ticketlens 0.38.48 → 0.38.49

package/README.md

@@ -300,7 +300,7 @@ ticketlens compliance <TICKET-KEY> --consensus -y # Same, skipping the cost-conf
 
 Runs the same compliance check as `ticketlens CNV1-2 --compliance` but as a dedicated subcommand — useful when you want to check compliance without fetching the full ticket brief. Free accounts get 3 checks per month; Pro is unlimited.
 
-`--consensus` (Pro) replaces the local deterministic matcher with independent reviews from every AI provider configured in `~/.ticketlens/credentials.json` (2+ of `anthropicApiKey`/`openaiApiKey`/`groqApiKey` required), reconciled by majority vote after a disagreement-triggered refinement round. This is the only compliance path that sends your diff off-machine — directly to each configured AI provider, never to TicketLens's own servers. The diff is scanned for secrets before anything is sent; a detected secret blocks the run with no network call made. Prompts for confirmation before spending API credits unless `-y`/`--yes` is passed.
+`--consensus` (Pro) replaces the local deterministic matcher with independent reviews from your team's AI provider pool, reconciled by majority vote after a disagreement-triggered refinement round. Requires `ticketlens login` and a "consensus" role set up at Console > Admin > AI Roles, with 2+ providers attached from your team's shared registry (Console > Admin > AI Provider Pool — any title/key/endpoint/model, not a fixed list). This is the only compliance path that sends your diff off-machine — to TicketLens's backend, which fans out to each provider (keys are encrypted server-side and never sent to the CLI). The diff is scanned for secrets before anything is sent; a detected secret blocks the run with no AI call made. Prompts for confirmation before spending your team's API credits unless `-y`/`--yes` is passed.
 
 ---
 
@@ -460,7 +460,7 @@ Every note is scanned before saving — anything shaped like a real secret (API
 
 **Removing a note:** `ticketlens note delete --id="..." [--ticket=KEY]` removes a note from your local vault. Local only — if it was already pushed to a team, teammates who pulled it keep their copy; deleting it there too is a manager action from the Console (Admin > Recall).
 
-**Any MCP-capable AI harness:** `ticketlens mcp` starts a stdio [MCP](https://modelcontextprotocol.io) server exposing `fetch`, `triage`, `compliance`, `review`, `standup`, `pr`, `stats`, `issue_types`, `history`, `collisions`, `ledger`, `doctor`, `recall_add`, `recall_update`, `recall_delete`, `recall_search`, `ticket_comment`, `ticket_transition`, `ticket_assign`, `ticket_duplicates`, `ticket_link`, `ticket_update`, and `ticket_create` as native tools — every CLI action now has an MCP tool, so any MCP-compatible AI assistant, not just Claude Code, can call them directly instead of constructing a shell command. It's a thin adapter over the exact same code as the CLI commands above — same license gate per tool, same secret scan/local vault/tracker writes, same team sync — nothing is reimplemented. `fetch`, `doctor`, and `standup` are Free; `triage`'s base scan is Free with some options gated Pro/Team, same as the CLI (`ticketlens triage --help`); `compliance` and `pr` are Free, sharing a 3-checks/month cap on their requirements-coverage section, Pro unlimited; `compliance` additionally accepts `consensus: true` (Pro) to replace the local deterministic matcher with a multi-agent AI review — sends the diff directly to each of your configured AI providers (never to TicketLens's own servers), requires 2+ of anthropic/openai/groq keys configured, and always implies `--yes` under MCP since there's no TTY for the cost-confirmation prompt; `review` is Free for branch/files/ticket context, with its coverage/focus section requiring Pro as a plain license check — it does not draw from that same monthly counter; `stats` is Free with a 7-day lookback cap, Pro extends it to 30 days, same split as the CLI (`ticketlens stats --help`); `issue_types` is Free and Jira-only — pre-fetches and caches a profile's real creatable projects and issue types ahead of a `ticket_create` attempt, sharing its cache with that tool's own reactive enrichment; Linear/GitHub profiles get a clear "not available" instead of an empty result; `history` reads local triage history only (zero network) and requires Pro; `collisions` requires `ticketlens login` (Console access) plus a Team license; `ledger` exports the local, signed compliance audit trail (zero network) and requires Pro; every other tool needs Pro. `recall_update` overwrites an existing Recall note's body — internal plumbing for the note quality loop, not typically called directly; its `attachments` array appends new files to whatever the note already has, same as `recall_add`'s, never replacing existing ones. `recall_delete` is destructive and local-vault-only — requires `confirm: true` alongside `id` to actually execute; there is no interactive y/N prompt under MCP (no real terminal to prompt against), so omitting it always fails rather than silently blocking. Point your harness's MCP config at it: `{ "command": "ticketlens", "args": ["mcp"] }` — or run `ticketlens mcp install` in a project to write that entry into its `.mcp.json` for you (creates the file if it doesn't exist, merges in if it does — never touches any other entry already there; `--dry-run` to preview first).
+**Any MCP-capable AI harness:** `ticketlens mcp` starts a stdio [MCP](https://modelcontextprotocol.io) server exposing `fetch`, `triage`, `compliance`, `review`, `standup`, `pr`, `stats`, `issue_types`, `history`, `collisions`, `ledger`, `doctor`, `recall_add`, `recall_update`, `recall_delete`, `recall_search`, `ticket_comment`, `ticket_transition`, `ticket_assign`, `ticket_duplicates`, `ticket_link`, `ticket_update`, and `ticket_create` as native tools — every CLI action now has an MCP tool, so any MCP-compatible AI assistant, not just Claude Code, can call them directly instead of constructing a shell command. It's a thin adapter over the exact same code as the CLI commands above — same license gate per tool, same secret scan/local vault/tracker writes, same team sync — nothing is reimplemented. `fetch`, `doctor`, and `standup` are Free; `triage`'s base scan is Free with some options gated Pro/Team, same as the CLI (`ticketlens triage --help`); `compliance` and `pr` are Free, sharing a 3-checks/month cap on their requirements-coverage section, Pro unlimited; `compliance` additionally accepts `consensus: true` (Pro) to replace the local deterministic matcher with a multi-agent AI review, run server-side against a "consensus" role configured at Console > Admin > AI Roles (2+ providers from the team's shared pool), and always implies `--yes` under MCP since there's no TTY for the cost-confirmation prompt; `review` is Free for branch/files/ticket context, with its coverage/focus section requiring Pro as a plain license check — it does not draw from that same monthly counter; `stats` is Free with a 7-day lookback cap, Pro extends it to 30 days, same split as the CLI (`ticketlens stats --help`); `issue_types` is Free and Jira-only — pre-fetches and caches a profile's real creatable projects and issue types ahead of a `ticket_create` attempt, sharing its cache with that tool's own reactive enrichment; Linear/GitHub profiles get a clear "not available" instead of an empty result; `history` reads local triage history only (zero network) and requires Pro; `collisions` requires `ticketlens login` (Console access) plus a Team license; `ledger` exports the local, signed compliance audit trail (zero network) and requires Pro; every other tool needs Pro. `recall_update` overwrites an existing Recall note's body — internal plumbing for the note quality loop, not typically called directly; its `attachments` array appends new files to whatever the note already has, same as `recall_add`'s, never replacing existing ones. `recall_delete` is destructive and local-vault-only — requires `confirm: true` alongside `id` to actually execute; there is no interactive y/N prompt under MCP (no real terminal to prompt against), so omitting it always fails rather than silently blocking. Point your harness's MCP config at it: `{ "command": "ticketlens", "args": ["mcp"] }` — or run `ticketlens mcp install` in a project to write that entry into its `.mcp.json` for you (creates the file if it doesn't exist, merges in if it does — never touches any other entry already there; `--dry-run` to preview first).
 
 `note add`'s save confirmation and `recall`'s search results are styled by default in a terminal; add `--plain` to either for bare, pipe-safe output. `recall` always shows each note's file ID (e.g. `[1784135399545-fe01c4.md]`) so you can open it directly (`cat ~/.ticketlens/recall/<PREFIX>/<id>`), or pass `--full` to print the full body content inline instead. Each result shows a relative time (`2h ago`, `3d ago`) rather than a bare date — the full-precision timestamp is always in the note file's own frontmatter.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.48",
+  "version": "0.38.49",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.42.7 -->
+<!-- jtb-skill-version: 0.43.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -539,10 +539,11 @@ If this harness has TicketLens's MCP server configured (a tool named `compliance
 ### --consensus: Multi-Agent AI Review (standalone command only, Pro)
 `ticketlens compliance PROJ-123 --consensus` replaces the local deterministic keyword-diff matcher with a multi-agent AI review, for a higher-confidence check on requirements that plain keyword matching tends to misjudge (paraphrased requirements, negative conditions, cross-file logic).
 
-- **This is the one path in TicketLens that sends your diff off-machine** — directly to each AI provider you've configured (never to TicketLens's own servers). Requires **2+** of `anthropicApiKey`/`openaiApiKey`/`groqApiKey` set in `~/.ticketlens/credentials.json` (the same local BYOK file `ticketlens summarize` uses — set up via `ticketlens init` or manually). Before anything is sent, the diff runs through the same secret scanner Recall notes use (`secret-scanner.mjs`) — a detected secret blocks the run entirely, before any network call.
-- Each configured provider independently reviews every requirement; where agents disagree, a second refinement round shows each agent its peers' (anonymized) verdicts and lets it reconsider; final verdicts are reconciled by majority vote, ties broken toward the stricter verdict. The report always shows the full per-agent breakdown, including any round-1→round-2 change.
-- Prompts for confirmation before making any API calls (real cost against your own provider keys) unless `-y`/`--yes` is passed. Over MCP, `consensus: true` always implies yes (no TTY to prompt).
-- `Phase 2` (not yet built): GLM/Kimi/DeepSeek/Qwen/Devstral/Gemini/Gemma providers. `Phase 1.5` (not yet built): scored iterative refinement with a stronger-model arbiter judging consensus acceptability, instead of plain majority vote.
+- **Requires `ticketlens login`** and a **consensus role** configured at Console > Admin > AI Roles, with 2+ providers attached from your team's shared registry (Console > Admin > AI Provider Pool — any title/key/endpoint/model your team wants, not a fixed vendor list; managed by team managers, selected per-role by each teammate). Provider keys are encrypted server-side and never sent to the CLI, so the actual AI calls run on TicketLens's backend, not from your machine directly — **this is the one path in TicketLens where the diff leaves your machine, to TicketLens's own backend, which fans out to each provider.** Before anything is sent, the diff runs through the same secret scanner Recall notes use — a detected secret blocks the run entirely, before any AI call.
+- Each attached provider independently reviews every requirement; where agents disagree, a second refinement round shows each agent its peers' (anonymized) verdicts and lets it reconsider; final verdicts are reconciled by majority vote, ties broken toward the stricter verdict. The report always shows the full per-agent breakdown, including any round-1→round-2 change.
+- Prompts for confirmation before making any API calls (real cost against your team's provider keys) unless `-y`/`--yes` is passed. Over MCP, `consensus: true` always implies yes (no TTY to prompt).
+- The now-superseded first version (0.38.48, same-day) read `~/.ticketlens/credentials.json` and called Anthropic/OpenAI/Groq directly from the CLI — deprecated before any stable release once the dynamic, Console-managed provider registry replaced it.
+- `Phase 2` (not yet built): non-`anthropic`/`openai_compatible` provider shapes beyond the two `provider_type`s the registry supports today. `Phase 1.5` (not yet built): scored iterative refinement with a stronger-model arbiter judging consensus acceptability, instead of plain majority vote.
 
 ### Ledger export
 `ticketlens ledger [--format=json|csv]` exports the same local, signed compliance ledger these checks write to — entirely local, no network call. `[Pro]`. If this harness has TicketLens's MCP server configured (a tool named `ledger` — often shown as `mcp__ticketlens__ledger` — visible in your tool list), prefer it over the bash form: same tier gate, same export, just no shell command to construct or stdout to parse. It accepts `format` (`json`/`csv`, defaults to `json`).

package/skills/jtb/scripts/lib/consensus-checker.mjs

@@ -1,82 +1,29 @@
+/**
+ * ticketlens compliance TICKET --consensus — thin client over POST /v1/consensus.
+ *
+ * Superseded local-BYOK version (0.38.48): read ~/.ticketlens/credentials.json,
+ * called Anthropic/OpenAI/Groq directly from the CLI. Deprecated same session it
+ * shipped — provider keys now live in the group-shared, dynamic AiProviderPool
+ * registry (Console > Admin > AI Provider Pool / AI Roles), encrypted server-side
+ * and never sent to the CLI, so the actual AI calls must happen on the backend.
+ * The diff and requirements still only ever leave the machine to reach
+ * TicketLens's own backend now (not straight to each vendor) — see
+ * ConsensusController.php for the round-1/round-2/reconcile algorithm, a direct
+ * port of what used to run here.
+ */
 import { isLicensed, showUpgradePrompt } from './license.mjs';
 import { extractRequirements } from './requirement-extractor.mjs';
 import { findLinkedCommits } from './commit-linker.mjs';
-import { loadCredentials } from './profile-resolver.mjs';
-import { summarize } from './summarizer.mjs';
+import { readCliToken } from './cli-auth.mjs';
+import { apiBase } from './api-utils.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { createStyler } from './ansi.mjs';
 import { STATUS_ICON, statusColor, coverageColor } from './compliance-checker.mjs';
-import { scanForSecrets } from './secret-scanner.mjs';
 
-const PROVIDER_ORDER = ['anthropic', 'openai', 'groq'];
-const PROVIDER_KEY_FIELD = { anthropic: 'anthropicApiKey', openai: 'openaiApiKey', groq: 'groqApiKey' };
-// Lower = stricter (less coverage claimed). Drives tie-break in reconcileRequirement.
-const STRICTNESS = { NOT_FOUND: 0, PARTIAL: 1, FOUND: 2 };
-const MAX_TOKENS = 512;
-// Each "requirement text | STATUS" response line runs ~20-40 tokens — scale the
-// floor up for tickets with many acceptance criteria so the model's per-requirement
-// list doesn't get cut off mid-response (a truncated response silently reads as
-// NOT_FOUND for every unparsed requirement via parseVerdicts, not as an error).
-const TOKENS_PER_REQUIREMENT = 40;
-
-export function getConfiguredProviders(credentials) {
-  if (!credentials) return [];
-  return PROVIDER_ORDER.filter(p => !!credentials[PROVIDER_KEY_FIELD[p]]);
-}
-
-/** Ports ComplianceController::parseAnalysis's line-matching convention to JS. */
-export function parseVerdicts(requirements, rawAnalysis) {
-  const lines = (rawAnalysis ?? '').split('\n');
-  return requirements.map(req => {
-    const needle = req.slice(0, 20).toLowerCase();
-    let status = 'NOT_FOUND';
-    for (const line of lines) {
-      if (!line.toLowerCase().includes(needle)) continue;
-      const upper = line.toUpperCase();
-      if (upper.includes('PARTIAL')) status = 'PARTIAL';
-      else if (upper.includes('FOUND') && !upper.includes('NOT_FOUND')) status = 'FOUND';
-      break;
-    }
-    return status;
-  });
-}
-
-/** Majority vote across agents' final verdicts for one requirement; ties go to the stricter verdict. */
-export function reconcileRequirement(verdicts) {
-  const counts = new Map();
-  for (const v of verdicts) counts.set(v, (counts.get(v) ?? 0) + 1);
-  const maxCount = Math.max(...counts.values());
-  const topStatuses = [...counts.entries()].filter(([, c]) => c === maxCount).map(([status]) => status);
-  if (topStatuses.length === 1) return topStatuses[0];
-  return topStatuses.reduce((strictest, s) => (STRICTNESS[s] < STRICTNESS[strictest] ? s : strictest));
-}
-
-function buildRound1Prompt(diff, requirements) {
-  return 'You are a compliance checker. Given this code diff, evaluate whether each requirement listed is addressed.\n\n'
-    + `Diff:\n${diff || '(no diff available)'}\n\n`
-    + 'Requirements to check:\n'
-    + requirements.map(r => `- ${r}`).join('\n')
-    + "\n\nFor each requirement, respond with: FOUND, PARTIAL, or NOT_FOUND. One per line, format: '<requirement> | <status>'.";
-}
-
-function buildRound2Prompt(diff, disagreedItems, selfProvider, successful1) {
-  const peers = successful1.filter(r => r.provider !== selfProvider);
-  const lines = [
-    'You previously reviewed a code diff against a set of requirements. Other independent',
-    'reviewers disagreed with you on some items below. Reconsider only these, in light of',
-    "their assessments, and respond again in the same format.",
-    '',
-    `Diff:\n${diff || '(no diff available)'}`,
-    '',
-  ];
-  for (const { requirement, index } of disagreedItems) {
-    lines.push(`Requirement: ${requirement}`);
-    peers.forEach((peer, i) => lines.push(`  Reviewer ${i + 1} said: ${peer.verdicts[index]}`));
-    lines.push('');
-  }
-  lines.push("For each requirement above, respond with: FOUND, PARTIAL, or NOT_FOUND. One per line, format: '<requirement> | <status>'.");
-  return lines.join('\n');
-}
+const ROLES_PATH = '/v1/ai-provider-roles';
+const CONSENSUS_PATH = '/v1/consensus';
+const ROLES_TIMEOUT_MS = 10_000;
+const CONSENSUS_TIMEOUT_MS = 90_000; // two AI rounds across N providers — real work, not a quick API call
 
 /** Interactive y/N cost-confirmation gate — same non-interactive fallback shape as confirmDestructive. */
 async function confirmCost(providerCount, { stream = process.stderr, stdin = process.stdin } = {}) {
@@ -84,7 +31,7 @@ async function confirmCost(providerCount, { stream = process.stderr, stdin = pro
     stream.write('  Non-interactive mode: pass --yes/-y to run --consensus without a prompt.\n');
     return false;
   }
-  stream.write(`  --consensus will make ${providerCount} AI API call(s) using your configured keys. Continue?  y/N  `);
+  stream.write(`  --consensus will run ${providerCount} AI review(s) via your team's provider pool. Continue?  y/N  `);
   return new Promise(resolve => {
     stdin.setRawMode(true);
     stdin.resume();
@@ -110,12 +57,12 @@ function formatNoCriteriaReport(ticketKey, s) {
   ].join('\n');
 }
 
-function formatConsensusReport({ ticketKey, results, coveragePercent, finalVerdictsByAgent, disagreedCount, s }) {
+function formatConsensusReport({ ticketKey, results, perAgent, disagreedCount, s }) {
   const lines = [
     '',
     `  Consensus Compliance Check — ${s.brand(s.bold(ticketKey))}`,
     `  ${s.dim('─'.repeat(50))}`,
-    `  ${s.dim(`${finalVerdictsByAgent.length} agents: ${finalVerdictsByAgent.map(a => a.provider).join(', ')}`)}`,
+    `  ${s.dim(`${perAgent.length} agents: ${perAgent.map(a => a.title).join(', ')}`)}`,
     '',
   ];
 
@@ -126,19 +73,27 @@ function formatConsensusReport({ ticketKey, results, coveragePercent, finalVerdi
 
   lines.push('');
   const found = results.filter(r => r.status === 'FOUND').length;
+  const coveragePercent = Math.round(((found + results.filter(r => r.status === 'PARTIAL').length * 0.5) / results.length) * 100);
   lines.push(`  Coverage: ${coverageColor(coveragePercent, s)(`${coveragePercent}%`)}  (${found}/${results.length} requirements found)`);
   if (disagreedCount > 0) {
     lines.push(`  ${s.dim(`${disagreedCount} requirement(s) needed a refinement round (agents initially disagreed).`)}`);
   }
   lines.push('');
   lines.push(`  ${s.bold('Per-agent breakdown:')}`);
-  for (const { provider, verdicts, round1Verdicts } of finalVerdictsByAgent) {
+  for (const { title, verdicts, round1Verdicts } of perAgent) {
     const parts = verdicts.map((v, i) => (round1Verdicts[i] !== v ? `${round1Verdicts[i]}→${v}` : v));
-    lines.push(`  ${s.dim(provider)}: ${parts.join(', ')}`);
+    lines.push(`  ${s.dim(title)}: ${parts.join(', ')}`);
   }
   lines.push('');
 
-  return lines.join('\n');
+  return { report: lines.join('\n'), coveragePercent };
+}
+
+async function fetchJson(url, { fetcher, timeoutMs, ...init }) {
+  const res = await fetcher(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON error page — body stays null */ }
+  return { ok: res.ok, status: res.status, body };
 }
 
 export async function runConsensusCheck({
@@ -150,14 +105,14 @@ export async function runConsensusCheck({
   outStream = process.stdout,
   forceYes = false,
   stdin = process.stdin,
+  cliToken,
   isLicensedFn = isLicensed,
   showUpgradeFn = showUpgradePrompt,
   extractRequirementsFn = extractRequirements,
   findLinkedCommitsFn = findLinkedCommits,
-  loadCredentialsFn = loadCredentials,
-  summarizeFn = summarize,
   confirmCostFn = confirmCost,
-  scanForSecretsFn = scanForSecrets,
+  readCliTokenFn = readCliToken,
+  fetcher = globalThis.fetch,
 }) {
   if (!isLicensedFn('pro', configDir)) {
     showUpgradeFn('pro', '--consensus', { stream });
@@ -171,101 +126,67 @@ export async function runConsensusCheck({
     return { report: formatNoCriteriaReport(ticketKey, s), results: [], coveragePercent: 0, noCriteria: true };
   }
 
-  const { diff } = findLinkedCommitsFn(ticketKey, { cwd: process.cwd() });
-
-  // --consensus is the only compliance path that sends the diff off-machine (to each
-  // configured AI vendor directly) — scan it before anything else touches the network,
-  // the same gate note-command.mjs applies to Recall note bodies before they leave the vault.
-  const scan = scanForSecretsFn({ body: diff ?? '' });
-  if (scan.rejected) {
-    stream.write(`  ✖ --consensus blocked — the diff looks like it contains a secret: ${scan.reasons.join(' ')}\n`);
+  const token = cliToken ?? readCliTokenFn(configDir);
+  if (!token) {
+    stream.write('  ✖ --consensus requires a login. Run: ticketlens login\n');
     return null;
   }
-  for (const warning of scan.warnings) {
-    stream.write(`  Warning: ${warning}\n`);
+
+  // Pre-flight: know the provider count before prompting for cost, and give a
+  // specific, actionable error before ever touching /v1/consensus — the
+  // backend re-validates all of this too, this is purely a faster/clearer UX path.
+  const rolesRes = await fetchJson(`${apiBase()}${ROLES_PATH}`, {
+    fetcher, timeoutMs: ROLES_TIMEOUT_MS,
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+  }).catch(err => ({ ok: false, status: 0, body: null, networkError: err }));
+
+  if (!rolesRes.ok) {
+    stream.write('  ✖ Could not reach TicketLens to check your consensus role. Try again, or check your connection.\n');
+    return null;
   }
 
-  const credentials = loadCredentialsFn(configDir);
-  const providers = getConfiguredProviders(credentials);
-  if (providers.length < 2) {
-    stream.write(
-      '  ✖ --consensus needs at least 2 configured AI providers. Configure with: ' +
-      'ticketlens cloud-keys add <provider> <key>, or add anthropicApiKey/openaiApiKey/groqApiKey ' +
-      'to ~/.ticketlens/credentials.json.\n'
-    );
+  const consensusRole = (rolesRes.body?.roles ?? []).find(r => r.kind === 'consensus');
+  if (!consensusRole) {
+    stream.write('  ✖ No consensus role configured. Set one up in Console > Admin > AI Providers.\n');
+    return null;
+  }
+  if (consensusRole.providers.length < 2) {
+    stream.write(`  ✖ Your consensus role needs at least 2 providers — currently has ${consensusRole.providers.length}. Add more in Console > Admin > AI Roles.\n`);
     return null;
   }
 
   if (!forceYes) {
-    const proceed = await confirmCostFn(providers.length, { stream, stdin });
+    const proceed = await confirmCostFn(consensusRole.providers.length, { stream, stdin });
     if (!proceed) {
-      stream.write('  Aborted — no API calls made.\n');
+      stream.write('  Aborted — no request made.\n');
       return null;
     }
   }
 
-  const round1Prompt = buildRound1Prompt(diff, requirements);
-  const round1MaxTokens = Math.max(MAX_TOKENS, requirements.length * TOKENS_PER_REQUIREMENT);
-
-  const round1 = await Promise.all(providers.map(async provider => {
-    try {
-      const raw = await summarizeFn({ mode: 'byok', credentials, provider, prompt: round1Prompt, brief: '', maxTokens: round1MaxTokens });
-      return { provider, verdicts: parseVerdicts(requirements, raw), error: null };
-    } catch (err) {
-      return { provider, verdicts: null, error: err.message };
-    }
-  }));
+  const { diff } = findLinkedCommitsFn(ticketKey, { cwd: process.cwd() });
 
-  const successful1 = round1.filter(r => !r.error);
-  if (successful1.length < 2) {
-    stream.write(`  ✖ Only ${successful1.length} provider(s) responded successfully — need at least 2 for consensus.\n`);
-    for (const r of round1) if (r.error) stream.write(`    ${r.provider}: ${r.error}\n`);
+  const runRes = await fetchJson(`${apiBase()}${CONSENSUS_PATH}`, {
+    fetcher, timeoutMs: CONSENSUS_TIMEOUT_MS,
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}`, Accept: 'application/json' },
+    body: JSON.stringify({ ticketKey, diff, requirements }),
+  }).catch(err => ({ ok: false, status: 0, body: null, networkError: err }));
+
+  if (!runRes.ok) {
+    const msg = runRes.body?.error
+      ?? (runRes.networkError?.name === 'TimeoutError' ? 'Request timed out.' : runRes.networkError?.message)
+      ?? `HTTP ${runRes.status}`;
+    stream.write(`  ✖ ${msg}\n`);
     return null;
   }
 
-  const disagreedIndexes = requirements
-    .map((_, i) => i)
-    .filter(i => new Set(successful1.map(r => r.verdicts[i])).size > 1);
-
-  let round2 = [];
-  if (disagreedIndexes.length > 0) {
-    const disagreedItems = disagreedIndexes.map(i => ({ requirement: requirements[i], index: i }));
-    const round2MaxTokens = Math.max(MAX_TOKENS, disagreedItems.length * TOKENS_PER_REQUIREMENT);
-    round2 = await Promise.all(successful1.map(async ({ provider }) => {
-      const prompt = buildRound2Prompt(diff, disagreedItems, provider, successful1);
-      try {
-        const raw = await summarizeFn({ mode: 'byok', credentials, provider, prompt, brief: '', maxTokens: round2MaxTokens });
-        const refined = parseVerdicts(disagreedItems.map(d => d.requirement), raw);
-        return { provider, refined: Object.fromEntries(disagreedItems.map((d, idx) => [d.index, refined[idx]])) };
-      } catch (err) {
-        stream.write(`  ⚠ ${provider}: refinement round failed (${err.message}) — keeping its round-1 verdict.\n`);
-        return { provider, refined: {} }; // degrade — keep the round-1 verdict for this agent
-      }
-    }));
+  for (const warning of runRes.body.warnings ?? []) {
+    stream.write(`  Warning: ${warning}\n`);
   }
 
-  const finalVerdictsByAgent = successful1.map(r1 => {
-    const r2 = round2.find(r => r.provider === r1.provider);
-    return {
-      provider: r1.provider,
-      round1Verdicts: r1.verdicts,
-      verdicts: requirements.map((_, i) => r2?.refined[i] ?? r1.verdicts[i]),
-    };
-  });
-
-  const results = requirements.map((requirement, i) => ({
-    requirement,
-    status: reconcileRequirement(finalVerdictsByAgent.map(a => a.verdicts[i])),
-    evidence: null,
-  }));
-
-  const found = results.filter(r => r.status === 'FOUND').length;
-  const partial = results.filter(r => r.status === 'PARTIAL').length;
-  const coveragePercent = Math.round(((found + partial * 0.5) / results.length) * 100);
-
-  const report = formatConsensusReport({
-    ticketKey, results, coveragePercent, finalVerdictsByAgent, disagreedCount: disagreedIndexes.length, s,
+  const { report, coveragePercent } = formatConsensusReport({
+    ticketKey, results: runRes.body.results, perAgent: runRes.body.perAgent, disagreedCount: runRes.body.disagreedCount, s,
   });
 
-  return { report, results, coveragePercent, noCriteria: false };
+  return { report, results: runRes.body.results, coveragePercent, noCriteria: false };
 }

package/skills/jtb/scripts/lib/help.mjs

@@ -658,8 +658,8 @@ export function printMcpHelp({ stream = process.stdout } = {}) {
     `  ${s.cyan('fetch')}, ${s.cyan('doctor')}, and ${s.cyan('standup')} are Free; ${s.cyan('triage')} is Free with some Pro/Team-gated`,
     `  options (see ${s.cyan('ticketlens triage --help')}); ${s.cyan('compliance')} and ${s.cyan('pr')} are Free, sharing a`,
     `  3-checks/month cap on their requirements-coverage section, Pro unlimited;`,
-    `  ${s.cyan('compliance')}'s \`consensus: true\` (Pro) sends the diff directly to your configured`,
-    `  AI providers instead — never to TicketLens's own servers — and always implies`,
+    `  ${s.cyan('compliance')}'s \`consensus: true\` (Pro) runs a multi-agent review server-side against`,
+    `  a "consensus" role configured at Console > Admin > AI Roles, and always implies`,
     `  \`--yes\` under MCP, since there is no TTY for the cost-confirmation prompt;`,
     `  ${s.cyan('review')} is Free for branch/files/ticket context — its coverage/focus section`,
     `  requires Pro as a plain license check, not a draw on that same counter;`,
@@ -1106,12 +1106,13 @@ export function printComplianceHelp({ stream = process.stdout } = {}) {
     '',
     `    ${s.brand('--profile')}=${s.dim('NAME')}  Use a specific Jira profile`,
     `    ${s.brand('--consensus')}      Replace the local matcher with a multi-agent AI review ${s.dim('[Pro]')}`,
-    `    ${s.dim('               ')}    — routes the same requirements-vs-diff check through every`,
-    `    ${s.dim('               ')}    AI provider configured in ~/.ticketlens/credentials.json`,
-    `    ${s.dim('               ')}    (2+ of anthropicApiKey/openaiApiKey/groqApiKey required),`,
-    `    ${s.dim('               ')}    reconciles disagreements with a refinement round, then a`,
-    `    ${s.dim('               ')}    majority vote. Calls each provider directly — never TicketLens's`,
-    `    ${s.dim('               ')}    own servers. Prompts for confirmation before spending API credits.`,
+    `    ${s.dim('               ')}    — requires ${s.cyan('ticketlens login')} and a "consensus" role configured`,
+    `    ${s.dim('               ')}    at Console > Admin > AI Roles (2+ providers from your team's`,
+    `    ${s.dim('               ')}    shared pool, Console > Admin > AI Provider Pool). Runs server-side`,
+    `    ${s.dim('               ')}    — the diff and requirements are sent to TicketLens's backend,`,
+    `    ${s.dim('               ')}    scanned for secrets first, then to each provider. Reconciles`,
+    `    ${s.dim('               ')}    disagreements with a refinement round, then a majority vote.`,
+    `    ${s.dim('               ')}    Prompts for confirmation before spending your team's API credits.`,
     `    ${s.brand('-y')}, ${s.brand('--yes')}       Skip the --consensus cost confirmation prompt`,
     `    ${s.brand('-h')}, ${s.brand('--help')}   Show this help`,
     '',

package/skills/jtb/scripts/lib/mcp-tool-schemas.mjs

@@ -42,7 +42,7 @@ export const TOOLS = [
   },
   {
     name: 'compliance',
-    description: 'Check a ticket\'s acceptance-criteria coverage against the current git diff — extracts requirements from the ticket description, matches them against code changes, and reports a coverage percentage plus what\'s missing. Read-only; the same check `ticketlens install-hooks` runs automatically. Free tier: 3 checks per month; TicketLens Pro removes the limit. Set `consensus: true` (TicketLens Pro) to replace the local matcher with a multi-agent AI review — routes the same check through every AI provider configured in ~/.ticketlens/credentials.json (2+ required), calling each directly (never TicketLens\'s own servers). Requires 2+ of anthropic/openai/groq keys configured via `cloud-keys` or credentials.json; automatically skips the interactive cost-confirmation prompt since MCP has no TTY.',
+    description: 'Check a ticket\'s acceptance-criteria coverage against the current git diff — extracts requirements from the ticket description, matches them against code changes, and reports a coverage percentage plus what\'s missing. Read-only; the same check `ticketlens install-hooks` runs automatically. Free tier: 3 checks per month; TicketLens Pro removes the limit. Set `consensus: true` (TicketLens Pro) to replace the local matcher with a multi-agent AI review, run server-side — requires `ticketlens login` and a "consensus" role configured at Console > Admin > AI Roles (2+ providers attached from the team\'s shared pool, Console > Admin > AI Provider Pool). The diff is scanned for secrets before it is sent. Automatically skips the interactive cost-confirmation prompt since MCP has no TTY.',
     inputSchema: {
       type: 'object',
       properties: {

package/skills/jtb/scripts/lib/summarizer.mjs

@@ -116,7 +116,10 @@ async function callGroq({ brief, apiKey, fetcher, timeoutMs, prompt, maxTokens }
       'Authorization': `Bearer ${apiKey}`,
     },
     body: JSON.stringify({
-      model: 'llama-3.1-8b-instant',
+      // llama-3.1-8b-instant was decommissioned by Groq 2026-08-16 (HTTP 404 on
+      // every call since) — openai/gpt-oss-20b is Groq's own recommended
+      // replacement. See console.groq.com/docs/deprecations.
+      model: 'openai/gpt-oss-20b',
       max_tokens: maxTokens,
       messages: [{ role: 'user', content: prompt + brief }],
     }),