@event4u/agent-config 10.3.0 → 10.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "10.3.0",
+    "version": "10.4.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/agent-src/templates/scripts/work_engine/directives/ui/design.ts

@@ -345,7 +345,10 @@ function _halt_provided_without_contract(
         '> 1. Proceed — port it with those five losses on the record; `apply` ' +
             'still has to report what it honoured, translated, and flagged',
         '> 2. Supply a `design-system.json` — its token values are then ' +
-            'honoured verbatim instead of re-derived',
+            'honoured verbatim instead of re-derived. Already have an ' +
+            "extractor's output in another shape? `/design-system:import " +
+            '<file>` maps a DTCG token file or an extraction tool\'s raw JSON ' +
+            'into this contract offline.',
         '> 3. Abort — drop this UI request',
         '',
         '**Recommendation: 2 — Supply the contract** — it is the only option ' +

package/src/config/gate-coverage.yml

@@ -305,8 +305,8 @@ gates:
 
   - id: check_ci_local_parity
     argv: ["--quiet"]
-    min_scanned: 380
-    corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (443 at baseline)"
+    min_scanned: 340
+    corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (360 measured 2026-08-13: 109 CI + 251 local)"
     status: enforced
     note: >
       Registered 2026-08-02. It already emitted the contract line on every path,
@@ -317,6 +317,27 @@ gates:
       taskfile set, so the only plantable violation is a new file under
       .github/workflows — a surface the canary must not write to. Reported
       UNPROVEN by --canary, never green.
+      FLOOR RE-ANCHORED 380 → 340 on 2026-08-13, and the direction deserves an
+      argument rather than a diff.
+      The claim is NOT that 443 minus phantoms equals 360 — that arithmetic does
+      not close, and pretending otherwise would be the false-precision this
+      manifest exists to prevent. 443 was measured on 2026-08-02 against a
+      different tree: both a CI-side set inflated by 167 phantoms AND a smaller
+      local set than today's. The two totals are not comparable term by term.
+      What IS comparable is the repair's own before/after on ONE tree, which is
+      the measurement that matters here: CI-side 273 → 106, because gate names
+      were being read out of workflow COMMENTS by an extraction bug this gate's
+      own repair removed. So the fall is entries that never existed ceasing to be
+      counted, not reach being lost — the discriminator false-green.md § 5 asks
+      for ("a legitimate ratchet lowers severity while keeping reach"). Reach over
+      the real corpus is one unit HIGHER than before this change: the two gates
+      wired into consistency.yml were previously reachable from neither side.
+      Why 340 and not 360, the measured value: gate-authoring.md § registration
+      requires a floor BELOW the live count, because a floor pinned at today's
+      number reds on the very change that legitimately retires one unit. 340
+      leaves ~20 units (~5.5%) of headroom while still catching the collapse this
+      floor exists for — a re-broken extractor would drop the count by 164, not
+      by 20.
 
   - id: check_site_links
     argv: []

package/src/config/gate-violation-baselines.json

@@ -2,9 +2,9 @@
   "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
   "gates": {
     "ci-parity:local-only": {
-      "count": 167,
+      "count": 166,
       "landed": "2026-08-13",
-      "note": "Gates that `task ci` runs and no workflow does — the direction this manifest's own header calls the one that let real defects merge (16 stale index rows reached the trunk behind a local-only check-index). Revealed, not created, by repairing the checker's extraction: check_ci_local_parity built its CI-side set by regexing RAW workflow text for `task <name>` and expanding each closure, comments included. Several workflow comments contain the literal string `task ci` while stating that no workflow invokes it, so `ci` was read as an invocation and its full 247-gate closure entered the 'runs in CI' set. The count was therefore 0 BY CONSTRUCTION, and the prose documenting the gap was what suppressed it. Measured at the repair: CI-side 273 → 106, undeclared_local_only 0 → 167 of 247 local gates (68%). Baselined rather than hard-failed because 167 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before; shrink-only keeps the property that matters, namely that a NEW gate registered in `task ci` with no workflow reds immediately. Lowering happens by wiring gates into workflows or declaring them under `local_only:` with a reason. Note the punchline, because it bounds the risk of this entry: check_ci_local_parity ITSELF runs in no workflow, so it is its own finding and this ratchet has no remote reach either — clearing the backlog is what gives it teeth.",
+      "note": "Gates that `task ci` runs and no workflow does — the direction this manifest's own header calls the one that let real defects merge (16 stale index rows reached the trunk behind a local-only check-index). Revealed, not created, by repairing the checker's extraction: check_ci_local_parity built its CI-side set by regexing RAW workflow text for `task <name>` and expanding each closure, comments included. Several workflow comments contain the literal string `task ci` while stating that no workflow invokes it, so `ci` was read as an invocation and its full 247-gate closure entered the 'runs in CI' set. The count was therefore 0 BY CONSTRUCTION, and the prose documenting the gap was what suppressed it. Measured at the repair: CI-side 273 → 106, undeclared_local_only 0 → 167 of 247 local gates (68%). Baselined rather than hard-failed because 167 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before; shrink-only keeps the property that matters, namely that a NEW gate registered in `task ci` with no workflow reds immediately. Lowering happens by wiring gates into workflows or declaring them under `local_only:` with a reason. Note the punchline, because it bounds the risk of this entry: check_ci_local_parity ITSELF runs in no workflow, so it is its own finding and this ratchet has no remote reach either — clearing the backlog is what gives it teeth. DRAINED BY ONE, 2026-08-13: check_ci_local_parity itself was wired into consistency.yml, so it left the set it exists to report. That is the whole shape of a legitimate drain here — the gate stops being local-only because a workflow now runs it, not because the declaration list grew. The floor in gate-coverage.yml moved in the same change and for the same reason: wiring two gates raised the parsed population 357 -> 359.",
       "falsifier": "./scripts-run src/scripts/check_ci_local_parity"
     },
     "check_no_new_legacy_path:hardcoded-scan-roots": {