@event4u/agent-config 10.3.0 → 11.0.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "10.3.0",
+    "version": "11.0.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -348,6 +348,153 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 10.4.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [11.0.0](https://github.com/event4u-app/agent-config/compare/10.4.0...11.0.0) (2026-08-13)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _auto-derived, rewrite before merge:_ rule/schema diffs, breaking commits or removed public surface in 7d4af2c, 9e4cc35.
+- **Default changes + migration:** _none_
+- **Security and correctness:** _none_
+- **Honest nulls:** _none_
+- **Known limitations:** _none_
+
+### BREAKING CHANGES
+
+* **settings:** delete worktrees.mode — worktree creation is instruction-only ([9e4cc35](https://github.com/event4u-app/agent-config/commit/9e4cc35513a69b9e107b639ff9dc78622d42b09e))
+
+### Features
+
+* **council:** replace the per-run spend confirmation with a ceiling ([945d6c0](https://github.com/event4u-app/agent-config/commit/945d6c08b6e9a5519858fa6f4bb6ddece461621b))
+* **gates:** resolve the PR base before judging branch freshness ([f77da9a](https://github.com/event4u-app/agent-config/commit/f77da9a6618d0ef982cd4b9bb83201179e26e818))
+* **grounding:** the three 1-10 design dials, re-derived not ported ([1516fa8](https://github.com/event4u-app/agent-config/commit/1516fa8adda1c772a71062fb1950598f336b1c5e))
+* **corpus:** vendor motion.csv and a gsap search domain; decline the rest ([0a82fa2](https://github.com/event4u-app/agent-config/commit/0a82fa2128ffdbc3273b85efd83152ead8e1da28))
+
+### Bug Fixes
+
+* **settings:** correct the class-count summaries after the deletion ([b1cf141](https://github.com/event4u-app/agent-config/commit/b1cf1419366bd1a8bc338ce4a11e310724143627))
+* **session-register:** gate the context block on a real collision ([c1dcf0e](https://github.com/event4u-app/agent-config/commit/c1dcf0e599e709f465903805a3f8147cc079fecd))
+* **council:** align the command surfaces with the ceiling bound ([2e3ad3f](https://github.com/event4u-app/agent-config/commit/2e3ad3f74947fba2ff73c2017515e5954b19cefb))
+* **session-register:** anchor the record on the session checkout, not the chdir target ([7b64d4e](https://github.com/event4u-app/agent-config/commit/7b64d4e3d0db42e6f177692cdf2c47eba3634d72))
+* **review:** put the skip declaration on one line ([d6d3736](https://github.com/event4u-app/agent-config/commit/d6d3736fef1509eda589dbb8f36a3b806f30bcf3))
+* **docs:** drop maintainer-only invocations from the shipped surfaces ([4e89881](https://github.com/event4u-app/agent-config/commit/4e8988172a773be43b8a9b3d93d3676f76fc5adf))
+* **roadmap:** relocate distillation's two maintainer-gated items and archive it ([c19fcf6](https://github.com/event4u-app/agent-config/commit/c19fcf6072f499a5e0b5149985e238ee8eb5511e))
+* **corpus:** advance last_checked in the manifest too, not only in ATTRIBUTION ([ca40b92](https://github.com/event4u-app/agent-config/commit/ca40b92b83db4a1951b4dc1328b21ecfdf7919f4))
+* **provenance:** correct a falsified compliance record, and shrink two diffs ([88e095d](https://github.com/event4u-app/agent-config/commit/88e095d8342106111bd36d69f410f39646deb558))
+* **grounding:** make the dials reach a reader, and make the variance claim true ([af919d3](https://github.com/event4u-app/agent-config/commit/af919d30d91a2c379819135fa7e34446a7da33a3))
+* **gates:** carve out the two license-attribution surfaces for code borrows ([2a969a0](https://github.com/event4u-app/agent-config/commit/2a969a0c4835e9a4db031d01e70ebcb5e0bb051d))
+* **records:** close all seven R2 findings, including a false claim of mine ([5ca4290](https://github.com/event4u-app/agent-config/commit/5ca4290795560d4fca8a054db6439e39e5bb6b42))
+
+### Documentation
+
+* **skills:** hardcode the instruction-only worktree rule across every surface ([7d4af2c](https://github.com/event4u-app/agent-config/commit/7d4af2c9b51714fe3a6ae636b379f835f7dc0cbc))
+* **adr:** record ADR-229 — worktree creation is instruction-only ([b20e3a5](https://github.com/event4u-app/agent-config/commit/b20e3a56a05402d95f88a66ade4075b3d211e53d))
+* **adr:** record ADR-230 — the council spend bound is a ceiling ([1f35330](https://github.com/event4u-app/agent-config/commit/1f35330a6203c336a9ddced6593cf7f8e09fdbdc))
+* **review:** declare the completion-review skip for a docs-only branch ([3ad11bf](https://github.com/event4u-app/agent-config/commit/3ad11bf5109088bca10a80954dffbd280e2586c1))
+* **roadmap:** close Phase 0 Step 3 and re-scope Phases 1 and 2 on the measurement ([d9a888e](https://github.com/event4u-app/agent-config/commit/d9a888e793977be05af7c2c2b345655956e3eb8e))
+* **evidence:** reproduce #58109 and record what the ledger cannot see ([21b8d2d](https://github.com/event4u-app/agent-config/commit/21b8d2dfbcd0dff415bfda7306788a86f3b3809b))
+* **review:** re-bind the skip declaration after merging main ([3e03c75](https://github.com/event4u-app/agent-config/commit/3e03c75c4465ceac9d02bdfb76e8ad0091387965))
+* **git:** route the pre-PR freshness check through the gate ([c0edb1f](https://github.com/event4u-app/agent-config/commit/c0edb1f36c001087d1118ef1fac3e7cb5e10f333))
+* **review:** re-scope the skip declaration after the main merge ([7184ae8](https://github.com/event4u-app/agent-config/commit/7184ae89ec9e9385aca59ecba9bdd2eacc336c08))
+* **review:** re-bind the findings artefact after the corpus-staleness fix ([47131d4](https://github.com/event4u-app/agent-config/commit/47131d403539cdaebf67e7b514267562835ae5c1))
+* **review:** re-bind the findings artefact to the post-fix scope ([6a48f11](https://github.com/event4u-app/agent-config/commit/6a48f11ba78b1086209dfa06928bfe1f7addc743))
+* **roadmap:** correct three overclaims, re-depth the archive links, stale watchlist ([c4e95d3](https://github.com/event4u-app/agent-config/commit/c4e95d36a6efcaf44f1aa693816806111e823165))
+* **review:** bind the R2 findings for feat-design-system-onramp-blockers ([2092734](https://github.com/event4u-app/agent-config/commit/2092734d3438ac2647bdcdde5faf05be49b7b0dc))
+* **review:** re-bind the artefact after the third main merge ([3b4bdb6](https://github.com/event4u-app/agent-config/commit/3b4bdb6a08f46181d869a2d4bd4dfb16af3e4349))
+* **review:** re-bind the R2 artefact after the fix pass ([5bfc84c](https://github.com/event4u-app/agent-config/commit/5bfc84c8bfea61a9522f21f8cbb7f72acdcc7450))
+* **council:** record the two unblocking decisions, and their honest standing ([8cd7182](https://github.com/event4u-app/agent-config/commit/8cd71823c1b1ce3c6002d16cb444d1b96b70f3fa))
+* **review:** the real R2 review, replacing the skip — 7 findings ([834e7f1](https://github.com/event4u-app/agent-config/commit/834e7f10f26e0d93911f0c92d0720f72c8ee0fc2))
+
+### Tests
+
+* **settings:** re-point two vacuous assertions and assert the deletion ([933f320](https://github.com/event4u-app/agent-config/commit/933f3208efd38a22854e147e7d3c7ddee2bacde1))
+
+### Chores
+
+* **roadmap:** regenerate the dashboard after the main merge ([2653222](https://github.com/event4u-app/agent-config/commit/26532222c07d0784f1f608a0fc4185ed9b02274b))
+* **roadmap:** regenerate the dashboard after the third main merge ([b271d07](https://github.com/event4u-app/agent-config/commit/b271d078b70d3c177571fc152cc00315b5780aba))
+* **roadmap:** close design-system-onramp at 12/12 and archive it ([14bce9c](https://github.com/event4u-app/agent-config/commit/14bce9c59b193631737f7b2a19157fd53d4e6de4))
+
+Tests: 13818 (+50 since 10.4.0)
+
+## [10.4.0](https://github.com/event4u-app/agent-config/compare/10.3.0...10.4.0) (2026-08-13)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _none_
+- **Default changes + migration:** _none_
+- **Security and correctness:** _none_
+- **Honest nulls:** _auto-derived, rewrite before merge:_ commits carrying an honest-null marker in 5a9f530.
+- **Known limitations:** _none_
+
+### Features
+
+* **commands:** /design-system cluster — three doors onto machinery that already ships ([e56eaf4](https://github.com/event4u-app/agent-config/commit/e56eaf4a5496bed575e421df997ad60bd2cfac08))
+* **scripts:** three-lane adapter into the design-system.json contract ([d1dd006](https://github.com/event4u-app/agent-config/commit/d1dd00610d4c2c97aa5adf0fa7baa120167b6aa2))
+* **hooks:** an open subagent dispatch is an explicit turn-end allow ([39daf4e](https://github.com/event4u-app/agent-config/commit/39daf4e2c3ba70fa4e43b57fc82bc1bf9eb5b613))
+* **hooks:** ship Phase 3 runaway containment in shadow posture ([b9efa4e](https://github.com/event4u-app/agent-config/commit/b9efa4ec618b3f26c1c07a8eb335866545c4274c))
+* **hooks:** register subagent lifecycle events and bind the ledger ([a6a4023](https://github.com/event4u-app/agent-config/commit/a6a4023529074069f03f8542d0513ee77f3adfde))
+* **hooks:** add the capture-only subagent-ledger concern ([f393ec4](https://github.com/event4u-app/agent-config/commit/f393ec4686422d247bc5862cf13e04459d64ace5))
+* **gates:** adopt the self-test harness in lint_rule_skill_pack_reach ([a758153](https://github.com/event4u-app/agent-config/commit/a7581533b8d5ed8672f985337dc87d21508fa451))
+
+### Bug Fixes
+
+* **design-system:** drop maintainer-only invocations from shipped surfaces ([122760a](https://github.com/event4u-app/agent-config/commit/122760aad5f2a6f4a19c7571da5fcfb732e5e1a8))
+* **scripts:** close nine silent-loss paths in the design-system import adapter ([ed4c7e3](https://github.com/event4u-app/agent-config/commit/ed4c7e39ad3bd732b034c24952460332bb7cb503))
+* **docs:** regenerate proof.md after the command-count change ([c5cb075](https://github.com/event4u-app/agent-config/commit/c5cb07529d8e1903ad15bbf300ce4156fb5a11b2))
+* **ci:** wire check_gate_coverage locally too, and correct three numbers ([a62745c](https://github.com/event4u-app/agent-config/commit/a62745cea249ace8e89a453e9f5950e7179721ce))
+* **ci:** wire the two meta-gates, re-anchor the parity floor ([ea13fc7](https://github.com/event4u-app/agent-config/commit/ea13fc77f2cceecc127933b7f56a5fbcc5a07709))
+* **commands:** register analyze:conformance in the table it already belonged in ([2c307f3](https://github.com/event4u-app/agent-config/commit/2c307f392061eb4ff24a15b1c29b7ddc5c162b71))
+* **hooks:** close the round-2 completion-review findings ([a3de33b](https://github.com/event4u-app/agent-config/commit/a3de33beacff72725b48e4ebdd0bb58b4258bee1))
+* **contracts:** drop the roadmap link from the activation policy ([4d49029](https://github.com/event4u-app/agent-config/commit/4d49029266a04d8d025e110be0a574553634acea))
+* **roadmap:** sync the Phase 2 record with the shipped floors, and own the red ([f98d9d5](https://github.com/event4u-app/agent-config/commit/f98d9d52998c016ad865334ffdf3964b4e01a8e3))
+* **hooks:** close the twelve R2 completion-review findings in the subagent ledger ([4415ff5](https://github.com/event4u-app/agent-config/commit/4415ff54c2e8f47375aeeada5e5d9776eccefa86))
+* **gates:** emit a parseable scan line, and refuse a valueless --root ([8ec2334](https://github.com/event4u-app/agent-config/commit/8ec2334a526572dd549b571f40bf9a24928dbd35))
+* **refs:** re-point the archived roadmap and record a two-gate contradiction ([9671002](https://github.com/event4u-app/agent-config/commit/9671002114d27fcbd112d3f77d79dfaacc94c821))
+* **roadmap:** tag the corpus-scoping roadmap lightweight, not standard ([b6676b0](https://github.com/event4u-app/agent-config/commit/b6676b09f87c48aa083feb98f2ff7343c837bd18))
+
+### Documentation
+
+* **review:** re-bind the findings artefact after the consumer-path fix ([fcb8ab4](https://github.com/event4u-app/agent-config/commit/fcb8ab408c9b2fbfd51d98e261ead5c572e5cf7a))
+* **review:** re-bind the findings artefact after the second main merge ([cfd2695](https://github.com/event4u-app/agent-config/commit/cfd2695162708c3db80b699667dbc7108c9e057c))
+* **review:** re-bind the findings artefact to the post-fix scope ([2674827](https://github.com/event4u-app/agent-config/commit/267482700c5d00db465722005888f823d50acc4c))
+* **review:** re-bind the skip declaration to the merged scope ([6518a6a](https://github.com/event4u-app/agent-config/commit/6518a6a12a69bc640c70febcf36d176ae05b8992))
+* **design-system:** correct two claims the review showed were too broad ([49b6e47](https://github.com/event4u-app/agent-config/commit/49b6e4741aa21a18c72c3f51f9775981f980bb1f))
+* **review:** bind the R2 completion-review findings for feat-design-system-onramp ([3be0b77](https://github.com/event4u-app/agent-config/commit/3be0b771bf99816ab4b0a7d9d69c51ea8e41a848))
+* **roadmap:** close road-to-local-only-gate-reds and archive it ([cfeeacc](https://github.com/event4u-app/agent-config/commit/cfeeacc81c2b09f18d7e5fcfd7a312b05dd0b209))
+* **roadmap:** archive road-to-august-program on its own falsifier ([3fd5a77](https://github.com/event4u-app/agent-config/commit/3fd5a776750447e6967137be31ee76a6e1c7b4b4))
+* **roadmap:** resolve the three release-integrity blockers and archive it ([9d66d73](https://github.com/event4u-app/agent-config/commit/9d66d73f45b28ed8c17b842ca0f730cf11ca614d))
+* **contract:** publish the curated-head recurrence rate, (b) stands ([310b49b](https://github.com/event4u-app/agent-config/commit/310b49b1d4b5f8fe7a12d6199c84429257cc4e0c))
+* **adr:** ADR-228 — the global install does not emit paths: ([d9bcbf5](https://github.com/event4u-app/agent-config/commit/d9bcbf5c46e7d4c100f1bceabe429c0df6b42990))
+* **adr:** accept ADR-221, the host-native-first ladder ([a55a37f](https://github.com/event4u-app/agent-config/commit/a55a37f6f88eb08326d56a0562c22324fa1746dc))
+* **review:** re-bind the round-2 findings after the fix pass ([f1403f1](https://github.com/event4u-app/agent-config/commit/f1403f1896b4570b6eb83c9ac0f1c28b1d504914))
+* **review:** bind round 2 of the completion review, and keep round 1 ([7914694](https://github.com/event4u-app/agent-config/commit/7914694b9055c4b47caf5c01c49699cb1aa77f01))
+* **design-system:** name the supply path where the contract is refused ([0bef92d](https://github.com/event4u-app/agent-config/commit/0bef92d6314c82978bce578effaff7e43e24ea6c))
+* **roadmap:** record the Phase 3 council pass and flip its three steps ([e1c99ad](https://github.com/event4u-app/agent-config/commit/e1c99ad25ece149cd80c0879957b01702148cc00))
+* **contracts:** write the concern activation policy three roadmaps cited and none wrote ([130a9d9](https://github.com/event4u-app/agent-config/commit/130a9d98ad691888a3d41bec71f170e8e6d853c3))
+* **review:** re-bind the round-2 artefact to the fixed scope ([1cba2b1](https://github.com/event4u-app/agent-config/commit/1cba2b111a3759d565ec0071ee1607c7c0d6bbec))
+* **review:** round 2 of the completion review, over the merged scope ([57e4fc5](https://github.com/event4u-app/agent-config/commit/57e4fc58491b80ce70f994963fbcaa6fbe972be4))
+* **review:** re-bind the findings artefact after the fix pass ([b58fcd5](https://github.com/event4u-app/agent-config/commit/b58fcd59ea10b899d6feaa1b7afa632c437f3d77))
+* **review:** bind the R2 completion-review findings for feat-subagent-lifecycle-integrity ([79b7c8e](https://github.com/event4u-app/agent-config/commit/79b7c8eb27f114ae6d40d6c168fa5c992be1b650))
+* **review:** re-bind the completion-review artefact to the fixed scope ([c714668](https://github.com/event4u-app/agent-config/commit/c71466897e1053bc28387d3da1240a3773534a0b))
+* **review:** R2 completion review for feat-local-only-gate-reds ([3c87378](https://github.com/event4u-app/agent-config/commit/3c87378c83b36da10a82af729ffa224d506716a8))
+* **roadmap:** record the Phase 0/1/5 findings and the Phase 3 stop ([3fc4332](https://github.com/event4u-app/agent-config/commit/3fc433269cc36520bb10e5f08f302cdfdffc5d5a))
+* **review:** declare the completion-review skip for a zero-code-path branch ([ac92f16](https://github.com/event4u-app/agent-config/commit/ac92f1686a44ca8d52cf652fb3c35ec71224d800))
+* **adr:** record that paths scoping is saturated, not a corpus lever ([6c062d9](https://github.com/event4u-app/agent-config/commit/6c062d9d57e290a50b0eb544448e83b8ec03c396))
+* **roadmap:** record the four closed steps, and a fifth red the repair left ([637c009](https://github.com/event4u-app/agent-config/commit/637c00913b9936d5ceb8fe5cdffa8eddd610ef47))
+
+### Chores
+
+* **dist:** re-project the design-system doc and halt-text changes ([070f4ce](https://github.com/event4u-app/agent-config/commit/070f4ce7b48ca0f206b6fae413a8f529d3f5bf0b))
+* **roadmap:** regenerate the dashboard after the main merge ([54250e3](https://github.com/event4u-app/agent-config/commit/54250e3f6de110ba8881386e6e8c95be38b9b8d4))
+* **roadmap:** close design-system-onramp Phases 1, 2 and 4; file two blockers ([80573dd](https://github.com/event4u-app/agent-config/commit/80573dd7d75ab27d026138e54ef06119daec59e8))
+* **roadmaps:** regenerate the dashboard after the main merge ([d54aba9](https://github.com/event4u-app/agent-config/commit/d54aba956229302c3bc7323ddf8cafd7bd4ccb3c))
+* **roadmap:** regenerate the dashboard after the second main merge ([b1a283b](https://github.com/event4u-app/agent-config/commit/b1a283bb04d9a881aa13495c28f0779557792670))
+* **roadmap:** close always-loaded-corpus-scoping on its honest null ([5a9f530](https://github.com/event4u-app/agent-config/commit/5a9f53009a920ff16b9cc92e39167497a51d92ab))
+
+Tests: 13768 (+89 since 10.3.0)
+
 ## [10.3.0](https://github.com/event4u-app/agent-config/compare/10.2.0...10.3.0) (2026-08-13)
 
 ### Release highlights

package/README.md

@@ -4,7 +4,7 @@
 
 [![Smoke](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml) [![Public install smoke (3 OS × 2 Node)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml) [![npm](https://img.shields.io/npm/v/@event4u/agent-config?style=flat-square&label=npm&color=orange)](https://www.npmjs.com/package/@event4u/agent-config) [![agent-config MCP server](https://glama.ai/mcp/servers/event4u-app/agent-config/badges/score.svg)](https://glama.ai/mcp/servers/event4u-app/agent-config) [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fevent4u-app%2Fagent-config.svg)](https://mcptoplist.com/server/glama%2Fevent4u-app%2Fagent-config)
 
-[![Skills](https://img.shields.io/badge/Skills-289-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-116-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-196-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-105-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
+[![Skills](https://img.shields.io/badge/Skills-289-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-116-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-200-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-105-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
 
 **Try it in 30 seconds** — drop one read-only subagent into any repo and watch it gate "done": `@production-validator check this branch is actually done`. No wizard, no lock-in, nothing else installed — the [30-second wedge ↓](#quickstart) is the whole first step. Start at the proof, not the catalog: **[event4u-app.github.io/agent-config/proof/](https://event4u-app.github.io/agent-config/proof/)**.
 

package/dist/agent-src/commands/analyze.md

@@ -5,7 +5,7 @@ disable-model-invocation: true
 argument-hint: "[postmortem|premortem|decision|near-miss|incident|reference-repo|inbox] [subject]"
 pack: analysis-workbench
 intent: "Analysis dispatcher — classify input by keywords, propose a weighted framework path, let the user pick"
-routes_to: [analyze-postmortem, analyze-premortem, analyze-decision, analyze-near-miss, analyze-incident, analyze-reference-repo, analyze-inbox]
+routes_to: [analyze-postmortem, analyze-premortem, analyze-decision, analyze-near-miss, analyze-incident, analyze-reference-repo, analyze-inbox, analyze-conformance]
 replaces: []
 tier: 1
 visibility: advanced
@@ -40,6 +40,7 @@ to the chosen sub-command. Never auto-selects silently.
 | `/analyze:incident` | `analyze/incident/command.md` | Full incident flow: commander → RCA → post-mortem → memory candidate |
 | `/analyze:reference-repo` | `analyze/reference-repo/command.md` | Deep-dive an external reference repo (competitor, inspiration, peer) → structured comparison + adoption plan |
 | `/analyze:inbox` | `analyze/inbox/command.md` | Deep-dive a LOCAL artifact dropped in `agents/tmp/` (review, prompt, spec, transcript) → claim verification against the current tree + artefact mapping + roadmap |
+| `/analyze:conformance` | `analyze/conformance/command.md` | Audit recent local sessions for rule violations → deterministic scan + subagent passes, root-caused per class, and a roadmap for what is mechanisable |
 
 ## Dispatch
 

package/dist/agent-src/commands/council/debate.md

@@ -68,11 +68,20 @@ this automatically when invoked via `debate`). The estimate covers
 projection. Surface the projection to the user with a clear note that
 progressive disclosure may stop the debate early.
 
-### 4. Cost confirmation (ALWAYS ASK)
+### 4. Spend bound (ask when a billable member has no ceiling)
 
-Per [`ai-council` skill § cost gate](../../skills/ai-council/SKILL.md),
-always surface the projected total spend and ask for explicit consent
-before invoking. Numbered options:
+Per [`ai-council` skill § Procedure 3](../../skills/ai-council/SKILL.md)
+and ADR-230, surface the projected total spend in every case, and ask
+only when a billable member is in the fan-out AND both
+`cost_budget.max_total_usd` and `daily_limit_usd` are `0`.
+
+A debate multiplies the per-round cost by `N`, so quote the worst case,
+not one round — that is what a ceiling has to cover. The between-rounds
+confirmation gate is unaffected: it is a separate, per-round control and
+it still fires, which is where a debate that turns out expensive gets
+stopped.
+
+Numbered options, when the ask applies:
 
 > The debate is projected to cost **$X.XXXX** ($Y.YYYY × N rounds, worst case).
 >

package/dist/agent-src/commands/council/default.md

@@ -152,11 +152,22 @@ Construct each member from the resolved mode:
 - `manual` → `ManualClient` from `scripts.ai_council.clients`
   (`billable=False`, no API key, no SDK call).
 
-### 3. Cost confirmation — ALWAYS ASK for billable members
+### 3. Spend bound — ASK when a billable member has no ceiling
 
-Council calls to billable members spend money. Even under
-`personal.autonomy: on`, the agent **must** ask before invoking any
-billable member.
+Council calls to billable members spend money, so a bound is mandatory.
+Per ADR-230 the bound is a **ceiling**, not a per-invocation approval —
+the same three cases the `ai-council` skill resolves in its Procedure § 3:
+
+| Situation | Behaviour |
+|---|---|
+| No billable member (all `mode: cli`, subscription auth) | No gate. Estimate is information; go to Step 4. Spend is $0. |
+| Billable member **with** `cost_budget.max_total_usd` or `daily_limit_usd` non-zero | No per-run ask. The ceiling is the authorization the user already gave; `on_overrun` still pauses per member on breach. |
+| Billable member with **both** caps `0` | **Ask.** Nothing bounds the spend, so the user must. |
+
+`personal.autonomy` neither creates nor lifts that bound — autonomy is
+not a ceiling. Consumers who want a per-invocation gate set a small
+`cost_budget.max_total_usd`; every call then breaches and `on_overrun`
+asks per member.
 
 Run the CLI in **estimate** mode first — it bundles the artefact, runs
 redaction, and prints the per-member preview without spending:
@@ -182,17 +193,21 @@ roadmap file with `--input-mode roadmap`. `diff` and `files` modes
 remain Phase 4 — for now ask the user to convert into a `prompt`.
 
 The CLI prints a `council:estimate · members=N (billable=M)` line
-followed by per-member projected USD and a TOTAL. Render that to the
-user inside the cost-confirmation numbered-options block per the
-`ai-council` skill (§ Pre-call estimate format) — then `1. Run /
-2. Cancel`. If the billable count is `0`, skip the gate entirely
-(spend = $0) and proceed directly to Step 4.
+followed by per-member projected USD and a TOTAL. Render that table per
+the `ai-council` skill (§ Pre-call estimate format) in every case — it is
+what makes the spend legible whether or not it is being asked about.
+
+Then read `billable=M` together with the two caps:
 
-Wait for the user's pick. `1` proceeds; anything else aborts.
+- `M == 0` → no gate. Proceed to Step 4.
+- `M > 0` and a cap is set → no gate. Proceed to Step 4; `on_overrun`
+  handles a breach per member.
+- `M > 0` and both caps are `0` → render the table inside a numbered-options
+  block (`1. Run / 2. Cancel`) and wait. `1` proceeds; anything else aborts.
 
 ### 4. Run the CLI
 
-Once the user picks `1`, invoke the same arguments with `run` plus
+Invoke the same arguments with `run` plus
 `--confirm` and an output path under `agents/runtime/council/sessions/`:
 
 ```bash

package/dist/agent-src/commands/council.md

@@ -35,7 +35,7 @@ sub-command swaps the mode-specific addendum.
 
 1. Resolve the target + capture the original ask.
 2. Check the council is configured + price table fresh.
-3. Cost confirmation (ALWAYS ASK for billable members).
+3. Spend bound (ask only when a billable member has no ceiling — ADR-230).
 4. Run the CLI.
 5. Render the report (5 / 5a / 5b — render → critical lens → user options).
 6. Hard floor — text only.

package/dist/agent-src/commands/design-system/capture.md

@@ -0,0 +1,44 @@
+---
+model_tier: medium
+name: design-system-capture
+pack: engineering-base
+tier: 2
+visibility: internal
+cluster: design-system
+sub: capture
+skills: [existing-ui-audit, design-system-capture]
+description: Inventory this repo's own components and tokens and emit them in the design-system.json shape, so the import path is identical to an external extraction.
+argument-hint: "[path]"
+suggestion:
+  eligible: false
+  rationale: "Cluster sub-command — reached via its cluster head's routing or its explicit /cluster:sub name; not independently suggested (surface-consolidation)."
+workspaces:
+  - engineering
+packs:
+  - frontend-design
+---
+
+# /design-system:capture
+
+Run [`existing-ui-audit`](../../skills/existing-ui-audit/SKILL.md) over the
+current repo and emit its inventory as a `design-system.json` artifact — the
+same shape an external extraction tool produces, so the import path is identical
+either way. Args: optional `[path]` to narrow the scan.
+
+Two sources, one shape: use this for **this** repo, and
+[`/design-system:import`](../import/command.md) for a site or repo you do not
+own.
+
+## Then hand it over
+
+Pass the emitted artifact to [`design-system-capture`](../../skills/design-system-capture/SKILL.md)'s
+import step, which confirms it per field into `DESIGN.md`.
+
+## Rules
+
+- **Set `source` honestly** — `kind: dir`, `ref` = the scanned path,
+  `captured_at` = now. An artifact with no provenance is rejected downstream.
+- **Observation is not a token.** Anything the audit *noticed* rather than
+  *decided* belongs under `_meta`, per the contract's field rules.
+- **The audit's own grouping is not the contract's shape.** Map it deliberately;
+  do not rename the audit's output keys and call it done.

package/dist/agent-src/commands/design-system/generate.md

@@ -0,0 +1,75 @@
+---
+model_tier: high
+name: design-system-generate
+pack: engineering-base
+tier: 2
+visibility: internal
+cluster: design-system
+sub: generate
+skills: [corpus-grounding, design-intelligence, design-system-capture]
+description: Ground a design system in the curated design corpus from a product or industry brief, then optionally persist it as MASTER.md or seed DESIGN.md.
+argument-hint: "<product / industry / keywords>"
+suggestion:
+  eligible: false
+  rationale: "Cluster sub-command — reached via its cluster head's routing or its explicit /cluster:sub name; not independently suggested (surface-consolidation)."
+workspaces:
+  - engineering
+packs:
+  - frontend-design
+---
+
+# /design-system:generate
+
+Run the grounded one-shot over the curated corpus and print the full
+recommendation. Args: `"<product / industry / keywords>"`.
+
+```bash
+npx tsx node_modules/@event4u/agent-config/src/skills/corpus-grounding/scripts/ground.ts \
+    ground "<query>" \
+    --manifest node_modules/@event4u/agent-config/src/skills/design-intelligence/data/manifest.json \
+    [--variance 1-10] [--motion 1-10] [--density 1-10]
+```
+
+Add `--persist <dir> --project-name <name>` to write
+`design-system/<slug>/MASTER.md`, and `--page <name>` for a page-override stub
+alongside it. The engine is read-only without `--persist`.
+
+## The three dials — optional, and unset means unset
+
+Each takes an integer 1-10. A dial you do not pass changes nothing at all, so
+the no-flag result is exactly what it was before dials existed.
+
+| Dial | 1-3 | 4-7 | 8-10 | What it touches |
+|---|---|---|---|---|
+| `--variance` | Centered / Minimal | Balanced / Modern | Bold / Asymmetric | Biases which style is **selected** from the rows the corpus returned |
+| `--motion` | Subtle | Standard | Complex | Pulls a motion recipe at that intensity tier |
+| `--density` | Spacious | Standard | Dense / Dashboard | Overrides the spacing scale |
+
+**`--variance` biases selection, never retrieval.** The rows that come back from
+the corpus are the same with or without it; the dial only changes which of those
+rows is picked. And when it changes the pick away from what the grounding rule's
+own keywords would have chosen, the run **says so in its evidence gaps** — a
+preference is allowed to win, but never quietly.
+
+`--motion` needs the `gsap` domain (`motion.csv`) in the manifest. Without it,
+or when no row matches the requested tier, the run reports that rather than
+returning an empty block.
+
+## After the recommendation
+
+Offer both destinations, and let the human pick — they are different artifacts,
+not two spellings of one:
+
+- **`MASTER.md` + page overrides** (`--persist`) — the interchange format, good
+  for handing a system to another tool or to a designer.
+- **`DESIGN.md`** via [`design-system-capture`](../../skills/design-system-capture/SKILL.md)
+  — this package's canonical design memory, the file every later design task
+  reads. Seed it when the system is for *this* repo's own work.
+
+## Rules
+
+- **Generated output is a proposal.** A provided artifact, registered brand
+  tokens, and a confirmed `DESIGN.md` outrank it — never overwrite a confirmed
+  decision with a generated default.
+- **Never persist silently.** `--persist` is the human's choice, and `DESIGN.md`
+  is seeded per field, not written wholesale.

package/dist/agent-src/commands/design-system/import.md

@@ -0,0 +1,63 @@
+---
+model_tier: medium
+name: design-system-import
+pack: engineering-base
+tier: 2
+visibility: internal
+cluster: design-system
+sub: import
+skills: [design-system-capture]
+description: Run an extraction tool's output through the three-lane adapter into the design-system.json contract, then hand it to the per-field confirmation import.
+argument-hint: "<file>"
+suggestion:
+  eligible: false
+  rationale: "Cluster sub-command — reached via its cluster head's routing or its explicit /cluster:sub name; not independently suggested (surface-consolidation)."
+workspaces:
+  - engineering
+packs:
+  - frontend-design
+---
+
+# /design-system:import
+
+Transform an extracted design system into the `design-system.json` contract,
+then import it per field. Args: `<file>`.
+
+```bash
+npx tsx node_modules/@event4u/agent-config/src/scripts/design_system_import.ts <file> \
+    [--lane native|dtcg|dembrandt] \
+    [--source-kind url|repo|dir --source-ref <ref>] [--captured-at <ISO>] \
+    [--format json|summary]
+```
+
+The lane is detected from the file's own shape; `--lane` only forces which
+mapper runs and never reshapes the input. Lane behaviour, the documented
+producers, and the never-force-a-lane degradation are specified in
+[`design-system-json.md`](../../skills/design-system-capture/references/design-system-json.md)
+§ Extractor compatibility.
+
+## The easy path, in two lines
+
+1. Connect an extractor once — e.g.
+   `claude mcp add --transport stdio dembrandt -- npx -y --package dembrandt dembrandt-mcp`.
+2. Run `/design-system:import` over its output.
+
+No extractor available? Skip step 1 and use
+[`/design-system:generate`](../generate/command.md) from the corpus instead, or
+[`/design-system:capture`](../capture/command.md) for this repo.
+
+## Then hand it over
+
+Pass the result to [`design-system-capture`](../../skills/design-system-capture/SKILL.md)'s
+import step. Do not write `DESIGN.md` from here.
+
+## Rules
+
+- **Provenance is mandatory.** A file with no `source` and no `--source-ref` is
+  rejected — you cannot confirm what you cannot trace. Supplying it by flag is
+  recorded as caller-asserted, not extracted.
+- **The artifact is observed, not authoritative.** Every field is confirmed by
+  the human; a value conflicting with a registered brand token is flagged, never
+  auto-applied.
+- **The adapter is offline.** It reads a file and writes the contract shape — it
+  never fetches, crawls, or launches a browser.

package/dist/agent-src/commands/design-system.md

@@ -0,0 +1,66 @@
+---
+model_tier: inherit
+name: design-system
+pack: engineering-base
+tier: 2
+visibility: internal
+cluster: design-system
+type: orchestrator
+description: Design-system onramp — generate one from the corpus, import an extractor's output, or capture the current repo's. Three doors onto machinery that already ships.
+argument-hint: "[generate|import|capture] [args]"
+suggestion:
+  eligible: true
+  trigger_description: "generate a design system, import extracted design tokens, capture this repo's design system, seed DESIGN.md from a site"
+  trigger_context: "user explicitly wants a design system produced, imported, or captured — never suggested for ordinary UI work"
+workspaces:
+  - engineering
+packs:
+  - frontend-design
+---
+
+# /design-system
+
+Three doors onto machinery this package already ships and nothing could reach.
+The grounded generator, its `MASTER.md` persistence, the `design-system.json`
+import contract, and the current-repo inventory all existed before this cluster;
+what was missing was a way in. So every sub-command below is an entry point, not
+a new subsystem.
+
+**Optional means invoked or not invoked.** This cluster adds no settings key, no
+always-on rule, and no auto-trigger. It is suggestion-eligible only when a
+design-system question is explicit, and otherwise silent.
+
+## Sub-commands
+
+| Sub-command | Routes to | Purpose |
+|---|---|---|
+| `/design-system:generate "<product / industry / keywords>"` | `commands/design-system/generate.md` | Ground a design system in the curated corpus; optionally persist `MASTER.md` + page overrides, or seed `DESIGN.md` |
+| `/design-system:import <file>` | `commands/design-system/import.md` | Run an extractor's output through the three-lane adapter, then the per-field confirmation import |
+| `/design-system:capture` | `commands/design-system/capture.md` | Inventory *this* repo's components and tokens and emit the same `design-system.json` shape |
+
+## Dispatch
+
+1. Parse `/design-system <sub-command> [args]`. Sub-command = first token; match
+   against the table's exact names only.
+2. Look up the sub-command and execute its file verbatim with the remaining args.
+3. Unknown / missing sub-command → print the table and ask which door to take.
+
+## Rules
+
+- **Do NOT commit, push, or open a PR** — subcommands never do this.
+- **Do NOT chain subcommands.** One `/design-system <sub>` per turn.
+- **Generated and imported output is a proposal.** A provided artifact,
+  registered brand tokens, and a confirmed `DESIGN.md` all outrank it; a value
+  that conflicts with a registered brand token is flagged, never auto-applied
+  (per [`brand-source-of-truth`](../rules/brand-source-of-truth.md)).
+- **No crawler, browser runtime, or font-bundler is shipped.** Extraction tools
+  are user-installed and user-connected; this package's share is the adapter,
+  the instructions, and the validation.
+- **Edit `src/` only.** Generated mirrors regenerate.
+
+## See also
+
+- [`design-system-capture`](../../skills/design-system-capture/SKILL.md) — owns `DESIGN.md` and the per-field-confirmation import.
+- [`corpus-grounding`](../../skills/corpus-grounding/SKILL.md) · [`design-intelligence`](../../skills/design-intelligence/SKILL.md) — the grounded generator behind `:generate`.
+- [`existing-ui-audit`](../../skills/existing-ui-audit/SKILL.md) — the current-repo inventory behind `:capture`.
+- [`docs/contracts/command-clusters.md`](../docs/contracts/command-clusters.md) — `design-system` cluster registration.