |
+| `sidecar/heartbeat.js` |  | `HEARTBEAT_INTERVAL()`, `createHeartbeat()` |
 | `sidecar/interactive-abort.js` |  | `startAbortWatch()`, `markResultAborted()`, `readAbortedMarker()`, `DEFAULT_INTERVAL_MS()` |
 | `sidecar/interactive-mirror.js` |  | `startInteractiveMirror()` |
 | `sidecar/interactive-process.js` | Sidecar Interactive Process Helpers - Electron probe/env/process-exit plumbing | `getElectronPath()`, `checkElectronAvailable()`, `buildElectronEnv()`, `handleElectronProcess()` |

package/docs/council.md

@@ -22,6 +22,7 @@ orchestration recipe. This page is the reference for the artifacts that recipe p
 - [The pipeline, end to end](#the-pipeline-end-to-end)
 - [`amicus council run`](#amicus-council-run)
   - [Task mode (`--intent task`)](#task-mode---intent-task)
+  - [Tool access per usage (`--tools`)](#tool-access-per-usage---tools)
   - [Debate mode](#debate-mode)
 - [Council Workspace (GUI)](#council-workspace-gui)
   - [Auto-open on `amicus_council_run` (v4.5)](#auto-open-on-amicus_council_run-v45)
@@ -114,6 +115,7 @@ amicus council run --prompt-file <briefing.md>
     [--template <name|path>] [--artifact <file>] [--var k=v]  # v4.5, see docs/usage.md#briefing-templates
     [--pack <name|path>]                                       # v4.5, see docs/usage.md#policy-packs
     [--intent review|task]                                     # v4.9, see Task mode below
+    [--tools <a,b,c>] [--agent Plan|Build]                    # v4.9.8, see Tool access below
 ```
 
 **The headless engine (v4.0).** Everything the `second-opinion` skill orchestrates by hand in
@@ -372,6 +374,101 @@ empty-section wordings — is used verbatim in both intents. One vocabulary, two
 - **Task runs build no reliability history**, so they never contribute to — and never benefit from —
   `amicus council stats`, including the ledger-driven chair-fallback promotion.
 
+### Tool access per usage (`--tools`)
+
+Tool access is a property of the **run**, set by the caller according to whether the seats
+must go and get their material — not a property of the mode (spec 2026-09-11 §2). Every
+council leg runs as one of two agents the run's own OpenCode server registers:
+
+- **`council-seat`** — stage-1 seats (the bench wave, the critic, the lenses) and their retries.
+  Its tools are the intent's default ∪ `--tools`: **task mode** defaults to `webfetch` (the
+  co-worker can research); **review mode** defaults to none (the artifact under review arrives
+  in the briefing — `--artifact`, `--pack`, or pasted). `--tools read,grep,glob,bash` opts local
+  tools in, even for task mode — opt-in is deliberate.
+- **`council-support`** — repair re-prompts, the Stage-2 judges, debate legs and the chair.
+  No tools, ever: their briefings already say so, and the agent now enforces it.
+  The wildcard deny also covers the engine's own doom-loop and question prompts, so the engine
+  never blocks a headless leg on a tool-level prompt; a model that asks its question in prose
+  simply ends its turn (what a leg does after a refusal is the §7 live check).
+
+`task` and `skill` are refused (`task` spawns child sessions amicus cannot observe; `skill` is
+where a seat starts reading the harness instead of the brief), as are `edit`, `write`,
+`apply_patch` (a seat never modifies the tree), `question` (a headless leg has no human) and
+`invalid`. Every seat tool — the intent's default included — is validated against the engine's
+declared list when the engine lists its tools; an unknown id is `BAD_ARGS` naming what the engine
+declares. `--agent Plan|Build` is the escape hatch: every leg runs on the engine's own agent, no
+council agents, no allowlist; it cannot be combined with `--tools`. Its legs run with the run
+directory (inside the project) as their working directory, so a seat can read the run's own
+records, the label map included — use it only where that is acceptable.
+`Build` is edit-capable: unlike the council agents' fenced allowlist, it can edit files and run
+commands over that directory (the CLI prints a Notice when you opt into it); `Plan` is the
+pre-4.9.8 default: it denies edits but allows reads, searches and the shell (measured on the
+pinned engine), so it is the escape hatch that restores v4.9.7's behaviour exactly, and the CLI
+prints a Notice for it too (every leg — judges and the chair included — can run commands).
+
+Refusals land in a run directory that already exists, so the refusal itself is recorded (the same
+order the other pre-spend checks use); nothing is launched and nothing is spent. When the engine
+cannot list its tools at all, a defaults-only run continues on the recorded degrade while an
+explicit opt-in is refused — in practice this only decides a defaults-only run's outcome when the
+shared server is otherwise up and only the tool-ids endpoint itself fails; a server that cannot
+start at all is now caught by the engine-rendered verification below regardless of intent (ruling
+P2-R38).
+
+**Engine-rendered verification.** After registration, the run reads back what the engine actually
+rendered for `council-seat`/`council-support` — the run directory, its `_scratch` support-leg
+directory, and the project tree too when a local tool is opted in (ruling P2-R39) — and refuses
+before any launch if an `opencode.json` or `.opencode/agent` file the engine loads for that
+directory (the tree's, or your global config) altered them — naming that config as the cause
+and `--agent` as the knowingly-unprotected alternative (ruling P2-R33). An `external_directory`
+allow after the wildcard deny is exempted only when it is the engine's own tool-output cache
+under its own XDG-first data directory (`$XDG_DATA_HOME/opencode` when set, else
+`~/.local/share/opencode` — ruling P2-R42, matching how `src/utils/auth-json.js`/
+`src/utils/engine-log.js` already resolve it); any other one reads as a widened agent too
+(ruling P2-R40). Unverifiable (no shared server to ask) REFUSES whenever
+verification can run at all — a defaults-only run included, no more quiet degrade (ruling
+P2-R38); it is skipped only when a caller supplies its own transport with no way to ask the
+engine at all (test-only — production always VERIFIES and refuses when it has no server to ask).
+When the run's own shared OpenCode server fails to start, that IS "no server to ask": a default
+(non-`--agent`) run now refuses before any launch rather than falling back — the per-wave
+fallback servers that used to absorb a shared-server failure for every run now serve only an
+`--agent` run, whose verification is skipped by design and so never has to ask at all (ruling
+P2-R43). `--agent Plan` restores v4.9.7's per-wave behaviour exactly.
+
+**Run-directory placement with a local tool.** A seat that can read the project tree must
+not be able to read this run's sibling sessions, so with any local tool opted in the run dir
+must sit **outside** the project tree (`--out-dir`), under your home, tmp or
+`AMICUS_PROJECT_ROOTS`; the seats are then scoped to the project tree (`external_directory:
+deny`) while their metadata stays in the run dir. Over MCP the run dir stays inside the
+project, so local tools are refused there with the CLI named; tools that never touch the tree
+(`webfetch`, `websearch`, `todowrite`) over MCP are fine.
+
+**What the seat is told.** With no tools it gets the same no-tools sentence as the chair
+(`Do NOT use any tools or read any files; …`), with tools one line naming exactly them, and
+under `--agent` a line saying it runs as the engine's named agent with its own tool set. The
+config enforces; the sentence informs — study run E1 showed gemini makes zero tool calls when
+told not to.
+
+**Secrets.** With `read` opted in, the seat agent denies `.env`, `.env.*` and `.envrc` files at
+the engine (the match is case-sensitive on Linux; no other spelling is fenced) — the seat gets a
+refusal and the leg continues (the deny rules are measured to render after the seat's own
+`read=allow`, and CI now models the engine's own evaluator — transcribed from its source — over
+the real rendering, confirming `.env`/`.env.*`/`.envrc` deny and an ordinary file allows; the
+refusal itself is exercised by the release ritual's live `--tools read` run, not by the probe).
+The CLI prints a Notice for `read` too, naming those three fenced names and asking you to keep
+other secrets out.
+`grep`, `glob` and `bash` have no per-file fence: opting them in trusts every seat with
+everything in the tree, `.env` included — grep returns its contents, glob lists its name — and
+the CLI prints a Notice when you opt any of grep, glob or bash in. Keep secrets out of any tree
+you point a `bash`, `grep` or `glob` seat at.
+With a local tool the seat's engine session is rooted at the project tree, so the engine also
+loads that tree's own opencode config; do not point a local-tools seat at a tree you do not trust.
+
+`bash` is outside every fence: a bash seat runs commands as you — it can reach the run
+directory outside the tree (this run's own records included: the label map that anonymizes the
+bench and every review already on disk, so bench anonymity and independence do not hold under
+bash), your home directory and the network, and the `webfetch` deny does not bind a shell. Opt
+it in only where that is acceptable; the CLI prints a Notice when you do.
+
 ### Debate mode
 
 `--debate` adds a **Stage-2.5 rebuttal round** between cross-review and the final tally
@@ -594,6 +691,19 @@ things make that safe:
   that is present and empty counts as "I found nothing" — the same line `countAttemptedFindings`
   draws when it checks a repair against the count the original declared.
 
+**When the original carried no block at all there is nothing to check the repair against**, so
+the repair is accepted and the seat's `runStats` row carries `findingsUnverified: true` — the
+seat is counted as reviewed, its findings are tallied, and nothing verified them. Since v4.9.8
+(#242) that fact is surfaced rather than merely recorded: `verdict.json`'s `seatsReviewed`
+counts the seat under `unverified`, and the report's **What was lost** gains a row for it
+(*seat X's findings came from a repair of a response with no findings block — nothing verified
+them*). A repair that returned a **different number** of findings than the original declared is
+refused instead — `repairRefused: {code, detail}` on the row, `conformance: unstructured`, no
+findings tallied, the seat's own prose still reaching the judges — and gets a `repair-refused`
+row naming the code. Since council #248 round 2 it is also counted under `seatsReviewed.refused`,
+printed on the check title and sticky comment as `(N refused)`, and named on the end-of-run
+stderr line.
+
 This closes a contradiction that used to be shipped in every run: the anti-sycophancy clause in
 each Stage-1 briefing says "An empty severity category is a valid result", while the validator
 rejected exactly that answer — so the only way for a reviewer to satisfy the schema was to
@@ -669,7 +779,7 @@ under "Stage-2 → tally assembly recipe"). It needs **all five top-level keys**
 | `findings[]` | array | One entry per finding across all reviews: `{id, raiser, severity}` (`claim` may ride along but isn't required by the tally engine). `id` is the run-global label (e.g. `A1`, `B2`) assigned during Stage-2 assembly, not the reviewer's local integer id. `raiserSeat?` (**v4.8**) — the raising **seat's** id (`deepseek#1`), emit-only-when-it-differs-from-the-alias, so a bench with no repeated alias never carries it. `raiser` stays the alias in every case. |
 | `adjudications[]` | array | One entry per (judge × finding): `{findingId, judge, verdict}`, `verdict ∈ {agree, dispute, neutral}`. `seat?` (**v4.8**) — the judging **seat's** id, on the same emit-when-different terms as `findings[].raiserSeat`; `judge` stays the alias. Include every judge's verdict on every finding, **including the raiser's own adjudication of its own finding** — the engine excludes it automatically when scoring (don't pre-filter it). ⚠️ **v4.8: that exclusion is seat-conditional.** When a vote *and* its finding both carry a seat id, the engine compares **seats** (`v.seat !== f.raiserSeat`), so on a bench that repeats an alias a twin's genuine vote on its twin's finding is now counted instead of discarded. When either side carries no seat id — a legacy document, a hand-assembled one, or a real run whose leg failed to bind to its seat — it falls back to comparing **aliases**, which is the pre-v4.8 behaviour and still drops that twin's vote. Never fill in a seat id you did not observe just to unlock the seat compare. ⚠️ **`""` is not a model id.** The schema accepts an empty string for `raiser` and for `judge`, but the engine cannot identify a vote it has no name for: when a finding's `raiser` is empty or missing, every vote whose `judge` is also empty or missing is excluded from `basis` and counted in `findings[].unattributedPeerDrops`. A **seat id on both sides overrides this** — it is a stronger identity than either name, so a seated vote is scored (or excluded as the raiser's own) regardless of what `raiser` and `judge` say. Send the real alias, or expect the vote not to be scored. |
 | `rankings[]` | array | One entry per judge: `{judge, order}`. `order` is that judge's `FINAL RANKING:` block translated to model ids, e.g. `["gpt", "deepseek"]` (ties may use a nested array, e.g. `[["gpt","deepseek"], "mistral"]`). `seat?` (**v4.8**) — the judge's own seat id, on the same emit-when-different terms as `adjudications[].seat`; `judge` stays the alias. `orderSeats?` (**v4.8**) — the seat-valued parallel of `order`, slot for slot (a tied slot is a nested array there too): each slot is a seat id where the ranked model's seat is known, `null` where it is not, and the whole key is emitted only when at least one slot is non-null. **Two consumers read it.** Street cred keys on `orderSeats` when present and falls back to the alias otherwise — the mechanism that lets a twin bench's two street-cred rows diverge instead of collapsing into one. **v4.8** — the **chair packet** is the second: its peer-rankings block zips `orderSeats` onto `order` slot for slot, so the chair reads seat ids where the run knows them and the ranked alias where it does not. A tied slot is zipped element by element, and a `null` slot renders the alias rather than the word `null`. |
-| `runStats[]` | array | One row per paid launch (v4.7 spec §5 D1/D2 — no longer capped at one row per model; see the role roster below): `{model, role, wasChair, conformance, status, durationMs, usage, waveId?, resolvedModel?, seat?}`. `seat?` (**v4.8**) is the row's seat **id**, emit-only-when-it-differs-from-that-seat's-own-alias — so only a bench that repeats an alias carries it. Only the two producers that *have* a seat pass one: the primary reviewing-seat rows and the dead-seat rows. A `judge`, `chair-attempt`, `repair` or `superseded` row never carries it (all four are excluded from the ledger join, so a seat stamp there could never win it), and neither do the off-bench chair rows or the synthetic `claude` row, which have no seat at all. Two seats of one alias that **both** died usually get **two** rows: each carries its own `seat` id where the run bound that seat's leg, and **no** `seat` where it could not — an unidentified dead seat is counted but never named. They still collapse into a **single** row in two cases, both of them seats the run genuinely cannot tell apart: both legs missing a task id, and a run with no seat table behind it — the deliberate floor, since inventing an identity there would be a guess. A retry wave that came back with **fewer legs than it launched** was a third such case and is **no longer**: v4.8 T-A4 made the retry reconcile count a key's SLOTS rather than test its presence, so both twins get a row (measured end to end through `runStage1`: 1 primary dead-seat row before, 2 after, with the superseded rows unchanged at 2 — one of the two rows carries `usage: null`, and **which one is arbitrary**: neither row names a seat, so the alias's billed total is split across its anonymous rows by row ORDER, never by identity). ⚠️ **Corrected in v4.8** — this cell previously claimed the two *always* collapse into one row carrying no `seat`. That was already wrong for **bound** twins the day it was written (the two-row behaviour landed 2026-08-13, this sentence 2026-08-14), and v4.8 closed the unbound half for every retry outcome, the partial return included (that last one in T-A4). May be `[]`. Any leg with no run document gets `durationMs: null, usage: null` — never invent a value. `waveId` is emit-only-when-set. `resolvedModel?` (v4.7) — the executable id that actually served the row's leg, emit-only-when-set; leg-less rows (the give-up chair row, dead seats with no leg, the claude row) never carry it. `model` stays the council alias. ⚠️ **One row shape carries `usage` with NO `waveId`, `resolvedModel` or `durationMs` (v4.8)**: an unidentified dead seat on an alias the bench repeats, where the run holds a billed retry leg it cannot attribute to either twin. The cost is real and is counted in the run total, but every per-seat execution fact is withheld rather than guessed — so do **not** assume `usage` implies `waveId`, and do not treat a null `durationMs` as "this seat cost nothing". |
+| `runStats[]` | array | One row per paid launch (v4.7 spec §5 D1/D2 — no longer capped at one row per model; see the role roster below): `{model, role, wasChair, conformance, status, durationMs, usage, waveId?, resolvedModel?, seat?}` — plus `findingsUnverified?: true` / `repairRefused?: {code, detail}` (the two halves of the repair contract's outcome, see the repair paragraph under `amicus council validate`) and `ttftMs?` (v4.9 W13). `seat?` (**v4.8**) is the row's seat **id**, emit-only-when-it-differs-from-that-seat's-own-alias — so only a bench that repeats an alias carries it. Only the two producers that *have* a seat pass one: the primary reviewing-seat rows and the dead-seat rows. A `judge`, `chair-attempt`, `repair` or `superseded` row never carries it (all four are excluded from the ledger join, so a seat stamp there could never win it), and neither do the off-bench chair rows or the synthetic `claude` row, which have no seat at all. Two seats of one alias that **both** died usually get **two** rows: each carries its own `seat` id where the run bound that seat's leg, and **no** `seat` where it could not — an unidentified dead seat is counted but never named. They still collapse into a **single** row in two cases, both of them seats the run genuinely cannot tell apart: both legs missing a task id, and a run with no seat table behind it — the deliberate floor, since inventing an identity there would be a guess. A retry wave that came back with **fewer legs than it launched** was a third such case and is **no longer**: v4.8 T-A4 made the retry reconcile count a key's SLOTS rather than test its presence, so both twins get a row (measured end to end through `runStage1`: 1 primary dead-seat row before, 2 after, with the superseded rows unchanged at 2 — one of the two rows carries `usage: null`, and **which one is arbitrary**: neither row names a seat, so the alias's billed total is split across its anonymous rows by row ORDER, never by identity). ⚠️ **Corrected in v4.8** — this cell previously claimed the two *always* collapse into one row carrying no `seat`. That was already wrong for **bound** twins the day it was written (the two-row behaviour landed 2026-08-13, this sentence 2026-08-14), and v4.8 closed the unbound half for every retry outcome, the partial return included (that last one in T-A4). May be `[]`. Any leg with no run document gets `durationMs: null, usage: null` — never invent a value. `waveId` is emit-only-when-set. `resolvedModel?` (v4.7) — the executable id that actually served the row's leg, emit-only-when-set; leg-less rows (the give-up chair row, dead seats with no leg, the claude row) never carry it. `model` stays the council alias. ⚠️ **One row shape carries `usage` with NO `waveId`, `resolvedModel` or `durationMs` (v4.8)**: an unidentified dead seat on an alias the bench repeats, where the run holds a billed retry leg it cannot attribute to either twin. The cost is real and is counted in the run total, but every per-seat execution fact is withheld rather than guessed — so do **not** assume `usage` implies `waveId`, and do not treat a null `durationMs` as "this seat cost nothing". |
 
 **`runStats[].role` roster (v4.7 row-per-launch).** Every leg the run budget counts gets exactly
 one row, so a seat that needed a repair or lost a leg to a retry can now show up more than once.
@@ -852,6 +962,7 @@ named here. That is why the v4.8 keys below each needed their own line.
 - `seats` — **v4.8**, optional. The tally record's `meta.seats` (same `{id, alias, role, lens, position}` shape), promoted to the top level next to `seatLoss`. Present only when the tally record carried one, i.e. only when the bench repeated an alias. It is what makes the `alias#N` ids on `findings[].raiserSeat`, `adjudications[].seat` and `runStats[].seat` resolvable from the verdict **alone** — before v4.8 the verdict named seats it could not resolve. `council report` reads it to give each seat its own adjudication-matrix column; when it is absent, or is not an array of objects each carrying a string `id`, the **adjudication matrix** falls back to alias space whole and renders exactly as it did before v4.8. ⚠️ **That fallback is the matrix's alone — it is not a whole-document guarantee.** The street-cred table beside it labels each row from `streetCred[].seat` whenever the row carries one, a predicate independent of this key, so a verdict with seated `streetCred[]` rows and no usable `seats` renders seat ids in the street-cred table and aliases in the matrix (measured on an absent `seats`, a non-array `seats`, and an array-of-strings `seats`). In-process both fields come from the same twin bench and travel together; the split is reachable on a hand-assembled or externally-supplied record, which `buildVerdict`'s own docblock names. A verdict written before v4.8 carries no `streetCred[].seat` at all and is unaffected.
 - `findings[].raiserSeat` — **v4.8**, optional. The raising seat's id, carried through from the tally record; absent unless the bench repeated an alias. `findings[].raiser` stays the alias.
 - `findings[].sameModelCorroboration` — **v4.8**, optional, `true` only. Carried through from the tally record; see the tally-record notes above for the stamp's meaning **and for the two directions in which it is wrong** (it misses one model behind two aliases, and it fires falsely on one alias behind two executables).
+- `seatsReviewed` — **#202**, optional: `{reviewed, unverified, refused, of}`, derived from `runStats` at build time (never passed in) and emitted only when the record carries at least one bench-role row (`seat`, `critic`, `lens:<slug>`), so `0 of 0` is never written. `of` counts bench seats post-retry (a healed seat once — its first attempt is `role:'superseded'`), `reviewed` those whose leg completed, and `unverified` (**v4.9.8**, #242) those among them whose findings came from a repair of a response with no parseable findings block (`runStats[].findingsUnverified`); the tally scored those findings, nothing verified the repair, and the flag is not a stub detector (a real review whose trailing JSON block was malformed carries it too). `refused` (**v4.9.8**, council #248 round 2) counts those whose repair was refused (`runStats[].repairRefused`): the seat contributed no findings at all and would otherwise read as a full reviewer on every gate surface. Both are always written with the census and never more than `reviewed` — the census and the report share one predicate (a bench role, a completed leg, and the literal `true` or a plain-object `repairRefused`), so a flagged row that is not a completed bench seat is counted nowhere and rendered nowhere. The report's `unverified-repair` and `repair-refused` rows name such seats; the check title and sticky comment print `(N unverified)` and `(N refused)` only when non-zero; at the end of a run whose counts are non-zero the CLI prints one `Notice:` line on stderr naming the seats.
 - All other keys (`runId`, `council`, `findings`, `streetCred`, `runStats`, `tierCounts`) are passed through unchanged from the tally record.
 
 **Write path:** always atomic — a `<out>.tmp-<pid>` file is written first, then renamed over the
@@ -897,8 +1008,12 @@ tier-count summary table — headed **Verdict summary** on a review run and **An
 task run, since a task run produces an answer, not a verdict, and on a task run followed by the
 one-line concurrence qualifier (*tiers report peer concurrence, never verification*) — a
 **What was lost** section
-when the run degraded (plus a **Notes** list for informational records, e.g. a task run's
-ledger-skipped announcement), the **adjudication matrix** (finding × judge, `✓`/`✗`/`–` with
+when the run degraded — and, since v4.9.8 (#242), one row per seat whose findings came from a
+repair of a response with no findings block (channel `unverified-repair`) and one per refused
+repair (channel `repair-refused`, naming the code), derived from `runStats[]` when the report is
+built, so re-rendering an older `verdict.json` shows them too — plus a **Notes** list for
+informational records (e.g. a task run's ledger-skipped announcement), the **adjudication
+matrix** (finding × judge, `✓`/`✗`/`–` with
 `*` marking the raiser's own vote), the **peers-only street-cred table**, **findings grouped by
 tier** (Disputed first), and a **cost table** (per-model status/duration/cost + wave total,
 sourced from `runStats[].usage`).
@@ -1263,6 +1378,28 @@ need Claude or a live council run to regenerate it.
 
 ---
 
+## Leg completion and `session.status`
+
+A headless leg ends on the first of: the engine reporting `idle`; its last message
+finalizing (two stable polls); the no-output backstop; the tool-stall detector; the
+tool-settle ceiling (when a tool call never settles); a retry the engine schedules
+past the leg deadline (`RETRY_BEYOND_DEADLINE`); or the leg `--timeout`. The
+flat-output heuristic that used to end a leg after 30 stable polls now runs only
+when `session.status` reports anything other than a working engine (busy or retry)
+— unavailable, unrecognised — **or** when a tool call is live (where the bounded
+ceiling governs). A finalized message always ends on the stable-finished path, whatever
+the status. A busy (or retrying) engine with no live tool is a model still answering
+— the poller cannot see its text until the message finalizes — so the leg waits. A
+busy-but-wedged session therefore ends by `--timeout`, and is named that. At debug
+level the trace names the veto once per flat stretch (and again whenever a non-zero
+count is reset) and the exit line records the last engine status. When the fallback
+heuristic ends an unfinalized message, the leg logs a warning (warn level) naming the
+status it saw. A retry whose next attempt lies beyond the leg deadline ends the leg
+at once as `RETRY_BEYOND_DEADLINE` — unless the last message has already finalized (the
+leg completes normally) or a tool call is live (the bounded tool-settle ceiling governs).
+
+---
+
 ## See also
 
 - **[skills/second-opinion/SKILL.md](../skills/second-opinion/SKILL.md)** — the orchestration

package/docs/usage.md

@@ -98,7 +98,7 @@ amicus start --model deepseek --prompt "Generate tests" --no-ui --timeout 30
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. | |
 | `--tag <t>` | Label this session for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; invalid values are rejected, never silently cleaned). | *(none)* |
 
-> Agents: **Chat** auto-approves reads and asks before writes/bash (interactive default); **Build** has full tool access (headless default); **Plan** is read-only analysis. `--agent Chat` is interactive-only and incompatible with `--no-ui`.
+> Agents: **Chat** auto-approves reads and asks before writes/bash (interactive default); **Build** has full tool access (headless default); **Plan** denies edits (reads, searches and shell allowed). `--agent Chat` is interactive-only and incompatible with `--no-ui`.
 
 **Catalog validation.** For an explicit `--model`, the model is checked against the live catalog before launch — a typo'd name fails fast with same-vendor suggestions. For a model inherited from a previous session (`continue`/`resume` without `--model`), validation is **advisory**: a warning is printed but the session starts anyway. Skip with `--no-validate-model`.
 
@@ -204,6 +204,8 @@ amicus council run --prompt-file briefing.md --models gemini,glm --chair deepsee
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
 | `--tag <t>` | Label this run for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; rejected, not cleaned). Every stage's sub-waves (Stage-1, critic/lens solos, Stage-2, chair, debate) carry the same tag on their wave metadata. |
 | `--intent <review\|task>` | The run's intent (v4.9). `review` — the default — is never stored; `task` marks a task-mode run, recorded as `intent: "task"` on `run.json`/`verdict.json` and kept out of the reliability ledger. Over MCP: the `intent` param on `amicus_council_run`, and a hand-assembled `amicus_council_tally` input may carry `meta.intent` the same emit-when-`task` way. What forks stage by stage — and what stays byte-identical — is in [docs/council.md § Task mode](./council.md#task-mode---intent-task). |
+| `--tools <a,b,c>` | Tool ids stage-1 seats may use, by the engine's own ids (v4.9.8). Task mode defaults to `webfetch`, review to none; `task`/`skill`/`edit`/`write`/`apply_patch`/`question`/`invalid` are refused; anything else is validated against the engine before launch. A local tool (anything that is not `webfetch`/`websearch`/`todowrite` — `read`, `grep`, `glob`, `bash`, …) needs `--out-dir` outside the project tree. With `read` opted in, `.env`, `.env.*` and `.envrc` files are denied at the engine (case-sensitive on Linux; no other spelling is fenced), and the CLI prints a Notice for `read` too, naming those three fenced names and asking you to keep other secrets out; `grep`, `glob` and `bash` have no such per-file fence (grep returns `.env` contents, glob lists `.env` names) and the CLI prints a Notice when you opt any of them in. `bash` is outside every fence (run directory, home, network — including this run's own records: the label map and every review already on disk, so bench anonymity and independence do not hold under bash). Cannot be combined with `--agent`. Over MCP: the `tools` param (tools that never touch the tree — `webfetch`, `websearch`, `todowrite` — only). See [docs/council.md § Tool access](./council.md#tool-access-per-usage---tools). |
+| `--agent <Plan\|Build>` | Escape hatch: run every leg on the engine's own agent instead of the council agents (no allowlist). Its legs run with the run directory (inside the project) as their working directory, so a seat can read the run's own records, the label map included — use it only where that is acceptable. `Build` is edit-capable — it can edit files and run commands there, and the CLI prints a Notice when you opt into it; `Plan` denies edits but allows reads, searches and the shell — the pre-4.9.8 default, so it restores v4.9.7's behaviour, and the CLI prints a Notice for it too (every leg, judges and the chair included, can run commands). Cannot be combined with `--tools`. Over MCP: the `agent` param. |
 
 **Exit codes:** `0` full run · `2` degraded but reportable (fewer than 2 judges, chair failure —
 `overallVerdict: null` — a cost ceiling hit after the tally, or a `--max-cost` ceiling set over a
@@ -303,7 +305,7 @@ Then invoke it with `--pack <name|path>` on `start` / `fanout` / `council run`
 | `fanout` | `bench` (a saved council name, or an array of ≥2 members) | — | `timeout`, `maxCost`, `gateway`, `agent`, `thinking`, `summaryLength`, `noContext`, `contextTurns`, `contextMaxTokens` |
 | `solo` | `model` | — | `timeout`, `maxCost`, `gateway`, `agent`, `thinking`, `summaryLength`, `noUi`, `noContext`, `contextTurns`, `contextMaxTokens` |
 
-`council` packs do **not** accept `agent`, `thinking`, or `summaryLength` — they were inert on every surface (no council code path, CLI or MCP, ever reads a pack-filled one; the engine hardcodes agent `Plan`/summaryLength `verbose`), so they were dropped before release rather than shipped as dead weight a pack author would reasonably expect to work. A `council` pack that still sets one fails `pack save` with `PACK_INVALID`, naming the key. They remain valid, and functional, on `fanout`/`solo` packs. Those releases recorded `medium` on EVERY session's metadata, **a fanout leg's included**, whether or not the flag was typed (a level nothing ever sent), so a pack saved with `pack save --from-run` on 4.9.3 or earlier copied it into `options.thinking` on **fanout packs as well as solo ones** — where it then applies to every seat of the bench at once. Such a pack now SENDS it: refused on every model that does not declare `medium` (kimi-k3, Haiku 4.5, deepseek-v4-pro among the curated routes), and on a model that DOES declare it the level really goes out — so a pack that was inert can now change a run's cost and behaviour. Delete the key or re-save the pack from a run that requested a level.
+`council` packs do **not** accept `agent`, `thinking`, or `summaryLength` — they were inert on every surface (no council code path, CLI or MCP, ever reads a pack-filled one; `--agent` / the MCP `agent` param are the only way to set a council run's agent — v4.9.8 — and summaryLength is hardcoded `verbose`), so they were dropped before release rather than shipped as dead weight a pack author would reasonably expect to work. A `council` pack that still sets one fails `pack save` with `PACK_INVALID`, naming the key. They remain valid, and functional, on `fanout`/`solo` packs. Those releases recorded `medium` on EVERY session's metadata, **a fanout leg's included**, whether or not the flag was typed (a level nothing ever sent), so a pack saved with `pack save --from-run` on 4.9.3 or earlier copied it into `options.thinking` on **fanout packs as well as solo ones** — where it then applies to every seat of the bench at once. Such a pack now SENDS it: refused on every model that does not declare `medium` (kimi-k3, Haiku 4.5, deepseek-v4-pro among the curated routes), and on a model that DOES declare it the level really goes out — so a pack that was inert can now change a run's cost and behaviour. Delete the key or re-save the pack from a run that requested a level.
 
 Every kind may also carry `description`, `version` (semver, default `1.0.0`), and `briefing.template` (a template **reference**, not rendered text — a pack never captures briefing prose).
 
@@ -540,7 +542,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.7",
+  "version": "4.9.8",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
@@ -970,6 +972,8 @@ Every tool below also takes an optional `project` — an absolute path naming th
 - `debate` — add a Stage-2.5 rebuttal round before the chair synthesizes.
 - `claudeReviewFile` — path to Claude's own review, included as a judged entry. Claude is reviewed and ranked like a seat, but never judges or chairs.
 - `intent` — `task` marks a task-mode run (recorded on `run.json`/`verdict.json`, kept out of the reliability ledger): seats produce the deliverable and the chair closes with `ANSWER:` on a disjoint scale. `review` is the default and is never stored. See [docs/council.md § Task mode](./council.md#task-mode---intent-task).
+- `tools` — tool ids stage-1 seats may use, by the engine's own ids (task mode defaults to `webfetch`, review to none). Over MCP only tools that never touch the tree (`webfetch`, `websearch`, `todowrite`) can be opted in: the MCP run directory stays inside the project, so a seat with a local tool (`read`, `grep`, `glob`, `bash`, …) is refused with a message naming the CLI's `--tools` + `--out-dir` (outside the project) instead. `task`, `skill`, `question`, `invalid`, `edit`, `write` and `apply_patch` are always refused. Cannot be combined with `agent`.
+- `agent` — escape hatch: run every leg on the engine's own agent instead of the council agents, with no tool allowlist. `Plan` or `Build` only — unlike `amicus_start`'s `agent`, `Chat` is not accepted here. Cannot be combined with `tools`.
 - `ui` — auto-open the Council Workspace window for this run. Default: opens under Claude Code (local) when Electron and a display exist and `workspace.autoOpen` is not `false`.
 - `onComplete`, `pack`, `tag` — as on `amicus_fanout`.
 
@@ -987,7 +991,7 @@ The `--agent` option controls which OpenCode agent drives the session:
 |-------|-------------|-------------|
 | **Chat** | Interactive conversation | Reads freely, asks before writes/bash |
 | **Build** | Full-access primary agent (headless default) | Read, write, bash, task |
-| **Plan** | Read-only analysis | Read-only |
+| **Plan** | Analysis without edits | Read, search, bash; no edits |
 
 `--agent Chat` is interactive-only and incompatible with `--no-ui`. Custom agents defined in `~/.config/opencode/agents/` or `.opencode/agents/` are also supported.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.7",
+  "version": "4.9.8",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/council-verdict.schema.json

@@ -231,9 +231,11 @@
     },
     "seatsReviewed": {
       "type": "object",
-      "description": "#202, optional. How much of the BENCH actually reviewed, derived from runStats: `of` counts every BENCH-role row — `seat`, `critic`, or `lens:<slug>`, exactly the roles seats.js :: buildSeats mints (one per bench seat POST-retry, so a healed seat is counted once and its first attempt is `role:'superseded'`), and `reviewed` counts those whose leg completed. Judges, chair and repair rows are not bench seats and are excluded. EMIT-WHEN-SET: a record with no bench rows carries no key at all, because `0 of 0` would read as a measurement of an empty bench rather than as the absence it is. WHY IT EXISTS: the sibling `seatLoss` above is present only when --critic was requested, and CI runs none — so seat loss was structurally absent from every CI verdict while a two-seat bench published a four-model street-cred table whose dead seats rendered `n/a`, indistinguishable from the legend's neutral (MEASURED, run 4424218c). No `additionalProperties: false` at the top level of this schema means an additive field was always accepted here; this documents the shape rather than changing what is accepted.",
+      "description": "#202, optional. How much of the BENCH actually reviewed, derived from runStats: `of` counts every BENCH-role row — `seat`, `critic`, or `lens:<slug>`, exactly the roles seats.js :: buildSeats mints (one per bench seat POST-retry, so a healed seat is counted once and its first attempt is `role:'superseded'`), and `reviewed` counts those whose leg completed. Judges, chair and repair rows are not bench seats and are excluded. EMIT-WHEN-SET: a record with no bench rows carries no key at all, because `0 of 0` would read as a measurement of an empty bench rather than as the absence it is. WHY IT EXISTS: the sibling `seatLoss` above is present only when --critic was requested, and CI runs none — so seat loss was structurally absent from every CI verdict while a two-seat bench published a four-model street-cred table whose dead seats rendered `n/a`, indistinguishable from the legend's neutral (MEASURED, run 4424218c). No `additionalProperties: false` at the top level of this schema means an additive field was always accepted here; this documents the shape rather than changing what is accepted. v4.9.8 (#242): `unverified` (bench seats among `reviewed` whose findings came from a repair of a response with no parseable findings block — runStats[].findingsUnverified) and, since council #248 round 2, `refused` (those whose repair was refused — runStats[].repairRefused) join the census. buildVerdict writes it whenever it writes the census, since that version (0 is a measurement); it is declared, not required, so documents written before it still validate.",
       "properties": {
         "reviewed": { "type": "integer", "minimum": 0, "description": "Bench seats whose leg completed." },
+        "unverified": { "type": "integer", "minimum": 0, "description": "v4.9.8 (#242): bench seats, counted in `reviewed` too, whose findings came from a repair of a response with no parseable findings block — the tally scored those findings and nothing verified the repair. Not a stub count. A refused repair (runStats[].repairRefused) is not counted here. Never more than `reviewed`: the census and the report share one predicate (a bench role, a completed leg, the literal true), so a flagged row that is not a completed bench seat is counted nowhere and rendered nowhere." },
+        "refused": { "type": "integer", "minimum": 0, "description": "v4.9.8 (#242; council #248 round 2): bench seats, counted in `reviewed` too, whose repair was refused (runStats[].repairRefused) — the repair broke its count contract, so the seat contributed NO findings; visible here because a seat that contributed nothing must not read as a full reviewer on the gate. Always written with the census since v4.9.8; never more than `reviewed` (the census and the report share one predicate)." },
         "of": { "type": "integer", "minimum": 1, "description": "Bench seats benched, post-retry." }
       },
       "required": ["reviewed", "of"],

package/skills/second-opinion/SEAT-BRIEFS.md

@@ -27,6 +27,12 @@ the deliverable rests on (same JSON shape, same severity enum, `location` = sour
 the word `assumption`); the judge's ranking axis becomes *how well the work was done* rather than
 how accurate a critique was; and the chair closes on the ANSWER scale below.
 
+**v4.9.8 — tools are per run.** The engine registers two agents per council run (`council-seat`
+for stage-1 legs, `council-support` for everything else) and composes the seat's tools sentence
+itself: no tools → the shared no-tools sentence; tools → *"Your tools: webfetch. You have no
+others — …"* (`src/council/seat-tools.js :: seatToolsSentence`). The manual path copies that
+line into each seat's `_tmp-*` briefing; see `docs/council.md § Tool access`.
+
 ---
 
 ## Standard anti-sycophancy clause (ALL Stage-1 briefings — not an optional element)