sibyl-system 1.5.1 → 1.6.1

package/README.md

@@ -2,7 +2,22 @@
 
 [![npm version](https://img.shields.io/npm/v/sibyl-system.svg)](https://www.npmjs.com/package/sibyl-system) ![license MIT](https://img.shields.io/badge/license-MIT-green.svg)
 
-A standalone [opencode](https://opencode.ai) plugin:
+A standalone [opencode](https://opencode.ai) plugin that adds independent,
+fail-closed review to your agent workflow: nothing it produces can be approved
+by the party that drafted it, and a missing or broken reviewer can never count
+as consent.
+
+## Why three voters
+
+An AI that reviews its own plan is grading its own homework: the same blind
+spots that produced the artifact produced the review. Sibyl's answer is
+structural, not temperamental. Three reviewer personas audit every artifact
+independently and in parallel, and approval needs 2 of 3 votes with zero
+broken seats. Silence, crashes, and unreadable replies count *against*
+approval, never for it. One drafting agent can wear down three independent
+checks; it cannot become all three.
+
+What it gives you:
 
 - **`sibyl_consult`** — a three-voter review council (MELCHIOR / BALTHASAR / CASPER)
   that audits an artifact against a goal and returns a **fail-closed verdict**
@@ -10,21 +25,24 @@ A standalone [opencode](https://opencode.ai) plugin:
 - **`sibyl_swarm`** — a lightweight workflow swarm: an ARCHITECT persona plans a
   dependency-ordered task graph, deterministic workers execute it in waves, and
   the result is aggregated into a verdict.
-- **`sibyl_review` / `sibyl-chamber`** (v1.1) — a general review chamber with
-  isolated role sessions and one conclusion spoken in one voice (see below).
-- **`sibyl_audit`** — the outside lane as a product organ: completion-state ballots convene themselves from a fresh root session (see Tools).
-- **`sibyl_status` + audit primitives** (`sibyl_anchor_check`, `sibyl_time_probe`,
-  `sibyl_attribute`) — read-only verification tools: run-store view, human-message
-  anchor re-verification, clock integrity, ref-move attribution.
+- **`sibyl_review` / `sibyl-chamber`** — a general review chamber with isolated
+  role sessions and one conclusion spoken in one voice (see below).
+- **`sibyl_audit`** — the outside lane as a product organ: completion reviews
+  convene themselves from a fresh root session, so the reviewer is
+  structurally unrelated to whoever drafted the artifact (see Tools).
+- **`sibyl_status` + verification primitives** (`sibyl_anchor_check`,
+  `sibyl_time_probe`, `sibyl_attribute`) — read-only checks: run-store view,
+  re-verification of claimed human orders against the engine's own records,
+  clock integrity, commit attribution.
 
 Zero coupling to team-mode or fleet orchestration: no `team_*` tools, no
 cross-agent message bus. Everything runs through plain opencode child sessions.
 
-## Session hygiene (L1)
+## Session hygiene
 
-Council voters, swarm workers and the swarm judge run as **child sessions of the
-calling session** (`parentID` from the tool context): the TUI session picker
-lists root sessions only, so no sibyl ballot ever clutters your top-level
+Council voters, swarm workers and the swarm judge run as **child sessions of
+the calling session** (`parentID` from the tool context): the TUI session
+picker lists root sessions only, so no review vote ever clutters your top-level
 session list. Transcripts stay in the DB, reachable from the parent session and
 mirrored into the run's sealed reply files. A seatless (CLI/headless) caller
 falls back to top-level creation, and its voter rows are **garbage-collected
@@ -32,23 +50,25 @@ on success** (the reply files are the durable record; failed votes keep their
 DB rows for salvage). `sibyl_review` roles run fully isolated under /tmp with
 their own HOME/DB (`src/lane/isolated.ts`), never touching yours.
 
-## v1.1 — the review chamber (民主集中制)
-
-`sibyl_review` + `sibyl-chamber` is a GENERAL review apparatus: any artifact
-(doc, plan, code, agent-behavior exam pack) goes through broad evidence
-gathering -> blind PRO/CON clash with cross-critique -> an independently-drawn
-judge (E2 pool+seed committed before launch) -> exactly ONE conclusion spoken
-in ONE voice (APPROVE / REJECT / NEEDS_HUMAN). Internal dissent is preserved
-by path+hash in the sealed run dir, never dumped outward. All role sessions
-run isolated under /tmp (zero sessions in your main list); runs are
-spotcheckable (`sha256sum -c CHECKSUMS.txt`) and append-only-ledgered.
+## The review chamber (民主集中制)
+
+The name is the design: broad internal deliberation, one unified external
+voice. `sibyl_review` + `sibyl-chamber` is a GENERAL review apparatus: any
+artifact (doc, plan, code, agent-behavior exam pack) goes through broad
+evidence gathering -> blind PRO/CON clash with cross-critique -> an
+independently-drawn judge (the judge pool and draw seed are recorded before
+launch) -> exactly ONE conclusion spoken in ONE voice (APPROVE / REJECT /
+NEEDS_HUMAN). Internal dissent is preserved by path+hash in the sealed run
+dir, never dumped outward. All role sessions run isolated under /tmp (zero
+sessions in your main list); runs are spotcheckable
+(`sha256sum -c CHECKSUMS.txt`) and append-only-ledgered.
 Laws: docs/isolation-laws.md. Mechanism: docs/democratic-centralism.md.
 
 ```
 node dist/cli.js run --target doc.md --goal "Is this sound?" --model your-provider/your-model
 node dist/cli.js status --tail 5
 node dist/cli.js spotcheck <runId>
-node dist/cli.js run --target - --profile exam --scenario scenarios/<id>.json ...  # behavioral exam venue (bell preflight mandatory)
+node dist/cli.js run --target - --profile exam --scenario scenarios/<id>.json ...  # behavioral exam venue (a venue self-check must pass before any exam run)
 ```
 
 ## Install
@@ -96,13 +116,17 @@ stderr, registers nothing, and returns empty hooks.
 
 ## Tools
 
+Throughout: a *receipt* here means a machine-verifiable result record —
+identifiers and hashes you can re-check against the engine's own store, not a
+transcription.
+
 | Tool | Arguments | Behavior |
 |------|-----------|----------|
 | `sibyl_consult` | `{ artifact, goal }` | `artifact` is a file path or inline multi-line text (≤ 256 KiB). The three councilors audit it in parallel; each reply is parsed into a verdict (one in-session JSON-only repair shot per voter). Returns the tally, merged reasons/must-fix, run id, and per-voter reply file paths. |
-| `sibyl_audit` | `{ artifact, goal }` | Independent audit lane: the council is convened by a FRESH engine-provisioned root session (structurally non-kin to any drafting chain), so the ballot enters the effective path without the caller's identity touching it. Receipt: auditor session id (retained, DB-reconcilable), artifact sha256 bound at start and end (mid-flight drift => VOID), verdict face; anything but INDEPENDENT on the fresh convener => REFUSED, no receipt. |
-| `sibyl_swarm` | `{ artifact, goal, judge? }` | ARCHITECT decomposes goal + artifact into a strict-JSON workflow schema; workers are minted deterministically and dispatched in dependency waves; drafts land in the run's space dir. Verdict: `APPROVE` / `REJECT` / `EXHAUSTED`, forced to `CANNOT_ANSWER` when a declared worker left no terminal row (W2) or zero drafts were produced. With `judge: true`, one extra judge pass may replace the derived verdict — an unrecognized or failed judge reply keeps the derived one. |
+| `sibyl_audit` | `{ artifact, goal }` | Independent audit lane: the council is convened by a FRESH engine-provisioned root session (structurally unrelated to any drafting chain), so the review enters the effective path without the caller's identity touching it. Receipt: auditor session id (retained, DB-reconcilable), artifact sha256 bound at start and end (mid-flight drift => VOID), and the verdict; anything but INDEPENDENT on the fresh convener => REFUSED, no receipt. |
+| `sibyl_swarm` | `{ artifact, goal, judge? }` | ARCHITECT decomposes goal + artifact into a strict-JSON workflow schema; workers are minted deterministically and dispatched in dependency waves; drafts land in the run's space dir. Verdict: `APPROVE` / `REJECT` / `EXHAUSTED`, forced to `CANNOT_ANSWER` when a declared worker left no terminal row (rule W2 below) or zero drafts were produced. With `judge: true`, one extra judge pass may replace the derived verdict — an unrecognized or failed judge reply keeps the derived one. |
 | `sibyl_status` | `{ runId? }` | Read-only. Lists all recorded runs (newest last) + the last chamber-ledger rows, or shows one run's full record and space dir. |
-| `sibyl_review` | `{ target, goal, seed?, maxRounds? }` | v1.1 general democratic-centralism chamber: launches the isolated evidence→clash→judge pipeline detached and returns a receipt (explicitly NOT a verdict); the single voice lands in the run record at terminal state. CLI twin: `sibyl-chamber`. |
+| `sibyl_review` | `{ target, goal, seed?, maxRounds? }` | General democratic-centralism chamber: launches the isolated evidence→clash→judge pipeline detached and returns a receipt (explicitly NOT a verdict); the single voice lands in the run record at terminal state. CLI twin: `sibyl-chamber`. |
 | `sibyl_anchor_check` | `{ sessionId, index?, body?, expectSha256?, label? }` | Read-only verifier for "human anchor" claims (an order/approval message the owner says they sent): re-checks the claim against the engine's own session store instead of trusting a transcribed string. Closed 4-state verdict `MATCH` / `MISMATCH` / `ABSENT` / `ERROR`; the receipt carries a hash of the canonical view read, so later store mutation shows up as a view-hash difference. No `expectSha256` claim → non-verdict. |
 | `sibyl_time_probe` | `{ endpoints?, toleranceMs? }` | Clock-integrity check against independent HTTP `Date` headers (default pool: cloudflare / google / mozilla; sources with the same owner dept collapse to ONE source). Verdict: `SYNCED` / `DRIFT` / `INSUFFICIENT-SOURCES` (< 2 distinct owners is never consent). Default tolerance 300000 ms. `endpoints` JSON is shape-validated and every URL passes the egress gate before any fetch (reserved/internal shapes refused by rule name; blocked = failed receipt, never consent). HEAD only, zero payload, redirects not followed. |
 | `sibyl_attribute` | `{ moves, commits, roster }` | Pure comparator (zero network/git of its own): attributes git ref-moves to committer identities against a roster. Per-move verdict: `ATTRIBUTED` / `UNATTRIBUTED` (the silent-egress case) / `AMBIGUOUS` (byte-equal roster pair = registry defect, blocks, never picks). Identity matching is byte-exact by design — no normalization. `moves`/`roster` JSON is shape-validated; malformed input is refused by name (entry-indexed), never guessed at. |
@@ -125,9 +149,9 @@ defaults.
 | `timeoutMs` | `240000` | Per-child-session timeout (create + prompt share the budget). Integer ≥ 1. |
 | `concurrencyK` | `4` | Cap on parallel workers per wave (also capped by the schema's own `concurrency`). Integer 1–8. |
 | `staggerMs` | `2000` | Delay between worker launches within a wave, to avoid rate-limit bursts. Integer ≥ 0. |
-| `lane` | see below | v1.1 isolated-lane mechanics for `sibyl_review` / `sibyl-chamber` (`src/lane/isolated.ts`). Sub-keys: `runRoot` (string, default `"/tmp"`) — parent dir for run dirs; `opencodeBin` (non-empty string; discovery order: `$OPENCODE_BIN` → `~/.local/bin/opencode` → `/usr/local/bin/opencode` → `/usr/bin/opencode` → bare PATH name `"opencode"`; never empty, a wrong guess fails loud at spawn naming the bin) — the binary launched for each isolated role; `configSource` (default `~/.config/opencode/opencode.jsonc`) — **read-copied** into each role home, never written back; `roleTimeoutMs` (integer ≥ 5000, default `600000`) — per-role wall-clock budget; `examMaskDirs` (array of absolute paths, default `[]`) — dirs tmpfs-masked from exam candidates (grader files, other runs); empty = an unsandboxed venue that says so plainly on the voice face. |
-| `modelPolicy` | `{ allowedPrefixes: ["local-"] }` | v1.1 E4/F1 seating allow-list: only pool models whose `providerID/modelID` starts with one of these prefixes may take a seat; everything else is denied at launch. Array of non-empty strings, **at least 1 entry** (an empty list is rejected as a deny-everything typo). Set this to your own machine's providers — the shipped default is a prefix pattern, not a specific model. |
-| `chamber` | see below | v1.1 review-chamber seats and rounds. Sub-keys: `maxRounds` (integer 1–8, default `3`) — clash/cross-critique round cap; `roles` (`{ evidence, pro, con, judge }` → pool slot names, each default `"default"`); `judgePool` (non-empty array of slot names, default `["default"]`) — the slots the independent judge may be drawn from (E2 pool+seed committed before launch). |
+| `lane` | see below | Isolated-lane mechanics for `sibyl_review` / `sibyl-chamber` (`src/lane/isolated.ts`). Sub-keys: `runRoot` (string, default `"/tmp"`) — parent dir for run dirs; `opencodeBin` (non-empty string; discovery order: `$OPENCODE_BIN` → `~/.local/bin/opencode` → `/usr/local/bin/opencode` → `/usr/bin/opencode` → bare PATH name `"opencode"`; never empty, a wrong guess fails loud at spawn naming the bin) — the binary launched for each isolated role; `configSource` (default `~/.config/opencode/opencode.jsonc`) — **read-copied** into each role home, never written back; `roleTimeoutMs` (integer ≥ 5000, default `600000`) — per-role wall-clock budget; `examMaskDirs` (array of absolute paths, default `[]`) — dirs tmpfs-masked from exam candidates (grader files, other runs); empty = an unsandboxed venue that says so plainly in its final report. |
+| `modelPolicy` | `{ allowedPrefixes: ["local-"] }` | Model seating allow-list: only pool models whose `providerID/modelID` starts with one of these prefixes may take a seat; everything else is denied at launch. Array of non-empty strings, **at least 1 entry** (an empty list is rejected as a deny-everything typo). Set this to your own machine's providers — the shipped default is a prefix pattern, not a specific model. |
+| `chamber` | see below | Review-chamber seats and rounds. Sub-keys: `maxRounds` (integer 1–8, default `3`) — clash/cross-critique round cap; `roles` (`{ evidence, pro, con, judge }` → pool slot names, each default `"default"`); `judgePool` (non-empty array of slot names, default `["default"]`) — the slots the independent judge may be drawn from (the pool and draw seed are recorded before launch). |
 
 ### Portability (release principle)
 
@@ -146,65 +170,92 @@ fails the release if any vendor model id reappears on a shipped surface.
 
 ## State layout
 
-- **Chamber ledger**: `~/.sibyl/chamber-ledger.jsonl` — append-only, one JSON
-  record per line, serial-stamped at append (A5); `sibyl_status` reads its tail.
+All persistent data lives under one directory, `~/.sibyl` (created on first
+use; on Windows `%USERPROFILE%\.sibyl`). The only place outside it the plugin
+writes is the isolated run root for chamber/exam lanes (`lane.runRoot`,
+default `/tmp`, defined under Options) — sealed per-run directories there.
+
+- **Chamber ledger**: `~/.sibyl/chamber-ledger.jsonl` — append-only history, one JSON
+  record per line, each run stamped with a per-run sequence number that
+  increments with every appended run; `sibyl_status` reads its tail.
 - **Runs file**: `~/.sibyl/runs.json` (Windows: `%USERPROFILE%\.sibyl\runs.json`) —
-  one record per run (id, kind, status, verdict tally, operator notes), co-located
+  one record per run (id, kind, artifact, goal, status, verdict, timestamps,
+  plus notes the tool records at run milestones, shown by `sibyl-chamber status`),
+  co-located
   with `spaces/` under the one `~/.sibyl` state root, so npm upgrades (which ship a
   fresh, versioned package directory) never wipe your run history. Written
   atomically (tmp + rename; the parent directory is created on demand).
-  *Note: 1.0.x-era runs recorded under the old package-local `<repo>/.state` path
-  are not migrated (pre-adoption by design) — the store starts empty.*
 - **Per-run space**: `~/.sibyl/spaces/<runId>/` (Windows: `%USERPROFILE%\.sibyl\spaces`) — full voter replies
   (`MELCHIOR.md`, …) for consults, worker drafts (`<workerId>.draft.md`) for swarms.
-- **Test seam**: `SIBYL_STATE_FILE` env var overrides the runs-file path.
-- `load()` never throws: a missing or corrupt file recovers to an empty list
-  (with a stderr warning); malformed individual entries are dropped, not fatal.
+- **Test/CI override**: the `SIBYL_STATE_FILE` env var points **the runs file**
+  at a custom path (its scope is exactly that file — the chamber ledger and
+  `spaces/` keep their real paths, since the ledger is the audit trail and is
+  deliberately not silently relocatable; CI runners get a fresh home dir
+  anyway).
+- `load()` never throws: a missing or corrupt runs file recovers to an empty
+  list (with a stderr warning) and the next write replaces the corrupt file —
+  so if run history matters, back up `~/.sibyl`; the chamber ledger is a
+  separate append-only file and is untouched by that recovery. Malformed
+  individual entries are dropped, not fatal.
 
 ## Fail-closed policy
 
-Plainly stated:
-
-- Approval needs **≥ 2 of 3 approvals and zero error/missing votes**.
-- When the council genuinely spoke (all three ballots substantive, or ≥ 2
-  substantive rejects) and approval was not reached, the verdict is **REJECT**.
-- When error/missing seats leave no decision (2A + 1 error, 2A + 1 missing,
-  a tie with an error seat), the verdict is **CANNOT_ANSWER** — a wounded
-  instrument, NOT a substantive reject, and it can never approve. Repair the
-  infra and re-run (since v1.2; pinned by `test/council.test.ts`).
-- Error votes, missing votes, and malformed verdicts all count against approval.
-- A reply that still doesn't parse after its single repair shot becomes a
-  0-confidence REJECT ballot with reason `verdict-unparseable: …`.
-- There is no lenient mode, by design.
-
-## Ballot-integrity laws (W1–W4, drafted 2026-10-04/05 after the campaign postmortems; shipped in v1.3.0)
+Plainly stated — every combination lands in exactly one state:
+
+- **APPROVE** needs ≥ 2 genuine approvals **and** zero error/missing votes.
+  With three voters that means exactly 3A or 2A+1R.
+- **REJECT** when the council answered: all three voted genuinely but approval
+  wasn't reached, or there are ≥ 2 genuine rejects regardless of the third
+  seat (2R+1error is still a REJECT — the "no" is already decisive).
+- **CANNOT_ANSWER** for every other mix (2A+1error, 1A+1R+1error, …): the
+  mechanism itself is broken. That is NOT a "no", and it can never be treated
+  as a "yes": repair the broken part and run again.
+- A reply that still doesn't parse after its single repair shot is **not** a
+  reject ballot — it marks that seat as an error, which blocks approval and
+  can force CANNOT_ANSWER. There is no path where a broken reply helps
+  anything pass.
+- Each ballot also carries a self-reported `confidence` (0..1): recorded for
+  the human reader, never used in the tally.
+- The pinned default policy is `majority2of3`; stricter policies exist (see
+  Architecture), never looser ones. There is no lenient mode, by design.
+  All of the above is pinned by `test/council.test.ts`.
+
+## Ballot-integrity laws
+
+These rules exist because real failures happened while this product was in
+daily internal use (the incident records themselves live outside the shipped
+package). Four of them govern the ballot itself; three carry the short names
+`W1`–`W3` used across the codebase and the docs, while the fourth — refused
+launches leaving records — arose from a specific council ruling and carries
+no short name. A fifth rule, `W4`, governs releases instead and is stated
+where it applies, in the Release process section at the end of this document.
 
 - **Convener recusal (W1).** Every consult/swarm/review run resolves the
   convening execution chain through the engine's own session store
   (`session.get` parent links — never a self-report) and scans it for drafting
   evidence of the artifact (write/edit parts targeting it, or content matches).
-  A kinship hit stamps the run `independence=NOT-INDEPENDENT`: the ballot is
+  A kinship hit marks the run `independence=NOT-INDEPENDENT`: the ballot is
   preserved as data but is not in any effective path. A chain that cannot be
   read stamps `UNVERIFIABLE` — unreadable is never silently clean.
-- **Refused launches leave records (v1.4.0, council 16a2):** an explicit `--run-id`
-  whose tool-staged `launch-context.json` is missing or malformed is REFUSED, with a
-  `launch-refusal.json` written into the private run dir — a pinned id claiming a
-  tool launch that never staged its finding is a provenance lie, not an absence.
-  The bare CLI lane (no `--run-id`) keeps the named `UNVERIFIABLE` leg, and once the
-  chamber runner regenerates its run record, that face outvouches any contradicted
-  staged claim ("record wins").
+- **Refused launches leave records.** An explicit `--run-id` whose tool-staged
+  `launch-context.json` is missing or malformed is REFUSED, with a
+  `launch-refusal.json` written into the private run dir — a pinned id claiming
+  a tool launch that never staged its finding is a provenance lie, not an
+  absence. The bare CLI lane (no `--run-id`) keeps the named `UNVERIFIABLE`
+  leg, and once the chamber runner regenerates its run record, that record
+  outranks any contradicted staged claim ("record wins").
 - **Absence is a disability (W2).** Before any tally is honored, every declared
   voter/worker must have left a terminal row (`ok|error|timeout` + detail) in
   the run's `TERMINALS.txt`. A declared seat without its row is counted
   `dead-without-record=N` on the first receipt line and forces `CANNOT_ANSWER` —
   never folded into an approve or a reject. A worker session ending with empty
   content is a failure, not a done ballot.
-- **The ruler rides the ballot (W3).** Each terminal record embeds
+- **The scoring rules travel with the vote (W3).** Each terminal record embeds
   `instrument: {rulesHash, components}` — the sha256 of every persona prompt /
   criteria text the build actually sends (councilors, architect, judge, repair
-  grammar, chamber roles). `rulesHash` flips with any ruler edit, so
+  grammar, chamber roles). `rulesHash` flips with any rule edit, so
   "re-evaluate under the new rules" is reproducible and comparable; the
-  `rules=<12hex>` label rides the receipt face and `sibyl_status` lines.
+  `rules=<12hex>` label rides every result line and `sibyl_status` output.
 
 ## Security notes
 
@@ -213,16 +264,29 @@ advisory), the full data-egress map, and the honestly-named limitations.
 Summary:
 
 - Consult/swarm send the artifact text to your configured model pool providers.
-- `sibyl_time_probe` fetches nothing before the URL passes the egress gate
-  (v1.5.0): reserved/internal address shapes, single-label hosts, non-http(s)
-  schemes, userinfo and non-default ports are refused by rule name; a blocked
-  source is a failed receipt, never consent.
+- `sibyl_time_probe` fetches nothing before the URL passes the egress gate:
+  reserved/internal address shapes, single-label hosts, non-http(s) schemes,
+  userinfo and non-default ports are refused by rule name; a blocked source is
+  a failed receipt, never consent.
 - The plugin writes under its state paths (the runs file and the per-run space) and,
   for chamber/exam lanes, sealed run directories under `lane.runRoot`
-  (default `/tmp`), every plugin-created dir `0700` (mkdir mode + explicit chmod:
-  unreachable to group/other regardless of umask — v1.4.0 private-dir law) —
+  (default `/tmp`), every plugin-created dir `0700` (mkdir mode + explicit
+  chmod: unreachable to group/other regardless of umask) —
   role homes, transcripts, pidfiles, CHECKSUMS.
 - Voter/worker turns run with `bash`, `edit`, and `write` disabled per prompt.
+- Supply chain: CI actions are SHA-pinned, installs run with
+  `--ignore-scripts`, and a weekly `npm audit`
+  (`.github/workflows/scheduled-audit.yml`, which also accepts repo
+  workflow_dispatch runs) is witnessed server-side by the pre-publish
+  liveness gate (a green audit run, recent within the gate's pinned
+  freshness window and bound to the exact commit being released — the
+  judgment table and the operative defaults are locked together in
+  `test/publish-gate.test.ts`, which imports the defaults from
+  `scripts/publish-gate.mjs`). Honest status ledger of every vector,
+  open or closed: [OPEN-VECTORS.md](OPEN-VECTORS.md).
+- Engine sessions this product spawns are retained under bounded ages
+  (`npm run reap`, dry-run by default; audit conveners >= 90 days per owner
+  ruling, reconciliation data preserved in the sealed manifest).
 
 ## Architecture (`src/`)
 
@@ -239,51 +303,57 @@ index.ts            plugin entry: parse options → share one RunStore + client
 ├── council/        councilor personas + tallyVotes (majority2of3 default,
 │                   unanimous exported); pure aggregation, zero IO
 ├── state/          RunStore: atomic RMW runs.json, per-run space dirs;
-│                   v1.1 chamber records: EOF-append ledger (A5), face-last
-│                   regeneration, CHECKSUMS + spotcheck (A4)
+│                   chamber records: EOF-append ledger, final report
+│                   regenerated last, CHECKSUMS + spotcheck
 ├── swarm/          planner (ARCHITECT schema) → minter (deterministic worker
 │                   roster) → dispatcher (dependency waves, stagger,
 │                   suspend-on-rate-limit, resume) → aggregate (report +
 │                   verdict derivation; full drafts never inlined)
-├── lane/           v1.1 E1/E4: isolated opencode-run launcher (L1 env pinning,
+├── lane/           isolated opencode-run launcher (env pinning,
 │                   argv-only spawn, pidfile-only kill) + seating policy prefilter
-├── chamber/        v1.1 民主 protocol (evidence -> blind clash -> cross-critique
-│                   -> drawn judge, bounded rounds) + 集中 synthesis (ONE voice,
-│                   fail-closed, dissent sealed by path+hash)
-├── exam/           v1.1 E3: scenario-as-data behavioral exams, mechanical
+├── chamber/        deliberation protocol (evidence -> blind clash ->
+│                   cross-critique -> drawn judge, bounded rounds) + synthesis
+│                   (one voice, fail-closed, dissent sealed by path+hash)
+├── exam/           scenario-as-data behavioral exams, mechanical
 │                   transcript/disk signal grading, canary veto
 ├── personas.ts     registry: 3 councilors + ARCHITECT + judge/repair texts,
-│                   model slots — the single source the W3 face hashes
-├── terminal.ts     W2 terminal-row grammar (ok|error|timeout), parse + the
-│                   dead-without-record declared-minus-recorded diff
-├── instrument.ts   W3 ruler face: sha256 set of the live prompt/criteria
+│                   model slots — the single source of every scoring-rule
+│                   text (rule W3 hashes these)
+├── terminal.ts     rule W2 terminal-row grammar (ok|error|timeout), parse +
+│                   the dead-without-record declared-minus-recorded diff
+├── instrument.ts   rule W3 ruler: sha256 set of the live prompt/criteria
 │                   texts + deterministic rulesHash fold
-├── independence.ts W1 convener-recusal: engine-store chain walk +
+├── independence.ts rule W1 convener-recusal: engine-store chain walk +
 │                   drafting-evidence scan (INDEPENDENT / NOT-INDEPENDENT /
 │                   UNVERIFIABLE, fail-closed on unreadable)
 ├── options.ts      zod v4 schema + parseOptions (never throws); home of the
 │                   config-default single sources (DEFAULT_TIMEOUT_MS)
-├── cli.ts          v1.1 sibyl-chamber bin: run | status | spotcheck | kill
-├── util.ts         v1.5.0 single definitions: withTimeout + errMessage
+├── cli.ts          sibyl-chamber bin: run | status | spotcheck | kill
+├── util.ts         single definitions: withTimeout + errMessage
 └── tools/          sibyl_consult / sibyl_swarm / sibyl_status / sibyl_review
                     + audit primitives (anchor / time probe / attribution)
                     glue + shared helpers (model-slot chain, artifact reader)
 ```
 
-## vs. swarm
+## Relationship to other multi-agent tools
 
-This is **not** the oh-my-openagent swarm. It has no `team_*` tools, no
+If you have seen "swarm"-style toolkits — for example the multi-agent
+orchestration bundled with [oh-my-openagent](https://github.com/code-yeongyu/oh-my-openagent),
+which coordinates long-lived named agents through shared tools and a message
+bus — this is **not** one of those. It has no `team_*` tools, no
 cross-agent message bus, and no fleet-orchestration dependency of any kind —
-it is a clean-room implementation (~5K lines of product code, comments excluded) that happens to
-share the problem space. `sibyl_swarm` is a single tool call driving a
-PLAN→MINT→DISPATCH→AGGREGATE pipeline over ordinary child sessions.
+it was written from scratch (~5K lines of product code, comments excluded,
+`src/` only) and happens to share the problem space. `sibyl_swarm` is a
+single tool call driving a PLAN→MINT→DISPATCH→AGGREGATE pipeline over
+ordinary child sessions.
 
 ## Development
 
 ```bash
 npm run typecheck   # tsc --noEmit, strict + noUncheckedIndexedAccess + exactOptionalPropertyTypes
-npm test            # full unit suite, fully offline (no network, no LLM; 480 at v1.5.0 — the run prints the exact count)
-npm run coverage    # offline suite + coverage floor ratchet (lines 55 / branches 80 / funcs 90 — floors only move up; CI door)
+npm test            # full unit suite, fully offline (no network, no LLM; the run prints the exact count)
+npm run reap        # session-retention reaper: dry-run manifest by default; -- --apply deletes via the engine API
+npm run coverage    # offline suite + coverage floor ratchet (floors only move up; CI door)
 npm run build       # esbuild bundle → dist/index.js + dist/cli.js (ESM)
 node smoke/run-smoke.mjs   # offline smoke of the shipped surface (see smoke/README.md)
 ./ship.sh           # the full release gate: all of the above + portability scan of the packed tarball
@@ -296,8 +366,11 @@ Live end-to-end evidence (real opencode, real model sessions):
   planted defect classes; council wall time 95.6 s ≈ slowest single voter
   (Σ 168.2 s), proving true parallel fan-out.
 - `.omo/evidence/t11/` (internal working evidence, not shipped) — failure paths, 31/31 assertions: a bad model slot
-  produced 3 error votes → fail-closed **REJECT 0A/0R/3E**; SIGINT mid-run left
+  produced 3 error votes, and the run failed closed; SIGINT mid-run left
   the store valid with the interrupted run honestly frozen at `running`.
+  (The recorded tally predates the judgment-table law pinned in
+  `test/council.test.ts`; under today's locked table an all-error ballot is
+  classified CANNOT_ANSWER, never REJECT — see the fail-closed policy table.)
 - `smoke/` ships a deterministic offline re-check of the build + entry +
   status surface for CI use.
 
@@ -313,6 +386,48 @@ developed under the name MAGI and renamed to Sibyl-System before its first relea
 
 MIT
 
-## Release wheel
-
-Tags v* require a packet receipt (docs/release/<ver>.md with a real `gate: PASS` line) and a lease; after cloning run `scripts/install-hooks.sh` — hooks are per-clone and ship empty. **W4 (2026-10-05):** the hook reads the receipt AND `package.json`'s version exclusively from the pushed tag's **object body** (`git show <oid>:<path>`); working-tree reads are forbidden — the tag must carry its own paperwork, and the in-tag version must equal the tag name (ghost-version class killed). **Tag-body hygiene (2026-10-24):** annotated-tag message bodies are scanned on push — home-path and email shapes refuse by rule name (the message is public release content; anchor facts by hash/run-id, not machine paths). Regression-locked in `test/hook-prepush.test.ts` (ref lines fed via stdin).
+## Release process
+
+Publishing a version takes three steps:
+
+1. write a release record (`docs/release/v<version>.md` — named after the tag, v included) listing the verification
+   evidence, including a literal `gate: PASS` line;
+2. take the release lease (`scripts/release-lease.sh`) — a lock file in the
+   releaser's own `~/.config/sibyl/` that stops the same maintainer from
+   tagging two releases at once (it is a per-user guard, not a distributed
+   lock);
+3. create the tag and push it.
+
+Nothing more is done by hand: pushing the tag is the last human step. A CI
+workflow triggered by the tag then re-verifies the paperwork and publishes to
+npm. Enforcement comes in two honest layers:
+
+- **Local (fast-fail, bypassable):** a push hook (rule `W4`) checks that the
+  tag carries its own proof — it reads the release record and
+  `package.json`'s version from the exact files the pushed tag itself points
+  at (`git show <oid>:<path>`), never from the working copy, and requires the
+  version inside the tag to equal the tag name. Tag messages are scanned too:
+  home-directory paths and email-address shapes are refused by rule name,
+  because tag messages are public — reference facts by hash or run id.
+  The hook also refuses a tag push unless the local release lease (step 2)
+  names exactly that version. Hooks are per-clone and must be installed
+  (`scripts/install-hooks.sh`), and
+  `git push --no-verify` can skip them — they save you a rejected push, they
+  are not the door.
+- **Server-side (the door):** the CI publish workflow re-runs the tag
+  paperwork — tag name must equal `package.json`'s version, and the release
+  record `docs/release/v<version>.md` (tag name, v included) must exist in the tagged tree carrying a
+  literal `gate: PASS` line (`scripts/tag-paperwork.mjs`, locked by
+  `test/tag-paperwork.test.ts`) — and additionally refuses unless a recent
+  security-audit run — scheduled or dispatched by the repo itself — finished
+  green on the exact commit being released (the commit binding and the
+  pinned freshness window are the "Supply chain" bullet in Security notes).
+  Skipping the local hook does not skip this; of the hook's four
+  checks, two have no server echo — the tag-message hygiene scan, and the
+  lease check, which cannot echo by design (the lease is an operator-local
+  per-user file, step 2). The npm publish itself runs under a CI identity
+  with provenance, so the registry records exactly which repo commit
+  produced the package.
+- All of it is regression-locked in tests (`test/hook-prepush.test.ts` feeds
+  the hook the same push information git sends it; `test/publish-gate.test.ts`
+  locks the server-side door's judgment table).

package/dist/cli.js

@@ -14288,8 +14288,8 @@ function registry() {
 var globalRegistry = globalThis.__zod_globalRegistry;
 
 // node_modules/zod/v4/core/compile.js
-var INVALID = Symbol.for("zod.compile.invalid");
-var FALLBACK_FLAG = Symbol.for("zod.compile.fallback");
+var INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
+var FALLBACK_FLAG = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 var ZodCompileAsyncError = class extends Error {
   constructor(message = "z.compile does not support async refinements, transforms, or checks") {
     super(message);
@@ -18077,7 +18077,7 @@ var nonoptionalProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
-var UNREPRESENTABLE_DEFAULT = Symbol();
+var UNREPRESENTABLE_DEFAULT = /* @__PURE__ */ Symbol();
 function serializeDefaultValue(value, schema, ctx, json2, params) {
   let unrepresentable = false;
   const serialized = JSON.stringify(value, (_, val) => {
@@ -20841,7 +20841,7 @@ function fromJSONSchema(schema, params) {
 }
 
 // node_modules/zod/v4/core/visit.js
-var RESOLVING = Symbol("z.visit/resolving");
+var RESOLVING = /* @__PURE__ */ Symbol("z.visit/resolving");
 function visit(schema, fnOrHandlers) {
   const fn = typeof fnOrHandlers === "function" ? fnOrHandlers : (node2, rewritten) => {
     const h = fnOrHandlers[node2._zod.def.type];

package/dist/index.js

@@ -12952,8 +12952,8 @@ function registry() {
 var globalRegistry = globalThis.__zod_globalRegistry;
 
 // node_modules/zod/v4/core/compile.js
-var INVALID = Symbol.for("zod.compile.invalid");
-var FALLBACK_FLAG = Symbol.for("zod.compile.fallback");
+var INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
+var FALLBACK_FLAG = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 var ZodCompileAsyncError = class extends Error {
   constructor(message = "z.compile does not support async refinements, transforms, or checks") {
     super(message);
@@ -16741,7 +16741,7 @@ var nonoptionalProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
-var UNREPRESENTABLE_DEFAULT = Symbol();
+var UNREPRESENTABLE_DEFAULT = /* @__PURE__ */ Symbol();
 function serializeDefaultValue(value, schema, ctx, json2, params) {
   let unrepresentable = false;
   const serialized = JSON.stringify(value, (_, val) => {
@@ -19505,7 +19505,7 @@ function fromJSONSchema(schema, params) {
 }
 
 // node_modules/zod/v4/core/visit.js
-var RESOLVING = Symbol("z.visit/resolving");
+var RESOLVING = /* @__PURE__ */ Symbol("z.visit/resolving");
 function visit(schema, fnOrHandlers) {
   const fn = typeof fnOrHandlers === "function" ? fnOrHandlers : (node2, rewritten) => {
     const h = fnOrHandlers[node2._zod.def.type];
@@ -21505,7 +21505,7 @@ async function artifactHash(raw, dir) {
 }
 function buildAuditTool(deps) {
   return tool({
-    description: "SIBYL independent audit lane: convenes the three-councilor consult from a FRESH engine-provisioned root session (structurally non-kin to any drafting chain), so the ballot enters the effective path without the caller's identity touching it. Emits an audit receipt \u2014 auditor session id (retained, DB-reconcilable), artifact sha256 bound at start and end, verdict face. REFUSES (no receipt) if the fresh convener resolves to anything but INDEPENDENT, or the artifact drifts mid-ballot (VOID).",
+    description: "SIBYL independent audit lane: convenes the three-councilor consult from a FRESH engine-provisioned root session (structurally non-kin to any drafting chain), so the ballot enters the effective path without the caller's identity touching it. Emits an audit receipt \u2014 auditor session id (retained >=90 days, then reconcilable via the sealed reap manifests), artifact sha256 bound at start and end, verdict face. REFUSES (no receipt) if the fresh convener resolves to anything but INDEPENDENT, or the artifact drifts mid-ballot (VOID).",
     args: {
       artifact: tool.schema.string().min(1).describe("Path to the artifact, or its inline content (multi-line)."),
       goal: tool.schema.string().min(1).describe("The question the audit must answer.")
@@ -21556,7 +21556,7 @@ async function auditExecute(deps, args, ctx) {
   return [
     `SIBYL AUDIT RECEIPT run=${runId}`,
     `  verdict=${v?.verdict ?? "unknown"} (${counts}) rules=${rules}`,
-    `  auditor-convener=${auditor} (fresh engine-provisioned root; session row RETAINED for DB reconciliation)`,
+    `  auditor-convener=${auditor} (fresh engine-provisioned root; session row retained >=90 days, after which sealed reap manifests carry the reconciliation face)`,
     `  requested-by=${caller} \u2014 recorded as ledger data only; it neither convenes nor votes`,
     `  artifact-sha256=${shaStart} (re-hashed after the ballot, identical \u2014 the receipt binds to these bytes)`,
     "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sibyl-system",
-  "version": "1.5.1",
+  "version": "1.6.1",
   "license": "MIT",
   "type": "module",
   "description": "Sibyl-System: democratic-centralism review chamber (one conclusion, one voice) + fail-closed council voting + dynamic swarm plugin for OpenCode",
@@ -33,7 +33,8 @@
     "build": "esbuild src/index.ts --bundle --format=esm --platform=node --outfile=dist/index.js && esbuild src/cli.ts --bundle --format=esm --platform=node --banner:js='#!/usr/bin/env node' --outfile=dist/cli.js",
     "test": "node --import ./tools/register-ts.mjs --test test/*.test.ts",
     "coverage": "node --import ./tools/register-ts.mjs --test --experimental-test-coverage \"--test-coverage-include=src/**\" --test-coverage-lines=55 --test-coverage-branches=80 --test-coverage-functions=90 test/*.test.ts",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "reap": "node --no-warnings scripts/session-reap.mjs"
   },
   "dependencies": {
     "@opencode-ai/plugin": "1.19.4",
@@ -41,7 +42,7 @@
   },
   "devDependencies": {
     "@types/node": "^22",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.2",
     "typescript": "^5"
   },
   "bin": {