@event4u/agent-config 12.0.0 → 13.0.0

package/dist/agent-src/contexts/execution/subagent-routing.md

@@ -8,8 +8,10 @@ provider's model or billing rule.
 
 ## Inputs
 
-- The sub-task's declared `model_tier` (`lite | medium | high | inherit`,
-  per [`model-recommendations`](../model-recommendations.md)).
+- The sub-task's declared `model_tier` (`lite | medium | high | frontier |
+  inherit`, per [`model-recommendations`](../model-recommendations.md)).
+  `frontier` (ADR-232) is declarable and opt-in; it is never the resolution of
+  `inherit` — see the top-band invariant below.
 - `subagents.downshift`, `subagents.quota_arbitrage`, `subagents.model_map`
   (see [`auto-orchestration-activation`](auto-orchestration-activation.md)).
 - The host-capability manifest's `separate_quota_pool`
@@ -27,43 +29,154 @@ THE SAME MINUS THE QUOTA WIN.
 1. **Downshift off** (`downshift: false`) → every sub-task runs on the session
    tier. No routing change.
 2. **Downshift on** → a sub-task runs on its declared tier; an `inherit` task
-   runs on the session tier. The tier resolves to a model alias via
-   `model_map`; an empty entry means "use the tier's runtime default" — never a
-   baked-in provider model name.
+   runs on the session tier, **bounded by the top-band invariant below**. The
+   tier resolves to a model alias via `model_map`; an empty entry means "use
+   the tier's runtime default" — never a baked-in provider model name.
 3. **Quota arbitrage** → prefer the **separate** quota pool for the sub-task
    **only when** `subagents.quota_arbitrage == true` **and**
    `manifest.separate_quota_pool == true`. Otherwise the shared pool is used and
    the tier/model choice is unchanged. This is the only place the
    "Sonnet-has-its-own-allowance" idea lives, and it lives as a runtime-detected
    flag, never as portable prose.
-4. **Budget routing** (design:
-   [`budget-routing` contract](../../../../docs/contracts/budget-routing.md)) →
-   AFTER the tier resolves per 1–3, the budget relation via `pickTier`
-   (`src/scripts/_lib/tier_budget_routing.ts`) would apply: cheapest
-   classifier-adequate tier WITH available budget; that tier exhausted or
-   cooling → next tier up with budget; all unavailable → session model +
-   surfaced one-line notice. Work is never blocked to save money. Before
-   the dispatch is created, acquire the atomic reserve
-   (`acquireBudgetPermit`; check state via `node src/scripts/cost/budget.mjs
-   tier <t>`); a 429/quota error trips `tripCooldown` for that tier and
-   falls back per the relation — never a retry loop.
-   `subagents.budget_routing` was removed as a settings key (always-on
-   orchestration, road-to-always-on-orchestration Phase 1: no per-layer
-   on/off switch survives) — `pickTier` has NO production caller today, so
-   this point documents the DESIGNED relation, not a currently wired one;
-   wiring it is a later phase of that roadmap (council-side
-   `cli_call_budget`/`cost_budget` are the caps that replace the settings
-   gate). Every budget-routed dispatch, once wired, would emit one
-   `orchestration_record` line (tier + provenance-tagged token delta) so
-   realized savings are measured, not asserted.
+4. **Budget routing — ARCHIVED 2026-08-16, there is no fourth step.** This
+   position used to describe a budget relation applied after the tier resolves
+   per 1–3: cheapest classifier-adequate tier WITH available budget, an atomic
+   pre-dispatch reserve, a cool-down on quota errors. None of it exists any
+   more. A converged AI-council verdict (anthropic + openai, 2 of 2) archived
+   `pickTier` and the permit lifecycle, because the `routing_switch` they
+   required lost its only source when `subagents.budget_routing` was deliberately
+   deleted by always-on orchestration — so wiring meant inventing a replacement
+   for a removed category — and because `session_tier` sits non-null in 0 of 327
+   records, leaving the saving unmeasurable in principle. Migration record and
+   the union revisit-if:
+   [`budget-routing` contract](../../../../docs/contracts/budget-routing.md).
+   **Tier resolution therefore ends at step 3.** What survives of the module is
+   `TIER_ORDER` and `readCooldowns`, read by `routing:doctor` as a diagnostic —
+   monitoring, not routing, and note that nothing writes the cool-down file any
+   more, which is why the doctor reports that state as *unavailable, no
+   producer* rather than as a measured "not cooling".
+
+### The top-band invariant (binding)
+
+```
+UNDER A TOP-BAND SESSION, `inherit` RESOLVES TO AT MOST `high`.
+A SLICE THAT GENUINELY NEEDS THE SESSION'S OWN BAND DECLARES IT.
+ONE TOP-BAND CONTEXT PER TASK — THE ORCHESTRATOR'S. NEVER A SECOND BY DEFAULT.
+```
+
+Read as one line: an undeclared slice under a top-band session runs at most
+`high`, never the session's own band.
+
+`inherit` means *model-agnostic*, not *whatever the session happens to cost*.
+Left unbounded it is the one declaration that silently buys the most expensive
+band available, for exactly the slices whose authors judged the model choice
+not to matter — the weakest possible reason to spend the most.
+
+**The clamp is `high`, not the top mapped tier, and the distinction is not
+cosmetic.** ADR-232 added `frontier` to the tier→model map, so the top *mapped*
+rung is now `frontier`; clamping there would clamp nothing. The bound is the
+top **generally-recommended** band, which is what
+[`model-recommendations`](../model-recommendations.md) already states from the
+other side — its `frontier` row reads *"Never the resolution of `inherit`"*.
+This clause is that same rule written where the resolution actually happens.
+
+Consequences, stated so the cost stays visible rather than removed:
+
+- A slice that needs `frontier` **declares `model_tier: frontier`** — a value
+  § Inputs above lists as declarable, precisely so this escape hatch is legal
+  rather than instructed-but-forbidden. The declaration is the whole point:
+  the spend becomes an authored decision with a name on it instead of a
+  default nobody chose.
+- The clamp changes only the **undeclared** case. Every explicit
+  `model_tier:` is honoured verbatim, upward included.
+- A session running *below* `high` is untouched — `inherit` still resolves to
+  the session tier. "At most" is a ceiling, never a floor, and this clause
+  never promotes a slice.
+- A **declared `frontier` implementer** keeps its band, and its judge is
+  governed by [`subagent-configuration`](../subagent-configuration.md)
+  § The judge cap — which handles that case explicitly rather than leaving
+  the reviewer weaker than the author.
+
+**Honest scope.** This is a policy clause in a context file, so it binds the
+agent that reads it and nothing else; no gate re-derives an `inherit`
+resolution at dispatch time. `enforced_by: none`, deliberately — the same
+boundary the safety-floor rules state for their own obligations.
+
+### The non-escalation floor (binding)
+
+```
+A SLICE WHOSE DISPATCH OVERHEAD EXCEEDS THE SAVING FROM DOWNSHIFTING
+STAYS IN-SESSION. SPLITTING WORK WHOSE OVERHEAD EATS ITS OWN SAVING
+IS THE ANTI-GOAL, NOT THE MECHANISM WORKING.
+```
+
+Every dispatch pays a fixed cost the in-session path does not: the slice's
+prompt is re-sent to a fresh context, the return is read back, and the
+orchestrator verifies it. Below some slice size that overhead exceeds
+whatever the cheaper tier saved, and the delegation is a net loss dressed as
+an optimisation.
+
+**The floor is a rule, not a number — and the reason is measured, not
+assumed.** The step that authored this clause expected the same-band spawn
+distribution to supply the number. It cannot, and the corpus says so
+precisely. Over the full 327-record `orchestration` corpus (2026-07 plus
+2026-08):
+
+| Field the saving model needs | Non-null records |
+|---|---:|
+| `dispatch_tokens` | 40 |
+| `tier_chosen` | 1 |
+| `session_tier` | **0** |
+
+The three must co-occur on one dispatch to model a reduction, so the usable
+intersection is **zero**. This is not a small sample — it is an empty one, and
+`orchestration_savings_report.ts` already prints exactly that conclusion
+(`MODELED cost reduction: n/a (needs dispatch_tokens + session_tier +
+tier_chosen on a dispatch)`). `token_delta` does not rescue it: the hook
+writes it as a constant `0` with provenance `estimated`, deliberately, because
+no in-session counterfactual exists on disk to difference against.
+
+So the floor binds as a judgement with a named direction rather than a
+threshold:
+
+- **Default to in-session** when the slice is small enough that stating it
+  costs about as much as doing it — a single-file edit, one grep, one
+  question with a known answer.
+- **Delegate** when the slice carries its own reading (a file set to sweep, an
+  independent verification, a search whose output you do not want in context)
+  — there the returned conclusion is the saving, and it is not in tokens.
+- **Never delegate to hit a target.** A dispatch count is not an outcome.
+
+*Revisit-if:* a single dispatch record carries `dispatch_tokens`,
+`session_tier` and `tier_chosen` together. At that point the floor is
+computable and this clause should be replaced by the number, not amended
+toward it. Filling `session_tier` is the blocking gap — it exists in the
+schema and on the manual `orchestration_record` CLI path (`--session-tier`),
+and the hook that produced all 327 records never sets it.
 
 **Cache trade-off (road-to-cache-economy Phase 4).** A tier downshift changes
-the sub-task's model, and the prompt cache is keyed by `(model, prefix)` — so
-a downshifted leg forfeits its model-scoped cache reads AND splits a cohort's
-shared prefix into two caches (downshifted legs vs. session-tier legs). The
-per-call model saving and the forfeited cache-read saving pull in opposite
-directions; which wins is a measured question, not a default this policy
-resolves — see
+the sub-task's model, and the prompt cache is keyed by `(model, prefix)`. The
+concern was that a downshifted leg forfeits its model-scoped cache reads AND
+splits a cohort's shared prefix into two caches (downshifted legs vs.
+session-tier legs).
+
+**Measured 2026-08-16 —
+[`downshift-vs-cache.md`](../../../../agents/evidence/analysis/downshift-vs-cache.md),
+611 subagent legs / 16,612 calls.** The first half does not hold: a subagent
+leg's **first call realizes 2.8 % cache read**, so it starts cold and does not
+inherit the session's cache — a downshift forfeits a cache the leg never had.
+The cache is not lost, it is created on the other model and then read for the
+rest of the leg (median 18 calls per leg, ~96.9 % read share). The second half
+is **not measured** — nothing sizes cohort prefix sharing — but it is bounded
+above: prefix splitting is a write-side cost, and writes are **3.1 %** of
+subagent billable input against a 96.9 % read surface. Even attributing every
+write to splitting, the two sit about an order of magnitude apart, in favour of
+the downshift, so the direction does not depend on the unmeasured fraction.
+
+This resolves the direction; it does not license downshifting as a target. The
+cold start is paid per leg regardless of tier, which is precisely what the
+non-escalation floor above bounds. Analogous downgrade/cache coupling on the
+council side: see
 [`docs/contracts/ai-council-config.md`](../../../../docs/contracts/ai-council-config.md)
 § `model_downgrade` for the analogous downgrade/cache coupling this suite
 already ships on the council side.
@@ -80,8 +193,10 @@ rule, or context asserts "model X is free".
 [`src/scripts/_lib/subagent_routing.ts`](../../../../src/scripts/_lib/subagent_routing.ts)
 (`resolveSubagentRouting`), covered by
 [`tests/scripts/_lib_subagent_routing.test.ts`](../../../../tests/scripts/_lib_subagent_routing.test.ts).
-Budget layer: [`src/scripts/_lib/tier_budget_routing.ts`](../../../../src/scripts/_lib/tier_budget_routing.ts)
-(`pickTier`, `acquireBudgetPermit`, cool-downs), covered by
+Tier vocabulary + cool-down state:
+[`src/scripts/_lib/tier_budget_routing.ts`](../../../../src/scripts/_lib/tier_budget_routing.ts)
+(`TIER_ORDER`, `readCooldowns` — the budget decision layer that used to live
+there is archived, see step 4), covered by
 [`tests/scripts/tier_budget_routing.test.ts`](../../../../tests/scripts/tier_budget_routing.test.ts);
 live state: `agent-config routing:doctor` (orchestration section).
 

package/dist/agent-src/contexts/model-recommendations.md

@@ -1,15 +1,17 @@
 # Model Recommendations
 
 Loaded by the `model-recommendation` rule. Expresses recommendations as
-**vendor-neutral capability tiers** (`lite | medium | high`, ADR-035), never
-vendor model names. Each agent resolves a tier to its own best model in that
-band; the package's only tier→model mapping is the Claude generator's
-(`high→opus`, `medium→sonnet`, `lite→haiku`).
+**vendor-neutral capability tiers** (`lite | medium | high | frontier`,
+ADR-035 as amended by ADR-232), never vendor model names. Each agent resolves a
+tier to its own best model in that band; the package's only tier→model mapping
+is the Claude generator's (`frontier→fable`, `high→opus`, `medium→sonnet`,
+`lite→haiku`).
 
 ## Tier Profiles
 
 | Tier | Band | Claude resolution | Use for |
 |---|---|---|---|
+| `frontier` | above the strongest generally-recommended band | Fable | **Opt-in, expected to stay rare.** Declare it only where the work genuinely needs capability beyond `high` — the point of the band is that such work *says so* rather than inheriting the session's model silently. Never the resolution of `inherit` |
 | `high` | strongest reasoning | Opus | Architecture, refactoring, complex debugging, code review, design decisions, multi-file changes, large-scale analysis / research / planning |
 | `medium` | balanced daily | Sonnet (latest) | Daily coding, known-cause bug fixes, tests, single-layer features, quality checks, config, documentation, implementation after a `high`-tier plan |
 | `lite` | fastest / cheapest | Haiku | Trivial mechanical edits — formatting, one-line config, rote renames, boilerplate stamping |

package/dist/agent-src/contexts/subagent-configuration.md

@@ -15,21 +15,83 @@ Loaded by the `subagent-orchestration` skill and the `/do-and-judge`,
 ## Model tier ladder
 
 The "one tier up" fallback walks this ladder. Session model is the
-starting point; judge picks the tier above.
+starting point; judge picks the tier above. The ladder is written in
+**bands**, not vendor models — the package keeps exactly one tier→model
+mapping and it lives in
+[`model-recommendations`](model-recommendations.md) (ADR-035 § 3). A
+second per-vendor ladder here would be the two-clocks drift ADR-232 was
+careful not to create.
 
 ```
-haiku  →  sonnet  →  opus
+lite  →  medium  →  high
 ```
 
-If the session runs on **opus**, judge stays on opus (no higher tier
-available). If the session runs on **sonnet**, judge defaults to opus.
-If the session runs on **haiku**, judge defaults to sonnet.
+If the session runs at **`high`**, judge stays at `high`. If the session
+runs at **`medium`**, judge defaults to `high`. If the session runs at
+**`lite`**, judge defaults to `medium`.
+
+### The judge cap (binding)
+
+```
+THE ONE-TIER-UP ESCALATION STOPS AT `high` — IT NEVER CLIMBS INTO `frontier`.
+A JUDGE IS NEVER BELOW ITS OWN IMPLEMENTER: A DECLARED `frontier`
+IMPLEMENTER KEEPS A `frontier` JUDGE.
+A SATURATED LADDER ESCALATES CROSS-VENDOR VIA THE COUNCIL —
+NEVER INTO A SECOND SAME-VENDOR TOP-BAND AGENT.
+```
+
+Two clauses that are easy to collapse into one and must not be. The cap
+binds the **escalation**, not the floor:
+
+| Implementer band | Judge band | Why |
+|---|---|---|
+| `lite` | `medium` | one tier up |
+| `medium` | `high` | one tier up |
+| `high` | `high` | escalation capped — never climbs into `frontier` |
+| `frontier` | **`frontier`** | the floor wins: a judge is never below its author |
+
+`frontier` (ADR-232) sits above `high` in the vocabulary, so a naive
+"one tier up" would resolve a `high` implementer's judge to `frontier`
+and buy the most expensive band available for every verification pass.
+The cap forecloses that — `frontier` is opt-in by declaration only.
+
+**But the cap must not invert the ladder it protects.** Reading it as a
+flat ceiling would give a declared `frontier` implementer a `high`
+judge, i.e. a reviewer strictly *weaker* than the author — worse than
+the same-band case the one-tier-up rule exists to avoid, and a direct
+contradiction of "never downshifts its judge below what the verify
+contract requires" below. So `frontier` reaches the judge only where
+the implementer already declared it, never by escalation from `high`.
+
+**What to do when the ladder saturates.** At `high` and at `frontier`
+the judge is same-band — the reviewer is no stronger than the author,
+which is the condition the one-tier-up rule existed to avoid. The
+answer is *different vendor*, not *bigger model*:
+
+- Route the saturation case through
+  [`ai-council`](../skills/ai-council/SKILL.md), which polls models
+  outside the host session (Anthropic + OpenAI) and is therefore
+  genuinely independent of the implementer's framing.
+- This is the escalation **instead of** a second top-band context, not
+  in addition to one. Two same-vendor top-band agents on one task cost
+  twice and correlate their blind spots; a second vendor costs less and
+  disagrees for real reasons.
+- Cost boundary unchanged: the council is a network call and is
+  therefore never automatic. It is what the saturation case escalates
+  *to* when a second opinion is wanted, not a step every `high` task
+  takes ([`ai-council`](../skills/ai-council/SKILL.md) § Do NOT use).
+
+**Honest scope.** This is policy prose in a context file — it binds the
+agent that reads it and no gate re-derives a judge tier at dispatch
+time. `enforced_by: none`, stated rather than implied.
 
 **Downshift never touches the judge.** When cost-aware routing runs an
 implementer on a downshifted tier (per the category → tier defaults in
 [`model-recommendations § Subagent Category → Tier Defaults`](model-recommendations.md)),
-the judge still resolves one tier above the IMPLEMENTER's resolved tier —
-so a `lite` implementer gets at least a `medium` judge. Downshifting an
+the judge still resolves one tier above the IMPLEMENTER's resolved tier,
+**with the escalation capped at `high` per the judge cap above** — so a
+`lite` implementer gets at least a `medium` judge, and no *downshifted*
+implementer escalates its judge into `frontier`. Downshifting an
 implementer never downshifts its judge below what the verify contract
 requires, and a judge is never `lite`.
 

package/dist/agent-src/rules/autonomous-execution.md

@@ -67,7 +67,7 @@ ALLOWLIST > 20 ENTRIES IN ONE SESSION = THE LINTER IS WRONG.
 STOP. PROPOSE LINTER REDESIGN OR REMOVAL. DO NOT EXPAND THE ALLOWLIST FURTHER.
 ```
 
-Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Enforced at tool-call time by the `block-config-weakening` PreToolUse guard (`src/scripts/hooks/block_config_weakening.ts`) **on the three hosts that have a `pre_tool_use` slot at all** — augment, claude, cowork: it counts allowlist entries added per session, warns from 5, and blocks past 20. On cursor, cline, windsurf, gemini and copilot the guard has nowhere to bind, so there the cap is model-carried and "enforced at tool-call time" is not a claim this rule can make. Run `agent-config hooks:status` to see which slots are bound on the host you are actually on — the sibling rules `git-history-discipline` and `evaluator-independence` qualify the identical slot, and an unqualified claim here would read as a guarantee the manifest does not give. Baselines and budget thresholds warn only — a rising count there may be a legitimate ratchet reset, which the edit alone cannot distinguish. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
+Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Enforced at tool-call time by the `block-config-weakening` PreToolUse guard (`src/scripts/hooks/block_config_weakening.ts`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**: it counts allowlist entries added per session, warns from 5, and blocks past 20. It is *bound* on augment and cowork as well, and ignored there — `host_semantics.ts` verifies claude alone, and both trampolines discard dispatcher output and `exit 0` unconditionally. Everywhere else the cap is model-carried and "enforced at tool-call time" is not a claim this rule can make. **Corrected 2026-08-17 in both directions:** this sentence used to certify augment, claude and cowork as the enforcing set (an over-claim of two hosts) and to explain the rest with "the guard has nowhere to bind" (false for cursor, cline and gemini, whose native pre-tool events `native_event_aliases` already maps onto `pre_tool_use` — unbound, not unbindable; only windsurf and copilot have no pre-tool surface). The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md). Run `agent-config hooks:status` to see which slots are bound on the host you are actually on — the sibling rules `git-history-discipline` and `evaluator-independence` qualify the identical slot, and an unqualified claim here would read as a guarantee the manifest does not give. Baselines and budget thresholds warn only — a rising count there may be a legitimate ratchet reset, which the edit alone cannot distinguish. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
 Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, N=3 mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/design-fidelity.md

@@ -171,7 +171,7 @@ introduced. The row that would have caught it is
 and it exists only because a review asked for it after the trigger had already
 shipped. Write that row first next time; it is the cheap half.
 
-Body migrated to [`guideline:design-fidelity-mechanics`](../docs/guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
+Body migrated to [`guideline:design-fidelity-mechanics`](../docs/guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — URL / live-page handover (extraction into the `design-system.json` contract before the first UI write, the retrieval order, the lock boundary), surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also

package/dist/agent-src/rules/design-review-after-ui-write.md

@@ -114,11 +114,16 @@ still have no runtime consumer. A test — not a code path — keeps the two fro
 drifting: `ui_rule_triggers.test.ts` asserts every `file_pattern` declared here
 is accepted by that predicate.
 
-Warn-only, capped at two nudges per session, default-OFF, bound only on hosts
-carrying a `pre_tool_use` slot. A nudge that can be ignored is not enforcement,
-so `enforced_by:` stays `none` — it moves the day a mechanism can refuse, not
-the day a reminder appears. `agent-config hooks:status` answers whether the
-concern is bound on the host you are actually on.
+Warn-only, capped at two nudges per session, default-OFF, and bound only in the
+three `platforms:` rows that carry a `pre_tool_use` key — augment, claude,
+cowork (**clarified 2026-08-17**: "hosts carrying a slot" read as a host
+property and is a manifest one; three further hosts alias a native pre-tool
+event with no binding, and only claude honours a deny — see
+[`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md)).
+The verdict is unchanged either way: a nudge that can be ignored is not
+enforcement, so `enforced_by:` stays `none` — it moves the day a mechanism can
+refuse, not the day a reminder appears. `agent-config hooks:status` answers
+whether the concern is bound on the host you are actually on.
 
 What that leaves, and it is the useful part: the write side now has a named
 obligation and a route to the skill that discharges it, where before it had

package/dist/agent-src/rules/evaluator-independence.md

@@ -95,13 +95,35 @@ Three limits, stated because they were measured. The pre-loaded-verdict list is
 a **phrase list**, so a paraphrase evades it — it catches recurrences of known
 steering wording, not steering as such. The turn boundary is the
 authorization ledger's `detected_at` stamp, because the envelope carries no turn
-id; with no ledger yet, the counter falls back to session scope. And the slot
-itself is not universal: `pre_tool_use` exists on **three** hosts — augment,
-claude, cowork. On cursor, cline, windsurf, gemini and copilot this guard has
-nowhere to bind, so items 1 and 4 join 2 and 3 as model-carried there. The
-frequency join in `check_enforcement_coverage.ts` reports exactly that set, and
+id; with no ledger yet, the counter falls back to session scope. And the guard
+does not deny everywhere it exists: `pre_tool_use` is **bound** on three hosts —
+augment, claude, cowork — and only `claude` honours the deny. Everywhere else,
+augment and cowork included, items 1 and 4 join 2 and 3 as model-carried.
 `agent-config hooks:status` answers it for the host you are on right now.
 
+**Corrected 2026-08-17 — this paragraph was wrong on both sides of the line it
+drew.** It said `pre_tool_use` "exists on three hosts" and that the guard has
+"nowhere to bind" on the other five. Neither half survived a re-read of the
+tree. **Downward:** the manifest's own `native_event_aliases` table already maps
+`preToolUse` (cursor), `PreToolUse` (cline) and `BeforeTool` (gemini) onto
+`pre_tool_use`, so there the guard is **unbound, not unbindable**; only windsurf
+and copilot carry no pre-tool surface at all. **Upward, and worse:**
+`host_semantics.ts` certifies **claude alone**, and the augment and cowork
+trampolines discard dispatcher output and `exit 0` unconditionally — so on two
+of the three "enforcing" hosts this guard runs and is then ignored. Nor may the
+inverse be asserted downward: nothing records whether an unbound host's
+pre-tool event can *deny*, and `severity: blocking` is a property of the concern
+rather than of the host. The four states are tabulated once in
+[`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md).
+
+Stated at this length because this rule exists over a case where a process that
+*looked* followed produced fabricated evidence. An unbacked reason for a real
+gap and an unmeasured claim of enforcement are the same failure in a smaller
+font, and this paragraph had shipped one of each. Note also what the frequency
+join actually reports: `check_enforcement_coverage.ts` skips `fallback_only`
+platforms, so its gap set is **four** — cursor, cline, windsurf, gemini — never
+copilot, which is excluded by declaration rather than measured as a gap.
+
 Items 2 and 3 — an honestly chosen scope, and recording the prompt with the
 verdict — are **not** enforced by anything. A narrowed scope is not decidable
 from the prompt alone, and no validator reads the artefacts a verdict lands in.

package/dist/agent-src/rules/git-history-discipline.md

@@ -84,4 +84,8 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`commit-policy`](commit-policy.md) — commits are the user's call; rewriting them is a stronger version of the same restriction.
 - [`token-efficiency`](token-efficiency.md) — Iron Law on burning the user's tokens for cosmetic gain.
 - [`skill:git-workflow`](../skills/git-workflow/SKILL.md) — Safe Squash-After-Push protocol and Divergent-State Recovery decision tree.
-- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on the three hosts that have a `pre_tool_use` slot at all** — augment, claude, cowork. On cursor, cline, windsurf, gemini and copilot the guard has nowhere to bind, so on those hosts the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. Surfaced by the frequency join in `check_enforcement_coverage.ts`, which reports the per-commit obligation as uncovered on exactly those platforms. To check the host you are on rather than trusting this sentence, run `agent-config hooks:status`.
+- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**. It is *bound* on augment and cowork too, and ignored there. Everywhere else the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. To check the host you are on rather than trusting this sentence, run `agent-config hooks:status`.
+
+  **Corrected 2026-08-17, in both directions, because this line was wrong on each side.** It read "the guard has nowhere to bind" on cursor, cline, windsurf, gemini and copilot — refuted for three of the five by the manifest's own `native_event_aliases` table, which already maps `preToolUse`, `PreToolUse` and `BeforeTool` onto `pre_tool_use`: there the guard is **unbound, not unbindable**, and only windsurf and copilot carry no pre-tool surface. And it certified augment, claude and cowork as the enforcing set — `host_semantics.ts` verifies **claude alone**, while the augment and cowork trampolines discard dispatcher output and `exit 0` unconditionally, so a guard bound there runs and is then ignored. Both halves are the same failure: a host-capability claim this tree never established. The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md).
+
+  The frequency join in `check_enforcement_coverage.ts` reports this obligation uncovered on **four** platforms — cursor, cline, windsurf, gemini. It skips `fallback_only` platforms before computing, so copilot never appears in its output and must not be quoted as if it did; copilot is uncovered for the separate reason that it has no hook surface at all.

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -4,6 +4,7 @@ tier: "1"
 description: "Writing/upstreaming low-impact-decisions corpus entries — non-bypassable privacy floor"
 triggers:
   - path_prefix: "agents/decisions/low-impact-decisions"
+  - path_prefix: "data/low-impact-decisions-seed"
   - keyword: "low-impact-decisions"
   - keyword: "low-impact corpus"
   - keyword: "learn-low-impact"

package/dist/agent-src/rules/missing-skill-recovery.md

@@ -0,0 +1,89 @@
+---
+type: "auto"
+tier: "2a"
+description: "A skill exists in the tree but not in the host's catalogue — ask for it by TASK via suggest_skill_for_task, never conclude it does not exist"
+triggers:
+  - phrase: "skill not found"
+  - phrase: "no such skill"
+  - phrase: "skill does not exist"
+  - phrase: "kein passendes skill"
+  - phrase: "which skill"
+  - phrase: "welches skill"
+applies_to_user_types:
+  - "developer"
+  - "maintainer"
+self_contained: true
+workspaces: [engineering]
+packs: [meta]
+# obligation: line 41
+obligation_frequency: "per-turn"
+---
+
+# Missing-Skill Recovery
+
+The catalogue a host shows you is not the catalogue that exists. Hosts truncate,
+and at least one truncates hard: measured 2026-08-16 on a default install, the
+host published its own budget event stating it had stripped every description
+and dropped **402 entries** from the model-visible skills list
+(`agents/evidence/analysis/scoped-projection-host-delivery.md`). Scoping the
+projection moved that to 330 and stripped the descriptions anyway.
+
+402 is the **host's own count against the host's own denominator**, which is not
+this package's: the same install projects 297 skills, so the figure is a
+magnitude, never a subtraction anyone can perform. What it establishes is that
+most of the catalogue is not model-visible — which is all this rule needs.
+
+So "I do not see a skill for this" is evidence about the **delivery**, never
+about the tree.
+
+## The Iron Law
+
+```
+A SKILL MISSING FROM THE HOST CATALOGUE IS NOT A SKILL THAT DOES NOT EXIST.
+NEVER CONCLUDE "NO SKILL COVERS THIS" FROM THE LIST YOU WERE SHOWN.
+ASK BY TASK — `suggest_skill_for_task` RANKS THE TREE, NOT THE CATALOGUE.
+NEVER REBUILD A CAPABILITY BECAUSE ITS SKILL WAS NOT DELIVERED.
+```
+
+## What to do
+
+1. **Ask by task, not by name.** A name you cannot see is a name you cannot
+   type; a task description always works. The `suggest_skill_for_task` MCP tool
+   ranks `SKILL.md` frontmatter over the source tree and returns names, scores
+   and personas — no bodies, so a wrong rank costs one read.
+2. **Open the winner and check it yourself.** The ranker is deterministic
+   keyword scoring, not judgement. A high score is a pointer, not a verdict.
+3. **Say which source answered.** "The catalogue had no entry, the ranker
+   found `X`" is a different claim from "there is no skill for this", and a
+   reader cannot reconstruct which one you meant from silence.
+4. **If nothing scores, say that** — and proceed without a skill rather than
+   inventing one. A ranked empty list and an unreachable catalogue are
+   different answers; the tool distinguishes them (`status: no_catalogue`) and
+   so should you.
+
+## When NOT to fire
+
+- The skill you need was delivered and is in front of you. This rule is for the
+  gap, not for routine skill selection.
+- The task genuinely has no skill and you already checked by task. Checking
+  twice is the loop, not the discipline.
+- A host that delivers its catalogue whole — the rule costs nothing there and
+  simply never has a gap to close.
+
+## Honest enforcement — `enforced_by: none`
+
+Nothing can observe an agent concluding "no skill exists". The `skill-route`
+concern injects ranked pointers on `user_prompt_submit` when its floor is
+cleared, which covers the prompts where the ranker is confident and by
+construction covers no others: it is silent on ~86 % of prompts by design. This
+rule is the model-carried half for the rest, and it is stated as such rather
+than implied to be caught by the concern.
+
+## See also
+
+- [`code-intelligence`](../skills/code-intelligence/SKILL.md) — the same
+  shape for source code: query the index first, fall back, name the source.
+- [`external-code-graph-interop`](external-code-graph-interop.md) — its rule-side
+  twin, and the model this rule's trigger set follows.
+- `src/scripts/skill_tools/score_skill_relevance.ts` — the ranker itself, and
+  the one place its scoring is defined.

package/dist/agent-src/rules/ui-audit-gate.md

@@ -121,10 +121,15 @@ every `file_pattern` declared here is accepted by that predicate. The predicate
 is deliberately wider (it also covers `.css`, `.scss`, `.astro`), because a
 measurement denominator and a routing trigger are not the same population.
 
-Warn-only, capped at two per session, default-OFF, bound only where a
-`pre_tool_use` slot exists. A reminder that can be ignored is not a gate, so
-`enforced_by:` stays `none`. Run `agent-config hooks:status` for the host you
-are on rather than trusting this sentence.
+Warn-only, capped at two per session, default-OFF, and bound only in the three
+`platforms:` rows that carry a `pre_tool_use` key — augment, claude, cowork
+(**clarified 2026-08-17**: "where a slot exists" read as a host property, and it
+is a manifest one; three further hosts alias a native pre-tool event without a
+binding, and only claude honours a deny at all — the four states are tabulated
+in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md)).
+None of that changes the verdict here: a reminder that can be ignored is not a
+gate, so `enforced_by:` stays `none`. Run `agent-config hooks:status` for the
+host you are on rather than trusting this sentence.
 
 ## Failure modes
 

package/dist/agent-src/scripts/archive_completed_roadmaps.ts

@@ -403,6 +403,38 @@ function _regen_dashboard(root: string, dry_run: boolean): void {
     }
 }
 
+/**
+ * Rebuild the archive index after a move, when the builder is present.
+ *
+ * The sweep is the one operation that changes what `agents/roadmaps/archive/`
+ * contains, so it is the one operation that can leave the generated index
+ * stale — and the drift gate on that index runs in the same PR the sweep runs
+ * in. Regenerating here keeps the two from disagreeing by construction rather
+ * than by remembering.
+ *
+ * `build_archive_index` is package-internal (`src/scripts/`), while this sweep
+ * is projected into consumer installs that carry no such script. Absent
+ * builder → nothing to regenerate, and that is a normal consumer state, not a
+ * failure. The spawn is best-effort for the same reason `_regen_dashboard` is:
+ * a sweep that archived correctly must not report failure because a
+ * regeneration could not run.
+ */
+function _regen_archive_index(root: string, dry_run: boolean): void {
+    if (dry_run) {
+        return;
+    }
+    const script = path.join(root, 'src', 'scripts', 'build_archive_index.ts');
+    if (!_isFile(script)) {
+        return;
+    }
+    _runTwin(root, script);
+    for (const rel of ['agents/roadmaps/archive/INDEX.md', 'agents/roadmaps/archive/index.json']) {
+        if (_isFile(path.join(root, rel))) {
+            _run(['git', 'add', '--', rel], root);
+        }
+    }
+}
+
 /** Spawn the dashboard generator twin (tsx) with cwd=root, mirroring `[sys.executable, script]`. */
 function _runTwin(root: string, script: string): void {
     // Python uses `sys.executable` — the interpreter already running this
@@ -491,6 +523,7 @@ function main(argv?: readonly string[]): number {
         return 0;
     }
     _regen_dashboard(root, ns.dry_run);
+    _regen_archive_index(root, ns.dry_run);
     const verb = ns.dry_run ? 'Would archive' : 'Archived';
     for (const rec of archived) {
         process.stdout.write(