Multi-agent debate

The flow and design plugins can convene a small team of agents with genuinely different stakes at the moments where multi-perspective argument pays — the bookends of the loop. It mirrors how a real team produces a decision: several people argue, the strongest objection survives, and one informed choice reaches you. The middle of the loop (writing code) stays solo.

It is opt-out: on by default, capability-gated, and additive. With nothing configured you get the cheap panel; with the experimental agent-teams flag on you get the live debate; one config line turns it off. Canonical decision: DDR-130.

Where it fires — the bookends

Two tiers, auto-selected

The only thing a live team adds over a plain parallel panel is stance revision — a seat changing its position after hearing another. That draws the line between the two tiers:

• reduce (every install, no flag). The seats run as parallel subagents that report back; one consolidator reads their verdicts and reconciles contradictions into a single ordered list. Read-only over outputs — it never routes one agent's words into another's input. This is what /design:critic uses to turn "a sum of conflicting blockers" into one coherent, de-conflicted list.
• relay (native agent-teams). When the experimental flag is on, the seats convene as a native Claude Code agent team and message each other — so a seat can revise. The runtime carries the messages; the plugins never hand-roll a debate loop in markdown.

Two gates keep "on by default" from being "always expensive": a stakes-gate (is this decision worth contesting? trivial calls skip it) and a short-circuit (the seats open blind; a full debate only runs when they genuinely disagree — agreement collapses to "converged" at roughly the cost of one panel).

What you need to turn it on

There is nothing to add to workflows.config.json to turn the debate on — an absent block is treated as mode:auto. You add the block only to change the default.

Configuration (opt-out)

All knobs live under orchestration in .ai/workflows.config.json. Every one has a default; the block is optional.

{
  "orchestration": {
    "mode": "auto",
    "bookends": {
      "diverge": { "enabled": true },
      "adversarial": { "enabled": true },
      "research": { "enabled": true }
    },
    "maxSeats": 4,
    "escalationCeiling": 0.5,
    "designTeam": { "enabled": true, "minConflicts": 2 }
  }
}

To turn the whole layer off:

{ "orchestration": { "mode": "off" } }

The cast — stakes, not personalities

Seats are cast by the orthogonal failure mode each one alone catches; the named "personality" is just the voice that stake argues in (a memorable handle elicits a more committed, less-hedged stance). Five are net-new and project-agnostic; the rest are existing reviewers re-seated.

A falsifiable rule keeps the roster honest: if two seats agree on the verdict more than ~90% of the time across runs, they're one seat in two hats — merge them.

Security posture

The debate layer reads repo content (diffs, issues, prior decisions) into agent prompts and can spawn agents with shell and web tools — so it is itself a prompt-injection surface, and it's treated as one. Running the layer's own /flow:validate-security debate against it surfaced and closed two findings (recorded in DDR-130):

• No single seat colocates the trifecta. A seat that ingests the untrusted diff/issue does not also hold a network-egress tool — the flow:investigator carries no web tools and runs shell as read-only local diagnostics only, so injected content can't be exfiltrated through it. Web fact-checking runs in a seat that never sees a code diff.
• The lead treats seat output as inert data. A seat's recommendation is quoted into the plan or canvas, never executed or turned into a tool call — closing the confused-deputy where a laundered-injection string could otherwise steer the artifact.

The reduce tier is read-only over outputs and needs no special trust. The relay tier runs entirely on Claude Code's native agent-teams runtime; the plugins never marshal untrusted agent output through their own string-templating. See Is maude safe? for the wider threat model.