consensus-rnd
English canonical public documentation. Chinese companion.
consensus-rnd publishes Agent Skills for Claude Code, Codex, Cursor, and Gemini. Its sshx skill brings isolated worker perspectives to a high-risk decision or implementation task, converges on a concrete plan, and checks the result through independent review. The deliverable is a prompt contract and its supporting files, shared across platform manifests.
Use it when product, architecture, correctness, safety, or cost risks justify separate perspectives. Routine one-step answers whose outcome would not change do not justify the protocol's cost. See the trigger and exclusions.
What It Provides
| skill | What it is for | Runtime shape |
|---|
sshx | Worker-delegated inline consensus for a decision, plan, or finished change. | Prompt contract with worker runners; no skill-owned daemon, GitHub, git, label, release, or lifecycle orchestration authority; optional heca MCP delegation inside heca. |
Core
The engine is not "run the same prompt several times and vote." It is biased, independent, multi-angle convergence:
- Biased independent perspectives: thinking and review workers start from different priors and must not read same-round peer output before sealing their own verdicts.
- Meta-judge convergence: disagreement is reduced into fixed exits: consensus, a compatible concrete plan, or a bounded stall that is surfaced honestly.
- Concrete plans pass the gate: an obvious direction still needs independent validation before implementation.
- Symmetric verification: finished work passes independent reviewers and the fixed review truth table before it is declared done.
- Pure orchestration: the caller dispatches workers and aggregates bounded conclusions; implementation, verification, repair, and design solving remain delegated.
Protocol at a Glance
The protocol has seven ordered stages. The caller handles intake, dispatch, convergence, and reporting; workers own thinking, implementation, and review.
| Stage | Purpose |
|---|
intake | Record the user's goal, constraints, success criteria, and host capabilities. |
choose_worker_mode | Check available worker carriers before dispatch. |
thinking_panel_workers | Test the plan through six isolated perspectives. |
meta_judge | Converge conclusions using the thinking truth table. |
implementation_worker | Delegate the approved outcomes and scope. |
review_triplet_workers | Review the completed candidate independently. |
fix_or_done | Route repairs, further review, or completion under the existing gates. |
The thinking panel assigns a distinct objective to each seat:
| Thinking seat | Lens |
|---|
teleology | Purpose and the form it requires. |
parsimony | How much mechanism is necessary. |
fidelity | Source-verified premises and representative evidence. |
natural-ownership | The layer that naturally owns the duty. |
proportional-containment | The justified scope, authority, and duration. |
worth | Whether the benefit warrants the cost. |
The review triplet applies the review truth table:
| Review seat | Focus |
|---|
architecture | Boundaries, contracts, coupling, and maintainability. |
quality | Behavior, edge cases, failures, and user impact. |
tests | Coverage, determinism, and verification strength. |
A termination gate applies inside the final stage only when the host has positively declared a goal-driven continuation mechanism in the goal contract, and an affirmative satisfaction claim is being considered. It is not an eighth stage and grants no control over the host mechanism.
Risks and Limits
- Broad execution access: the Codex runner defaults to
danger-full-access. Read the invocation contract and threat model before supplying a work target.
- Heca execution: seats run unattended with full permissions; heca owns their agents, so host job time limits and teardown do not reach them. On the ordinary route, the caller collects each attempt's successful or failed result and then archives that attempt's own agent. On the stopped-failure route, the confirmed stop archive is the archive and comes before recording the failure. An attempt that was neither collected nor stopped, such as a caller interrupted before collection, remains unarchived; an archive call that fails after collection is reported as unresolved housekeeping. Archived history stays readable in heca. Support is limited to recorded evidence. See worker delegation.
- Cost and duration: a full initial run dispatches at least 10 worker turns, each potentially making multiple model calls: six thinking seats, one implementation worker, and three reviewers. Repair, focused, repeated review, and applicable termination passes add work. There is no
pass_budget cap by default; see the protocol, panel, review, and pass accounting.
- External content transfer: the oracle seat sends the inlined brief through NyxID to an external ChatGPT Pro account. Consider what the brief contains before dispatch; see worker delegation and the oracle .
Quick Start
Prerequisites and carriers
The host must provide background execution with completion notification, time limits, and whole-job teardown for runner dispatch. Worker delegation owns capability checks, seat assignment, bounded retries, and fallback.
| Carrier | Prerequisites and role |
|---|
codex-cli | Bash, jq, and an executable, usable Codex CLI; a writable run root and supplied work target. Initial seats when heca is unavailable and fallback seats inside heca use the Codex runner. |
heca | Explicit user or host opt-in for this sshx run, with heca's MCP agent tools exposed to the session and an existing placement matching the work target. Disabled by default; takes all initial Codex seats when available, including implementation and repair. See Using Heca Workers and worker delegation. |
nyxid-oracle | Python 3, Bash and jq for path projection, and a usable NyxID CLI with an active broker pool containing an online worker. The oracle runner owns dispatch; see pool selection and login diagnostics. |
isolated-token-subagent | A host subagent facility with isolated token context; same-round peers cannot read one another's outputs before returning their verdicts. |
abstain | Stop honestly when no carrier is available or a required flight exhausts retries and fallback; this is an outcome, not an execution carrier. |
Every multi-seat stage initially assigns one seat to the isolated subagent, one to the oracle, and the rest to heca when explicitly enabled and available, otherwise Codex CLI, subject to seat constraints and fallback. The tests reviewer needs a carrier that can execute verification in the work target. Carrier assignment and isolation do not by themselves establish model diversity; see the owning policy.
Using Heca Workers
sshx supports heca alongside codex-cli and nyxid-oracle as a worker carrier. Heca is disabled by default. When the user or host explicitly enables it for this sshx run and its non-mutating capability check finds the exposed MCP agent tools, it takes every seat otherwise assigned to Codex CLI: the remainder of each multi-seat stage and every single-worker stage, including implementation and repair. When heca is unavailable, existing carrier composition stays unchanged. The fallback priority stays unchanged, so Codex CLI remains reachable inside heca.
Enable it explicitly, for example: “Use heca workers for this sshx run.” A host instruction explicitly enabling heca for the run also qualifies. Silence, merely mentioning heca, running inside heca, or exposed tools alone do not enable it. The caller records enablement, its source (or absence), and tool exposure once per run in the existing run/gate evidence. Both opt-in and exposed MCP agent tools are required for initial composition, single-worker dispatch, and fallback; opt-in cannot supply missing tools. Seats use those tools directly. You or the host may select a provider and model per seat; by default, seats use heca's codex provider when reported enabled, otherwise the caller's own heca provider, with heca's default model. The work target must have a matching existing heca placement. Worker delegation owns the contract and its evidence limits.
Claude Code
Install the marketplace and plugin, then invoke the skill with your task:
/plugin marketplace add ChronoAIProject/consensus-rnd
/plugin install consensus-rnd@consensus-rnd
/consensus-rnd:sshx <task>
The plugin identity is declared in the marketplace and plugin manifest.
Codex / Cursor
The Codex and Cursor manifests both declare "skills": "./skills/". Use the platform's plugin support to load the repository and read the skill contract; installation and invocation details depend on the host.
Gemini CLI
The extension manifest selects GEMINI.md as its context file. GEMINI.md lists the available skill and directs the agent to read its contract on demand.
Architecture
Contributing
See CONTRIBUTING.md for development prerequisites, local checks, and maintainer-owned release steps. Repository maintenance guidance is in Chinese.
License
MIT © ChronoAIProject
