@event4u/agent-config 14.0.0 → 14.2.0

package/dist/hooks/dispatch.js

@@ -23087,9 +23087,38 @@ import path50 from "node:path";
 import { fileURLToPath as fileURLToPath32, pathToFileURL as pathToFileURL24 } from "node:url";
 var EXIT_ALLOW8 = 0;
 var STATE_FILE7 = path50.join("agents", "state", "git-authorization.json");
+var STATE_DIR3 = path50.join("agents", "state", "git-authorization");
+var PENDING_DIR = path50.join("agents", "state", "git-authorization-pending");
+function sessionSlug(session_id) {
+  return session_id.replace(/[^A-Za-z0-9._-]/gu, "_").slice(0, 80);
+}
+function ledgerFileFor(session_id) {
+  if (!session_id) {
+    return STATE_FILE7;
+  }
+  return path50.join(STATE_DIR3, `${sessionSlug(session_id)}.json`);
+}
+function pendingFileFor(session_id) {
+  if (!session_id) {
+    return PENDING_FILE;
+  }
+  return path50.join(PENDING_DIR, `${sessionSlug(session_id)}.json`);
+}
+var PENDING_FILE = path50.join("agents", "state", "git-authorization-pending.json");
+var PENDING_MAX_AGE_MS = 10 * 60 * 1e3;
 function _isObject8(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+var ALL_OPS = [
+  "commit",
+  "push",
+  "branch",
+  "pr-create",
+  "pr-merge",
+  "tag",
+  "release",
+  "publish"
+];
 var PHRASES = [
   { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
   { op: "push", re: /\b(push(e|en|t)?|hochladen|hochschieben|raufschieben)\b/i },
@@ -23127,6 +23156,18 @@ function isInterrogative(prose) {
     t
   );
 }
+function isAffirmative(prose) {
+  const t = prose.trim().replace(/[.!]+$/u, "");
+  if (!t || t.length > 24) {
+    return false;
+  }
+  if (isInterrogative(t)) {
+    return false;
+  }
+  return /^(?:option\s*)?\d{1,2}[.)]?$/iu.test(t) || /^(ja|jo|jep|yes|yep|yeah|ok|okay|okey|klar|passt|gut|los|go|go ahead|mach|mach das|mach es|leg los|do it|proceed|bitte)$/iu.test(
+    t
+  );
+}
 var PASTED_COMMANDS = [
   { op: "publish", re: /\bnpm\s+publish\b/i },
   { op: "tag", re: /\bgit\s+push\s+[^\n]*--tags\b|\bgit\s+tag\s+-a\b/i },
@@ -23175,6 +23216,40 @@ function classifyAuthorization(prompt) {
   }
   return { authorized: [...authorized], evidence };
 }
+function takePending(consumer_root, session_id, now) {
+  const file = path50.join(consumer_root, pendingFileFor(session_id));
+  let raw;
+  try {
+    raw = fs49.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    fs49.rmSync(file, { force: true });
+  } catch {
+  }
+  try {
+    const decoded = JSON.parse(raw);
+    if (!_isObject8(decoded)) {
+      return null;
+    }
+    const op = decoded["op"];
+    if (typeof op !== "string" || !ALL_OPS.includes(op)) {
+      return null;
+    }
+    const recorded = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+    if (session_id && recorded && recorded !== session_id) {
+      return null;
+    }
+    const at = Date.parse(String(decoded["refused_at"] ?? ""));
+    if (!Number.isFinite(at) || now - at > PENDING_MAX_AGE_MS) {
+      return null;
+    }
+    return { op, session_id: recorded, refused_at: String(decoded["refused_at"]) };
+  } catch {
+    return null;
+  }
+}
 function run9(stdin_text, options) {
   let envelope = {};
   if (stdin_text.trim()) {
@@ -23200,6 +23275,12 @@ function run9(stdin_text, options) {
     return EXIT_ALLOW8;
   }
   const { authorized, evidence } = classifyAuthorization(prompt);
+  const session = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
+  const pending = takePending(options.consumer_root, session, Date.now());
+  if (pending && !authorized.includes(pending.op) && isAffirmative(prompt)) {
+    authorized.push(pending.op);
+    evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
+  }
   const ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
     detected_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -23208,7 +23289,7 @@ function run9(stdin_text, options) {
     prompt_chars: prompt.length
   };
   try {
-    atomic_write_json(path50.join(options.consumer_root, STATE_FILE7), ledger);
+    atomic_write_json(path50.join(options.consumer_root, ledgerFileFor(session)), ledger);
   } catch {
   }
   return EXIT_ALLOW8;
@@ -23494,17 +23575,30 @@ function commandOp(command) {
 }
 var LEDGER_MAX_AGE_MS = 30 * 60 * 1e3;
 function _loadLedger(consumer_root, session_id, now) {
+  const candidates = [ledgerFileFor(session_id)];
+  if (!candidates.includes(STATE_FILE7)) {
+    candidates.push(STATE_FILE7);
+  }
+  for (const rel of candidates) {
+    const found = _readLedgerFile(path51.join(consumer_root, rel), session_id, now);
+    if (found !== null) {
+      return found;
+    }
+  }
+  return { authorized: /* @__PURE__ */ new Set(), present: false };
+}
+function _readLedgerFile(file, session_id, now) {
   try {
-    const raw = fs50.readFileSync(path51.join(consumer_root, STATE_FILE7), "utf8");
+    const raw = fs50.readFileSync(file, "utf8");
     const decoded = JSON.parse(raw);
     if (_isObject9(decoded) && Array.isArray(decoded["authorized"])) {
       const ledgerSession = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
       if (session_id && ledgerSession && ledgerSession !== session_id) {
-        return { authorized: /* @__PURE__ */ new Set(), present: false };
+        return null;
       }
       const at = Date.parse(String(decoded["detected_at"] ?? ""));
       if (Number.isFinite(at) && now - at > LEDGER_MAX_AGE_MS) {
-        return { authorized: /* @__PURE__ */ new Set(), present: false };
+        return null;
       }
       return {
         authorized: new Set(decoded["authorized"].filter(Boolean)),
@@ -23513,7 +23607,7 @@ function _loadLedger(consumer_root, session_id, now) {
     }
   } catch {
   }
-  return { authorized: /* @__PURE__ */ new Set(), present: false };
+  return null;
 }
 function decide(command, ledger) {
   if (command === null) {
@@ -23527,7 +23621,7 @@ function decide(command, ledger) {
   if (BLOCK_OPS.has(op)) {
     const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}. Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
     return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}
-` };
+`, blockedOp: op };
   }
   if (WARN_OPS.has(op)) {
     const reason = `No \`${op}\` authorization found in this turn's prompt (commit-policy: a one-shot authorization is spent on the operation it named). If the user did authorize it this turn, proceed; otherwise stop and ask. Command: ${shown}`;
@@ -23557,6 +23651,16 @@ function run10(stdin_text, options) {
     extractCommand2(envelope),
     _loadLedger(options.consumer_root, session_id, Date.now())
   );
+  if (decision.blockedOp) {
+    try {
+      atomic_write_json(path51.join(options.consumer_root, pendingFileFor(session_id)), {
+        op: decision.blockedOp,
+        session_id,
+        refused_at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    } catch {
+    }
+  }
   if (decision.stdout) {
     process.stdout.write(decision.stdout);
   }
@@ -27387,6 +27491,51 @@ var OBSERVATION_LOG = path66.join(
   "metrics",
   "skill-catalogue.jsonl"
 );
+function truncationModeOf(record) {
+  return record.truncation_mode ?? "per-entry";
+}
+function _supersedes(candidate, incumbent) {
+  if (candidate.observed_at !== incumbent.observed_at) {
+    return candidate.observed_at > incumbent.observed_at;
+  }
+  return (candidate.dropped_count ?? 0) > (incumbent.dropped_count ?? 0);
+}
+function headlineRecordPerHost(records) {
+  const out = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    const previous = out.get(record.host);
+    if (previous === void 0 || _supersedes(record, previous)) {
+      out.set(record.host, record);
+    }
+  }
+  return out;
+}
+function readObservationLog(logPath) {
+  if (!fs65.existsSync(logPath)) return [];
+  const out = [];
+  for (const line of fs65.readFileSync(logPath, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    try {
+      out.push(JSON.parse(trimmed));
+    } catch {
+      continue;
+    }
+  }
+  return out;
+}
+
+// src/scripts/_lib/skill_catalogue_series.ts
+function knownBareNames(records, host) {
+  const dated = records.filter(
+    (record) => record.host === host && typeof record.observed_at === "string"
+  );
+  const latest = headlineRecordPerHost(dated).get(host);
+  if (latest === void 0) return null;
+  if (truncationModeOf(latest) !== "per-entry") return null;
+  if (!Array.isArray(latest.bare_names)) return null;
+  return new Set(latest.bare_names.filter((name) => typeof name === "string"));
+}
 
 // src/scripts/skill_tools/score_skill_relevance.ts
 import * as fs66 from "node:fs";
@@ -27874,22 +28023,45 @@ var TOP_K = 3;
 function _isObject15(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function routePointers(prompt, skillsDir) {
-  if (skillsDir === null) return [];
+function knownBareForHost(workspaceRoot2, host) {
+  if (host === null || host === "") return null;
   try {
-    if (_tokenize(prompt).size < MIN_TASK_TERMS) return [];
+    return knownBareNames(readObservationLog(path68.join(workspaceRoot2, OBSERVATION_LOG)), host);
   } catch {
-    return [];
+    return null;
+  }
+}
+function filterKnownBare(rows, bare) {
+  if (bare === null || bare.size === 0) return [...rows];
+  return rows.filter(([name]) => !bare.has(name));
+}
+function routeDecision(prompt, skillsDir, bareProvider) {
+  const silent = { rows: [], suppressed: 0 };
+  if (skillsDir === null) return silent;
+  try {
+    if (_tokenize(prompt).size < MIN_TASK_TERMS) return silent;
+  } catch {
+    return silent;
   }
   let rows;
   try {
     rows = rank(prompt, skillsDir);
   } catch {
-    return [];
+    return silent;
   }
-  const top = rows[0];
-  if (top === void 0 || top[1] < MIN_TOP_SCORE) return [];
-  return rows.slice(0, TOP_K);
+  let bare = null;
+  if (bareProvider !== void 0) {
+    try {
+      bare = bareProvider();
+    } catch {
+      bare = null;
+    }
+  }
+  const deliverable = filterKnownBare(rows, bare);
+  const suppressed = bare === null ? 0 : rows.slice(0, TOP_K).filter(([name]) => bare.has(name)).length;
+  const top = deliverable[0];
+  if (top === void 0 || top[1] < MIN_TOP_SCORE) return { rows: [], suppressed };
+  return { rows: deliverable.slice(0, TOP_K), suppressed };
 }
 function buildRouteLine(rows) {
   const pointers = rows.map(([name, score]) => `${name} (${score})`).join(", ");
@@ -27922,12 +28094,21 @@ function main43() {
   const prompt = _extractPrompt3(payload);
   if (!prompt) return EXIT_ALLOW18;
   if (isSyntheticPrompt(prompt)) return EXIT_ALLOW18;
-  const rows = routePointers(prompt, resolveSkillsRoot(_workspaceRoot4(env)));
+  const root = _workspaceRoot4(env);
+  const platform = env["platform"];
+  const host = typeof platform === "string" && platform ? platform : null;
+  const { rows, suppressed } = routeDecision(
+    prompt,
+    resolveSkillsRoot(root),
+    () => knownBareForHost(root, host)
+  );
   if (rows.length === 0) return EXIT_ALLOW18;
   process.stdout.write(
     `${JSON.stringify({
       decision: "warn",
-      reason: `skill-route: ${rows.length} pointer(s), top ${rows[0][1]}/100`,
+      reason: `skill-route: ${rows.length} pointer(s), top ${rows[0][1]}/100` + // The suppression metric's numerator. Named only when non-zero, so the
+      // common line keeps its shape and its registered byte budget.
+      (suppressed > 0 ? `, ${suppressed} suppressed as host-bare` : ""),
       additional_context: buildRouteLine(rows)
     })}
 `
@@ -28499,12 +28680,12 @@ function resolveDepth(parentRef, open) {
   if (!parent) return { depth: 2, depth_basis: "asserted-parent" };
   return { depth: parent.depth + 1, depth_basis: "observed" };
 }
-function ledgerFileFor(root, ts) {
+function ledgerFileFor2(root, ts) {
   return path70.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
 }
 function appendLedgerLine(root, ts, line) {
   if (is_replay_mode()) return;
-  const file = ledgerFileFor(root, ts);
+  const file = ledgerFileFor2(root, ts);
   fs69.mkdirSync(path70.dirname(file), { recursive: true });
   fs69.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");

package/dist/mcp/registry-manifest.json

@@ -9,7 +9,7 @@
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "14.0.0"
+    "version": "14.2.0"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "14.0.0"
+      "version": "14.2.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "14.0.0"
+  "version": "14.2.0"
 }

package/dist/mcp/server.mjs

@@ -34092,6 +34092,21 @@ var init_language_mirror_hook = __esm({
 import fs55 from "node:fs";
 import path56 from "node:path";
 import { fileURLToPath as fileURLToPath31, pathToFileURL as pathToFileURL20 } from "node:url";
+function sessionSlug(session_id) {
+  return session_id.replace(/[^A-Za-z0-9._-]/gu, "_").slice(0, 80);
+}
+function ledgerFileFor(session_id) {
+  if (!session_id) {
+    return STATE_FILE2;
+  }
+  return path56.join(STATE_DIR, `${sessionSlug(session_id)}.json`);
+}
+function pendingFileFor(session_id) {
+  if (!session_id) {
+    return PENDING_FILE;
+  }
+  return path56.join(PENDING_DIR, `${sessionSlug(session_id)}.json`);
+}
 function _isObject4(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -34110,6 +34125,18 @@ function isInterrogative(prose) {
     t
   );
 }
+function isAffirmative(prose) {
+  const t = prose.trim().replace(/[.!]+$/u, "");
+  if (!t || t.length > 24) {
+    return false;
+  }
+  if (isInterrogative(t)) {
+    return false;
+  }
+  return /^(?:option\s*)?\d{1,2}[.)]?$/iu.test(t) || /^(ja|jo|jep|yes|yep|yeah|ok|okay|okey|klar|passt|gut|los|go|go ahead|mach|mach das|mach es|leg los|do it|proceed|bitte)$/iu.test(
+    t
+  );
+}
 function splitFences(prompt) {
   const fences = [];
   const prose = prompt.replace(/```[^\n]*\n([\s\S]*?)```/g, (_m, body) => {
@@ -34148,6 +34175,40 @@ function classifyAuthorization(prompt) {
   }
   return { authorized: [...authorized], evidence };
 }
+function takePending(consumer_root, session_id, now) {
+  const file = path56.join(consumer_root, pendingFileFor(session_id));
+  let raw;
+  try {
+    raw = fs55.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    fs55.rmSync(file, { force: true });
+  } catch {
+  }
+  try {
+    const decoded = JSON.parse(raw);
+    if (!_isObject4(decoded)) {
+      return null;
+    }
+    const op = decoded["op"];
+    if (typeof op !== "string" || !ALL_OPS.includes(op)) {
+      return null;
+    }
+    const recorded = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+    if (session_id && recorded && recorded !== session_id) {
+      return null;
+    }
+    const at = Date.parse(String(decoded["refused_at"] ?? ""));
+    if (!Number.isFinite(at) || now - at > PENDING_MAX_AGE_MS) {
+      return null;
+    }
+    return { op, session_id: recorded, refused_at: String(decoded["refused_at"]) };
+  } catch {
+    return null;
+  }
+}
 function run2(stdin_text, options) {
   let envelope = {};
   if (stdin_text.trim()) {
@@ -34173,6 +34234,12 @@ function run2(stdin_text, options) {
     return EXIT_ALLOW2;
   }
   const { authorized, evidence } = classifyAuthorization(prompt);
+  const session = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
+  const pending = takePending(options.consumer_root, session, Date.now());
+  if (pending && !authorized.includes(pending.op) && isAffirmative(prompt)) {
+    authorized.push(pending.op);
+    evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
+  }
   const ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
     detected_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -34181,7 +34248,7 @@ function run2(stdin_text, options) {
     prompt_chars: prompt.length
   };
   try {
-    atomic_write_json(path56.join(options.consumer_root, STATE_FILE2), ledger);
+    atomic_write_json(path56.join(options.consumer_root, ledgerFileFor(session)), ledger);
   } catch {
   }
   return EXIT_ALLOW2;
@@ -34219,7 +34286,7 @@ function _isCliEntry18() {
     return false;
   }
 }
-var EXIT_ALLOW2, STATE_FILE2, PHRASES, OUTPUT_LINE, PASTED_COMMANDS;
+var EXIT_ALLOW2, STATE_FILE2, STATE_DIR, PENDING_DIR, PENDING_FILE, PENDING_MAX_AGE_MS, ALL_OPS, PHRASES, OUTPUT_LINE, PASTED_COMMANDS;
 var init_git_authorization_hook = __esm({
   "src/scripts/git_authorization_hook.ts"() {
     "use strict";
@@ -34227,6 +34294,20 @@ var init_git_authorization_hook = __esm({
     init_hook_stdin();
     EXIT_ALLOW2 = 0;
     STATE_FILE2 = path56.join("agents", "state", "git-authorization.json");
+    STATE_DIR = path56.join("agents", "state", "git-authorization");
+    PENDING_DIR = path56.join("agents", "state", "git-authorization-pending");
+    PENDING_FILE = path56.join("agents", "state", "git-authorization-pending.json");
+    PENDING_MAX_AGE_MS = 10 * 60 * 1e3;
+    ALL_OPS = [
+      "commit",
+      "push",
+      "branch",
+      "pr-create",
+      "pr-merge",
+      "tag",
+      "release",
+      "publish"
+    ];
     PHRASES = [
       { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
       { op: "push", re: /\b(push(e|en|t)?|hochladen|hochschieben|raufschieben)\b/i },
@@ -34456,17 +34537,30 @@ function commandOp(command) {
   return found;
 }
 function _loadLedger(consumer_root, session_id, now) {
+  const candidates = [ledgerFileFor(session_id)];
+  if (!candidates.includes(STATE_FILE2)) {
+    candidates.push(STATE_FILE2);
+  }
+  for (const rel of candidates) {
+    const found = _readLedgerFile(path57.join(consumer_root, rel), session_id, now);
+    if (found !== null) {
+      return found;
+    }
+  }
+  return { authorized: /* @__PURE__ */ new Set(), present: false };
+}
+function _readLedgerFile(file, session_id, now) {
   try {
-    const raw = fs56.readFileSync(path57.join(consumer_root, STATE_FILE2), "utf8");
+    const raw = fs56.readFileSync(file, "utf8");
     const decoded = JSON.parse(raw);
     if (_isObject5(decoded) && Array.isArray(decoded["authorized"])) {
       const ledgerSession = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
       if (session_id && ledgerSession && ledgerSession !== session_id) {
-        return { authorized: /* @__PURE__ */ new Set(), present: false };
+        return null;
       }
       const at = Date.parse(String(decoded["detected_at"] ?? ""));
       if (Number.isFinite(at) && now - at > LEDGER_MAX_AGE_MS) {
-        return { authorized: /* @__PURE__ */ new Set(), present: false };
+        return null;
       }
       return {
         authorized: new Set(decoded["authorized"].filter(Boolean)),
@@ -34475,7 +34569,7 @@ function _loadLedger(consumer_root, session_id, now) {
     }
   } catch {
   }
-  return { authorized: /* @__PURE__ */ new Set(), present: false };
+  return null;
 }
 function decide(command, ledger) {
   if (command === null) {
@@ -34489,7 +34583,7 @@ function decide(command, ledger) {
   if (BLOCK_OPS.has(op)) {
     const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}. Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
     return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}
-` };
+`, blockedOp: op };
   }
   if (WARN_OPS.has(op)) {
     const reason = `No \`${op}\` authorization found in this turn's prompt (commit-policy: a one-shot authorization is spent on the operation it named). If the user did authorize it this turn, proceed; otherwise stop and ask. Command: ${shown}`;
@@ -34519,6 +34613,16 @@ function run3(stdin_text, options) {
     extractCommand(envelope),
     _loadLedger(options.consumer_root, session_id, Date.now())
   );
+  if (decision.blockedOp) {
+    try {
+      atomic_write_json(path57.join(options.consumer_root, pendingFileFor(session_id)), {
+        op: decision.blockedOp,
+        session_id,
+        refused_at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    } catch {
+    }
+  }
   if (decision.stdout) {
     process.stdout.write(decision.stdout);
   }
@@ -34565,6 +34669,7 @@ var init_block_unauthorized_git = __esm({
   "src/scripts/hooks/block_unauthorized_git.ts"() {
     "use strict";
     init_hook_stdin();
+    init_state_io();
     init_git_authorization_hook();
     EXIT_ALLOW3 = 0;
     EXIT_BLOCK = 1;
@@ -35610,12 +35715,12 @@ function resolveDepth(parentRef, open) {
   if (!parent) return { depth: 2, depth_basis: "asserted-parent" };
   return { depth: parent.depth + 1, depth_basis: "observed" };
 }
-function ledgerFileFor(root, ts) {
+function ledgerFileFor2(root, ts) {
   return path60.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
 }
 function appendLedgerLine(root, ts, line) {
   if (is_replay_mode()) return;
-  const file = ledgerFileFor(root, ts);
+  const file = ledgerFileFor2(root, ts);
   fs59.mkdirSync(path60.dirname(file), { recursive: true });
   fs59.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.0.0",
+    "version": "14.2.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/config/gate-violation-baselines.json

@@ -34,9 +34,9 @@
       "note": "Markdown links between source artefacts that cross a pack boundary the source pack's `requires` graph does not reach — revealed when the scan root moved off the deleted packages/ tree to the live corpus (0 -> 753 artefacts scanned). 82 distinct pack pairs across 131 source files; largest single class is engineering-base -> meta (73), skills in a consumer-installable pack citing this package's own maintenance skills. Each is a link that dangles for a consumer who installs the source pack without the target's. Judged real drift rather than an over-strict gate because it is long-tailed — top bucket 22%, no single systematic cause — unlike the lint_artefact_frontmatter case, where one required shape had 0-of-288 adoption. Fix per finding: add the edge to packs.yml requires, retarget the link, or move the artefact."
     },
     "check_gate_completeness": {
-      "count": 216,
-      "landed": "2026-08-12",
-      "note": "Ledger adoption ratchet. 216 of 244 registered gates do not yet carry per-target completeness accounting (`_lib/gate_ledger.ts`) or a `// ledger-exempt:` marker. This is deliberately NOT a sweep: road-to-skill-ecosystem-gate-integrity Phase 1 adopts exactly three gates (lint_framework_leakage, check_references, lint_roadmap_complexity) plus the checker itself to prove the interface, and the remainder migrates as gates are touched. Shrink-only from here — the number may not grow, so a NEW gate must adopt or exempt.",
+      "count": 215,
+      "landed": "2026-08-17",
+      "note": "Ledger adoption ratchet. Gates registered under the CI task roots that carry neither per-target completeness accounting (`_lib/gate_ledger.ts`) nor a `// ledger-exempt:` marker. This is deliberately NOT a sweep: road-to-skill-ecosystem-gate-integrity Phase 1 adopts exactly three gates (lint_framework_leakage, check_references, lint_roadmap_complexity) plus the checker itself to prove the interface, and the remainder migrates as gates are touched. Shrink-only from here — the number may not grow, so a NEW gate must adopt or exempt. Lowered 216 -> 215 on 2026-08-17 by discharging the obligation three NEW arrivals had incurred, which is the standing rule being enforced rather than a drain: the registered population grew 244 -> 258 and three of the fourteen arrivals adopted nothing — `build_archive_index`, `check_gate_coverage`, `check_pr_ci_current`. The reading was 218 against this baseline of 216, and the missing arithmetic is that one PRE-existing gate (`lint_rule_skill_pack_reach`) had adopted in the meantime: 216 + 3 - 1 = 218. All three adopted a real ledger. `check_pr_ci_current` first took a reasoned exemption claiming no target population; the completion review refuted it from the file itself — the check rows ARE a population, and rows whose `state` is not a string were being dropped before any verdict ran, so a dropped row could be the failing one. The exemption was withdrawn and the ledger adopted, counting kept rows as read, dropped rows as skips, and rows a pre-row verdict never reached as out of scope. The denominator in this note was 14 stale (it said 244) and is now expressed without one, because a count pinned to a population that grows weekly rots faster than the count itself. Note what this lowering does NOT buy: headroom is zero either way, so the next un-adopted arrival reds this gate immediately — which is the intended behaviour and the reason the number is not padded. The refreshed `landed` is load-bearing rather than bookkeeping: `checkRatchet` returns `improved` BEFORE it evaluates staleness, so an entry left at 216 while the tree measures 215 would never expire at any age (pinned by tests/lib/gate_baseline.test.ts, which asserts `improved` at landed + STALE_AFTER_DAYS + 400 days) — the greenest available state and the worst, since it switches off the anti-fossilization clause exactly when someone has done real work.",
       "falsifier": "./scripts-run src/scripts/check_gate_completeness"
     },
     "check_depth_budget": {

package/src/config/hook-token-budget.json

@@ -56,6 +56,12 @@
             "instrument": "rule-trips.json warn counters for the skill-route concern (fires) + conformance audits for whether the pointed-at skill was opened (adoption); HONEST GAP: no deterministic counter exists for 'the agent acted on the pointer' - the numerator is audit-carried and registered as such rather than implied to be automatic",
             "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
         },
+        "skill_route_bare_suppression_rate": {
+            "definition": "road-to-catalogue-host-fit Phase 3 step 3.2: of the prompts where skill-route FIRES, the share whose warn reason carries `N suppressed as host-bare` - i.e. how often a skill the ranker wanted to POINT AT is one the current host is KNOWN to have delivered without its description. `N` counts the pointer window (TOP_K of the unfiltered ranking), never the whole ranked list: `rank` returns every non-zero-scoring skill, so counting the tail would let a bare name at rank 40 - never pointable, never a loss - bump the count on nearly every fire (R2 finding 1). Registered beside skill_route_pointer_rate because it measures the same concern's behaviour under the same owner and review date. NO THRESHOLD IS COMMITTED, and the refusal is inherited from the sibling rather than restated: the FILTER is derived from a measurement (all 16 bare entries in the 2026-08-12 claude observation are in the ranker's catalogue, `capture_skill_catalogue --pointable-bare`), the OUTCOME - whether suppressing them changes what the agent does - is not.",
+            "instrument": "the dispatcher's warn reason string for the skill-route concern (`, N suppressed as host-bare`, appended only when non-zero) + agents/evidence/metrics/skill-catalogue.jsonl for the population; TWO HONEST GAPS, both registered as gaps rather than implied to be automatic. (1) rule-trips.json counts fires per concern and does NOT retain the reason, so the numerator is log-carried, not counter-carried - the same posture the sibling metric takes for its own audit-carried numerator. (2) TOTAL suppression is INVISIBLE here by construction (R2 finding 4): when the filter empties the pointer set the concern returns before writing stdout, so no reason line exists for the one case the roadmap calls load-bearing. `RouteDecision.suppressed` carries it at the API boundary and nothing reads that in production.",
+            "threshold": "none committed before data - baseline first, threshold at the shared review date (2026-11-10)",
+            "falsifiers": "For the FILTER half only, never for the outcome. UPPER: a live rate far above the share of the pointer window the host degrades means the ranker preferentially ranks exactly what the host drops - a finding about the projection, which belongs to Phase 2. Name the populations rather than a bare ratio, because three different denominators are in play and an earlier draft of this row conflated them (R2 finding 11): the 2026-08-12 claude observation carries `entries_total` 336, of which only 35 were enumerated at all (16 bare + 19 described), against a ranker catalogue of 338 entries at probe time. The comparable share is 16 of the 35 ENUMERATED entries; 16/336 and 16/338 describe different things and neither is this metric's denominator. LOWER: a rate of 0 does NOT establish that the ranker and the host's bare set fail to intersect - gap (2) above makes complete suppression indistinguishable from no suppression in this instrument. `capture_skill_catalogue --pointable-bare` is the instrument that separates them, and it must be read before any zero here is interpreted."
+        },
         "full_rewrite_small_diff_rate": {
             "definition": "edit-shape fires / Write calls per session (the full-rewrite-with-small-diff rate). Kill criterion per the shipped nudge standard: a nudge whose verdicts are measurably ignored (adoption near zero over the review window, from conformance audits) gets its trigger tightened or the injected line removed.",
             "instrument": "rule-trips.json warn counters (the dispatcher already counts every warn per concern) + conformance audits for adoption"

package/src/scripts/_lib/gate_ledger.ts

@@ -57,7 +57,9 @@ export type GateSkipReason =
     | 'generated_artifact'
     | 'dead_scan_root'
     | 'declared_exemption'
-    | 'not_applicable_kind';
+    | 'not_applicable_kind'
+    | 'precondition_unmet'
+    | 'check_did_not_run';
 
 /**
  * One sentence per skip code, printed verbatim in the ledger's own output.
@@ -79,6 +81,8 @@ export const SKIP_REASON_MESSAGE: Record<GateSkipReason, string> = {
     dead_scan_root: 'the root this target was enumerated from no longer exists',
     declared_exemption: 'the target carries an explicit, reviewable exemption from this check',
     not_applicable_kind: 'the target is a kind of artifact this check does not apply to',
+    precondition_unmet: 'a precondition of this run settled the verdict before the target could be inspected',
+    check_did_not_run: 'the check itself could not be executed, so the target was never read',
 };
 
 /** Terminal outcomes a planned target can reach. Exactly one, exactly once. */