docs: M6b implementation plan

Six closed tasks for consult: registry, CONSULT_WAIT, [consult]/[secrets],
ToolName and grants, Decision body, loopback HTTP. Reference is the git bundle
~/boxmaker-refs/m6b-ref.bundle at 5fb05f0. Gate after task 06 is 1611.

Co-Authored-By: Grok 4.6 <noreply@x.ai>

docs/plans/M6b/files/runbook-consult.md

@@ -0,0 +1,44 @@
+## consult-not-configured
+
+**What you see.** A `consult` call is denied as invalid-arguments. The tool result names this
+entry:
+
+```text
+Denied: the arguments are not valid for this tool: consult is not configured; see docs/runbook.md#consult-not-configured.
+```
+
+**Why.** `brokerd.toml` has no `[consult]` table. Every `consult` call is denied until the owner
+writes one. The audit line still holds the JSON body that would have been sent.
+
+**Confirm.**
+
+```sh
+grep -n '\[consult\]' "$BOXMAKER_HOME/../brokerd.toml" /etc/boxmaker/brokerd.toml 2>/dev/null
+```
+
+**Fix.** Add a `[consult]` table with `url`, `model` and `secret`, a matching `[secrets.<name>]`
+entry, and a grant whose `tool` is `consult`. Restart `brokerd`. M6's URL is loopback only.
+
+**Check.** A `consult` from a session whose taint is at or below the grant's `max_taint` returns
+an answer, and the audit line's `body` matches the bytes posted.
+
+## consult-secret-unreadable
+
+**What you see.** `brokerd` does not start. The line names the secret and this entry, and may
+also name `secret-unavailable` or `secret-in-a-file`.
+
+**Why.** `[consult]` names a secret that is missing from `[secrets]`, whose spec is not exactly
+one of credential/env/file, or that the secret store cannot read (missing, too open, or not
+UTF-8).
+
+**Confirm.**
+
+```sh
+# the name in [consult] secret = "…"
+ls -l <the file or credential path>
+```
+
+**Fix.** Put the bearer in the store the spec names, mode `0600` for a file, owned by the
+user `brokerd` runs as. Restart `brokerd`.
+
+**Check.** `brokerd serve --config <path>` prints the serving lines and no secret error.