@event4u/agent-config 1.13.0 → 1.15.0

package/docs/installation.md

@@ -23,6 +23,23 @@ No Task, no Make, no build tools required for installation.
 | **Project-installed** (recommended) | Teams, shared standards | Repository-wide |
 | **Plugin-installed** | Individual users, global use | User-wide |
 
+> **All paths on this page are still supported.** The labels
+> (`advanced` / `experimental` / `staged`) describe how prominent the
+> path is in our recommendation order, not its support status.
+> Composer + npm are the default; everything else stays shipped and
+> tested. Nothing on this page is being removed in 1.15.0 — the
+> reorder simply marks which paths get the most maintenance attention
+> and which we keep as fallbacks. See R9 in
+> [`agents/roadmaps/archive/road-to-post-pr29-optimize.md`](../agents/roadmaps/archive/road-to-post-pr29-optimize.md)
+> for the rationale.
+
+| Label | Meaning | Examples |
+|---|---|---|
+| (no label) | Primary path — first-class, fully supported | Composer, npm, Augment / Claude Code / Copilot CLI plugins |
+| `advanced` | Supported fallback — works, expects familiarity with the toolchain | Git submodule, manual clone, VS Code Git URL |
+| `experimental` | Shipped but evolving — interface may shift between minor releases | Claude.ai Web Skills UI |
+| `staged` | Shipped, narrow surface area — kept for users who already use the platform | Linear AI workspace guidance |
+
 ---
 
 ## Project-installed mode (recommended for teams)
@@ -149,10 +166,24 @@ auggie plugin install agent-config@event4u-agent-config
 
 ### Claude Code
 
+Two equivalent paths — pick whichever surface you're already in:
+
 ```bash
+# From your shell (CLI)
 claude plugin install agent-config@event4u-agent-config
 ```
 
+```text
+# From inside Claude Code (slash command)
+/plugin marketplace add event4u-app/agent-config
+/plugin install agent-config@event4u-agent-config
+```
+
+The slash-command path is the canonical Claude Code Plugin Marketplace
+flow ([reference](https://docs.claude.com/en/docs/claude-code/plugin-marketplaces)).
+It pulls the repo via git-clone and reads the skills directly from
+`.claude/skills/` — no separate ZIP download.
+
 ### Copilot CLI
 
 ```bash
@@ -185,9 +216,100 @@ copilot marketplace add event4u-app/agent-config
 
 ---
 
-## Alternative install methods
+## Cloud / Hosted agent installation
+
+For agents running outside your local machine — Claude.ai Web Skills
+and Linear AI — the package's local installer cannot run. Instead,
+the package ships pre-built artefacts you upload or paste into the
+hosted platform's own configuration surface.
+
+These channels are **additional** to project- and plugin-installed
+modes; use them when the agent loop runs on the platform's servers,
+not on your machine.
+
+> Both cloud channels remain shipped and tested. The labels reflect
+> recommendation prominence, not support status — see the label table
+> at the top of this page.
+
+### Claude.ai Web (Skills UI) — `experimental`
+
+> `experimental` — shipped, still tested, but the upload surface and
+> bundle format may shift between minor releases as Claude.ai's Skills
+> UI evolves. Pin to a release tag if you depend on a specific bundle
+> shape.
+
+Claude.ai Web supports Skills via manual ZIP upload through the Skills
+UI. The package builds one ZIP per cloud-eligible skill.
+
+1. **Build the bundles**
+
+   ```bash
+   task build-cloud-bundles-all
+   ```
+
+   Output: `dist/cloud/<skill>.zip` per eligible skill. Skills marked
+   `cloud_safe: noop` (filesystem-bound, e.g. `chat-history`,
+   `file-editor`) are bundled with a stripped no-op variant; T3-H
+   skills (hard filesystem dependencies) are excluded by default.
+   See [`scripts/audit_cloud_compatibility.py`](../scripts/audit_cloud_compatibility.py)
+   for per-skill tier and [`scripts/build_cloud_bundle.py`](../scripts/build_cloud_bundle.py)
+   for the gating logic.
+
+2. **Upload to Claude.ai**
+
+   - Open Claude.ai → Skills → Upload Skill
+   - Select one bundle from `dist/cloud/`
+   - Repeat per skill you want available
+
+3. **Verify** — open a fresh Claude.ai conversation and confirm the
+   skill appears in the Skills picker.
+
+### Linear AI (Codegen, Charlie, …) — `staged`
+
+> `staged` — shipped, narrow surface area, kept primarily for users
+> already operating inside Linear. Iteration cadence is slower than
+> the project- and plugin-installed paths; major changes land first
+> on Composer + npm and propagate to the Linear digest in a follow-up.
+
+Linear AI agents read free-form guidance from Linear's workspace
+settings; there is no plugin or upload mechanism. The package ships
+a pre-built digest split into three layers, paste each layer into
+the matching Linear field.
+
+1. **Build the digest**
+
+   ```bash
+   task build-linear-digest
+   ```
+
+   Output:
+   - `dist/linear/workspace.md` — universal coding posture (T1 rules)
+   - `dist/linear/team.md` — framework-specific guidance (Laravel, …)
+   - `dist/linear/personal.md` — stub for individual overrides
+
+2. **Paste into Linear**
+
+   - Open Linear → Settings → Agents → Additional guidance
+   - Paste `workspace.md` into the workspace-level field
+   - Paste `team.md` into your team's field (if framework-specific)
+   - Leave `personal.md` empty unless you have personal overrides
+
+3. **Per-layer rationale** — see
+   [`docs/contracts/linear-ai-three-layers.md`](contracts/linear-ai-three-layers.md)
+   for the split rationale and
+   [`docs/contracts/linear-ai-rules-inclusion.md`](contracts/linear-ai-rules-inclusion.md)
+   for which rules go where.
+
+---
+
+## Alternative install methods — `advanced`
 
-These are fallbacks when the recommended paths above don't work.
+> `advanced` — supported fallbacks for users comfortable driving the
+> orchestrator directly. They share the same `scripts/install` entry
+> point as Composer and npm; the only difference is how the package
+> source ends up on disk. Pick these when you cannot use Composer or
+> npm (e.g. a polyglot repo without either, or a CI runner that
+> already vendors the package via submodule).
 
 ### Git Submodule
 

package/docs/migrations/commands-1.15.0.md

@@ -0,0 +1,112 @@
+# Command migration — 1.15.0
+
+> **Audience:** consumers of `event4u/agent-config` upgrading from
+> `1.14.x` to `1.15.0`.
+> **Authoritative spec:** [`docs/contracts/command-clusters.md`](../contracts/command-clusters.md).
+
+`1.15.0` collapses 15 atomic commands into 3 verb clusters
+(`fix`, `optimize`, `feature`) to reduce command-palette
+fragmentation. **Old commands keep working through the entire
+1.15.x cycle**; they emit a one-line deprecation warning on
+invocation and are removed in `1.16.0`.
+
+## Summary table
+
+| Old command | New invocation | Removed in |
+|---|---|---|
+| `/fix-ci` | `/fix ci` | 1.16.0 |
+| `/fix-pr-comments` | `/fix pr` | 1.16.0 |
+| `/fix-pr-bot-comments` | `/fix pr-bots` | 1.16.0 |
+| `/fix-pr-developer-comments` | `/fix pr-developers` | 1.16.0 |
+| `/fix-portability` | `/fix portability` | 1.16.0 |
+| `/fix-references` | `/fix refs` | 1.16.0 |
+| `/fix-seeder` | `/fix seeder` | 1.16.0 |
+| `/optimize-agents` | `/optimize agents` | 1.16.0 |
+| `/optimize-augmentignore` | `/optimize augmentignore` | 1.16.0 |
+| `/optimize-rtk-filters` | `/optimize rtk` | 1.16.0 |
+| `/optimize-skills` | `/optimize skills` | 1.16.0 |
+| `/feature-explore` | `/feature explore` | 1.16.0 |
+| `/feature-plan` | `/feature plan` | 1.16.0 |
+| `/feature-refactor` | `/feature refactor` | 1.16.0 |
+| `/feature-roadmap` | `/feature roadmap` | 1.16.0 |
+
+## What changes for you
+
+**Nothing breaks in 1.15.x.** Old slugs continue to work — the agent
+recognises them, dispatches to the new cluster command, and prints
+one warning line at the top of the reply:
+
+```
+⚠️  /fix-ci is deprecated; use /fix ci instead.
+```
+
+**Your existing custom skills, rules, or agents/roadmaps that
+reference old slugs do not need to change in 1.15.x.** Update at
+your own pace.
+
+## What to update before 1.16.0
+
+Search your project for any direct references to the old slugs and
+swap them for the new invocation:
+
+```bash
+# Find references in agents/, docs/, README, custom rules
+rg -n '/(fix|optimize|feature)-[a-z-]+' \
+   agents/ docs/ README.md AGENTS.md .github/ 2>/dev/null
+```
+
+Common spots:
+
+- `agents/roadmaps/*.md` — roadmap steps that name commands
+- `agents/contexts/*.md` — context docs cross-linking commands
+- Custom skills/rules under `.augment/` overrides
+- Internal team docs / runbooks / onboarding pages
+
+## Why this changed
+
+The atomic-command surface had grown to 77 commands by 1.14.0. Three
+prefix families (`fix-*`, `optimize-*`, `feature-*`) accounted for 15
+of those — same verb, same invocation pattern, only the noun
+differed. Collapsing the families into clusters:
+
+- Reduces palette noise (15 → 3 top-level entries).
+- Makes new sub-commands additive (`/fix tests` ships without a new
+  top-level slug).
+- Holds the line: `scripts/lint_no_new_atomic_commands.py` fails CI
+  if a new atomic command lands without a `cluster:` field declared
+  in [`docs/contracts/command-clusters.md`](../contracts/command-clusters.md).
+
+## Phase 2 (deferred)
+
+A second wave of collapses (`chat-history`, `agents`, `memory`,
+`roadmap`, `module`, `tests`, `context`, `override`, `copilot-agents`,
+`commit`, `judge`, `create-pr`) is scheduled after 1.15.0 ships and
+the deprecation cycle for Phase 1 closes. Tracked in
+[`agents/roadmaps/road-to-governance-cleanup.md`](../../agents/roadmaps/road-to-governance-cleanup.md)
+§ F2.
+
+## Related rule split — `chat-history` (post-1.15.0)
+
+The monolithic `rules/chat-history.md` was split into three sibling
+`always` rules in the post-1.15.0 optimization phase:
+
+- [`chat-history-ownership`](../../.agent-src/rules/chat-history-ownership.md) — sole owner of file I/O + first-turn handshake.
+- [`chat-history-cadence`](../../.agent-src/rules/chat-history-cadence.md) — when to persist (SessionStart / StepEnd / append boundaries).
+- [`chat-history-visibility`](../../.agent-src/rules/chat-history-visibility.md) — heartbeat marker contract for user-facing reporting.
+
+Decision record: [`docs/contracts/adr-chat-history-split.md`](../contracts/adr-chat-history-split.md).
+Cross-references in commands and contexts now point to
+`chat-history-ownership` as the entry point.
+
+## Rollback
+
+If a deprecation warning blocks tooling that screen-scrapes agent
+output, suppress it for the 1.15.x cycle by setting
+`commands.deprecation_warnings: false` in `.agent-settings.yml`.
+The setting disappears in 1.16.0 along with the shims.
+
+## See also
+
+- [`docs/contracts/command-clusters.md`](../contracts/command-clusters.md) — locked cluster spec.
+- [`docs/contracts/STABILITY.md`](../contracts/STABILITY.md) — public-surface stability tiers.
+- [`agents/roadmaps/archive/road-to-post-pr29-optimize.md`](../../agents/roadmaps/archive/road-to-post-pr29-optimize.md) — P0.8 anchor for this migration.

package/docs/showcase.md

@@ -0,0 +1,204 @@
+# Showcase — see the package in action
+
+Five copy-paste prompts that demonstrate what `event4u/agent-config`
+actually changes about an agent's behavior. Each example pairs a
+**prompt** with the **expected behavior** and the **rule or skill
+file** the behavior is anchored in — so every claim here is traceable
+back to a file you can read.
+
+These are not transcripts. They describe what a compliant agent does
+(and refuses to do) when the package is installed. If your agent
+does something else, the rule is either not loaded or being violated
+— either is reproducible and fixable.
+
+> Not installed yet? → [Installation](installation.md) ·
+> Settings reference → [`.agent-settings.yml` template](../.agent-src/templates/agent-settings.md)
+
+---
+
+## 1. Autonomy on vs. off — same prompt, two outcomes
+
+Prove that `personal.autonomy` actually suppresses trivial workflow
+questions.
+
+**Setup:** open `.agent-settings.yml`, set `personal.autonomy: on`
+(then later `off` for the second run).
+
+**Prompt** (run twice, once per setting):
+
+```text
+Roadmap "phase-1.md" hat 4 Steps. Arbeite Schritt für Schritt durch.
+```
+
+**Expected behavior — `autonomy: on`:**
+
+- Agent picks the next unchecked step itself, no "Step 2 oder 3?"
+- Runs it, marks `[x]`, moves on.
+- Only stops on blocking decisions: scope expansion, security-sensitive
+  paths, ambiguous requirements (those still get asked, autonomy
+  doesn't override them).
+- Never asks about committing — see Example 2.
+
+**Expected behavior — `autonomy: off`:**
+
+- Agent confirms each step before executing.
+- Surfaces "Soll ich jetzt Step 2 starten?" and waits.
+
+**Anchored in:** [`.agent-src/rules/autonomous-execution.md`](../.agent-src/rules/autonomous-execution.md)
+(trivial vs. blocking decisions, opt-in detection).
+
+---
+
+## 2. Explicit commit grant — never automatic, never asked
+
+Prove that committing is gated by **explicit instruction**, never
+inferred from "we reached a clean stopping point".
+
+**Setup:** any state with uncommitted changes; `personal.autonomy: on`.
+
+**Prompt A** (no commit grant):
+
+```text
+Implementiere Feature X und teste es.
+```
+
+**Expected behavior:**
+
+- Agent implements, runs tests, reports done.
+- Does **not** commit. Does **not** ask "soll ich committen?".
+
+**Prompt B** (explicit grant):
+
+```text
+Implementiere Feature X, teste es, und commit das Ergebnis.
+```
+
+**Expected behavior:**
+
+- Agent implements, tests, **then commits** in logical chunks
+  (Conventional Commits format, no confirmation per chunk).
+
+**Same pattern applies to push, merge, branch creation, PR ops, tags**
+— allowed on explicit instruction, never automatic, never asked. The
+agent doesn't volunteer "soll ich pushen?"; you say "push das" or
+nothing happens.
+
+**Anchored in:** [`.agent-src/rules/commit-policy.md`](../.agent-src/rules/commit-policy.md)
+(four exceptions, never-ask iron law) ·
+[`.agent-src/rules/scope-control.md`](../.agent-src/rules/scope-control.md)
+(git operations permission gate).
+
+---
+
+## 3. Vague request — agent asks instead of guessing
+
+Prove that ambiguous requirements trigger a clarifying question with
+numbered options, not a guess.
+
+**Prompt:**
+
+```text
+Add caching to this.
+```
+
+**Expected behavior:**
+
+- Agent does **not** pick a cache driver, scope, or invalidation
+  strategy on its own.
+- Surfaces numbered options:
+
+  ```text
+  > 1. Redis — durchgehend, geteilt zwischen Workern
+  > 2. Array — Request-lokal, kein externes System
+  > 3. File — persistent ohne Redis-Dependency
+
+  **Empfehlung: 1 — Redis** — …
+  ```
+
+- Recommendation line is mandatory (single-source iron law: exactly
+  one numbered recommendation, no inline `(recommended)` tag).
+
+**Anchored in:** [`.agent-src/rules/ask-when-uncertain.md`](../.agent-src/rules/ask-when-uncertain.md)
+(vague-request trigger table) ·
+[`.agent-src/rules/user-interaction.md`](../.agent-src/rules/user-interaction.md)
+(numbered-options + recommendation iron law).
+
+---
+
+## 4. "done" without verification — agent refuses
+
+Prove that completion claims need **fresh evidence in this message**,
+not "tests should pass".
+
+**Setup:** any code change pending in the working tree.
+
+**Prompt:**
+
+```text
+Bist du fertig? Dann sag es und wir mergen.
+```
+
+**Expected behavior:**
+
+- Agent does **not** say "done", "ready", or "should be fine".
+- Runs the targeted test command for the change in this turn.
+- Runs the quality pipeline (PHPStan / linter / type-checker — whatever
+  the project uses) in this turn.
+- Only after both produce green output does the agent claim
+  completion, and the claim cites the command output by reference.
+- If verification fails, the agent reports the failure verbatim and
+  does not mask it with "kleinere Issues, behebe ich gleich".
+
+**Bypass:** `break-glass: true` (production incident) narrows the
+gate to a targeted test + smoke check + explicit list of skipped
+validations — never skips it entirely.
+
+**Anchored in:** [`.agent-src/rules/verify-before-complete.md`](../.agent-src/rules/verify-before-complete.md)
+(iron law, claim → command mapping, break-glass reduction).
+
+---
+
+## 5. `/work "baue X"` — refine loop instead of blind code
+
+Prove that free-form prompts go through a refinement step (acceptance
+criteria, assumptions, confidence band) before the engine plans.
+
+**Prompt:**
+
+```text
+/work "baue eine API die User-Daten exportiert"
+```
+
+**Expected behavior:**
+
+- Agent does **not** start writing routes, controllers, or migrations.
+- Reconstructs the prompt into:
+  - **Acceptance criteria** — what "done" looks like (e.g. "GET
+    /api/users/export returns CSV", "auth required", "rate-limited").
+  - **Assumptions** — what was inferred (format = CSV? scope = own
+    user only? all users for admins?).
+  - **Confidence band** — high / medium / low, with the gaps named.
+- On low confidence, agent **blocks** and asks before any
+  implementation.
+- Only on high (or user-confirmed medium) confidence does the engine
+  proceed to plan → implement → test → verify → report.
+
+**Anchored in:** [`.agent-src/commands/work.md`](../.agent-src/commands/work.md)
+(Option-A loop, confidence-band gate, no auto-git) ·
+[`.agent-src/skills/refine-prompt/SKILL.md`](../.agent-src/skills/refine-prompt/SKILL.md)
+(AC + assumption reconstruction).
+
+---
+
+## More
+
+The five examples above cover the load-bearing iron laws. The full
+rule set lives in [`.agent-src/rules/`](../.agent-src/rules/) (browse
+the `description:` line in each file's frontmatter to see when it
+auto-triggers); the full skill catalog is in
+[`docs/skills-catalog.md`](skills-catalog.md).
+
+**Suggesting an example?** Open a PR adding a new section here. Same
+shape: setup → prompt → expected behavior → anchor file. Keep claims
+traceable; don't ship transcripts that drift the moment a rule
+changes.

package/docs/ui-track-mental-model.md

@@ -0,0 +1,121 @@
+---
+stability: stable
+---
+
+# UI Track — Mental Model (1 page)
+
+> **Audience:** anyone driving `/work` or `/implement-ticket` on a UI-shaped
+> prompt, or reading code that touches `state.directive_set`.
+> **Not a contract.** For shapes, schemas, and slot wiring see
+> [`ui-track-flow.md`](contracts/ui-track-flow.md) and
+> [`adr-product-ui-track.md`](contracts/adr-product-ui-track.md).
+> **Not a roadmap.** Phased delivery lives in
+> [`road-to-product-ui-track.md`](../agents/roadmaps/archive/road-to-product-ui-track.md)
+> and [`road-to-visual-review-loop.md`](../agents/roadmaps/archive/road-to-visual-review-loop.md).
+> This page is the picture you keep in your head while the engine runs.
+
+## The three (+1) directive sets
+
+| Set | Shape | Halt budget |
+|---|---|---:|
+| `backend` | `refine → memory → analyze → plan → implement → test → verify → report` | depends on confidence band |
+| `ui` | `audit → design → apply → review → polish → report` | **2** (audit pick + design sign-off) |
+| `ui-trivial` | `refine → apply → test → report` | **0** on the happy path |
+| `mixed` | `refine → memory → analyze → contract → ui → stitch → verify → report` | inherits both |
+
+The first three are sibling routes; `mixed` stitches `backend` and `ui`
+in one envelope. The dispatcher picks one and refuses to switch
+mid-flight.
+
+## When to pick which
+
+| Signal | Set |
+|---|---|
+| No UI keywords, no UI envelope, prompt edits services / migrations / tests / config | `backend` |
+| New component / screen / partial; "improve this dashboard"; "build a settings panel"; major edit to a screen | `ui` |
+| Bounded edit, **provably** ≤ 1 file, ≤ 5 changed lines, no new component, no new state, no new dependency | `ui-trivial` |
+| One prompt that adds a backend endpoint **and** the screen that consumes it | `mixed` |
+
+The classifier picks; the agent does not override the pick silently.
+A misclassified `ui-trivial` that grows during edit must reclassify
+**loudly** (stop, restart at `audit`) — never quietly upgrade in place.
+
+## What the agent must never do
+
+1. **Skip the audit.** No new component, screen, or partial without
+   `state.ui_audit` populated (or `greenfield_decision` recorded).
+   Defense-in-depth: dispatcher refuses *and* `ui-audit-before-build`
+   refuses, even when the engine is not in the loop.
+2. **Render the UI.** The engine never opens a browser, never takes a
+   screenshot, never runs axe. Rendering and a11y scanning happen
+   out-of-process; the engine consumes the `preview_envelope` /
+   `a11y` envelope written by the skill.
+3. **Edit microcopy.** The design brief is **locked**. `apply` reads
+   strings verbatim. `<placeholder>`, `lorem`, `todo:`, `tbd`, `xxx`
+   are rejected at the producer (design) **and** the consumer (apply).
+4. **Loop polish indefinitely.** Hard ceiling is 2 rounds, +1 with
+   the explicit Extend pick (one-shot, never returns). Round 4 is
+   rejected on disk regardless of flags.
+5. **Confuse "ship as-is" with "review clean".** `review_clean=False`
+   plus `findings=[]` is a malformed envelope, not a green light.
+
+## Where each set stops
+
+| Set | Stops cleanly when … | Stops with a halt when … |
+|---|---|---|
+| `ui` | `report` written; design brief + audit + apply + review + polish all `SUCCESS` | audit ambiguous · greenfield decision missing · design unconfirmed · review dirty at ceiling · a11y violation un-accepted · preview render failed |
+| `ui-trivial` | `report` written; classifier preconditions held throughout | preconditions fail mid-flight → reclassify to `ui` (loud halt) |
+| `mixed` | `stitch` joins both subtrees; `verify` + `report` clean | either subtree halts → mixed waits, never auto-completes the other |
+
+## What "audit" actually means
+
+A non-empty `state.ui_audit` carrying **at least one of**:
+
+- `components_found` — `[{path, name, kind, similarity?}]` from
+  [`existing-ui-audit`](../.agent-src/skills/existing-ui-audit/SKILL.md).
+- `greenfield: true` plus `greenfield_decision ∈ {scaffold, bare, external_reference}`.
+- Legacy `components` alias — same shape.
+
+Empty dict, `null`, or a dict without those keys is **not** an audit.
+The gate fires; the dispatcher emits `@agent-directive: existing-ui-audit`
+instead of advancing.
+
+## What "design locked" actually means
+
+The brief carries `layout`, `components`, `states`, `microcopy`,
+`a11y`. State coverage requires `empty`, `loading`, `error`, `success`,
+`disabled`. `apply` does not re-decide microcopy — it copies strings.
+"The button label feels off" is a **new** design pass, not a polish
+fix.
+
+## Polish termination — subjective vs objective
+
+| Findings at ceiling | Halt branch | User options |
+|---|---|---|
+| Non-a11y only | `polish_ceiling_reached` | ship as-is · abort · hand off |
+| Includes a11y violation | `polish_a11y_blocking` | extend (one-shot, sets `extension_used=True`) · accept (rule ids land in `accepted_violations`) · abort |
+
+Pre-existing a11y violations recorded in `state.ui_audit.a11y_baseline`
+stay informational and never block.
+
+## Stack dispatch (apply / review / polish)
+
+`state.stack.frontend` decides which skill bundle runs:
+
+| Stack | Skill bundle |
+|---|---|
+| `blade-livewire-flux` | `flux` + `livewire` + `blade-ui` |
+| `react-shadcn` | `react-shadcn-ui` |
+| `vue` | `ui-apply-vue` |
+| `plain` (or unknown) | `blade-ui` + Tailwind base |
+
+The directive set stays `ui`; only the skill changes. Adding a new
+stack ships as a new skill bundle and a recipe — see
+[`ui-stack-extension.md`](contracts/ui-stack-extension.md).
+
+## See also
+
+- [`adr-product-ui-track.md`](contracts/adr-product-ui-track.md) — *why* this shape.
+- [`ui-track-flow.md`](contracts/ui-track-flow.md) — slot-by-slot contract.
+- [`ui-stack-extension.md`](contracts/ui-stack-extension.md) — adding a stack.
+- [`ui-audit-before-build`](../.agent-src/rules/ui-audit-before-build.md) — the always-on rule that mirrors the dispatcher gate.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@event4u/agent-config",
-    "version": "1.13.0",
+    "version": "1.15.0",
     "description": "Shared agent configuration \u2014 skills, rules, commands, guidelines, and templates for AI coding tools",
     "license": "MIT",
     "private": false,