arkaos 4.1.1 → 4.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 **The Operating System for AI Agent Teams.**
 
-82 agents. 17 departments. 267 skills. Enterprise frameworks. Multi-runtime. One install.
+82 agents. 17 departments. 268 skills. Enterprise frameworks. Multi-runtime. One install.
 
 ```bash
 npx arkaos install

package/VERSION

@@ -1 +1 @@
-4.1.1
+4.3.0

package/arka/SKILL.md

@@ -24,7 +24,7 @@ does not replace the vault.
 # ArkaOS — Main Orchestrator
 
 > **The Operating System for AI Agent Teams**
-> 82 agents. 17 departments. 267 skills. Multi-runtime. Dashboard. Knowledge RAG.
+> 82 agents. 17 departments. 268 skills. Multi-runtime. Dashboard. Knowledge RAG.
 
 ## ⛔ Evidence flow — 4 gates (NON-NEGOTIABLE)
 

package/arka/skills/flow/SKILL.md

@@ -87,6 +87,21 @@ resumes at the right gate.
   coverage read from the report file, security grep, spell-check for
   copy. Reviewers (Quality Gate personas) interpret tool output; they do
   not replace it. APPROVED/REJECTED derives from evidence.
+- **Excellence check (`excellence-mandate`, mandatory):** before closing,
+  answer three questions with evidence, not narration:
+  1. What is **unfinished** in this delivery (trimmed scope, TODO left
+     behind, parity skipped)?
+  2. What is **default** (template look, boilerplate copy, unstyled
+     component, generic strategy)?
+  3. What would a **top-tier lead reject** here? Name the benchmark
+     (`reference_companies.application` — e.g. Linear/Stripe for
+     frontend) and judge against it.
+  A non-empty answer loops the work back into Gate 3 or is escalated to
+  the operator as an explicit open-items decision. Shipping with a
+  non-empty list and no operator decision is a constitution breach.
+  Time and token cost are not acceptable answers to any of the three.
+- Quality Gate REJECTED loops back at most twice; a third REJECTED
+  escalates to the operator with the full verdict.
 - Close with an honest summary: what changed, where, how it was
   verified (real commands + results), what remains open.
 

package/arka/skills/fusion/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: arka-fusion
+description: >
+  Model Fabric advisor and fusion configurator. Discovers what the machine
+  can run (Ollama local models, OpenRouter/Anthropic keys), reads the
+  current role routing, interviews the user about goals and constraints,
+  and recommends — with rationale — which model should run each role and
+  which panel+judge combination to use for fusion. Applies the approved
+  configuration via `npx arkaos models`. Trigger: "/arka-fusion", "fusion",
+  "que modelos usar", "configurar modelos", "model routing".
+allowed-tools: [Read, Bash, AskUserQuestion]
+---
+
+# /arka-fusion — Model Fabric Advisor
+
+You are the Model Fabric advisor. Your job: leave the user with a role →
+model mapping and a fusion panel that fit THEIR machine, keys, and goals —
+never a generic default. Constitution `model-routing` sets the posture:
+quality-critical roles get the best model available; only genuinely
+mechanical work economises.
+
+## Phase 1 — Discover (never skip, never assume)
+
+Run and read all three:
+
+```bash
+python -m core.runtime.model_router_cli discover        # Ollama + local models
+python -m core.runtime.model_router_cli --json          # current routing
+python -m core.runtime.model_router_cli usage --period week --json
+```
+
+Also check key presence (never print values): `OPENROUTER_API_KEY` /
+`ANTHROPIC_API_KEY` in env or `~/.arkaos/keys.json`.
+
+Interpret the discovery honestly:
+- Ollama **not installed** → local lane unavailable; say what installing
+  it would unlock (free mechanical/panel calls, privacy).
+- Ollama installed but **not running** → tell the user to start it; count
+  its models as one `ollama serve` away.
+- Ollama running → classify each local model by size/family: coder models
+  (qwen-coder, deepseek-coder) suit `mechanical` + code review panels;
+  large general models (30B+, kimi cloud) qualify for panel seats;
+  sub-8B models are mechanical-only. `:cloud` models are Ollama-proxied
+  remote models — panel-grade, not privacy-local.
+
+## Phase 2 — Interview (one AskUserQuestion, then dialogue)
+
+Ask about, at most 4 questions, adapting to what discovery found:
+1. **Prioridade** — máxima qualidade custe o que custar / equilíbrio /
+   privacidade local primeiro?
+2. **Fusion** — ativar painel multi-modelo para trabalho crítico
+   (2-5× chamadas por resposta, qualidade validada acima de qualquer
+   modelo solo) ou manter single-model por agora?
+3. **OpenRouter** — se não há chave: quer criar uma? (1 chave → Kimi,
+   DeepSeek, GPT, Gemini como participantes de painel.)
+4. Qualquer ambiguidade real que a discovery levantou.
+
+## Phase 3 — Recommend (framework-backed, named tradeoffs)
+
+Produce a table: role → provider/model + ONE-line rationale each. Rules:
+- `design/review/architecture/strategy/quality_gate` → best frontier
+  model available. NEVER a local small model, even if the user leans
+  cost-sensitive — offer fusion-with-budget-panel instead (OpenRouter
+  evidence: budget panel + frontier judge beats frontier solo at ~50%
+  cost).
+- `mechanical` → cheapest competent lane: local coder model if Ollama
+  runs one, else haiku-class.
+- Fusion panel: 2-3 DIVERSE models (different families — e.g. one
+  Anthropic, one Kimi/DeepSeek, one local large) + frontier judge.
+  Homogeneous panels waste the fan-out.
+- Cite `usage` data when it argues for a change ("80% of your tokens are
+  mechanical → moving them local saves X").
+
+## Phase 4 — Apply (only after explicit approval)
+
+```bash
+npx arkaos models set <role> <provider>/<model> --effort <effort>
+```
+
+For fusion panel/judge and aliases, edit `~/.arkaos/models.yaml` directly
+(keep comments). Show the final `npx arkaos models` table as proof and
+remind: the dashboard Models page shows the same state + live usage.
+
+## Hard rules
+
+- Discovery before advice — recommending a model the machine cannot run
+  is a constitution breach (`context-verification`).
+- Never print key values. Presence only.
+- Quality roles never downgrade below frontier (`model-routing`,
+  `excellence-mandate`). Push back if asked; offer budget fusion instead.
+- Every recommendation carries a rationale the user can disagree with.

package/config/constitution.yaml

@@ -117,14 +117,18 @@ enforcement_levels:
         rule: "When a squad lead dispatches a specialist via the Agent tool, the lead MUST emit `[arka:dispatch] <from> -> <to>` on a line of its own immediately before the dispatch call. The marker identifies the specialist to the PreToolUse specialist-enforcer so writes from the specialist pass `owner-match` instead of falling through as `no-routing-tag` or blocking the lead. The format is identical to `[arka:routing]` but uses the verb `dispatch` and points from the calling persona to the receiving specialist (e.g., `[arka:dispatch] paulo -> frontend-dev`)."
         enforcement: "PreToolUse hook (config/hooks/pre-tool-use.sh) reads the dispatch marker via core.workflow.specialist_enforcer._resolve_persona. Dispatch tag overrides routing tag because it is more specific. Without it, lead writes to specialist-owned files are blocked when hooks.specialistEnforcement=true. See ADR docs/adr/2026-05-28-specialist-dispatch-subagent-blindspot.md for the architectural constraint this rule mitigates."
 
+      # ─── Rule added in Excellence Reform (2026-07-05, operator mandate) ──
+      - id: excellence-mandate
+        rule: "Every deliverable targets excellence, not acceptance. Supervisors (leads, C-Suite, Quality Gate) and specialists are REQUIRED to be maximally critical and meticulous: no default-looking output, no unfinished edges, no lazy implementations, no delivery-for-the-sake-of-delivering. Latency and token cost are NEVER arguments against quality work — the CostGovernor hard budget is the only ceiling. Before any gate closes, the closing agent answers with evidence: 'what is unfinished, what is default, what would a top-tier lead (see reference_companies.application) reject here?' — a non-empty answer loops the work back or escalates to the operator; it is never silently shipped. UI work MUST load the frontend design skills (frontend-design, ui-ux-pro-max, project design system) at maximum effort and pass visual review against a named benchmark before reaching the Quality Gate."
+        enforcement: "G4 excellence check in arka/skills/flow/SKILL.md; frontend gate core/workflow/frontend_gate.py (flag hooks.frontendGate); QG reviewers must cite the named benchmark and enumerate concrete rejections; REJECTED redo loop capped at 2 cycles then operator escalation. Operator mandate 2026-07-05: 'não interessa se demora — o goal é excelência'."
+
   quality_gate:
     description: "Mandatory pre-delivery review. Nothing ships without APPROVED verdict."
     trigger: "After the last execution phase, before delivery to user"
     frequency: "Once per workflow execution, not per phase"
     model_policy:
-      default: sonnet
-      opus_scope: "Tier 0 diffs only: constitution, security-relevant changes, release pipeline, installer auth — or deliverables explicitly security-flagged"
-      note: "Marta's veto is model-independent: the verdict derives from the evidence report (core.governance.evidence_checks), not from model size."
+      default: best-available
+      note: "Quality Gate reviews run the best model available (frontier tier) at maximum effort by default — the Excellence Reform (2026-07-05) inverted the former sonnet-default cost posture; review quality is never the place to save tokens. User overrides per role live in ~/.arkaos/models.yaml (Model Fabric). Marta's veto is model-independent: the verdict derives from the evidence report (core.governance.evidence_checks), not from model size."
     agents:
       orchestrator:
         id: cqo-marta
@@ -140,9 +144,10 @@ enforcement_levels:
     process:
       - "Evidence engine runs first: python -m core.governance.evidence_checks — the verdict derives from its report"
       - "Marta receives all output from execution phase plus the evidence report"
-      - "Marta dispatches Eduardo (text) and Francisca (technical) in parallel to interpret the report"
-      - "Each reviewer returns a structured QGVerdict (APPROVED or REJECTED) with specific issues; evidence overall=fail forces REJECTED"
+      - "Marta dispatches Eduardo (text) and Francisca (technical) in parallel, each in an INDEPENDENT subagent context (clean context, no stake in the work being approved)"
+      - "Each reviewer returns a structured QGVerdict (APPROVED or REJECTED) with specific issues; the verdict MUST name the benchmark used (reference_companies.application) and enumerate the concrete rejections a top-tier lead would raise; evidence overall=fail forces REJECTED"
       - "If ANY reviewer rejects: work loops back to execution with issue list"
+      - "Redo loop is capped at 2 cycles: a third REJECTED escalates to the operator with the full verdict instead of another silent retry (excellence-mandate)"
       - "If ALL approve: Marta issues final APPROVED verdict"
       - "Nothing reaches the user without APPROVED from all three"
 
@@ -182,11 +187,11 @@ enforcement_levels:
         enforcement: "persistence.py exports on status change; audit detects missing exports"
 
       - id: model-routing
-        rule: "Per-tier model assignment enforced: Tier 0 opus, Tier 1/2 sonnet, mechanical haiku. Quality Gate reviewers run sonnet by default; opus ONLY for Tier 0/security-scope diffs (constitution, security, release pipeline, installer auth). Marta keeps her veto regardless of model tier."
+        rule: "Quality-first model routing: design, review, architecture, strategy, and Quality Gate phases run the BEST model available for the task (frontier tier) at maximum effort BY DEFAULT. Cheaper/smaller models (haiku, local) are reserved for genuinely mechanical work: commit messages, keyword extraction, data fetching, formatting. Cost optimisation NEVER downgrades a quality-critical phase — the CostGovernor hard budget is the only ceiling. User-owned overrides live in ~/.arkaos/models.yaml (Model Fabric): the user decides which provider/model serves each role; this rule sets the default posture, not a fixed vendor table. Replaced the cost-optimised per-tier table in the Excellence Reform (2026-07-05)."
         enforcement: "warning"
 
       - id: subagent-discipline
-        rule: "Dispatch subagents only when task requires >3 Reads or >5 Greps or isolated context. Never parallel subagents sharing state. Prefer main thread for trivial tasks."
+        rule: "Dispatch subagents only when task requires >3 Reads or >5 Greps or isolated context. Never parallel subagents sharing state. Prefer main thread for trivial tasks. EXEMPT: quality dispatches (Quality Gate reviewers, adversarial verification, design review) are never suppressed by this rule — independent review context is a correctness requirement under excellence-mandate, not an optimisation choice."
         enforcement: "warning"
 
       # ─── Rule added in PR3 Squad Intelligence Upgrade (2026-05-28) ───────
@@ -436,3 +441,6 @@ amendments:
     - version: "2.32.0"
       date: "2026-05-13"
       changes: "PR10 Conclave Phase 5 — added 7 NON-NEGOTIABLE rules (quality-over-speed, always-research, project-design-system-prerequisite, definition-of-done-per-domain, arkaos-not-yes-man, inter-agent-checkpoints, hybrid-learning) and 3 new top-level sections (definition_of_done per domain, reference_companies, tone_guide)."
+    - version: "4.2.0"
+      date: "2026-07-05"
+      changes: "Excellence Reform (operator mandate) — added excellence-mandate NON-NEGOTIABLE rule; inverted model-routing from cost-optimised tiers to quality-first (best model for design/review/architecture/strategy, user overrides in ~/.arkaos/models.yaml); QG model_policy sonnet-default → best-available; QG reviewers independent + benchmark-cited verdicts + redo loop capped at 2; subagent-discipline exempts quality dispatches."

package/config/hooks/session-start.sh

@@ -120,6 +120,28 @@ if [ -n "$REPO" ] && command -v python3 &>/dev/null; then
   fi
 fi
 
+# ─── Dashboard ensure (v4.1.2) ──────────────────────────────────────────
+# Safety net for the login autostart (`npx arkaos autostart enable`): if the
+# dashboard is healthy this is two curl health checks (~50ms); if not, it
+# starts API+UI. Background + disown so it never touches the 5s budget.
+# Toggle off: ~/.arkaos/config.json -> {"dashboard": {"ensure_on_session": false}}
+if [ -n "$REPO" ] && [ -f "$REPO/scripts/start-dashboard.sh" ]; then
+  _DASH_ENSURE=$(python3 -c "import json; print(json.load(open('$HOME/.arkaos/config.json')).get('dashboard',{}).get('ensure_on_session', True))" 2>/dev/null || echo "True")
+  if [ "$_DASH_ENSURE" = "True" ] || [ "$_DASH_ENSURE" = "true" ]; then
+    mkdir -p "$HOME/.arkaos/logs"
+    (
+      # GNU `timeout` is absent on stock macOS — degrade to an unbounded
+      # run; the launcher itself is bounded (health wait + start).
+      if command -v timeout >/dev/null 2>&1; then
+        ARKAOS_NO_BROWSER=1 timeout 90s bash "$REPO/scripts/start-dashboard.sh" ensure >> "$HOME/.arkaos/logs/dashboard-ensure.log" 2>&1
+      else
+        ARKAOS_NO_BROWSER=1 bash "$REPO/scripts/start-dashboard.sh" ensure >> "$HOME/.arkaos/logs/dashboard-ensure.log" 2>&1
+      fi
+    ) &
+    disown 2>/dev/null || true
+  fi
+fi
+
 # --- Session Memory Resume Context ---
 if command -v python3 &>/dev/null && [ -n "$REPO" ]; then
   _SESSION_CTX=$(cd "$REPO" && python3 -c "

package/config/models.yaml

@@ -0,0 +1,70 @@
+# ═══════════════════════════════════════════════════════════════════════
+# ArkaOS Model Fabric — who runs what.
+#
+# Your copy lives at ~/.arkaos/models.yaml (created by `npx arkaos models
+# init`; this file is the packaged default). Edit it directly or use:
+#
+#   npx arkaos models                 show every role and what it resolves to
+#   npx arkaos models set review anthropic/best
+#   npx arkaos models set mechanical ollama/qwen3:8b
+#
+# The interactive runtime (Claude Code, Codex, Gemini, Cursor) keeps its
+# own main-loop model — roles govern everything ArkaOS itself dispatches:
+# subagents, Quality Gate, Forge, fusion, cognition, daemons.
+#
+# Constitution `model-routing` (Excellence Reform 2026-07-05): quality-
+# critical roles run the BEST model available by default; only genuinely
+# mechanical work economises. Change the mapping, not the posture.
+# ═══════════════════════════════════════════════════════════════════════
+version: 1
+
+# ─── Providers ──────────────────────────────────────────────────────────
+# type must match a provider in core/runtime/llm_provider.py.
+providers:
+  runtime:
+    type: subagent          # shell out to the active runtime CLI
+  anthropic:
+    type: anthropic-direct  # SDK; needs ANTHROPIC_API_KEY
+  ollama:
+    type: ollama            # local models, http://localhost:11434
+  # openrouter:             # one key -> hundreds of models (Model Fabric PR-B)
+  #   type: openrouter
+
+# ─── Aliases ────────────────────────────────────────────────────────────
+# `best` / `default` / `fast` resolve per provider, so roles stay readable.
+aliases:
+  runtime:
+    best: opus
+    default: sonnet
+    fast: haiku
+  anthropic:
+    best: claude-opus-4-8
+    default: claude-sonnet-5
+    fast: claude-haiku-4-5-20251001
+  ollama:
+    best: ""                # set your strongest local model, e.g. kimi-k2.6
+    default: ""
+    fast: ""
+
+# ─── Roles ──────────────────────────────────────────────────────────────
+# provider/model per kind of work. `model` is an alias above or a literal
+# model id. `effort`: low | medium | high | max.
+roles:
+  design:       {provider: runtime, model: best,    effort: max}
+  review:       {provider: runtime, model: best,    effort: max}
+  architecture: {provider: runtime, model: best,    effort: max}
+  strategy:     {provider: runtime, model: best,    effort: max}
+  quality_gate: {provider: runtime, model: best,    effort: max}
+  execution:    {provider: runtime, model: default, effort: high}
+  mechanical:   {provider: runtime, model: fast,    effort: low}
+
+# ─── Fusion (Model Fabric PR-D) ─────────────────────────────────────────
+# Panel answers in parallel; the judge analyses consensus, contradictions
+# and blind spots, then synthesises. Empty panel = fusion disabled.
+fusion:
+  judge: {provider: runtime, model: best, effort: max}
+  panel: []
+  # panel:
+  #   - {provider: ollama, model: kimi-k2.6}
+  #   - {provider: openrouter, model: deepseek/deepseek-v4-pro}
+  #   - {provider: anthropic, model: best}

package/core/fusion/__init__.py

@@ -0,0 +1,5 @@
+"""Fusion engine — panel of models answers, a judge synthesises."""
+
+from core.fusion.engine import FusionResult, FusionUnavailable, fuse
+
+__all__ = ["FusionResult", "FusionUnavailable", "fuse"]

package/core/fusion/cli.py

@@ -0,0 +1,37 @@
+"""Fusion CLI — smoke path for the panel → judge pipeline.
+
+Usage::
+
+    python -m core.fusion.cli "your question"
+"""
+
+from __future__ import annotations
+
+import sys
+
+from core.fusion.engine import FusionUnavailable, fuse
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = argv if argv is not None else sys.argv[1:]
+    if not args:
+        print("usage: python -m core.fusion.cli \"question\"", file=sys.stderr)
+        return 1
+    prompt = " ".join(args)
+    try:
+        result = fuse(prompt)
+    except FusionUnavailable as exc:
+        print(f"  ✗ {exc}", file=sys.stderr)
+        return 1
+    seats = ", ".join(
+        f"{a.provider}/{a.model}" + (" (failed)" if a.failed else "")
+        for a in result.answers
+    )
+    print(f"\n  Fusion — judge {result.judge_provider}/{result.judge_model} "
+          f"| panel: {seats}\n")
+    print(result.text)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/core/fusion/engine.py

@@ -0,0 +1,153 @@
+"""Fusion engine — panel → judge → synthesis (Model Fabric PR-D).
+
+Pattern validated by OpenRouter's DRACO results: a panel of diverse
+models answers the same prompt in parallel; a judge model receives every
+answer, analyses consensus, contradictions and blind spots, and writes
+the final synthesis. A budget panel + frontier judge beats frontier solo
+at roughly half the cost; self-fusion alone gains several points.
+
+Configuration lives in ``models.yaml`` (``fusion.judge`` +
+``fusion.panel`` — see ``core/runtime/model_router.py``). An empty panel
+means fusion is disabled; callers get ``FusionUnavailable`` and fall
+back to single-model completion.
+
+Consumers: Forge complex/super tiers, QG adversarial review, and the
+``python -m core.fusion.cli`` smoke path used by ``/arka-fusion``.
+"""
+
+from __future__ import annotations
+
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass, field
+
+from core.runtime.llm_provider import LLMResponse, LLMUnavailable
+from core.runtime.model_router import ModelsConfig, RoleChoice, load_config
+
+_PANEL_MAX_TOKENS = 2000
+_JUDGE_MAX_TOKENS = 3000
+
+_JUDGE_SYSTEM = (
+    "You are the judge in a model-fusion panel. You receive one question "
+    "and several independent answers from different models. Analyse them: "
+    "consensus points, contradictions, partial coverage, unique insights, "
+    "blind spots. Then write the best possible final answer grounded in "
+    "that analysis. Output ONLY the final answer — no meta-commentary "
+    "about the panel."
+)
+
+
+class FusionUnavailable(RuntimeError):
+    """Fusion cannot run: empty panel or no reachable participant."""
+
+
+@dataclass(frozen=True)
+class PanelAnswer:
+    provider: str
+    model: str
+    text: str
+    failed: bool = False
+    error: str = ""
+
+
+@dataclass(frozen=True)
+class FusionResult:
+    text: str
+    judge_provider: str
+    judge_model: str
+    answers: list[PanelAnswer] = field(default_factory=list)
+    tokens_in: int = 0
+    tokens_out: int = 0
+
+
+def _provider_for(choice: RoleChoice, config: ModelsConfig):
+    """Instantiate the LLM provider for one panel/judge seat."""
+    from core.runtime.model_router import _resolve_alias
+    model = _resolve_alias(config, choice.provider, choice.model)
+    if choice.provider == "ollama":
+        from core.runtime.ollama_provider import OllamaProvider
+        return OllamaProvider(model=model), model
+    if choice.provider == "openrouter":
+        from core.runtime.openrouter_provider import OpenRouterProvider
+        return OpenRouterProvider(model=model), model
+    # runtime / anthropic / anything else: provider chain decides; the
+    # model override is advisory (subagent uses the session model).
+    from core.runtime.llm_provider import get_llm_provider
+    return get_llm_provider(), model
+
+
+def _ask_participant(
+    choice: RoleChoice, config: ModelsConfig, prompt: str, system: str
+) -> PanelAnswer:
+    try:
+        provider, model = _provider_for(choice, config)
+        response: LLMResponse = provider.complete(
+            prompt, max_tokens=_PANEL_MAX_TOKENS, system=system
+        )
+        if not response.text.strip():
+            return PanelAnswer(choice.provider, model, "", failed=True,
+                               error="empty response")
+        return PanelAnswer(choice.provider, model, response.text)
+    except LLMUnavailable as exc:
+        return PanelAnswer(choice.provider, choice.model, "", failed=True,
+                           error=str(exc))
+    except Exception as exc:  # noqa: BLE001 — one dead seat must not kill the panel
+        return PanelAnswer(choice.provider, choice.model, "", failed=True,
+                           error=f"unexpected: {exc}")
+
+
+def _judge_prompt(prompt: str, answers: list[PanelAnswer]) -> str:
+    blocks = []
+    for i, answer in enumerate(answers, 1):
+        blocks.append(
+            f"--- Answer {i} (model: {answer.model}) ---\n{answer.text}"
+        )
+    return (
+        f"QUESTION:\n{prompt}\n\n"
+        f"PANEL ANSWERS ({len(answers)}):\n\n" + "\n\n".join(blocks)
+    )
+
+
+def fuse(
+    prompt: str,
+    *,
+    system: str = "",
+    config: ModelsConfig | None = None,
+) -> FusionResult:
+    """Run the full panel → judge → synthesis pipeline.
+
+    Raises FusionUnavailable when the panel is empty (fusion disabled in
+    models.yaml) or when every participant fails — the caller falls back
+    to a single-model completion, never to silence.
+    """
+    if config is None:
+        config, _ = load_config()
+    panel = config.fusion.panel
+    if not panel:
+        raise FusionUnavailable(
+            "fusion panel is empty — configure fusion.panel in models.yaml "
+            "(try /arka-fusion for guided setup)"
+        )
+    with ThreadPoolExecutor(max_workers=max(len(panel), 1)) as pool:
+        answers = list(pool.map(
+            lambda choice: _ask_participant(choice, config, prompt, system),
+            panel,
+        ))
+    alive = [a for a in answers if not a.failed]
+    if not alive:
+        details = "; ".join(f"{a.provider}/{a.model}: {a.error}" for a in answers)
+        raise FusionUnavailable(f"every panel participant failed — {details}")
+
+    judge_provider, judge_model = _provider_for(config.fusion.judge, config)
+    verdict = judge_provider.complete(
+        _judge_prompt(prompt, alive),
+        max_tokens=_JUDGE_MAX_TOKENS,
+        system=_JUDGE_SYSTEM,
+    )
+    return FusionResult(
+        text=verdict.text,
+        judge_provider=config.fusion.judge.provider,
+        judge_model=judge_model or verdict.model,
+        answers=answers,
+        tokens_in=verdict.tokens_in,
+        tokens_out=verdict.tokens_out,
+    )

package/core/governance/redo_counter.py

@@ -0,0 +1,81 @@
+"""Quality Gate redo-loop counter (excellence-mandate, v4.2.0).
+
+The constitution caps REJECTED redo cycles at 2 — a third REJECTED
+escalates to the operator with the full verdict instead of another
+silent retry. This module is the mechanical counter behind that rule
+(previously declarative only).
+
+State: ``~/.arkaos/quality-gate/redo-counters.json`` keyed by session id.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from pathlib import Path
+
+REDO_CAP = 2
+
+_STATE_PATH = Path.home() / ".arkaos" / "quality-gate" / "redo-counters.json"
+
+
+@dataclass(frozen=True)
+class RedoState:
+    session_id: str
+    count: int
+    escalate: bool
+
+    def to_message(self) -> str:
+        if not self.escalate:
+            return (
+                f"[arka:qg] REJECTED — redo cycle {self.count}/{REDO_CAP}. "
+                f"Looping back to execution with the issue list."
+            )
+        return (
+            f"[arka:qg:escalate] REJECTED {self.count} times — cap of "
+            f"{REDO_CAP} redo cycles exceeded (excellence-mandate). "
+            f"STOP: present the full verdict to the operator and wait for "
+            f"a decision. Do not retry silently."
+        )
+
+
+def _load(path: Path) -> dict:
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def record_rejected(session_id: str, path: Path | None = None) -> RedoState:
+    """Increment the REJECTED counter; escalate above the cap."""
+    state_path = path or _STATE_PATH
+    data = _load(state_path)
+    count = int(data.get(session_id, 0) or 0) + 1
+    data[session_id] = count
+    try:
+        state_path.parent.mkdir(parents=True, exist_ok=True)
+        state_path.write_text(json.dumps(data, indent=2), encoding="utf-8")
+    except OSError:
+        pass  # counter must never block the gate itself
+    return RedoState(session_id=session_id, count=count,
+                     escalate=count > REDO_CAP)
+
+
+def reset(session_id: str, path: Path | None = None) -> None:
+    """Clear the counter — called on APPROVED."""
+    state_path = path or _STATE_PATH
+    data = _load(state_path)
+    if session_id in data:
+        del data[session_id]
+        try:
+            state_path.write_text(json.dumps(data, indent=2), encoding="utf-8")
+        except OSError:
+            pass
+
+
+def current(session_id: str, path: Path | None = None) -> RedoState:
+    """Read-only view of the counter."""
+    count = int(_load(path or _STATE_PATH).get(session_id, 0) or 0)
+    return RedoState(session_id=session_id, count=count,
+                     escalate=count > REDO_CAP)