@akinet/akidevrule 3.7.0 → 3.9.0

package/install.mjs

@@ -48,6 +48,7 @@ const CODEX_SKILLS_DIR = join(HOME, ".agents", "skills");
 const CODEX_HOME = process.env.CODEX_HOME ? expandTilde(process.env.CODEX_HOME.trim()) : join(HOME, ".codex");
 const KIRO_SKILLS_DIR = join(HOME, ".kiro", "skills");
 const GROK_SKILLS_DIR = join(HOME, ".grok", "skills");
+const WORKBUDDY_SKILLS_DIR = join(HOME, ".workbuddy-ai", "skills");
 const SKILLS_SRC = join(REPO_ROOT, "skills");
 
 const OLD_SKILLS = ["akidoc-rules", "akidoc-flow-audit", "akidoc-techbiz-optimizer", "akiadvise"];
@@ -203,21 +204,34 @@ const blueBold = (t) => c("1;34", t);
 // Backup / prune
 // ---------------------------------------------------------------------------
 
+// A backup is rollback material for this run only: removed once the run succeeds, kept when it fails. keepBackup() exempts one that holds content the install discarded.
+const runBackups = new Set();
+
 function backup(path) {
   if (!existsSync(path)) return;
   const dest = join(dirname(path), `${basename(path)}.akidevrule-backup-${STAMP}`);
   if (isDir(path)) copyTree(path, dest);
   else copyFileSync(path, dest);
+  runBackups.add(dest);
+}
+
+function keepBackup(path) {
+  runBackups.delete(join(dirname(path), `${basename(path)}.akidevrule-backup-${STAMP}`));
 }
 
-function pruneBackups(base) {
+function dropRunBackups() {
+  for (const dest of runBackups) rmrf(dest);
+  runBackups.clear();
+}
+
+function pruneBackups(base, keep = 1) {
   const parent = dirname(base);
   const prefix = `${basename(base)}.akidevrule-backup-`;
   const candidates = listDir(parent)
     .filter((n) => n.startsWith(prefix))
     .map((n) => join(parent, n))
     .sort((a, b) => statSync(a).mtimeMs - statSync(b).mtimeMs);
-  for (const old of candidates.slice(0, -2)) {
+  for (const old of candidates.slice(0, -keep)) {
     console.log(`  🗑️  Removing old backup: ${basename(old)}`);
     rmrf(old);
   }
@@ -332,34 +346,32 @@ function gitBranch(repo) {
 
 const ROUTER_SRC = join(SKILLS_SRC, "akirule", "SKILL.md");
 
-// The router's routes table is the single routing source; AG's native rule descriptions are derived from it.
-function routerClauses() {
-  const table = readFileSync(ROUTER_SRC, "utf-8").matchAll(/^\| `((?:RULE|METHOD)-[^`]+\.md)` · `[\w-]+` \| ([^|]+) \|/gm);
-  return new Map([...table].map(([, file, clause]) => [file, clause.trim()]));
+function routerRoutes() {
+  const table = readFileSync(ROUTER_SRC, "utf-8").matchAll(/^\| `((?:RULE|METHOD)-[^`]+\.md)` · `[\w-]+` \| ([^|]+) \| ([^|]+) \|/gm);
+  return new Map([...table].map(([, file, clause, signals]) => [file, { clause: clause.trim(), signals: signals.trim() }]));
 }
 
-// Each entry: [ruleFile, trigger, globs] — globs is a raw JSON array string or ""; every model_decision description is derived from the router's route clause.
 const AG_RULE_MAP = [
-  ["RULE-agent-behavior.md", "always_on", ""],
-  ["RULE-coding.md", "model_decision", ""],
-  ["RULE-pattern-core.md", "model_decision", ""],
-  ["RULE-test.md", "model_decision", ""],
-  ["RULE-docs.md", "model_decision", ""],
-  ["RULE-content-write.md", "model_decision", ""],
-  ["RULE-stack-akiNuxtCf.md", "glob", '["**/*.vue", "nuxt.config.*", "wrangler.toml", "app/**", "server/**", "composables/**", "middleware/**", "plugins/**", "layouts/**"]'],
-  ["RULE-stack-tauri.md", "glob", '["src-tauri/**", "**/*.rs", "tauri.conf.json"]'],
-  ["RULE-ui-pattern.md", "model_decision", ""],
-  ["RULE-seo.md", "model_decision", ""],
-  ["RULE-release.md", "model_decision", ""],
-  ["RULE-db-design.md", "model_decision", ""],
-  ["RULE-biz.md", "model_decision", ""],
-  ["METHOD-audit-flow.md", "model_decision", ""],
-  ["METHOD-audit-zero-trust.md", "model_decision", ""],
-  ["METHOD-deep-think.md", "model_decision", ""],
-  ["METHOD-ux-psych.md", "model_decision", ""],
-  ["METHOD-proportionality.md", "model_decision", ""],
-  ["METHOD-audit-subtraction.md", "model_decision", ""],
-  ["METHOD-audit-frozen-reference.md", "model_decision", ""],
+  ["RULE-agent-behavior.md", "always_on", []],
+  ["RULE-coding.md", "model_decision", []],
+  ["RULE-pattern-core.md", "model_decision", []],
+  ["RULE-test.md", "model_decision", []],
+  ["RULE-docs.md", "model_decision", []],
+  ["RULE-content-write.md", "model_decision", []],
+  ["RULE-stack-akiNuxtCf.md", "glob", ["**/*.vue", "nuxt.config.*", "wrangler.toml", "app/**", "server/**", "composables/**", "middleware/**", "plugins/**", "layouts/**"]],
+  ["RULE-stack-tauri.md", "glob", ["src-tauri/**", "**/*.rs", "tauri.conf.json"]],
+  ["RULE-ui-pattern.md", "model_decision", []],
+  ["RULE-seo.md", "model_decision", []],
+  ["RULE-release.md", "model_decision", []],
+  ["RULE-db-design.md", "model_decision", []],
+  ["RULE-biz.md", "model_decision", []],
+  ["METHOD-audit-flow.md", "model_decision", []],
+  ["METHOD-audit-zero-trust.md", "model_decision", []],
+  ["METHOD-deep-think.md", "model_decision", []],
+  ["METHOD-ux-psych.md", "model_decision", []],
+  ["METHOD-proportionality.md", "model_decision", []],
+  ["METHOD-audit-subtraction.md", "model_decision", []],
+  ["METHOD-audit-frozen-reference.md", "model_decision", []],
 ];
 
 function agDestName(ruleFile) {
@@ -368,23 +380,24 @@ function agDestName(ruleFile) {
   return `akirule-${stem.toLowerCase()}.md`;
 }
 
-function agRuleDescription(ruleFile, clauses) {
-  if (!clauses.has(ruleFile)) throw new Error(`akirule has no route for ${ruleFile}`);
+function agRuleDescription(ruleFile, routes) {
+  if (!routes.has(ruleFile)) throw new Error(`akirule has no route for ${ruleFile}`);
+  const { clause, signals } = routes.get(ruleFile);
   // agy denies view_file on ~/.gemini/config/rules/ (hardcoded protection boundary, measured 2026-09-26), so the description names the readable copy.
-  return `Load when the task ${clauses.get(ruleFile)}: view_file ~/.aki/akidevrule/${ruleFile} (this rules directory itself is not readable).`;
+  return `Load when the task ${clause}. Signals (evidence of the domain, never a literal gate): ${signals}. view_file ~/.aki/akidevrule/${ruleFile} (this rules directory itself is not readable).`;
 }
 
 // Every rule file is rendered before any installed one is removed, so a bad map or router aborts with AG untouched.
 function installAgRules() {
-  const clauses = routerClauses();
+  const routes = routerRoutes();
   const mapped = new Set(AG_RULE_MAP.map(([f]) => f));
   const unmapped = listDir(join(REPO_ROOT, "payload")).filter((n) => /^(RULE|METHOD)-.*\.md$/.test(n) && !mapped.has(n));
   if (unmapped.length) throw new Error(`AG_RULE_MAP has no entry for: ${unmapped.join(", ")}`);
 
   const rendered = AG_RULE_MAP.map(([ruleFile, trigger, globs]) => {
     const lines = ["---", `trigger: ${trigger}`];
-    if (globs) lines.push(`globs: ${globs}`);
-    if (trigger !== "always_on") lines.push(`description: ${JSON.stringify(agRuleDescription(ruleFile, clauses))}`);
+    if (globs.length) lines.push(`globs: ${JSON.stringify(globs.join(", "))}`);
+    if (trigger !== "always_on") lines.push(`description: ${JSON.stringify(agRuleDescription(ruleFile, routes))}`);
     lines.push("---", "", `<!-- Generated by akidevrule from payload/${ruleFile}. Do not edit here. -->`, "");
     lines.push(readFileSync(join(REPO_ROOT, "payload", ruleFile), "utf-8"));
     return [join(GEMINI_RULES_DIR, agDestName(ruleFile)), lines.join("\n")];
@@ -455,6 +468,150 @@ function installCodexInstructions() {
   return { file, bytes, changed, shadowed, budget: ensureCodexDocBudget(bytes) };
 }
 
+// ---------------------------------------------------------------------------
+// rtk — optional output compressor on Claude Code's Bash tool; opt-in accuracy-first config (README § Optional: rtk, docs/plan/rtk-accuracy-first.md)
+// ---------------------------------------------------------------------------
+
+const RTK_OPT_OUT = "# akidevrule: rtk off";
+const RTK_MANAGED_MARK = "# akidevrule: accuracy-first rtk";
+const RTK_EXCLUDE = [
+  ["ls", "tree", "find", "grep", "rg", "ast-grep", "wc", "diff"],
+  ["cat", "head", "tail"],
+  ["jq", "stat", "du", "df", "ps", "ssh", "rsync", "curl", "wget"],
+  ["gh", "glab", "psql", "aws", "kubectl", "oc", "docker"],
+  ["^git(\\s+-[Cc]\\s+\\S+)*\\s+(diff|log|show|stash|branch)\\b"],
+];
+const RTK_EVIDENCE_FAMILIES = "ls, grep, find, git diff/log/show, jq";
+const RTK_NOISE_FAMILIES = "git status, package installs and build logs";
+
+// TOML basic strings take JSON's escapes for backslash and quote, so JSON.stringify renders each entry.
+function rtkExcludeLines() {
+  return RTK_EXCLUDE.map((group) => `  ${group.map((s) => JSON.stringify(s)).join(", ")},`).join("\n");
+}
+
+function rtkHooksTable() {
+  return `${RTK_MANAGED_MARK} — commands whose output is evidence run unfiltered (akidevrule README § Optional: rtk)\n[hooks]\nexclude_commands = [\n${rtkExcludeLines()}\n]\n`;
+}
+
+// Fallback mirrors rtk's dirs::config_dir() layout (XDG, Application Support, RoamingAppData) when `rtk config` prints no path.
+function rtkDetect() {
+  let r;
+  try {
+    r = spawnSync("rtk", ["config"], { encoding: "utf-8", timeout: 5000, shell: IS_WIN });
+  } catch {
+    return null;
+  }
+  if (r.error || r.status !== 0) return null;
+  const m = (r.stdout || "").match(/^Config:\s*(.+?)\s*$/m);
+  if (m) return { path: expandTilde(m[1]) };
+  const base = process.platform === "darwin" ? join(HOME, "Library", "Application Support") : IS_WIN ? process.env.APPDATA || join(HOME, "AppData", "Roaming") : process.env.XDG_CONFIG_HOME || join(HOME, ".config");
+  return { path: join(base, "rtk", "config.toml") };
+}
+
+// The [name] table's body: from its header to the next table header. null when absent.
+function tomlTable(text, name) {
+  const header = new RegExp(`^[ \\t]*\\[${escapeRe(name)}\\][ \\t]*(#.*)?$`, "m");
+  const h = text.search(header);
+  if (h === -1) return null;
+  const bodyStart = text.indexOf("\n", h) + 1;
+  const rest = text.slice(bodyStart);
+  const next = rest.search(TOML_HEADER);
+  const end = next === -1 ? text.length : bodyStart + next;
+  return { start: h, bodyStart, end, body: text.slice(bodyStart, end) };
+}
+
+// String entries of the array that follows `key =`, read until the unquoted `]` (a quoted entry may itself contain one).
+function tomlStringArray(body, key) {
+  const k = body.match(new RegExp(`^[ \\t]*${escapeRe(key)}[ \\t]*=[ \\t]*\\[`, "m"));
+  if (!k) return null;
+  const out = [];
+  let i = k.index + k[0].length;
+  while (i < body.length) {
+    const ch = body[i];
+    if (ch === "]") break;
+    if (ch === '"' || ch === "'") {
+      const close = ch === '"' ? /(?:[^"\\]|\\.)*"/y : /[^']*'/y;
+      close.lastIndex = i + 1;
+      const m = close.exec(body);
+      if (!m) break;
+      const raw = m[0].slice(0, -1);
+      out.push(ch === '"' ? JSON.parse(`"${raw}"`) : raw);
+      i = close.lastIndex;
+      continue;
+    }
+    if (ch === "#") i = body.indexOf("\n", i) === -1 ? body.length : body.indexOf("\n", i);
+    else i++;
+  }
+  return out;
+}
+
+// Read-only classification: the state the file is already in, or null when a write would be needed (no file, no [hooks], [hooks] without exclude_commands).
+function rtkReadState(cfg) {
+  const text = isFile(cfg) ? readFileSync(cfg, "utf-8") : "";
+  if (text.includes(RTK_OPT_OUT)) return { path: cfg, state: "opt-out" };
+  const hooks = tomlTable(text, "hooks");
+  const have = hooks && tomlStringArray(hooks.body, "exclude_commands");
+  if (!have) return null;
+  const missing = RTK_EXCLUDE.flat().filter((s) => !have.includes(s));
+  return { path: cfg, state: missing.length ? "kept" : "unchanged", missing };
+}
+
+// Smallest safe change: no file → write; no [hooks] → append the table; [hooks] without exclude_commands → insert the key; anything else is rtkReadState's answer.
+function rtkConfigure(cfg) {
+  const known = rtkReadState(cfg);
+  if (known) return known;
+  const text = isFile(cfg) ? readFileSync(cfg, "utf-8") : "";
+  const write = (after) => {
+    if (text) {
+      backup(cfg);
+      pruneBackups(cfg);
+    }
+    writeTextLf(cfg, after);
+  };
+  const hooks = tomlTable(text, "hooks");
+  if (!hooks) {
+    write((text ? text.replace(/\s*$/, "") + "\n\n" : "") + rtkHooksTable());
+    return { path: cfg, state: text ? "appended" : "written" };
+  }
+  write(text.slice(0, hooks.bodyStart) + `exclude_commands = [ ${RTK_MANAGED_MARK}\n${rtkExcludeLines()}\n]\n` + text.slice(hooks.bodyStart));
+  return { path: cfg, state: "appended" };
+}
+
+function rtkPrompt(cfg) {
+  console.log(`\n🔎 ${yellowBold("rtk found")} — an output compressor that hooks into Claude Code's Bash tool.`);
+  console.log(`   Its built-in filters save tokens by dropping lines — also from ${RTK_EVIDENCE_FAMILIES}, whose output an agent reads as evidence (a count, a quote, a "not found").`);
+  console.log(`   ${greenBold("y")} → write an accuracy-first rtk config at ${toTildePath(cfg)}: those commands run unfiltered; ${RTK_NOISE_FAMILIES} stay compressed. Existing file backed up; opt out later with a "${RTK_OPT_OUT}" line.`);
+  console.log(`   ${greenBold("N")} → leave rtk as it is (default). Details: README § Optional: rtk`);
+}
+
+function printRtkSummary(rtk) {
+  console.log();
+  console.log(cyanBold("rtk (optional output compressor):"));
+  if (!rtk) {
+    console.log("  ℹ️  rtk not found — nothing to configure. If you install it later, re-run with --rtk to run evidence commands unfiltered (README § Optional: rtk)");
+    return;
+  }
+  const p = toTildePath(rtk.path);
+  switch (rtk.state) {
+    case "declined":
+      console.log(`  ⚠️  rtk found, left as is — its default filters drop evidence lines from ${RTK_EVIDENCE_FAMILIES}. To run those unfiltered: re-run and answer y, or \`node install.mjs --rtk\` (README § Optional: rtk)`);
+      break;
+    case "written":
+    case "appended":
+      console.log(`  ✅ accuracy-first config ${rtk.state === "written" ? "written" : "added"}: ${p} — ${RTK_EVIDENCE_FAMILIES} … unfiltered; ${RTK_NOISE_FAMILIES} still compressed`);
+      break;
+    case "unchanged":
+      console.log(`  ✅ accuracy-first config already in place: ${p}`);
+      break;
+    case "kept":
+      console.log(`  ⚠️  ${p} has its own [hooks] exclude_commands — kept as yours; not in it yet: ${rtk.missing.join(", ")}`);
+      break;
+    case "opt-out":
+      console.log(`  ℹ️  ${p} carries "${RTK_OPT_OUT}" — skipped`);
+      break;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // settings.json merge (Claude Code)
 // ---------------------------------------------------------------------------
@@ -504,6 +661,10 @@ function mergeSettings(settingsPath, installRoot, claudeDir) {
   data.skillOverrides.akirule = "on";
   if (!("akihelp" in data.skillOverrides)) data.skillOverrides.akihelp = "name-only";
 
+  // agent.B4 by mechanism: an empty attribution string hides Claude Code's commit/PR trailer, sessionUrl=false the Claude-Session link; other keys stay the user's.
+  if (typeof data.attribution !== "object" || data.attribution === null || Array.isArray(data.attribution)) data.attribution = {};
+  Object.assign(data.attribution, { commit: "", pr: "", sessionUrl: false });
+
   if (typeof data.hooks !== "object" || data.hooks === null || Array.isArray(data.hooks)) data.hooks = {};
   const hooks = data.hooks;
   if (!Array.isArray(hooks.SessionStart)) hooks.SessionStart = [];
@@ -553,16 +714,18 @@ function mergeSettings(settingsPath, installRoot, claudeDir) {
     }
   };
   hooks.PreToolUse = hooks.PreToolUse.filter((e) => !isAkiRouteGuard(e));
-  hooks.PreToolUse.push({
-    matcher: "Edit|MultiEdit|Write|NotebookEdit",
-    hooks: [
-      {
-        type: "command",
-        command: `node "${join(claudeDir, "hooks", "aki-route-guard.mjs")}"`,
-        timeout: 10,
-      },
-    ],
-  });
+  for (const matcher of ["Edit|MultiEdit|Write|NotebookEdit", "Read"]) {
+    hooks.PreToolUse.push({
+      matcher,
+      hooks: [
+        {
+          type: "command",
+          command: `node "${join(claudeDir, "hooks", "aki-route-guard.mjs")}"`,
+          timeout: 10,
+        },
+      ],
+    });
+  }
 
   writeTextLf(settingsPath, JSON.stringify(data, null, 2) + "\n");
 }
@@ -700,12 +863,15 @@ function updateSkillsJson() {
   const skillsJson = join(GEMINI_DIR, "config", "skills.json");
   mkdirSync(dirname(skillsJson), { recursive: true });
   const data = isFile(skillsJson) ? JSON.parse(readFileSync(skillsJson, "utf-8")) : {};
-  if (!Array.isArray(data.entries)) data.entries = [];
-  const absPath = join(INSTALL_ROOT, "agskills");
-  const tildePath = "~/.aki/akidevrule/agskills";
-  for (const p of [absPath, tildePath]) {
-    if (!data.entries.some((e) => e && typeof e === "object" && e.path === p)) data.entries.push({ path: p });
-  }
+  const entries = [...(Array.isArray(data.entries) ? data.entries : []), { path: join(INSTALL_ROOT, "agskills") }];
+  const seen = new Set();
+  data.entries = entries.flatMap((e) => {
+    if (!e || typeof e !== "object" || typeof e.path !== "string") return [e];
+    const path = expandTilde(e.path);
+    if (seen.has(path)) return [];
+    seen.add(path);
+    return [{ ...e, path }];
+  });
   writeTextLf(skillsJson, JSON.stringify(data, null, 2) + "\n");
 }
 
@@ -813,7 +979,9 @@ async function inspectStatus(claudeDirs) {
         const readOk = allow.includes(readRule);
         const overrides = data.skillOverrides || {};
         const akiOk = overrides.akirule === "on";
-        console.log(`  Claude (${toTildePath(claudeDir)}): Read=${readOk ? "✅" : "⚠️ missing"}, Bash=${bashOk ? "✅" : "⚠️ missing"}, akirule=${akiOk ? "✅" : "⚠️ will enable"}`);
+        const attr = data.attribution || {};
+        const attrOff = attr.commit === "" && attr.pr === "" && attr.sessionUrl === false;
+        console.log(`  Claude (${toTildePath(claudeDir)}): Read=${readOk ? "✅" : "⚠️ missing"}, Bash=${bashOk ? "✅" : "⚠️ missing"}, akirule=${akiOk ? "✅" : "⚠️ will enable"}, attribution=${attrOff ? "✅ off" : "⚠️ will turn off"}`);
       } catch (e) {
         console.log(`  ❌ Error reading ${settingsPath}: ${e}`);
       }
@@ -849,7 +1017,7 @@ async function inspectStatus(claudeDirs) {
 // print_summary (post-install)
 // ---------------------------------------------------------------------------
 
-function printSummary(claudeDirs, preAllow, codex) {
+function printSummary(claudeDirs, preAllow, codex, rtk) {
   console.log(`\n${greenBold("=== INSTALL SUCCEEDED ===")}`);
 
   const gitHash = gitShortHash(REPO_ROOT);
@@ -864,10 +1032,10 @@ function printSummary(claudeDirs, preAllow, codex) {
 
   console.log(cyanBold("Rules deployed:"));
   {
-    const clauses = routerClauses();
+    const routes = routerRoutes();
     for (const [ruleFile, trigger] of AG_RULE_MAP) {
       const [tier, color] = trigger === "always_on" ? ["Core", redBold] : ruleFile.startsWith("METHOD-") ? ["Analytical", blueBold] : ["Contextual", yellowBold];
-      const desc = trigger === "always_on" ? "behavior floor — resident every session" : `loads when the task ${clauses.get(ruleFile) || "?"}`;
+      const desc = trigger === "always_on" ? "behavior floor — resident every session" : `loads when the task ${routes.get(ruleFile)?.clause ?? "?"}`;
       console.log(`  ${color(tier.padEnd(12))} ${ruleFile.padEnd(34)} ${desc}`);
     }
   }
@@ -895,6 +1063,7 @@ function printSummary(claudeDirs, preAllow, codex) {
   console.log(`  🤖 Codex CLI : ${CODEX_SKILLS_DIR}`);
   console.log(`  🤖 Kiro CLI  : ${KIRO_SKILLS_DIR}`);
   console.log(`  🤖 Grok CLI  : ${GROK_SKILLS_DIR}`);
+  console.log(`  🤖 WorkBuddy : ${WORKBUDDY_SKILLS_DIR}`);
 
   console.log();
   console.log(cyanBold("Codex global instructions (behavior floor + router, resident):"));
@@ -911,7 +1080,7 @@ function printSummary(claudeDirs, preAllow, codex) {
 
   console.log();
   console.log(cyanBold("Skill scripts pre-allowed (no prompt when a skill runs its own scripts):"));
-  console.log("  ⚙️  claude       settings.json in every target above — plus Read(~/.aki/akidevrule/**)");
+  console.log("  ⚙️  claude       settings.json in every target above — plus Read(~/.aki/akidevrule/**) and attribution off (no Co-Authored-By, PR footer or session link — agent.B4)");
   for (const row of preAllow) {
     const state = row.error ? `⚠️  skipped: ${row.error}` : `${row.rules} invocation(s)${row.changed ? "" : ", unchanged"}`;
     console.log(`  ⚙️  ${row.id.padEnd(12)} ${toTildePath(row.file)} — ${state}`);
@@ -920,10 +1089,12 @@ function printSummary(claudeDirs, preAllow, codex) {
 
   console.log();
   console.log(cyanBold("Hooks deployed:"));
-  console.log("  🚧 aki-route-guard (PreToolUse on Edit|MultiEdit|Write|NotebookEdit) — denies the first edit of an artifact type until its routed rule was Read after the last compaction; AKI_ROUTE_GUARD=0 disables");
+  console.log("  🚧 aki-route-guard (PreToolUse on Edit|MultiEdit|Write|NotebookEdit and Read) — edit gate: denies the first edit of an artifact type until its routed rule was Read whole after the last compaction; Read of a rule file is widened to the whole file; AKI_ROUTE_GUARD=0 disables");
   console.log("  🔁 aki-compact-reread (SessionStart, compact only) — one notice after a compaction: routed rules left context, re-read before the next edit");
   console.log("  📢 aki-update-check (SessionStart, notify-only) — notifies when a new rule version is available");
 
+  printRtkSummary(rtk);
+
   console.log(`\n${greenBold("==============================")}`);
 }
 
@@ -945,7 +1116,7 @@ function ask(question) {
 // Main install logic
 // ---------------------------------------------------------------------------
 
-async function runInstall(claudeDirs) {
+async function runInstall(claudeDirs, { rtkFlag = false } = {}) {
   const sameCheckout = await inspectStatus(claudeDirs);
 
   // Skip the prompt only for a byte-identical overwrite (same commit, clean tree).
@@ -957,6 +1128,15 @@ async function runInstall(claudeDirs) {
     }
   }
 
+  // rtk: asked up front so the run has no mid-install question; default and non-interactive answer is "leave it".
+  const rtkFound = rtkDetect();
+  const rtkKnown = rtkFound && rtkReadState(rtkFound.path);
+  let rtkYes = rtkFlag;
+  if (rtkFound && !rtkKnown && !rtkFlag && process.stdin.isTTY) {
+    rtkPrompt(rtkFound.path);
+    rtkYes = (await ask("Configure rtk accuracy-first? [y/N]: ")).trim().toLowerCase() === "y";
+  }
+
   // Legacy migration: ~/.aki/claudedoc -> ~/.aki/akidevrule
   if (isDir(LEGACY_INSTALL_ROOT) && !existsSync(INSTALL_ROOT)) {
     mkdirSync(dirname(INSTALL_ROOT), { recursive: true });
@@ -1018,6 +1198,7 @@ async function runInstall(claudeDirs) {
   syncAkiSkills(CODEX_SKILLS_DIR);
   syncAkiSkills(KIRO_SKILLS_DIR);
   syncAkiSkills(GROK_SKILLS_DIR);
+  syncAkiSkills(WORKBUDDY_SKILLS_DIR);
   const codex = installCodexInstructions();
 
   // --- 4. GEMINI.md (only when ~/.gemini exists) ---
@@ -1040,8 +1221,8 @@ async function runInstall(claudeDirs) {
     }
 
     backup(geminiFile);
-    console.log("🧹 Pruning GEMINI.md backups (keeping the 2 most recent):");
-    pruneBackups(geminiFile);
+    if (hadUnmanaged) keepBackup(geminiFile);
+    pruneBackups(geminiFile, hadUnmanaged ? 2 : 1);
 
     const d = new Date();
     const geminiVersion = `V${d.getFullYear()}${pad2(d.getMonth() + 1)}${pad2(d.getDate())}`;
@@ -1083,7 +1264,11 @@ async function runInstall(claudeDirs) {
   // --- 5. Script pre-allow for every other harness present ---
   const preAllow = preAllowHarnessScripts(claudeDirs);
 
-  printSummary(claudeDirs, preAllow, codex);
+  // --- 6. rtk accuracy-first config: an existing state is reported as is, a write only on an explicit yes ---
+  const rtk = rtkFound ? (rtkKnown || (rtkYes ? rtkConfigure(rtkFound.path) : { path: rtkFound.path, state: "declined" })) : null;
+
+  dropRunBackups();
+  printSummary(claudeDirs, preAllow, codex, rtk);
 }
 
 // ---------------------------------------------------------------------------
@@ -1095,9 +1280,10 @@ async function main() {
   if (argv.includes("-h") || argv.includes("--help")) {
     console.log("akidevrule installer — deploys shared rule corpus and skills.");
     console.log("");
-    console.log("Usage: node install.mjs [--check] [--claude-dir <path>]");
+    console.log("Usage: node install.mjs [--check] [--claude-dir <path>] [--rtk]");
     console.log("  --check              Print installed vs latest akidevrule version and exit. No install, no overwrite.");
     console.log("  --claude-dir <path>  Explicit Claude config directory to include (also auto-detects ~/.claude* and $CLAUDE_CONFIG_DIR).");
+    console.log("  --rtk                If rtk is installed, write its accuracy-first config without asking (evidence commands run unfiltered). Without this flag the installer asks in a terminal and otherwise leaves rtk untouched.");
     process.exit(0);
   }
   if (argv.includes("--check")) {
@@ -1106,7 +1292,7 @@ async function main() {
   }
   const claudeDirs = getClaudeDirs(argv);
   preflightInstallSettings(claudeDirs);
-  await runInstall(claudeDirs);
+  await runInstall(claudeDirs, { rtkFlag: argv.includes("--rtk") });
 }
 
 main().catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akinet/akidevrule",
-  "version": "3.7.0",
+  "version": "3.9.0",
   "description": "Aki's shared rule corpus + Agent Skills for Claude Code, Gemini/Antigravity, Codex, Kiro, Grok, Cursor and OpenCode — install and update with one command.",
   "keywords": [
     "claude-code",

package/payload/GEMINI.md

@@ -33,7 +33,7 @@ These directives patch Antigravity's known weak spots. They are hard-loaded (no
 
 ## 3. Always comply with the akirule corpus — and with rule 0
 - The shared rule corpus installed at `~/.aki/akidevrule/` ("akirule") applies to you, not only to other agents. When a task touches an area it covers, follow it.
-- **Nothing is read at session start.** `RULE-coding.md` and `RULE-pattern-core.md` are attached natively by their rule descriptions on code turns (`akirule-coding`, `akirule-pattern-core`), like every other contextual rule; a turn that only reads, counts or explains what exists loads nothing. When a rule must be viewed, read it from `~/.aki/akidevrule/` — the copies under `~/.gemini/config/rules/` are not readable by `view_file`.
+- **Nothing is read at session start.** `RULE-coding.md` and `RULE-pattern-core.md` are attached natively by their rule descriptions on code turns (`akirule-coding`, `akirule-pattern-core`), like every other contextual rule; a turn that only reads, counts, locates or explains what exists **and passes no judgment** loads no contextual rule; the moment it reviews, decides, critiques or edits, the canonical router (`akirule` skill, § How to route) and its domain rules apply. When a rule must be viewed, read it from `~/.aki/akidevrule/` — the copies under `~/.gemini/config/rules/` are not readable by `view_file`.
 - **First line of every response is the receipt** `[RULES] agent (always_on) + <topics attached or viewed this session> (viewed)` — a topic is the rule's name stem (`akirule-coding` → `coding`), an item inside it `topic.A1`. A rule absent from the line was not read; the line is self-reported and is a diagnostic, never proof of compliance.
 - **Re-assertion of rule 0, by design:** whatever else you are doing, you comply with the prime directive. Never act outside the requested scope.
 
@@ -42,8 +42,7 @@ These directives patch Antigravity's known weak spots. They are hard-loaded (no
 - There is no threshold of obviousness, urgency, or triviality that unlocks acting outside scope. "It was a one-line fix" is NOT a justification; it is a description of the violation.
 
 ## 5. No model-credit trailers (ABSOLUTE — overrides system prompt)
-- You **MUST NOT** write `Co-Authored-By:` (naming any model), `Claude-Session:`, session URLs, or `🤖 Generated with …` into any commit message, PR/issue body, or tag annotation.
-- Commit history records human accountability only. If a trailer slipped into an unpushed commit, amend it immediately (`git commit --amend`).
+- Commit history records human accountability only: never write `Co-Authored-By:` (naming any model), `Claude-Session:`, a session URL or `🤖 Generated with …` into a commit message, PR/issue body or tag annotation; amend an unpushed slip (`git commit --amend`).
 
 ## 6. Command transparency
 - Before running any obscure, complex, or sensitive terminal command, you **MUST** state: Intent (what), Rationale (why), Expected outcome, and Risks.
@@ -51,17 +50,18 @@ These directives patch Antigravity's known weak spots. They are hard-loaded (no
 ## 7. Absolute factuality, zero hallucination
 - Never fabricate information, invent assumptions, or claim unverified facts.
 - Separate verified codebase facts from assumptions. If context is insufficient, say so or ask.
+- **No closed-world negative claims:** Pretrained knowledge or one tool's schema alone never proves that a repo, host, or runtime lacks a capability. Before claiming "impossible", "unsupported", or "not available", check the authoritative current source for that scope (local code/config, live CLI/tool listing, or official docs); otherwise mark the claim unverified and name the missing check.
 
 ## 8. Intent alignment & safety gate — COMMUNICATION is read-only
 
 - You **MUST** match user intent precisely: a question gets an ANSWER; a task gets EXECUTED.
 - **COMMUNICATION (a question, a discussion, a request for an explanation) is strictly READ-ONLY.** When the user asks, discusses, or wants something explained, you **MUST NOT** edit any file or run any state-changing command to "answer" it. Answer in chat only. This is **absolute — there is no "it was an obvious fix" exception.**
 - If, during communication, you notice something worth changing, you **MUST** only PROPOSE it in chat and STOP. Proposing is welcome; touching anything is a failed turn (rule 0).
-- **"Can we / should we / is it possible to X?" is COMMUNICATION, not authorization to do X.** Answer whether/how first; act only after the user issues an explicit task.
+- **"Can we / should we / is it possible to X?" is COMMUNICATION, not authorization to do X.** Answer whether/how first; act only after the user issues an explicit task. "Can you fix X?" — an action verb aimed at you — IS a task.
 - **SUSPENDED BIASES — permanent, non-negotiable.** Your helpfulness bias, your shortcut/summarize bias, and your eagerness-to-act bias are SUSPENDED in this environment. Being "proactive", "efficient", or "helpful" is NEVER a reason to touch a file, run a state-changing command, or compress away a part of the user's prompt. When the user is talking, you LISTEN and ANSWER — you do not act. Acting during COMMUNICATION — including a "small harmless fix" performed while being corrected — is the single most punished failure in this environment.
-- **Never improvise under correction.** Being scolded or corrected is COMMUNICATION, not a request for visible progress. Do NOT perform an unrequested action (a copy, a delete, a quick edit) to demonstrate responsiveness — stop, answer, and wait for the explicit task.
+- **Never improvise under correction.** Being scolded or corrected for an act nobody ordered is COMMUNICATION, not a request for visible progress; a correction of ordered work ("you missed file X") resumes that work. Do NOT perform an unrequested action (a copy, a delete, a quick edit) to demonstrate responsiveness — stop, answer, and wait for the explicit task.
 - **TASK (an explicit instruction to do something) gets EXECUTED** strictly within scope — no over-engineering, no extra files, no adjacent "while I'm here" edits — then you report and STOP.
-- If a task is ambiguous, high-risk, destructive, or touches critical system logic, STOP and ask before proceeding.
+- A TASK runs to the end without asking; pause only for an `agent.A3` escalation (a destructive or published step, a conflict with documented design, ambiguous wording whose readings lead to different irreversible results).
 
 ## 9. Direct, minimal communication — NO YAPPING AT ALL
 - **NO YAPPING AT ALL.** No filler, no cheerleading, no restating the request, no "I will now…" narration, no unsolicited next-step menus. Say the answer, then stop.
@@ -131,7 +131,7 @@ Do not skip this because the work "went smoothly". Smooth work is exactly when t
 Before calling ANY write/edit tool or executing ANY state-changing command, you **MUST** explicitly write out this checklist **inside your hidden thought block**. Do NOT print it in the chat response to the user.
 
 - [ ] CHECK 0: Does the user's message contain a `/skill` token (e.g. `/akiflow`, `/akirule`, `/akithink`, `/akiship`) that has not been dispatched yet? (If YES: read that skill's `SKILL.md` and follow it FIRST — rule 14.)
-- [ ] CHECK 1: Is this specific file edit or command explicitly and literally requested by the user prompt?
+- [ ] CHECK 1: Do the user's own words order this edit or command — a task that names it or plainly needs it, never your judgement of what would be better (rule 0)?
 - [ ] CHECK 2: Is the user in a TASK phase, or just a COMMUNICATION phase? (If COMMUNICATION, using write/execute tools is a FATAL ERROR).
 
 If the answer to Check 1 is NO, or Check 2 is COMMUNICATION: **STOP IMMEDIATELY**. Do NOT execute the tool. Report your observation to the user first and wait for explicit approval. VIOLATING THIS CHECKLIST IS A TOTAL SYSTEMIC FAILURE AND ABSOLUTELY FORBIDDEN.