devcouncil 0.1.1 → 0.3.0

package/src/devcouncil/app/config.py

@@ -5,16 +5,37 @@ Replaces scattered yaml.safe_load() calls with a single validated config service
 
 from __future__ import annotations
 
+import logging
 import os
+import shutil
+import subprocess
+import time
 from pathlib import Path
-from typing import Dict, List
+from typing import Dict, List, Optional, Tuple
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
+
+logger = logging.getLogger(__name__)
 
 
 class ModelRoleConfig(BaseModel):
     model: str
     temperature: float = 0.0
+    # Optional per-role provider override. When unset, the role uses
+    # ``models.provider``. Lets a single run route some roles to one provider
+    # (e.g. planning on OpenRouter) and others to another (e.g. live review on
+    # local Ollama). Validated/normalized against the supported provider list.
+    provider: str | None = None
+
+    @field_validator("provider")
+    @classmethod
+    def _normalize_provider(cls, value: str | None) -> str | None:
+        if value is None:
+            return None
+        # Lazy import avoids a circular import (llm.provider imports app.config).
+        from devcouncil.llm.provider import validate_model_provider
+
+        return validate_model_provider(value)
 
 
 class ModelsConfig(BaseModel):
@@ -34,6 +55,79 @@ class CommandsConfig(BaseModel):
     typecheck: List[str] = Field(default_factory=list)
 
 
+class VerificationSandboxConfig(BaseModel):
+    docker_image: str = "python:3.12-slim"
+    docker_setup_commands: List[str] = Field(default_factory=list)
+    nix_flake_attr: str | None = None
+
+
+class DiffCoverageConfig(BaseModel):
+    """Diff↔coverage gating: prove the *changed* lines were exercised by tests.
+
+    ``measure`` runs the diff-coverage analysis and records it as evidence (and a
+    non-blocking signal) whenever the target repo's coverage tooling is present.
+    ``enforce`` promotes an unexercised diff to a *blocking* gap. Enforcement is
+    off by default so the signal is visible before it ever gates — a passing test
+    that does not touch the new code is surfaced first, then teams opt in to
+    blocking. ``min_ratio`` of 0.0 means "require at least one changed executable
+    line to be exercised"; a higher value demands that fraction of changed lines.
+    """
+
+    measure: bool = True
+    enforce: bool = False
+    min_ratio: float = 0.0
+
+
+class AcceptanceCheckConfig(BaseModel):
+    """Tuning for DevCouncil's per-criterion compiled acceptance checks.
+
+    These default to single-shot behavior (``samples=1``, ``repair_attempts=1``)
+    so a strong cloud model is unaffected. They exist to make a WEAK/LOCAL model
+    (e.g. an Ollama reviewer) trustworthy: such a model frequently emits a check
+    that does not run (wrong import, broken one-liner) — recorded as ``incomplete``
+    — or a single mis-asserting check that false-``blocked`` correct code.
+
+    - ``repair_attempts``: when a compiled check FAILS TO RUN (malformed/unrunnable,
+      proves nothing), feed the error back and regenerate the COMMAND up to this many
+      times. Safe by construction — a check that never ran cannot weaken the gate.
+    - ``samples``: generate this many INDEPENDENT checks per criterion and decide by
+      majority vote (proven iff a strict majority pass; unanimous-fail blocks; a split
+      stays unproven with a non-blocking advisory). Local sampling is cost-free, so
+      raising this (e.g. 3) outvotes a single mis-generated check without ever
+      auto-passing a real defect. ``1`` reproduces today's single-check behavior.
+    """
+
+    samples: int = 1
+    repair_attempts: int = 1
+    # Compile one criterion per model call instead of batching them all into a single
+    # prompt. A weak/local model batching N criteria into one JSON routinely omits or
+    # mis-attributes some (a false "incomplete"); a focused single-criterion prompt is far
+    # more reliable. Costs N× the calls — cheap on a local monitor, so opt-in. Off keeps
+    # the single batched call.
+    per_criterion: bool = False
+
+
+class ReviewerCheckConfig(BaseModel):
+    """Self-consistency voting for the LLM live reviewer.
+
+    A weak/local reviewer can emit a lone, mis-calibrated "Critical Issues" verdict that
+    falsely BLOCKS (the live card becomes a blocking gap). Sampling ``samples`` independent
+    reviews and majority-voting the verdict outvotes a single bad judgment: the gate only
+    escalates to the blocking verdict when a strict majority agree; a split de-escalates to
+    the non-blocking "Concerns". ``samples=1`` reproduces today's single-review behavior, so
+    a strong cloud model is unaffected. Local sampling is cost-free — raise it (e.g. 3) there.
+    """
+
+    samples: int = 1
+
+
+class VerificationConfig(BaseModel):
+    sandbox: VerificationSandboxConfig = Field(default_factory=VerificationSandboxConfig)
+    diff_coverage: DiffCoverageConfig = Field(default_factory=DiffCoverageConfig)
+    acceptance_checks: AcceptanceCheckConfig = Field(default_factory=AcceptanceCheckConfig)
+    reviewer_checks: ReviewerCheckConfig = Field(default_factory=ReviewerCheckConfig)
+
+
 class GatesConfig(BaseModel):
     require_clean_git_before_task: bool = True
     block_orphan_diffs: bool = True
@@ -48,6 +142,23 @@ class ExecutionConfig(BaseModel):
     max_repair_attempts: int = 3
     checkpoint_before_each_task: bool = True
     command_timeout: int = 300
+    stream_cli_output: bool = False
+    # Default lifetime of an MCP task lease. A crashed/disconnected agent's lease
+    # auto-expires after this, so the task frees up without a human running force.
+    lease_ttl_seconds: int = 1800
+    # When true, the post-task coding-CLI hook runs deterministic verification of the
+    # active task (and records gaps) instead of only printing a reminder. Off by default
+    # so hooks stay fast/cheap unless a team opts in.
+    verify_on_post_task: bool = False
+    cursor_resume_mode: str = "off"
+    coding_cli_probe_order: List[str] = Field(default_factory=list)
+    # Opt-in scope gate for executors WITHOUT a pre-write hook (CLI subprocesses that write
+    # directly to disk). When true, DevCouncil re-checks every file a coding-CLI subprocess
+    # changed against the task's authorization right after it exits and REVERTS any the task
+    # did not allow — so unplanned drift never reaches the verify gate or a commit, instead
+    # of only being flagged post-verify by orphan_diff. Off by default (it reverts the
+    # agent's writes; teams opt in once their plans declare planned_files reliably).
+    enforce_file_scope_pre_verify: bool = False
 
 
 class PrivacyConfig(BaseModel):
@@ -75,10 +186,106 @@ class LiveReviewIntegrationConfig(BaseModel):
     default_client: str = "claude"
 
 
+class WarpIntegrationConfig(BaseModel):
+    enabled: bool = False
+    command: str = "oz"
+    run_mode: str = "local"
+    mcp_config_path: str = ".devcouncil/integrations/warp-mcp.json"
+    profile: str | None = None
+    model: str | None = None
+    environment: str | None = None
+    share: List[str] = Field(default_factory=list)
+
+
+class OpenCodeIntegrationConfig(BaseModel):
+    enabled: bool = False
+    config_path: str = "opencode.json"
+
+
+class AntigravityIntegrationConfig(BaseModel):
+    enabled: bool = False
+    mcp_config_path: str = ".agents/mcp_config.json"
+
+
+class CursorIntegrationConfig(BaseModel):
+    enabled: bool = False
+    config_path: str = ".cursor/mcp.json"
+    hooks_path: str = ".cursor/hooks.json"
+
+
+class AiderIntegrationConfig(BaseModel):
+    enabled: bool = False
+
+
+class CliAgentProfileConfig(BaseModel):
+    description: str = ""
+    timeout_seconds: int | None = None
+    prompt_preamble: str = ""
+    require_explicit_confirmation: bool = False
+    # Per-profile CLI containment overrides. Empty/None reproduce today's behavior
+    # exactly so a profile that only sets a prompt preamble is a no-op on the
+    # subprocess invocation. ``extra_args`` are appended verbatim to the resolved
+    # command, ``permission_mode`` is translated into the right per-CLI flag where
+    # known (and overly-permissive flags are dropped for stricter modes), and
+    # ``model`` overrides the model flag for CLIs that accept one.
+    extra_args: List[str] = Field(default_factory=list)
+    permission_mode: str | None = None
+    model: str | None = None
+
+
+class CustomCliAgentConfig(BaseModel):
+    command: str
+    args: List[str] = Field(default_factory=list)
+    input_mode: str = "stdin"
+    prompt_arg: str | None = None
+    timeout_seconds: int | None = None
+    env: Dict[str, str] = Field(default_factory=dict)
+    display_name: str | None = None
+    kind: str = "custom"
+    supports_mcp: bool = False
+    supports_diff_review: bool = False
+    default_profile: str = "default"
+    help_command: List[str] = Field(default_factory=list)
+
+
+class CliAgentsIntegrationConfig(BaseModel):
+    enabled: bool = True
+    profiles: Dict[str, CliAgentProfileConfig] = Field(default_factory=dict)
+    agents: Dict[str, CustomCliAgentConfig] = Field(default_factory=dict)
+
+
+class McpIntegrationConfig(BaseModel):
+    write_task_scope_to_config: bool = False
+
+
 class IntegrationsConfig(BaseModel):
+    mcp: McpIntegrationConfig = Field(default_factory=McpIntegrationConfig)
     agent_flow: AgentFlowIntegrationConfig = Field(default_factory=AgentFlowIntegrationConfig)
     code_review_graph: CodeReviewGraphIntegrationConfig = Field(default_factory=CodeReviewGraphIntegrationConfig)
     live_review: LiveReviewIntegrationConfig = Field(default_factory=LiveReviewIntegrationConfig)
+    cursor: CursorIntegrationConfig = Field(default_factory=CursorIntegrationConfig)
+    aider: AiderIntegrationConfig = Field(default_factory=AiderIntegrationConfig)
+    antigravity: AntigravityIntegrationConfig = Field(default_factory=AntigravityIntegrationConfig)
+    warp: WarpIntegrationConfig = Field(default_factory=WarpIntegrationConfig)
+    opencode: OpenCodeIntegrationConfig = Field(default_factory=OpenCodeIntegrationConfig)
+    cli_agents: CliAgentsIntegrationConfig = Field(default_factory=CliAgentsIntegrationConfig)
+
+
+class KnowledgeConfig(BaseModel):
+    """Ingested knowledge (Open Knowledge Format bundles + a project design.md) that gets
+    injected into planning/council/task prompts.
+
+    Sources live under ``<directory>/{okf,design}``. A design system is always selected
+    (``design_always``) because a coding agent should honor it on every UI task; OKF
+    knowledge is selected by goal keywords / document tags. The ``*_max_chars`` budgets
+    bound how much rides inline so a large knowledge base can't crowd out file context.
+    """
+
+    enabled: bool = True
+    directory: str = ".devcouncil/knowledge"
+    design_always: bool = True
+    okf_max_chars: int = 3000
+    design_max_chars: int = 4000
 
 
 class ProviderConfig(BaseModel):
@@ -97,42 +304,102 @@ class DevCouncilConfig(BaseModel):
     commands: CommandsConfig = Field(default_factory=CommandsConfig)
     gates: GatesConfig = Field(default_factory=GatesConfig)
     execution: ExecutionConfig = Field(default_factory=ExecutionConfig)
+    verification: VerificationConfig = Field(default_factory=VerificationConfig)
     privacy: PrivacyConfig = Field(default_factory=PrivacyConfig)
     integrations: IntegrationsConfig = Field(default_factory=IntegrationsConfig)
+    knowledge: KnowledgeConfig = Field(default_factory=KnowledgeConfig)
+
+
+# Memoized parsed configs keyed by resolved config path. Each entry stores the
+# file's stat signature (mtime_ns, size, inode) so a rewritten config.yaml — common in
+# tests that mutate config mid-process, including delete+recreate — is re-read instead
+# of served stale.
+_CONFIG_CACHE: Dict[Path, Tuple[Tuple[int, int, int], DevCouncilConfig]] = {}
 
 
 def load_config(project_root: Path = Path(".")) -> DevCouncilConfig:
     """Load and validate .devcouncil/config.yaml.
-    
+
     Returns DevCouncilConfig with defaults for any missing fields.
     Raises FileNotFoundError if config doesn't exist.
+
+    Parsed results are memoized per resolved config path and invalidated when the
+    file's mtime/size changes, so repeated callers avoid redundant disk reads while
+    still picking up a rewritten config.
     """
-    import yaml
+    import yaml  # type: ignore[import-untyped]
 
     config_path = project_root / ".devcouncil" / "config.yaml"
-    if not config_path.exists():
+    try:
+        stat = config_path.stat()
+    except FileNotFoundError:
         raise FileNotFoundError(f"Config not found at {config_path}. Run 'dev init' first.")
 
-    with open(config_path) as f:
-        raw = yaml.safe_load(f) or {}
-
-    return DevCouncilConfig.model_validate(raw)
+    cache_key = config_path.resolve()
+    # Include the inode so a delete+recreate under the same path (new inode) is treated
+    # as changed even if the rewritten file lands with the same mtime and size.
+    signature = (stat.st_mtime_ns, stat.st_size, stat.st_ino)
+    cached = _CONFIG_CACHE.get(cache_key)
+    if cached is not None and cached[0] == signature:
+        # The cached instance is shared across callers; treat it as read-only. Nothing
+        # in the codebase mutates a loaded DevCouncilConfig (settings are rewritten on
+        # disk via the raw-config helpers, then re-read), so we avoid a per-call copy.
+        return cached[1]
+
+    logger.debug("Loading config from %s", config_path)
+    with open(config_path, encoding="utf-8") as f:
+        try:
+            raw = yaml.safe_load(f) or {}
+        except yaml.YAMLError as exc:
+            logger.error("Invalid YAML in %s: %s", config_path, exc)
+            raise ValueError(
+                f"Invalid YAML in {config_path}: {exc}. Fix the syntax or re-run 'dev init'."
+            ) from exc
+
+    config = DevCouncilConfig.model_validate(raw)
+    _CONFIG_CACHE[cache_key] = (signature, config)
+    logger.debug("Config loaded: provider=%s", config.models.provider)
+    return config
 
 
 def provider_api_key_env_var(provider: str = "openrouter") -> str:
+    normalized = provider.strip().lower().replace("-", "").replace("_", "")
     env_map = {
         "openrouter": "OPENROUTER_API_KEY",
+        "vertexai": "VERTEXAI_ACCESS_TOKEN",
+        "doubleword": "DOUBLEWORD_API_KEY",
+        "ollama": "OLLAMA_API_KEY",
         "openai": "OPENAI_API_KEY",
         "anthropic": "ANTHROPIC_API_KEY",
     }
-    return env_map.get(provider, f"{provider.upper()}_API_KEY")
+    return env_map.get(normalized, f"{normalized.upper()}_API_KEY")
+
+
+def _normalized_provider_name(provider: str) -> str:
+    return provider.strip().lower().replace("-", "").replace("_", "")
+
+
+# Memoized parsed secrets keyed by resolved secrets path, with the same
+# stat-signature (mtime_ns, size) invalidation as load_config.
+_SECRETS_CACHE: Dict[Path, Tuple[Tuple[int, int, int], Dict[str, str]]] = {}
 
 
 def load_local_secrets(project_root: Path = Path(".")) -> Dict[str, str]:
     secrets_path = project_root / ".devcouncil" / "secrets.env"
-    if not secrets_path.exists():
+    try:
+        stat = secrets_path.stat()
+    except FileNotFoundError:
         return {}
 
+    cache_key = secrets_path.resolve()
+    # Include the inode so a delete+recreate under the same path (new inode) is treated
+    # as changed even if the rewritten file lands with the same mtime and size.
+    signature = (stat.st_mtime_ns, stat.st_size, stat.st_ino)
+    cached = _SECRETS_CACHE.get(cache_key)
+    if cached is not None and cached[0] == signature:
+        # Copy so callers can't mutate the cached mapping.
+        return dict(cached[1])
+
     secrets: Dict[str, str] = {}
     for line in secrets_path.read_text(encoding="utf-8").splitlines():
         stripped = line.strip()
@@ -140,9 +407,66 @@ def load_local_secrets(project_root: Path = Path(".")) -> Dict[str, str]:
             continue
         key, value = stripped.split("=", 1)
         secrets[key.strip()] = value.strip().strip('"').strip("'")
+    _SECRETS_CACHE[cache_key] = (signature, dict(secrets))
     return secrets
 
 
+def get_gcloud_access_token() -> str | None:
+    """Fetch a fresh gcloud access token by shelling out to ``gcloud``.
+
+    This always spawns the subprocess (no caching) so callers that need a guaranteed
+    fresh token — e.g. the Vertex provider refreshing after a 401/403 — get one. For
+    the hot path (per-provider-construction key lookups) use
+    :func:`get_cached_gcloud_access_token`, which memoizes the result with a TTL.
+    """
+    executable = shutil.which("gcloud")
+    if not executable:
+        return None
+    try:
+        token = subprocess.check_output(
+            [executable, "auth", "print-access-token"],
+            stderr=subprocess.STDOUT,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=10,
+        ).strip()
+    except Exception:
+        return None
+    return token or None
+
+
+# Cached gcloud access token + monotonic expiry. gcloud tokens last ~60 min, so the
+# hot path (a fresh provider per role/run calling get_api_key) reuses a fetched token
+# for a conservative window instead of spawning ``gcloud auth print-access-token`` on
+# every lookup. A single gcloud identity is assumed, so no cache key is needed. A
+# failed fetch (None) is never cached.
+_GCLOUD_TOKEN_TTL_SECONDS = 50 * 60
+_gcloud_token_cache: Optional[Tuple[str, float]] = None
+
+
+def get_cached_gcloud_access_token() -> str | None:
+    """Return a gcloud access token, reusing a recent one within the TTL window.
+
+    Falls back to :func:`get_gcloud_access_token` on a cache miss/expiry. ``gcloud``
+    absence is checked first so an environment without gcloud short-circuits to None
+    without ever consulting the cache (preserving the uncached error/None behavior).
+    """
+    global _gcloud_token_cache
+
+    if shutil.which("gcloud") is None:
+        return None
+
+    cached = _gcloud_token_cache
+    if cached is not None and time.monotonic() < cached[1]:
+        return cached[0]
+
+    token = get_gcloud_access_token()
+    if token:
+        _gcloud_token_cache = (token, time.monotonic() + _GCLOUD_TOKEN_TTL_SECONDS)
+    return token
+
+
 def get_api_key(provider: str = "openrouter", project_root: Path = Path(".")) -> str:
     """Retrieve the API key for the configured provider from environment.
     
@@ -150,9 +474,21 @@ def get_api_key(provider: str = "openrouter", project_root: Path = Path(".")) ->
     """
     env_var = provider_api_key_env_var(provider)
     key = os.environ.get(env_var) or load_local_secrets(project_root).get(env_var)
+    if not key and _normalized_provider_name(provider) == "vertexai":
+        key = get_cached_gcloud_access_token()
+    if not key and _normalized_provider_name(provider) == "ollama":
+        # Ollama is a local server and needs no API key; an explicitly-set
+        # OLLAMA_API_KEY still flows through above if present.
+        return ""
     if not key:
+        logger.warning("API key not found for provider %s (env var %s)", provider, env_var)
+        extra = (
+            " You can also authenticate with 'gcloud auth login' for vertexai."
+            if _normalized_provider_name(provider) == "vertexai"
+            else ""
+        )
         raise ValueError(
             f"API key not found. Set {env_var} in your environment or run 'dev setup'. "
-            f"Provider: {provider}"
+            f"Provider: {provider}.{extra}"
         )
     return key

package/src/devcouncil/app/orchestrator.py

@@ -18,9 +18,13 @@ class Orchestrator:
         self.project_root = project_root
         self.persist_state = persist_state
         
-        db = get_db(self.project_root)
-        if db:
-            with db.get_session() as session:
+        # Cache the Database handle once: get_db() rebuilds the SQLAlchemy engine
+        # and runs a schema check on every call, and transition_to() is invoked
+        # several times per run. The handle is reusable, so build it here and
+        # reuse it everywhere in this orchestrator instance.
+        self.db = get_db(self.project_root)
+        if self.db:
+            with self.db.get_session() as session:
                 repo = StateRepository(session)
                 state = repo.get_state()
                 if state:
@@ -45,6 +49,7 @@ class Orchestrator:
             goal=goal
         )
         self.current_run.initialize()
+        logger.info("Run started: run_id=%s goal=%r", run_id, goal)
         TraceLogger(self.project_root).log_event(
             "planning_started",
             {"goal": goal},
@@ -60,9 +65,8 @@ class Orchestrator:
         old_phase = self.state_machine.phase
         self.state_machine.transition(target_phase)
         
-        db = get_db(self.project_root)
-        if db and self.persist_state:
-            with db.get_session() as session:
+        if self.db and self.persist_state:
+            with self.db.get_session() as session:
                 repo = StateRepository(session)
                 repo.save_state(
                     self.state_machine.phase.value,

package/src/devcouncil/app/state_machine.py

@@ -9,9 +9,12 @@ States (from §12):
 
 from __future__ import annotations
 
+import logging
 from enum import Enum
 from typing import Dict, List, Set
 
+logger = logging.getLogger(__name__)
+
 
 
 class ProjectPhase(str, Enum):
@@ -99,6 +102,7 @@ class StateMachine:
         Raises InvalidTransitionError if the transition is not allowed.
         """
         if not self.can_transition(target):
+            logger.error("Invalid phase transition: %s -> %s", self._phase.value, target.value)
             raise InvalidTransitionError(self._phase, target)
         self._phase = target
         self._history.append(target)

package/src/devcouncil/artifacts/graph.py

@@ -18,7 +18,7 @@ from typing import Any, Dict, List, Set, Tuple
 from devcouncil.domain.requirement import Requirement, AcceptanceCriterion
 from devcouncil.domain.task import Task
 from devcouncil.domain.assumption import Assumption
-from devcouncil.domain.evidence import CommandResult, DiffEvidence, TestEvidence
+from devcouncil.domain.evidence import CommandResult, DiffCoverageEvidence, DiffEvidence, TestEvidence
 from devcouncil.domain.gap import Gap
 from devcouncil.domain.critique import CritiqueFinding
 
@@ -35,6 +35,7 @@ class ArtifactGraph:
     test_evidence: List[TestEvidence] = field(default_factory=list)
     diff_evidence: List[DiffEvidence] = field(default_factory=list)
     command_results: List[CommandResult] = field(default_factory=list)
+    diff_coverage_evidence: List[DiffCoverageEvidence] = field(default_factory=list)
 
     # --- Mutation ---
 
@@ -62,6 +63,17 @@ class ArtifactGraph:
     def add_command_result(self, cr: CommandResult) -> None:
         self.command_results.append(cr)
 
+    def add_diff_coverage_evidence(self, ev: DiffCoverageEvidence) -> None:
+        self.diff_coverage_evidence.append(ev)
+
+    def diff_coverage_findings(self) -> List[DiffCoverageEvidence]:
+        """Measured diff-coverage runs where the changed lines were NOT fully exercised
+        — i.e. a green suite that did not actually run the new code."""
+        return [
+            ev for ev in self.diff_coverage_evidence
+            if ev.measured and ev.changed_lines and ev.covered_lines < ev.changed_lines
+        ]
+
     # --- Coverage Queries ---
 
     def requirements_without_tasks(self) -> List[Requirement]:
@@ -80,10 +92,16 @@ class ArtifactGraph:
         return [r for r in self.requirements.values() if not r.acceptance_criteria]
 
     def acceptance_criteria_without_evidence(self) -> List[Tuple[str, AcceptanceCriterion]]:
-        """AC IDs that have no test evidence mapped to them."""
+        """AC IDs that have no *passing* test evidence mapped to them.
+
+        Only ``passed`` evidence counts: a failed or not-run check is not proof, so
+        it must not remove a criterion from the unproven list (which would feed a
+        falsely-green coverage summary to ``dev status`` and the MCP surface).
+        """
         evidenced_ac_ids: Set[str] = set()
         for ev in self.test_evidence:
-            evidenced_ac_ids.add(ev.acceptance_criterion_id)
+            if getattr(ev, "status", "passed") == "passed":
+                evidenced_ac_ids.add(ev.acceptance_criterion_id)
 
         results: List[Tuple[str, AcceptanceCriterion]] = []
         for req in self.requirements.values():
@@ -126,6 +144,13 @@ class ArtifactGraph:
 
     def coverage_summary(self) -> Dict[str, Any]:
         """Produce a coverage summary for reporting."""
+        # Single pass over open findings; the "high"-filtered count reuses the same
+        # severity_order/rank predicate as open_findings("high") (rank >= 2).
+        all_open = self.open_findings()
+        severity_order = {"low": 0, "medium": 1, "high": 2, "critical": 3}
+        high_critical_open = sum(
+            1 for f in all_open if severity_order.get(f.severity, 0) >= severity_order["high"]
+        )
         return {
             "total_requirements": len(self.requirements),
             "requirements_without_tasks": len(self.requirements_without_tasks()),
@@ -137,7 +162,9 @@ class ArtifactGraph:
             "ac_without_evidence": len(self.acceptance_criteria_without_evidence()),
             "total_gaps": len(self.gaps),
             "blocking_gaps": len(self.blocking_gaps()),
-            "open_findings": len(self.open_findings()),
-            "high_critical_open_findings": len(self.open_findings("high")),
+            "diff_coverage_runs": len(self.diff_coverage_evidence),
+            "unexercised_diff_findings": len(self.diff_coverage_findings()),
+            "open_findings": len(all_open),
+            "high_critical_open_findings": high_critical_open,
             "unconfirmed_high_assumptions": len(self.unconfirmed_high_impact_assumptions()),
         }

package/src/devcouncil/assets/__init__.py

@@ -0,0 +1 @@
+"""Packaged visual assets for DevCouncil."""

package/src/devcouncil/assets/devcouncil-logo.svg

@@ -0,0 +1,60 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 500 500" width="100%" height="100%">
+  <defs>
+    <linearGradient id="bgGrad" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#1a0000" />
+      <stop offset="100%" stop-color="#000000" />
+    </linearGradient>
+    <linearGradient id="redGlow" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#ff3333" />
+      <stop offset="100%" stop-color="#990000" />
+    </linearGradient>
+    <filter id="glow" x="-20%" y="-20%" width="140%" height="140%">
+      <feGaussianBlur stdDeviation="10" result="blur" />
+      <feComposite in="SourceGraphic" in2="blur" operator="over" />
+    </filter>
+  </defs>
+  
+  <rect width="500" height="500" fill="transparent" />
+  
+  <g transform="translate(250, 250)">
+    <!-- Outer wireframe hexagon representing the bounds of the orchestrator -->
+    <polygon points="0,-180 155.88,-90 155.88,90 0,180 -155.88,90 -155.88,-90" 
+             fill="none" stroke="#330000" stroke-width="8" stroke-linejoin="round" />
+             
+    <!-- Inner geometric structure - Top Face -->
+    <polygon points="0,-180 155.88,-90 0,0 -155.88,-90" fill="#0d0000" stroke="#ff0000" stroke-width="2" />
+    
+    <!-- Inner geometric structure - Right Face -->
+    <polygon points="0,0 155.88,-90 155.88,90 0,180" fill="#000000" stroke="#cc0000" stroke-width="2" />
+    
+    <!-- Inner geometric structure - Left Face -->
+    <polygon points="0,0 0,180 -155.88,90 -155.88,-90" fill="#1a0000" stroke="#ff3333" stroke-width="2" />
+    
+    <!-- The glowing core node (3D Isometric) -->
+    <!-- Top core face -->
+    <polygon points="0,-80 69.28,-40 0,0 -69.28,-40" fill="#ff4d4d" />
+    
+    <!-- Right core face -->
+    <polygon points="0,0 69.28,-40 69.28,40 0,80" fill="#b30000" />
+    
+    <!-- Left core face -->
+    <polygon points="0,0 0,80 -69.28,40 -69.28,-40" fill="#800000" />
+    
+    <!-- Power lines radiating from the core -->
+    <line x1="0" y1="-80" x2="0" y2="-180" stroke="#ff0000" stroke-width="4" filter="url(#glow)" />
+    <line x1="69.28" y1="40" x2="155.88" y2="90" stroke="#ff0000" stroke-width="4" filter="url(#glow)" />
+    <line x1="-69.28" y1="40" x2="-155.88" y2="90" stroke="#ff0000" stroke-width="4" filter="url(#glow)" />
+    
+    <line x1="0" y1="80" x2="0" y2="180" stroke="#ff0000" stroke-width="2" stroke-dasharray="5,5" />
+    <line x1="-69.28" y1="-40" x2="-155.88" y2="-90" stroke="#ff0000" stroke-width="2" stroke-dasharray="5,5" />
+    <line x1="69.28" y1="-40" x2="155.88" y2="-90" stroke="#ff0000" stroke-width="2" stroke-dasharray="5,5" />
+    
+    <!-- Terminal connection dots -->
+    <circle cx="0" cy="-180" r="8" fill="#ff3333" filter="url(#glow)" />
+    <circle cx="155.88" cy="90" r="8" fill="#ff3333" filter="url(#glow)" />
+    <circle cx="-155.88" cy="90" r="8" fill="#ff3333" filter="url(#glow)" />
+    <circle cx="0" cy="180" r="5" fill="#800000" />
+    <circle cx="-155.88" cy="-90" r="5" fill="#800000" />
+    <circle cx="155.88" cy="-90" r="5" fill="#800000" />
+  </g>
+</svg>