@event4u/agent-config 14.11.0 → 14.12.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![Smoke](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml) [![Public install smoke (3 OS × 2 Node)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml) [![npm](https://img.shields.io/npm/v/@event4u/agent-config?style=flat-square&label=npm&color=orange)](https://www.npmjs.com/package/@event4u/agent-config) [![agent-config MCP server](https://glama.ai/mcp/servers/event4u-app/agent-config/badges/score.svg)](https://glama.ai/mcp/servers/event4u-app/agent-config) [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fevent4u-app%2Fagent-config.svg)](https://mcptoplist.com/server/glama%2Fevent4u-app%2Fagent-config)
 
-[![Skills](https://img.shields.io/badge/Skills-299-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-120-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-202-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-112-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
+[![Skills](https://img.shields.io/badge/Skills-299-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-120-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-202-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-114-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
 
 **Try it in 30 seconds** — drop one read-only subagent into any repo and watch it gate "done": `@production-validator check this branch is actually done`. No wizard, no lock-in, nothing else installed — the [30-second wedge ↓](#quickstart) is the whole first step. Start at the proof, not the catalog: **[event4u-app.github.io/agent-config/proof/](https://event4u-app.github.io/agent-config/proof/)**.
 

package/dist/agent-src/contexts/execution/evidence-discipline.md

@@ -95,6 +95,32 @@ L0–L4 are human shorthand for how deep a discovery went; they are documentatio
 only. The **same** evidence rules apply at every tier — no enforced state
 machine, no per-tier evidence relaxation.
 
+## Re-orient when the tree contradicts what you last read
+
+External edits invalidate evidence. When the user mentions they changed something
+outside this session, or a read contradicts the last known state of a file, the
+prior observation is **stale, not wrong** — and acting on it overwrites work that
+is not yours.
+
+Five steps, in order:
+
+1. Treat every prior observation of the affected paths as invalidated.
+2. Re-read the state — `git status`, then the affected files themselves.
+3. Reconstruct the assumption that broke. A file did not vanish; it was renamed,
+   a block moved, a symbol was extracted. Find where it went before concluding
+   it is gone.
+4. Preserve the external work. Never restore from your own stale copy.
+5. Say what changed if the scope or the conclusion moved, rather than
+   continuing as though the earlier reading still held.
+
+The failure this prevents is narrower than "be careful": it is re-applying a
+diff computed against a tree that no longer exists, which looks like a clean
+apply and silently reverts somebody's edit.
+
+**No gate covers this.** It is a re-read the transcript cannot distinguish from
+a first read, so it is model-carried — the same honesty boundary § Honest
+enforcement reality states for the rest of this file.
+
 ## Honest enforcement reality
 
 ```

package/dist/agent-src/skills/code-refactoring/SKILL.md

@@ -28,8 +28,51 @@ Do NOT use when:
 2. **Understand the scope** — what exactly needs to change and why?
 3. **Find ALL references** — use `codebase-retrieval` and `view` with `search_query_regex` to find every
    caller, implementation, test, and configuration that references the code being changed.
+   **If the change is to a closed set** — an enum, union, literal type, state
+   machine, role or permission set — identifier search is not enough: the
+   consumers that break are the ones that never name the type. Search by shape as
+   well (`switch` / `match` / if-chains over it, lookup tables keyed by it,
+   validators, serializers, schemas, fixtures, translation keys) and classify each
+   as exhaustive, deliberate fallback, or missing case. Procedure:
+   [`downstream-changes-mechanics`](../../../docs/guidelines/agent-infra/downstream-changes-mechanics.md).
 4. **Map the impact** — create a list of all files that will need changes.
-5. **Present the plan** — show the user what will be affected before starting.
+5. **Decide the verdict, if the refactor is a de-duplication** — see the
+   safe-abstraction gate below. An extraction with no recorded verdict is a
+   guess about whether two things are the same thing.
+6. **Present the plan** — show the user what will be affected before starting.
+
+### Safe-abstraction gate — before merging two things into one
+
+This skill performs extractions; it is therefore the place that decides
+whether one should happen. A wrong abstraction costs more than the
+duplication it replaced, because the duplication is visible and the wrong
+abstraction grows caller flags until nobody can remove it. Ask, before
+moving any code:
+
+1. Is this the same knowledge, or two facts that currently look alike?
+2. Would both copies change for the same reason?
+3. Is there one honest domain name that fits **every** call site?
+4. Can the common core stay free of caller-specific flags and modes?
+5. Are public contracts preserved, and do tests prove behavioural equivalence?
+6. **If the two copies diverged tomorrow, would that be a defect or
+   legitimate evolution?**
+
+A "legitimate evolution" answer to the last question is decisive: stop, and
+record the verdict `keep-duplicated`. That closes the refactor **successfully**
+— so does `de-abstract`, splitting a shared unit that has grown modes back
+apart. Neither is a failure to act, and neither needs an apology in the
+output. Textual similarity is not evidence of shared knowledge: copies that
+read identically can encode different assumptions, and merging them changes
+behaviour silently.
+
+The class names and the full verdict list are in
+[`redundancy-taxonomy`](../../../docs/guidelines/redundancy-taxonomy.md).
+
+When the refactor goes the other way and **creates** a new unit, the reuse
+question comes first: does an existing class or component already cover this, and
+what does composing or extending it cost against a new one? Thresholds per
+artifact class:
+[`component-oriented-and-oop-development`](../../../docs/guidelines/component-oriented-and-oop-development.md).
 
 ## Procedure: Refactor code
 
@@ -140,6 +183,7 @@ After the code changes are verified, update all affected documentation:
 1. Find all usages → update all usages → update docs → run the static analyser → run tests.
 
 ### Extract method / class
+0. Run the safe-abstraction gate above — a `keep-duplicated` verdict ends it here.
 1. Create the new method/class → move logic → update caller → update docs → run the static analyser → run tests.
 
 ### Move class to different namespace

package/dist/agent-src/skills/code-review/SKILL.md

@@ -37,11 +37,70 @@ Use this skill when:
 2. **Detect the change-type + depth** — route to the right checklist and pick the review depth (below).
 3. **Architecture** — does the approach make sense? Right layer? Right pattern?
 4. **Correctness** — does it actually work? Edge cases? Error handling?
-5. **Quality** — types, naming, readability, DRY, SOLID?
-6. **Security** — input validation, authorization, injection?
-7. **Performance** — N+1 queries, missing indexes, unbounded queries?
-8. **Tests** — are new paths covered? Are existing tests still valid?
-9. **Conventions** — does it follow project standards?
+5. **Quality** — types, naming, readability, SOLID?
+6. **Redundancy** — see below; a verdict, not a "this looks duplicated".
+7. **Propagation** — did a changed concept reach every occurrence? see below.
+8. **Security** — input validation, authorization, injection?
+9. **Performance** — N+1 queries, missing indexes, unbounded queries?
+10. **Tests** — are new paths covered? Are existing tests still valid?
+11. **Conventions** — does it follow project standards?
+
+## The redundancy dimension
+
+`DRY` as a checklist word produced findings nobody could act on: it names a
+principle, not a decision, and it has no answer for the case where two copies
+should stay. Replace it with a verdict.
+
+Classify the finding against
+[`redundancy-taxonomy`](../../../docs/guidelines/redundancy-taxonomy.md) —
+implementation, knowledge, or representation — and record one verdict from that
+document's list. `keep-duplicated` and `de-abstract` are successful outcomes; a
+finding with no recorded verdict stays open. Knowledge, policy, contract and
+delivery-authority duplication outrank clone percentage: two copies of a
+*decision* diverge into a bug, two copies of a loop usually do not.
+
+**Diff-aware, always.** The finding is duplication this change **introduces**,
+or duplication on a surface it touches. Pre-existing duplication is baseline —
+it is named once if the reviewer thinks it matters and it never fails an
+unrelated change. A review that reds a diff against debt it did not create is a
+review nobody will run twice.
+
+For comments, labels, tooltips, placeholders and empty states, run the
+Information Delta Test from the same document rather than judging text volume.
+A reduction that removes an accessibility name is a defect, not a cleanup.
+
+Naming is the same dimension pointed the other way: a diff that introduces a
+second term for a concept the tree already names is the finding, and an existing
+split is baseline. The classes and the `canonicalize-term` / `keep-distinct`
+verdicts are in the same document.
+
+## The propagation dimension
+
+A change is complete when the **concept** changed everywhere, not when the named
+file compiles. Two shapes to check, both of which the file-level review misses:
+
+**A closed set gained or lost a member** (enum, union, literal type, state
+machine, role or permission set, schema `enum`, DB check constraint). List the
+consumers and their status — every `switch` / `match` / if-chain over the type,
+every lookup table keyed by it, every validator, serializer, schema, fixture and
+translation key. A `default` branch that silently absorbs the new member is a
+missing case, not a handled one. Procedure:
+[`downstream-changes-mechanics`](../../../docs/guidelines/agent-infra/downstream-changes-mechanics.md).
+
+**A shared behaviour moved and its siblings did not.** A defect fixed in one
+place is presumed to recur until searched: name the exact wrong construct, grep
+the tree, and report the count — zero is a real answer and worth stating, because
+it distinguishes "this was unique" from "nobody looked".
+
+Diff-aware on the same terms as redundancy: the finding is a concept **this
+change** left half-migrated. Pre-existing incompleteness elsewhere is baseline.
+
+When the diff **creates** a class, component, service or hook rather than
+changing one, the question is whether it needed to exist: what was searched,
+what was found, and why composing or extending the incumbent was rejected. An
+answer, not a ceremony — and the thresholds for when repetition actually earns
+an abstraction are in
+[`component-oriented-and-oop-development`](../../../docs/guidelines/component-oriented-and-oop-development.md).
 
 ## Change-type routing — load only the checklist the diff needs
 
@@ -113,7 +172,7 @@ coverage reads as full coverage.
 the package implements it. That is now true for a recorded reason rather than by
 omission: the pre-registered question — does rotating reviewer order change the finding set
 on a frozen corpus, by more than 15 % — **cannot be answered from the corpus that exists**.
-`agents/evidence/reviews/` holds 123 findings artefacts, and none of them records the file
+`agents/evidence/reviews/` holds 123 findings artifacts, and none of them records the file
 order it was produced under, so the counterfactual is not recoverable; re-running reviewers
 produces fresh judgements in which ordering is confounded with run-to-run variance. Full
 null, with its reopening condition: `agents/evidence/review-rotation-prereg-and-null.md`.

package/dist/agent-src/skills/command-writing/SKILL.md

@@ -305,6 +305,41 @@ Bad description (vague, no outcome):
 
 > "PR command"
 
+## The `## Examples` section on a user-facing command
+
+Stated once, here — never repeated per command.
+
+A command whose `visibility` is `visible` or `advanced` carries an
+`## Examples` section: **1-3 filled invocations** in a fence, then **exactly
+one Why line**. Filled means a real path, a real ticket key, a real flag — a
+placeholder teaches nothing about what to type.
+
+The Why line uses one of two literals, `**Why it works:**` or a
+`### Why it works` heading, and cites **exactly one** pattern id from
+[`prompt-patterns.yml`](../../config/discovery/prompt-patterns.yml):
+`outcome-not-steps` · `self-check-loop` · `measurable-target` ·
+`give-the-artifact` · `point-at-reference` · `say-the-format`. One id, because
+the Why line's job is the part that transfers to a command the reader has not
+seen, and a line naming three patterns names none of them.
+
+~~~
+## Examples
+
+```
+/work fix the failing login test under tests/feature/auth
+```
+
+**Why it works:** measurable-target — it names the file instead of the symptom.
+~~~
+
+Enforced by `check_command_examples`, forward-only: the 23 in-scope commands as
+of 2026-08-24 are grandfathered in a frozen set inside the gate, and a command
+**added or promoted into `visible`/`advanced`** after that must comply. Two
+things the gate checks that are easy to miss — an invocation must resolve to
+the command's own `name:` (a rename otherwise leaves stale examples behind), and
+a flag used in an example must be documented in the body **outside** the
+section.
+
 ## Encode usage policy in the description
 
 Workflow sequencing, preconditions, ID/output provenance ("copy ids verbatim,

package/dist/agent-src/skills/existing-ui-audit/SKILL.md

@@ -100,7 +100,8 @@ Write into `state.ui_audit.design_tokens` (object, never null — empty object i
 
 | Source | What to extract |
 |---|---|
-| `tailwind.config.{js,ts,cjs,mjs}` | `theme.colors`, `theme.spacing`, `theme.fontFamily`, `theme.extend.*` |
+| **`tailwind-v3`** (`axes.css`) — `tailwind.config.{js,ts,cjs,mjs}` | `theme.colors`, `theme.spacing`, `theme.fontFamily`, `theme.extend.*` |
+| **`tailwind-v4`** (`axes.css`) — the `@theme` block in the entry CSS; **no config file exists**, and `components.json` `"tailwind": {"config": ""}` is the marker | every `--token: value` declared inside `@theme` / `@theme inline` |
 | `:root { --... }` blocks in `resources/css/`, `app/globals.css`, `src/app/globals.css` | every `--token-name: value` pair |
 | `theme.json` / `tokens.json` (any depth) | flat or nested token tree |
 | `app/css/variables.css`, `assets/scss/_tokens.scss` | SCSS `$var: value` and CSS custom properties |
@@ -109,6 +110,12 @@ Write into `state.ui_audit.design_tokens` (object, never null — empty object i
 
 Group output by category: `colors`, `spacing`, `radius`, `font`, `shadow`, `breakpoint`, `other`.
 
+**Branch on the axis, do not probe for a config file.** `detect_stack()` emits
+`axes.css` as `tailwind-v3` or `tailwind-v4`
+(`work_engine/stack/detect.ts:521-524`); reading it is how this step and
+`react-shadcn-ui` § Gotcha stay on the same key. Absence of
+`tailwind.config.*` is v4's normal state, never a missing file.
+
 **Artifact-sourced tokens stay distinguishable from project tokens.** Every
 group carries a `source` — `project` for the first four rows, `artifact` for the
 last two — because the mapping between them is the thing a port has to keep

package/dist/agent-src/skills/project-analysis-core/SKILL.md

@@ -129,6 +129,29 @@ Check:
 6. Known uncertainties
 7. Recommended next specialist skill
 
+## Improvement mode — check for an existing artefact first
+
+Before a full analysis, ask whether this target has already been analysed:
+
+```bash
+npx tsx node_modules/@event4u/agent-config/src/scripts/select_analysis_mode.ts "<target>"
+```
+
+`full` → run steps 1-8 as written. `delta` → **read the named artefact first**,
+then analyse only what it does not cover: gaps, sections the tree has moved past,
+patterns that are new since it was written. The output format is unchanged; the
+reading is narrower.
+
+This changes **write economics only**. A concept page is a hypothesis cache,
+never truth — the delta path re-verifies every structural claim it carries
+forward against a live source, exactly as a full run would
+([`source-discovery-gate`](../../rules/source-discovery-gate.md) § v1↔v2
+isolation). A cheaper write is not a licence to trust a cached read, and
+"the page already says so" is not evidence.
+
+An empty page counts as absent: it carries no conclusions to delta against, so
+the router answers `full`.
+
 ## Knowledge capture (`convention_detected` events)
 
 An architecture map or stack finding that recurs (a naming convention,

package/dist/agent-src/skills/react-shadcn-ui/SKILL.md

@@ -54,7 +54,14 @@ block above:
 
 ## Compatibility
 
-- **Tested against:** `shadcn@2.1`, Tailwind CSS `3.x`, React `18+`.
+- **Tested against:** `shadcn@4`, Tailwind CSS `4.x`, React `19`, primitives from
+  `@base-ui/react@1`, `components.json` style `base-nova` — every major read out
+  of `tests/fixtures/stack/shadcn-current/package.json`, the verbatim output of
+  `npx shadcn@latest init -d --template vite` on 2026-08-24. No version on this
+  line may be stated from prose; move it only by re-running that scaffold and
+  re-committing the fixture.
+- Tailwind `3.x` and Radix primitives stay supported through the **v3 branch**
+  under § Gotcha — the CLI moved on, existing projects did not.
 - The audit step (`directives/ui/audit.ts`) reads the line above and
   compares it with `state.ui_audit.shadcn_inventory.version`; a major
   mismatch triggers a soft halt before this skill runs.
@@ -63,8 +70,8 @@ block above:
 
 Use when `state.stack.frontend == "react-shadcn"` and `directives/ui/apply.ts`,
 `review.ts`, or `polish.ts` dispatches to this skill, or when a React project
-clearly uses shadcn/ui (presence of `components.json`, `@radix-ui/*`
-dependencies, a `components/ui/` folder of generated primitives).
+clearly uses shadcn/ui (presence of `components.json`, a `@base-ui/react` or
+`@radix-ui/*` dependency, a `components/ui/` folder of generated primitives).
 
 Do NOT use when:
 - Project is Blade + Livewire + Flux (use `flux` / `livewire` / `blade-ui`).
@@ -82,13 +89,23 @@ Do NOT use when:
   writes `state.ui_audit.shadcn_inventory` with the detected version —
   when it diverges by a major, audit emits a soft halt before this
   skill runs.
-- shadcn/ui composes Radix primitives. Accessibility is built in via Radix
-  but only when you use the wrapper components correctly (`asChild`,
+- shadcn/ui composes a primitive vendor — `@base-ui/react` in a CLI-4 scaffold,
+  `@radix-ui/*` in older projects. Accessibility is built in either way, but
+  only when the wrapper components are used correctly (`asChild`,
   `<DialogTrigger>` instead of a bare `<button>`).
-- Tailwind tokens come from `tailwind.config.{js,ts}` (`theme.extend.colors`)
-  and CSS custom properties on `:root` and `.dark` (`--background`,
-  `--foreground`, `--primary`, `--ring`, …). Audit writes them into
-  `state.ui_audit.design_tokens`. Use those tokens; do not hardcode values.
+- **Tailwind tokens: branch on the `css` axis, never guess.** `detect_stack()`
+  emits `axes.css` as `tailwind-v4` or `tailwind-v3`
+  (`work_engine/stack/detect.ts:521-524`); `existing-ui-audit` reads tokens on
+  the same key.
+  - `tailwind-v4` — **no config file exists.** Tokens live in the `@theme` block
+    of the entry CSS named by `components.json` → `tailwind.css`, and that file's
+    `"tailwind": {"config": ""}` — an empty `config` string — IS the v4 marker.
+    Never write `tailwind.config.{js,ts}` in a v4 project.
+  - `tailwind-v3` — tokens come from `tailwind.config.{js,ts}`
+    (`theme.extend.colors`).
+  - Either branch — CSS custom properties on `:root` and `.dark`
+    (`--background`, `--foreground`, `--primary`, `--ring`, …). Audit writes them
+    into `state.ui_audit.design_tokens`. Use those tokens; never hardcode values.
 - Dark mode is class-based (`<html class="dark">`). Every color must come
   from `bg-background`, `text-foreground`, etc. — never raw `bg-white`.
 - Every interactive primitive must declare a focus-visible state via
@@ -243,12 +260,12 @@ this over a registry file.
    `bg-primary text-primary-foreground`, `text-muted-foreground`. No
    `bg-white` / `text-black` / hardcoded `#fff`.
 2. Spacing / radius from theme tokens (`rounded-lg` mapped to `--radius`
-   in `tailwind.config.{js,ts}`). Polish refactors hardcoded values
-   when a token equivalent exists.
+   — in the `@theme` block on `tailwind-v4`, in `tailwind.config.{js,ts}` on
+   `tailwind-v3`). Polish refactors hardcoded values when a token exists.
 3. Dark mode: never branch on a `dark` prop; rely on the `.dark` class
    on the root and semantic tokens.
 4. Every interactive primitive: keyboard trigger present (Enter/Space
-   on buttons, Esc on dialogs — Radix free), visible focus ring,
+   on buttons, Esc on dialogs — free from the primitive vendor), focus ring,
    `aria-label` from `state.ui_design.a11y` when icon-only.
 
 ### Step 3: State coverage

package/dist/agent-src/skills/skill-writing/references/procedure.md

@@ -22,8 +22,9 @@ rule. Skip only on explicit *"just do it"* bypass or trivial edits
 ### 0b. Skill-growth gate (new skill only)
 
 The skill count keeps climbing; nothing forces *"should this be a new skill at
-all?"*. Before creating a **new** skill, answer these in the PR body — a new
-skill that cannot answer them is a merge / guideline / no-op in disguise:
+all?"*. Before creating a **new** skill, answer these **in the ledger**,
+`agents/decisions/skill-admissions.jsonl` — a new skill that cannot answer them
+is a merge / guideline / no-op in disguise:
 
 1. **Family** — which capability family does it join? (engineering, product, …)
 2. **Capability** — what does it do that no existing skill does? Name the gap.
@@ -31,6 +32,27 @@ skill that cannot answer them is a merge / guideline / no-op in disguise:
 4. **Why not a guideline** — is this executable workflow (skill) or reference material (guideline)? Guideline-shaped content does not become a skill.
 5. **Visibility tier** — `core` or `lab`? Which pack?
 
+**The answers go in the ledger, not in the PR body.** That used to say PR body,
+and `check_finding_dispositions.ts:11` rejects that exact surface for findings in
+its own words — a comment is *"mutable and unaudited; it is transport, not a
+record"*. The consequence was measurable: **+8 skills landed in one release with
+no visible "no"**, because a refusal kept in a PR body is a refusal nobody can
+grep. One line, appended:
+
+```json
+{"skill":"<name>","decision":"admitted","date":"YYYY-MM-DD","family":"…","capability":"…","why_not_extend":"…","why_not_a_guideline":"…","visibility":"…"}
+```
+
+`check_skill_admissions` is forward-only: it requires a row only for skills added
+since the base ref, so nothing existing needs backfilling. It rejects an answer
+under 12 characters, because a one-word answer is the boilerplate the gate exists
+to catch rather than an answer.
+
+**A refusal is a row too**, and that is the half the PR body lost:
+`{"skill":"…","decision":"rejected","date":"…","instead":"…"}`. A rejected row may
+not name a skill that exists — a record saying a capability was refused while it
+ships is worse than no record.
+
 **Surface overlap before deciding** — run `./scripts-run src/scripts/skill_overlap`
 (or `audit_skill_overlap`) and read the nearest matches; a high-overlap hit is a
 merge signal, not a green light. This gate is the authoring-time companion to the

package/dist/agent-src/skills/storybook-workshop/SKILL.md

@@ -131,6 +131,15 @@ that file, which is the one thing a static checker must not start doing.
 
 ## MCP path — opt-in channel, never a dependency
 
+**"Opt-in" is about the agent connecting, not about installing.** A 2026-08-24
+`npx storybook@latest init --yes` scaffold ships `@storybook/addon-mcp` *and*
+`@storybook/addon-a11y` in `devDependencies` by default — recorded verbatim in
+`tests/fixtures/stack/storybook-current/`, which is also the only source any
+Storybook major stated here may come from (`storybook@^10.5.10`). So the addon
+usually already exists; what stays optional is whether an agent reaches a
+running instance. The same scaffold prints *"installed but is not entirely set
+up yet"*, so its presence is not evidence the channel works.
+
 When the project has `@storybook/addon-mcp` **and** a running Storybook,
 [`existing-ui-audit`](../existing-ui-audit/SKILL.md) prefers the live tools —
 `list-all-documentation`, then `get-documentation` for the components that matter — over the

package/dist/agent-src/skills/ui-component-architect/SKILL.md

@@ -68,6 +68,14 @@ still exists in the tree. Absent or empty → fall through to
 
 Then review existing components in the codebase for the same
 responsibility — extend rather than rebuild when a match is found.
+
+**A new component's workshop is part of its design, on every React lane and not
+only `react-shadcn`.** When the extraction is agreed, the story set comes from
+[`storybook-workshop`](../storybook-workshop/SKILL.md) — one story per concept
+off the state-coverage matrix below, which is what makes the component
+agent-readable and its contrast floor checkable before it reaches a page. That
+skill is stack-agnostic and ships in `engineering-base`, so a plain-`react`
+project receives it exactly as a `react-shadcn` one does.
 If none exists, write the new component's purpose: *"Renders a
 labelled input with inline error and hint."* If the sentence has an
 "and" joining two unrelated jobs, the component is two components.

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.11.0"
+agent_config_version: "14.12.0"
 
 # --- Project identity ---
 project:

package/dist/cli-delegate/{chunk-L43NCYPB.js → chunk-JCW7ZLHK.js}

@@ -4549,6 +4549,11 @@ var settingsSchema = external_exports.object({
       enabled: external_exports.boolean().default(false).describe(
         "PreToolUse code-graph nudge (ADR-124 Phase 4). Default off. When on AND a native code-graph cache or a consumer-shipped graph.json/SCIP index is present, warns once per session (never blocks) as the agent is about to Grep/Glob or Read a source file \u2014 query the graph first for who-calls/where-used/impact questions (or rebuild if stale, build if absent). Source G\u2019s strict block-first-read mode is deliberately un-ported."
       )
+    }).default({}),
+    suggestion_capture: external_exports.object({
+      enabled: external_exports.boolean().default(false).describe(
+        'Suggestion-block capture (road-to-suggestion-block-capture Phase 2). Default off. Two slots: `stop` reads `last_assistant_message` \u2014 a payload field, so no transcript file is read \u2014 and latches that the assistant turn carried a numbered-options block; `user_prompt_submit` CONSUMES that latch and classifies the answering turn as option_n / as_is / other / stale_block. Consume-once is the correctness guard: the latch is deleted on read, so a bare "1" three turns later meets no latch and classifies `other`, and a latch past its TTL or unparseable is `stale_block` rather than a guess. Writes COUNTS ONLY to agents/runtime/state/audit/suggestion-capture.jsonl \u2014 the record type has no field able to hold a prompt, an option label or a command name, and a test asserts the written key set against src/config/suggestion-capture.json. Off by default because this is an INSTRUMENT rather than a feature: it exists so a capture rate can be measured on a maintainer workspace over a fixed soak window, and there is nothing in it for a consumer to gain.'
+      )
     }).default({})
     // `turn_end_gate` is deliberately ABSENT. The stop-slot turn-end gate is
     // always armed (2026-08-12) and has no settings surface: whether it

package/dist/cli-delegate/{chunk-236PNQZK.js → chunk-JJA2QEWA.js}

@@ -2,7 +2,7 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   ZodFirstPartyTypeKind,
   settingsSchema
-} from "./chunk-L43NCYPB.js";
+} from "./chunk-JCW7ZLHK.js";
 import {
   main
 } from "./chunk-6RJA2F5A.js";

package/dist/cli-delegate/cmd_export.js

@@ -9,8 +9,8 @@ import {
   KIRO_MARKER,
   ROOCODE_MARKER,
   ZED_MARKER
-} from "./chunk-236PNQZK.js";
-import "./chunk-L43NCYPB.js";
+} from "./chunk-JJA2QEWA.js";
+import "./chunk-JCW7ZLHK.js";
 import "./chunk-6RJA2F5A.js";
 import "./chunk-WOKWX5PL.js";
 import "./chunk-523HCFYO.js";

package/dist/cli-delegate/cmd_prune.js

@@ -1,8 +1,8 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   PROJECT_BRIDGE_MARKERS
-} from "./chunk-236PNQZK.js";
-import "./chunk-L43NCYPB.js";
+} from "./chunk-JJA2QEWA.js";
+import "./chunk-JCW7ZLHK.js";
 import "./chunk-6RJA2F5A.js";
 import "./chunk-WOKWX5PL.js";
 import "./chunk-523HCFYO.js";

package/dist/cli-delegate/cmd_settings_migrate.js

@@ -3,8 +3,8 @@ import {
   GLOBAL_AGENT_SETTINGS_PATH,
   GLOBAL_USER_SETTINGS_PATH,
   SETTINGS_FILE
-} from "./chunk-236PNQZK.js";
-import "./chunk-L43NCYPB.js";
+} from "./chunk-JJA2QEWA.js";
+import "./chunk-JCW7ZLHK.js";
 import "./chunk-6RJA2F5A.js";
 import "./chunk-WOKWX5PL.js";
 import "./chunk-523HCFYO.js";

package/dist/cli-delegate/cmd_settings_set.js

@@ -11,7 +11,7 @@ import {
 import {
   external_exports,
   settingsSchema
-} from "./chunk-L43NCYPB.js";
+} from "./chunk-JCW7ZLHK.js";
 import {
   resolvePackageRoot
 } from "./chunk-MCJYCQPF.js";

package/dist/cli-delegate/cmd_sync.js

@@ -1,8 +1,8 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   main
-} from "./chunk-236PNQZK.js";
-import "./chunk-L43NCYPB.js";
+} from "./chunk-JJA2QEWA.js";
+import "./chunk-JCW7ZLHK.js";
 import "./chunk-6RJA2F5A.js";
 import "./chunk-WOKWX5PL.js";
 import "./chunk-523HCFYO.js";

package/dist/cli-delegate/cmd_uninstall.js

@@ -3,8 +3,8 @@ import {
   PROJECT_BRIDGE_MARKERS,
   USER_SCOPE_PATHS,
   subtract_pointers
-} from "./chunk-236PNQZK.js";
-import "./chunk-L43NCYPB.js";
+} from "./chunk-JJA2QEWA.js";
+import "./chunk-JCW7ZLHK.js";
 import "./chunk-6RJA2F5A.js";
 import "./chunk-WOKWX5PL.js";
 import "./chunk-523HCFYO.js";

package/dist/cli-delegate/cmd_validate.js

@@ -3,8 +3,8 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   PROJECT_BRIDGE_MARKERS,
   USER_SCOPE_PATHS
-} from "./chunk-236PNQZK.js";
-import "./chunk-L43NCYPB.js";
+} from "./chunk-JJA2QEWA.js";
+import "./chunk-JCW7ZLHK.js";
 import "./chunk-6RJA2F5A.js";
 import "./chunk-WOKWX5PL.js";
 import "./chunk-523HCFYO.js";

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-08-24T04:43:12Z`
+- Generated: `2026-08-25T12:20:53Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._