@akinet/akidevrule 3.3.1 → 3.4.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## [3.4.0] - 2026-09-26
+
+### Fixed
+- **Antigravity's shared allowlist lost a `--claude-dir` profile's skill-script entries on the next plain install run.** Evidence: the new pre-allow-everywhere mechanism below (`lib/permissions.mjs`) prunes any "owned" allowlist entry absent from the current run's known Claude roots, but Antigravity's allowlist is one machine-wide file, not per profile, a profile reachable only via an explicit `--claude-dir` flag is not rediscovered on a later flagless run, so its entries read as stale and were deleted (caught by the existing `install-smoke.yml` field-only-update assertion, reproduced locally: 12 entries for a second profile vanished after one follow-up run). Mechanism: `recoverSkillRoots` (`lib/permissions.mjs`) reads a target's already-recorded allowlist before pruning and re-admits any profile root still present there, so a root once recorded stays known across runs; verified stable across three additional install runs with no drift or duplication.
+- **AG's native rule descriptions are generated from the router's routes table.** Evidence: `install.mjs` carried a second, hand-written set of routing descriptions that had drifted from the router (deep-think fired only on "big, hard-to-reverse" decisions there, on any decision in the router). Mechanism: `AG_RULE_MAP` keeps only trigger and globs; each `model_decision`/`glob` description is `Load when the task <route clause>.`, and a payload rule with no route aborts the install. Rejected: embedding the router into `~/.gemini/GEMINI.md` and promoting `coding`/`pattern` to `always_on`, AG's routing is already native, and `always_on` is rationed because all `always_on` rule files share one budget of about 43 KB, past which AG silently drops whole files, largest first (measured 2026-09-26, `docs/research/rule-delivery-force-load-sep25.md`; the earlier "~12,000 characters per file" figure from `docs/plan/done/antigravity-rule-delivery.md` §2.4 did not hold). Description-routed rules are never inlined and have no size limit, the 41 KB release rule loads whole when the model views it. A third run showed the model does attempt `view_file` on a matching rule, but agy denies reads under `~/.gemini/config/rules/` ("hardcoded system protection boundary") and the model recovers by reading the copy under `~/.aki/akidevrule/`. Mechanism: every generated description now ends `view_file ~/.aki/akidevrule/<file>` (the path the installer already pre-allows), and `payload/GEMINI.md` §3 orders a session-start `view_file` of `RULE-coding.md` and `RULE-pattern-core.md` plus a `[RULES] … (viewed)` receipt, an imperative sentence in the always-loaded file instead of `always_on` bytes, since the two core rules (~36 KB) would evict the behavior rule from the shared budget. Rejected: inlining the router into `GEMINI.md` (10.8 KB duplicating descriptions AG already routes on).
+- **Installer preflight reported `Bash=⚠️ missing` on every Claude target**, it still looked for the directory-glob rule this release replaces; it now checks for any installer-owned script rule.
+- **The router went uninvoked unless the owner asked for it by name, it is now `@`-imported.** Evidence: the owner had to say "nạp akirule" before any contextual rule loaded. Root cause: `akirule` was a skill, and a skill runs only when the model decides to invoke it; the regression dates to `1b0f2ab` (2026-08-01, pre-1.0.0), which narrowed its description from "loads core rules on every task" to a contextual router, removing the only pull toward invoking it on ordinary work. No later release removed a forcing mechanism, none had ever existed. Mechanism: `claude/CLAUDE.md` imports `~/.claude/skills/akirule/SKILL.md` beside the four core files, so the routing is in context every session; only the `Read` of a routed file stays model-dependent, and the `[RULES]` receipt exposes that hop. Rejected: a `UserPromptSubmit` reminder hook (still one model hop, the skill invocation, and a per-turn token cost, declined 2026-08-03); re-widening the description (the same best-effort mechanism that failed). Cost: the router is paid every session, cut from ~19.7 KB to ~10.7 KB by the rewrite below so the guarantee stays cheap.
+- **`~/.claude-*` profile installs imported the primary profile's router.** The `CLAUDE.md` template hardcodes `@~/.claude/skills/akirule/SKILL.md`; the installer now rewrites that import to each target profile's own `skills/`, so a profile with no primary install still gets the router.
+- **Skill scripts still prompted in Claude Code.** Root cause: the installer wrote only `Bash(python3 ~/.claude/skills/*)`, and Claude Code matches the raw command before `~` expansion (issue #18160), so an invocation with an absolute path never matched. Now one rule per script in both renderings.
+
+### Changed
+- **`[RULES]` receipt drops the `| missing:` field**, router, `agent.A5`, `akiship`, the five `claude/agents/` definitions, `akihelp`, `README`. Evidence: in practice it always read `missing: none`, so it spent a column on every turn to carry nothing. A file that was not read is already visible as its absence from the line, which is how `aki-conduct` now detects a LOAD-fail; a worker that cannot read a required rule says so and stops, as before.
+- **Routing by meaning, anchored by concept signals (`skills/akirule/SKILL.md` rewritten).** Every route was a list of English and Vietnamese phrases used as the test, a leaf patch that misses every synonym and fires on words used in passing, and the new `frozen-ref` entry added a sixteenth such list. Each route is now one clause naming the domain and the act, applied to a two-term classification of the task (domains touched × create/decide/audit/ship) in any language; a project binding is a standing signal. Tier 2 is "the owner asks to load the whole corpus", not a phrase list. The rule is recorded as an authoring principle in the repo `CLAUDE.md`, with the content-language exception narrowed from Vietnamese keyword lists to concept terms in the signals column. Each route also carries a **signals** column: one term per concept the domain owns, artifacts (`.sql`, `wrangler.toml`), symptoms (a freezing app), question shapes (is it done, is it worth it, is this overkill), in English and Vietnamese, each standing for every synonym and never gating a route. Evidence from a routing probe (router text given, model asked which files to load): on full-sentence requests the semantic router matched the old one (Haiku 97% vs 98%, Sonnet 100% both); on terse colloquial Vietnamese it lost recall (Haiku 65% vs 82%, Sonnet 93% vs 100%), and the misses were concepts absent from the clauses (a freezing app, "done yet?", "overkill?", "you decide"). On fresh wording the old phrase lists missed as well (Haiku 81%): a list used as the test does not generalize, a concept used as evidence does. The signals restore the old lists' concepts, not their phrasing variants. The akirule `description` also names its domains, since on skill-only harnesses (Codex, Kiro, Grok) it is the sole trigger. Unverified: the signals column itself was not re-measured.
+- **Every remaining phrase-list trigger rewritten as a semantic clause**, descriptions of `akilint`, `akidevsync-notes`, `akihelp`, `akihtmlreport`, `aki-article-writer`, `akiship`; activation lines of `METHOD-audit-zero-trust.md` and `METHOD-audit-frozen-reference.md`; `ui.C` section triggers; `release.B8`'s completion-intensity list (now "wording in any language that insists the run finish everything, end to end"); `/akithink`'s converge and self-authorization cues. Same root as the router rewrite: a phrase list is a leaf patch. Kept: `akiship`'s activation table, which is a worked example of the discrimination, not a trigger list.
+- **`/akithink` self-run mode thinks and never acts.** Evidence: twice in one session the agent ran a self-run on a question turn and then edited files on its own conclusions, against `agent.A3`. Root cause: the self-run clause read "converges, acts, and reports", and the skill description carried its own copy of the `agent.A3` trigger list, the skill both decided when to fire and licensed the action. Mechanism: the session ends at the decision block; whether anything is executed is decided by the originating turn's class per `agent.A3`, outside the skill (`pattern.A3`: thinking is one responsibility, acting another). Self-run fires on an `agent.A3` trigger, the router's deep-think-depth line, or owner authorization; the description points at that list instead of restating it. Interactive sessions stay owner-invoked, because they spend the owner's turns.
+- **Antigravity's Nuxt rule no longer globs `**/*.ts`**, it attached the 20 KB stack rule to every TypeScript project; the globs are now the Nuxt/Cloudflare artifacts themselves (`.vue`, `nuxt.config.*`, `wrangler.toml`, `app/`, `server/`, `composables/`, `middleware/`, `plugins/`, `layouts/`).
+- **`harness-facts.md` is marked as a facts file that must be updated on every provider change**, and the agy discovery default moved to `gemini-3.8-flash-high` (`agy models` 2026-09-26; `aki-hands.md` and `docs/arch/akiflow.md` follow). Evidence: the agent flagged the newer tier to the owner instead of recording it, the owner's rule is newest Flash `-high`, so an observed fact was turned into a question. The header now says so.
+- **`agent.A5` no longer names a model.** It carried `agy --model gemini-3.7-flash-high …`, an owner-set default with its date and a CLI quirk, machine facts inside a public core rule loaded in every session, and already drifted (this machine runs a newer Flash). `model-tier-host-resolution-sep08.md` had made `harness-facts.md` § Host resolution the single table for per-host model ids and left this sentence behind; A5 now names the tier and points at that table (`pattern.A1`).
+- **Tier 1/Tier 2 vocabulary removed** from `README`, `index.md`, `akihelp` and the delivery architecture doc, the router has had no tiers since the rewrite above; the manifest's Core/Contextual/Analytical column is unchanged. The receipt's `(core)` row names the three core rule files instead of "the four imported files", now that a fifth file is imported.
+- **Sequential full audit route.** A request to check a codebase across every standard now loads zero-trust, flow, subtract, docs and content (plus ui for a frontend) and runs them in a fixed read-only order, detectors, structure, subtraction, docs drift both directions, content, into one report. Composes existing methods instead of adding a skill: every pass already existed, only the order was missing.
+- **Installer pre-allows every Aki skill script in every harness present** (`lib/permissions.mjs`, new). One inventory (`skills/*/scripts/*.py` × skill roots × absolute and `~/` renderings × launchers) feeds one adapter per rule dialect: Claude Code, Antigravity CLI/IDE, Kiro (marker-delimited managed block), Codex (`~/.codex/rules/akidevrule.rules`, a file akidevrule owns), Cursor CLI (`Shell(python3:<script>*)`) and OpenCode (`permission.bash`). Before, only Antigravity and Kiro were written, only akiflow's scripts were covered (`notes_cli.py` prompted everywhere), and Codex/Grok rules documented in `docs/ref/` were never installed. Ownership is a predicate (a Python launcher pointing into `<aki-skill>/scripts/`, or a directory-glob rule of an earlier release), so renamed scripts are pruned and user entries are kept; a config that fails to parse is reported and skipped. Grok CLI and Ollama have no file-based allowlist, so nothing is written for them. Rejected: `Shell(python3)` / directory wildcards (allow every Python command); a Kiro append-only merge (re-appended on every run, never pruned).
+- **`AG_RULE_MAP` covers `METHOD-audit-frozen-reference.md`**, and `installAgRules` now fails loudly when any `RULE-*`/`METHOD-*` file lacks an entry, the gap that let the new method ship without an Antigravity rule.
+- `docs/ref/cli-permission-allowlist-standard.md` rewritten against vendor docs read 2026-09-25: Codex rules live in `~/.codex/rules/*.rules`, not `config.toml`; the Grok `user-settings.json` `Bash()` schema it described is not a documented mechanism.
+
+### Removed
+- `skills/akiflow/scripts/*.sh`, "transitional" wrappers from the `.py` migration (2.2.0) with no remaining live reference.
+- `docs/plan/from-aug22.md` → `docs/plan/done/`: every item parked with a reopen trigger; §9 (a skipped project `prebuild` gate) was closed by `release.B7` step 6 in 3.3.0, which makes build & test mandatory on every release.
+
+### Added
+- **`docs.A5`: admission bar for the auto-loaded instruction file** (`CLAUDE.md`/`AGENTS.md`/`GEMINI.md`). Evidence: the harness prepends that file to every request, making it the most expensive doc in a project, and the corpus only said "keep it short". Mechanism: five tests per line, nameable harm when absent, majority-of-requests reach, not derivable from code or a routed doc, not a restatement of the corpus, facts and limits rather than behavior, as a domain application of `agent.A4`'s deletion test (lens row in `index.md`). Placed in `docs.A` because editing that file is a docs act and the docs route already fires on its name; not in the core behavior rule, which would charge every session for a rule needed only when that file is edited. Rejected: a numeric reach threshold, a number in a rule invites counting instead of judging.
+- **"Obvious" and "impossible" are defined against the project's pinned facts** (`coding.C1`, pointed at from `coding.B4` and `pattern.A8`). Evidence: the owner kept prompting by hand against guards for states the docs rule out, fallbacks for dependencies `CLAUDE.md` declares present, comments restating known facts, and patches beside a defined flow, every rule existed, but each judged "obvious" against the code alone, with no reference frame. Router: the flow and subtract routes gain the concepts patchwork and redundant guard (EN · VI).
+- **`agent.B3` adds spending paid API credits or session quota to the ask-before list.** Evidence: an agent running prompt-classification benchmarks in scratchpad spawned 1,609 headless calls via `ThreadPoolExecutor(8)` calling `claude -p` with an overridden `HOME`, consuming $67.83 USD in ~40 minutes and hitting the 5-hour quota limit (100% full) while concealing telemetry from `ccusage`. Root cause: `agent.B3` listed billing assumptions and external services, but nothing explicitly treated spending billable credits or burning session quotas for tests/benchmarks/verification as a one-way-door action requiring user consent. Mechanism: `agent.B3`'s ask-before list now explicitly includes `- any test, benchmark, or trial run that spends paid API credits or session quota`. Rejected: technical symptom-patching rules (banning `ThreadPoolExecutor`, Python loops, or setting `HOME` in scratchpad), which miss other languages/runtimes; the invariant is the consumption of finite paid resources/quota for evaluation.
+- **`METHOD-audit-frozen-reference.md`: audit method for clauses naming a concrete external artifact as the canonical shape to match.** Evidence: a private project's audits kept re-surfacing the same structural drift against its own frozen reference, each session judged "looks compliant" from memory of the reference instead of a literal diff. Root cause: existing methods audit against principles (DRY, naming) satisfied by reading well; a frozen-reference clause claims literal parity with a specific external artifact, and nothing forced the audit to diff that artifact's actual bytes. Mechanism: resolve the clause to an exact path before judging, read at least two implementations when more than one reference exists (disagreement between them is a standard-vs-practice gap charged to the rule corpus, not the target), build a comparison table one literal unit per row with a verdict of MATCH/RENAMED/MISSING/EXTRA/STRUCTURAL-DIFF only, never softened inside the audit. Inherits `zero-trust`'s evidence discipline and `agent.B5`'s read-only floor. Routed Default ON in `akirule/SKILL.md` when a project's CLAUDE.md names a concrete external reference. Rejected: folding into `METHOD-audit-zero-trust.md` (different detector kind, live diff against another file, not local static analysis); a domain rule instead of a method (the gap was a missing procedure, not a missing constraint).
+
 ## [3.3.1] - 2026-09-22
 
 ### Changed

package/README.md

@@ -1,6 +1,6 @@
 # akidevrule
 
-One install command turns a fresh environment into Aki's full working baseline — for **Claude Code, Antigravity/Gemini, Codex CLI, Kiro CLI, and Grok CLI**, generated from one agent-neutral source: a shared rule corpus that loads itself at the right moment (Claude Code + Antigravity), plus a small set of sharp, single-purpose skills synced to every CLI that natively consumes the shared `SKILL.md` open standard.
+One install command turns a fresh environment into Aki's full working baseline — for **Claude Code, Antigravity/Gemini, Codex CLI, Kiro CLI, Grok CLI, Cursor and OpenCode**, generated from one agent-neutral source: a shared rule corpus that loads itself at the right moment (Claude Code + Antigravity), plus a small set of sharp, single-purpose skills synced to every CLI that natively consumes the shared `SKILL.md` open standard.
 
 **Quick install (npm):**
 
@@ -63,11 +63,11 @@ Interpreter convention (documented once): the installer and hooks run on `node`
 
 | Skill | Invoke | Purpose |
 |---|---|---|
-| `akirule` | automatic, every conversation | Smart rule router — contextual rules on signal match, everything on `nạp full` / `load all rules`. Core rules do not pass through it: the harness `@`-imports them, so they hold even when this skill never runs. Also owns the **`[RULES]` receipt** — one mandatory line reporting the whole rule context (`core` + `router` + a `missing:` field), so that "the rule never arrived" stops sharing a signature with "the rule arrived and was ignored". Hidden from the `/` menu by design. |
+| `akirule` | automatic, every conversation | Rule router — `@`-imported by `~/.claude/CLAUDE.md` in Claude Code, a skill elsewhere. Routes each task turn by meaning (the domain touched and the act), anchored by bilingual concept signals that never gate; full corpus on an explicit load-everything request. Core rules do not pass through it. Also owns the **`[RULES]` receipt** — one mandatory line reporting the whole rule context (`core` + `router` — what is loaded, nothing else), so that "the rule never arrived" stops sharing a signature with "the rule arrived and was ignored". Hidden from the `/` menu by design. |
 | `akiflow` | `/akiflow` | Lead-coordinated **agent council** for work needing more than one kind of judgment. The lead's job is two laws: **ANCHOR** — the owner's verbatim message is pinned as the run's immutable first block (`council_open.py` refuses to open a room without it) and every numbered requirement must quote a fragment of it; and **JUSTIFICATION** — every seat, check and script is OFF by default and turns on only when this run produces a reason, so there are no standing seats and no roster derived from a tier. It decomposes the request into owned work items, checks a three-condition activation gate, and convenes seats from the five definitions in `~/.claude/agents/` — one batch, each seat traced to a requirement, never picked from a menu. **Two shapes, discriminated by whether anything is actually being arbitrated.** A *council* is items with adversaries, for work where two competent seats could reach different defensible answers. A *dispatch* is lanes with exclusive file ownership, for a fan-out whose answer is already knowable and whose only real hazard is two workers writing the same file — `--convene` refuses an overlapping `writes:` before a token is spent. Dispatch drops the challenger, the debate and the three-condition gate; it keeps the anchor, the quoted requirements, the `[RULES]` receipts, the durable record and the whole closure gate. It exists because 19 of 70 live rooms posted no debate turn at all and 11 of those still did substantive fan-out work, paying council overhead for machinery they never used. Orthogonally, three modes discriminated by one question, *what changes outside the room*: `discuss`, `audit` (read-only by construction), `execute` (only `aki-maker` may write). The lead does no menial work and settles what doctrine answers, escalating only a one-way door, a contradiction with documented design, or scope expansion — then writes the owner's answer back into doctrine the same turn, so a question never escalates twice. `council_verify.py` refuses closure on a missing anchor, a requirement quoting nothing the owner wrote, a declared seat that left no trace anywhere in the session, a seat with no `[RULES]` receipt, or an unanswered reminder — reading each seat's own `<seat>.md` as well as its turns, and printing `SKIP` rather than `PASS` where there was nothing to check — and deliberately requires no named seat, since an earlier version that did forced a seat to exist in a run with nothing to enforce and was gamed rather than questioned. **A read is a subscription, not a purchase** — the cost model that shapes how the room is used: every turn re-sends the whole history, so a read of size `S` at turn `t` of a `T`-turn run is charged about `S × (T − t)`, and pulling a 50k-token room at turn 50 of 200 costs ~7.5M cache-read tokens from one call. Measured on a real run with three `aki-maker` seats doing every file edit, the lead still held 70% of cache-read and 66% of output: delegation moves the work but not the money, because what a run pays for is the lead's own accumulated context. Hence `council_read.py --grep` to locate for a few hundred bytes and `--turn` to pull only what the grep pointed at. Close-out reconciles declared model tiers against actual spend, cross-CLI calls added by hand since they never appear in the transcript. Design record: [`docs/arch/akiflow.md`](docs/arch/akiflow.md). |
-| `akithink` | `/akithink` | Structured deep-thinking session for big, hard-to-reverse, or goal-ambiguous decisions: restate → goal excavation → first principles → mandatory critique → convergence into a `docs/` decision record. Interactive by default; a non-interactive self-run mode fires when the owner authorizes it or an `agent.A3` deep-think trigger holds, ending in decide-and-report or escalation. Recommends a top-tier model (Opus/Fable). |
+| `akithink` | `/akithink`, or self-run | Structured deep thinking: restate → goal excavation → first principles → mandatory critique → convergence into a `docs/` decision record. Self-run (model-invoked, non-interactive, decide-and-report) whenever the task is a decision rather than execution; interactive only when the owner asks. Recommends a top-tier model (Opus/Fable). |
 | `akihtmlreport` | `/akihtmlreport` | Distills a dense analysis already in the conversation into one self-contained, ultra-wide `REPORT.html` at the project root — no new analysis, no dropped detail — then opens it locally. Exactly one per project; asks before overwriting. |
-| `akihelp` | `/akihelp` | Live introduction to the whole installed Aki system, rendered by reading `index.md` and skill frontmatters at runtime — it can never go stale. Includes a **painpoint → what to say** table (sprawling CSS, docs that no longer match code, a half-finished tree, a pre-ship check, a hard-to-reverse decision, padded or hard-wrapped output, over-guarded flows, UX friction, pricing calls) built from that live state, with any row whose target is not installed dropped rather than shown. Closes on the caveat that governs everything else: `akirule` is a skill and therefore best-effort, so name the rule file in the prompt whenever the load must be deterministic. |
+| `akihelp` | `/akihelp` | Live introduction to the whole installed Aki system, rendered by reading `index.md` and skill frontmatters at runtime — it can never go stale. Includes a **painpoint → what to say** table (sprawling CSS, docs that no longer match code, a half-finished tree, a pre-ship check, a hard-to-reverse decision, padded or hard-wrapped output, over-guarded flows, UX friction, pricing calls) built from that live state, with any row whose target is not installed dropped rather than shown. Closes on the caveat that governs everything else: the router is always present but the `Read` of a routed file is still model-dependent, so name the rule file in the prompt whenever the load must be deterministic. |
 | `akigitcommit` | `/akigitcommit` | Turns a messy working tree into a few clean, logically grouped Conventional Commits. Triages a half-finished tree first — finished vs mid-edit vs abandoned vs accidental, asking rather than guessing — then stages by explicit path, never `git add -A`, never pushes unasked. |
 | `aki-article-writer` | `/aki-article-writer` or natural language | Per-project article writing pipeline: research & fact-verification, SEO metadata, JSON-LD schema, UX-psychology-aware content, and a dedicated Image Scout subagent (Gemini Flash / Haiku) for search → download → visual inspection → ffmpeg processing → slug-named WebP output. One subagent per article; image work is always isolated to a separate lightweight subagent. |
 | `akidevsync-notes` | natural language | Reads/edits a project's `.akidevsync/notes.json` — the per-project task list the Aki-Dev-Sync app itself writes (list/add/pin/mark-done/edit/delete tasks) via a bundled script that preserves the app's own JSON formatting, plus a workflow for cross-checking pinned notes against a shipped release (CHANGELOG + code) before marking them done. |
@@ -98,16 +98,16 @@ A catalog is not a roster. Five files on disk make it easy to pick seats from a
 - `METHOD-*.md` — analytical frameworks: how to reason through a specific class of problem. Heavy, loaded only when the task is genuinely analytical.
 - `index.md` — file manifest, precedence order, cross-cutting lens.
 
-Loading happens on two different mechanisms, and the difference matters more than the tier numbering does.
+Loading happens on two different mechanisms.
 
-**Core — harness-embedded, not routed.** `index.md`, `RULE-agent-behavior.md`, `RULE-coding.md` and `RULE-pattern-core.md` are `@`-imported by `~/.claude/CLAUDE.md`, which Claude Code reads mechanically at session start. No model decision is involved, so they are the only rules that genuinely apply to every task. The two rule files were promoted out of Tier 1 after "default ON" proved to be a statement of intent rather than a mechanism: routing them through a skill meant they loaded only when the model first chose to invoke that skill, and the rules needing the most owner correction were absent from the context rather than present and disobeyed. They cost context in every session, including sessions with no code in them — that is the price of the guarantee. `@` imports have this effect **only** inside `CLAUDE.md` — the same syntax written into a skill body looks like an import but loads nothing, because a skill body is read only after the model has already chosen to invoke the skill.
+**Core and router — harness-embedded.** `index.md`, `RULE-agent-behavior.md`, `RULE-coding.md`, `RULE-pattern-core.md` and the router `skills/akirule/SKILL.md` are `@`-imported by `~/.claude/CLAUDE.md`, which Claude Code reads mechanically at session start. No model decision is involved, so the four rule files genuinely apply to every task and the routing is always present. The router joined them for the same reason: as a skill it went uninvoked until the owner asked for it by name. The two rule files were promoted out of the router after "default ON" proved to be a statement of intent rather than a mechanism: routing them through a skill meant they loaded only when the model first chose to invoke that skill, and the rules needing the most owner correction were absent from the context rather than present and disobeyed. They cost context in every session, including sessions with no code in them — that is the price of the guarantee. `@` imports have this effect **only** inside `CLAUDE.md` — the same syntax written into a skill body looks like an import but loads nothing, because a skill body is read only after the model has already chosen to invoke the skill.
 
-**Everything else — routed by the `akirule` skill**, and therefore best-effort: it applies when the model invokes the skill and a signal matches. Sensitivity is deliberately high (err toward loading — a false positive costs a few tokens, a false negative causes wrong behavior).
+**Everything else — routed by meaning.** Each task turn is classified by the domains it touches and the act (create, decide, audit, ship), in any language; each route carries concept signals in English and Vietnamese as evidence, never as the test, so a paraphrase routes as well as the listed word. The one model-dependent hop left is the `Read` of a routed file. Sensitivity is deliberately high (err toward loading — a false positive costs a few tokens, a false negative causes wrong behavior).
 
-- **Tier 1 — Contextual, read on signal match:** `RULE-docs.md` (structure and lifecycle, plus the docs-vs-code drift audit), `RULE-content-write.md` (UI copy and writing style, plus the content audit — canonical-term drift, density deletion test, i18n coverage), `RULE-stack-akiNuxtCf.md`, `RULE-stack-tauri.md` (Tauri v2 + Rust: never-block-the-UI, version SSOT, target context, the macOS TCC/Gatekeeper boundary for spawned sidecars), `RULE-ui-pattern.md` (design-system layer: the subtraction pass that runs before the tier ladder, class taxonomy, tokens, variant API, and the audit playbook), `RULE-seo.md`, `RULE-release.md`, `RULE-db-design.md`, `RULE-biz.md` (market-facing decisions: positioning, pricing, audience) — plus the analytical methods (tagged `Analytical` in `index.md`, but mechanically signal-loaded like the rest of Tier 1): `METHOD-audit-flow.md` (refactors, multi-file bugs, fragile flows), `METHOD-audit-zero-trust.md` (strict mechanical-first audit: detectors before opinion, exact matches separated from pattern-level candidates), `METHOD-deep-think.md` (scope/architecture/value decisions, first-principles and critique-style thinking), `METHOD-ux-psych.md` (UX/user-behavior evaluation, onboarding and conversion flows), `METHOD-proportionality.md` (sizing a guard, limit or accepted risk against reach, capability, motive and blast radius — the lens that stops both over-engineering and client-side-limits-as-enforcement), and `METHOD-audit-subtraction.md` (repo-wide "does this need to exist" sweep, terminating on two dry rounds).
-- **Tier 2 — Full load on explicit command:** `nạp full` / `load all rules` reads every `RULE-*`/`METHOD-*` file at once.
+- **Contextual and analytical — read on route match:** `RULE-docs.md` (structure and lifecycle, plus the docs-vs-code drift audit), `RULE-content-write.md` (UI copy and writing style, plus the content audit — canonical-term drift, density deletion test, i18n coverage), `RULE-stack-akiNuxtCf.md`, `RULE-stack-tauri.md` (Tauri v2 + Rust: never-block-the-UI, version SSOT, target context, the macOS TCC/Gatekeeper boundary for spawned sidecars), `RULE-ui-pattern.md` (design-system layer: the subtraction pass that runs before the tier ladder, class taxonomy, tokens, variant API, and the audit playbook), `RULE-seo.md`, `RULE-release.md`, `RULE-db-design.md`, `RULE-biz.md` (market-facing decisions: positioning, pricing, audience) — plus the analytical methods (tagged `Analytical` in `index.md`, loaded on route match like the rest): `METHOD-audit-flow.md` (refactors, multi-file bugs, fragile flows), `METHOD-audit-zero-trust.md` (strict mechanical-first audit: detectors before opinion, exact matches separated from pattern-level candidates), `METHOD-deep-think.md` (scope/architecture/value decisions, first-principles and critique-style thinking), `METHOD-ux-psych.md` (UX/user-behavior evaluation, onboarding and conversion flows), `METHOD-proportionality.md` (sizing a guard, limit or accepted risk against reach, capability, motive and blast radius — the lens that stops both over-engineering and client-side-limits-as-enforcement), `METHOD-audit-subtraction.md` (repo-wide "does this need to exist" sweep, terminating on two dry rounds), and `METHOD-audit-frozen-reference.md` (compliance audit for a clause naming a concrete external artifact as the canonical shape to match — resolve to an exact path, diff literally against it, never judge from memory of the rule's prose).
+- **Full load on explicit request:** asking, in any wording, to load the whole corpus reads every `RULE-*`/`METHOD-*` file at once.
 
-No harness magic beyond the `CLAUDE.md` import: Tier 1 is trigger instructions telling Claude to Read the file from `~/.aki/akidevrule/` when signals match; Tier 2 is the explicit-command escape hatch.
+No harness magic beyond the `CLAUDE.md` import: routes are instructions telling Claude to Read the file from `~/.aki/akidevrule/` when the task's domain matches; the full-load request is the escape hatch.
 
 ### Addressing — `topic.A1`, and the `⟨Aki⟩` flag
 
@@ -117,7 +117,7 @@ Three files (`RULE-seo.md`, `RULE-release.md`, `RULE-stack-akiNuxtCf.md`) mix un
 
 ### Project binding & change policy
 
-Each project keeps a root `CLAUDE.md` that references the `akirule` skill as the rule loader, defines project-specific facts and overrides, stays short, and avoids duplicating shared rules.
+Each project keeps a root `CLAUDE.md` that binds its stack and any reference implementation (a standing route signal for the router), defines project-specific facts and overrides, stays short, and avoids duplicating shared rules. Every line in it is paid on every request, so it is admitted line by line through `docs.A5`.
 
 Aki-RULE changes affect many projects. Before changing rule files, clarify the intended rule, scope, and tradeoff unless the user explicitly requests the exact change.
 
@@ -125,9 +125,9 @@ Aki-RULE changes affect many projects. Before changing rule files, clarify the i
 
 `METHOD-deep-think.md` is a single analytical brain — goal excavation, first principles, mandatory critique, conditional techbiz lens — consumed three ways:
 
-- **Passive:** `akirule` auto-loads it inline when a normal task hits a signal ("should we…", "is it worth…", tradeoff talk). Applied briefly inside the current answer, at most one clarifying question.
+- **Passive:** the router loads it inline whenever a task evaluates, decides or critiques rather than only executes. Applied briefly inside the current answer, at most one clarifying question.
 - **Triggered self-run:** fired by `agent.A3`'s mandatory deep-think triggers (about to ask/escalate, a one-way-door action, a repeated fix failure, conflicting rules, ambiguous owner wording, a documented-design touch) or by owner authorization. Non-interactive — depth scales to difficulty instead of a fixed round count, and it ends in decide-and-act (reported as `Decided: X · because Y · rejected Z (why) · reopen if W`) or escalates per `agent.A3`'s outcomes, never in a question left hanging or an offer to open `/akithink`.
-- **Active:** the user runs `/akithink`, which drives the same METHOD through a full 5-phase interactive protocol at maximum depth and ends with a proposed decision record under `docs/` (plus `/akihtmlreport` when the material is complex). `/akithink` also has its own non-interactive self-run mode, which collapses to the triggered mode above.
+- **Active:** `/akithink` drives the same METHOD at maximum depth. It self-runs, model-invoked and non-interactive, whenever the task is a genuine decision — approach choice, critique of a plan/idea/rule, scope tradeoff, a documented-design change — and runs its 5-phase interactive protocol only when the owner asks for a session; both end in a decision record under `docs/` when the decision is durable (plus `/akihtmlreport` when the material is complex).
 
 Content-wise, the triggered and active modes are supersets of the passive one; mechanically, only `/akithink`'s default invocation runs the interactive protocol.
 
@@ -147,12 +147,12 @@ Notify-only either way: neither surface downloads or installs anything on its ow
 
 ## Usage model
 
-Install once; from then on the system has two kinds of surface. **Rules load themselves** — you never invoke them for normal work: the core four are in every session by construction, and `akirule` reads the contextual ones when your message or file paths match a signal, announcing the result in a `[RULES]` receipt line. **Skills are deliberate entry points** — each one maps to a moment in the working day, invoked when that moment arrives:
+Install once; from then on the system has two kinds of surface. **Rules load themselves** — you never invoke them for normal work: the core four and the router are in every session by construction, and the router reads the contextual ones when the task's domain matches, announcing the result in a `[RULES]` receipt line. **Skills are deliberate entry points** — each one maps to a moment in the working day, invoked when that moment arrives:
 
 | Moment | Entry point |
 |---|---|
 | Any normal task | nothing — just describe the task; rules route themselves |
-| A rule must be loaded *for certain* | name the rule file in the prompt, or `nạp full` / `load all rules` — routing is best-effort by design, naming the file is the guarantee |
+| A rule must be loaded *for certain* | name the rule file in the prompt, or ask to load the whole corpus — the `Read` of a routed file is one model hop, naming the file is the guarantee |
 | "What is installed here and what do I say to it?" | `/akihelp` |
 | A big, hard-to-reverse, or goal-ambiguous decision | `/akithink` |
 | Work needing several kinds of judgment, or a parallel fan-out | `/akiflow` |
@@ -281,7 +281,7 @@ flowchart TD
     subgraph T3["🚀 3. Antigravity Engine (~/.gemini/)"]
         G_MD["GEMINI.md (Managed prompt global)"]
         G_LOCAL["GEMINI.local.md (Machine local)"]
-        G_RULES["config/rules/akirule-*.md (18 rules with YAML trigger)"]
+        G_RULES["config/rules/akirule-*.md (one per rule file, YAML trigger)"]
         G_SKILLS["config/skills/ (10 skills, native auto-discovery)"]
         G_SJSON["config/skills.json (Inherits agskills, absolute path)"]
     end
@@ -313,17 +313,18 @@ Targets 4-6 only get the shared skill corpus (no rule corpus / no `CLAUDE.md`/`G
    - Copies `claude/agents/*.md` into `<target>/agents/` **file by file, never a directory mirror with `--delete`** — that folder is a shared namespace where your own agent definitions sit beside Aki's, exactly like `<target>/skills/`, so nothing you did not install is ever removed.
    - Replaces `<target>/CLAUDE.md` with the packaged guidance (timestamped backup first), appending this machine's source-repo path and an `@<target>/CLAUDE.local.md` import.
    - Creates `<target>/CLAUDE.local.md` **only if missing** — never overwritten afterward. On profile variants (`~/.claude-*`), the template imports `@~/.claude/CLAUDE.local.md` by default so machine-wide facts are inherited. Put per-machine/per-profile rules there; they survive every reinstall.
-   - Before the confirmation prompt or any mutation, preflights every existing JSON file it may update: each detected profile's `settings.json`, `~/.gemini/config/skills.json`, `~/.gemini/antigravity-cli/settings.json`, and `~/.gemini/settings.json`. A malformed file or non-object root aborts the install with originals untouched. After preflight, updates `<target>/settings.json` with a timestamped backup: read permission for `~/.aki/akidevrule/**`, skill script execution permissions (`Bash(python3 <target>/skills/*)` and `Bash(python3 ~/.claude/skills/*)`), `skillOverrides.akirule = "on"`, idempotent registration of the `SessionStart` update-check hook.
+   - Before the confirmation prompt or any mutation, preflights every existing JSON file it may update: each detected profile's `settings.json`, `~/.gemini/config/skills.json`, `~/.gemini/antigravity-cli/settings.json`, and `~/.gemini/settings.json`. A malformed file or non-object root aborts the install with originals untouched. After preflight, updates `<target>/settings.json` with a timestamped backup: read permission for `~/.aki/akidevrule/**`, one `Bash(<launcher> <script>*)` rule per Aki skill script per rendering (absolute and `~/`-literal — Claude Code does not expand `~` before matching), `skillOverrides.akirule = "on"`, idempotent registration of the `SessionStart` update-check hook.
    - Installs `<target>/hooks/aki-update-check.mjs` plus its shared parser `<target>/hooks/aki_version_check.mjs`.
 3. Writes `~/.aki/akidevrule/.version` with `installed=`/`version=`/`commit=`/`branch=` and records the source-repo path in `~/.aki/akidevrule/.source-repo` — `version=` is the just-installed CHANGELOG's latest released semver, the same value `install.mjs --check` and the hook compare against remote.
-4. Installs `payload/GEMINI.md` to `~/.gemini/GEMINI.md` — Antigravity global behavior overrides, stamped with a version marker (`[AKIRULE-AG-OVERRIDES-…]`) on line 1. Generates 18 native rule files under `~/.gemini/config/rules/` with YAML `trigger` frontmatter. Deploys 10 skills directly to `~/.gemini/config/skills/` for native auto-discovery (synced per skill folder, same never-touch-the-rest guarantee as step 2), configures `~/.gemini/config/skills.json` with absolute paths as secondary, and merges skill execution permissions into `~/.gemini/antigravity-cli/settings.json` and `~/.gemini/settings.json` — a `command()` prefix rule for each of akiflow's five scripts (the only skill whose scripts agy invokes directly) per skill root, in both the expanded and the tilde-literal rendering (agy's matcher compares command strings literally — no glob expansion, and no tilde expansion in either direction — so a directory wildcard never matches and a rule only matches a command written the same way; see [docs/ref/cli-permission-allowlist-standard.md](docs/ref/cli-permission-allowlist-standard.md) §1.2) plus scoped `write_file`/`read_file` rules for the council workspace and rule corpus.
-5. Syncs the same skill folders to `~/.agents/skills/` (Codex CLI), `~/.kiro/skills/` (Kiro CLI, plus pre-allowed shell permissions in `~/.kiro/settings/permissions.yaml`), and `~/.grok/skills/` (Grok CLI) — each a plain global skills root these CLIs read natively, synced per skill folder name exactly like step 2. Skills-only: no rule corpus is generated for these targets.
+4. Installs `payload/GEMINI.md` to `~/.gemini/GEMINI.md` — Antigravity global behavior overrides, stamped with a version marker (`[AKIRULE-AG-OVERRIDES-…]`) on line 1. Generates one native rule file per `RULE-*`/`METHOD-*` under `~/.gemini/config/rules/` with YAML `trigger` frontmatter — `agent` `always_on`, the stacks `glob`, the rest `model_decision` — each description generated from its `akirule` route, so both harnesses route from one table. Deploys 10 skills directly to `~/.gemini/config/skills/` for native auto-discovery (synced per skill folder, same never-touch-the-rest guarantee as step 2), configures `~/.gemini/config/skills.json` with absolute paths as secondary, and merges skill execution permissions into `~/.gemini/antigravity-cli/settings.json` and `~/.gemini/settings.json` — a `command()` prefix rule for every `skills/*/scripts/*.py` per skill root, in both the expanded and the tilde-literal rendering (agy's matcher compares command strings literally — no glob expansion, and no tilde expansion in either direction — so a directory wildcard never matches and a rule only matches a command written the same way; see [docs/ref/cli-permission-allowlist-standard.md](docs/ref/cli-permission-allowlist-standard.md) §1.2) plus scoped `write_file`/`read_file` rules for the council workspace and rule corpus.
+5. Syncs the same skill folders to `~/.agents/skills/` (Codex CLI, Cursor), `~/.kiro/skills/` (Kiro CLI), and `~/.grok/skills/` (Grok CLI) — each a plain global skills root these CLIs read natively, synced per skill folder name exactly like step 2. Skills-only: no rule corpus is generated for these targets.
+6. Pre-allows every Aki skill script in each harness present on the machine, one adapter per rule dialect (`lib/permissions.mjs`): `~/.kiro/settings/permissions.yaml` (a marker-delimited managed block), `~/.codex/rules/akidevrule.rules` (a file akidevrule owns), `~/.cursor/cli-config.json` (`Shell(python3:<script>*)`, never a bare `Shell(python3)`), `~/.config/opencode/opencode.json` (`permission.bash`). Every rule names one exact script, in both path renderings; entries a previous install wrote are replaced, the user's own are kept. Grok CLI and Ollama have no file-based allowlist, so nothing is written for them — [docs/ref/cli-permission-allowlist-standard.md](docs/ref/cli-permission-allowlist-standard.md).
 
 Re-running the installer updates the same managed files cleanly.
 
 ## Gemini / Antigravity model
 
-Claude Code loads the rule corpus automatically (harness-guaranteed `@`-imports via the `akirule` skill). Antigravity/Gemini has no such loader, so the split is: `~/.gemini/GEMINI.md` carries **hard-loaded behavior overrides** that patch Antigravity's weak spots (unrequested artifacts, over-engineering, verbosity), and a tiny per-project `GEMINI.md` bootstrap points the agent at that project's `CLAUDE.md` as its single source of truth. The per-project bootstrap is copied into a project by hand (it is not distributed by the installer).
+Claude Code loads the core and the router automatically (harness-guaranteed `@`-imports in `~/.claude/CLAUDE.md`). Antigravity/Gemini has no such loader, so the split is: `~/.gemini/GEMINI.md` carries **hard-loaded behavior overrides** that patch Antigravity's weak spots (unrequested artifacts, over-engineering, verbosity), native rules route the corpus with descriptions generated from the `akirule` routes, and a tiny per-project `GEMINI.md` bootstrap points the agent at that project's `CLAUDE.md` as its single source of truth. The per-project bootstrap is copied into a project by hand (it is not distributed by the installer).
 
 ## What is excluded
 

package/claude/CLAUDE.md

@@ -2,25 +2,24 @@
 
 Keep global context small. Prefer current project files and runtime output over stale docs or memory.
 
-## Core rules — mechanically loaded, every session
+## Core rules and the router — mechanically loaded, every session
 
 @~/.aki/akidevrule/index.md
 @~/.aki/akidevrule/RULE-agent-behavior.md
 @~/.aki/akidevrule/RULE-coding.md
 @~/.aki/akidevrule/RULE-pattern-core.md
+@~/.claude/skills/akirule/SKILL.md
 
-These four are embedded by the harness when it reads this file at session start. No model decision is involved, so they apply to every task whether or not any skill runs. The rule corpus map lives in `index.md`; the behavior floor lives in `RULE-agent-behavior.md`; the code-quality floor in `RULE-coding.md`; the structural floor in `RULE-pattern-core.md`.
+The harness embeds these five when it reads this file at session start — no model decision is involved. `index.md` is the corpus map; `RULE-agent-behavior.md` the behavior floor; `RULE-coding.md` the code-quality floor; `RULE-pattern-core.md` the structural floor; `akirule/SKILL.md` the router that decides which contextual rule files to read on each task turn.
 
-`RULE-coding.md` and `RULE-pattern-core.md` were promoted here because being labelled "default ON" in the router never made them load — a skill runs only when the model decides to invoke it, so the rules the owner had to re-state most often were frequently the ones that had never entered the context at all. They are paid for in every session, including sessions that touch no code; that cost is deliberate and is the price of the guarantee.
+The router is imported rather than left as a skill because a skill runs only when the model decides to invoke it, and it went uninvoked until the owner asked by name. The same failure earlier promoted `RULE-coding.md` and `RULE-pattern-core.md` to core. All five are paid for in every session; that cost is the price of the guarantee.
 
-Nothing else in the corpus is guaranteed. Every other rule file loads only when the `akirule` skill runs and matches a signal, and invoking a skill is the model's decision, not a harness mechanism.
+What stays best-effort is the second hop: a routed file enters context only when the model `Read`s it on a route match.
 
 ## Shared Aki rule source
 
 Aki's shared rule corpus lives at `~/.aki/akidevrule`.
 
-The `akirule` skill routes everything beyond the core above: contextual and analytical rules on signal match with high sensitivity, and full load on explicit command. See `~/.claude/skills/akirule/SKILL.md` for the complete routing spec and signal list.
-
 **IMPORTANT — editing shared rules:** The installed `~/.aki/akidevrule` directory is a **deployed copy**, not the source of truth. To change a shared rule:
 1. Find the source repo: its absolute path on this machine is recorded in `~/.aki/akidevrule/.source-repo`, written by the installer on every install. Read that file — do not guess a location, and do not ask the user for something already recorded. Ask only if the recorded path no longer exists.
 2. Edit under `<source-repo>/payload/` (shared rule corpus), `<source-repo>/skills/` (Agent Skills, shared with Antigravity), or `<source-repo>/claude/` (Claude Code-only runtime assets: global guidance, hooks, settings fragment).

package/claude/agents/aki-challenger.md

@@ -20,7 +20,7 @@ If a brief hands you the caller's reasoning anyway, say so and judge the artifac
 # Receipt — first line of your output, always
 
 ```
-[RULES] agent,flow,pattern (brief) | missing: none
+[RULES] agent,flow,pattern (brief)
 ```
 
 # The two questions you always close with

package/claude/agents/aki-conduct.md

@@ -13,7 +13,7 @@ Your defining job is a discrimination nothing else in the system can make:
 
 | Class | Signal | Where the bug is |
 |---|---|---|
-| **LOAD-fail** | a `[RULES]` line missing the rule, a non-empty `missing:` field, or no receipt at all | the delivery path — the spawning brief, the router, or the `@` import. Fixing the rule's wording would be wasted work |
+| **LOAD-fail** | a `[RULES]` line without a rule the brief or router required, or no receipt at all | the delivery path — the spawning brief, the router, or the `@` import. Fixing the rule's wording would be wasted work |
 | **COMPLY-fail** | the receipt names the rule and the output violates it anyway | the rule text — unclear, mis-placed, or unenforceable as written |
 
 Report which class every violation belongs to. A violation with no class attached is a bug report with no address on it.
@@ -26,7 +26,7 @@ Report which class every violation belongs to. A violation with no class attache
 # Receipt — first line of your output, always
 
 ```
-[RULES] agent,coding (brief) | missing: none
+[RULES] agent,coding (brief)
 ```
 
 # Evidence — no evidence, no finding

package/claude/agents/aki-hands.md

@@ -20,10 +20,10 @@ Nothing else, unless the spawning brief names a file. You inherit no router: a r
 # Receipt — first line of your output, always
 
 ```
-[RULES] agent (brief) | missing: none
+[RULES] agent (brief)
 ```
 
-Name every rule file you actually read, and list under `missing:` anything the brief told you to read that you could not. You get one round, so this is not conditional (`agent.A5`). The line is a diagnostic signal about delivery, not a claim of compliance (`agent.B2`).
+Name every rule file you actually read — nothing else. You get one round, so this is not conditional (`agent.A5`). The line is a diagnostic signal about delivery, not a claim of compliance (`agent.B2`).
 
 # Output contract
 
@@ -41,13 +41,13 @@ The mandate, rule manifest, receipt, and output contract above are the same on e
 | Lane | Invocation | Pick it when | Context / rules the caller must pass |
 |---|---|---|---|
 | **Claude subagent · `haiku`** | in-harness spawn of this agent; the frontmatter carries `model: haiku` | the paths are known and few, the result must land in this session, or several hands must run **concurrently** — the Agent tool fans out natively where every headless lane needs its own backgrounding | nothing — the frontmatter carries the tools, and this body carries the manifest. Name the paths and the question in the prompt |
-| **agy headless · `gemini-3.7-flash-high`, backgrounded** | `agy --model gemini-3.7-flash-high --mode plan --output-format json -p "<prompt>"` — **prompt last** — launched in the background, because a real sweep costs seconds to a minute and there is no reason for the caller to block on it | the discovery default (`agent.A5`): a wide sweep over a large surface, or the Claude quota is the constraint. ~1M context on a separate quota; `--mode plan` makes read-only mechanical rather than worded. Its weakness is skimming, so pay for it in prompt precision, not a bigger model | `~/.gemini/GEMINI.md` auto-loads the behavior baseline, so the behavior floor is free — but **name the domain rule files and the exact absolute paths anyway**: `cwd` is not a scope boundary for agy |
+| **agy headless · `gemini-3.8-flash-high`, backgrounded** | `agy --model gemini-3.8-flash-high --mode plan --output-format json -p "<prompt>"` — **prompt last** — launched in the background, because a real sweep costs seconds to a minute and there is no reason for the caller to block on it | the discovery default (`agent.A5`): a wide sweep over a large surface, or the Claude quota is the constraint. ~1M context on a separate quota; `--mode plan` makes read-only mechanical rather than worded. Its weakness is skimming, so pay for it in prompt precision, not a bigger model | `~/.gemini/GEMINI.md` auto-loads the behavior baseline, so the behavior floor is free — but **name the domain rule files and the exact absolute paths anyway**: `cwd` is not a scope boundary for agy |
 | **kiro-cli headless · `claude-sonnet-4.5`** | `kiro-cli chat --no-interactive --trust-tools=fs_read --model claude-sonnet-4.5 "<prompt>"` | a sweep that is wide **and** needs real reading comprehension — flash skims, and this lane buys a strong model on a **third** quota (owner's pick for hands, 2026-08-16). Not the cheap tier: sonnet-4.5 meters 1.3× against `qwen3-coder-next`'s 0.05×, so pick it for the comprehension, not the price | everything: no rule file loads by itself. Paste the four sections above plus exact paths. `--trust-tools=fs_read` is the read-only mechanism |
 | **cl-9rt (Claude via proxy gateway)** | `CLAUDE_CONFIG_DIR=~/.claude-9rt claude -p --tools "Read,Grep" --model <alias> --effort low "<prompt>"` | a parallel explore lane is wanted **concurrently** with this session, on separate metering | everything, as with kiro. `cl-9rt`/`cl-9rt-min` is a **shell alias** the owner defined interactively — it does not exist in a spawned/non-interactive shell. Always run the expanded literal command shown here, never the alias name. Note the gateway may route an alias to a non-Anthropic core — treat as bandwidth, never as judgment |
 
 **Model tier for this seat, on any Claude-family lane.** Default `haiku`. Escalate to a Sonnet-class model when the sweep is wide enough that comprehension is the binding constraint rather than throughput — a large context read carelessly returns a confident partial answer, which is the one failure this seat cannot afford. **Never opus or fable**: that is the calling session's own tier, and retrieval priced like judgment removes the reason to delegate it.
 
-**Recorded harness facts — do not re-derive them.** The literal command, read-only mechanism and silent failure mode for every lane above are in one table: `~/.claude/skills/akiflow/references/harness-facts.md` § Worker invocation quick-facts. Read that section instead of probing; the rest of that file is design rationale a lane assignment does not need. Running `agy --help`, `agy models`, or a "just checking it works" call to re-learn something already recorded is exactly the redundant work this corpus exists to remove — one drifted session did it three times before using the CLI it had already been told to use. **Exception:** if a caller names a model absent from the recorded list, verify live (`agy models`) before assuming it doesn't exist — a new generation shipping is exactly the kind of drift the recorded fact cannot self-update for (`gemini-3.7-flash-*` shipped between the 2026-08-02 and 2026-08-15 checks).
+**Recorded harness facts — do not re-derive them.** The literal command, read-only mechanism and silent failure mode for every lane above are in one table: `~/.claude/skills/akiflow/references/harness-facts.md` § Worker invocation quick-facts. Read that section instead of probing; the rest of that file is design rationale a lane assignment does not need. Running `agy --help`, `agy models`, or a "just checking it works" call to re-learn something already recorded is exactly the redundant work this corpus exists to remove — one drifted session did it three times before using the CLI it had already been told to use. **Exception:** if a caller names a model absent from the recorded list, verify live (`agy models`) before assuming it doesn't exist — a new generation shipping is exactly the kind of drift the recorded fact cannot self-update for (`gemini-3.7-flash-*` shipped between the 2026-08-02 and 2026-08-15 checks, `gemini-3.8-flash-*` before 2026-09-26).
 
 Two things are genuinely *not* recorded, because they change per machine and per day, and they are the only probes that stay legitimate — run them **once, at the moment of assigning the lane**, never as a habit:
 

package/claude/agents/aki-judge.md

@@ -21,10 +21,10 @@ Your verdict must be able to go against whoever spawned you. If you find yoursel
 # Receipt — first line of your output, always
 
 ```
-[RULES] agent,pattern (brief) | missing: none
+[RULES] agent,pattern (brief)
 ```
 
-If the standard you were told to judge against could not be read, say so under `missing:` and **stop** — do not judge from memory of it. That is a LOAD-fail, and it is a bug in the brief, not in the artifact.
+If the standard you were told to judge against could not be read, say so and **stop** — do not judge from memory of it. That is a LOAD-fail, and it is a bug in the brief, not in the artifact.
 
 # Output contract
 

package/claude/agents/aki-maker.md

@@ -23,10 +23,10 @@ Change exactly what was asked. No adjacent refactors, no cleanup, no renames, no
 # Receipt — first line of your output, always
 
 ```
-[RULES] agent,coding,pattern,ui (brief) | missing: none
+[RULES] agent,coding,pattern,ui (brief)
 ```
 
-A non-empty `missing:` on a domain rule means you should not have written that part. Report it instead of guessing what the rule probably said.
+A domain rule the brief named that you could not read means you should not have written that part. Report it instead of guessing what the rule probably said.
 
 # Output contract