the-high-council 0.7.8 → 0.7.9

package/README.md

@@ -7,7 +7,8 @@ You choose the number of debate rounds, the seats and labs (any lab except xAI),
 limit for each model's replies.
 
 We recommend our own chains: `cheap-7-v2`, `plan-premium-7` and `plan-highest-7` (the top
-models, GPT-6 Astra, Claude Fable 5.1, DeepSeek V4 Pro and GLM-5.3, write the alternative
+models, GPT-6 Astra, Claude Opus 5.5, DeepSeek V4 Pro
+and GLM-5.3, write the alternative
 architectures and are the only seats that vote; cheaper seats write the proposals and the debate). You can also edit a chain to suit yourself, or run every seat on
 your own machine with `local-ollama`.
 
@@ -40,8 +41,8 @@ Three commands from nothing to a priced run of your own idea (no key needed unti
 | Chain | Who does what | Needs | Worst case |
 |---|---|---|---|
 | `cheap-7-v2` | Claude Sonnet 5 writes the plan; low-cost models from seven other labs review it, and all seven must sign off. Up to 7 rounds. | one OpenRouter key | $5.38 |
-| `plan-premium-7` | A Claude Code session writes the plan; a seven-lab panel of larger models (GPT-6 Astra, Claude Fable 5.1, Gemini 3.8 Flash, Muse Spark 1.2, Qwen 3.8 Max, DeepSeek V4 Pro, GLM-5.3) proposes, debates and reviews. | OpenRouter key + a Claude Code session | $21.59 |
-| `plan-highest-7` | Seven low-cost models propose and debate; four top models write whole architectures and are the only reviewers; one deep-dive seat checks the first draft against the task. **Untested with real models.** | OpenRouter key + a Claude Code session | $14.89 |
+| `plan-premium-7` | A Claude Code session writes the plan; a seven-lab panel of larger models (GPT-6 Astra, Claude Fable 5.1, Gemini 3.8 Flash, Muse Spark 1.2, Qwen 3.8 Max, DeepSeek V4 Pro, GLM-5.3) proposes, debates and reviews. | OpenRouter key + a Claude Code session | $22.30 |
+| `plan-highest-7` | Seven low-cost models propose and debate; four top models write whole architectures and are the only reviewers; one deep-dive seat checks the first draft against the task. **Untested with real models.** | OpenRouter key + a Claude Code session | $11.21 |
 | `local-ollama` | Every seat on your own machine, through Ollama. | Ollama and the models pulled | $0 |
 
 `plan-premium-7` and `plan-highest-7` cost more than the default cap, so give them a `--max-usd` at
@@ -419,7 +420,7 @@ Each outcome has its own code, so a script or CI job can branch on it:
 | 8 | Finished, but the final security review could not judge it (never a pass). |
 | 9 | Artifact gate: the task names files whose content it never includes (`BLOCKED-ARTIFACTS.md`). |
 | 10 | Preflight: a seat objected to the task description itself (`STOPPED-preflight.md`). |
-| 11 | PII gate (`--pii-gate hard-stop`): the input matches a PII shape or one of the key formats listed in `src/secret-patterns.js`. |
+| 11 | Something in the input must not be sent: a prompt matches one of the key formats listed in `src/secret-patterns.js` (checked by default; `--allow-secret-shaped` overrides), or, under `--pii-gate hard-stop`, a PII shape. |
 | 12 | `policy.json` refused the chain. |
 | 13 | Another process is already running this run folder. |
 | 14 | The task file changed since the run started and `AMENDMENTS.md` does not cover it. |
@@ -460,7 +461,7 @@ than reporting the overspend afterwards.
 
 ```bash
 council --task tasks/x.md --max-usd 2     # this run stops at $2
-council --task tasks/x.md --max-usd none  # no ceiling
+council --task tasks/x.md --max-usd none  # no ceiling (0 is refused: it used to mean this)
 export MAX_USD_PER_RUN=20                         # change the default
 ```
 
@@ -612,7 +613,7 @@ for anyone with a subscription, since the project's cost story depends on it.
 
 ## Chains
 
-51 chain configs live in `chains/`. Each one is plain JSON - the seat roster, which models fill
+52 chain configs live in `chains/`. Each one is plain JSON - the seat roster, which models fill
 which seat, the round cap, and whether proposals/debate/handoff stages run. They are meant to be
 copied and edited.
 
@@ -623,6 +624,12 @@ in the table at the top. A few more worth knowing:
   and Google keys.
 - **`plan-open-7`** - the `cheap-7-v2` panel, with a Claude Code session writing the plan instead
   of a paid seat.
+- **`plan-daily-7`** - `plan-highest-7`'s stages at a lower price, for planning one feature:
+  Claude Opus 5.5 on your Claude subscription (an external seat), GPT-6 Luna and DeepSeek V4 Pro
+  write the architectures and alone vote; seven low-cost labs propose and debate. Two Claude Code
+  sessions answer its external seats: Opus 5.5 every stage whose label contains `opus5.5-sub`
+  (including `-retry` and `-reask1`/`-reask2` forms), Sonnet 5 the writer stages. $1.90 worst case.
+  **Run once with real models (2026-09-28); nothing about it has been measured.**
 - **`cheap`** - small models throughout. For testing the harness itself, not for real work.
 - **`plan-debate`** - five labs propose blind, debate each other's proposals anonymised, then a
   blind panel grades the integrated draft.
@@ -654,7 +661,7 @@ Read a chain's `description` field before running it; they say what they cost yo
 - **`quorum: { "minHeard": N }`** - opt-in, unanimous chains only, set in no shipped chain. A
   round's sign-off counts only when at least N reviewers gave a verdict (signed off or objected);
   a round short of it is recorded as `notQuorate`, the run does not pass, and the loop stops.
-- **Tiered councils (experimental, used by `plan-highest-7` and `mock-tiered`).**
+- **Tiered councils (experimental, used by `plan-highest-7`, `plan-daily-7` and `mock-tiered`).**
   `seats.alternatives` names who writes the whole alternative architectures, separately from the
   proposers. `deep_dive` + `seats.deep_dive` add one non-voting seat with its own dollar cap
   (`usd`, required) inside the run's cap. `majority_guard.enabled` shows each author every
@@ -740,11 +747,11 @@ what each rule guards against and why. Copy the folders you want into your proje
   oldest date every entry was last checked) is printed by `council doctor` and `--dry-run`, with a
   warning once it is more than 60 days old. The spend cap and every estimate use these static
   prices. They are estimates, not invoices. Your provider's bill is the real number.
-- `plan-highest-7`, the tiered council, has not been run with real models, and none of its
-  mechanisms (tiers, the deep-dive seat, the majority guard) has been measured. Its dry-run price
-  is a projection.
-- Seats marked `external` (the writer seats in `plan-premium-7`, `plan-highest-7` and
-  `plan-open-7`) pause the run until someone answers them, and are $0 only because a Claude Code
+- `plan-highest-7` has not been run with real models, and `plan-daily-7` has run once
+  (2026-09-28). None of the tiered councils' mechanisms (tiers, the deep-dive seat, the majority
+  guard) has been measured. Their dry-run prices are projections.
+- Seats marked `external` (the writer seats in `plan-premium-7`, `plan-highest-7`,
+  `plan-daily-7` and `plan-open-7`, and the Opus 5.5 anchor seat in `plan-daily-7`) pause the run until someone answers them, and are $0 only because a Claude Code
   session on a subscription writes them. Nothing checks who wrote the answer.
 - Chains with many labs and high round caps get expensive quickly. `plan-unanimous` at three rounds
   is fifteen critic calls; `plan-auto` runs several frontier models over multiple rounds. Price
@@ -758,6 +765,10 @@ what each rule guards against and why. Copy the folders you want into your proje
   which is the default, it does not detect a full rewrite**: anyone who can edit the file can
   recompute every hash. Set `AUDIT_HMAC_KEY_FILE` to a key kept outside the run folder if the log
   has to stand up to that.
+- The outbound key scan matches **key shapes only**, the formats in `src/secret-patterns.js`; a
+  password written in prose is not detectable. Generic shapes (a password inside a URL or an
+  assignment) are checked in your inputs before the run; text the models write is checked only for
+  distinctive key formats.
 
 ## Privacy
 

package/chains/plan-daily-7.json

@@ -0,0 +1,43 @@
+{
+  "name": "plan-daily-7",
+  "description": "daily7 (the owner's name, 2026-09-27: cheap API seats, and the expensive Opus 5.5 seat runs on a local Claude Code session). Tiered council for planning ONE feature cheaply (Muad, 2026-09-27: \"Opus 5.5 on a local sub that does the important tasks from the highest7 setup ... all together ~1$ per council run\"). Same stages and flags as plan-highest-7 (alternatives, debate, decision records, deep dive, majority guard ON, canary, dispute, handoff); only the seats and the deep-dive cap differ. ANCHOR SEATS write the whole alternative architectures (seats.alternatives), answer the posts on them, and are the only panel that votes, unanimously (seats.critics): Claude Opus 5.5 on the owner's Claude subscription (provider external, model subscription:opus-5.5, lab opus5.5-sub: $0 API, a separate Opus 5.5 Claude Code session answers its paused stages), GPT-6 Luna and DeepSeek V4 Pro through OpenRouter. MASS SEATS (seats.proposers, seven labs from the strong and low-cost part of arena.ai's agent leaderboard, fetched 2026-09-27): Tencent Hy4 preview, Gemini 3.8 Flash, DeepSeek V4.1 Flash, GLM 5.2, Muse Spark 1.3, Qwen 3.8 Max, Mistral Medium 3.5 (kept on the owner's word) write the blind proposals and every debate post and reply, and post on the anchors' architectures (alternatives.debaters \"all\"); they argue, they never vote. DEEP-DIVE SEAT: DeepSeek V4.1 Flash, a mass-tier model (a different model from the voting V4 Pro, so chain-lint deep-dive-votes passes), under its own $0.50 cap: a feature-sized task is one 40,000-character call, and a $4 sub-cap would be larger than this chain's whole worst case. Criteria: Llama 4 Maverick, which holds no other seat. WRITER SEATS (skeleton, build, deep-dive-revise, revise-N, dispute, handoff) are a Claude Code session running Sonnet 5, which builds and holds no panel seat. The Opus 5.5 panel seat is a DIFFERENT Anthropic model in a separate session: the owner's plan-highest-7 exception (an Anthropic model reviews a draft another Claude writes), not selfReview - no model writes and votes. ROUTING, because a NEEDS file names only its label: every label containing opus5.5-sub goes to the Opus 5.5 session (alternative-, alt-debate-, alt-reply-, panel-N-, including the suffixed forms panel-N-opus5.5-sub-retry, -reask1, -reask2 and alternative-opus5.5-sub-retry); skeleton, build, deep-dive-revise, revise-N, dispute and handoff go to the Sonnet 5 session. Nothing checks who wrote an answer. Dry run on a one-page feature task (2026-09-27, GPT-6 Luna in place of GPT-6 Sol on the owner's word: \"GPT 6 Sol is too expensive, take GPT 6 luna\"): $1.90 worst case at 7 rounds; under the default $7 cap. No Kimi, no xAI. Run once with real models (2026-09-28); none of its mechanisms has been measured. Price your task with `npm run dry` and get an explicit go before any paid run.",
+  "maxRounds": 7,
+  "signoff": "unanimous",
+  "dispute": { "enabled": true, "stall_rounds": 2 },
+  "proposals": { "parts": 3, "maxTokens": 4000 },
+  "debate": true,
+  "decisions": { "enabled": true },
+  "alternatives": { "enabled": true, "debaters": "all" },
+  "deep_dive": { "enabled": true, "job": "sources", "usd": 0.5, "maxCalls": 24, "chunkChars": 40000 },
+  "majority_guard": { "enabled": true },
+  "canary": { "enabled": true, "sampleRate": 0.1 },
+  "handoff": true,
+  "estimate": { "promptTokens": 10000, "draftTokens": 10000, "critiqueTokens": 5000 },
+  "seats": {
+    "criteria": { "provider": "openrouter", "model": "meta-llama/llama-4-maverick", "maxTokens": 36000, "lab": "llama4-maverick" },
+    "skeleton": { "provider": "external", "model": "claude-code-session" },
+    "builder": { "provider": "external", "model": "claude-code-session" },
+    "reviser": { "provider": "external", "model": "claude-code-session" },
+    "handoff": { "provider": "external", "model": "claude-code-session" },
+    "proposers": [
+      { "provider": "openrouter", "model": "tencent/hy4-preview", "maxTokens": 36000, "lab": "hy4-preview" },
+      { "provider": "openrouter", "model": "google/gemini-3.8-flash", "maxTokens": 36000, "lab": "gemini3.8-flash" },
+      { "provider": "openrouter", "model": "deepseek/deepseek-v4.1-flash", "maxTokens": 36000, "lab": "deepseek-v4.1-flash" },
+      { "provider": "openrouter", "model": "z-ai/glm-5.2", "maxTokens": 36000, "lab": "glm5.2" },
+      { "provider": "openrouter", "model": "meta/muse-spark-1.3", "maxTokens": 36000, "lab": "muse-spark1.3" },
+      { "provider": "openrouter", "model": "qwen/qwen3.8-max-0902", "maxTokens": 36000, "lab": "qwen3.8-max" },
+      { "provider": "openrouter", "model": "mistralai/mistral-medium-3-5", "maxTokens": 36000, "lab": "mistral-medium3.5" }
+    ],
+    "alternatives": [
+      { "provider": "external", "model": "subscription:opus-5.5", "lab": "opus5.5-sub" },
+      { "provider": "openrouter", "model": "openai/gpt-6-luna", "maxTokens": 36000, "lab": "gpt6-luna" },
+      { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" }
+    ],
+    "critics": [
+      { "provider": "external", "model": "subscription:opus-5.5", "lab": "opus5.5-sub" },
+      { "provider": "openrouter", "model": "openai/gpt-6-luna", "maxTokens": 36000, "lab": "gpt6-luna" },
+      { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" }
+    ],
+    "deep_dive": { "provider": "openrouter", "model": "deepseek/deepseek-v4.1-flash", "maxTokens": 36000, "lab": "deepseek-v4.1-flash" }
+  }
+}

package/chains/plan-highest-7.json

@@ -1,6 +1,6 @@
 {
   "name": "plan-highest-7",
-  "description": "Tiered council, Muad's design (2026-09-26): the highest models for the highest tasks, the cheapest models for the mass work. MASS SEATS (seats.proposers, the cheap-7-v2 roster: GPT-5.6 Luna, Gemini 3.8 Flash, DeepSeek V4.1 Flash, GLM 5.3 Flash, Qwen 3.7 Plus, MiniMax M3, Mistral Medium 3.5) write the blind proposals and all the proposal debate posts and replies, and post on the anchors' architectures (alternatives.debaters \"all\"). ANCHOR SEATS: GPT-6 Astra and Claude Fable 5.1 (his deliberate exception: an Anthropic model reviews a draft a Claude Code session writes), DeepSeek V4 Pro and GLM-5.3 write the whole alternative architectures (seats.alternatives), answer the posts on them, and form the review panel that must sign off unanimously (seats.critics). The mass seats argue; only the anchors vote, so a cheap majority can never out-vote them. DEEP-DIVE SEAT (seats.deep_dive, DeepSeek V4.1 Flash, a mass-tier model: it must not share a lab with a voting anchor, chain-lint deep-dive-votes): one job, checking the first draft against every part of the task, 40,000 characters per call at a 36k output cap, up to 24 calls under its OWN $4 cap inside the run's; it does not vote, and the reviser answers its findings before the anchors' first review. The MAJORITY GUARD is ON (majority_guard, Muad's go 2026-09-26; off in every other shipped chain but mock-tiered): authors see each argument once with no lab letter or count, the reply prompts carry an evidence bar, and a withdrawal that does not quote the argument it concedes to is kept for the builder. Criteria move to Llama 4 Maverick, which holds no other seat. Same Claude Code writer seats and stages as plan-premium-7, including decision records and the dispute stage. No Kimi, no xAI. Untested with real models: price it with `npm run dry` and get an explicit go before any paid run.",
+  "description": "Tiered council, Muad's design (2026-09-26): the highest models for the highest tasks, the cheapest models for the mass work. MASS SEATS (seats.proposers, the cheap-7-v2 roster: GPT-5.6 Luna, Gemini 3.8 Flash, DeepSeek V4.1 Flash, GLM 5.3 Flash, Qwen 3.7 Plus, MiniMax M3, Mistral Medium 3.5) write the blind proposals and all the proposal debate posts and replies, and post on the anchors' architectures (alternatives.debaters \"all\"). ANCHOR SEATS: GPT-6 Astra and Claude Opus 5.5 (Muad's pick 2026-09-26, in place of Fable 5.1; still his deliberate exception: an Anthropic model reviews a draft a Claude Code session writes), DeepSeek V4 Pro and GLM-5.3 write the whole alternative architectures (seats.alternatives), answer the posts on them, and form the review panel that must sign off unanimously (seats.critics). The mass seats argue; only the anchors vote, so a cheap majority can never out-vote them. DEEP-DIVE SEAT (seats.deep_dive, DeepSeek V4.1 Flash, a mass-tier model: it must not share a lab with a voting anchor, chain-lint deep-dive-votes): one job, checking the first draft against every part of the task, 40,000 characters per call at a 36k output cap, up to 24 calls under its OWN $4 cap inside the run's; it does not vote, and the reviser answers its findings before the anchors' first review. The MAJORITY GUARD is ON (majority_guard, Muad's go 2026-09-26; off in every other shipped chain but mock-tiered): authors see each argument once with no lab letter or count, the reply prompts carry an evidence bar, and a withdrawal that does not quote the argument it concedes to is kept for the builder. Criteria move to Llama 4 Maverick, which holds no other seat. Same Claude Code writer seats and stages as plan-premium-7, including decision records and the dispute stage. No Kimi, no xAI. Untested with real models: price it with `npm run dry` and get an explicit go before any paid run.",
   "maxRounds": 7,
   "signoff": "unanimous",
   "dispute": { "enabled": true, "stall_rounds": 2 },
@@ -30,13 +30,13 @@
     ],
     "alternatives": [
       { "provider": "openrouter", "model": "openai/gpt-6-astra", "maxTokens": 36000, "lab": "gpt6-astra" },
-      { "provider": "openrouter", "model": "anthropic/claude-fable-5.1", "maxTokens": 36000, "lab": "fable5.1" },
+      { "provider": "openrouter", "model": "anthropic/claude-opus-5.5", "maxTokens": 36000, "lab": "opus5.5", "estimate": { "critiqueTokens": 10000 } },
       { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" },
       { "provider": "openrouter", "model": "z-ai/glm-5.3", "maxTokens": 64000, "lab": "glm5.3" }
     ],
     "critics": [
       { "provider": "openrouter", "model": "openai/gpt-6-astra", "maxTokens": 36000, "lab": "gpt6-astra" },
-      { "provider": "openrouter", "model": "anthropic/claude-fable-5.1", "maxTokens": 36000, "lab": "fable5.1" },
+      { "provider": "openrouter", "model": "anthropic/claude-opus-5.5", "maxTokens": 36000, "lab": "opus5.5", "estimate": { "critiqueTokens": 10000 } },
       { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" },
       { "provider": "openrouter", "model": "z-ai/glm-5.3", "maxTokens": 64000, "lab": "glm5.3" }
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "the-high-council",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "mcpName": "io.github.muad-yasin/the-high-council",
   "description": "The High Council: a multi-model planning harness. One builder, independent critics from other labs, checkable acceptance criteria, a debate on the record, and a hard stop.",
   "type": "module",

package/schemas/report-v1.json

@@ -83,7 +83,7 @@
     "outcome": {
       "x-stability": "stable",
       "enum": ["consensus", "no_consensus", "degraded"],
-      "description": "Verdict class, computed by src/outcome.js from the rest of this file. `degraded` wins: some seat dropped out, abstained, or no reviewer was heard, so the intended roster never reached a verdict. Otherwise `consensus` if passed, else `no_consensus`."
+      "description": "Verdict class, computed by src/outcome.js from the rest of this file. `degraded` wins: a seated lab produced nothing usable (it dropped out, see `dropouts[]`: in a tiered chain this may be a debating seat that never votes), a reviewer abstained, no reviewer was heard, or the round fell short of the quorum - so the run did not have the roster the chain intended. Otherwise `consensus` if passed, else `no_consensus`."
     },
     "lastCritique": {
       "x-stability": "stable",
@@ -234,7 +234,8 @@
           "model": { "type": "string" },
           "verdict": { "enum": ["signed_off", "objected", "passed", "unheard"] },
           "reason_code": { "anyOf": [{ "type": "null" }, { "$ref": "#/$defs/abstentionReason" }] },
-          "reasked": { "type": "boolean", "description": "True if the seat was unheard once and asked again this round." }
+          "reasked": { "type": "boolean", "description": "True if the seat was unheard once and asked again this round." },
+          "carried": { "type": "boolean", "description": "Present and true when the seat was not asked this round: the draft was byte-identical to the last round's, where this seat was heard and clean, and only the unheard seat(s) were asked again (0.7.9). Absent otherwise." }
         }
       },
       "description": "Every critic's verdict in every review round, both sign-off modes. The per-round history that signoff[] (final round only) does not keep."
@@ -614,7 +615,8 @@
         },
         "passed": { "type": "boolean", "description": "True if the seat stated a pass (declined to give a verdict, with a reason). Not the same as the top-level `passed`." },
         "passReason": { "type": ["string", "null"] },
-        "reason_code": { "anyOf": [{ "type": "null" }, { "$ref": "#/$defs/abstentionReason" }] }
+        "reason_code": { "anyOf": [{ "type": "null" }, { "$ref": "#/$defs/abstentionReason" }] },
+        "seat_index": { "type": "integer", "description": "The seat's index in the chain's seats.critics (0.7.9). A relay panel lists signoff[] in its review order, so array position is not the seat; replay and rematch diffs key on this. Absent on earlier reports." }
       }
     },
     "proposal": {
@@ -684,14 +686,14 @@
         },
         "dropped": {
           "type": "array",
-          "description": "Experimental (0.7.8). Debate posts and author replies the stage's filters rejected, one row per stage, lab and reason; [] when none were. Absent in runs made before 0.7.8. Reasons: for stage 'debate' unknown_target, own_proposal, bad_stance, unreadable; for stage 'replies' unknown_target, not_own_proposal, not_posted_on, bad_action, unreadable. An 'unreadable' row counts whole replies that did not parse, not posts.",
+          "description": "Experimental (0.7.8). Debate posts and author replies the stage's filters rejected, one row per stage, lab and reason; [] when none were. Absent in runs made before 0.7.8. Reasons: for stage 'debate' unknown_target, own_proposal, bad_stance, unreadable, provider_error; for stage 'replies' unknown_target, not_own_proposal, not_posted_on, bad_action, unreadable, provider_error. An 'unreadable' row counts whole replies that did not parse, not posts; 'provider_error' (0.7.9) counts whole replies the provider ended with stop error, content_filter or refusal on the first try and on its one retry.",
           "items": {
             "type": "object",
             "required": ["stage", "by", "reason", "count"],
             "properties": {
               "stage": { "enum": ["debate", "replies"] },
               "by": { "type": "string", "description": "The lab whose post or reply was dropped." },
-              "reason": { "enum": ["unknown_target", "own_proposal", "bad_stance", "not_own_proposal", "not_posted_on", "bad_action", "unreadable"] },
+              "reason": { "enum": ["unknown_target", "own_proposal", "bad_stance", "not_own_proposal", "not_posted_on", "bad_action", "unreadable", "provider_error"] },
               "count": { "type": "integer", "minimum": 1 }
             }
           }

package/src/api.js

@@ -72,9 +72,9 @@ export function price({ chain, cwd = process.cwd(), rounds } = {}) {
 }
 
 // The ceiling is never silently off. undefined: the CLI's own default (MAX_USD_PER_RUN, else $7).
-// A positive number: that ceiling. 'none': no ceiling, said explicitly. The CLI and the MCP tool
-// read 0 as "no ceiling"; here 0 is refused, because a caller who wrote 0 almost certainly meant
-// "spend nothing", and reading it as "spend without limit" is the costliest possible guess.
+// A positive number: that ceiling. 'none': no ceiling, said explicitly. 0 is refused, because a
+// caller who wrote 0 almost certainly meant "spend nothing", and reading it as "spend without limit"
+// is the costliest possible guess. Since 0.7.9 the CLI and the MCP tools refuse it too.
 function maxUsdArgs(maxUsd) {
   if (maxUsd === undefined) return [];
   if (maxUsd === 'none') return ['--max-usd', 'none'];
@@ -110,8 +110,12 @@ function runCli(args, { cwd, env, onOutput, signal }) {
     };
     child.stdout.on('data', take('stdout'));
     child.stderr.on('data', take('stderr'));
-    child.on('error', reject);
-    child.on('close', (code, sig) => resolvePromise({ exitCode: code, signal: sig, outputTail: tail.join('').split('\n').slice(-40).join('\n') }));
+    // Bug audit 2026-09-28 (area 4 MED-1): an abort rejected on 'error', before the child had exited,
+    // so a caller that resumed at once could meet a run still marked running. The abort now settles
+    // only on 'close'; any other spawn error rejects at once, as before.
+    let aborted = null;
+    child.on('error', err => { if (err?.name === 'AbortError') aborted = err; else reject(err); });
+    child.on('close', (code, sig) => aborted ? reject(aborted) : resolvePromise({ exitCode: code, signal: sig, outputTail: tail.join('').split('\n').slice(-40).join('\n') }));
   });
 }
 
@@ -120,7 +124,7 @@ function runCli(args, { cwd, env, onOutput, signal }) {
  * spend ceiling, or refused by a guard. Resolves in every one of those cases (read `status` and
  * `exitCode`); rejects only when the child process could not be started or was aborted.
  */
-export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, draft, fromRun, context, piiGate, env, onOutput, signal } = {}) {
+export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, draft, fromRun, context, piiGate, allowSecretShaped, env, onOutput, signal } = {}) {
   const work = resolve(cwd);
   chainPath(chain, work); // a clear error here beats a CLI usage message
   if (typeof task !== 'string' || !task) throw new TypeError('task: a path to the task file');
@@ -137,8 +141,15 @@ export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, dr
     if (piiGate !== 'warn' && piiGate !== 'hard-stop') throw new RangeError(`piiGate: 'warn' or 'hard-stop', got ${JSON.stringify(piiGate)}`);
     args.push('--pii-gate', piiGate);
   }
-  const res = await runCli(args, { cwd: work, env, onOutput, signal });
+  // 0.7.9 outbound key scan: the one override (saved in run.json, so a resume keeps it).
+  if (allowSecretShaped === true) args.push('--allow-secret-shaped');
   const runDir = join(work, 'runs', id);
+  // Area 4 MED-1: an aborted run's stages stay on disk and can be resumed, so the rejection says
+  // which run it was (`runId`, and `runDir` once the folder exists).
+  const res = await runCli(args, { cwd: work, env, onOutput, signal }).catch(err => {
+    if (err && typeof err === 'object') Object.assign(err, { runId: id, runDir: existsSync(runDir) ? runDir : null });
+    throw err;
+  });
   return { runId: id, runDir: existsSync(runDir) ? runDir : null, ...res, ...(existsSync(runDir) ? statusOf(runDir) : { status: 'not_started', report: null }) };
 }
 
@@ -146,11 +157,12 @@ export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, dr
  * Resume a paused run (after its external stage was answered) or one the spend ceiling stopped
  * (pass a higher maxUsd). Stages already on disk replay from disk and cost nothing again.
  */
-export async function resume({ runDir, cwd = process.cwd(), maxUsd, env, onOutput, signal } = {}) {
+export async function resume({ runDir, cwd = process.cwd(), maxUsd, allowSecretShaped, env, onOutput, signal } = {}) {
   const work = resolve(cwd);
   const dir = resolve(work, runDir ?? '');
   if (!runDir || !existsSync(join(dir, 'run.json'))) throw new Error(`runDir: not a run folder with a run.json: ${dir}`);
-  const res = await runCli(['--resume', dir, ...maxUsdArgs(maxUsd)], { cwd: work, env, onOutput, signal });
+  // Verify pass 2026-09-28 F1(b): continue a run the outbound key scan stopped.
+  const res = await runCli(['--resume', dir, ...maxUsdArgs(maxUsd), ...(allowSecretShaped === true ? ['--allow-secret-shaped'] : [])], { cwd: work, env, onOutput, signal });
   return { runId: basename(dir), runDir: dir, ...res, ...statusOf(dir) };
 }
 

package/src/chain-lint.js

@@ -763,7 +763,7 @@ export function lintChain(config, filePath = '<chain>') {
     try { roster = resolveChainSeats(config || {}); } catch { /* malformed config: check the raw one */ }
     const walk = (node, path) => {
       if (!node || typeof node !== 'object') return;
-      if (typeof node.provider === 'string' && 'model' in node) {
+      if (typeof node.provider === 'string') {
         const reasons = keyDestinationReasons(node);
         if (reasons.length) {
           findings.push({
@@ -806,6 +806,29 @@ export function lintChain(config, filePath = '<chain>') {
     });
   }
 
+  // extra-models-unpriced (bug audit 2026-09-27 H1): a priced seat's OpenRouter fallbacks
+  // (extra.models) may answer instead of its model. invoke() charges an unpriced answer at the seat's
+  // own price, which understates a dearer fallback; a price entry for each fallback keeps the cap honest.
+  {
+    const walk = (node, path) => {
+      if (!node || typeof node !== 'object') return;
+      if (typeof node.provider === 'string' && typeof node.model === 'string' && Array.isArray(node.extra?.models)
+          && node.provider !== 'mock' && node.provider !== 'external' && priceOf(node.provider, node.model)) {
+        for (const m of node.extra.models) {
+          if (typeof m === 'string' && !priceOf(node.provider, m)) {
+            findings.push({
+              kind: 'extra-models-unpriced',
+              message: `${path}: fallback model "${m}" in extra.models has no price in src/pricing.json, so when it answers the spend cap would charge it at ${node.model}'s price.`,
+              fix: `Add "${node.provider}/${m}" to src/pricing.json, or remove it from extra.models in ${filePath}.`,
+            });
+          }
+        }
+      }
+      for (const [k, v] of Object.entries(node)) if (k !== 'extra') walk(v, path ? `${path}.${k}` : k);
+    };
+    walk(seats, 'seats');
+  }
+
   // Tiered councils (2026-09-26): anchor seats, mass seats, a deep-dive seat. Each rule names a
   // config that would silently do nothing, or spend without a ceiling.
   const dd = config?.deep_dive;