Grand Council Consensus

Grand council — unanimous cross-family consensus

Overview

The heavyweight tier above a lighter peer-review. When a decision is genuinely hard — architecture, deps, major UX, a security/data-model call — or when a single peer reviewer deadlocks, convene every available LLM family (one per vendor) at max reasoning, and debate to unanimous consensus. The same council also serves as the gate that certifies a council-gated automated action (e.g. an auto-merge).

Core rule: one veto rejects. Reaching unanimity is what grants authority to act on the decision — including push + open PR — while a hard ceiling (no infra mutation, cloud-provider writes read-only) holds regardless of any vote. The bar is MVP/PoC-correct (fixable after human tests), not perfection.

Integrity principle (the gate must verify itself). A safety gate that doesn't check whether its own reviewers actually ran licenses the automated action on false confidence — worse than no gate. So the gate is codified in run-council.sh (liveness-smoke → verdict-contract → quorum → audit), never reconstructed from memory. A reviewer that exits 0 but produces no valid verdict is INVALID — never silently counted as a vote. This rule exists because it has failed live: a mis-invoked reviewer returned a greeting instead of a review (some CLIs — e.g. agy — read their prompt from stdin, not a positional arg; see roster.md).

When to use / not use

Use for: a hard/high-stakes call (architecture, dependency choice, major UX, security/data model); or when a lighter peer-review tier hits impasse/round-cap; or the gate of a council-gated automated action. Not for: routine spec/plan/diagnosis gates (use a single peer reviewer there — far cheaper) — the council is slow and expensive, reserved for the hard ~5% and the automated-action boundary.

Authority model (the point)

• Decision standard: deliver the task's MVP/PoC, correctable after human tests — not perfection.
• Push is conditional: consensus authorizes push/open-PR only when a standing human go-signal is already present. Consensus decides the design is ready to ship; it does not override absent human arming, and never the ceiling above.
• Gate variant (higher bar, codified): when convened to sign off an automated action that lands code (e.g. a feature-PR auto-merge, human pre-authorized and council-gated), the council applies a hard-evidence certainty standard — it must be certain the action won't break the mainline, backed by green CI + the local quality cascade + a contained, intended diff scope. It tolerates only minor, justified imperfections (e.g. a mock blocked by an external dependency), never breakage. The council still never grants the action — it certifies safety; the standing human authorization is the grant. Run it via run-council.sh --gate merge (below), not by hand.

The veto standard (what makes unanimity achievable)

A VETO is reserved for "this proposal fails to deliver a working MVP/PoC, or breaches a hard rule (security, the ceiling above, the task's acceptance criteria)." Preferences / perfectible-later improvements are voiced as non-blocking notes — they are NOT veto-grounds. And a reviewer that did not actually review (INVALID) is not a veto and not an approval — it is excluded and retried (quorum below).

Without this, unbounded debate + any-veto = permanent deadlock. The standard is the circuit-breaker on content; the round cap (below) is the circuit-breaker on time.

Roster and per-member calls

One strongest model per family, ≥3 distinct families — codex (OpenAI) · grok (xAI) · claude (Anthropic) · agy (Google). Whichever family is running the session is the in-session driver-member (full vote + veto); the other three families are invoked as external CLIs. Don't double a vendor (e.g. don't spawn an external claude when the driver already is claude). <3 families ⇒ cannot convene → fall back to a single peer reviewer or the human. Each member runs at max reasoning, under a hard gtimeout 600 wrapper, with </dev/null (or stdin for the CLIs that read their prompt from stdin). Detail + exact flags: roster.md. The pinned, drift-proof invocations also live in run-council.sh.

The debate (bounded round loop — for hard DECISIONS)

The driver is a full voting + veto member, not just facilitator — unanimity includes the driver.

digraph council {
  node [shape=box];
  p   [label="driver presents proposal\n+ full context + prior protocol"];
  v   [label="each member emits VOTE: APPROVE|VETO\n(deterministic line)", shape=box];
  all [label="all APPROVE?", shape=diamond];
  pass[label="CONSENSUS → authority granted\n(write protocol first)", shape=doublecircle];
  cap [label="< N=6 rounds on this proposal?", shape=diamond];
  ref [label="circulate veto → refine /\nconvince the vetoer → re-vote"];
  newp[label="< K=3 distinct proposals?", shape=diamond];
  diff[label="driver synthesizes a\nDIFFERENT proposal"];
  human[label="ESCALATE TO HUMAN\n+ full protocol", shape=box];
  p->v->all;
  all->pass [label="yes"];
  all->cap [label="no (a veto)"];
  cap->ref [label="yes"]; ref->v;
  cap->newp [label="no (cap hit / irreconcilable) → REJECT proposal"];
  newp->diff [label="yes"]; diff->p;
  newp->human [label="no"];
}

• Bounded: N=6 rounds per proposal × K=3 distinct proposals (≤18 total) — far beyond a typical peer-review's ~5, but guaranteed to terminate. Not "unlimited".
• Votes are tallied deterministically from the required VOTE: line, never by semantic guessing.
• Protocol + veto standard + auto-iterate detail: debate-protocol.md.

Running the gate — run-council.sh (codified)

For the gate variant (and any single-round certify/veto), don't reconstruct the invocations — run:

./run-council.sh \
  --prompt /tmp/gate-prompt.txt   # task framing + the FULL diff to review \
  --out    /tmp/council-out       # audit dir (logs + council-summary.md land here) \
  --gate   merge                  # or: standard \
  --reviewers codex,grok,agy      # the families that are NOT the current driver
# exit 0 = CERTIFY/PASS · 2 = REJECT(veto) · 3 = INCONCLUSIVE(quorum) · 4 = setup error

It bakes in the integrity machinery so the verdict can be trusted:

• Liveness smoke per reviewer (LIVE_OK_<name>) before the real review — fail-fast on a broken CLI.
• Verdict contract — each reviewer must end with FINAL_VERDICT=CERTIFY or FINAL_VERDICT=VETO: reason; the parser takes the last match (dodges mid-stream template echo). No valid line ⇒ INVALID, retried once, then excluded.
• Quorum — merge: ≥2 VALID + the primary VALID + zero vetoes → CERTIFY; any veto → REJECT; otherwise INCONCLUSIVE. standard: ≥1 VALID + zero vetoes.
• De-anchoring + attack-surface diversity — reviewers are told the author's "all green" is a claim, and each gets a different FOCUS so the council probes the surface, not the same spot three times.
• Audit — council-summary.md (per-reviewer verdict + findings + decision); attach it to the PR.
• bash 3.2-safe (no declare -A; state keyed off per-reviewer files — survives the &-subshell boundary).

Acting on the exit code: 0 → proceed + attach the summary. 2 (REJECT) → read the veto reason, fix systematically, re-run the full local cascade, re-convene (the gate's iteration is in the code, not the debate). 3 (INCONCLUSIVE) → escalate to the human (the council couldn't certify; the automated action is not authorized).

Mandatory written protocol (council minutes)

A required deliverable — the council may NOT grant authority until it is written. For a decision, the driver writes a minutes file (e.g. council-notes/<date>-council-<topic>.md) and embeds it in the authorizing PR body: per round, per member — the proposal; each member's statement/argument; their VOTE; for a veto, the objection + what-would-change-my-vote; how it was resolved; model + reasoning-effort (with sources); and the final unanimous rationale. For a gate, run-council.sh's council-summary.md is that audit — attach it to the PR. Any human can audit who blocked what, why, and how it resolved. Shape: debate-protocol.md.

Red flags — STOP

• Declaring consensus with <3 families, or letting one vendor hold two vetoes.
• Counting a reviewer's greeting / empty / no-FINAL_VERDICT output as a vote (CERTIFY or VETO), or reconstructing the invocations from memory instead of running run-council.sh.
• Treating a preference as a veto (perfectionism deadlock) — veto is MVP-blocker / hard-rule only.
• Using consensus to authorize an infra mutation, cloud-provider writes, or an automated action with no standing human authorization (consensus certifies; the standing auth grants).
• Pushing/opening a PR with no standing arming go-signal (consensus ≠ arming).
• Proceeding to the automated action on INCONCLUSIVE (exit 3) without a human.
• Running a member without max reasoning, or without </dev/null/stdin (hang), or passing a stdin-reading CLI its prompt positionally.
• Wrapping the council in an inner & inside a backgrounded agent call — untracked orphan, lost signal.
• Letting a proposal debate past N=6 rounds, or iterating past K=3 proposals, instead of escalating.
• Granting authority before the written protocol / audit summary exists.

Common mistakes

Companion files

• roster.md — family detection, per-CLI invocation flags, web-search reliability, hard call rules.
• debate-protocol.md — the bounded round loop, veto standard, minutes shape, gate-variant bar.
• run-council.sh — the codified, self-verifying gate runner.