@event4u/agent-config 10.2.0 → 10.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "10.2.0",
+    "version": "10.4.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/agent-src/templates/scripts/work_engine/directives/ui/design.ts

@@ -345,7 +345,10 @@ function _halt_provided_without_contract(
         '> 1. Proceed — port it with those five losses on the record; `apply` ' +
             'still has to report what it honoured, translated, and flagged',
         '> 2. Supply a `design-system.json` — its token values are then ' +
-            'honoured verbatim instead of re-derived',
+            'honoured verbatim instead of re-derived. Already have an ' +
+            "extractor's output in another shape? `/design-system:import " +
+            '<file>` maps a DTCG token file or an extraction tool\'s raw JSON ' +
+            'into this contract offline.',
         '> 3. Abort — drop this UI request',
         '',
         '**Recommendation: 2 — Supply the contract** — it is the only option ' +

package/src/config/gate-coverage.yml

@@ -40,16 +40,29 @@
 #                visible, or it repeats the sin it exists to catch.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-10)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-13)
 # ----------------------------------------------------------
-# 251 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 257 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
-# **33 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and all 33 are listed below.** The manifest is therefore
-# complete with respect to its own contract, and covers ~13 % of the population.
-# (The 2026-08-05 reading said "32 … and all 31 are listed": the two halves of
-# one sentence disagreed by one, which is the drift this paragraph exists to
-# make visible. Both are recounted above, not adjusted toward each other.)
+# **35 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 35 are listed below.** The manifest is therefore
+# complete with respect to its own contract, and covers ~14 % of the population.
+# (The 2026-08-05 reading said "32 … and all 31 are listed"; the 2026-08-10
+# reading said "33 … and all 33" while 34 entries were listed. Both halves are
+# RECOUNTED here: 257 is what `count_gate_scripts()` returns on the tree that
+# carries this change, and 35 is the entries counted directly. It read 255 while
+# this change was being written and 257 after `main` merged in two further gate
+# scripts — re-measured at the merge rather than left at the earlier reading,
+# which is the same discipline the note below records failing.)
+#
+# A 2026-08-13 revision of this paragraph first wrote 256, derived as "255 before
+# this change plus the one it adds" — inside the sentence claiming to have
+# recounted. It was wrong twice over: 255 was already the reading WITH the new
+# script present, and arithmetic on the previous prose is the exact move this
+# paragraph forbids. Recorded rather than quietly corrected, because a
+# denominator that goes stale by being adjusted is the failure documented here
+# twice before, and the third instance is the one that shows the note is not
+# enough on its own.
 #
 # Two revisions of this header have now gone stale the same way. It claimed
 # "8 of 211", then "22 of 223" while 26 entries were listed. Both halves drift
@@ -292,8 +305,8 @@ gates:
 
   - id: check_ci_local_parity
     argv: ["--quiet"]
-    min_scanned: 380
-    corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (443 at baseline)"
+    min_scanned: 340
+    corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (360 measured 2026-08-13: 109 CI + 251 local)"
     status: enforced
     note: >
       Registered 2026-08-02. It already emitted the contract line on every path,
@@ -304,6 +317,27 @@ gates:
       taskfile set, so the only plantable violation is a new file under
       .github/workflows — a surface the canary must not write to. Reported
       UNPROVEN by --canary, never green.
+      FLOOR RE-ANCHORED 380 → 340 on 2026-08-13, and the direction deserves an
+      argument rather than a diff.
+      The claim is NOT that 443 minus phantoms equals 360 — that arithmetic does
+      not close, and pretending otherwise would be the false-precision this
+      manifest exists to prevent. 443 was measured on 2026-08-02 against a
+      different tree: both a CI-side set inflated by 167 phantoms AND a smaller
+      local set than today's. The two totals are not comparable term by term.
+      What IS comparable is the repair's own before/after on ONE tree, which is
+      the measurement that matters here: CI-side 273 → 106, because gate names
+      were being read out of workflow COMMENTS by an extraction bug this gate's
+      own repair removed. So the fall is entries that never existed ceasing to be
+      counted, not reach being lost — the discriminator false-green.md § 5 asks
+      for ("a legitimate ratchet lowers severity while keeping reach"). Reach over
+      the real corpus is one unit HIGHER than before this change: the two gates
+      wired into consistency.yml were previously reachable from neither side.
+      Why 340 and not 360, the measured value: gate-authoring.md § registration
+      requires a floor BELOW the live count, because a floor pinned at today's
+      number reds on the very change that legitimately retires one unit. 340
+      leaves ~20 units (~5.5%) of headroom while still catching the collapse this
+      floor exists for — a re-broken extractor would drop the count by 164, not
+      by 20.
 
   - id: check_site_links
     argv: []
@@ -677,6 +711,27 @@ gates:
       a gate scanning nothing — it plants the removal-permitting class with no
       evidence and the gate reds.
 
+  - id: check_review_prompt_binding
+    argv: []
+    min_scanned: 15
+    corpus: "agents/evidence/reviews/<slug>.review-input/prompt.md paired with a prompt_hash in <slug>.findings.md (19 at baseline)"
+    status: enforced
+    canary:
+      class: unbound-review-prompt
+      path: agents/evidence/reviews/zcs-closure.review-input/prompt.md
+      content: |
+        Planted canary: a reviewer prompt whose sha256 cannot equal the
+        prompt_hash recorded in zcs-closure.findings.md.
+    note: >
+      The plant needs a slug that already carries a `prompt_hash` but no committed
+      package — a brand-new `zz-canary` slug is skipped, not caught, because an
+      artefact without a package is deliberately out of scope. `zcs-closure` is a
+      closed round, so it will not gain a real package and the plant cannot
+      collide with one. The two planted failures the roadmap asked for (a one-byte
+      prompt edit, a pre-loaded verdict) are pinned in
+      tests/scripts/check_review_prompt_binding.test.ts, which is where the
+      two-file plants this single-file recipe cannot express are exercised.
+
   - id: check_corpus_staleness
     argv: ["--quiet", "--today", "2026-08-06"]
     min_scanned: 5

package/src/config/gate-violation-baselines.json

@@ -1,6 +1,12 @@
 {
   "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
   "gates": {
+    "ci-parity:local-only": {
+      "count": 166,
+      "landed": "2026-08-13",
+      "note": "Gates that `task ci` runs and no workflow does — the direction this manifest's own header calls the one that let real defects merge (16 stale index rows reached the trunk behind a local-only check-index). Revealed, not created, by repairing the checker's extraction: check_ci_local_parity built its CI-side set by regexing RAW workflow text for `task <name>` and expanding each closure, comments included. Several workflow comments contain the literal string `task ci` while stating that no workflow invokes it, so `ci` was read as an invocation and its full 247-gate closure entered the 'runs in CI' set. The count was therefore 0 BY CONSTRUCTION, and the prose documenting the gap was what suppressed it. Measured at the repair: CI-side 273 → 106, undeclared_local_only 0 → 167 of 247 local gates (68%). Baselined rather than hard-failed because 167 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before; shrink-only keeps the property that matters, namely that a NEW gate registered in `task ci` with no workflow reds immediately. Lowering happens by wiring gates into workflows or declaring them under `local_only:` with a reason. Note the punchline, because it bounds the risk of this entry: check_ci_local_parity ITSELF runs in no workflow, so it is its own finding and this ratchet has no remote reach either — clearing the backlog is what gives it teeth. DRAINED BY ONE, 2026-08-13: check_ci_local_parity itself was wired into consistency.yml, so it left the set it exists to report. That is the whole shape of a legitimate drain here — the gate stops being local-only because a workflow now runs it, not because the declaration list grew. The floor in gate-coverage.yml moved in the same change and for the same reason: wiring two gates raised the parsed population 357 -> 359.",
+      "falsifier": "./scripts-run src/scripts/check_ci_local_parity"
+    },
     "check_no_new_legacy_path:hardcoded-scan-roots": {
       "count": 48,
       "landed": "2026-08-09",

package/src/config/review-prompt-binding-baseline.json

@@ -0,0 +1,19 @@
+{
+  "$schema_note": "Consumed by src/scripts/check_review_prompt_binding.ts. An entry EXEMPTS one committed review prompt from the sha256(prompt.md) == prompt_hash check. Both hashes are pinned on purpose: if either moves, the entry stops matching and the gate reds, so a later repair and a further corruption are equally visible. A pre-loaded verdict is NEVER suppressed by the hash exemption alone — it needs its own `steered_ack` block on the entry, which pins the exact matched phrase, so growth of the shared steering predicate cannot turn committed prompts into permanent unfixable blocks and cannot be waved through silently either.",
+  "entries": [
+    {
+      "slug": "zcs-close-2026-08-09",
+      "declared": "48eae5ad829b375c4667fcd72ecc482cbd62ae90788134ca46a81eacce267d49",
+      "actual": "f83ee959abb7f8c333bc89f117d3dee93f0e7b2a816c4593471aeda9b18c302d",
+      "reason": "Explained and closed at the cause: the archival sweep rewrote a roadmap path INSIDE this committed reviewer prompt while migrating inbound references. The cause was fixed on 2026-08-11 by _FROZEN_RECORD_PREFIXES in the sweep. Not repaired because repair is not available here: the recorded hash was produced by the ORIGINAL prompt text, so rewriting the hash to match the corrupted text would fabricate a binding that never existed, and restoring the text from history would erase the only evidence that the sweep reached inside a committed round at all. An earlier revision of this entry cited section 2.7 as forbidding the edit; that citation was wrong and is corrected here, because section 2.7 says the rename is an archival step and never an edit ban on a live artefact.",
+      "falsifier": "npx tsx src/scripts/check_review_prompt_binding.ts --json  # the recorded actual hash stops matching the committed prompt.md, i.e. the record moved after all"
+    },
+    {
+      "slug": "feat-parallel-session-collision-hardening",
+      "declared": "d996e8e86a6e21a7cad66963f70219e59fe8cb96bca0bd1adceeea7ad2565c4b",
+      "actual": "dae1f14e90be94e71415e520b08222ea819488188d670de280d874803de1035c",
+      "reason": "Current and UNEXPLAINED, and it is the empirical justification for this gate. The prompt.md has a single commit dated 2026-08-12, after the sweep fix, so the sweep did not cause it; the declared hash never matched the committed text. CRLF/LF and trailing-newline variants were all tried and none reproduces the declared hash. Not repaired because no repair is knowable: with the cause unidentified, neither side can be established as the correct one, and editing either to make them agree would assert a binding nobody has evidence for. Recording it keeps the discrepancy visible until someone can explain it.",
+      "falsifier": "npx tsx src/scripts/check_review_prompt_binding.ts --json  # a cause is found and the entry is replaced by the repair, or the recorded actual hash stops matching"
+    }
+  ]
+}

package/src/config/rule-enforcement-baseline.json

@@ -1,5 +1,4 @@
 [
-  "active-remediation.md",
   "agent-authority.md",
   "analysis-skill-routing.md",
   "architecture.md",

package/src/scripts/_dispatch.bash

@@ -80,6 +80,7 @@ TS-shell native (run via the installed `agent-config` binary):
                              Names the degraded case (settings file without a
                              profile.id → zero packs) that nothing else reports.
   commands [ls|explain]      List/explain the command surface from the discovery manifest
+                             (ls --candidates: surface-reduction report, report-only)
   mcp-server                 Turnkey read-only stdio MCP server (no repo clone; ADR-085)
   doctor-shell               Probe the TS-shell environment
   rtk:detect                 rtk (Rust Token Killer) presence + identity readout (--json)