chati-dev 4.5.28 → 4.5.29

package/node_modules/@chati/rail/src/provider-processing.js

@@ -0,0 +1,118 @@
+import { canonicalize, ContractError, sha256 } from '@chati/core';
+import { restoredExecutionProof } from './execution-restoration.js';
+import { assertTerminalCompletionContainment } from './terminal-containment.js';
+
+const STAGES = Object.freeze({ execution_dispatched: 'execution', review_dispatched: 'review', adjudication_dispatched: 'adjudication' });
+function fail(code, message) { throw new ContractError(code, message); }
+
+/** Full observed text, never a summary or caller-declared result. */
+export function assertProviderProcessOutput(output, receipt) {
+  if (!output || typeof output !== 'object' || Array.isArray(output)
+    || Object.keys(output).length !== 2
+    || typeof output.stdout !== 'string' || typeof output.stderr !== 'string') {
+    fail('RAIL_PROCESS_OUTPUT_MISMATCH', 'process output must contain exactly stdout and stderr strings');
+  }
+  if (Buffer.byteLength(output.stdout) > 1_000_000 || Buffer.byteLength(output.stderr) > 100_000) {
+    fail('RAIL_PROCESS_OUTPUT_TOO_LARGE', 'observed process output exceeds the journal-bound evidence limit');
+  }
+  if (sha256(output.stdout) !== receipt.stdout_digest || sha256(output.stderr) !== receipt.stderr_digest) {
+    fail('RAIL_PROCESS_OUTPUT_MISMATCH', 'process output must match both digests in its verified completion receipt');
+  }
+}
+
+export function providerProcessDispatches(records, attemptId) {
+  return records.filter((record) => Object.hasOwn(STAGES, record.type) && record.payload?.attempt_id === attemptId);
+}
+
+export function assertProviderProcessReceipt(dispatch, receipt, verifyAuthority) {
+  const invocation = dispatch.payload.invocation;
+  const launch = dispatch.payload.launch_receipt;
+  const binding = { authority_kind: `rail_${STAGES[dispatch.type]}`, invocation_id: invocation.invocation_id,
+    launch_nonce: invocation.launch_nonce, terminal_id: launch.terminal_id, provider_id: invocation.provider_id,
+    harness_id: invocation.harness_id, model_id: invocation.model_pin.model_id,
+    reasoning_configuration: invocation.model_pin.reasoning_configuration };
+  verifyAuthority('provider_process_launch', launch, { ...binding, purpose: 'terminal_launch' });
+  verifyAuthority('provider_process_completion', receipt, { ...binding, purpose: 'terminal_completion',
+    launch_receipt_digest: sha256(launch) });
+  assertTerminalCompletionContainment(receipt, launch, 'RAIL_PROCESS_CONTAINMENT_MISMATCH');
+  if (receipt.process_time_kind !== 'provider-invocation-wall-time'
+    || typeof receipt.process_elapsed_ms !== 'number' || !Number.isFinite(receipt.process_elapsed_ms)
+    || receipt.process_elapsed_ms < 0 || !Number.isInteger(receipt.exit_status)) {
+    fail('RAIL_PROCESS_DURATION_REQUIRED', 'provider processing requires a signed monotonic duration and observed exit, never inferred wall-clock timestamps');
+  }
+}
+
+function completionReceipt(record) {
+  if (['provider_process_observed', 'review_decided'].includes(record.type)) return record.payload.terminal_authority_receipt;
+  if (record.type === 'execution_recorded') return record.payload.execution_evidence?.execution?.terminal_authority_receipt;
+  if (record.type === 'adjudication_observed') return record.payload.observation?.terminal_authority_receipt;
+  return null;
+}
+
+/** Called with a verified canonical journal by RailEngine, not caller evidence. */
+export function collectProviderProcessing(records, { attempt_id, verifyAuthority }) {
+  const dispatches = providerProcessDispatches(records, attempt_id);
+  if (!dispatches.length) fail('RAIL_PROCESS_COVERAGE_INCOMPLETE', 'no dispatched provider process has been observed for this attempt');
+  const seenNonces = new Set();
+  const processes = dispatches.map((dispatch) => {
+    const { invocation } = dispatch.payload;
+    // Logical invocation IDs may be reused by a retry/resumed review round.
+    // The canonical launch nonce identifies the actual process invocation.
+    if (seenNonces.has(invocation.launch_nonce)) {
+      fail('RAIL_PROCESS_DISPATCH_CONFLICT', 'canonical provider dispatch identities must be unique');
+    }
+    seenNonces.add(invocation.launch_nonce);
+    const completions = records.filter((record) => record.payload?.attempt_id === attempt_id)
+      .map((record) => ({ record, receipt: completionReceipt(record) }))
+      .filter(({ receipt }) => receipt?.launch_nonce === invocation.launch_nonce);
+    if (!completions.length) {
+      const proof = restoredExecutionProof(records, dispatch, { verifyAuthority, requireRecovered: true });
+      if (!proof) fail('RAIL_PROCESS_COVERAGE_INCOMPLETE', `provider invocation ${invocation.invocation_id} has no observed completion or canonical restored recovery`);
+      verifyAuthority('provider_process_launch', dispatch.payload.launch_receipt, {
+        purpose: 'terminal_launch', authority_kind: 'rail_execution', invocation_id: invocation.invocation_id,
+        launch_nonce: invocation.launch_nonce, provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+        model_id: invocation.model_pin.model_id, reasoning_configuration: invocation.model_pin.reasoning_configuration });
+      return { stage: STAGES[dispatch.type], dispatch_event_id: dispatch.event_id,
+        source_event_ids: [proof.interruption_event_id, proof.checkpoint_event_id, proof.restoration_event_id, proof.recovery_event_id],
+        invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+        provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+        model_id: invocation.model_pin.model_id, reasoning_configuration: invocation.model_pin.reasoning_configuration,
+        measurement_status: 'unavailable_interrupted', process_elapsed_ms: null, exit_status: null,
+        receipt_digest: null, reconciliation: proof };
+    }
+    if (records.some((record) => record.type === 'execution_worktree_restored'
+      && record.payload.dispatch_event_id === dispatch.event_id)) {
+      fail('RAIL_PROCESS_RECEIPT_CONFLICT', 'restored interruption must not also claim an observed completion');
+    }
+    const receipt = completions[0].receipt;
+    assertProviderProcessReceipt(dispatch, receipt, verifyAuthority);
+    if (completions.some((entry) => sha256(entry.receipt) !== sha256(receipt))) {
+      fail('RAIL_PROCESS_RECEIPT_CONFLICT', 'one provider invocation has conflicting completion receipts');
+    }
+    return { stage: STAGES[dispatch.type], dispatch_event_id: dispatch.event_id,
+      source_event_ids: [...new Set(completions.map((entry) => entry.record.event_id))],
+      invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+      provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+      model_id: invocation.model_pin.model_id, reasoning_configuration: invocation.model_pin.reasoning_configuration,
+      measurement_status: 'observed',
+      process_elapsed_ms: receipt.process_elapsed_ms, exit_status: receipt.exit_status,
+      receipt_digest: sha256(receipt) };
+  });
+  const observedValue = processes.filter((entry) => entry.measurement_status === 'observed')
+    .reduce((sum, entry) => sum + entry.process_elapsed_ms, 0);
+  if (!Number.isFinite(observedValue)) fail('RAIL_PROCESS_DURATION_REQUIRED', 'summed provider processing duration exceeds the finite measurement range');
+  const unknown = processes.filter((entry) => entry.measurement_status === 'unavailable_interrupted').map((entry) => entry.launch_nonce);
+  return Object.freeze(canonicalize({ schema_version: 2, evidence_class: 'observed-provider-invocation-wall-time',
+    attempt_id, counted_stages: [...new Set(processes.map((entry) => entry.stage))],
+    unit: 'milliseconds', value: unknown.length ? null : observedValue, observed_value: observedValue,
+    coverage: unknown.length ? 'reconciled_incomplete' : 'complete', unknown_launch_nonces: unknown, processes }));
+}
+
+/** Preserve unknown duration explicitly when converting units for completion. */
+export function providerProcessingMetric(report, evidence_ref) {
+  return canonicalize({ unit: 'minutes', value: report.value === null ? null : report.value / 60000, evidence_ref,
+    coverage: { schema_version: 2, status: report.coverage, observed_value: report.observed_value / 60000,
+      unknown_launch_nonces: report.unknown_launch_nonces,
+      reconciliation_proofs: report.processes.filter((entry) => entry.measurement_status === 'unavailable_interrupted')
+        .map((entry) => entry.reconciliation) } });
+}

package/node_modules/@chati/rail/src/terminal-containment.js

@@ -0,0 +1,23 @@
+import { ContractError, assertDarwinTerminalLaunch, assertDarwinTerminalCompletion } from '@chati/core';
+
+function reject(code, message) { throw new ContractError(code, message); }
+function typed(check, code) {
+  try { check(); } catch (error) { reject(code, `Darwin terminal contract rejected: ${error.message}`); }
+}
+
+/** Authentication remains with RailEngine's configured authority verifier. */
+export function assertTerminalLaunchContainment(receipt, code) {
+  if (receipt.process_containment_kind === 'darwin_scoped_process_group_v1') {
+    typed(() => assertDarwinTerminalLaunch(receipt), code);
+  } else if (receipt.process_containment_kind !== 'bubblewrap_pid_namespace_v1'
+    || Object.hasOwn(receipt, 'darwin_launch_binding')) reject(code, 'unsupported or mixed terminal containment variant');
+}
+
+export function assertTerminalCompletionContainment(receipt, launch, code) {
+  if (launch.process_containment_kind === 'darwin_scoped_process_group_v1') {
+    typed(() => assertDarwinTerminalCompletion(receipt, launch), code);
+  } else if (Object.hasOwn(launch, 'darwin_launch_binding')
+    || Object.hasOwn(receipt, 'darwin_completion_observation') || Object.hasOwn(receipt, 'darwin_launch_binding_digest')) {
+    reject(code, 'Darwin completion cannot be attached to another containment variant');
+  }
+}

package/node_modules/@chati/release-lane/src/index.js

@@ -1,11 +1,14 @@
 import { createPublicKey, randomUUID, verify as verifySignature } from 'node:crypto';
 import {
-  closeSync, constants, existsSync, fstatSync, fsyncSync, ftruncateSync, mkdirSync,
-  lstatSync, openSync, readSync, renameSync, unlinkSync, writeSync,
+  closeSync, constants, fstatSync, fsyncSync, ftruncateSync,
+  openSync, readSync, writeSync,
 } from 'node:fs';
 import { hostname } from 'node:os';
-import { basename, dirname, join, parse, resolve, sep } from 'node:path';
-import { ContractError, canonicalize, sha256 } from '@chati/core';
+import { basename, dirname, parse, resolve, sep } from 'node:path';
+import {
+  captureHostBootMarker, ContractError, canonicalize, hostBootMarkerChanged, sha256, openAtSync, mkdirAtSync,
+  lstatAtSync, renameAtSync, unlinkAtSync,
+} from '@chati/core';
 
 const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
 const RELEASE_STATE_MAX_BYTES = 64 * 1024 * 1024;
@@ -324,16 +327,12 @@ function sameSnapshot(left, right) {
     && left?.ctimeMs === right?.ctimeMs;
 }
 
-function descriptorDirectoryPath(descriptor) {
-  return `/proc/self/fd/${descriptor}`;
-}
-
 function openPinnedReleaseDirectory(path, { create = false } = {}) {
   const absolute = resolve(path);
-  if (process.platform !== 'linux') {
+  if (!['linux', 'darwin'].includes(process.platform)) {
     fail(
       'UNSUPPORTED_RELEASE_STATE_PLATFORM',
-      'durable release state requires descriptor-relative filesystem access, which is supported only on Linux',
+      `durable release state requires descriptor-relative filesystem access; unsupported platform: ${process.platform}`,
     );
   }
   const root = parse(absolute).root;
@@ -341,10 +340,9 @@ function openPinnedReleaseDirectory(path, { create = false } = {}) {
   let descriptor = openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
   try {
     for (const segment of segments) {
-      const childPath = join(descriptorDirectoryPath(descriptor), segment);
       let childDescriptor;
       try {
-        childDescriptor = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+        childDescriptor = openAtSync(descriptor, segment, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
       } catch (error) {
         if (error?.code !== 'ENOENT' || !create) {
           if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
@@ -352,9 +350,9 @@ function openPinnedReleaseDirectory(path, { create = false } = {}) {
           }
           throw error;
         }
-        try { mkdirSync(childPath, { mode: 0o700 }); }
+        try { mkdirAtSync(descriptor, segment, { mode: 0o700 }); }
         catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
-        childDescriptor = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+        childDescriptor = openAtSync(descriptor, segment, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
       }
       const childStat = fstatSync(childDescriptor);
       if (!childStat.isDirectory()) {
@@ -366,7 +364,6 @@ function openPinnedReleaseDirectory(path, { create = false } = {}) {
     }
     return Object.freeze({
       absolute, descriptor, identity: fstatSync(descriptor),
-      reference: descriptorDirectoryPath(descriptor),
     });
   } catch (error) {
     closeSync(descriptor);
@@ -388,15 +385,11 @@ function assertPinnedReleaseDirectory(storage) {
   closeSync(canonical.descriptor);
 }
 
-function releaseEntryPath(storage, name) {
+function openReleaseEntry(storage, name, flags, mode) {
   if (basename(name) !== name || name === '.' || name === '..') {
     fail('UNSAFE_RELEASE_STATE_FILE', 'release state entry must be one path segment');
   }
-  return join(storage.reference, name);
-}
-
-function openReleaseEntry(storage, name, flags, mode) {
-  try { return openSync(releaseEntryPath(storage, name), flags, mode); }
+  try { return openAtSync(storage.descriptor, name, flags, mode); }
   catch (error) {
     if (['ELOOP', 'ENXIO', 'EISDIR'].includes(error?.code)) {
       fail('UNSAFE_RELEASE_STATE_FILE', 'release state must not be a symlink, FIFO or directory');
@@ -471,8 +464,6 @@ function writeReleaseCheckpoint(storage, stateName, checkpoint) {
   if (bytes.length > RELEASE_CHECKPOINT_MAX_BYTES) fail('INVALID_RELEASE_STATE', 'release checkpoint exceeds its safety limit');
   const targetName = checkpointName(stateName);
   const temporaryName = `${targetName}.${process.pid}.${randomUUID()}.tmp`;
-  const temporaryPath = releaseEntryPath(storage, temporaryName);
-  const targetPath = releaseEntryPath(storage, targetName);
   let fd;
   try {
     assertPinnedReleaseDirectory(storage);
@@ -487,12 +478,12 @@ function writeReleaseCheckpoint(storage, stateName, checkpoint) {
     closeSync(fd);
     fd = undefined;
     assertPinnedReleaseDirectory(storage);
-    renameSync(temporaryPath, targetPath);
+    renameAtSync(storage.descriptor, temporaryName, storage.descriptor, targetName);
     fsyncSync(storage.descriptor);
     assertPinnedReleaseDirectory(storage);
   } finally {
     if (fd !== undefined) closeSync(fd);
-    try { unlinkSync(temporaryPath); } catch { /* temporary may already be renamed or absent */ }
+    try { unlinkAtSync(storage.descriptor, temporaryName); } catch { /* temporary may already be renamed or absent */ }
   }
 }
 
@@ -543,22 +534,24 @@ function readLockOwner(storage, name, { assertCanonical = true } = {}) {
 
 function recoverStaleLock(storage, name) {
   assertPinnedReleaseDirectory(storage);
-  const path = releaseEntryPath(storage, name);
   let stat;
-  try { stat = lstatSync(path); } catch (error) { return error?.code === 'ENOENT'; }
+  try { stat = lstatAtSync(storage.descriptor, name); } catch (error) { return error?.code === 'ENOENT'; }
   if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) return false;
   const owner = readLockOwner(storage, name);
-  if (owner?.hostname === hostname() && processIsAlive(owner.pid)) return false;
+  // A rebooted host may recycle the owner's pid onto an unrelated live process.
+  // Prove the reboot from the boot marker before ever trusting PID liveness.
+  if (owner?.hostname === hostname() && !hostBootMarkerChanged(owner.host_boot_marker, captureHostBootMarker())
+    && processIsAlive(owner.pid)) return false;
   // A PID from another host cannot be proven dead locally. Never steal a
   // remote lock automatically; explicit operator reconciliation is required.
   if (owner?.hostname && owner.hostname !== hostname()) return false;
   if (!owner && Date.now() - stat.mtimeMs < RELEASE_LOCK_STALE_AFTER_MS) return false;
   const recoveryName = `${name}.recovery`;
-  const recoveryPath = releaseEntryPath(storage, recoveryName);
   let recoveryFd;
   try {
-    recoveryFd = openSync(recoveryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
-    const bytes = Buffer.from(JSON.stringify({ pid: process.pid, hostname: hostname(), token: randomUUID() }));
+    recoveryFd = openAtSync(storage.descriptor, recoveryName, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const recoveryMarker = captureHostBootMarker();
+    const bytes = Buffer.from(JSON.stringify({ pid: process.pid, hostname: hostname(), token: randomUUID(), ...(recoveryMarker ? { host_boot_marker: recoveryMarker } : {}) }));
     writeSync(recoveryFd, bytes, 0, bytes.length);
     fsyncSync(recoveryFd);
   } catch {
@@ -566,24 +559,28 @@ function recoverStaleLock(storage, name) {
     return false;
   }
   const quarantineName = `${name}.stale.${process.pid}.${randomUUID()}`;
-  const quarantine = releaseEntryPath(storage, quarantineName);
   try {
-    const current = lstatSync(path);
+    const current = lstatAtSync(storage.descriptor, name);
     const currentOwner = readLockOwner(storage, name);
     if (!sameIdentity(stat, current) || currentOwner?.token !== owner?.token) return false;
-    renameSync(path, quarantine);
-    const quarantined = lstatSync(quarantine);
+    renameAtSync(storage.descriptor, name, storage.descriptor, quarantineName);
+    const quarantined = lstatAtSync(storage.descriptor, quarantineName);
     const quarantinedOwner = readLockOwner(storage, quarantineName);
     if (!sameIdentity(stat, quarantined) || quarantinedOwner?.token !== owner?.token) {
-      try { if (!existsSync(path)) renameSync(quarantine, path); } catch { /* preserve quarantine fail-closed */ }
+      try { lstatAtSync(storage.descriptor, name); }
+      catch (error) {
+        if (error?.code === 'ENOENT') {
+          try { renameAtSync(storage.descriptor, quarantineName, storage.descriptor, name); } catch { /* preserve quarantine fail-closed */ }
+        }
+      }
       return false;
     }
-    unlinkSync(quarantine);
+    unlinkAtSync(storage.descriptor, quarantineName);
     return true;
   } catch (error) { return error?.code === 'ENOENT'; }
   finally {
     if (recoveryFd !== undefined) closeSync(recoveryFd);
-    try { unlinkSync(recoveryPath); } catch { /* fail closed if recovery ownership changed */ }
+    try { unlinkAtSync(storage.descriptor, recoveryName); } catch { /* fail closed if recovery ownership changed */ }
   }
 }
 
@@ -591,7 +588,6 @@ function acquireReleaseLock(statePath) {
   const storage = openPinnedReleaseDirectory(dirname(statePath), { create: true });
   const stateName = basename(statePath);
   const name = lockName(stateName);
-  const path = releaseEntryPath(storage, name);
   let fd;
   let token;
   try {
@@ -599,7 +595,7 @@ function acquireReleaseLock(statePath) {
       assertPinnedReleaseDirectory(storage);
       let candidate;
       try {
-        candidate = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+        candidate = openAtSync(storage.descriptor, name, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
       } catch (error) {
         if (error?.code !== 'EEXIST') throw error;
         if (recoverStaleLock(storage, name)) continue;
@@ -608,7 +604,8 @@ function acquireReleaseLock(statePath) {
       }
       token = `${process.pid}-${Date.now()}-${randomUUID()}`;
       try {
-        const bytes = Buffer.from(JSON.stringify({ schema_version: 1, pid: process.pid, hostname: hostname(), token, acquired_at: new Date().toISOString() }));
+        const ownerMarker = captureHostBootMarker();
+        const bytes = Buffer.from(JSON.stringify({ schema_version: 1, pid: process.pid, hostname: hostname(), token, acquired_at: new Date().toISOString(), ...(ownerMarker ? { host_boot_marker: ownerMarker } : {}) }));
         writeSync(candidate, bytes, 0, bytes.length);
         fsyncSync(candidate);
         fsyncSync(storage.descriptor);
@@ -616,7 +613,7 @@ function acquireReleaseLock(statePath) {
         break;
       } catch (error) {
         closeSync(candidate);
-        try { unlinkSync(path); } catch { /* the acquisition failed closed */ }
+        try { unlinkAtSync(storage.descriptor, name); } catch { /* the acquisition failed closed */ }
         throw error;
       }
     }
@@ -633,7 +630,7 @@ function acquireReleaseLock(statePath) {
       try { assertPinnedReleaseDirectory(storage); } catch (error) { safetyError = error; }
       try {
         if (readLockOwner(storage, name, { assertCanonical: false })?.token === token) {
-          unlinkSync(path);
+          unlinkAtSync(storage.descriptor, name);
           fsyncSync(storage.descriptor);
         }
       } finally { closeSync(storage.descriptor); }

package/node_modules/@chati/review-council/src/index.js

@@ -7,6 +7,21 @@ const DISPOSITIONS = new Set(['accepted', 'rejected', 'unresolved']);
 const VERDICTS = new Set(['accept', 'rework', 'required-human-decision', 'blocked']);
 const AUTHORITY_REASONS = new Set(['scope', 'security', 'privacy', 'cost', 'external-action']);
 const IMPASSE_KINDS = new Set(['none', 'technical']);
+const COUNCIL_REVIEW_VERDICTS = new Set(['accept', 'rework']);
+const COUNCIL_BLOCKING_SEVERITIES = new Set(['critical', 'high']);
+
+/**
+ * Product-level default for planning-quality gates. It deliberately expresses
+ * a range rather than inventing a third provider when an installation has
+ * only two selected providers. One-provider installations cannot satisfy the
+ * autonomous council quorum.
+ */
+export const DEFAULT_COUNCIL_POLICY = Object.freeze({
+  min_members: 2,
+  max_members: 3,
+  require_distinct_providers: true,
+  blocking_severities: Object.freeze(['critical', 'high']),
+});
 
 function fail(code, message, details = {}) {
   throw new ContractError(code, message, details);
@@ -126,6 +141,214 @@ function nearestReviewReasoning(binding, model) {
     })[0] || null;
 }
 
+function reviewPriority(model) {
+  return model.routing_priority?.['council:review']
+    ?? model.routing_priority?.['planning:council']
+    ?? model.routing_priority?.review
+    ?? 0;
+}
+
+function validateCouncilPolicy(policy = DEFAULT_COUNCIL_POLICY) {
+  assertObject(policy, 'INVALID_COUNCIL_POLICY', 'council policy');
+  const min = policy.min_members;
+  const max = policy.max_members;
+  if (!Number.isInteger(min) || min < 2) {
+    fail('INVALID_COUNCIL_POLICY', 'council policy requires at least two members');
+  }
+  if (!Number.isInteger(max) || max < min || max > 3) {
+    fail('INVALID_COUNCIL_POLICY', 'council policy max_members must be between min_members and 3');
+  }
+  if (policy.require_distinct_providers !== true) {
+    fail('INVALID_COUNCIL_POLICY', 'council policy requires distinct providers');
+  }
+  const severities = policy.blocking_severities;
+  if (!Array.isArray(severities) || severities.length !== COUNCIL_BLOCKING_SEVERITIES.size
+    || !severities.every((severity) => COUNCIL_BLOCKING_SEVERITIES.has(severity))
+    || new Set(severities).size !== COUNCIL_BLOCKING_SEVERITIES.size) {
+    fail('INVALID_COUNCIL_POLICY', 'council blocking severities must contain exactly critical and high');
+  }
+  return freeze(canonicalize({
+    min_members: min,
+    max_members: max,
+    require_distinct_providers: true,
+    blocking_severities: [...new Set(severities)].sort(),
+  }));
+}
+
+/** Validates the public policy without selecting a provider. */
+export function validateCouncilGatePolicy(policy) {
+  return validateCouncilPolicy(policy);
+}
+
+function selectBestReviewerPerProvider({ installation, snapshot, builder_identity, clock }) {
+  assertObject(installation, 'INVALID_COUNCIL_SELECTION', 'installation');
+  assertObject(snapshot, 'INVALID_COUNCIL_SELECTION', 'snapshot');
+  if (builder_identity !== undefined) validateIdentity(builder_identity, 'builder_identity');
+  const byProvider = new Map();
+  for (const binding of installation.enabled_providers || []) {
+    for (const modelId of binding.allowed_models || []) {
+      const model = snapshot.models?.find((candidate) =>
+        candidate.provider_id === binding.provider_id && candidate.model_id === modelId);
+      if (!model?.actions?.includes('review')) continue;
+      const reasoning = nearestReviewReasoning(binding, model);
+      if (!reasoning) continue;
+      const reviewer_identity = { provider_id: binding.provider_id, model_id: model.model_id };
+      const invocation = {
+        provider_id: binding.provider_id,
+        harness_id: binding.harness_id,
+        action: 'review',
+        model_pin: {
+          model_id: model.model_id,
+          catalog_snapshot_ref: snapshot.snapshot_id,
+          reasoning_configuration: reasoning,
+        },
+      };
+      assertEligibleInvocation({ installation, snapshot, invocation, clock });
+      const candidate = {
+        invocation,
+        reviewer_identity,
+        priority: reviewPriority(model),
+        adjudication_priority: model.adjudication_priority ?? 0,
+        independence_level: builder_identity
+          ? computeIndependenceLevel({ builder_identity, reviewer_identity })
+          : null,
+      };
+      const current = byProvider.get(binding.provider_id);
+      if (!current
+        || candidate.priority > current.priority
+        || (candidate.priority === current.priority && candidate.adjudication_priority > current.adjudication_priority)
+        || (candidate.priority === current.priority && candidate.adjudication_priority === current.adjudication_priority
+          && `${candidate.invocation.harness_id}:${candidate.reviewer_identity.model_id}`
+            .localeCompare(`${current.invocation.harness_id}:${current.reviewer_identity.model_id}`) < 0)) {
+        byProvider.set(binding.provider_id, candidate);
+      }
+    }
+  }
+  return [...byProvider.values()].sort((left, right) =>
+    right.priority - left.priority
+    || right.adjudication_priority - left.adjudication_priority
+    || `${left.invocation.provider_id}:${left.invocation.harness_id}:${left.reviewer_identity.model_id}`
+      .localeCompare(`${right.invocation.provider_id}:${right.invocation.harness_id}:${right.reviewer_identity.model_id}`)
+  );
+}
+
+/**
+ * Selects the autonomous planning council from the installation allow-list.
+ * It chooses at most one model per provider and never pads the council with an
+ * unselected vendor. Two selected providers are sufficient; a third improves
+ * coverage when available.
+ */
+export function selectCouncilReviewers({
+  installation,
+  snapshot,
+  builder_identity,
+  policy = DEFAULT_COUNCIL_POLICY,
+  clock = () => new Date(),
+} = {}) {
+  const normalizedPolicy = validateCouncilPolicy(policy);
+  const candidates = selectBestReviewerPerProvider({ installation, snapshot, builder_identity, clock });
+  if (candidates.length < normalizedPolicy.min_members) {
+    fail(
+      'COUNCIL_QUORUM_UNAVAILABLE',
+      `autonomous council requires ${normalizedPolicy.min_members} distinct selected providers with review capability, but only ${candidates.length} are eligible`,
+      {
+        required_members: normalizedPolicy.min_members,
+        eligible_providers: candidates.map(({ invocation }) => invocation.provider_id),
+      },
+    );
+  }
+  const members = candidates.slice(0, normalizedPolicy.max_members).map((candidate, index) => ({
+    member_id: `council-${index + 1}-${candidate.invocation.provider_id}-${candidate.reviewer_identity.model_id}`,
+    ...candidate.invocation,
+    reviewer_identity: candidate.reviewer_identity,
+    ...(candidate.independence_level ? { independence_level: candidate.independence_level } : {}),
+  }));
+  return freeze(canonicalize({
+    policy: normalizedPolicy,
+    member_count: members.length,
+    members,
+  }));
+}
+
+function validateCouncilFinding(finding) {
+  validateFinding(finding);
+  return finding;
+}
+
+/**
+ * Validates one member result. Low and medium findings are durable evidence
+ * but do not turn an otherwise successful council decision into rework.
+ */
+export function validateCouncilMemberReview(result, { blocking_severities = DEFAULT_COUNCIL_POLICY.blocking_severities } = {}) {
+  assertObject(result, 'INVALID_COUNCIL_REVIEW', 'council member review');
+  assertString(result.member_id, 'INVALID_COUNCIL_REVIEW', 'council member review.member_id');
+  validateIdentity(result.reviewer_identity, 'council member review.reviewer_identity');
+  if (!COUNCIL_REVIEW_VERDICTS.has(result.verdict)) {
+    fail('INVALID_COUNCIL_REVIEW', 'council member review.verdict must be accept or rework');
+  }
+  if (!Array.isArray(result.findings)) fail('INVALID_COUNCIL_REVIEW', 'council member review.findings must be an array');
+  const findingIds = new Set();
+  for (const finding of result.findings) {
+    validateCouncilFinding(finding);
+    if (findingIds.has(finding.finding_id)) {
+      fail('DUPLICATE_COUNCIL_FINDING_ID', `council member ${result.member_id} returned finding ${finding.finding_id} more than once`);
+    }
+    findingIds.add(finding.finding_id);
+  }
+  const acceptedBlockingFindings = result.findings.filter((finding) =>
+    finding.disposition === 'accepted' && blocking_severities.includes(finding.severity));
+  if (acceptedBlockingFindings.length > 0 && result.verdict !== 'rework') {
+    fail('COUNCIL_BLOCKER_REQUIRES_REWORK', 'an accepted high or critical council finding requires rework');
+  }
+  return freeze(canonicalize(result));
+}
+
+/**
+ * Applies unanimity to absence of blockers. This is intentionally not a vote:
+ * any accepted high or critical finding blocks, while lower-severity findings
+ * stay in the immutable decision trail without blocking the gate.
+ */
+export function decideCouncilGate({ selection, reviews } = {}) {
+  assertObject(selection, 'INVALID_COUNCIL_SELECTION', 'council selection');
+  const policy = validateCouncilPolicy(selection.policy);
+  if (!Array.isArray(selection.members) || selection.members.length < policy.min_members || selection.members.length > policy.max_members) {
+    fail('INVALID_COUNCIL_SELECTION', 'council selection does not satisfy its policy quorum');
+  }
+  if (!Array.isArray(reviews)) fail('INVALID_COUNCIL_REVIEW', 'council reviews must be an array');
+  const expected = new Map(selection.members.map((member) => [member.member_id, member]));
+  if (reviews.length !== expected.size) {
+    fail('COUNCIL_QUORUM_INCOMPLETE', 'every selected council member must return one result before the gate can decide');
+  }
+  const seen = new Set();
+  const acceptedBlockingFindings = [];
+  const nonBlockingFindings = [];
+  const normalizedReviews = reviews.map((result) => {
+    const validated = validateCouncilMemberReview(result, { blocking_severities: policy.blocking_severities });
+    const member = expected.get(validated.member_id);
+    if (!member) fail('COUNCIL_MEMBER_UNEXPECTED', `review returned by unselected council member ${validated.member_id}`);
+    if (seen.has(validated.member_id)) fail('DUPLICATE_COUNCIL_MEMBER_REVIEW', `council member ${validated.member_id} returned more than once`);
+    seen.add(validated.member_id);
+    if (member.reviewer_identity.provider_id !== validated.reviewer_identity.provider_id
+      || member.reviewer_identity.model_id !== validated.reviewer_identity.model_id) {
+      fail('COUNCIL_MEMBER_IDENTITY_MISMATCH', `council member ${validated.member_id} did not use its selected model`);
+    }
+    for (const finding of validated.findings) {
+      const entry = { member_id: validated.member_id, ...finding };
+      if (finding.disposition === 'accepted' && policy.blocking_severities.includes(finding.severity)) acceptedBlockingFindings.push(entry);
+      else if (finding.disposition === 'accepted') nonBlockingFindings.push(entry);
+    }
+    return validated;
+  });
+  if (seen.size !== expected.size) fail('COUNCIL_QUORUM_INCOMPLETE', 'one or more selected council members did not return a result');
+  return freeze(canonicalize({
+    verdict: acceptedBlockingFindings.length === 0 ? 'accept' : 'rework',
+    member_count: selection.members.length,
+    reviews: normalizedReviews,
+    blocking_findings: acceptedBlockingFindings,
+    non_blocking_findings: nonBlockingFindings,
+  }));
+}
+
 /** Selects the one canonical reviewer from the signed selected-only capability projection. */
 export function selectCanonicalReviewer({ installation, snapshot, builder_identity, clock = () => new Date() } = {}) {
   assertObject(installation, 'INVALID_REVIEW_SELECTION', 'installation');