Maestro Council

<!-- maestro-skill-version: dev -->

maestro-council

Use when maestro-design intake scores yes on every ROI question including hard to reverse. The Lead is the final arbiter: it frames, seals, collects, verifies, drafts, and decides. It never performs a seat's analysis itself and never spawns another Lead. Council ends at a decision and a handoff contract; seats never implement.

Lead-only guard

Proceed only as the Lead of a running team, or in a plain session outside a team. A Peer, Verifier, Auditor, or any other seat refuses in one line and returns to its own assignment. A seat never opens a council. No Observer seat exists (Hub d98); a council has exactly the seats its tier names.

The owner chooses the Lead's model and effort; do not second-guess it. Seat routing lives in the five seat profiles of bundle slp-profiles (independent, challenger, specialist, verifier, auditor); this skill carries no routing table.

Protocol at a glance

tier    -> the smallest sufficient tier, in one sentence
brief   -> neutral brief + case output contract + framing lint
sealed  -> one bound work item per round 1 seat, read nothing until all return
collect -> seat audit, failure policy
model   -> typed claims with statuses
verify  -> premise verifier on unanimity, bounded verifiers on dispute
cross   -> one challenge and one response per disputed unit
draft   -> the Lead drafts alone
audit   -> auditor by tier
verdict -> decision draft with dissent, handoff note on the work item

Re-anchor on this list when unsure which step is active. Announce each phase in one line.

Tier

• lens: one Independent.
• debate (default): Independent + Challenger.
• debate-with-proof: Independent + Challenger, Verifiers as needed, audit by default.
• high-risk: Independent + Challenger at the high-risk profile, optionally one Specialist, Verifiers as needed, audit mandatory.

Pick the tier in one sentence. The design ROI score decides only whether a council happens; it never picks the tier.

Brief

Write the neutral brief from the template in references/brief.md. The original request stays verbatim. The snapshot is the branch, commit, and dirty paths, pinned as maestro-design intake already requires; a hash detects drift, it does not preserve bytes. Design the case output contract for this case's natural units (findings, options, gates, timeline) from the patterns in references/report-format.md; never force POSITION or a fixed claim count where it does not fit.

Framing lint: repair the brief until every answer is yes.

• Does it preserve the user's original request?
• Does no wording imply a preferred verdict?
• Does every authoritative fact carry authority or provenance?
• Are unverified premises listed as claims, not facts?
• Are hard constraints separate from preferences?
• Is no option excluded without an authoritative reason?
• Can seats investigate independently within the authorized scope?
• Is the snapshot current where source state matters?
• Does the output contract keep every unit the user expects adjudicated?
• Does no requested heading create filler or seed a conclusion?

Ask the user only when missing authority or scope would change the decision. After lint, the next action is opening the seats; no more context gathering.

Sealed round 1

Every core seat receives the identical brief and output contract plus exactly one role line:

• Independent: reason from first principles, recommend the strongest answer, expose the decision-critical assumptions.
• Challenger: test the framing and the shared premises, build at least one viable counterfactual, say what it makes unnecessary; do not manufacture disagreement.
• Specialist: apply only the requested domain semantics; expertise does not override stronger evidence or product authority.

Open every seat before reading any report. Round 1 is sealed: no seat sees the Lead's view, another report, or another seat's identity, and the Lead reads nothing until every required seat has returned. Seats are analysis only: no edits, no spawning, no contact with other seats, no council skill.

Collect and audit seats

After every required seat returns:

1. Audit the run checkout with git status --short against the pinned dirty paths, and read maestro trace <id> for each seat's work item.
2. A seat that wrote a file, opened work, or contacted another seat is COMPROMISED: its report is unused and named as such in the verdict (Hub d93). Isolation is by profile (Claude disallowedTools, Codex read-only sandbox under the subagent executor) and audited here; never claim a write was technically impossible.
3. Failure policy: one retry with the same brief and snapshot for an infrastructure or output-contract failure; a format-only failure gets one request for the missing content; a compromised seat gets one fresh replacement. lens cannot issue a verdict without its seat; debate tiers continue with one missing core seat only as DEGRADED; high-risk never issues a normal verdict without both core seats.

Decision model

Reduce valid reports into the smallest model that keeps every natural unit. Type each material claim when its type sets the evidence bar: FACT, INFERENCE, CAUSAL CLAIM, FORECAST, VALUE / PREFERENCE, AUTHORITATIVE CONSTRAINT. Statuses are exactly:

verified | falsified | authoritative | supported inference |
contested inference | unresolved | insufficient coverage | snapshot mismatch

Only facts and direct observations are eligible for factual verification. insufficient coverage is never evidence that a claim is false. Do not build a claim graph or a store; the model lives in the Lead's draft.

Verify

Unanimity is not a skip: above lens, when every valid seat agrees, open exactly one Verifier whose single mandate is to name the shared premise in the brief that drives the common conclusion and test it. Verified leads to the Lead draft; falsified opens a second generation with a corrected brief (Hub d94). Only a material dispute opens the full path below.

For a material factual dispute, open one to three Verifiers, each with one precise proposition, the authorized sources, and one distinct mandate: supporting evidence, disconfirming evidence, or coverage audit. Use only the mandates the proposition needs; identical prompts never form an ensemble vote (Hub d95). A Verifier returns:

PROPOSITION CHECKED
MANDATE
SOURCES OR LOCATIONS SEARCHED
DIRECT OBSERVATIONS
RESULT: verified | falsified | partial | insufficient coverage | snapshot mismatch
LIMITATIONS

A snapshot mismatch stops that proposition until the source is refreshed.