v4.1.1

What's Changed

Bug Fixes

• Integration tests now watched and passing: The integration tier had been completely unreachable from every gate, causing six E2E tests to fail unnoticed behind a dead gemini-flash model alias. These tests now point to the live gemini alias and run in CI via a new keyless wrapper that guarantees no credentials leak and no money is spent.

• Claude review reports no longer show blank judge columns: The --claude-review report was incorrectly including Claude in the adjudication judge matrix even though Claude is only judged, never judges. This resulted in a blank column (or a false self-vote marker) in the report matrix. The judge roster is now filtered independently from the council roster.

• Debate-revote stage now correctly reports skipped status: When the re-vote wave never launches (nothing was defended or cost ceiling was hit), the stage was incorrectly marked complete instead of skipped. This is now a consumer-visible run.json change that correctly reflects the actual stage state.

• Report HTML files now written with secure permissions: amicus council verdict --render now writes report.html with 0o600 permissions instead of falling back to the process umask, matching all other artifact writers and preventing unintended world-readability of model output.

• Removed false CLI wait command documentation: Both docs and help text claimed amicus wait <councilRunId> existed as a CLI command when it does not. Users are now directed to the MCP amicus_wait tool instead, which is the actual blocking primitive.

• Report matrix no longer grows Claude column: Fixed toModel() in report generation reusing the street-cred universe as the judge roster, which incorrectly included Claude and created blank or misleading columns in the adjudication matrix.

• Model alias defaults now derive from live gateway routes: The amicus doctor command and CI model-drift checks were incorrectly reporting shipped default aliases as stale due to using hand-stripped OpenRouter IDs instead of routed direct forms. Defaults now come from toGatewayRoutes() and match their authored direct forms when available.

• Keyless integration wrapper sandboxes all credential-path roots: The previous version only sandboxed HOME/USERPROFILE, leaving XDG_DATA_HOME and APPDATA open as escape hatches for credentials. The wrapper now sandboxes all credential-path roots simultaneously.

Features

• Free keyless integration testing in CI: A new integration job in .github/workflows/ci.yml runs the integration tier on every push and PR with all credentials scrubbed, catching regressions at zero cost and ensuring the tier is permanently watched. npm run test:integration guarantees no credentials leak by repointing HOME, USERPROFILE, XDG_DATA_HOME, XDG_CONFIG_HOME, and APPDATA into an empty sandbox before spawning jest.

• Paid integration tier split to on-demand workflow: npm run test:integration:live and .github/workflows/integration-live.yml isolate the money-spending E2E suites to a manually dispatched workflow, preventing accidental billing and ensuring the keyless tier stays genuinely free.

Changed

• Curated gemini alias now points to Gemini 3.6 Flash: The default gemini alias moves from Gemini 3.5 Flash to Gemini 3.6 Flash on both gateways. This is a silent model change: users with no gemini override will start talking to a newer underlying model on next use after upgrading.

Documentation

• Testing guide clarified for keyless and paid tiers: Updated docs/testing.md, CLAUDE.md, and CONTRIBUTING.md to explain the two-rail integration strategy, why the pre-push hook intentionally runs unit tests only, and which CI workflows run which tier at what cost.

• Release checklist now requires both integration rails: The publishing checklist in docs/publishing.md now requires running npm run test:integration (free keyless) and npm run test:integration:live (paid) before release, since keyless skips the money-spending suites entirely.

• Future plans flagged for de-rotting: v4.5, v4.6, and v4.7 implementation plans now include rotation warnings and guidance for re-grounding against merged main before execution.

Full Changelog: v4.1.0...v4.1.1