@event4u/agent-config 14.11.0 → 14.12.0

package/src/scripts/report_pack_delta.ts

@@ -0,0 +1,204 @@
+#!/usr/bin/env tsx
+/**
+ * Branch-vs-base packed-payload delta — make accretion legible while it is small.
+ *
+ * WHY, and this is the whole argument: the 2026-08-24 cap trip was a **merge
+ * artifact**. `origin/main` measured 8.3911 and the branch 8.4305, against a cap
+ * of 8.4 — *neither side was over alone*, and together they crossed. No
+ * per-branch absolute check can see that shape, which is why the cap had to be
+ * re-baselined rather than the payload fixed. `check_pack_size` answers "is the
+ * total under the cap"; this answers "how much did THIS branch add", which is
+ * the number that would have made the accretion visible four raises ago.
+ *
+ * It is a REPORT, not a gate. It prints a delta and exits 0 whatever the number,
+ * because a threshold here would be a second cap with no derivation behind it
+ * and the absolute cap already owns the refusal. `--fail-over <MB>` exists for a
+ * caller that wants one, and is deliberately not wired into CI.
+ *
+ * Measurement matches `pack-size-budget.json`'s documented conditions exactly —
+ * `npm pack --dry-run --json --ignore-scripts` on an unbuilt tree — because a
+ * delta between two figures measured differently is noise. Both sides are
+ * measured in throwaway detached worktrees for the same reason: a built working
+ * tree reads ~2 MB high, which the budget file records as a trap its own method
+ * invites.
+ *
+ * ```bash
+ *   report_pack_delta                      # vs origin/main
+ *   report_pack_delta --base origin/main --head HEAD
+ *   report_pack_delta --json
+ *   report_pack_delta --markdown           # a PR-comment / step-summary block
+ * ```
+ *
+ * Exit codes: 0 = reported · 2 = could not measure (a missing ref, a failed
+ * pack). Never non-zero for a large delta unless `--fail-over` says so.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const _FILE = fileURLToPath(import.meta.url);
+const REPO = path.resolve(path.dirname(_FILE), '..', '..');
+
+export interface Side {
+    readonly ref: string;
+    readonly packedBytes: number;
+    readonly unpackedBytes: number;
+    readonly entries: number;
+}
+
+export interface Delta {
+    readonly base: Side;
+    readonly head: Side;
+    readonly packedDeltaBytes: number;
+    readonly entryDelta: number;
+    readonly capMb: number | null;
+    readonly headroomBytes: number | null;
+}
+
+const run = (cmd: string, args: readonly string[], cwd: string): { code: number; out: string; err: string } => {
+    const r = spawnSync(cmd, [...args], {
+        cwd,
+        encoding: 'utf8',
+        timeout: 600_000,
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    return { code: r.status ?? 1, out: r.stdout ?? '', err: r.stderr ?? '' };
+};
+
+/** Measure one ref in a throwaway detached worktree, unbuilt. */
+export function measure(ref: string): Side {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ac-pack-delta-'));
+    const tree = path.join(dir, 'tree');
+    try {
+        const add = run('git', ['worktree', 'add', '--quiet', '--detach', tree, ref], REPO);
+        if (add.code !== 0) throw new Error(`cannot check out ${ref}: ${add.err.trim()}`);
+        const packed = run('npm', ['pack', '--dry-run', '--json', '--ignore-scripts'], tree);
+        if (packed.code !== 0) throw new Error(`npm pack failed for ${ref}: ${packed.err.slice(-600)}`);
+        const start = packed.out.indexOf('[');
+        if (start === -1) throw new Error(`npm pack produced no JSON for ${ref}`);
+        const meta = JSON.parse(packed.out.slice(start)) as Array<{
+            size: number;
+            unpackedSize: number;
+            entryCount: number;
+        }>;
+        const m = meta[0];
+        if (m === undefined) throw new Error(`npm pack produced no entry for ${ref}`);
+        return { ref, packedBytes: m.size, unpackedBytes: m.unpackedSize, entries: m.entryCount };
+    } finally {
+        run('git', ['worktree', 'remove', '--force', tree], REPO);
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+
+function readCap(): number | null {
+    try {
+        const raw = fs.readFileSync(path.join(REPO, 'src', 'config', 'pack-size-budget.json'), 'utf8');
+        const d = JSON.parse(raw) as { budgets?: { packed_size_mb?: { max?: number } } };
+        const max = d.budgets?.packed_size_mb?.max;
+        return typeof max === 'number' ? max : null;
+    } catch {
+        return null;
+    }
+}
+
+export function delta(baseRef: string, headRef: string): Delta {
+    const base = measure(baseRef);
+    const head = measure(headRef);
+    const capMb = readCap();
+    return {
+        base,
+        head,
+        packedDeltaBytes: head.packedBytes - base.packedBytes,
+        entryDelta: head.entries - base.entries,
+        capMb,
+        headroomBytes: capMb === null ? null : Math.round(capMb * 1e6 - head.packedBytes),
+    };
+}
+
+const kb = (n: number): string => `${(n / 1024).toFixed(1)} KB`;
+const mb = (n: number): string => `${(n / 1e6).toFixed(4)} MB`;
+const signed = (n: number): string => `${n >= 0 ? '+' : '−'}${kb(Math.abs(n))}`;
+
+export function markdown(d: Delta): string {
+    const dir = d.packedDeltaBytes === 0 ? 'unchanged' : d.packedDeltaBytes > 0 ? 'grew' : 'shrank';
+    const lines = [
+        `**Packed payload ${dir}: ${signed(d.packedDeltaBytes)}**`,
+        '',
+        '| | packed | entries |',
+        '|---|---|---|',
+        `| base \`${d.base.ref}\` | ${mb(d.base.packedBytes)} | ${d.base.entries} |`,
+        `| head \`${d.head.ref}\` | ${mb(d.head.packedBytes)} | ${d.head.entries} |`,
+        `| delta | **${signed(d.packedDeltaBytes)}** | ${d.entryDelta >= 0 ? '+' : ''}${d.entryDelta} |`,
+    ];
+    if (d.capMb !== null && d.headroomBytes !== null) {
+        lines.push(
+            '',
+            `Cap ${d.capMb} MB · headroom after this branch **${kb(d.headroomBytes)}**.`,
+            '',
+            '<sub>Measured `npm pack --dry-run --ignore-scripts` on unbuilt detached worktrees of both refs — the ' +
+                'conditions `pack-size-budget.json` documents. A report, not a gate: the absolute cap owns the refusal. ' +
+                'This line exists because the 2026-08-24 trip was a MERGE artifact — neither side was over alone.</sub>',
+        );
+    }
+    return lines.join('\n');
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    const arg = (name: string, dflt: string): string => {
+        const i = argv.indexOf(name);
+        return i !== -1 && argv[i + 1] !== undefined ? (argv[i + 1] as string) : dflt;
+    };
+    const baseRef = arg('--base', 'origin/main');
+    const headRef = arg('--head', 'HEAD');
+    const failOver = arg('--fail-over', '');
+
+    let d: Delta;
+    try {
+        d = delta(baseRef, headRef);
+    } catch (exc) {
+        process.stderr.write(`report_pack_delta: ${String(exc)}\n`);
+        return 2;
+    }
+
+    if (argv.includes('--json')) {
+        process.stdout.write(`${JSON.stringify(d, null, 2)}\n`);
+    } else if (argv.includes('--markdown')) {
+        process.stdout.write(`${markdown(d)}\n`);
+    } else {
+        process.stdout.write(
+            `pack delta ${baseRef} → ${headRef}: ${signed(d.packedDeltaBytes)} ` +
+                `(${mb(d.base.packedBytes)} → ${mb(d.head.packedBytes)}, ` +
+                `${d.entryDelta >= 0 ? '+' : ''}${d.entryDelta} entries)\n`,
+        );
+        if (d.capMb !== null && d.headroomBytes !== null) {
+            process.stdout.write(`  cap ${d.capMb} MB · headroom ${kb(d.headroomBytes)}\n`);
+        }
+    }
+    // `scanned:` per the gate-coverage contract — two refs is what it inspected.
+    process.stdout.write('scanned: 2\n');
+
+    if (failOver !== '') {
+        const limit = Number(failOver) * 1e6;
+        if (Number.isFinite(limit) && d.packedDeltaBytes > limit) {
+            process.stderr.write(`report_pack_delta: delta ${kb(d.packedDeltaBytes)} exceeds --fail-over ${failOver} MB\n`);
+            return 1;
+        }
+    }
+    return 0;
+}
+
+function _isCliEntry(): boolean {
+    const a = process.argv[1];
+    if (!a) return false;
+    if (a === _FILE || pathToFileURL(path.resolve(a)).href === import.meta.url) return true;
+    try {
+        return fs.realpathSync(a) === fs.realpathSync(_FILE);
+    } catch {
+        return false;
+    }
+}
+if (_isCliEntry()) process.exit(main());
+
+export { REPO };

package/src/scripts/select_analysis_mode.ts

@@ -0,0 +1,112 @@
+#!/usr/bin/env tsx
+/**
+ * `select_analysis_mode` — full analysis, or a targeted delta?
+ *
+ * `project-analysis-core` writes an artefact per analysed target under the
+ * `agents/knowledge/concepts/` convention. Re-running it against a target that
+ * already has one rewrites a page that mostly still holds, which costs a full
+ * read of the codebase to reproduce conclusions already on disk.
+ *
+ * This decides which path to take, and it decides ONE thing only: write
+ * economics. It does NOT change the trust status of the existing artefact.
+ * A concept page is a hypothesis cache, never truth (`context-document`,
+ * `source-discovery-gate` § v1↔v2 isolation), so the delta path still
+ * re-verifies every structural claim it carries forward against a live source.
+ * A cheaper write is not a licence to trust a cached read.
+ *
+ * Exit codes: 0 always — this is a router, not a gate. The answer is on stdout.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const HERE = fileURLToPath(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(HERE), '..', '..');
+
+/** Where `/team-knowledge consolidate` lands concept pages. */
+export const CONCEPTS_DIR = 'agents/knowledge/concepts';
+
+export type AnalysisMode = 'full' | 'delta';
+
+export interface ModeVerdict {
+    mode: AnalysisMode;
+    /** The artefact the delta path would update, repo-relative. Null on `full`. */
+    artefact: string | null;
+    /** One sentence, printed — why this path. */
+    reason: string;
+}
+
+/** `Auth Module` / `auth-module` / `auth module` all address the same page. */
+export function slugify(target: string): string {
+    return target
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+
+/**
+ * Does a concept page for this target already exist?
+ *
+ * Matched on the slug, so the caller's phrasing does not decide the answer. An
+ * EMPTY file is deliberately treated as absent: a zero-byte page carries no
+ * conclusions to delta against, and taking the delta path on one would produce
+ * an update of nothing while reporting a saving.
+ */
+export function selectAnalysisMode(target: string, root: string = REPO_ROOT): ModeVerdict {
+    const slug = slugify(target);
+    if (slug === '') {
+        return {
+            mode: 'full',
+            artefact: null,
+            reason: 'the target resolves to an empty slug, so no artefact can be addressed',
+        };
+    }
+    const dir = path.join(root, CONCEPTS_DIR);
+    const candidate = path.join(dir, `${slug}.md`);
+    let stat: fs.Stats;
+    try {
+        stat = fs.statSync(candidate);
+    } catch {
+        return {
+            mode: 'full',
+            artefact: null,
+            reason: `no ${CONCEPTS_DIR}/${slug}.md — nothing to delta against`,
+        };
+    }
+    if (!stat.isFile() || stat.size === 0) {
+        return {
+            mode: 'full',
+            artefact: null,
+            reason: `${CONCEPTS_DIR}/${slug}.md is empty — it carries no conclusions to carry forward`,
+        };
+    }
+    return {
+        mode: 'delta',
+        artefact: path.join(CONCEPTS_DIR, `${slug}.md`),
+        reason:
+            `${CONCEPTS_DIR}/${slug}.md exists (${String(stat.size)} bytes) — read it first and ` +
+            'analyse the gaps, stale sections and new patterns, not the whole tree. Its ' +
+            'structural claims are still re-verified against a live source.',
+    };
+}
+
+export function main(argv: string[] = process.argv.slice(2), root = REPO_ROOT): number {
+    const target = argv.filter((a) => !a.startsWith('--')).join(' ');
+    if (target === '') {
+        process.stderr.write('usage: select_analysis_mode <target>\n');
+        return 2;
+    }
+    const v = selectAnalysisMode(target, root);
+    if (argv.includes('--json')) {
+        process.stdout.write(`${JSON.stringify(v)}\n`);
+    } else {
+        process.stdout.write(`${v.mode}: ${v.reason}\n`);
+    }
+    return 0;
+}
+
+if (path.resolve(process.argv[1] ?? '') === path.resolve(HERE)) {
+    process.exit(main());
+}

package/src/scripts/sync_pr_branch.ts

@@ -83,6 +83,44 @@ const GENERATED = [
     // measured for road-to-merge-hotspot-drawdown. Regenerate; never merge.
     'agents/roadmaps/archive/INDEX.md',
     'agents/roadmaps/archive/index.json',
+    // ── Added 2026-08-25 (road-to-merge-surface-zero 1.1). Each carries its
+    // write site, because this list tells a human to DISCARD one side, and an
+    // entry added on a conflict count alone would tell them to discard hand
+    // work. Counts are from `pr_conflict_census --limit 2000` over 60 days.
+    //
+    // Written by `build_proof.ts:500` from `docs/CLAIMS.md`. 26 resolutions, and
+    // it fails in pairs: a CLAIMS.md edit leaves it stale, which reds both the
+    // drift-guard test and `demo-commands-still-pass`.
+    'docs/proof.md',
+    // Both written by `generate_catalog.ts` (`:166` for llms.txt) from SKILL.md
+    // frontmatter. Neither has ever been hand-authored.
+    'docs/skills-catalog.md',
+    'llms.txt',
+    // Written by `lint_originality.ts:340`. Named by step 1.1 and included
+    // although the census found ZERO conflicts on it in either window — it is
+    // genuinely generated and classifying it costs nothing. Recorded rather than
+    // quietly dropped: the step named it on conflict frequency, and that premise
+    // does not hold.
+    'agents/reports/originality.json',
+    'agents/reports/originality.md',
+];
+
+/**
+ * Generated paths a literal cannot express.
+ *
+ * `isGenerated` matches on equality or a trailing-slash prefix, so a per-pack
+ * manifest needs a pattern. Kept as a separate named list rather than by
+ * loosening the literal matcher: a glob inside the array above would make every
+ * future entry ambiguous about which kind of match it asks for.
+ */
+const GENERATED_PATTERNS: readonly { readonly re: RegExp; readonly why: string }[] = [
+    {
+        // `generate_pack_manifests.ts:427`, and the file's own first line reads
+        // "Generated by scripts/generate_pack_manifests.ts — DO NOT EDIT BY
+        // HAND". 12 resolutions over 60 days across two packs.
+        re: /^src\/domains\/[^/]+\/pack\.yaml$/,
+        why: 'per-pack manifest written by generate_pack_manifests.ts',
+    },
 ];
 
 /**
@@ -159,7 +197,8 @@ export function isUntrackedByDesign(rel: string): boolean {
 
 export function isGenerated(rel: string): boolean {
     const norm = rel.replace(/\\/g, '/');
-    return GENERATED.some((g) => (g.endsWith('/') ? norm.startsWith(g) : norm === g));
+    if (GENERATED.some((g) => (g.endsWith('/') ? norm.startsWith(g) : norm === g))) return true;
+    return GENERATED_PATTERNS.some((p) => p.re.test(norm));
 }
 
 /**

package/src/server/schemas/settings.ts

@@ -526,6 +526,11 @@ export const settingsSchema = z.object({
                 'PreToolUse code-graph nudge (ADR-124 Phase 4). Default off. When on AND a native code-graph cache or a consumer-shipped graph.json/SCIP index is present, warns once per session (never blocks) as the agent is about to Grep/Glob or Read a source file — query the graph first for who-calls/where-used/impact questions (or rebuild if stale, build if absent). Source G’s strict block-first-read mode is deliberately un-ported.',
             ),
         }).default({}),
+        suggestion_capture: z.object({
+            enabled: z.boolean().default(false).describe(
+                'Suggestion-block capture (road-to-suggestion-block-capture Phase 2). Default off. Two slots: `stop` reads `last_assistant_message` — a payload field, so no transcript file is read — and latches that the assistant turn carried a numbered-options block; `user_prompt_submit` CONSUMES that latch and classifies the answering turn as option_n / as_is / other / stale_block. Consume-once is the correctness guard: the latch is deleted on read, so a bare "1" three turns later meets no latch and classifies `other`, and a latch past its TTL or unparseable is `stale_block` rather than a guess. Writes COUNTS ONLY to agents/runtime/state/audit/suggestion-capture.jsonl — the record type has no field able to hold a prompt, an option label or a command name, and a test asserts the written key set against src/config/suggestion-capture.json. Off by default because this is an INSTRUMENT rather than a feature: it exists so a capture rate can be measured on a maintainer workspace over a fixed soak window, and there is nothing in it for a consumer to gain.',
+            ),
+        }).default({}),
         // `turn_end_gate` is deliberately ABSENT. The stop-slot turn-end gate is
         // always armed (2026-08-12) and has no settings surface: whether it
         // fires is decided by each detector's own trigger conditions, not by a

package/dist/agent-src/skills/accessibility-auditor/evals/evals.json

@@ -1,15 +0,0 @@
-{
-  "skill": "accessibility-auditor",
-  "_calibration": "Behavioural fixtures (road-to-skill-eval-coverage Phase 2, rich set). Deterministic `contains` asserts a real WCAG audit property (the standard is cited); finding_floor n=2 is a conservative floor (an icon-button with no name + a placeholder-only input surface ≥2 issues), not a calibrated per-host number; the rubric names the specific missing control as a pinned-judge known-limit.",
-  "scenarios": [
-    {
-      "id": "audit-icon-button-and-placeholder-input",
-      "prompt": "Audit this UI for accessibility and list each issue as its own bullet point:\n```html\n<button onclick=\"save()\"><svg width=\"16\" height=\"16\"></svg></button>\n<input type=\"text\" placeholder=\"Email address\">\n```",
-      "assertions": [
-        { "kind": "finding_floor", "n": 2, "pattern": "(?m)^\\s*[-*+]\\s+" },
-        { "kind": "contains", "value": "WCAG" },
-        { "kind": "rubric", "criterion": "Names the icon-only button's missing accessible name (aria-label / visible label) AND the placeholder-not-a-label problem on the input." }
-      ]
-    }
-  ]
-}

package/dist/agent-src/skills/agent-security-review/evals/triggers.json

@@ -1,52 +0,0 @@
-{
-    "skill": "agent-security-review",
-    "last_eval": "2026-06-16",
-    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for adversarial review of an agent's CONFIG/behaviour (rules, skills, MCP, hooks, permissions). Should-not-trigger covers the near-miss neighbours (code threat-model, code security-audit, the static config-audit command, privacy review, dependency CVE scan) whose vocabulary overlaps.",
-    "queries": [
-        {
-            "q": "red-team my agent setup — could someone weaponise my CLAUDE.md or MCP servers?",
-            "trigger": true
-        },
-        {
-            "q": "do an adversarial security review of this agent config and its skills",
-            "trigger": true
-        },
-        {
-            "q": "is this third-party skill pack safe to install, attacker's view?",
-            "trigger": true
-        },
-        {
-            "q": "prüfe meine Agent-Konfiguration adversarial auf Angriffsketten",
-            "trigger": true
-        },
-        {
-            "q": "what could an attacker do with my rules files, hooks and tool permissions?",
-            "trigger": true
-        },
-        {
-            "q": "threat-model this new payments endpoint before I build it",
-            "trigger": false,
-            "note": "code change threat model → threat-modeling"
-        },
-        {
-            "q": "find vulnerabilities in my application code",
-            "trigger": false,
-            "note": "code vulnerability hunt → security-audit"
-        },
-        {
-            "q": "give me an A-F score for my agent config",
-            "trigger": false,
-            "note": "static scored audit → /security-audit-config command, not the adversarial skill"
-        },
-        {
-            "q": "are we GDPR compliant with this data flow?",
-            "trigger": false,
-            "note": "regulatory-regime read → privacy-review"
-        },
-        {
-            "q": "scan my dependencies for known CVEs",
-            "trigger": false,
-            "note": "dependency CVE audit → security-audit dependency pass"
-        }
-    ]
-}

package/dist/agent-src/skills/ai-code-blindspots/evals/triggers.json

@@ -1,52 +0,0 @@
-{
-    "skill": "ai-code-blindspots",
-    "last_eval": "2026-07-09",
-    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for the pre-ship 'what invisible cross-cutting controls did the AI omit?' checklist across code surfaces. Should-not-trigger covers near-miss neighbours (deep single-surface skills, prose/docs edits, adversarial config review) whose vocabulary overlaps.",
-    "queries": [
-        {
-            "q": "I just wrote this endpoint — what invisible controls did I forget before I call it done?",
-            "trigger": true
-        },
-        {
-            "q": "run the senior pre-ship checklist over this diff for cross-cutting controls",
-            "trigger": true
-        },
-        {
-            "q": "what does AI-generated code usually omit here — authz, tenant scope, validation?",
-            "trigger": true
-        },
-        {
-            "q": "prüf meinen Code auf die unsichtbaren Kontrollen, die die KI weglässt",
-            "trigger": true
-        },
-        {
-            "q": "before I finish this migration and query, what am I blind to?",
-            "trigger": true
-        },
-        {
-            "q": "review this React component specifically for XSS and client secrets",
-            "trigger": false,
-            "note": "single frontend surface → frontend-render-security"
-        },
-        {
-            "q": "is this npm package safe to add?",
-            "trigger": false,
-            "note": "dependency intake → supply-chain-intake"
-        },
-        {
-            "q": "threat-model this new payments endpoint before I build it",
-            "trigger": false,
-            "note": "pre-build threat model → threat-modeling / security-sensitive-stop"
-        },
-        {
-            "q": "fix the typo in this README",
-            "trigger": false,
-            "note": "prose/docs edit — no code surface"
-        },
-        {
-            "q": "red-team my agent's CLAUDE.md and MCP config",
-            "trigger": false,
-            "note": "agent-config adversarial review → agent-security-review"
-        }
-    ]
-}

package/dist/agent-src/skills/alerting-doctrine/evals/triggers.json

@@ -1,17 +0,0 @@
-{
-  "skill": "alerting-doctrine",
-  "last_eval": "2026-08-23",
-  "description": "5 should-trigger + 5 should-not-trigger. Should-trigger covers alert classification and the malformed-page contract. Should-not-trigger covers the near-miss neighbours this skill deliberately does not own: signal existence (logging-monitoring), the go/no-go verdict (operational-readiness), running an open incident (incident-commander), dashboard layout (dashboard-design) and host security (server-hardening).",
-  "queries": [
-    {"q": "should this condition page someone or just open a ticket?", "trigger": true},
-    {"q": "review our alert rules — too many of them wake the on-call", "trigger": true},
-    {"q": "what has to be in a runbook for it to be worth paging into?", "trigger": true},
-    {"q": "this alert has no owner, is that a problem?", "trigger": true},
-    {"q": "define what earns a page versus an info notification", "trigger": true},
-    {"q": "does this project even have an error rate metric?", "trigger": false, "note": "signal existence and detection → logging-monitoring"},
-    {"q": "are we ready to ship this to production?", "trigger": false, "note": "go/no-go readiness verdict → operational-readiness"},
-    {"q": "the outage started 10 minutes ago, what do I do now?", "trigger": false, "note": "running an open incident → incident-commander"},
-    {"q": "how should I lay out the panels on this monitoring dashboard?", "trigger": false, "note": "dashboard layout and visualization → dashboard-design"},
-    {"q": "harden ssh and set up unattended upgrades on this box", "trigger": false, "note": "host security posture → server-hardening"}
-  ]
-}

package/dist/agent-src/skills/analysis-skill-router/evals/evals.json

@@ -1,13 +0,0 @@
-{
-  "skill": "analysis-skill-router",
-  "_calibration": "Behavioural fixtures (road-to-skill-eval-coverage Phase 2, router set). Deterministic `contains` asserts the router picks the NARROWEST matching project-analysis-* skill (the whole routing contract) — a mis-route names the wrong or a generic skill.",
-  "scenarios": [
-    {
-      "id": "route-laravel-slow-queries",
-      "prompt": "Analyze why our Laravel app's database queries are slow. Which analysis skill should handle this?",
-      "assertions": [
-        { "kind": "contains", "value": "project-analysis-laravel" }
-      ]
-    }
-  ]
-}

package/dist/agent-src/skills/brand/evals/triggers.json

@@ -1,17 +0,0 @@
-{
-  "skill": "brand",
-  "last_eval": "2026-06-16",
-  "description": "5 should-trigger + 5 should-not-trigger. Should-trigger covers grounding a brand decision against the corpus (archetype, voice, colour, naming, archetype->type). Should-not-trigger covers near-miss neighbors: UI style grounding (design-intelligence), token authoring (design-tokens), generating a logo asset (logo-generation), validation of emitted artifacts (brand-consistency), and font-pairing lookup without a brand frame (typography-system style path).",
-  "queries": [
-    {"q": "which brand archetype fits a rugged outdoor gear company?", "trigger": true},
-    {"q": "ground the voice and tone for a challenger fintech brand", "trigger": true},
-    {"q": "what colour direction does the corpus suggest for a children's education brand?", "trigger": true},
-    {"q": "which naming pattern suits a coined-word tech startup brand?", "trigger": true},
-    {"q": "what type pairing-filter does a luxury law firm archetype imply?", "trigger": true},
-    {"q": "which UI style and palette fit a fintech dashboard?", "trigger": false, "note": "frontend style grounding → design-intelligence, not brand strategy"},
-    {"q": "emit the brand colours as DTCG CSS variables", "trigger": false, "note": "token authoring/emission → design-tokens / brand-to-tokens"},
-    {"q": "generate a logo image for this bakery", "trigger": false, "note": "asset generation → logo-generation, not brand grounding"},
-    {"q": "check whether this landing page copy is on-brand", "trigger": false, "note": "post-action validation → brand-consistency rule"},
-    {"q": "what's a good serif font pairing for a magazine?", "trigger": false, "note": "font-pairing lookup with no brand frame → typography-system style path"}
-  ]
-}

package/dist/agent-src/skills/brand-asset-generation/evals/triggers.json

@@ -1,17 +0,0 @@
-{
-  "last_eval": "2026-06-16",
-  "should_trigger": [
-    "Generate a banner for our product launch — use the brand colors from .tokens.json",
-    "Create a social card for the Open Graph meta tag, 1200×630, matching our brand palette",
-    "Make a LinkedIn cover image using our brand typography and voice",
-    "Generate a CIP header element for the website hero section with brand-token injection",
-    "Produce a branded social media image for the campaign — we have pack-brand installed"
-  ],
-  "should_not_trigger": [
-    "Design a logo for our new startup",
-    "Generate a product photo of a coffee mug on a white background",
-    "Which image provider should I use for text-heavy images?",
-    "Write a prompt for Midjourney to create a realistic landscape",
-    "Create a brand strategy document outlining our positioning and target audience"
-  ]
-}

package/dist/agent-src/skills/brand-audit/evals/triggers.json

@@ -1,17 +0,0 @@
-{
-  "skill": "brand-audit",
-  "last_eval": "2026-06-16",
-  "description": "5 should-trigger + 5 should-not-trigger. Should-trigger covers auditing/inventorying current brand expression and flagging drift. Should-not covers near-miss neighbors.",
-  "queries": [
-    {"q": "audit our brand consistency across the site and decks", "trigger": true},
-    {"q": "is our brand applied consistently — find where we drift", "trigger": true},
-    {"q": "inventory how the logo and colours are used today across all touchpoints", "trigger": true},
-    {"q": "baseline our current brand expression before the refresh", "trigger": true},
-    {"q": "where does our copy drift from the brand voice", "trigger": true},
-    {"q": "define a new brand strategy from scratch", "trigger": false, "note": "strategy definition -> brand-strategy"},
-    {"q": "generate a new logo for us", "trigger": false, "note": "generation -> logo-generation"},
-    {"q": "audit just the UI components to find reuse opportunities", "trigger": false, "note": "UI component inventory -> existing-ui-audit"},
-    {"q": "emit our brand tokens as CSS custom properties", "trigger": false, "note": "emission -> brand-to-tokens"},
-    {"q": "validate this single banner asset against the token spec in CI", "trigger": false, "note": "automated validation gate -> brand-consistency rule"}
-  ]
-}

package/dist/agent-src/skills/brand-identity/evals/triggers.json

@@ -1,17 +0,0 @@
-{
-  "skill": "brand-identity",
-  "last_eval": "2026-06-16",
-  "description": "5 should-trigger + 5 should-not-trigger. Should-trigger covers defining the identity constraint set (colour story, type story, logo direction) from a strategy. Should-not covers near-miss neighbors.",
-  "queries": [
-    {"q": "define the colour story for our brand based on this archetype", "trigger": true},
-    {"q": "what type story fits a challenger archetype in the fintech sector", "trigger": true},
-    {"q": "give me a logo direction for our identity — what mark style and form language fits", "trigger": true},
-    {"q": "assemble the brand identity constraint set from our confirmed strategy", "trigger": true},
-    {"q": "what imagery direction should we use for our brand — subject matter, mood, composition", "trigger": true},
-    {"q": "who is our brand for and how should we position it in the market", "trigger": false, "note": "strategy -> brand-strategy"},
-    {"q": "generate the actual logo image for our brand", "trigger": false, "note": "generation -> logo-generation"},
-    {"q": "emit the colour tokens as CSS variables and a DTCG JSON file", "trigger": false, "note": "emission -> brand-to-tokens"},
-    {"q": "pick a font pairing for a modern SaaS product with no brand frame yet", "trigger": false, "note": "style path -> typography-system"},
-    {"q": "check whether this asset is on-brand and consistent with our guidelines", "trigger": false, "note": "validation -> brand-consistency rule"}
-  ]
-}

package/dist/agent-src/skills/brand-strategy/evals/triggers.json

@@ -1,17 +0,0 @@
-{
-  "skill": "brand-strategy",
-  "last_eval": "2026-06-16",
-  "description": "5 should-trigger + 5 should-not-trigger. Should-trigger covers grounding brand strategy (archetype, positioning, voice, messaging). Should-not covers near-miss neighbors.",
-  "queries": [
-    {"q": "which brand archetype fits a B2B SaaS startup targeting mid-market ops teams", "trigger": true},
-    {"q": "write an opposable positioning statement for our challenger brand", "trigger": true},
-    {"q": "define the voice and tone profile for our brand — what do we sound like and what do we never say", "trigger": true},
-    {"q": "which messaging framework should we use — jobs-to-be-done or category creation", "trigger": true},
-    {"q": "who is this brand actually for and what makes us different from the obvious competitors", "trigger": true},
-    {"q": "what UI style and colour palette should the dashboard use", "trigger": false, "note": "frontend style grounding -> design-intelligence"},
-    {"q": "generate a logo image for our new product line", "trigger": false, "note": "asset generation -> logo-generation"},
-    {"q": "emit our brand colours as CSS custom properties and a DTCG token file", "trigger": false, "note": "token emission -> brand-to-tokens / design-tokens"},
-    {"q": "check whether this landing page copy is consistent with our brand voice", "trigger": false, "note": "validation -> brand-consistency rule"},
-    {"q": "audit how consistently our brand is applied across our marketing site and product", "trigger": false, "note": "audit -> brand-audit"}
-  ]
-}