feat(spectrum): add council and free discussions

[lukemaj]

What: Add start_spectrum for server-relayed council and free discussions, with hidden Drafters and a visible transcript labelled by Color.
Why: Manual relay truncates replies, spends model turns copying messages, and cannot reliably coordinate participant barriers.
So what: CI, live proof and exact-head review pass; the coordinator merged this PR and owns installed-build checks and the #119 comparison.

Closes #118. Implements the Spectrum outcome in #113 and the current Objective.

Council starts independent answers, waits for every Color through at least two verbatim relay rounds, then asks a moderator Color for synthesis. Free mode schedules a bounded number of turns in Color order. The Spectrum runs no provider turn. User messages reach actual providers at the next barrier; completion reports once, settles, and reopening retains the transcript. Participant reports bypass the ordinary 4,000-character child-report path.

Prism resolves Color roles/models/effort. Durable outboxes and exact request/turn bindings protect scheduling and recovery. Completion uses bound turns rather than the mutable latest-turn pointer, including checkpoint reorderings. Retirement stops scheduling and participants without reviving a retired Spectrum or caller. The supported Node 24 SQLite query now binds an integer instead of a boolean. Transport omits duplicated outbox text while recovery reads the full persisted state.

Explicit Claude Opus 5.5 client work clears the composer when a Spectrum's user message persists and hides scheduler bookkeeping. Existing transcript/Agents paths display labels and hidden Drafters on web/desktop/mobile. No new presentation or relay model is introduced.

Requirements and who asked: User and #118/#113 require council/free server relay, hidden participants, Prism Colors, User broadcasts, report/settle/reopen, focused tests and real live proof; coordinator required predecessor rebases and one bounded cleanup repair with two regressions.
Deleted: Relay model, reply truncation, speaker-selection model, retry loops, duplicate installation, new UI surface, versioning and unapproved browser work.
Bottleneck: Exact asynchronous request/turn identity, retirement generations, crash cleanup and supported-runtime startup blocked real proof.
Checked myself: Full issues/briefs and authored diff; actual focused outputs and hashes; native Node 24 boolean rejection; checkpoint ordering evidence; physical-stop and successor regressions; final isolated live evidence and independent verdict recorded below.

Candidate and integration

Merged externally at 2026-10-01T21:43:30Z as 08fc76b7b201a0c047cbc7c538f1349ce3dbafd3. Final CI run passed Check, Test, all three server shards, Rust and Release Smoke; Fork Stack Model and native fingerprint also passed. No local repo-wide checks were run.

• Head: 7a0f9a30f1e002055f1d850e42511fa906f78122.
• Base: e5cf87a31e82ccf086847fb277f2c33f0331f1c4, current fetched origin/main; original starting base 0db8b3f19549ef369a611883e111ae20760364c8.
• Exclusive branch/workspace: feat/118-spectrum, /Users/lukaszmaj/dev/toolboxmd/chromeria-worktrees/118-spectrum. No canonical or sibling checkout mutation.
• Start threads in another project, as a child or top-level #114 projectId, child/top-level mode and runtimeMode are preserved and tested. Prism role for the Promachos picks his conversation's model #115 Prism effort routing and Stopping a thread does not stop its children; report-backs revive it #122 retirement generation guards remain intact. Explicit Opus resolved the Promachos mode: chat-first view with bubbles #116 ChatView import overlap, preserving Promachos; MessagesTimeline and ChatComposer are unchanged. Wight mode: keep a thread working on continue #117 Wight sender/admission and engine idleGuard regressions pass. Spectrum retains pure persisted commands because accepting a sender's idle no-op would leave a barrier waiting.
• Scoped checks below are affected proof; GitHub CI owns the complete suite. Source hashes match the tested worker manifests after commit hooks. Client proof is reused only for unchanged files and inputs.

Proof commands and results

Executed for the final server changes on exact Node 24.13.1:

PATH=/Users/lukaszmaj/.nvm/versions/node/v24.13.1/bin:$PATH pnpm exec vp test run apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.test.ts apps/server/src/mcp/alwaysLoad.test.ts apps/server/src/mcp/toolkits/threads/spectrum.test.ts apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts

141 passed, exit 0. After test-only Scope/DateTime corrections, the two affected cases were rerun with -t 'unbound restart': 2 passed, exit 0; the other 139 cases are unchanged. Coverage includes native query omitted/false/true archive options, actual reactor physical stop, exact request identity, long and multiple replies, barriers, User provider broadcasts, synthesis steering, reopen, initialization crash, restart settlement and retirement interleavings. Native Node 24 baseline reproduced SQL parameter-2 failure. The original cleanup guard failed the history-only append case and passed the successor case; the bounded replacement passes both.

Reused unchanged integration proof:

pnpm exec vp test run apps/server/src/mcp/toolkits/threads/wightAdmission.test.ts apps/server/src/mcp/toolkits/threads/wightToolkit.test.ts apps/server/src/mcp/toolkits/threads/wightMode.test.ts apps/server/src/mcp/toolkits/threads/spectrum.test.ts apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts apps/server/src/orchestration/Layers/OrchestrationEngine.test.ts
pnpm exec vp test run apps/server/src/mcp/toolkits/threads/childThreads.test.ts apps/server/src/mcp/toolkits/threads/childUsageLimitResume.test.ts apps/server/src/mcp/toolkits/threads/usageLimitResume.test.ts apps/server/src/mcp/toolkits/threads/spawnIntoProject.test.ts apps/server/src/mcp/toolkits/threads/retireSubtree.test.ts apps/server/src/mcp/toolkits/threads/interruptThread.test.ts

145 and 50 passed respectively, exit 0, on the #117 integration candidate. Final Spectrum/reactor proof supersedes their earlier cases; the remaining sources and inputs are unchanged. Transport tests: 32 passed, including rejecting a duplicated 3 MB outbox; final formatting changed only wrapping/trailing commas. Decider affected regressions: 23 passed, exit 0.

Opus client proof: ChatView.logic.test.ts, subagentThreads.test.ts, session-logic.test.ts, mobile threadActivity.test.ts, plus the four Promachos tests: 352 passed, exit 0. The composer regression failed before the change. UI hashes are unchanged through final server follow-up.

pnpm exec vp exec tsc --noEmit -p apps/server/tsconfig.json: final exit 0. Web/mobile equivalent typechecks: exit 0, reused unchanged client inputs. Targeted pnpm exec vp lint on touched paths: exit 0; existing ChatView warnings remain. Targeted pnpm exec vp fmt --check on every touched TypeScript path: exit 0. node scripts/fork-features.mjs check: 21 features, exit 0. git diff --check: clean. Scoped pnpm exec knip --workspace apps/server --exports --preprocessor ./scripts/knip-schemas.ts --no-config-hints: exit 0; subsequent global CI Knip also passed. CI exposed the formatting and delegation-list assertions, both repaired. start_spectrum stays always-loaded as a group delegation tool; unrelated tools remain deferred.

Isolated live council/free

Passed on the exact head, Node v24.13.1, at 2026-10-01T21:37:26Z. A real caller made exactly two native MCP start_spectrum calls. Prism selected Blue codex/gpt-6.1-sol medium and Green codex/gpt-6-luna max without model overrides.

Council completed 7 participant turns: two independent answers, two full barrier rounds, one moderator synthesis. Free completed 4 turns in Blue, Green, Blue, Green order. Independent analysis verified every completed reply and each next prompt byte-for-byte, exact barrier ordering, both settlements, one exact caller report each, and zero Spectrum provider turns/bindings. All 11 participant checkpoint completions were observed.

/Users/lukaszmaj/.nvm/versions/node/v24.13.1/bin/node /tmp/promachos-coord/118/live-only/proof.mjs --prepare --settings-source /Users/lukaszmaj/dev/toolboxmd/chromeria-worktrees/118-spectrum/.t3/userdata/settings.json
/Users/lukaszmaj/.nvm/versions/node/v24.13.1/bin/node /tmp/promachos-coord/118/live-only/proof.mjs --run /tmp/promachos-coord/118/live-only/run-Et0kIV --deadline-ms 1800000
/Users/lukaszmaj/.nvm/versions/node/v24.13.1/bin/node /tmp/promachos-coord/118/live-only/analyze.mjs /tmp/promachos-coord/118/live-only/run-Et0kIV

Run and analyzer exit 0. Clean working-diff SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855; verdict SHA-256 a00490832314482619b25d015c8b99e92cc2da990ef4a23d9cf432f6c25625fc. Private scratch evidence remains at /tmp/promachos-coord/118/live-only/run-Et0kIV/evidence; no auth, account details, raw provider logs or unrelated state are published. Backend PID 42015, port 59118, stopped by the driver's captured PID cleanup. No live state writes, port 3773, browsers or install.

Limits: this live run covers normal council/free, not live broadcast/reopen/crash/UI; those behavioral edges have focused tests. Replies are small, so the >4,000-character case is unit proof. Public settlement/checkpoint barriers were observed; production exposes no internal worker-drain RPC. Tests use receipts/drains, never sleeps.

Independent review

Passed on 7a0f9a30f1e002055f1d850e42511fa906f78122. Published findings and verdict. Newest review/independent status is success, created by authenticated lukemaj, linking those findings. Reviewer: Prism thread sub.sub.sub.46b03420-8643-4703-8756-8602f14b39fb.dispatcher-90b030e2146e.dispatcher-1468525028a4.reviewer-7543d30e2594, GPT-6-Luna through Codex. No unaccepted blocking finding remains; the coordinator-permitted crash-recovery race is stated below. Older reviews are stale and are not reused.

start_spectrum usage for #119

{
  "question": "The same real question for both modes",
  "colors": [
    { "label": "Blue", "role": "dispatcher" },
    { "label": "Green", "role": "reviewer" }
  ],
  "mode": "council",
  "limit": 2,
  "moderator": 0
}

Use mode: "free" and a total discussion-turn limit for comparison. Colors accept a Prism role/worker lane, or explicit instanceId, model, effort. The result returns the visible Spectrum ID and resolved participant IDs/models. Use read_thread or message_thread with scope: "project" to inspect/join; normal composer sends join too. Send a message or reopen to start another bounded cycle with retained context.

Reversible assumptions and open coordinator proof

2–8 unique Colors, reserved User label; limits 1–100, council minimum two relay rounds; first Color moderates by default; free defaults to three turns per Color. User acknowledgement stages sit outside free discussion-turn counts. Failures stop/report rather than retry. A restart with a lost provider-start binding settles with an explicit uncertainty report instead of blindly duplicating provider work; an explicit message reopens. Retirement requires explicit recovery of retired source/participant threads before reopening. The coordinator's one-iteration cleanup ruling was met with persisted request identity and exactly two named regressions; no broader recovery policy was added. Known crash-recovery limitation, explicitly accepted by coordinator: the identity read and plain session-stop dispatch are separate operations. A genuine successor arriving between them can still be stopped. The successor regression covers requests persisted before recovery, not that interleaving. Further restart-path findings fall under the same permitted limitation; no additional restart repair loop was authorized.

No versioning by design. Root performed no merge, installation or browser proof. Installed-build council/free, joining/reopening and before/after UI images remain coordinator-owned under the common brief. No screenshot claim: browser use was not authorized. Existing snooze heuristic may remain unavailable for two minutes after a Spectrum send. No website/SEO change: agent server capability and minimal existing-client integration.

Implementation and orchestration: GPT-6.1-Sol through Codex/Prism. UI: explicitly claudeAgent, claude-opus-5-5. Independent review: GPT-6-Luna through Codex/Prism. Agent cost is maintained in the PR's existing Observer comment.

[lukemaj]

What: The independent review of PR #130 at 7ee7ac166a202264dfe5323fc63f8b23c6183d39 is stopped as stale scope.
Why: The PR now conflicts with newer main; this candidate is based on 6f56eb907a9743e5ca31f978b8d0042b9b9d73a3, and review must cover the rebased base and head.
So what: Rebase and request a new exact-head review; this comment and status make no clean-review claim.

Requirements and who asked: User requested independent review of PR #130 closing #118 under parent #113, bound to the specified base and head, with stale-scope handling if the candidate scope changes.
Deleted: Any verdict transferable to a rebased candidate.
Bottleneck: PR #130 conflicts with newer main, so the final candidate does not yet exist for review.
Checked myself: Confirmed local HEAD and PR head are 7ee7ac166a202264dfe5323fc63f8b23c6183d39; confirmed its parent is 6f56eb907a9743e5ca31f978b8d0042b9b9d73a3; GitHub reports mergeStateStatus=DIRTY at base c66f6b3366d98a9a43a37c2f838fc0b0471a2b4f. The review read both Issues, the required briefs/procedures, full diff and relevant consumers, but stopped before completing all requested interleaving adjudication. No actionable code finding was confirmed before stop; this is not a clean verdict. Existing focused proof was inspected but not rerun. Live council/free has not been verified; the supplied coordinator state says its isolated fixture model catalog blocked before launch. Browser, installed-build and image proof remain coordinator-owned.

Reviewer: current T3 Code thread, GPT-6-Luna through Codex harness. Stale-scope notes: /tmp/promachos-coord/118/stale-review-7ee7ac166.md.

[lukemaj]

Agent work on this PR

Estimated cost $0.00 · 0 responses · 50 sessions · 2.4 h wall time

Model	Responses	Tokens	Estimated cost

Flags: 6 human corrections · 75 large tool outputs · 38 repeated commands · 8 repeated failures · 27 repeated reads · 9 repeated skill loads · 50 sessions with usage bound to no task

Details: snapshot, prices, coverage, counters

• Task toolboxmd/chromeria#118: outcome unknown (recorded acceptance only; a finished process never implies it).
• Proof: Spectrum: start_spectrum with council and free modes #118
• Snapshot d470062c9c57f1d91efaf4eeeb145647c869fd616e12905b6db7b12972ab1928, records up to 2026-10-01 21:43 UTC.
• 50 sessions on claude, codex; AgentsMD 14.6.0.
• Not counted: 2,908 responses (at least $33.08) in sessions shared with other PRs that worked in no single PR's checkout.
• 1,839 responses in these sessions worked on other PRs and are counted there.
• Totals reconcile with the measured sessions: yes. Evidence complete: yes.
• Prices: list-price estimate from T3 local rate table (path withheld) as of 2026-09-28, schedule 696aae45933d0a684a015d3f08cfb6f1aa2fef02e7d272b4689e3a692ea04fff. Unknown prices stay unknown, never zero.
  • T3 LiteLLM rate table when present; bundled schedule covers the rest.
• Harness-reported cost: none reported.
• Usage totals are not billing. Subscription spending is separate and is never posted as spend.
• Crashed runs are counted separately: 0.

Token counters by model (native counter semantics; never added across semantics):

Selected rates (USD per million tokens). These rates value the report at the selected schedule date; they do not establish historical prices or subscription spending.

Model	Input tier	Input	Cache read	Cache write	Other output	Reasoning

Other output and reasoning are priced without double counting inclusive native output. Missing rates remain unknown.

_{Local measurement from native records; usage totals are not billing. Updated in place by agent-observer publish.}

[lukemaj]

What: The review found a restart recovery blocker in PR #130 at f3366871b0d1422a578db3f5fd3f30032c7f222f.
Why: The scheduler clears the turn-start outbox and advances its cursor before the provider turn binding is durable, leaving no replay path after a crash in that interval.
So what: Root is routing a fix; this candidate's review is superseded, and the replacement head needs a fresh exact-head review.

Requirements and who asked: User and Issues #118/#113 require exact request/turn identity, restart recovery, barrier completion, and once-only report/settlement.
Deleted: A success verdict on this candidate; the review was stopped at the coordinator's request and is incomplete.
Bottleneck: The crash window between thread.turn-start-requested and spectrum.turn-bound can strand a pending participant and block the whole barrier.
Checked myself: At spectrum.ts:401-409, handling the request persists requested: true, advances the cursor, and clears the outbox. The provider binding appears only after sendTurn returns (ProviderCommandReactor.ts:1524-1541); the provider reactor subscribes to new hot-stream events and does not replay the old request on startup. Recovery therefore skips the request while leaving turnId: null. Focused server proof in /tmp/promachos-coord/118/rebase125-server-tests.log passed 391 tests across 9 files, but no test covers this request-to-binding crash window. Live council/free remains pending; no live verdict is claimed.

This is an actionable P1 finding on f3366871b0d1422a578db3f5fd3f30032c7f222f, not a final review verdict. Review notes: /tmp/promachos-coord/118/review-f3366871.md.

Reviewer: current T3 Code thread, GPT-6-Luna through Codex harness.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−1 B (−0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+3 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+6 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: e5cf87a · PR result: 7a0f9a3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[lukemaj]

What: Independent review passes for 7a0f9a30f1e002055f1d850e42511fa906f78122, including the focused server proof and fresh Node 24.13.1 council/free live run.
Why: The review concentrated on request identity, exact barrier completion, provider cleanup, startup portability, and source/UI compatibility across the rebased changes.
So what: No unaccepted blocking findings remain; the coordinator-permitted crash-recovery race is documented below, and installed-build/UI proof remains coordinator-owned.

Reviewed exact head 7a0f9a30f1e002055f1d850e42511fa906f78122 on base e5cf87a31e82ccf086847fb277f2c33f0331f1c4. Full Issue/comment and diff review included #114 project/runtime behavior, #115 Prism, #116 Promachos UI, #117 Wight, #122 retirement, startup/transport projections, command reactor and current consumers.

Finding disposition: The earlier P2 cleanup defect is fixed. When a history-only User append follows a durable unbound provider request, recovery now reads persisted thread.turn-start-requested identity instead of treating the latest User history message as the request. Focused regressions verify a surviving provider is physically stopped after the append and a genuine successor already persisted before recovery is preserved.

Coordinator-permitted known limitation: The identity read and plain thread.session.stop dispatch are separate operations. A genuine successor that arrives between them can still be stopped. The PR explicitly records this bounded crash-recovery limitation; per the coordinator ruling, I did not request another restart repair iteration. The focused successor regression covers a successor persisted before recovery, not this check-to-dispatch interleaving.

Proof reviewed: Node 24.13.1 scoped server tests passed 141/141, with the two cleanup regressions rerun after harness corrections. Server typecheck, targeted lint, formatting, fork registry and scoped knip passed; the global Knip and always-load CI failures were repaired. The isolated live analyzer passed for the exact head and current base: council completed independent answers, two barrier relay rounds and moderator synthesis; free mode completed four ordered turns; both preserved exact replies, reported once, settled, and used zero Spectrum provider turns. The live proof did not exercise User broadcasts, restart recovery, messages over 4,000 characters, installed build or UI screenshots. Existing focused tests cover the server paths; UI screenshots and installed-build checks remain coordinator-owned.

Requirements and who asked: #118/#113 and the user require server-coordinated council/free relay, exact barriers, transcript fidelity, provider delivery and settlement; the coordinator required the final rebased review and bounded cleanup ruling.
Deleted: No additional retry, restart machinery or UI surface was warranted; the coordinator accepted the one documented crash-recovery race.
Bottleneck: The original exact request/turn identity and supported Node 24 startup path blocked safe recovery and live proof.
Checked myself: Reviewed the exact source and consumers, verified the focused evidence and sanitized live oracle, and confirmed the worktree and PR head match.

Independent reviewer: GPT-6-Luna through Codex/Prism.

[lukemaj]

Merged by the coordinator as 08fc76b (squash) at verified head 7a0f9a3: diff read, CI green on that head, review/independent success by lukemaj on that head, live council and free runs on that head. The known crash-recovery limitation recorded above was accepted by the coordinator (not the user). Worktree and branch retired.