@event4u/agent-config 10.2.0 → 10.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "10.2.0",
+    "version": "10.3.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/config/gate-coverage.yml

@@ -40,16 +40,29 @@
 #                visible, or it repeats the sin it exists to catch.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-10)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-13)
 # ----------------------------------------------------------
-# 251 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 257 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
-# **33 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and all 33 are listed below.** The manifest is therefore
-# complete with respect to its own contract, and covers ~13 % of the population.
-# (The 2026-08-05 reading said "32 … and all 31 are listed": the two halves of
-# one sentence disagreed by one, which is the drift this paragraph exists to
-# make visible. Both are recounted above, not adjusted toward each other.)
+# **35 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 35 are listed below.** The manifest is therefore
+# complete with respect to its own contract, and covers ~14 % of the population.
+# (The 2026-08-05 reading said "32 … and all 31 are listed"; the 2026-08-10
+# reading said "33 … and all 33" while 34 entries were listed. Both halves are
+# RECOUNTED here: 257 is what `count_gate_scripts()` returns on the tree that
+# carries this change, and 35 is the entries counted directly. It read 255 while
+# this change was being written and 257 after `main` merged in two further gate
+# scripts — re-measured at the merge rather than left at the earlier reading,
+# which is the same discipline the note below records failing.)
+#
+# A 2026-08-13 revision of this paragraph first wrote 256, derived as "255 before
+# this change plus the one it adds" — inside the sentence claiming to have
+# recounted. It was wrong twice over: 255 was already the reading WITH the new
+# script present, and arithmetic on the previous prose is the exact move this
+# paragraph forbids. Recorded rather than quietly corrected, because a
+# denominator that goes stale by being adjusted is the failure documented here
+# twice before, and the third instance is the one that shows the note is not
+# enough on its own.
 #
 # Two revisions of this header have now gone stale the same way. It claimed
 # "8 of 211", then "22 of 223" while 26 entries were listed. Both halves drift
@@ -677,6 +690,27 @@ gates:
       a gate scanning nothing — it plants the removal-permitting class with no
       evidence and the gate reds.
 
+  - id: check_review_prompt_binding
+    argv: []
+    min_scanned: 15
+    corpus: "agents/evidence/reviews/<slug>.review-input/prompt.md paired with a prompt_hash in <slug>.findings.md (19 at baseline)"
+    status: enforced
+    canary:
+      class: unbound-review-prompt
+      path: agents/evidence/reviews/zcs-closure.review-input/prompt.md
+      content: |
+        Planted canary: a reviewer prompt whose sha256 cannot equal the
+        prompt_hash recorded in zcs-closure.findings.md.
+    note: >
+      The plant needs a slug that already carries a `prompt_hash` but no committed
+      package — a brand-new `zz-canary` slug is skipped, not caught, because an
+      artefact without a package is deliberately out of scope. `zcs-closure` is a
+      closed round, so it will not gain a real package and the plant cannot
+      collide with one. The two planted failures the roadmap asked for (a one-byte
+      prompt edit, a pre-loaded verdict) are pinned in
+      tests/scripts/check_review_prompt_binding.test.ts, which is where the
+      two-file plants this single-file recipe cannot express are exercised.
+
   - id: check_corpus_staleness
     argv: ["--quiet", "--today", "2026-08-06"]
     min_scanned: 5

package/src/config/gate-violation-baselines.json

@@ -1,6 +1,12 @@
 {
   "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
   "gates": {
+    "ci-parity:local-only": {
+      "count": 167,
+      "landed": "2026-08-13",
+      "note": "Gates that `task ci` runs and no workflow does — the direction this manifest's own header calls the one that let real defects merge (16 stale index rows reached the trunk behind a local-only check-index). Revealed, not created, by repairing the checker's extraction: check_ci_local_parity built its CI-side set by regexing RAW workflow text for `task <name>` and expanding each closure, comments included. Several workflow comments contain the literal string `task ci` while stating that no workflow invokes it, so `ci` was read as an invocation and its full 247-gate closure entered the 'runs in CI' set. The count was therefore 0 BY CONSTRUCTION, and the prose documenting the gap was what suppressed it. Measured at the repair: CI-side 273 → 106, undeclared_local_only 0 → 167 of 247 local gates (68%). Baselined rather than hard-failed because 167 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before; shrink-only keeps the property that matters, namely that a NEW gate registered in `task ci` with no workflow reds immediately. Lowering happens by wiring gates into workflows or declaring them under `local_only:` with a reason. Note the punchline, because it bounds the risk of this entry: check_ci_local_parity ITSELF runs in no workflow, so it is its own finding and this ratchet has no remote reach either — clearing the backlog is what gives it teeth.",
+      "falsifier": "./scripts-run src/scripts/check_ci_local_parity"
+    },
     "check_no_new_legacy_path:hardcoded-scan-roots": {
       "count": 48,
       "landed": "2026-08-09",

package/src/config/review-prompt-binding-baseline.json

@@ -0,0 +1,19 @@
+{
+  "$schema_note": "Consumed by src/scripts/check_review_prompt_binding.ts. An entry EXEMPTS one committed review prompt from the sha256(prompt.md) == prompt_hash check. Both hashes are pinned on purpose: if either moves, the entry stops matching and the gate reds, so a later repair and a further corruption are equally visible. A pre-loaded verdict is NEVER suppressed by the hash exemption alone — it needs its own `steered_ack` block on the entry, which pins the exact matched phrase, so growth of the shared steering predicate cannot turn committed prompts into permanent unfixable blocks and cannot be waved through silently either.",
+  "entries": [
+    {
+      "slug": "zcs-close-2026-08-09",
+      "declared": "48eae5ad829b375c4667fcd72ecc482cbd62ae90788134ca46a81eacce267d49",
+      "actual": "f83ee959abb7f8c333bc89f117d3dee93f0e7b2a816c4593471aeda9b18c302d",
+      "reason": "Explained and closed at the cause: the archival sweep rewrote a roadmap path INSIDE this committed reviewer prompt while migrating inbound references. The cause was fixed on 2026-08-11 by _FROZEN_RECORD_PREFIXES in the sweep. Not repaired because repair is not available here: the recorded hash was produced by the ORIGINAL prompt text, so rewriting the hash to match the corrupted text would fabricate a binding that never existed, and restoring the text from history would erase the only evidence that the sweep reached inside a committed round at all. An earlier revision of this entry cited section 2.7 as forbidding the edit; that citation was wrong and is corrected here, because section 2.7 says the rename is an archival step and never an edit ban on a live artefact.",
+      "falsifier": "npx tsx src/scripts/check_review_prompt_binding.ts --json  # the recorded actual hash stops matching the committed prompt.md, i.e. the record moved after all"
+    },
+    {
+      "slug": "feat-parallel-session-collision-hardening",
+      "declared": "d996e8e86a6e21a7cad66963f70219e59fe8cb96bca0bd1adceeea7ad2565c4b",
+      "actual": "dae1f14e90be94e71415e520b08222ea819488188d670de280d874803de1035c",
+      "reason": "Current and UNEXPLAINED, and it is the empirical justification for this gate. The prompt.md has a single commit dated 2026-08-12, after the sweep fix, so the sweep did not cause it; the declared hash never matched the committed text. CRLF/LF and trailing-newline variants were all tried and none reproduces the declared hash. Not repaired because no repair is knowable: with the cause unidentified, neither side can be established as the correct one, and editing either to make them agree would assert a binding nobody has evidence for. Recording it keeps the discrepancy visible until someone can explain it.",
+      "falsifier": "npx tsx src/scripts/check_review_prompt_binding.ts --json  # a cause is found and the entry is replaced by the repair, or the recorded actual hash stops matching"
+    }
+  ]
+}

package/src/config/rule-enforcement-baseline.json

@@ -1,5 +1,4 @@
 [
-  "active-remediation.md",
   "agent-authority.md",
   "analysis-skill-routing.md",
   "architecture.md",

package/src/scripts/_dispatch.bash

@@ -80,6 +80,7 @@ TS-shell native (run via the installed `agent-config` binary):
                              Names the degraded case (settings file without a
                              profile.id → zero packs) that nothing else reports.
   commands [ls|explain]      List/explain the command surface from the discovery manifest
+                             (ls --candidates: surface-reduction report, report-only)
   mcp-server                 Turnkey read-only stdio MCP server (no repo clone; ADR-085)
   doctor-shell               Probe the TS-shell environment
   rtk:detect                 rtk (Rust Token Killer) presence + identity readout (--json)

package/src/scripts/ai_council/clients.ts

@@ -949,7 +949,21 @@ export const CLI_CALLS_FILENAME = 'cli-calls.json';
 // Default subprocess timeout (seconds) for a single CLI call. Long enough for
 // the largest frontier models to think; short enough to surface a hung
 // subprocess without freezing the council run.
-export const DEFAULT_CLI_TIMEOUT_SECONDS = 120.0;
+//
+// Raised 120 → 300 (2026-08-13) to match the API transport, which has carried
+// `--max-time 290` / `timeout: 300_000` since the 2026-06-24 repair of the same
+// symptom. That repair landed in `_curlJsonPost` only, so when a member resolves
+// to `cli · subscription` the old cap was still live — and a deep design run
+// reproduced it exactly: both members returned `error: timeout` at
+// `latency_ms: 122921` with `timeout_seconds: 120`, and the run reported
+// `0/2 present — INCONCLUSIVE`.
+//
+// This is not a comfort setting. A council that cannot finish a deep prompt is
+// a council the agent cannot use, and every question it would have answered
+// falls back to interrupting the user — the routing that
+// `decision_resolution` classes `medium_impact → council` depends on this
+// call completing.
+export const DEFAULT_CLI_TIMEOUT_SECONDS = 300.0;
 
 /** Return the canonical write target for the daily-quota counter. */
 function _cliCallsStatePath(): string {

package/src/scripts/check_ci_local_parity.ts

@@ -30,6 +30,8 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { parse as parseYaml } from 'yaml';
 
+import { checkRatchet } from './_lib/gate_baseline.js';
+
 const _FILE = fileURLToPath(import.meta.url);
 export const REPO = path.resolve(path.dirname(_FILE), '..', '..');
 const MANIFEST = path.join(REPO, 'src', 'config', 'ci-local-parity.yml');
@@ -202,13 +204,49 @@ export function local_closure(roots: readonly string[], tasks: Map<string, TaskD
     return gates;
 }
 
+/**
+ * Drop YAML comments before anything is extracted from a workflow.
+ *
+ * WHY, and it is the defect this checker was blind to for its whole life. The CI
+ * side is built by regexing workflow TEXT for `task <name>` and expanding each
+ * name's closure. Several workflow comments contain the literal string
+ * `task ci` — while stating that **no workflow invokes it**:
+ *
+ *     # invokes `task ci`, so a gate registered only there never runs remotely.
+ *     # …NO workflow invokes `task ci`, `ci-strict`, or …
+ *
+ * Read as an invocation, `ci` expanded to its full closure and put all 247
+ * `task ci` gates into the "runs in CI" set. `undeclared_local_only` was
+ * therefore **0 by construction** — the one direction this manifest's own header
+ * calls the one that let real defects merge could not be reported at all, and the
+ * prose documenting the gap was what suppressed it.
+ *
+ * Measured at the repair: CI-side 273 → 106, `undeclared_local_only` 0 → 167 of
+ * 247 local gates. A checker whose extraction invents coverage is worse than
+ * none, which this file already says about a different extraction bug ten lines
+ * up — the same lesson, learned twice.
+ *
+ * Deliberately crude: a `#` inside a quoted YAML scalar is treated as a comment
+ * start. That direction is safe here — it can only make the checker see LESS
+ * wiring, i.e. over-report drift, never invent coverage. A YAML parse would be
+ * exact, but every workflow would have to be structurally valid for the checker
+ * to run at all, and a parity checker that cannot run on a malformed workflow is
+ * a parity checker that goes quiet exactly when someone is editing CI.
+ */
+export function strip_yaml_comments(text: string): string {
+    return text
+        .split('\n')
+        .map((l) => l.replace(/(^|\s)#.*$/, '$1'))
+        .join('\n');
+}
+
 function _read_all(dir: string): string {
     if (!fs.existsSync(dir)) return '';
     return fs
         .readdirSync(dir)
         .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))
         .sort()
-        .map((f) => fs.readFileSync(path.join(dir, f), 'utf-8'))
+        .map((f) => strip_yaml_comments(fs.readFileSync(path.join(dir, f), 'utf-8')))
         .join('\n');
 }
 
@@ -332,17 +370,33 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
                 '    Undeclared, it means a contributor discovers this failure only after pushing.\n',
         );
     }
-    if (r.undeclared_local_only.length > 0) {
+    // Ratcheted, not listed one by one.
+    //
+    // Repairing the comment-blindness above took this count from 0 to 167 in one
+    // step — pre-existing debt the checker could not see, not new breakage. A hard
+    // fail on 167 findings nobody can clear in the change that reveals them is the
+    // gate that lands as N instant blockers, which this repository has recorded as
+    // a failure mode and refused before. A shrink-only count keeps the property
+    // that matters: the number may not RISE, so a gate added to `task ci` with no
+    // workflow reds immediately, which is the regression this direction exists to
+    // catch. Listing all 167 every run would bury that signal in its own noise.
+    const parity = checkRatchet({
+        gate: 'ci-parity:local-only',
+        actual: r.undeclared_local_only.length,
+        repoRoot: REPO,
+    });
+    if (!parity.ok) {
         failed = true;
-        process.stdout.write(
-            `❌  ${String(r.undeclared_local_only.length)} gate(s) run locally but in no workflow:\n`,
-        );
+        process.stdout.write(`❌  ${parity.message}\n`);
         for (const g of r.undeclared_local_only) process.stdout.write(`  - ${g}\n`);
         process.stdout.write(
             '\n    Prefer adding it to a workflow — this is the direction that let real defects\n' +
                 '    merge (16 stale index rows reached main behind a local-only check-index).\n' +
-                '    If remote enforcement is genuinely not wanted, declare it under `local_only:`.\n',
+                '    If remote enforcement is genuinely not wanted, declare it under `local_only:`.\n' +
+                '    Raising the baseline is a defect, not a fix.\n',
         );
+    } else {
+        process.stdout.write(`ℹ️   ${parity.message}\n`);
     }
     if (r.stale_declarations.length > 0) {
         failed = true;