v0.4.2 — security patches + GitHub install support

What's in this release

🔒 Security

• Upgraded @anthropic-ai/sdk to ≥0.91.1 to clear GHSA-p7fg-763f-g4gf (CWE-732, insecure default file permissions in the local-filesystem memory tool).
• Patched transitive esbuild vulns: GHSA-gv7w-rqvm-qjhr (NPM_CONFIG_REGISTRY RCE) + GHSA-g7r4-m6w7-qqqr (arbitrary file read on Windows dev server).
• npm audit now reports 0 vulnerabilities.

📦 Install

• Added prepare: tsc so npm install github:alex-jb/council-diff#v0.4.2 auto-builds dist/. Lets downstream TypeScript projects pull this from GitHub directly until the next npm publish.

🌐 Distribution

• council-diff is now distributed across 71 AI agent platforms via skills.sh: npx skills add alex-jb/council-diff installs SKILL.md + types + source to Amp / Antigravity / Claude Code / Cline / Codex / Cursor / Gemini CLI / GitHub Copilot / Kimi Code CLI / Warp / Zed +60 more.

🧪 Verified by

• Local npm audit: 0 vulns
• Local npm run build: passes
• Local npm test: 1/1 passing
• skills.sh install: SKILL.md + dist/ + sources fully unpacked
• Downstream consumer build: Council-for-Slack v0.4.2 GitHub install → Next.js production build green

Upgrade

# npm (when v0.4.2 publishes — currently still serving v0.4.0)
npm install council-diff@0.4.2

# GitHub tag (works immediately, audit-clean)
npm install github:alex-jb/council-diff#v0.4.2

# skills.sh universal install (71 agent platforms)
npx skills add alex-jb/council-diff

🤖 Generated with Claude Code

v0.4.0 — Software 3.0 reference implementation (Karpathy framing)

What's new in v0.4.0

Repositioned as the OSS evaluation loop for multi-persona AI agents — directly mapping to Karpathy's Software 3.0 framing (Sequoia AI Ascent, April 20, 2026).

• Paste a decision → get 5 persona verdicts in parallel
• Watch personas disagree → optional Fable 5 Oracle adjudicates
• Brier-audit every voice when the real-world outcome resolves
• Shipped 6 months before Anthropic's "advisor strategy" beta (announced June 9, 2026)

Install

```bash
npm i council-diff
```

Why this is a Software 3.0 artifact

Software 3.0 has no compiler error or unit test that catches a hallucination. The agentic engineer's job: design specs precise enough that ambiguity has nowhere to hide, then build the evaluation loop that catches model drift. council-diff is the smallest reproducible version of that loop.

Sister project

skill-truth-check — Brier-style calibration audit for the AI skill marketplace ecosystem (Anthropic Skills standard, June 2026).

License

MIT

v0.3.1 — Fable 5 Oracle privacy disclosure + safeMode

Privacy + safety layer on top of v0.3.0 Fable 5 Oracle.

Read together with the v0.3.0 release notes for the Oracle backstory. v0.3.1 is the small but load-bearing privacy/transparency pass.

What's new

• 30-day data retention disclosure — Mythos-class models (which Fable 5 Oracle uses) carry an explicit 30-day retention window on Anthropic's side. Council-diff now surfaces this with a data_retention: "30day-mythos" field on every response so privacy-positioned downstream apps can branch on it.

• safeMode silent downgrade — pass safeMode: true to force Sonnet 4.6 as the Oracle fallback instead of any Mythos-class model. No 30-day retention, slightly weaker adjudication, fully opt-in. Designed for apps that can't ship Mythos data to a third-party.

• API surface stable — no breaking changes from v0.3.0. Add the two new optional fields and you're done.

Pairs with

• polymarket-brier-skill — calibration layer for prediction markets. Pass council-diff output through Brier audit to track which voice has been predictive over 30 days.
• solo-founder-os — the agent stack that birthed both projects.

Install

```bash
npm install council-diff@0.3.1
```

Hackathon

This release is the version going into the Band of Agents Hackathon submission (deadline 2026-06-19) under the "3+ agents collaborating" track. The Oracle + 5 voices = literally 6 agents in disagreement-and-resolve shape.

v0.3.0 — Fable 5 Oracle mode

What's new

oracle: "fable-5" opt-in on DeliberateInput. After the 5-voice council deliberates, Claude Fable 5 (Mythos-class flagship shipped 2026-06-10, 95% SWE-Bench, 1M context) reads every verdict + the consensus and issues a single adjudication with override authority over the council.

Returned on CouncilResult.oracle:

• model — e.g. claude-fable-5
• recommendation — go / wait / kill / split
• score — 0-100
• verdict — 2-3 sentences naming which voices it sided with
• override_reason — set only when Oracle disagrees with the council

Why two layers

Single-LLM answers hide their own uncertainty. A 5-voice council exposes the disagreement. A flagship adjudicator picks which side actually holds up. Both layers Brier-audited separately at resolution so you see when Oracle wins vs underperforms the council, instead of taking either's word for it.

Quickstart

```ts
import { CouncilDiff } from "council-diff";

const council = new CouncilDiff();
const result = await council.deliberate({
domain: "founder",
decision: "Ship hosted SaaS at $29/mo or stay OSS-only?",
context: "11-agent OSS stack, 3 paying customers begging for managed",
oracle: "fable-5",
});

console.log(result.recommendation); // council vote
console.log(result.oracle?.recommendation); // Fable 5 vote
console.log(result.oracle?.override_reason); // set only when they disagree
```

Try it: `ANTHROPIC_API_KEY=... npm run example:oracle`

Cost

• Council only: ~$0.03/call (Sonnet 4.6)
• Council + Fable 5 Oracle: ~$0.10/call total

Install

```bash
npm install council-diff@0.3.0
```

(npm publish pending NPM_TOKEN setup — for now, build from source.)

Diff

dd65f42 feat(oracle): v0.3.0 — Fable 5 Oracle mode (wave-borrow within 24h launch window)