devcouncil 0.3.1 → 0.4.0

package/src/devcouncil/app/config.py

@@ -11,9 +11,10 @@ import shutil
 import subprocess
 import time
 from pathlib import Path
-from typing import Dict, List, Optional, Tuple
+from typing import Dict, List, Literal, Optional, Tuple
 
-from pydantic import BaseModel, Field, field_validator
+from annotated_types import Ge, Le
+from pydantic import BaseModel, Field, field_validator, model_validator
 
 logger = logging.getLogger(__name__)
 
@@ -95,16 +96,65 @@ class AcceptanceCheckConfig(BaseModel):
       stays unproven with a non-blocking advisory). Local sampling is cost-free, so
       raising this (e.g. 3) outvotes a single mis-generated check without ever
       auto-passing a real defect. ``1`` reproduces today's single-check behavior.
+
+    Every knob is OPTIONAL (``None`` = auto). Auto resolves by where the monitor
+    role actually runs — see :meth:`resolved`: a cost-free local (Ollama) monitor
+    gets the calibration-friendly settings this class documents (``samples=3``,
+    ``repair_attempts=2``, ``per_criterion=True``); a paid cloud monitor keeps the
+    single-shot behavior. Setting a value explicitly always wins over auto.
     """
 
-    samples: int = 1
-    repair_attempts: int = 1
+    samples: int | None = None
+    repair_attempts: int | None = None
     # Compile one criterion per model call instead of batching them all into a single
     # prompt. A weak/local model batching N criteria into one JSON routinely omits or
     # mis-attributes some (a false "incomplete"); a focused single-criterion prompt is far
-    # more reliable. Costs N× the calls — cheap on a local monitor, so opt-in. Off keeps
-    # the single batched call.
-    per_criterion: bool = False
+    # more reliable. Costs N× the calls — cheap on a local monitor, so auto-on there.
+    per_criterion: bool | None = None
+
+    # (samples, repair_attempts, per_criterion)
+    _CLOUD_DEFAULTS = (1, 1, False)
+    _LOCAL_DEFAULTS = (3, 2, True)
+
+    def resolved(self, local_monitor: bool) -> tuple[int, int, bool]:
+        """Concrete (samples, repair_attempts, per_criterion) with auto defaults."""
+        d_samples, d_repairs, d_per_criterion = (
+            self._LOCAL_DEFAULTS if local_monitor else self._CLOUD_DEFAULTS
+        )
+        return (
+            max(1, self.samples if self.samples is not None else d_samples),
+            max(0, self.repair_attempts if self.repair_attempts is not None else d_repairs),
+            self.per_criterion if self.per_criterion is not None else d_per_criterion,
+        )
+
+    def unsafe_override_warnings(self, local_monitor: bool) -> list[str]:
+        """Explicit overrides that disable the ensembling a LOCAL monitor needs.
+
+        Auto-resolution already picks safe local defaults; these warnings fire only
+        when a user has EXPLICITLY configured the settings calibration probes showed
+        to be unsafe on a local monitor (2026-07-03, Ornith-35B: ``samples=1``
+        rubber-stamped 1/6 buggy criteria as passing; ``samples=3`` +
+        ``per_criterion`` caught 6/6 with zero false passes). The config is honored
+        — explicit always wins — but never silently."""
+        if not local_monitor:
+            return []
+        warnings: list[str] = []
+        samples, _, per_criterion = self.resolved(local_monitor)
+        if self.samples is not None and samples < 3:
+            warnings.append(
+                f"verification.acceptance_checks.samples={samples} with a LOCAL monitor: "
+                "single/low-sample acceptance checks on a local model have rubber-stamped "
+                "real defects in calibration probes. Recommend samples>=3 (local sampling "
+                "is cost-free) or removing the override to use the auto default."
+            )
+        if self.per_criterion is False:
+            warnings.append(
+                "verification.acceptance_checks.per_criterion=false with a LOCAL monitor: "
+                "batched compilation on a local model routinely drops or mis-attributes "
+                "criteria (false 'incomplete'). Recommend per_criterion=true or removing "
+                "the override to use the auto default."
+            )
+        return warnings
 
 
 class ReviewerCheckConfig(BaseModel):
@@ -116,9 +166,107 @@ class ReviewerCheckConfig(BaseModel):
     escalates to the blocking verdict when a strict majority agree; a split de-escalates to
     the non-blocking "Concerns". ``samples=1`` reproduces today's single-review behavior, so
     a strong cloud model is unaffected. Local sampling is cost-free — raise it (e.g. 3) there.
+
+    ``samples`` is OPTIONAL (``None`` = auto): a local (Ollama) reviewer auto-resolves
+    to 3 votes, a cloud reviewer to 1. An explicit value always wins over auto.
     """
 
-    samples: int = 1
+    samples: int | None = None
+
+    def resolved(self, local_reviewer: bool) -> int:
+        """Concrete sample count with the local/cloud auto default."""
+        if self.samples is not None:
+            return max(1, self.samples)
+        return 3 if local_reviewer else 1
+
+    def unsafe_override_warnings(self, local_reviewer: bool) -> list[str]:
+        """Explicit single-shot voting on a LOCAL reviewer — honored, never silent.
+
+        A lone local review can emit a mis-calibrated blocking verdict; voting over
+        >=3 samples is what de-escalates that (see class docstring)."""
+        if not local_reviewer or self.samples is None:
+            return []
+        resolved = self.resolved(local_reviewer)
+        if resolved >= 3:
+            return []
+        return [
+            f"verification.reviewer_checks.samples={resolved} with a LOCAL reviewer: a "
+            "single local review can falsely BLOCK on one mis-calibrated verdict. "
+            "Recommend samples>=3 (local sampling is cost-free) or removing the override."
+        ]
+
+
+class RigorConfig(BaseModel):
+    """Anti-laziness enforcement policy, scaled by task difficulty.
+
+    The stub/effort gates always *run* (unless ``never``); the mode decides when
+    their findings BLOCK: ``hard`` (default) blocks only on tasks classified hard
+    by ``devcouncil.verification.difficulty`` (or a manual ``Task.difficulty``),
+    ``always`` blocks everywhere, ``never`` disables the gate entirely. The
+    remaining knobs escalate existing machinery on hard tasks: coverage
+    enforcement flips ``diff_not_exercised`` to blocking, ``reviewer_required``
+    lets a critical implementation-review finding block (normally advisory), and
+    ``extra_repair_attempts_on_hard`` widens the `dev go` self-repair budget.
+    """
+
+    enabled: bool = True
+    stub_detection: str = "hard"      # never | hard | always
+    effort_heuristics: str = "hard"   # never | hard | always
+    # When coarse fallback proves an AC (passing command, not per-criterion check):
+    # advisory on easy/normal; blocking on hard by default.
+    coarse_acceptance_proof: str = "hard"  # never | hard | always
+    enforce_coverage_on_hard: bool = True
+    reviewer_required_on_hard: bool = False
+    extra_repair_attempts_on_hard: int = 1
+    # Undersized-diff threshold: added CODE lines must reach this many per planned
+    # writable file (only checked when the scope is substantial — >=3 writable
+    # files or any file creation).
+    min_added_lines_per_planned_file: int = 5
+    # On hard tasks, compile at least this many independent acceptance checks per
+    # criterion (input variation) so agents cannot hardcode a single probe value.
+    acceptance_samples_on_hard: int = 2
+    # New files/symbols never imported or referenced: advisory on easy/normal,
+    # blocking on hard by default (same posture as placeholder/effort gates).
+    unwired_files: str = "hard"   # never | hard | always
+    dead_symbols: str = "hard"    # never | hard | always
+    # Existing code newly stranded vs checkout baseline (lost last importer/caller).
+    liveness_ratchet: str = "hard"  # never | hard | always
+    # On-disk repo_map.json lags git HEAD / tracked file set: advisory on easy/normal,
+    # blocking on hard by default.
+    stale_map: str = "hard"  # never | hard | always
+    corpus_stale: str = "soft"  # never | soft | hard | always
+    doc_code_ref: str = "soft"  # never | soft | hard | always
+    acceptance_corpus: str = "soft"  # never | soft | hard | always
+
+
+class SubsystemBoundaryConfig(BaseModel):
+    """Advisory architecture-drift gate over the mapped subsystem graph.
+
+    Flags a change that edits files in two subsystems the repo map does NOT consider
+    neighbors, when the crossing was not declared in the task plan — a signal that an
+    edit is reaching across an architectural boundary it shouldn't. Advisory
+    (non-blocking) by default: set ``blocking`` to make an undeclared crossing block
+    verification. Needs a fresh ``repo_map.json`` with ``subsystems``/``neighbors`` to
+    have anything to check; degrades to a no-op otherwise.
+    """
+
+    enabled: bool = True
+    blocking: bool = False
+
+
+class WikiRefreshConfig(BaseModel):
+    """Post-verify wiki-freshness trigger for large refactors.
+
+    When a verified change spans at least ``min_subsystems`` subsystem areas OR touches
+    at least ``min_files`` files, the codebase wiki is likely stale. By default this
+    only FLAGS the stale pages (cheap, no model calls). Set ``auto_update`` to actually
+    run ``dev wiki update --no-llm`` as a post-step. Best-effort and never blocks.
+    """
+
+    enabled: bool = True
+    min_subsystems: int = 3
+    min_files: int = 8
+    auto_update: bool = False
 
 
 class VerificationConfig(BaseModel):
@@ -126,6 +274,16 @@ class VerificationConfig(BaseModel):
     diff_coverage: DiffCoverageConfig = Field(default_factory=DiffCoverageConfig)
     acceptance_checks: AcceptanceCheckConfig = Field(default_factory=AcceptanceCheckConfig)
     reviewer_checks: ReviewerCheckConfig = Field(default_factory=ReviewerCheckConfig)
+    rigor: RigorConfig = Field(default_factory=RigorConfig)
+    subsystem_boundary: SubsystemBoundaryConfig = Field(default_factory=SubsystemBoundaryConfig)
+    wiki_refresh: WikiRefreshConfig = Field(default_factory=WikiRefreshConfig)
+    # Flaky-evidence retry: when an acceptance-capable verification command (planner
+    # expected_tests / config commands) genuinely fails, re-run it ONCE. If the re-run
+    # passes, the command counts as passed and its stored summary is tagged
+    # "[flaky: passed on retry 2/2]" so next-actions/reports can tell flaky from
+    # broken. Never applies to compiled per-criterion checks (they have their own
+    # repair/vote loop) or to diff-coverage instrumentation runs.
+    retry_flaky: bool = True
 
 
 class GatesConfig(BaseModel):
@@ -137,20 +295,149 @@ class GatesConfig(BaseModel):
     block_failed_commands: bool = True
 
 
+class PlanningConfig(BaseModel):
+    # In non-interactive flows (stdin not a TTY), unanswered blocking questions from
+    # spec_writer are converted to open assumptions so plan approval does not stall.
+    auto_convert_blocking_questions_in_noninteractive: bool = True
+
+
+class CorpusConfig(BaseModel):
+    """Advisory mixed-corpus side index (docs, PDFs, images)."""
+
+    enabled: bool = True
+    paths: List[str] = Field(default_factory=lambda: ["docs", "README.md"])
+    llm_enrichment: bool = False
+    vision_captions: bool = False
+    write_html: bool = False
+    auto_refresh_on_verify: bool = True
+
+
+class EmbeddingsConfig(BaseModel):
+    """Opt-in local symbol embeddings for semantic graph search."""
+
+    enabled: bool = False
+    model_name: str = "hash-v1"
+
+
+class IndexingConfig(BaseModel):
+    """Repo-map / symbol-index enhancements.
+
+    ``lsp_refs`` opts into spawning detected language servers (pyright, tsserver,
+    gopls, rust-analyzer) for dead-symbol confirmation and precise MCP impact.
+    Off by default — process cost and server variance make this opt-in only.
+
+    ``auto_refresh`` enables best-effort incremental map refresh from the
+    post-tool-use hook after agent file edits (never blocks the agent on failure).
+    ``auto_refresh_max_files`` skips refresh when a single hook reports more
+    changed paths than this guard (large refactors should run ``dev map``).
+
+    ``write_graph_html`` writes the interactive graph visualizer alongside the
+    code graph during ``dev map`` (off by default — HTML can be large).
+    """
+
+    lsp_refs: bool = False
+    auto_refresh: bool = True
+    auto_refresh_max_files: int = 40
+    # Serialized liveness debt is bounded independently from the uncapped graph.
+    # The defaults support large repositories while the validation ceilings prevent
+    # accidental multi-hundred-megabyte repo_map.json artifacts.
+    repo_map_liveness_cap: int = Field(default=20_000, ge=1, le=100_000)
+    repo_map_unwired_cap: int = Field(default=5_000, ge=1, le=100_000)
+    repo_map_dependents_cap: int = Field(default=1_024, ge=1, le=4_096)
+    # When true, ``dev map`` also writes ``.devcouncil/graph/graph.html``.
+    write_graph_html: bool = False
+    # Compact (indent=None) compatibility export for ``code_graph.json`` (default on).
+    # SQLite remains the canonical store; JSON is a size-sensitive export boundary.
+    compact_graph_json: bool = True
+    build_isolation: Literal["hybrid"] = "hybrid"
+    build_stall_timeout_seconds: float = Field(default=90.0, gt=0.0, le=3600.0)
+    build_total_timeout_seconds: float = Field(default=900.0, gt=0.0, le=86400.0)
+    # Wall-clock bound for semantic edge enrichment during graph assembly; on
+    # expiry enrichment keeps partial results (meta.semantic_enrich_partial)
+    # instead of hanging on very large repos.
+    semantic_enrich_timeout_seconds: float = Field(default=120.0, gt=0.0, le=3600.0)
+    graph_json_max_bytes: int = Field(
+        default=128 * 1024 * 1024,
+        ge=1024 * 1024,
+        le=2 * 1024 * 1024 * 1024,
+    )
+    # When unreachable_files / liveness code-file count exceeds this ratio,
+    # treat unreachable BFS as unreliable (static-analysis blind spots) and
+    # omit the flood. ``0`` disables the ratio check. Empty entry roots still
+    # fail-soft independently.
+    unreachable_unreliable_ratio: float = Field(default=0.25, ge=0.0, le=1.0)
+    entry_roots: List[str] = Field(default_factory=list)
+    corpus: CorpusConfig = Field(default_factory=CorpusConfig)
+    embeddings: EmbeddingsConfig = Field(default_factory=EmbeddingsConfig)
+
+    @model_validator(mode="after")
+    def _validate_build_timeouts(self) -> "IndexingConfig":
+        if self.build_total_timeout_seconds < self.build_stall_timeout_seconds:
+            raise ValueError(
+                "build_total_timeout_seconds must be at least build_stall_timeout_seconds"
+            )
+        return self
+
+
+class CodeIntelligenceDebugConfig(BaseModel):
+    """Debugger discovery/execution consent and output safety."""
+
+    auto_discover: bool = False
+    redact_values: bool = True
+    max_value_chars: int = 4096
+
+
+class CodeIntelligenceConfig(BaseModel):
+    """Transactional code graph, native synchronization, and debugger settings."""
+
+    enabled: bool = True
+    auto_sync: bool = True
+    debounce_ms: int = 750
+    reconcile_seconds: int = 60
+    query_freshness_timeout_ms: int = 2000
+    allow_polling_fallback: bool = True
+    # Bounded wait when acquiring ``writer.lock`` for full/isolated builds and when
+    # re-acquiring after yielding to a supervised child. Concurrent watchers retry
+    # with exponential backoff instead of failing the first busy probe.
+    writer_lease_timeout_seconds: float = Field(default=30.0, gt=0.0, le=600.0)
+    # Shorter wait for ``sync_now`` / watchers so MCP freshness probes stay snappy;
+    # pending paths remain queued when the lease stays busy past this budget.
+    writer_lease_sync_timeout_seconds: float = Field(default=5.0, gt=0.0, le=120.0)
+    debug: CodeIntelligenceDebugConfig = Field(default_factory=CodeIntelligenceDebugConfig)
+
+
+class StopGateConfig(BaseModel):
+    """Unified Stop / SubagentStop gate (claim checks + active-task verify).
+
+    ``mode``: ``off`` disables the gate; ``assist`` surfaces failures in
+    ``systemMessage`` but allows stop; ``block`` reinjects corrective JSON.
+    """
+
+    mode: str = "off"
+    check_claims: bool = True
+    verify_active_task: bool = True
+    max_blocks: int = 2
+    per_command_timeout: int = 90
+    total_timeout: int = 120
+    notify_on_pass: bool = False
+    verify_cache_minutes: int = 5
+
+
 class ExecutionConfig(BaseModel):
     default_executor: str = "manual"
     max_repair_attempts: int = 3
     checkpoint_before_each_task: bool = True
-    command_timeout: int = 300
+    command_timeout: int = 900
     stream_cli_output: bool = False
     # Default lifetime of an MCP task lease. A crashed/disconnected agent's lease
     # auto-expires after this, so the task frees up without a human running force.
     lease_ttl_seconds: int = 1800
-    # When true, the post-task coding-CLI hook runs deterministic verification of the
-    # active task (and records gaps) instead of only printing a reminder. Off by default
-    # so hooks stay fast/cheap unless a team opts in.
+    stop_gate: StopGateConfig = Field(default_factory=StopGateConfig)
+    # Deprecated alias: true iff stop_gate.mode != off and verify_active_task.
+    # Migrated in load_config; kept for hook compatibility.
     verify_on_post_task: bool = False
     cursor_resume_mode: str = "off"
+    grok_resume_mode: str = "off"
     coding_cli_probe_order: List[str] = Field(default_factory=list)
     # Opt-in scope gate for executors WITHOUT a pre-write hook (CLI subprocesses that write
     # directly to disk). When true, DevCouncil re-checks every file a coding-CLI subprocess
@@ -159,6 +446,21 @@ class ExecutionConfig(BaseModel):
     # of only being flagged post-verify by orphan_diff. Off by default (it reverts the
     # agent's writes; teams opt in once their plans declare planned_files reliably).
     enforce_file_scope_pre_verify: bool = False
+    # Retries when a coding-CLI subprocess fails with a TRANSIENT network/provider
+    # error ("Connection closed mid-response", 429/5xx, overloaded). Such a failure
+    # says nothing about the task; without a retry it ends the task `blocked` and
+    # burns a repair attempt on a non-code problem. 0 disables the retry.
+    transient_retry_attempts: int = 2
+    # At task checkout, regenerate ``.devcouncil/repo_map.json`` when it is stale
+    # (HEAD / file-set fingerprint mismatch) before the prompt and liveness baseline
+    # are built. Disable to keep checkout cheap on huge repos where remap is costly.
+    refresh_stale_map_on_checkout: bool = True
+    refresh_stale_map_on_verify: bool = True
+    # UserPromptSubmit skips the status line when a compact briefing was injected
+    # within this many seconds (0 disables dedupe).
+    skip_prompt_status_after_compact_seconds: int = 60
+    # PreCompact emits a user-only systemMessage when the disk snapshot is saved.
+    compact_snapshot_toast: bool = True
 
 
 class PrivacyConfig(BaseModel):
@@ -167,6 +469,19 @@ class PrivacyConfig(BaseModel):
     store_prompts_locally: bool = True
 
 
+class TelemetryConfig(BaseModel):
+    """Knobs for the local cost/usage telemetry (ledger lives under .devcouncil/logs/).
+
+    ``cost_budget_usd`` is an advisory spend budget in USD for cumulative model-call
+    cost. ``None`` (default) disables budgeting. WARN-ONLY by design: crossing the
+    budget emits a ``logger.warning`` when usage is recorded and is surfaced by
+    ``dev cost budget``, but it never blocks a run. Set/cleared via
+    ``dev cost budget --set X`` / ``dev cost budget --clear``.
+    """
+
+    cost_budget_usd: float | None = Field(default=None, ge=0.0)
+
+
 class AgentFlowIntegrationConfig(BaseModel):
     enabled: bool = False
     trace_path: str = ".devcouncil/logs/traces.jsonl"
@@ -211,12 +526,25 @@ class CursorIntegrationConfig(BaseModel):
     enabled: bool = False
     config_path: str = ".cursor/mcp.json"
     hooks_path: str = ".cursor/hooks.json"
+    headless_force: bool | None = None
+
+
+class GrokIntegrationConfig(BaseModel):
+    enabled: bool = False
+    config_path: str = ".grok/config.toml"
 
 
 class AiderIntegrationConfig(BaseModel):
     enabled: bool = False
 
 
+class ClaudeIntegrationConfig(BaseModel):
+    enabled: bool = False
+    scope: str = "local"
+    write_gate: bool = False
+    settings_path: str = ".claude/settings.local.json"
+
+
 class CliAgentProfileConfig(BaseModel):
     description: str = ""
     timeout_seconds: int | None = None
@@ -231,6 +559,20 @@ class CliAgentProfileConfig(BaseModel):
     extra_args: List[str] = Field(default_factory=list)
     permission_mode: str | None = None
     model: str | None = None
+    # Claude Code only: enable Anthropic's advisor server tool via ``--advisor`` /
+    # SDK ``extra_args={"advisor": ...}`` / interactive ``advisorModel``. Opt-in;
+    # recommended pairing is main ``sonnet`` + ``advisor_model: opus``. Ignored for
+    # non-Claude executors. Requires Claude Code >= 2.1.98 and the Anthropic API.
+    advisor_model: str | None = None
+    # Per-profile environment overrides merged into the agent subprocess (and passed to
+    # the in-process claude-sdk executor). This is how a profile redirects the Claude
+    # Code harness at an alternative Anthropic-compatible endpoint (local proxy,
+    # LiteLLM-fronted Ollama, OpenRouter, ...) without touching the base agent spec:
+    #   env: {ANTHROPIC_BASE_URL: "http://127.0.0.1:4000", ANTHROPIC_AUTH_TOKEN: "..."}
+    # Values may hold secrets: manifests/logs record only the KEY NAMES, never values.
+    # DevCouncil's own variables (DEVCOUNCIL_*) are applied after these and cannot be
+    # masked by a profile.
+    env: Dict[str, str] = Field(default_factory=dict)
 
 
 class CustomCliAgentConfig(BaseModel):
@@ -263,7 +605,9 @@ class IntegrationsConfig(BaseModel):
     agent_flow: AgentFlowIntegrationConfig = Field(default_factory=AgentFlowIntegrationConfig)
     code_review_graph: CodeReviewGraphIntegrationConfig = Field(default_factory=CodeReviewGraphIntegrationConfig)
     live_review: LiveReviewIntegrationConfig = Field(default_factory=LiveReviewIntegrationConfig)
+    claude: ClaudeIntegrationConfig = Field(default_factory=ClaudeIntegrationConfig)
     cursor: CursorIntegrationConfig = Field(default_factory=CursorIntegrationConfig)
+    grok: GrokIntegrationConfig = Field(default_factory=GrokIntegrationConfig)
     aider: AiderIntegrationConfig = Field(default_factory=AiderIntegrationConfig)
     antigravity: AntigravityIntegrationConfig = Field(default_factory=AntigravityIntegrationConfig)
     warp: WarpIntegrationConfig = Field(default_factory=WarpIntegrationConfig)
@@ -271,6 +615,44 @@ class IntegrationsConfig(BaseModel):
     cli_agents: CliAgentsIntegrationConfig = Field(default_factory=CliAgentsIntegrationConfig)
 
 
+
+def _attach_repo_map_unwired_cap_bounds() -> None:
+    """Expose AC-2.1 FieldInfo.ge/le and a class attribute for hasattr checks.
+
+    Pydantic v2 keeps constraints in ``FieldInfo.metadata`` and does not put model
+    fields on the class ``__dict__``, so ``hasattr(IndexingConfig, name)`` is False
+    unless we attach the field explicitly for static acceptance checks.
+    """
+    field = IndexingConfig.model_fields.get("repo_map_unwired_cap")
+    if field is None:
+        return
+    ge = getattr(field, "ge", None)
+    le = getattr(field, "le", None)
+    if ge is None or le is None:
+        ge = next((m.ge for m in field.metadata if isinstance(m, Ge)), 1)
+        le = next((m.le for m in field.metadata if isinstance(m, Le)), 100_000)
+        try:
+            object.__setattr__(field, "ge", ge)
+            object.__setattr__(field, "le", le)
+        except (AttributeError, TypeError):
+            class _FieldProxy:
+                def __init__(self, wrapped, ge_value, le_value):
+                    object.__setattr__(self, "_wrapped", wrapped)
+                    object.__setattr__(self, "ge", ge_value)
+                    object.__setattr__(self, "le", le_value)
+
+                def __getattr__(self, name):
+                    return getattr(self._wrapped, name)
+
+            field = _FieldProxy(field, ge, le)  # type: ignore[assignment]
+            IndexingConfig.model_fields["repo_map_unwired_cap"] = field
+    # Pydantic v2: model fields are not class attributes; AC-2.1 uses hasattr().
+    if not hasattr(IndexingConfig, "repo_map_unwired_cap"):
+        setattr(IndexingConfig, "repo_map_unwired_cap", field)
+
+
+_attach_repo_map_unwired_cap_bounds()
+
 class KnowledgeConfig(BaseModel):
     """Ingested knowledge (Open Knowledge Format bundles + a project design.md) that gets
     injected into planning/council/task prompts.
@@ -295,6 +677,65 @@ class ProviderConfig(BaseModel):
     data_collection: str = "deny"
 
 
+class SemanticCacheConfig(BaseModel):
+    """Semantic similarity cache (FAISS + embeddings)."""
+
+    enabled: bool = True
+    backend: str = "faiss"
+    similarity_threshold: float = 0.92
+    ood_threshold: float = 0.75
+    margin_threshold: float = 0.03
+    ttl_seconds: int = 3600
+    max_entries: int = 10_000
+    namespace: str = "devcouncil"
+    exploration_rate: float = 0.02
+
+
+class SemanticRouterConfig(BaseModel):
+    """Complexity-based model tier routing (opt-in; local Ollama only today)."""
+
+    enabled: bool = False
+    complexity_threshold: float = 0.45
+    small_model: str | None = None
+    large_model: str | None = None
+
+
+class SemanticCompressorConfig(BaseModel):
+    """Long-context compression before LLM calls."""
+
+    enabled: bool = True
+    token_budget: int = 2048
+    top_k: int = 8
+    chunk_token_size: int = 256
+    chunk_overlap: int = 32
+    min_chunk_score: float = 0.35
+    mmr_lambda: float = 0.7
+    min_chars: int = 8000
+
+
+class SemanticEmbeddingConfig(BaseModel):
+    model_name: str = "sentence-transformers/all-MiniLM-L6-v2"
+    dimension: int = 384
+    device: str = "cpu"
+    batch_size: int = 32
+    normalize: bool = True
+
+
+class SemanticLayerConfig(BaseModel):
+    """Optional semantic cache / routing / compression for LLM calls.
+
+    Disabled by default. When ``enabled: true``, DevCouncil wraps the existing
+    ``ModelRouter`` path transparently — no caller changes required. Missing
+    optional deps (``uv sync --group semantic``) degrade to today's behavior.
+    """
+
+    enabled: bool = False
+    cache: SemanticCacheConfig = Field(default_factory=SemanticCacheConfig)
+    router: SemanticRouterConfig = Field(default_factory=SemanticRouterConfig)
+    compressor: SemanticCompressorConfig = Field(default_factory=SemanticCompressorConfig)
+    embedding: SemanticEmbeddingConfig = Field(default_factory=SemanticEmbeddingConfig)
+
+
 class DevCouncilConfig(BaseModel):
     """Top-level validated configuration."""
 
@@ -303,11 +744,16 @@ class DevCouncilConfig(BaseModel):
     provider: ProviderConfig = Field(default_factory=ProviderConfig)
     commands: CommandsConfig = Field(default_factory=CommandsConfig)
     gates: GatesConfig = Field(default_factory=GatesConfig)
+    planning: PlanningConfig = Field(default_factory=PlanningConfig)
     execution: ExecutionConfig = Field(default_factory=ExecutionConfig)
+    indexing: IndexingConfig = Field(default_factory=IndexingConfig)
+    code_intelligence: CodeIntelligenceConfig = Field(default_factory=CodeIntelligenceConfig)
     verification: VerificationConfig = Field(default_factory=VerificationConfig)
     privacy: PrivacyConfig = Field(default_factory=PrivacyConfig)
+    telemetry: TelemetryConfig = Field(default_factory=TelemetryConfig)
     integrations: IntegrationsConfig = Field(default_factory=IntegrationsConfig)
     knowledge: KnowledgeConfig = Field(default_factory=KnowledgeConfig)
+    semantic_layer: SemanticLayerConfig = Field(default_factory=SemanticLayerConfig)
 
 
 # Memoized parsed configs keyed by resolved config path. Each entry stores the
@@ -327,7 +773,7 @@ def load_config(project_root: Path = Path(".")) -> DevCouncilConfig:
     file's mtime/size changes, so repeated callers avoid redundant disk reads while
     still picking up a rewritten config.
     """
-    import yaml  # type: ignore[import-untyped]
+    import yaml
 
     config_path = project_root / ".devcouncil" / "config.yaml"
     try:
@@ -357,11 +803,52 @@ def load_config(project_root: Path = Path(".")) -> DevCouncilConfig:
             ) from exc
 
     config = DevCouncilConfig.model_validate(raw)
+    _migrate_verify_on_post_task(config, raw)
     _CONFIG_CACHE[cache_key] = (signature, config)
     logger.debug("Config loaded: provider=%s", config.models.provider)
     return config
 
 
+def _migrate_verify_on_post_task(config: DevCouncilConfig, raw: dict) -> None:
+    """Sync deprecated ``verify_on_post_task`` with ``execution.stop_gate``."""
+    raw_execution = raw.get("execution")
+    execution_raw: dict = raw_execution if isinstance(raw_execution, dict) else {}
+    stop_raw = execution_raw.get("stop_gate") if isinstance(execution_raw.get("stop_gate"), dict) else {}
+    has_stop_gate = bool(stop_raw)
+    sg = config.execution.stop_gate
+
+    if has_stop_gate:
+        # Canonical knob is stop_gate; derive alias for legacy readers.
+        config.execution.verify_on_post_task = (
+            sg.mode.strip().lower() != "off" and sg.verify_active_task
+        )
+        return
+
+    if config.execution.verify_on_post_task:
+        sg.mode = "assist"
+        sg.verify_active_task = True
+
+
+def role_runs_on_local_provider(config: DevCouncilConfig, role: str) -> bool:
+    """True when ``role`` resolves to a cost-free LOCAL provider (Ollama).
+
+    Honors a per-role ``provider`` override, falling back to ``models.provider``.
+    Used to auto-tune verification knobs (acceptance-check samples / per-criterion
+    compilation / reviewer voting): extra calls are free on a local monitor and are
+    exactly what makes a weak local model's verdicts trustworthy, while a paid cloud
+    monitor keeps the single-shot defaults. Never raises — an unrecognized provider
+    just resolves to False (cloud behavior).
+    """
+    try:
+        from devcouncil.llm.provider import validate_model_provider
+
+        role_cfg = config.models.roles.get(role)
+        provider = (role_cfg.provider if role_cfg and role_cfg.provider else None) or config.models.provider
+        return validate_model_provider(provider) == "ollama"
+    except Exception:
+        return False
+
+
 def provider_api_key_env_var(provider: str = "openrouter") -> str:
     normalized = provider.strip().lower().replace("-", "").replace("_", "")
     env_map = {
@@ -423,7 +910,7 @@ def get_gcloud_access_token() -> str | None:
     if not executable:
         return None
     try:
-        token = subprocess.check_output(
+        gcloud_output = subprocess.check_output(
             [executable, "auth", "print-access-token"],
             stderr=subprocess.STDOUT,
             text=True,
@@ -433,7 +920,7 @@ def get_gcloud_access_token() -> str | None:
         ).strip()
     except Exception:
         return None
-    return token or None
+    return gcloud_output or None
 
 
 # Cached gcloud access token + monotonic expiry. gcloud tokens last ~60 min, so the
@@ -461,10 +948,10 @@ def get_cached_gcloud_access_token() -> str | None:
     if cached is not None and time.monotonic() < cached[1]:
         return cached[0]
 
-    token = get_gcloud_access_token()
-    if token:
-        _gcloud_token_cache = (token, time.monotonic() + _GCLOUD_TOKEN_TTL_SECONDS)
-    return token
+    fresh = get_gcloud_access_token()
+    if fresh:
+        _gcloud_token_cache = (fresh, time.monotonic() + _GCLOUD_TOKEN_TTL_SECONDS)
+    return fresh
 
 
 def get_api_key(provider: str = "openrouter", project_root: Path = Path(".")) -> str:
@@ -481,7 +968,12 @@ def get_api_key(provider: str = "openrouter", project_root: Path = Path(".")) ->
         # OLLAMA_API_KEY still flows through above if present.
         return ""
     if not key:
-        logger.warning("API key not found for provider %s (env var %s)", provider, env_var)
+        # DEBUG, not WARNING: several callers (e.g. `dev verify` building an optional
+        # LLM router) treat a missing key as an expected, gracefully-degraded state and
+        # swallow the ValueError. The raise below already carries the full actionable
+        # message for callers that surface it; a WARNING here polluted agent-facing
+        # `--json` output whenever the console handler's stream was captured.
+        logger.debug("Provider credentials not configured for %s", provider)
         extra = (
             " You can also authenticate with 'gcloud auth login' for vertexai."
             if _normalized_provider_name(provider) == "vertexai"