the-high-council 0.7.8 → 0.8.0

package/README.md

@@ -7,7 +7,8 @@ You choose the number of debate rounds, the seats and labs (any lab except xAI),
 limit for each model's replies.
 
 We recommend our own chains: `cheap-7-v2`, `plan-premium-7` and `plan-highest-7` (the top
-models, GPT-6 Astra, Claude Fable 5.1, DeepSeek V4 Pro and GLM-5.3, write the alternative
+models, GPT-6 Astra, Claude Opus 5.5, DeepSeek V4 Pro
+and GLM-5.3, write the alternative
 architectures and are the only seats that vote; cheaper seats write the proposals and the debate). You can also edit a chain to suit yourself, or run every seat on
 your own machine with `local-ollama`.
 
@@ -40,8 +41,8 @@ Three commands from nothing to a priced run of your own idea (no key needed unti
 | Chain | Who does what | Needs | Worst case |
 |---|---|---|---|
 | `cheap-7-v2` | Claude Sonnet 5 writes the plan; low-cost models from seven other labs review it, and all seven must sign off. Up to 7 rounds. | one OpenRouter key | $5.38 |
-| `plan-premium-7` | A Claude Code session writes the plan; a seven-lab panel of larger models (GPT-6 Astra, Claude Fable 5.1, Gemini 3.8 Flash, Muse Spark 1.2, Qwen 3.8 Max, DeepSeek V4 Pro, GLM-5.3) proposes, debates and reviews. | OpenRouter key + a Claude Code session | $21.59 |
-| `plan-highest-7` | Seven low-cost models propose and debate; four top models write whole architectures and are the only reviewers; one deep-dive seat checks the first draft against the task. **Untested with real models.** | OpenRouter key + a Claude Code session | $14.89 |
+| `plan-premium-7` | A Claude Code session writes the plan; a seven-lab panel of larger models (GPT-6 Astra, Claude Fable 5.1, Gemini 3.8 Flash, Muse Spark 1.2, Qwen 3.8 Max, DeepSeek V4 Pro, GLM-5.3) proposes, debates and reviews. | OpenRouter key + a Claude Code session | $22.30 |
+| `plan-highest-7` | Seven low-cost models propose and debate; four top models write whole architectures and are the only reviewers; one deep-dive seat checks the first draft against the task. **Untested with real models.** | OpenRouter key + a Claude Code session | $11.21 |
 | `local-ollama` | Every seat on your own machine, through Ollama. | Ollama and the models pulled | $0 |
 
 `plan-premium-7` and `plan-highest-7` cost more than the default cap, so give them a `--max-usd` at
@@ -147,7 +148,10 @@ A run moves through fixed stages. Which stages fire depends on the chain you pic
 7. **Panel review** - every critic independently grades the draft against the acceptance criteria,
    blind. Not unanimous? It revises against the union of every objection and the panel reviews
    again, up to the chain's round cap.
-8. **Handoff** - a `HANDOFF.md` written for whoever executes the result.
+8. **Handoff** - a `HANDOFF.md` written for whoever executes the result. It ends with a block the
+   harness writes, not a model: the acceptance criteria the run settled, with a fingerprint.
+   `council check-lock HANDOFF.md` ($0) says whether a copy still carries them; it catches an edit or
+   a slip, and is not a signature.
 
 Some chains add optional stages to this: whole alternative architectures written blind before
 the skeleton, a deep-dive check of the first draft, a dispute stage that records unresolved
@@ -156,6 +160,12 @@ objections at the top of the plan, and a final security review.
 Every run writes a folder: the deliverable, `BOARD.md` (the full debate - every post, every
 withdrawal), `HANDOFF.md`, a per-lab scoreboard, and the real token/cost accounting.
 
+A run that stopped before it wrote its handoff (the spend cap, an abandoned pause, a crash) can get one from
+its latest draft: `council handoff --from-run runs/<id>`. It is one call on the chain's handoff seat, under the
+run's own spend cap (what the folder already cost counts toward it; `--max-usd N` is a total, as on `--resume`),
+the same policy check and key scan as a run, and a run no panel signed off gets a note at the top, written by
+the harness, saying so. It never overwrites an existing `HANDOFF.md`.
+
 ### Reading a run with a program
 
 `BOARD.md` is for people. **`report.json` is the same board, structured** - if you are building
@@ -275,8 +285,8 @@ ones. Put only the keys your chosen chain needs in that `.env`, one `NAME=value`
 `DEEPSEEK_API_KEY` · `GROQ_API_KEY` · `TOGETHER_API_KEY` · `COHERE_API_KEY` ·
 `OPENROUTER_API_KEY` · `ZAI_API_KEY`
 
-xAI/Grok is never seated, and neither is a router id (`openrouter/auto`, the Pareto Code router)
-that could route to it: chain-lint refuses such a chain and the run itself refuses such a seat,
+xAI/Grok is never seated, and neither is a router id (`openrouter/auto`, the Pareto Code router,
+any other `openrouter/<name>` id) that could route to it: chain-lint refuses such a chain and the run itself refuses such a seat,
 with no override. There is no `xai` provider. Kimi/Moonshot models are not in any chain this
 package ships, but you may seat one in a chain of your own.
 
@@ -419,10 +429,10 @@ Each outcome has its own code, so a script or CI job can branch on it:
 | 8 | Finished, but the final security review could not judge it (never a pass). |
 | 9 | Artifact gate: the task names files whose content it never includes (`BLOCKED-ARTIFACTS.md`). |
 | 10 | Preflight: a seat objected to the task description itself (`STOPPED-preflight.md`). |
-| 11 | PII gate (`--pii-gate hard-stop`): the input matches a PII shape or one of the key formats listed in `src/secret-patterns.js`. |
+| 11 | Something in the input must not be sent: a prompt matches one of the key formats listed in `src/secret-patterns.js` (checked by default; `--allow-secret-shaped` overrides), or, under `--pii-gate hard-stop`, a PII shape. |
 | 12 | `policy.json` refused the chain. |
 | 13 | Another process is already running this run folder. |
-| 14 | The task file changed since the run started and `AMENDMENTS.md` does not cover it. |
+| 14 | The task file, or (since 0.8.0) a `--context` document, changed since the run started and `AMENDMENTS.md` does not cover it. The message prints the hashes to write; a context hash is written `ctx-<hash>`. |
 | 15 | `--resume` of a run that already finished (it has a `report.json`); nothing is run or spent. |
 | 16 | The run stopped at an unexpected error (a seat that could not be reached, a crash); `STOPPED-error.md` says what, and `--resume` continues from the completed stages. |
 | 17 | A draft (build, revise, dispute, final edit or handoff) was cut off at its token cap, and its one larger-cap retry was cut off too; the fragment is never graded or shipped (`STOPPED-truncated.md`). |
@@ -460,7 +470,7 @@ than reporting the overspend afterwards.
 
 ```bash
 council --task tasks/x.md --max-usd 2     # this run stops at $2
-council --task tasks/x.md --max-usd none  # no ceiling
+council --task tasks/x.md --max-usd none  # no ceiling (0 is refused: it used to mean this)
 export MAX_USD_PER_RUN=20                         # change the default
 ```
 
@@ -612,7 +622,7 @@ for anyone with a subscription, since the project's cost story depends on it.
 
 ## Chains
 
-51 chain configs live in `chains/`. Each one is plain JSON - the seat roster, which models fill
+52 chain configs live in `chains/`. Each one is plain JSON - the seat roster, which models fill
 which seat, the round cap, and whether proposals/debate/handoff stages run. They are meant to be
 copied and edited.
 
@@ -623,6 +633,12 @@ in the table at the top. A few more worth knowing:
   and Google keys.
 - **`plan-open-7`** - the `cheap-7-v2` panel, with a Claude Code session writing the plan instead
   of a paid seat.
+- **`plan-daily-7`** - `plan-highest-7`'s stages at a lower price, for planning one feature:
+  Claude Opus 5.5 on your Claude subscription (an external seat), GPT-6 Luna and DeepSeek V4 Pro
+  write the architectures and alone vote; seven low-cost labs propose and debate. Two Claude Code
+  sessions answer its external seats: Opus 5.5 every stage whose label contains `opus5.5-sub`
+  (including `-retry` and `-reask1`/`-reask2` forms), Sonnet 5 the writer stages. $1.90 worst case.
+  **Run once with real models (2026-09-28); nothing about it has been measured.**
 - **`cheap`** - small models throughout. For testing the harness itself, not for real work.
 - **`plan-debate`** - five labs propose blind, debate each other's proposals anonymised, then a
   blind panel grades the integrated draft.
@@ -654,7 +670,7 @@ Read a chain's `description` field before running it; they say what they cost yo
 - **`quorum: { "minHeard": N }`** - opt-in, unanimous chains only, set in no shipped chain. A
   round's sign-off counts only when at least N reviewers gave a verdict (signed off or objected);
   a round short of it is recorded as `notQuorate`, the run does not pass, and the loop stops.
-- **Tiered councils (experimental, used by `plan-highest-7` and `mock-tiered`).**
+- **Tiered councils (experimental, used by `plan-highest-7`, `plan-daily-7` and `mock-tiered`).**
   `seats.alternatives` names who writes the whole alternative architectures, separately from the
   proposers. `deep_dive` + `seats.deep_dive` add one non-voting seat with its own dollar cap
   (`usd`, required) inside the run's cap. `majority_guard.enabled` shows each author every
@@ -720,6 +736,9 @@ what each rule guards against and why. Copy the folders you want into your proje
   input plus the seat's entire `maxTokens` budget billed as output (doubled for Anthropic seats,
   which may retry once). Real stages almost never cost that much, so a run can stop with headroom
   left. That is the intended trade - resume it with a higher ceiling.
+- The dry run (`--dry-run`, MCP `dry_run`) prices the task alone and does not read `--context`
+  documents, so for a run with context its estimate is too low. The spend cap is not affected: it
+  checks every real prompt, context included, before each call.
 - A seat whose model has no entry in `src/pricing.json` is **unpriced, and therefore uncapped**.
   It contributes $0 to the running total no matter what it really costs. Check `dry_run` output
   for `unpriced` before trusting a ceiling. `ollama` seats are the one deliberate exception: they
@@ -740,11 +759,11 @@ what each rule guards against and why. Copy the folders you want into your proje
   oldest date every entry was last checked) is printed by `council doctor` and `--dry-run`, with a
   warning once it is more than 60 days old. The spend cap and every estimate use these static
   prices. They are estimates, not invoices. Your provider's bill is the real number.
-- `plan-highest-7`, the tiered council, has not been run with real models, and none of its
-  mechanisms (tiers, the deep-dive seat, the majority guard) has been measured. Its dry-run price
-  is a projection.
-- Seats marked `external` (the writer seats in `plan-premium-7`, `plan-highest-7` and
-  `plan-open-7`) pause the run until someone answers them, and are $0 only because a Claude Code
+- `plan-highest-7` has not been run with real models, and `plan-daily-7` has run once
+  (2026-09-28). None of the tiered councils' mechanisms (tiers, the deep-dive seat, the majority
+  guard) has been measured. Their dry-run prices are projections.
+- Seats marked `external` (the writer seats in `plan-premium-7`, `plan-highest-7`,
+  `plan-daily-7` and `plan-open-7`, and the Opus 5.5 anchor seat in `plan-daily-7`) pause the run until someone answers them, and are $0 only because a Claude Code
   session on a subscription writes them. Nothing checks who wrote the answer.
 - Chains with many labs and high round caps get expensive quickly. `plan-unanimous` at three rounds
   is fifteen critic calls; `plan-auto` runs several frontier models over multiple rounds. Price
@@ -758,6 +777,10 @@ what each rule guards against and why. Copy the folders you want into your proje
   which is the default, it does not detect a full rewrite**: anyone who can edit the file can
   recompute every hash. Set `AUDIT_HMAC_KEY_FILE` to a key kept outside the run folder if the log
   has to stand up to that.
+- The outbound key scan matches **key shapes only**, the formats in `src/secret-patterns.js`; a
+  password written in prose is not detectable. Generic shapes (a password inside a URL or an
+  assignment) are checked in your inputs before the run; text the models write is checked only for
+  distinctive key formats.
 
 ## Privacy
 

package/chains/cheap-7-v2.json

@@ -1,6 +1,7 @@
 {
   "name": "cheap-7-v2",
   "description": "Seven independent labs vote, none of them the author's, all on current-generation models through one OpenRouter key: OpenAI GPT-5.6 Luna, Google Gemini 3.8 Flash, DeepSeek v4.1 Flash, Z.ai GLM 5.3 Flash, Qwen 3.7 Plus, MiniMax M3, Mistral Medium 3.5. Blind proposals, debate, unanimous signoff, with a round cap of 7 and a stall rule: if the same objections from the same labs survive two rounds running, the revise loop stops rather than buying more rounds of the same argument, and the unresolved dissent is recorded at the top of the deliverable. A run that ends that way reports no consensus - the dispute stage records disagreement, it never resolves it. Anthropic Sonnet 5 writes the skeleton, the draft, every revision and the handoff and holds NO panel seat; Meta Llama 4 Maverick writes the criteria and also holds no panel seat, so neither the lab that drafts nor the lab that sets the bar votes on whether the bar was cleared. This is the revision of cheap-7 after its first real run, where one lab held the criteria, skeleton, builder, reviser and handoff seats AND a critic seat, voted on its own draft, and a claim it wrote survived to the deliverable. Anthropic is deliberately absent from the panel: plans from this chain are read by a Claude session before anything is built, so that review happens downstream rather than inside the vote. Kimi K3 is deliberately absent too - a seat that may route through another lab is not an independent seat. Every seat gets a 36000-token ceiling and reasoning is left on: a debate is not squeezed to a short answer, and a reply cut off at the ceiling is retried once, then the seat is re-asked alone - it is never counted as agreement. The cap is a ceiling, not a price; only generated tokens are billed. Prices are from src/pricing.json, refreshed against OpenRouter's live model list on 2026-09-20 - price a real task with `npm run dry` before running.",
+  "summary": "Seven labs on one OpenRouter key: blind proposals, debate, unanimous sign-off.",
   "maxRounds": 7,
   "signoff": "unanimous",
   "dispute": {

package/chains/local-ollama.json

@@ -1,6 +1,7 @@
 {
   "name": "local-ollama",
   "description": "BYO-hardware: every seat runs on a local Ollama instance. No API key, no spend - `dry_run` prices this chain at $0. Swap the model names for whatever you've pulled (`ollama pull <model>`); swap `baseUrl` if Ollama (or an LM Studio / other OpenAI-compatible local runner) listens somewhere other than the default `http://localhost:11434/v1`.",
+  "summary": "Every seat on a local Ollama model: no API key and no spend.",
   "maxRounds": 2,
   "stopOnPass": true,
   "estimate": {

package/chains/plan-daily-7.json

@@ -0,0 +1,44 @@
+{
+  "name": "plan-daily-7",
+  "description": "daily7 (the owner's name, 2026-09-27: cheap API seats, and the expensive Opus 5.5 seat runs on a local Claude Code session). Tiered council for planning ONE feature cheaply (Muad, 2026-09-27: \"Opus 5.5 on a local sub that does the important tasks from the highest7 setup ... all together ~1$ per council run\"). Same stages and flags as plan-highest-7 (alternatives, debate, decision records, deep dive, majority guard ON, canary, dispute, handoff); only the seats and the deep-dive cap differ. ANCHOR SEATS write the whole alternative architectures (seats.alternatives), answer the posts on them, and are the only panel that votes, unanimously (seats.critics): Claude Opus 5.5 on the owner's Claude subscription (provider external, model subscription:opus-5.5, lab opus5.5-sub: $0 API, a separate Opus 5.5 Claude Code session answers its paused stages), GPT-6 Luna and DeepSeek V4 Pro through OpenRouter. MASS SEATS (seats.proposers, seven labs from the strong and low-cost part of arena.ai's agent leaderboard, fetched 2026-09-27): Tencent Hy4 preview, Gemini 3.8 Flash, DeepSeek V4.1 Flash, GLM 5.2, Muse Spark 1.3, Qwen 3.8 Max, Mistral Medium 3.5 (kept on the owner's word) write the blind proposals and every debate post and reply, and post on the anchors' architectures (alternatives.debaters \"all\"); they argue, they never vote. DEEP-DIVE SEAT: DeepSeek V4.1 Flash, a mass-tier model (a different model from the voting V4 Pro, so chain-lint deep-dive-votes passes), under its own $0.50 cap: a feature-sized task is one 40,000-character call, and a $4 sub-cap would be larger than this chain's whole worst case. Criteria: Llama 4 Maverick, which holds no other seat. WRITER SEATS (skeleton, build, deep-dive-revise, revise-N, dispute, handoff) are a Claude Code session running Sonnet 5, which builds and holds no panel seat. The Opus 5.5 panel seat is a DIFFERENT Anthropic model in a separate session: the owner's plan-highest-7 exception (an Anthropic model reviews a draft another Claude writes), not selfReview - no model writes and votes. ROUTING, because a NEEDS file names only its label: every label containing opus5.5-sub goes to the Opus 5.5 session (alternative-, alt-debate-, alt-reply-, panel-N-, including the suffixed forms panel-N-opus5.5-sub-retry, -reask1, -reask2 and alternative-opus5.5-sub-retry); skeleton, build, deep-dive-revise, revise-N, dispute and handoff go to the Sonnet 5 session. Nothing checks who wrote an answer. Dry run on a one-page feature task (2026-09-27, GPT-6 Luna in place of GPT-6 Sol on the owner's word: \"GPT 6 Sol is too expensive, take GPT 6 luna\"): $1.90 worst case at 7 rounds; under the default $7 cap. No Kimi, no xAI. Run once with real models (2026-09-28); none of its mechanisms has been measured. Price your task with `npm run dry` and get an explicit go before any paid run.",
+  "summary": "One feature: three anchors write architectures and vote, seven low-cost labs debate; Opus 5.5 via your Claude plan.",
+  "maxRounds": 7,
+  "signoff": "unanimous",
+  "dispute": { "enabled": true, "stall_rounds": 2 },
+  "proposals": { "parts": 3, "maxTokens": 4000 },
+  "debate": true,
+  "decisions": { "enabled": true },
+  "alternatives": { "enabled": true, "debaters": "all" },
+  "deep_dive": { "enabled": true, "job": "sources", "usd": 0.5, "maxCalls": 24, "chunkChars": 40000 },
+  "majority_guard": { "enabled": true },
+  "canary": { "enabled": true, "sampleRate": 0.1 },
+  "handoff": true,
+  "estimate": { "promptTokens": 10000, "draftTokens": 10000, "critiqueTokens": 5000 },
+  "seats": {
+    "criteria": { "provider": "openrouter", "model": "meta-llama/llama-4-maverick", "maxTokens": 36000, "lab": "llama4-maverick" },
+    "skeleton": { "provider": "external", "model": "claude-code-session" },
+    "builder": { "provider": "external", "model": "claude-code-session" },
+    "reviser": { "provider": "external", "model": "claude-code-session" },
+    "handoff": { "provider": "external", "model": "claude-code-session" },
+    "proposers": [
+      { "provider": "openrouter", "model": "tencent/hy4-preview", "maxTokens": 36000, "lab": "hy4-preview" },
+      { "provider": "openrouter", "model": "google/gemini-3.8-flash", "maxTokens": 36000, "lab": "gemini3.8-flash" },
+      { "provider": "openrouter", "model": "deepseek/deepseek-v4.1-flash", "maxTokens": 36000, "lab": "deepseek-v4.1-flash" },
+      { "provider": "openrouter", "model": "z-ai/glm-5.2", "maxTokens": 36000, "lab": "glm5.2" },
+      { "provider": "openrouter", "model": "meta/muse-spark-1.3", "maxTokens": 36000, "lab": "muse-spark1.3" },
+      { "provider": "openrouter", "model": "qwen/qwen3.8-max-0902", "maxTokens": 36000, "lab": "qwen3.8-max" },
+      { "provider": "openrouter", "model": "mistralai/mistral-medium-3-5", "maxTokens": 36000, "lab": "mistral-medium3.5" }
+    ],
+    "alternatives": [
+      { "provider": "external", "model": "subscription:opus-5.5", "lab": "opus5.5-sub" },
+      { "provider": "openrouter", "model": "openai/gpt-6-luna", "maxTokens": 36000, "lab": "gpt6-luna" },
+      { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" }
+    ],
+    "critics": [
+      { "provider": "external", "model": "subscription:opus-5.5", "lab": "opus5.5-sub" },
+      { "provider": "openrouter", "model": "openai/gpt-6-luna", "maxTokens": 36000, "lab": "gpt6-luna" },
+      { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" }
+    ],
+    "deep_dive": { "provider": "openrouter", "model": "deepseek/deepseek-v4.1-flash", "maxTokens": 36000, "lab": "deepseek-v4.1-flash" }
+  }
+}

package/chains/plan-highest-7.json

@@ -1,6 +1,7 @@
 {
   "name": "plan-highest-7",
-  "description": "Tiered council, Muad's design (2026-09-26): the highest models for the highest tasks, the cheapest models for the mass work. MASS SEATS (seats.proposers, the cheap-7-v2 roster: GPT-5.6 Luna, Gemini 3.8 Flash, DeepSeek V4.1 Flash, GLM 5.3 Flash, Qwen 3.7 Plus, MiniMax M3, Mistral Medium 3.5) write the blind proposals and all the proposal debate posts and replies, and post on the anchors' architectures (alternatives.debaters \"all\"). ANCHOR SEATS: GPT-6 Astra and Claude Fable 5.1 (his deliberate exception: an Anthropic model reviews a draft a Claude Code session writes), DeepSeek V4 Pro and GLM-5.3 write the whole alternative architectures (seats.alternatives), answer the posts on them, and form the review panel that must sign off unanimously (seats.critics). The mass seats argue; only the anchors vote, so a cheap majority can never out-vote them. DEEP-DIVE SEAT (seats.deep_dive, DeepSeek V4.1 Flash, a mass-tier model: it must not share a lab with a voting anchor, chain-lint deep-dive-votes): one job, checking the first draft against every part of the task, 40,000 characters per call at a 36k output cap, up to 24 calls under its OWN $4 cap inside the run's; it does not vote, and the reviser answers its findings before the anchors' first review. The MAJORITY GUARD is ON (majority_guard, Muad's go 2026-09-26; off in every other shipped chain but mock-tiered): authors see each argument once with no lab letter or count, the reply prompts carry an evidence bar, and a withdrawal that does not quote the argument it concedes to is kept for the builder. Criteria move to Llama 4 Maverick, which holds no other seat. Same Claude Code writer seats and stages as plan-premium-7, including decision records and the dispute stage. No Kimi, no xAI. Untested with real models: price it with `npm run dry` and get an explicit go before any paid run.",
+  "description": "Tiered council, Muad's design (2026-09-26): the highest models for the highest tasks, the cheapest models for the mass work. MASS SEATS (seats.proposers, the cheap-7-v2 roster: GPT-5.6 Luna, Gemini 3.8 Flash, DeepSeek V4.1 Flash, GLM 5.3 Flash, Qwen 3.7 Plus, MiniMax M3, Mistral Medium 3.5) write the blind proposals and all the proposal debate posts and replies, and post on the anchors' architectures (alternatives.debaters \"all\"). ANCHOR SEATS: GPT-6 Astra and Claude Opus 5.5 (Muad's pick 2026-09-26, in place of Fable 5.1; still his deliberate exception: an Anthropic model reviews a draft a Claude Code session writes), DeepSeek V4 Pro and GLM-5.3 write the whole alternative architectures (seats.alternatives), answer the posts on them, and form the review panel that must sign off unanimously (seats.critics). The mass seats argue; only the anchors vote, so a cheap majority can never out-vote them. DEEP-DIVE SEAT (seats.deep_dive, DeepSeek V4.1 Flash, a mass-tier model: it must not share a lab with a voting anchor, chain-lint deep-dive-votes): one job, checking the first draft against every part of the task, 40,000 characters per call at a 36k output cap, up to 24 calls under its OWN $4 cap inside the run's; it does not vote, and the reviser answers its findings before the anchors' first review. The MAJORITY GUARD is ON (majority_guard, Muad's go 2026-09-26; off in every other shipped chain but mock-tiered): authors see each argument once with no lab letter or count, the reply prompts carry an evidence bar, and a withdrawal that does not quote the argument it concedes to is kept for the builder. Criteria move to Llama 4 Maverick, which holds no other seat. Same Claude Code writer seats and stages as plan-premium-7, including decision records and the dispute stage. No Kimi, no xAI. Untested with real models: price it with `npm run dry` and get an explicit go before any paid run.",
+  "summary": "Four anchor labs write architectures and vote; seven low-cost labs write proposals and debate.",
   "maxRounds": 7,
   "signoff": "unanimous",
   "dispute": { "enabled": true, "stall_rounds": 2 },
@@ -30,13 +31,13 @@
     ],
     "alternatives": [
       { "provider": "openrouter", "model": "openai/gpt-6-astra", "maxTokens": 36000, "lab": "gpt6-astra" },
-      { "provider": "openrouter", "model": "anthropic/claude-fable-5.1", "maxTokens": 36000, "lab": "fable5.1" },
+      { "provider": "openrouter", "model": "anthropic/claude-opus-5.5", "maxTokens": 36000, "lab": "opus5.5", "estimate": { "critiqueTokens": 10000 } },
       { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" },
       { "provider": "openrouter", "model": "z-ai/glm-5.3", "maxTokens": 64000, "lab": "glm5.3" }
     ],
     "critics": [
       { "provider": "openrouter", "model": "openai/gpt-6-astra", "maxTokens": 36000, "lab": "gpt6-astra" },
-      { "provider": "openrouter", "model": "anthropic/claude-fable-5.1", "maxTokens": 36000, "lab": "fable5.1" },
+      { "provider": "openrouter", "model": "anthropic/claude-opus-5.5", "maxTokens": 36000, "lab": "opus5.5", "estimate": { "critiqueTokens": 10000 } },
       { "provider": "openrouter", "model": "deepseek/deepseek-v4-pro", "maxTokens": 64000, "lab": "deepseek-v4-pro" },
       { "provider": "openrouter", "model": "z-ai/glm-5.3", "maxTokens": 64000, "lab": "glm5.3" }
     ],

package/chains/plan-premium-7.json

@@ -1,6 +1,7 @@
 {
   "name": "plan-premium-7",
   "description": "Premium panel, Muad's roster (2026-09-22): OpenAI GPT-6 Astra, Anthropic Claude Fable 5.1, Google Gemini 3.8 Flash, Meta Muse Spark 1.2, Qwen 3.8 Max, DeepSeek V4 Pro, Z.ai GLM-5.3 - seven labs, same stages and external Claude-role seats as plan-open-7. DELIBERATE EXCEPTION, Muad's call: an Anthropic model (Fable 5.1) sits on the panel although the draft is written by a Claude Code session, so this panel is not fully independent of the drafting lab - read its sign-off with that in mind. Criteria move to Mistral Medium 3.5, which holds no panel seat, because Meta now votes. No Kimi K3, no xAI. Each seat carries a persona (debate stage only; see PERSONAS.md): the five defaults plus Hypatia and Avicenna via COUNCIL_PERSONAS_FILE. Several times the cost of plan-open-7: price with `npm run dry` and get an explicit go first. Decision records and whole alternative architectures on (2026-09-23): each lab blind-proposes one whole architecture before the skeleton, the labs debate them, and the plan's Decisions section records why the losers lost.",
+  "summary": "Seven premium-tier labs argue whole architectures first; a Claude Code session writes the drafts.",
   "maxRounds": 7,
   "signoff": "unanimous",
   "dispute": {

package/chains/security-review-only.json

@@ -0,0 +1,29 @@
+{
+  "name": "security-review-only",
+  "description": "A tiny chain whose only real content is a human-supplied artifact and the final security-review gate (515439a, docs/security-review-gate.md). The builder seat is external: the CLI pauses, an operator (a person or an orchestrator like Sophi-A) pastes the artifact under review as the paused stage's own <label>.md, and resumes. No criteria call (criteria is hardcoded so that stage never runs) and one always-passing mock critic round, present only because chain-lint requires at least one seats.critics entry - this chain's real gate is security_review, not the critic panel. Exit 0 = pass, 7 = blocked, 8 = not_judged. Swap seats.security_reviewer's model to mock-security-block for the blocking path (this file's default), or to any other name (e.g. mock-security-clean) for the passing path - see docs/security-review-gate.md. Zero engine changes: this is a config-only chain built entirely from existing seat kinds and the existing security_review flag.",
+  "maxRounds": 1,
+  "criteria": [
+    "The artifact under review is present as the resumed external stage's content.",
+    "The final security-review gate ran and recorded a gate verdict."
+  ],
+  "seats": {
+    "builder": {
+      "provider": "external"
+    },
+    "critics": [
+      {
+        "provider": "mock",
+        "model": "mock-critic-passer",
+        "lab": "mock-passthrough"
+      }
+    ],
+    "security_reviewer": {
+      "provider": "mock",
+      "model": "mock-security-block",
+      "lab": "mock-security"
+    }
+  },
+  "security_review": {
+    "enabled": true
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "the-high-council",
-  "version": "0.7.8",
+  "version": "0.8.0",
   "mcpName": "io.github.muad-yasin/the-high-council",
   "description": "The High Council: a multi-model planning harness. One builder, independent critics from other labs, checkable acceptance criteria, a debate on the record, and a hard stop.",
   "type": "module",

package/schemas/report-v1.json

@@ -83,7 +83,7 @@
     "outcome": {
       "x-stability": "stable",
       "enum": ["consensus", "no_consensus", "degraded"],
-      "description": "Verdict class, computed by src/outcome.js from the rest of this file. `degraded` wins: some seat dropped out, abstained, or no reviewer was heard, so the intended roster never reached a verdict. Otherwise `consensus` if passed, else `no_consensus`."
+      "description": "Verdict class, computed by src/outcome.js from the rest of this file. `degraded` wins: a seated lab produced nothing usable (it dropped out, see `dropouts[]`: in a tiered chain this may be a debating seat that never votes), a reviewer abstained, no reviewer was heard, or the round fell short of the quorum - so the run did not have the roster the chain intended. Otherwise `consensus` if passed, else `no_consensus`."
     },
     "lastCritique": {
       "x-stability": "stable",
@@ -234,7 +234,8 @@
           "model": { "type": "string" },
           "verdict": { "enum": ["signed_off", "objected", "passed", "unheard"] },
           "reason_code": { "anyOf": [{ "type": "null" }, { "$ref": "#/$defs/abstentionReason" }] },
-          "reasked": { "type": "boolean", "description": "True if the seat was unheard once and asked again this round." }
+          "reasked": { "type": "boolean", "description": "True if the seat was unheard once and asked again this round." },
+          "carried": { "type": "boolean", "description": "Present and true when the seat was not asked this round: the draft was byte-identical to the last round's, where this seat was heard and clean, and only the unheard seat(s) were asked again (0.7.9). Absent otherwise." }
         }
       },
       "description": "Every critic's verdict in every review round, both sign-off modes. The per-round history that signoff[] (final round only) does not keep."
@@ -501,6 +502,141 @@
       },
       "description": "Present only on chains with argued.enabled: where the 'How this plan was argued' text is, and the check of every id and lab it names against this run's record."
     },
+    "criteria_sha256": {
+      "x-stability": "experimental",
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "sha256 over the criteria list, each criterion collapsed to one line, order counted (0.8.0). The same fingerprint the HANDOFF.md lock block carries; `council check-lock` compares them."
+    },
+    "criteria_lints": {
+      "x-stability": "experimental",
+      "type": "array",
+      "description": "Word-level lints over the acceptance criteria, run before any paid review round (0.8.0). Heuristics: they miss a rephrasing and can flag a good criterion. Recorded only: never a stop. [] when clean.",
+      "items": {
+        "type": "object",
+        "required": ["id", "message"],
+        "properties": {
+          "id": { "enum": ["no-consistency", "presence-heavy", "vague-word"] },
+          "message": { "type": "string" },
+          "criterion_ids": { "type": "array", "items": { "type": "string" } }
+        }
+      }
+    },
+    "criteria_ids": {
+      "x-stability": "experimental",
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Positional ids for `criteria`, index-aligned: C1, C2, ... (0.8.0)."
+    },
+    "missing_criteria": {
+      "x-stability": "experimental",
+      "type": "array",
+      "description": "Sign-offs whose criteria table left criteria out (0.8.0). Recorded only: no verdict, prompt or stop reads it. [] when there were none. A reply with no table at all is not listed.",
+      "items": {
+        "type": "object",
+        "required": [
+          "round",
+          "lab",
+          "criterion_ids"
+        ],
+        "properties": {
+          "round": {
+            "type": "integer"
+          },
+          "lab": {
+            "type": "string"
+          },
+          "criterion_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "table_rows": {
+            "type": "integer"
+          },
+          "criteria_total": {
+            "type": "integer"
+          }
+        }
+      }
+    },
+    "cut_despite_support": {
+      "x-stability": "experimental",
+      "type": "array",
+      "description": "Proposals the plan cut although another lab supported them in the debate (0.8.0). Derived from proposals[] and debate.posts[]; present only when the run had both.",
+      "items": {
+        "type": "object",
+        "required": [
+          "id",
+          "supporters"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "title": {},
+          "author_lab": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "supporters": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "objectors": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "note": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "disagreement_map": {
+      "x-stability": "experimental",
+      "type": "array",
+      "description": "One row per review round: each lab's verdict and the counts (0.8.0). Derived from panelVerdicts[]. A verdict marked `(carried)` was reused on an unchanged draft.",
+      "items": {
+        "type": "object",
+        "required": [
+          "round",
+          "labs"
+        ],
+        "properties": {
+          "round": {
+            "type": "integer"
+          },
+          "labs": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "signed_off": {
+            "type": "integer"
+          },
+          "objected": {
+            "type": "integer"
+          },
+          "unheard": {
+            "type": "integer"
+          },
+          "passed": {
+            "type": "integer"
+          }
+        }
+      }
+    },
     "criteria_kinds": {
       "x-stability": "experimental",
       "type": "array",
@@ -614,7 +750,8 @@
         },
         "passed": { "type": "boolean", "description": "True if the seat stated a pass (declined to give a verdict, with a reason). Not the same as the top-level `passed`." },
         "passReason": { "type": ["string", "null"] },
-        "reason_code": { "anyOf": [{ "type": "null" }, { "$ref": "#/$defs/abstentionReason" }] }
+        "reason_code": { "anyOf": [{ "type": "null" }, { "$ref": "#/$defs/abstentionReason" }] },
+        "seat_index": { "type": "integer", "description": "The seat's index in the chain's seats.critics (0.7.9). A relay panel lists signoff[] in its review order, so array position is not the seat; replay and rematch diffs key on this. Absent on earlier reports." }
       }
     },
     "proposal": {
@@ -684,14 +821,14 @@
         },
         "dropped": {
           "type": "array",
-          "description": "Experimental (0.7.8). Debate posts and author replies the stage's filters rejected, one row per stage, lab and reason; [] when none were. Absent in runs made before 0.7.8. Reasons: for stage 'debate' unknown_target, own_proposal, bad_stance, unreadable; for stage 'replies' unknown_target, not_own_proposal, not_posted_on, bad_action, unreadable. An 'unreadable' row counts whole replies that did not parse, not posts.",
+          "description": "Experimental (0.7.8). Debate posts and author replies the stage's filters rejected, one row per stage, lab and reason; [] when none were. Absent in runs made before 0.7.8. Reasons: for stage 'debate' unknown_target, own_proposal, bad_stance, unreadable, provider_error; for stage 'replies' unknown_target, not_own_proposal, not_posted_on, bad_action, unreadable, provider_error. An 'unreadable' row counts whole replies that did not parse, not posts; 'provider_error' (0.7.9) counts whole replies the provider ended with stop error, content_filter or refusal on the first try and on its one retry.",
           "items": {
             "type": "object",
             "required": ["stage", "by", "reason", "count"],
             "properties": {
               "stage": { "enum": ["debate", "replies"] },
               "by": { "type": "string", "description": "The lab whose post or reply was dropped." },
-              "reason": { "enum": ["unknown_target", "own_proposal", "bad_stance", "not_own_proposal", "not_posted_on", "bad_action", "unreadable"] },
+              "reason": { "enum": ["unknown_target", "own_proposal", "bad_stance", "not_own_proposal", "not_posted_on", "bad_action", "unreadable", "provider_error"] },
               "count": { "type": "integer", "minimum": 1 }
             }
           }

package/src/api.js

@@ -72,9 +72,9 @@ export function price({ chain, cwd = process.cwd(), rounds } = {}) {
 }
 
 // The ceiling is never silently off. undefined: the CLI's own default (MAX_USD_PER_RUN, else $7).
-// A positive number: that ceiling. 'none': no ceiling, said explicitly. The CLI and the MCP tool
-// read 0 as "no ceiling"; here 0 is refused, because a caller who wrote 0 almost certainly meant
-// "spend nothing", and reading it as "spend without limit" is the costliest possible guess.
+// A positive number: that ceiling. 'none': no ceiling, said explicitly. 0 is refused, because a
+// caller who wrote 0 almost certainly meant "spend nothing", and reading it as "spend without limit"
+// is the costliest possible guess. Since 0.7.9 the CLI and the MCP tools refuse it too.
 function maxUsdArgs(maxUsd) {
   if (maxUsd === undefined) return [];
   if (maxUsd === 'none') return ['--max-usd', 'none'];
@@ -110,8 +110,12 @@ function runCli(args, { cwd, env, onOutput, signal }) {
     };
     child.stdout.on('data', take('stdout'));
     child.stderr.on('data', take('stderr'));
-    child.on('error', reject);
-    child.on('close', (code, sig) => resolvePromise({ exitCode: code, signal: sig, outputTail: tail.join('').split('\n').slice(-40).join('\n') }));
+    // Bug audit 2026-09-28 (area 4 MED-1): an abort rejected on 'error', before the child had exited,
+    // so a caller that resumed at once could meet a run still marked running. The abort now settles
+    // only on 'close'; any other spawn error rejects at once, as before.
+    let aborted = null;
+    child.on('error', err => { if (err?.name === 'AbortError') aborted = err; else reject(err); });
+    child.on('close', (code, sig) => aborted ? reject(aborted) : resolvePromise({ exitCode: code, signal: sig, outputTail: tail.join('').split('\n').slice(-40).join('\n') }));
   });
 }
 
@@ -120,7 +124,7 @@ function runCli(args, { cwd, env, onOutput, signal }) {
  * spend ceiling, or refused by a guard. Resolves in every one of those cases (read `status` and
  * `exitCode`); rejects only when the child process could not be started or was aborted.
  */
-export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, draft, fromRun, context, piiGate, env, onOutput, signal } = {}) {
+export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, draft, fromRun, context, piiGate, allowSecretShaped, env, onOutput, signal } = {}) {
   const work = resolve(cwd);
   chainPath(chain, work); // a clear error here beats a CLI usage message
   if (typeof task !== 'string' || !task) throw new TypeError('task: a path to the task file');
@@ -137,8 +141,15 @@ export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, dr
     if (piiGate !== 'warn' && piiGate !== 'hard-stop') throw new RangeError(`piiGate: 'warn' or 'hard-stop', got ${JSON.stringify(piiGate)}`);
     args.push('--pii-gate', piiGate);
   }
-  const res = await runCli(args, { cwd: work, env, onOutput, signal });
+  // 0.7.9 outbound key scan: the one override (saved in run.json, so a resume keeps it).
+  if (allowSecretShaped === true) args.push('--allow-secret-shaped');
   const runDir = join(work, 'runs', id);
+  // Area 4 MED-1: an aborted run's stages stay on disk and can be resumed, so the rejection says
+  // which run it was (`runId`, and `runDir` once the folder exists).
+  const res = await runCli(args, { cwd: work, env, onOutput, signal }).catch(err => {
+    if (err && typeof err === 'object') Object.assign(err, { runId: id, runDir: existsSync(runDir) ? runDir : null });
+    throw err;
+  });
   return { runId: id, runDir: existsSync(runDir) ? runDir : null, ...res, ...(existsSync(runDir) ? statusOf(runDir) : { status: 'not_started', report: null }) };
 }
 
@@ -146,11 +157,12 @@ export async function run({ chain, task, cwd = process.cwd(), maxUsd, rounds, dr
  * Resume a paused run (after its external stage was answered) or one the spend ceiling stopped
  * (pass a higher maxUsd). Stages already on disk replay from disk and cost nothing again.
  */
-export async function resume({ runDir, cwd = process.cwd(), maxUsd, env, onOutput, signal } = {}) {
+export async function resume({ runDir, cwd = process.cwd(), maxUsd, allowSecretShaped, env, onOutput, signal } = {}) {
   const work = resolve(cwd);
   const dir = resolve(work, runDir ?? '');
   if (!runDir || !existsSync(join(dir, 'run.json'))) throw new Error(`runDir: not a run folder with a run.json: ${dir}`);
-  const res = await runCli(['--resume', dir, ...maxUsdArgs(maxUsd)], { cwd: work, env, onOutput, signal });
+  // Verify pass 2026-09-28 F1(b): continue a run the outbound key scan stopped.
+  const res = await runCli(['--resume', dir, ...maxUsdArgs(maxUsd), ...(allowSecretShaped === true ? ['--allow-secret-shaped'] : [])], { cwd: work, env, onOutput, signal });
   return { runId: basename(dir), runDir: dir, ...res, ...statusOf(dir) };
 }
 

package/src/cache-integrity.js

@@ -15,7 +15,11 @@ import { createHash } from 'node:crypto';
 
 /** A short fingerprint of the inputs a cached stage's validity depends on. */
 export function fingerprintInputs(taskText, config) {
-  return createHash('sha256').update(JSON.stringify({ taskText, config })).digest('hex').slice(0, 12);
+  // `summary` is a chain card's display line: no stage reads it, so editing it must not make a
+  // resumed run read every finished stage as stale. A config without one hashes exactly as before.
+  let forHash = config;
+  if (config && typeof config === 'object' && 'summary' in config) { const { summary: _display, ...rest } = config; forHash = rest; }
+  return createHash('sha256').update(JSON.stringify({ taskText, config: forHash })).digest('hex').slice(0, 12);
 }
 
 /**