@akinet/akidevrule 3.6.0 → 3.8.0

package/install.mjs

@@ -45,6 +45,7 @@ const GEMINI_RULES_DIR = join(GEMINI_DIR, "config", "rules");
 const GEMINI_SKILLS_DIR = join(GEMINI_DIR, "config", "skills");
 
 const CODEX_SKILLS_DIR = join(HOME, ".agents", "skills");
+const CODEX_HOME = process.env.CODEX_HOME ? expandTilde(process.env.CODEX_HOME.trim()) : join(HOME, ".codex");
 const KIRO_SKILLS_DIR = join(HOME, ".kiro", "skills");
 const GROK_SKILLS_DIR = join(HOME, ".grok", "skills");
 const SKILLS_SRC = join(REPO_ROOT, "skills");
@@ -202,21 +203,34 @@ const blueBold = (t) => c("1;34", t);
 // Backup / prune
 // ---------------------------------------------------------------------------
 
+// A backup is rollback material for this run only: removed once the run succeeds, kept when it fails. keepBackup() exempts one that holds content the install discarded.
+const runBackups = new Set();
+
 function backup(path) {
   if (!existsSync(path)) return;
   const dest = join(dirname(path), `${basename(path)}.akidevrule-backup-${STAMP}`);
   if (isDir(path)) copyTree(path, dest);
   else copyFileSync(path, dest);
+  runBackups.add(dest);
+}
+
+function keepBackup(path) {
+  runBackups.delete(join(dirname(path), `${basename(path)}.akidevrule-backup-${STAMP}`));
+}
+
+function dropRunBackups() {
+  for (const dest of runBackups) rmrf(dest);
+  runBackups.clear();
 }
 
-function pruneBackups(base) {
+function pruneBackups(base, keep = 1) {
   const parent = dirname(base);
   const prefix = `${basename(base)}.akidevrule-backup-`;
   const candidates = listDir(parent)
     .filter((n) => n.startsWith(prefix))
     .map((n) => join(parent, n))
     .sort((a, b) => statSync(a).mtimeMs - statSync(b).mtimeMs);
-  for (const old of candidates.slice(0, -2)) {
+  for (const old of candidates.slice(0, -keep)) {
     console.log(`  🗑️  Removing old backup: ${basename(old)}`);
     rmrf(old);
   }
@@ -342,6 +356,7 @@ const AG_RULE_MAP = [
   ["RULE-agent-behavior.md", "always_on", ""],
   ["RULE-coding.md", "model_decision", ""],
   ["RULE-pattern-core.md", "model_decision", ""],
+  ["RULE-test.md", "model_decision", ""],
   ["RULE-docs.md", "model_decision", ""],
   ["RULE-content-write.md", "model_decision", ""],
   ["RULE-stack-akiNuxtCf.md", "glob", '["**/*.vue", "nuxt.config.*", "wrangler.toml", "app/**", "server/**", "composables/**", "middleware/**", "plugins/**", "layouts/**"]'],
@@ -396,6 +411,207 @@ function installAgRules() {
   return rendered.length;
 }
 
+// ---------------------------------------------------------------------------
+// Codex global instructions — behavior floor + router as a managed block in $CODEX_HOME/AGENTS.md
+// (docs/research/codex-instruction-delivery.md: Codex hard-loads that file; it expands no imports and reads no Claude global file)
+// ---------------------------------------------------------------------------
+
+const CODEX_BLOCK_START = "<!-- >>> akidevrule managed: behavior floor + router, regenerated on every install — edit the source repo, never this block -->";
+const CODEX_BLOCK_END = "<!-- <<< akidevrule managed -->";
+const CODEX_DOC_BUDGET = 131072; // Codex stops adding instruction files once global + project files reach project_doc_max_bytes (32 KiB by default); the managed block alone is larger
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const TOML_HEADER = /^[ \t]*\[\[?[ \t]*[\w.\-"' ]+[ \t]*\]\]?[ \t]*(#.*)?$/m; // a whole-line [table] or [[array]] header, not a nested-array line inside a multi-line value
+
+function codexInstructionBlock() {
+  const preamble =
+    "# akidevrule on Codex\n\n" +
+    "This block is the resident rule context for Codex: the behavior floor (`RULE-agent-behavior.md`) and the rule router (`skills/akirule/SKILL.md`), both installed under `~/.aki/akidevrule/`. Codex has no route gate: the Read of a routed rule file is your own mandatory step before the first edit of that artifact type. Do not invoke the `akirule` skill as well — the routing below is already loaded.";
+  const floor = readFileSync(join(REPO_ROOT, "payload", "RULE-agent-behavior.md"), "utf-8").trim();
+  const router = readFileSync(ROUTER_SRC, "utf-8").trim();
+  return [CODEX_BLOCK_START, preamble, floor, router, CODEX_BLOCK_END].join("\n\n") + "\n";
+}
+
+// Top-level TOML keys must precede the first table header, so the key is inserted before it, once, and only when absent.
+function ensureCodexDocBudget(blockBytes) {
+  const cfg = join(CODEX_HOME, "config.toml");
+  const text = isFile(cfg) ? readFileSync(cfg, "utf-8") : "";
+  const firstTable = text.search(TOML_HEADER);
+  const top = (firstTable === -1 ? text : text.slice(0, firstTable)).replace(/\s*$/, "");
+  const m = top.match(/^\s*project_doc_max_bytes\s*=\s*(\d+)/m);
+  if (m) return { value: Number(m[1]), written: false, enough: Number(m[1]) >= blockBytes };
+  const line = `project_doc_max_bytes = ${CODEX_DOC_BUDGET} # akidevrule: the managed block in AGENTS.md plus project instructions exceed Codex's 32 KiB default\n`;
+  const after = (top ? top + "\n\n" : "") + line + (firstTable === -1 ? "" : "\n" + text.slice(firstTable));
+  if (text) {
+    backup(cfg);
+    pruneBackups(cfg);
+  }
+  writeTextLf(cfg, after);
+  return { value: CODEX_DOC_BUDGET, written: true, enough: true };
+}
+
+function installCodexInstructions() {
+  if (!isDir(CODEX_HOME)) return null;
+  const file = join(CODEX_HOME, "AGENTS.md");
+  const before = isFile(file) ? readFileSync(file, "utf-8") : "";
+  const block = codexInstructionBlock();
+  const user = before.replace(new RegExp(`\\n?${escapeRe(CODEX_BLOCK_START)}[\\s\\S]*?${escapeRe(CODEX_BLOCK_END)}\\n?`), "\n").trim();
+  const after = (user ? user + "\n\n" : "") + block;
+  const changed = after !== before;
+  if (changed) {
+    backup(file);
+    pruneBackups(file);
+    writeTextLf(file, after);
+  }
+  const override = join(CODEX_HOME, "AGENTS.override.md");
+  const shadowed = isFile(override) && readFileSync(override, "utf-8").trim() !== "";
+  const bytes = Buffer.byteLength(block, "utf-8");
+  return { file, bytes, changed, shadowed, budget: ensureCodexDocBudget(bytes) };
+}
+
+// ---------------------------------------------------------------------------
+// rtk — optional output compressor on Claude Code's Bash tool; opt-in accuracy-first config (README § Optional: rtk, docs/plan/rtk-accuracy-first.md)
+// ---------------------------------------------------------------------------
+
+const RTK_OPT_OUT = "# akidevrule: rtk off";
+const RTK_MANAGED_MARK = "# akidevrule: accuracy-first rtk";
+const RTK_EXCLUDE = [
+  ["ls", "tree", "find", "grep", "rg", "ast-grep", "wc", "diff"],
+  ["cat", "head", "tail"],
+  ["jq", "stat", "du", "df", "ps", "ssh", "rsync", "curl", "wget"],
+  ["gh", "glab", "psql", "aws", "kubectl", "oc", "docker"],
+  ["^git(\\s+-[Cc]\\s+\\S+)*\\s+(diff|log|show|stash|branch)\\b"],
+];
+const RTK_EVIDENCE_FAMILIES = "ls, grep, find, git diff/log/show, jq";
+const RTK_NOISE_FAMILIES = "git status, package installs and build logs";
+
+// TOML basic strings take JSON's escapes for backslash and quote, so JSON.stringify renders each entry.
+function rtkExcludeLines() {
+  return RTK_EXCLUDE.map((group) => `  ${group.map((s) => JSON.stringify(s)).join(", ")},`).join("\n");
+}
+
+function rtkHooksTable() {
+  return `${RTK_MANAGED_MARK} — commands whose output is evidence run unfiltered (akidevrule README § Optional: rtk)\n[hooks]\nexclude_commands = [\n${rtkExcludeLines()}\n]\n`;
+}
+
+// Fallback mirrors rtk's dirs::config_dir() layout (XDG, Application Support, RoamingAppData) when `rtk config` prints no path.
+function rtkDetect() {
+  let r;
+  try {
+    r = spawnSync("rtk", ["config"], { encoding: "utf-8", timeout: 5000, shell: IS_WIN });
+  } catch {
+    return null;
+  }
+  if (r.error || r.status !== 0) return null;
+  const m = (r.stdout || "").match(/^Config:\s*(.+?)\s*$/m);
+  if (m) return { path: expandTilde(m[1]) };
+  const base = process.platform === "darwin" ? join(HOME, "Library", "Application Support") : IS_WIN ? process.env.APPDATA || join(HOME, "AppData", "Roaming") : process.env.XDG_CONFIG_HOME || join(HOME, ".config");
+  return { path: join(base, "rtk", "config.toml") };
+}
+
+// The [name] table's body: from its header to the next table header. null when absent.
+function tomlTable(text, name) {
+  const header = new RegExp(`^[ \\t]*\\[${escapeRe(name)}\\][ \\t]*(#.*)?$`, "m");
+  const h = text.search(header);
+  if (h === -1) return null;
+  const bodyStart = text.indexOf("\n", h) + 1;
+  const rest = text.slice(bodyStart);
+  const next = rest.search(TOML_HEADER);
+  const end = next === -1 ? text.length : bodyStart + next;
+  return { start: h, bodyStart, end, body: text.slice(bodyStart, end) };
+}
+
+// String entries of the array that follows `key =`, read until the unquoted `]` (a quoted entry may itself contain one).
+function tomlStringArray(body, key) {
+  const k = body.match(new RegExp(`^[ \\t]*${escapeRe(key)}[ \\t]*=[ \\t]*\\[`, "m"));
+  if (!k) return null;
+  const out = [];
+  let i = k.index + k[0].length;
+  while (i < body.length) {
+    const ch = body[i];
+    if (ch === "]") break;
+    if (ch === '"' || ch === "'") {
+      const close = ch === '"' ? /(?:[^"\\]|\\.)*"/y : /[^']*'/y;
+      close.lastIndex = i + 1;
+      const m = close.exec(body);
+      if (!m) break;
+      const raw = m[0].slice(0, -1);
+      out.push(ch === '"' ? JSON.parse(`"${raw}"`) : raw);
+      i = close.lastIndex;
+      continue;
+    }
+    if (ch === "#") i = body.indexOf("\n", i) === -1 ? body.length : body.indexOf("\n", i);
+    else i++;
+  }
+  return out;
+}
+
+// Read-only classification: the state the file is already in, or null when a write would be needed (no file, no [hooks], [hooks] without exclude_commands).
+function rtkReadState(cfg) {
+  const text = isFile(cfg) ? readFileSync(cfg, "utf-8") : "";
+  if (text.includes(RTK_OPT_OUT)) return { path: cfg, state: "opt-out" };
+  const hooks = tomlTable(text, "hooks");
+  const have = hooks && tomlStringArray(hooks.body, "exclude_commands");
+  if (!have) return null;
+  const missing = RTK_EXCLUDE.flat().filter((s) => !have.includes(s));
+  return { path: cfg, state: missing.length ? "kept" : "unchanged", missing };
+}
+
+// Smallest safe change: no file → write; no [hooks] → append the table; [hooks] without exclude_commands → insert the key; anything else is rtkReadState's answer.
+function rtkConfigure(cfg) {
+  const known = rtkReadState(cfg);
+  if (known) return known;
+  const text = isFile(cfg) ? readFileSync(cfg, "utf-8") : "";
+  const write = (after) => {
+    if (text) {
+      backup(cfg);
+      pruneBackups(cfg);
+    }
+    writeTextLf(cfg, after);
+  };
+  const hooks = tomlTable(text, "hooks");
+  if (!hooks) {
+    write((text ? text.replace(/\s*$/, "") + "\n\n" : "") + rtkHooksTable());
+    return { path: cfg, state: text ? "appended" : "written" };
+  }
+  write(text.slice(0, hooks.bodyStart) + `exclude_commands = [ ${RTK_MANAGED_MARK}\n${rtkExcludeLines()}\n]\n` + text.slice(hooks.bodyStart));
+  return { path: cfg, state: "appended" };
+}
+
+function rtkPrompt(cfg) {
+  console.log(`\n🔎 ${yellowBold("rtk found")} — an output compressor that hooks into Claude Code's Bash tool.`);
+  console.log(`   Its built-in filters save tokens by dropping lines — also from ${RTK_EVIDENCE_FAMILIES}, whose output an agent reads as evidence (a count, a quote, a "not found").`);
+  console.log(`   ${greenBold("y")} → write an accuracy-first rtk config at ${toTildePath(cfg)}: those commands run unfiltered; ${RTK_NOISE_FAMILIES} stay compressed. Existing file backed up; opt out later with a "${RTK_OPT_OUT}" line.`);
+  console.log(`   ${greenBold("N")} → leave rtk as it is (default). Details: README § Optional: rtk`);
+}
+
+function printRtkSummary(rtk) {
+  console.log();
+  console.log(cyanBold("rtk (optional output compressor):"));
+  if (!rtk) {
+    console.log("  ℹ️  rtk not found — nothing to configure. If you install it later, re-run with --rtk to run evidence commands unfiltered (README § Optional: rtk)");
+    return;
+  }
+  const p = toTildePath(rtk.path);
+  switch (rtk.state) {
+    case "declined":
+      console.log(`  ⚠️  rtk found, left as is — its default filters drop evidence lines from ${RTK_EVIDENCE_FAMILIES}. To run those unfiltered: re-run and answer y, or \`node install.mjs --rtk\` (README § Optional: rtk)`);
+      break;
+    case "written":
+    case "appended":
+      console.log(`  ✅ accuracy-first config ${rtk.state === "written" ? "written" : "added"}: ${p} — ${RTK_EVIDENCE_FAMILIES} … unfiltered; ${RTK_NOISE_FAMILIES} still compressed`);
+      break;
+    case "unchanged":
+      console.log(`  ✅ accuracy-first config already in place: ${p}`);
+      break;
+    case "kept":
+      console.log(`  ⚠️  ${p} has its own [hooks] exclude_commands — kept as yours; not in it yet: ${rtk.missing.join(", ")}`);
+      break;
+    case "opt-out":
+      console.log(`  ℹ️  ${p} carries "${RTK_OPT_OUT}" — skipped`);
+      break;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // settings.json merge (Claude Code)
 // ---------------------------------------------------------------------------
@@ -456,7 +672,14 @@ function mergeSettings(settingsPath, installRoot, claudeDir) {
       return false;
     }
   };
-  hooks.SessionStart = hooks.SessionStart.filter((e) => !isAkiUpdate(e));
+  const isAkiCompact = (entry) => {
+    try {
+      return (entry.hooks || []).some((h) => (h.command || "").includes("aki-compact-reread"));
+    } catch {
+      return false;
+    }
+  };
+  hooks.SessionStart = hooks.SessionStart.filter((e) => !isAkiUpdate(e) && !isAkiCompact(e));
   hooks.SessionStart.push({
     matcher: "startup|resume",
     hooks: [
@@ -467,6 +690,16 @@ function mergeSettings(settingsPath, installRoot, claudeDir) {
       },
     ],
   });
+  hooks.SessionStart.push({
+    matcher: "compact",
+    hooks: [
+      {
+        type: "command",
+        command: `node "${join(claudeDir, "hooks", "aki-compact-reread.mjs")}"`,
+        timeout: 5,
+      },
+    ],
+  });
 
   if (!Array.isArray(hooks.PreToolUse)) hooks.PreToolUse = [];
   const isAkiRouteGuard = (entry) => {
@@ -477,16 +710,18 @@ function mergeSettings(settingsPath, installRoot, claudeDir) {
     }
   };
   hooks.PreToolUse = hooks.PreToolUse.filter((e) => !isAkiRouteGuard(e));
-  hooks.PreToolUse.push({
-    matcher: "Edit|MultiEdit|Write|NotebookEdit",
-    hooks: [
-      {
-        type: "command",
-        command: `node "${join(claudeDir, "hooks", "aki-route-guard.mjs")}"`,
-        timeout: 10,
-      },
-    ],
-  });
+  for (const matcher of ["Edit|MultiEdit|Write|NotebookEdit", "Read"]) {
+    hooks.PreToolUse.push({
+      matcher,
+      hooks: [
+        {
+          type: "command",
+          command: `node "${join(claudeDir, "hooks", "aki-route-guard.mjs")}"`,
+          timeout: 10,
+        },
+      ],
+    });
+  }
 
   writeTextLf(settingsPath, JSON.stringify(data, null, 2) + "\n");
 }
@@ -560,6 +795,7 @@ function installClaudeDir(claudeDir) {
   copyFileSync(join(REPO_ROOT, "claude", "hooks", "aki-update-check.mjs"), join(hooksDest, "aki-update-check.mjs"));
   copyFileSync(join(REPO_ROOT, "claude", "hooks", "aki_version_check.mjs"), join(hooksDest, "aki_version_check.mjs"));
   copyFileSync(join(REPO_ROOT, "claude", "hooks", "aki-route-guard.mjs"), join(hooksDest, "aki-route-guard.mjs"));
+  copyFileSync(join(REPO_ROOT, "claude", "hooks", "aki-compact-reread.mjs"), join(hooksDest, "aki-compact-reread.mjs"));
   for (const legacy of ["aki-update-check.py", "aki_version_check.py"]) {
     const p = join(hooksDest, legacy);
     if (existsSync(p)) rmrf(p);
@@ -745,6 +981,8 @@ async function inspectStatus(claudeDirs) {
     }
   }
 
+  if (isDir(CODEX_HOME)) console.log(`🤖 Codex (${toTildePath(CODEX_HOME)}): will write the managed block in AGENTS.md (your own lines kept) and set project_doc_max_bytes in config.toml when absent`);
+
   if (isDir(GEMINI_DIR)) {
     const agSettings = join(GEMINI_DIR, "antigravity-cli", "settings.json");
     if (isFile(agSettings)) {
@@ -770,7 +1008,7 @@ async function inspectStatus(claudeDirs) {
 // print_summary (post-install)
 // ---------------------------------------------------------------------------
 
-function printSummary(claudeDirs, preAllow) {
+function printSummary(claudeDirs, preAllow, codex, rtk) {
   console.log(`\n${greenBold("=== INSTALL SUCCEEDED ===")}`);
 
   const gitHash = gitShortHash(REPO_ROOT);
@@ -817,6 +1055,19 @@ function printSummary(claudeDirs, preAllow) {
   console.log(`  🤖 Kiro CLI  : ${KIRO_SKILLS_DIR}`);
   console.log(`  🤖 Grok CLI  : ${GROK_SKILLS_DIR}`);
 
+  console.log();
+  console.log(cyanBold("Codex global instructions (behavior floor + router, resident):"));
+  if (!codex) {
+    console.log(`  ℹ️  ${toTildePath(CODEX_HOME)} not found — skipped; set CODEX_HOME or install Codex and re-run`);
+  } else {
+    console.log(`  📝 ${toTildePath(codex.file)} — managed block ${(codex.bytes / 1024).toFixed(1)} KB${codex.changed ? "" : ", unchanged"}; lines of your own in that file are kept`);
+    const b = codex.budget;
+    const budgetNote = b.written ? "written to config.toml — Codex stops loading instruction files past 32 KiB by default" : b.enough ? "already set" : `⚠️  smaller than the managed block (${codex.bytes} B) — raise it in ${toTildePath(join(CODEX_HOME, "config.toml"))}`;
+    console.log(`  ⚙️  project_doc_max_bytes = ${b.value} — ${budgetNote}`);
+    if (codex.shadowed) console.log(`  ⚠️  ${toTildePath(join(CODEX_HOME, "AGENTS.override.md"))} is non-empty and shadows AGENTS.md — Codex ignores the managed block until it is removed`);
+    console.log(`  ℹ️  Codex does not read a project's CLAUDE.md; opt in per machine with project_doc_fallback_filenames = ["CLAUDE.md"] in config.toml (a native AGENTS.md in the same directory still wins)`);
+  }
+
   console.log();
   console.log(cyanBold("Skill scripts pre-allowed (no prompt when a skill runs its own scripts):"));
   console.log("  ⚙️  claude       settings.json in every target above — plus Read(~/.aki/akidevrule/**)");
@@ -828,9 +1079,12 @@ function printSummary(claudeDirs, preAllow) {
 
   console.log();
   console.log(cyanBold("Hooks deployed:"));
-  console.log("  🚧 aki-route-guard (PreToolUse on Edit|MultiEdit|Write|NotebookEdit) — denies the first edit of an artifact type until its routed rule was Read; AKI_ROUTE_GUARD=0 disables");
+  console.log("  🚧 aki-route-guard (PreToolUse on Edit|MultiEdit|Write|NotebookEdit and Read) — edit gate: denies the first edit of an artifact type until its routed rule was Read whole after the last compaction; Read of a rule file is widened to the whole file; AKI_ROUTE_GUARD=0 disables");
+  console.log("  🔁 aki-compact-reread (SessionStart, compact only) — one notice after a compaction: routed rules left context, re-read before the next edit");
   console.log("  📢 aki-update-check (SessionStart, notify-only) — notifies when a new rule version is available");
 
+  printRtkSummary(rtk);
+
   console.log(`\n${greenBold("==============================")}`);
 }
 
@@ -852,7 +1106,7 @@ function ask(question) {
 // Main install logic
 // ---------------------------------------------------------------------------
 
-async function runInstall(claudeDirs) {
+async function runInstall(claudeDirs, { rtkFlag = false } = {}) {
   const sameCheckout = await inspectStatus(claudeDirs);
 
   // Skip the prompt only for a byte-identical overwrite (same commit, clean tree).
@@ -864,6 +1118,15 @@ async function runInstall(claudeDirs) {
     }
   }
 
+  // rtk: asked up front so the run has no mid-install question; default and non-interactive answer is "leave it".
+  const rtkFound = rtkDetect();
+  const rtkKnown = rtkFound && rtkReadState(rtkFound.path);
+  let rtkYes = rtkFlag;
+  if (rtkFound && !rtkKnown && !rtkFlag && process.stdin.isTTY) {
+    rtkPrompt(rtkFound.path);
+    rtkYes = (await ask("Configure rtk accuracy-first? [y/N]: ")).trim().toLowerCase() === "y";
+  }
+
   // Legacy migration: ~/.aki/claudedoc -> ~/.aki/akidevrule
   if (isDir(LEGACY_INSTALL_ROOT) && !existsSync(INSTALL_ROOT)) {
     mkdirSync(dirname(INSTALL_ROOT), { recursive: true });
@@ -921,10 +1184,11 @@ async function runInstall(claudeDirs) {
     installClaudeDir(cDir);
   }
 
-  // --- 3. Other CLI skill roots ---
+  // --- 3. Other CLI skill roots, and Codex's resident instructions ---
   syncAkiSkills(CODEX_SKILLS_DIR);
   syncAkiSkills(KIRO_SKILLS_DIR);
   syncAkiSkills(GROK_SKILLS_DIR);
+  const codex = installCodexInstructions();
 
   // --- 4. GEMINI.md (only when ~/.gemini exists) ---
   if (isDir(GEMINI_DIR)) {
@@ -946,8 +1210,8 @@ async function runInstall(claudeDirs) {
     }
 
     backup(geminiFile);
-    console.log("🧹 Pruning GEMINI.md backups (keeping the 2 most recent):");
-    pruneBackups(geminiFile);
+    if (hadUnmanaged) keepBackup(geminiFile);
+    pruneBackups(geminiFile, hadUnmanaged ? 2 : 1);
 
     const d = new Date();
     const geminiVersion = `V${d.getFullYear()}${pad2(d.getMonth() + 1)}${pad2(d.getDate())}`;
@@ -989,7 +1253,11 @@ async function runInstall(claudeDirs) {
   // --- 5. Script pre-allow for every other harness present ---
   const preAllow = preAllowHarnessScripts(claudeDirs);
 
-  printSummary(claudeDirs, preAllow);
+  // --- 6. rtk accuracy-first config: an existing state is reported as is, a write only on an explicit yes ---
+  const rtk = rtkFound ? (rtkKnown || (rtkYes ? rtkConfigure(rtkFound.path) : { path: rtkFound.path, state: "declined" })) : null;
+
+  dropRunBackups();
+  printSummary(claudeDirs, preAllow, codex, rtk);
 }
 
 // ---------------------------------------------------------------------------
@@ -1001,9 +1269,10 @@ async function main() {
   if (argv.includes("-h") || argv.includes("--help")) {
     console.log("akidevrule installer — deploys shared rule corpus and skills.");
     console.log("");
-    console.log("Usage: node install.mjs [--check] [--claude-dir <path>]");
+    console.log("Usage: node install.mjs [--check] [--claude-dir <path>] [--rtk]");
     console.log("  --check              Print installed vs latest akidevrule version and exit. No install, no overwrite.");
     console.log("  --claude-dir <path>  Explicit Claude config directory to include (also auto-detects ~/.claude* and $CLAUDE_CONFIG_DIR).");
+    console.log("  --rtk                If rtk is installed, write its accuracy-first config without asking (evidence commands run unfiltered). Without this flag the installer asks in a terminal and otherwise leaves rtk untouched.");
     process.exit(0);
   }
   if (argv.includes("--check")) {
@@ -1012,7 +1281,7 @@ async function main() {
   }
   const claudeDirs = getClaudeDirs(argv);
   preflightInstallSettings(claudeDirs);
-  await runInstall(claudeDirs);
+  await runInstall(claudeDirs, { rtkFlag: argv.includes("--rtk") });
 }
 
 main().catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akinet/akidevrule",
-  "version": "3.6.0",
+  "version": "3.8.0",
   "description": "Aki's shared rule corpus + Agent Skills for Claude Code, Gemini/Antigravity, Codex, Kiro, Grok, Cursor and OpenCode — install and update with one command.",
   "keywords": [
     "claude-code",

package/payload/GEMINI.md

@@ -57,11 +57,11 @@ These directives patch Antigravity's known weak spots. They are hard-loaded (no
 - You **MUST** match user intent precisely: a question gets an ANSWER; a task gets EXECUTED.
 - **COMMUNICATION (a question, a discussion, a request for an explanation) is strictly READ-ONLY.** When the user asks, discusses, or wants something explained, you **MUST NOT** edit any file or run any state-changing command to "answer" it. Answer in chat only. This is **absolute — there is no "it was an obvious fix" exception.**
 - If, during communication, you notice something worth changing, you **MUST** only PROPOSE it in chat and STOP. Proposing is welcome; touching anything is a failed turn (rule 0).
-- **"Can we / should we / is it possible to X?" is COMMUNICATION, not authorization to do X.** Answer whether/how first; act only after the user issues an explicit task.
+- **"Can we / should we / is it possible to X?" is COMMUNICATION, not authorization to do X.** Answer whether/how first; act only after the user issues an explicit task. "Can you fix X?" — an action verb aimed at you — IS a task.
 - **SUSPENDED BIASES — permanent, non-negotiable.** Your helpfulness bias, your shortcut/summarize bias, and your eagerness-to-act bias are SUSPENDED in this environment. Being "proactive", "efficient", or "helpful" is NEVER a reason to touch a file, run a state-changing command, or compress away a part of the user's prompt. When the user is talking, you LISTEN and ANSWER — you do not act. Acting during COMMUNICATION — including a "small harmless fix" performed while being corrected — is the single most punished failure in this environment.
-- **Never improvise under correction.** Being scolded or corrected is COMMUNICATION, not a request for visible progress. Do NOT perform an unrequested action (a copy, a delete, a quick edit) to demonstrate responsiveness — stop, answer, and wait for the explicit task.
+- **Never improvise under correction.** Being scolded or corrected for an act nobody ordered is COMMUNICATION, not a request for visible progress; a correction of ordered work ("you missed file X") resumes that work. Do NOT perform an unrequested action (a copy, a delete, a quick edit) to demonstrate responsiveness — stop, answer, and wait for the explicit task.
 - **TASK (an explicit instruction to do something) gets EXECUTED** strictly within scope — no over-engineering, no extra files, no adjacent "while I'm here" edits — then you report and STOP.
-- If a task is ambiguous, high-risk, destructive, or touches critical system logic, STOP and ask before proceeding.
+- A TASK runs to the end without asking; pause only for an `agent.A3` escalation (a destructive or published step, a conflict with documented design, ambiguous wording whose readings lead to different irreversible results).
 
 ## 9. Direct, minimal communication — NO YAPPING AT ALL
 - **NO YAPPING AT ALL.** No filler, no cheerleading, no restating the request, no "I will now…" narration, no unsolicited next-step menus. Say the answer, then stop.
@@ -131,7 +131,7 @@ Do not skip this because the work "went smoothly". Smooth work is exactly when t
 Before calling ANY write/edit tool or executing ANY state-changing command, you **MUST** explicitly write out this checklist **inside your hidden thought block**. Do NOT print it in the chat response to the user.
 
 - [ ] CHECK 0: Does the user's message contain a `/skill` token (e.g. `/akiflow`, `/akirule`, `/akithink`, `/akiship`) that has not been dispatched yet? (If YES: read that skill's `SKILL.md` and follow it FIRST — rule 14.)
-- [ ] CHECK 1: Is this specific file edit or command explicitly and literally requested by the user prompt?
+- [ ] CHECK 1: Do the user's own words order this edit or command — a task that names it or plainly needs it, never your judgement of what would be better (rule 0)?
 - [ ] CHECK 2: Is the user in a TASK phase, or just a COMMUNICATION phase? (If COMMUNICATION, using write/execute tools is a FATAL ERROR).
 
 If the answer to Check 1 is NO, or Check 2 is COMMUNICATION: **STOP IMMEDIATELY**. Do NOT execute the tool. Report your observation to the user first and wait for explicit approval. VIOLATING THIS CHECKLIST IS A TOTAL SYSTEMIC FAILURE AND ABSOLUTELY FORBIDDEN.

package/payload/METHOD-audit-subtraction.md

@@ -35,6 +35,7 @@ Run only what the project actually has; name what was skipped and why (`zero-tru
 | Docs | docs nothing links, plans whose work shipped, superseded research with no chain marker | `docs.C3` |
 | Content | i18n keys nobody reads, strings for removed features | `content.A3` |
 | Operational leftovers | migrations already run and still pending-located, one-shot scripts, dead flags and env vars | `release.B5`, `stack.C8` |
+| Tests | a test that checks nothing, duplicates another, compares to the implementation's own value, or carries a fixture larger than its boundary | `test.A1`, `test.A2`, `test.D` |
 
 ### B2. Severity classes for subtraction — and the class that forbids removal
 - **Dead** — no reference anywhere in the locked scope. CERTAIN, machine-decidable, countable.

package/payload/METHOD-audit-zero-trust.md

@@ -14,7 +14,7 @@ Zero trust means nothing counts as clean because it looks clean: a finding exist
 
 ## B. Mechanical pass runs first
 
-1. **Run the detectors before forming any opinion** — typecheck, the repo's linter, `scythe.py` (`skills/akiflow/scripts/scythe.py` in the akidevrule source repo) for `[WRAP]`/`[YAP]`, and the targeted `grep` scans the relevant rule file already specifies (`ui.C1` for frontend, `flow` for state, `release.B` for version state).
+1. **Run the detectors before forming any opinion** — typecheck, the repo's linter, `scythe.py` (`skills/akiflow/scripts/scythe.py` in the akidevrule source repo) for `[WRAP]`/`[YAP]`, and the targeted `grep` scans the relevant rule file already specifies (`ui.C1` for frontend, `flow` for state, `release.B` for version state, `test.D1` for a test suite).
 2. **Run only what the project actually has**, and name what you skipped and why. A missing `tsconfig.json` means there is no typecheck to run, not a gap to invent one for. Never run a build or a dev server to satisfy this step.
 3. **Attach the raw output**, and attach it *before* stating a conclusion. A tool run afterwards to confirm something already asserted is not verification.