@event4u/agent-config 14.11.0 → 14.13.0

package/dist/agent-src/templates/scripts/work_engine/directives/backend/implement.ts

@@ -16,6 +16,9 @@
  * Flow:
  *
  * - `plan` outcome is not `success` → BLOCKED on precondition.
+ * - no RED evidence on `state.tests` → BLOCKED with
+ *   `@agent-directive: observe-red` so the agent writes and observes the
+ *   failing test for the next single behaviour BEFORE any production edit.
  * - `state.changes` empty → BLOCKED with `@agent-directive:
  *   apply-plan` so the agent applies the plan.
  * - `state.changes` populated but malformed (entries missing
@@ -26,6 +29,26 @@
  * `docs/contracts/implement-ticket-flow.md#deliverystate-the-only-shared-object`
  * — each entry is a dict with at least a `path`; optional
  * `lines` / `purpose` feed the delivery report.
+ *
+ * RED evidence lives at `state.tests.red` and is the engine-side carrier for
+ * the test-first default in `rules/think-before-action.md`. Two accepted
+ * shapes, and nothing else counts:
+ *
+ * - one observation, or a list of them, each a dict with a non-empty
+ *   `behaviour` and a `failure_class` from `_RED_FAILURE_CLASSES` — the three
+ *   valid RED classes the `test-driven-development` skill admits (a failing
+ *   assertion, a missing target, a contract failure). A broken fixture, a
+ *   syntax error in the test, a missing unrelated dependency and a runner
+ *   fault are NOT RED and are rejected by that same contract, not here.
+ * - `{exempt: "<reason>"}` — the recorded override for work the skill's
+ *   *Do NOT use when* list already excludes (scaffolding, generated files,
+ *   documentation). Recorded, never silent: an absent key is not an exemption.
+ *
+ * The gate is per behaviour, not per run: it names the behaviour it is waiting
+ * on and re-fires for the next one. It does NOT detect a batch — an agent that
+ * front-loads every test for the feature satisfies it, and the eval that fails
+ * a one-test-phase-then-one-code-phase plan is the control for that, not this
+ * step.
  */
 
 import type { DeliveryState} from '../../delivery_state.js';
@@ -39,6 +62,13 @@ export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [
         trigger: '`plan` outcome is not `success`',
         resolution: 're-run `/implement-ticket` from the start',
     },
+    {
+        code: 'no_red_evidence',
+        trigger: '`state.tests.red` carries neither an observed failing test for a ' +
+            'behaviour nor a recorded exemption',
+        resolution: 'agent directive `observe-red` → write the failing test for the ' +
+            'next single behaviour, observe it fail, record it',
+    },
     {
         code: 'empty_changes_delegate',
         trigger: '`state.changes` empty — plan not applied yet',
@@ -68,6 +98,13 @@ export function run(state: DeliveryState): StepResult {
         return _blocked_on_precondition(state);
     }
 
+    // Test-first, enforced where the engine can see it: no production work is
+    // emitted for a behaviour whose failing test has not been observed.
+    const redIssue = _diagnose_red(state.tests);
+    if (redIssue !== null) {
+        return _blocked_on_missing_red(state, redIssue);
+    }
+
     if (!_pyTruthy(state.changes)) {
         return _delegate_to_apply_plan(state);
     }
@@ -98,6 +135,59 @@ function _diagnose_changes(changes: Any[]): string[] {
     return issues;
 }
 
+/** The three RED classes the `test-driven-development` mode contract admits. */
+const _RED_FAILURE_CLASSES = ['assertion', 'missing_target', 'contract'] as const;
+
+/**
+ * `null` when `state.tests` carries usable RED evidence, else the complaint.
+ *
+ * Absent is a complaint, not an exemption — the whole point of the gate.
+ */
+function _diagnose_red(tests: Any): string | null {
+    if (!_isPlainObject(tests)) {
+        return 'no `state.tests.red` recorded';
+    }
+    const red = (tests as Record<string, unknown>).red;
+    if (!_pyTruthy(red)) {
+        return 'no `state.tests.red` recorded';
+    }
+    if (_isPlainObject(red) && _pyTruthy((red as Record<string, unknown>).exempt)) {
+        return null;
+    }
+    const observations = Array.isArray(red) ? red : [red];
+    for (const obs of observations) {
+        if (!_isPlainObject(obs)) {
+            return 'a `red` observation is not a dict';
+        }
+        const o = obs as Record<string, unknown>;
+        if (typeof o.behaviour !== 'string' || _pyStrip(o.behaviour).length === 0) {
+            return 'a `red` observation names no `behaviour`';
+        }
+        if (!_RED_FAILURE_CLASSES.includes(o.failure_class as (typeof _RED_FAILURE_CLASSES)[number])) {
+            return (
+                `\`red\` observation for \`${_pyStrip(o.behaviour)}\` has ` +
+                `\`failure_class\` outside ${_RED_FAILURE_CLASSES.join(', ')}`
+            );
+        }
+    }
+    return null;
+}
+
+function _blocked_on_missing_red(state: DeliveryState, issue: string): StepResult {
+    const ticketId = _ticketId(state);
+    return new StepResult({
+        outcome: Outcome.BLOCKED,
+        questions: [
+            agent_directive('observe-red', { ticket: ticketId }),
+            `> Ticket ${ticketId} — implement gate refused: ${issue}. Write the ` +
+                'failing test for the next single behaviour and observe it fail first.',
+            '> 1. Continue — write and run that one failing test',
+            '> 2. Record an exemption — `state.tests.red = {exempt: "<reason>"}`',
+        ],
+        message: `Ticket ${ticketId} needs an observed failing test before production work: ${issue}.`,
+    });
+}
+
 function _delegate_to_apply_plan(state: DeliveryState): StepResult {
     const ticketId = _ticketId(state);
     return new StepResult({

package/dist/agent-src/templates/scripts/work_engine/directives/backend/index.ts

@@ -45,6 +45,17 @@ export const SUPPORTED_KINDS: ReadonlyArray<string> = ['ticket', 'prompt'];
 // test, verify, report). The leaf name is the dispatcher slot key; in Python
 // it is derived via `step.__name__.rsplit(".", 1)[-1]` — hardcoded here since
 // the modules are imported statically.
+//
+// `implement` stays BEFORE `test`, deliberately, and the order is not the
+// test-after instruction it looks like. The tuple is linear and runs once per
+// flow, so moving `test` in front of `implement` would buy exactly one test
+// phase followed by one code phase — batch-TDD, which is the second
+// anti-pattern rather than a fix for the first. Test-first is enforced INSIDE
+// `implement` instead: `./implement.ts` refuses to emit production work for a
+// behaviour whose failing test has not been observed (`state.tests.red`), so
+// the discipline is per behaviour while the tuple stays per flow. The `test`
+// slot here is the whole-suite verdict that gates `verify`, never the first
+// time a test is written.
 const _STEPS: ReadonlyArray<[string, { run: Step; AMBIGUITIES: ReadonlyArray<Record<string, string>> }]> = [
     ['refine', refine],
     ['memory', memory],

package/dist/agent-src/templates/scripts/work_engine/directives/backend/test.ts

@@ -25,6 +25,13 @@
  *   be silently skipped, and the loop cannot report one as success.
  * - Optional keys (`targeted`, `full`, `duration_ms`,
  *   `followups`) feed the delivery report.
+ * - `red` is NOT a verdict. It is the per-behaviour RED evidence
+ *   `./implement.ts` gates on, written before any production edit, and it
+ *   says nothing about the suite. A `state.tests` carrying `red` and no
+ *   `verdict` therefore means the runner has not been invoked for the suite
+ *   yet → delegate, exactly as an empty `state.tests` does. A `verdict` that
+ *   is present and unrecognised still blocks on shape; this is a
+ *   not-yet-run case, never a relaxed verdict check.
  */
 
 import type { DeliveryState} from '../../delivery_state.js';
@@ -86,7 +93,7 @@ export function run(state: DeliveryState): StepResult {
     }
 
     const tests = state.tests;
-    if (!_pyTruthy(tests)) {
+    if (!_pyTruthy(tests) || _isRedOnly(tests)) {
         return _delegate_to_run_tests(state, policy.widen_tests);
     }
 
@@ -104,6 +111,21 @@ export function run(state: DeliveryState): StepResult {
     return new StepResult({ outcome: Outcome.SUCCESS });
 }
 
+/**
+ * True when `state.tests` carries only the pre-implement RED record.
+ *
+ * `red` is written by the `implement` gate's `observe-red` directive; it is
+ * evidence about one behaviour's first failing run, not a suite verdict. Only
+ * a MISSING `verdict` routes here — a present-but-wrong one still blocks.
+ */
+function _isRedOnly(tests: Any): boolean {
+    if (!_isPlainObject(tests)) {
+        return false;
+    }
+    const d = tests as Record<string, unknown>;
+    return !('verdict' in d) && _pyTruthy(d.red);
+}
+
 function _diagnose_tests(tests: Any): string[] {
     if (!_isPlainObject(tests)) {
         return [`state.tests must be a dict, got ${_pyTypeName(tests)}`];

package/dist/agent-src/templates/scripts/work_engine/directives/backend/verify.ts

@@ -33,7 +33,16 @@ import { type Any, Outcome, StepResult, agent_directive } from '../../delivery_s
 import { resolve_policy } from '../../persona_policy.js';
 import { decide, partial_exit, record_attempt, retry_halt, unmet_dod, verdict_signature } from './_self_fix.js';
 
-const _ALLOWED_VERDICTS = ['success', 'blocked', 'partial'] as const;
+/**
+ * DERIVED, never re-declared. `delivery_state.ts` is the step vocabulary's
+ * declaration for the template tree (templates are self-contained by contract
+ * and may not import from `src/scripts/`, so the registry mirrors it rather
+ * than the other way round). Spelling the three values again here made this the
+ * THIRD copy, and a third copy is how one vocabulary becomes two truths --
+ * which is the defect the outcome-vocabulary reconciliation was opened to fix.
+ * Found by the widened duplicate detector, 2026-08-30.
+ */
+const _ALLOWED_VERDICTS = Object.values(Outcome) as ReadonlyArray<Outcome>;
 
 /** Declared ambiguity surfaces. Advisory personas skip this step entirely. */
 export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [

package/dist/agent-src/templates/scripts/work_engine/directives/mixed/stitch.ts

@@ -20,7 +20,11 @@ import {
 /** Agent directive that drives end-to-end smoke scenarios. */
 export const INTEGRATION_TEST_DIRECTIVE = 'integration-test';
 
-const _ALLOWED_VERDICTS: ReadonlyArray<string> = ['success', 'blocked', 'partial'];
+/**
+ * DERIVED, never re-declared — see the note in `directives/backend/verify.ts`.
+ * This was the fourth copy of the step vocabulary.
+ */
+const _ALLOWED_VERDICTS: ReadonlyArray<string> = Object.values(Outcome);
 
 export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [
     {

package/dist/agent-src/templates/scripts/work_engine/stack/runner.ts

@@ -236,7 +236,7 @@ export function resolve_toolchain(
         quality.push(..._php_quality(project_root, composer, wrappers));
     }
     if (has_package) {
-        runners.push(..._js_runners(pkg, wrappers));
+        runners.push(..._js_runners(pkg, wrappers, _package_manager(project_root, pkg)));
         quality.push(..._js_quality(pkg, wrappers));
     }
     if (has_python) {
@@ -347,7 +347,7 @@ function _php_runners(root: string, composer: Manifest, wrappers: Wrappers): Run
     ];
 }
 
-function _js_runners(pkg: Manifest, wrappers: Wrappers): RunnerResult[] {
+function _js_runners(pkg: Manifest, wrappers: Wrappers, manager: string): RunnerResult[] {
     const deps = _all_dependencies(
         pkg,
         'dependencies',
@@ -383,17 +383,17 @@ function _js_runners(pkg: Manifest, wrappers: Wrappers): RunnerResult[] {
 
     // e2e runner — separate bucket, excluded unless --include-e2e.
     if ('@playwright/test' in deps || 'playwright' in deps) {
-        const cmd = _script_command(scripts, ['test:e2e', 'e2e', 'playwright']) || 'npx playwright test';
+        const cmd = _script_command(scripts, ['test:e2e', 'e2e', 'playwright'], manager) || 'npx playwright test';
         out.push(
             new RunnerResult('js', 'playwright', cmd, SPEED_E2E, HIGH, '@playwright/test in package deps'),
         );
     } else if ('cypress' in deps) {
-        const cmd = _script_command(scripts, ['test:e2e', 'e2e', 'cypress']) || 'npx cypress run';
+        const cmd = _script_command(scripts, ['test:e2e', 'e2e', 'cypress'], manager) || 'npx cypress run';
         out.push(new RunnerResult('js', 'cypress', cmd, SPEED_E2E, HIGH, 'cypress in package deps'));
     }
 
     // slow bucket — an explicit slow/integration script.
-    const slow_cmd = _script_command(scripts, ['test:slow', 'test:integration']);
+    const slow_cmd = _script_command(scripts, ['test:slow', 'test:integration'], manager);
     if (slow_cmd) {
         out.push(
             new RunnerResult(
@@ -487,19 +487,100 @@ function _task_runner_wrappers(root: string, pkg: Manifest): Wrappers {
     }
     const scripts: Manifest = _isDict(pkg.scripts) ? pkg.scripts : {};
     if (_isDict(scripts) && 'test' in scripts) {
-        out['js-test'] = `${_package_manager(root)} test`;
+        out['js-test'] = `${_package_manager(root, pkg)} test`;
     }
     return out;
 }
 
-function _package_manager(root: string): string {
-    if (_is_file(path.join(root, 'pnpm-lock.yaml'))) {
-        return 'pnpm';
+/**
+ * Lockfile → manager, in the order `monorepo-workspace/SKILL.md` § 1 states.
+ * Kept as data rather than a chain of ifs so `PACKAGE_MANAGER_BRANCHES` below
+ * can assert the count against the documented one.
+ */
+const LOCKFILE_MANAGERS: ReadonlyArray<readonly [string, string]> = [
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['bun.lock', 'bun'],
+    ['bun.lockb', 'bun'],
+    ['package-lock.json', 'npm'],
+];
+
+/**
+ * The five branches `monorepo-workspace/SKILL.md` § 1 specifies, named so a
+ * test can assert none went missing. The skill is the contract and it was
+ * already correct; this list exists because the code implemented three of the
+ * five and nothing noticed.
+ */
+export const PACKAGE_MANAGER_BRANCHES: readonly string[] = [
+    'packageManager',
+    'pnpm',
+    'yarn',
+    'bun',
+    'npm',
+] as const;
+
+export interface PackageManagerResolution {
+    /** The resolved manager, or `null` when the cascade deliberately refuses. */
+    manager: string | null;
+    /** Which branch answered — one of `PACKAGE_MANAGER_BRANCHES`, or `'ambiguous'`. */
+    via: string;
+    /** Non-empty when the cascade refuses: the reported finding. */
+    finding: string;
+}
+
+/**
+ * Resolve the package manager per `monorepo-workspace/SKILL.md` § 1.
+ *
+ * Two behaviours the previous three-branch version did not have, and both are
+ * in the skill rather than invented here:
+ *
+ *  - `packageManager` in the root `package.json` is the DECLARATION and wins
+ *    when present, because it is what Corepack enforces. A lockfile is an
+ *    inference; a declaration is not.
+ *  - **Two lockfiles is a finding, not a tie to break.** The old code returned
+ *    `pnpm` for a repository carrying both `pnpm-lock.yaml` and `yarn.lock`,
+ *    silently picking the first branch it tested. That is a guess presented as
+ *    an answer, and the skill says to report both and stop.
+ */
+export function _resolve_package_manager(
+    root: string,
+    pkg?: Manifest,
+): PackageManagerResolution {
+    const declared = pkg === undefined ? undefined : pkg['packageManager'];
+    if (typeof declared === 'string' && declared.trim() !== '') {
+        // `pnpm@9.1.0` → `pnpm`. Corepack's own format.
+        const name = declared.trim().split('@')[0] as string;
+        if (name !== '') {
+            return { manager: name, via: 'packageManager', finding: '' };
+        }
+    }
+    const present = LOCKFILE_MANAGERS.filter(([file]) => _is_file(path.join(root, file)));
+    const distinct = [...new Set(present.map(([, mgr]) => mgr))];
+    if (distinct.length > 1) {
+        return {
+            manager: null,
+            via: 'ambiguous',
+            finding:
+                `two package-manager lockfiles present (${present.map(([f]) => f).join(', ')}) ` +
+                'and no `packageManager` declaration — report both and stop, per ' +
+                'monorepo-workspace SKILL.md § 1',
+        };
     }
-    if (_is_file(path.join(root, 'yarn.lock'))) {
-        return 'yarn';
+    if (distinct.length === 1) {
+        const mgr = distinct[0] as string;
+        return { manager: mgr, via: mgr, finding: '' };
     }
-    return 'npm';
+    return { manager: 'npm', via: 'npm', finding: '' };
+}
+
+/**
+ * The resolved manager as a bare string for command construction. Falls back to
+ * `npm` on the ambiguous case so a caller building a command string still gets
+ * one — the FINDING is what carries the ambiguity, and a caller that needs it
+ * calls `_resolve_package_manager` directly.
+ */
+function _package_manager(root: string, pkg?: Manifest): string {
+    return _resolve_package_manager(root, pkg).manager ?? 'npm';
 }
 
 // --------------------------------------------------------------------------
@@ -580,10 +661,17 @@ function _script_uses(scripts: Manifest, name: string, tool: string): boolean {
     return typeof value === 'string' && value.includes(tool);
 }
 
-function _script_command(scripts: Manifest, names: string[]): string {
+/**
+ * Build a `<manager> run <script>` command for the first matching script name.
+ *
+ * `manager` used to be hardcoded `npm`. Every command the work engine hands an
+ * agent for verification inherited that, so a pnpm or yarn repository was told
+ * to run a command its lockfile contradicts.
+ */
+function _script_command(scripts: Manifest, names: string[], manager: string): string {
     for (const name of names) {
         if (typeof scripts[name] === 'string') {
-            return `npm run ${name}`;
+            return `${manager} run ${name}`;
         }
     }
     return '';

package/dist/cli/commands/uiAudit.js

@@ -44,7 +44,45 @@ import { isUiPath, isUiTreePath } from '../../scripts/_lib/ui_surface.js';
  */
 export const COVERAGE_BUCKETS = ['honoured', 'translated', 'flagged'];
 export const ARTEFACT_REL = path.join('agents', 'runtime', 'state', 'ui-audit.json');
-/** Files that mark an adopted design system, and the marker each implies. */
+/**
+ * The audit `kind` vocabulary — ONE definition, and the source the skill is
+ * tested against rather than a second hand-written list.
+ *
+ * Canonicalised 2026-08-26 (road-to-component-granularity-vocabulary 0.1). The
+ * skill declared `page | partial | component | layout` and the code emitted
+ * `component | view | style | page`; only two values were common, so an audit
+ * artefact written by the code was being read against a contract it did not
+ * satisfy. AI council 2/2: the emitted schema is authoritative for
+ * compatibility, one seat adding the refinement that the enum should live in a
+ * single module the producer, the consumer and the doc-conformance test all
+ * depend on — which is what this constant is.
+ *
+ * `partial` and `layout` are NOT adopted. Both sound like they mean something,
+ * and neither has an operational definition anyone could test: measured against
+ * a real tree, there is no line. Adding them would replace two undocumented
+ * values with two speculative ones.
+ *
+ * `view` IS retained, against both council seats' recommendation, because the
+ * premise they were given is false. The roadmap records `view` as "0 in any JS
+ * tree" and both seats read that as zero-yield. Measured on this repository
+ * 2026-08-26: **`view` = 2**, on
+ * `tests/eval/frontend-corpus/cases/blade-view/…` and
+ * `…/livewire-flux/…`. It is the BLADE branch. "Zero in a JS tree" is true of it
+ * the way "zero cats in a dog show" is true — the instrument was pointed at the
+ * wrong corpus. Removing it would have deleted this suite's only Laravel
+ * classification.
+ */
+export const AUDIT_KINDS = ['component', 'view', 'style', 'page'];
+/**
+ * Files that mark an adopted design system, and the marker each implies.
+ *
+ * The `shadcn` row is a FALLBACK, not the detector. shadcn's own
+ * `components.json` declares where its primitives live under `aliases.ui`, and a
+ * project that points that alias anywhere other than `components/ui/` was
+ * reported as having no design system at all. Read the declaration first — see
+ * `shadcnUiDirs` — and keep this pattern for the case where `components.json`
+ * is absent or unreadable.
+ */
 const SYSTEM_MARKERS = [
     [/components\/ui\/[a-z-]+\.tsx?$/i, 'shadcn'],
     [/\btailwind\.config\.[cm]?[jt]s$/i, 'tailwind'],
@@ -77,19 +115,90 @@ function walk(root, out = [], depth = 0) {
     }
     return out;
 }
-function classify(rel) {
+/**
+ * True when a module's body is re-exports and nothing else — a barrel.
+ *
+ * `index.[jt]sx?` is one of the page markers, and a barrel is the commonest
+ * thing to call `index`. Reproduced 2026-08-26: `src/ui/components/index.tsx`
+ * containing two `export { X } from './X'` lines classified as `page`, which is
+ * wrong in a way that matters — `page` is what the `audit_path` branch and every
+ * downstream consumer read as "a screen".
+ *
+ * Deliberately conservative. Comments and blank lines are ignored; ANY other
+ * statement — a declaration, a side effect, an `export default` — makes it not a
+ * barrel, so a hybrid `index.tsx` that both re-exports and renders keeps its
+ * page classification. A false negative here costs a page label; a false
+ * positive would silently reclassify real screens.
+ */
+export function isBarrel(text) {
+    const body = text
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l !== '' && !l.startsWith('//'));
+    if (body.length === 0)
+        return false;
+    return body.every((l) => /^export\s+(?:\*|\{)[^;]*from\s+['"][^'"]+['"];?$/.test(l));
+}
+function classify(rel, text = '') {
     if (/\.(css|scss|sass|less)$/i.test(rel))
         return 'style';
-    if (/(^|\/)(pages|app)\//i.test(rel) || /(^|\/)(page|index)\.[jt]sx?$/i.test(rel))
-        return 'page';
+    // `view` is the BLADE branch, not a dead one. It reads 0 in a JS tree by
+    // construction and 2 in this repository's own Laravel fixtures — the two
+    // statements are not in tension, and reading the first as "unused" is the
+    // misreading `road-to-component-granularity-vocabulary` 0.6 was written
+    // against.
     if (/\.blade\.php$/.test(rel) || /resources\/views\//.test(rel))
         return 'view';
+    if (/(^|\/)(pages|app)\//i.test(rel))
+        return 'page';
+    // An `index.*` that only re-exports is a barrel, not a screen.
+    if (/(^|\/)(page|index)\.[jt]sx?$/i.test(rel)) {
+        return /(^|\/)index\.[jt]sx?$/i.test(rel) && isBarrel(text) ? 'component' : 'page';
+    }
     return 'component';
 }
 /**
  * Pure core. Takes (relative path, text) pairs so every branch is testable
  * without a tree on disk — the same reason `ui_authority` takes a record.
  */
+/**
+ * The directories shadcn's own `components.json` declares as its UI root, as
+ * repo-relative prefixes with a trailing slash. Empty when the file is absent,
+ * unparseable, or declares no `aliases.ui`.
+ *
+ * `aliases.ui` is written as a path alias (`@/components/ui`, `~/lib/ui`, or a
+ * bare `src/ui`). The leading alias token is stripped rather than resolved: this
+ * is a marker detector, not a module resolver, and resolving `@` would mean
+ * reading `tsconfig.json` paths for a signal that only has to be right about
+ * WHICH DIRECTORY, never about which module.
+ */
+export function shadcnUiDirs(files) {
+    const out = [];
+    for (const [rel, text] of files) {
+        if (path.basename(rel) !== 'components.json')
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            continue;
+        }
+        if (typeof parsed !== 'object' || parsed === null)
+            continue;
+        const aliases = parsed['aliases'];
+        if (typeof aliases !== 'object' || aliases === null)
+            continue;
+        const ui = aliases['ui'];
+        if (typeof ui !== 'string' || ui.trim() === '')
+            continue;
+        const stripped = ui.trim().replace(/^[@~]\//, '').replace(/^\.\//, '').replace(/\/+$/, '');
+        if (stripped !== '')
+            out.push(`${stripped}/`);
+    }
+    return [...new Set(out)];
+}
 export function buildArtefact(root, files, now = new Date().toISOString()) {
     const uiFiles = files.filter(([rel]) => isUiPath(rel) || isUiTreePath(rel));
     const components = [];
@@ -97,7 +206,17 @@ export function buildArtefact(root, files, now = new Date().toISOString()) {
     const primitives = new Set();
     const markers = [];
     const families = new Set();
+    // Declared shadcn UI roots win over the hardcoded `components/ui/` pattern.
+    // A project whose `aliases.ui` points elsewhere used to report NO design
+    // system, which is the opposite of the truth.
+    const declaredUiDirs = shadcnUiDirs(files);
     for (const [rel] of files) {
+        if (declaredUiDirs.length > 0 &&
+            /\.tsx?$/i.test(rel) &&
+            declaredUiDirs.some((d) => rel.startsWith(d)) &&
+            !markers.some((m) => m.marker === 'shadcn')) {
+            markers.push({ marker: 'shadcn', path: rel });
+        }
         for (const [re, marker] of SYSTEM_MARKERS) {
             if (re.test(rel) && !markers.some((m) => m.marker === marker))
                 markers.push({ marker, path: rel });
@@ -116,7 +235,7 @@ export function buildArtefact(root, files, now = new Date().toISOString()) {
             exports.push(m[1]);
             primitives.add(m[1]);
         }
-        components.push({ path: rel, kind: classify(rel), exports });
+        components.push({ path: rel, kind: classify(rel, text), exports });
     }
     // Greenfield is the ABSENCE of a UI surface, not the absence of a
     // DESIGN.md. A1.3 depends on this distinction: a coherent incumbent with no

package/dist/cli/registry.js

@@ -65,6 +65,8 @@ export const REGISTRY = [
     { name: 'roadmap:progress', disposition: 'delegate', synopsis: 'Regenerate agents/roadmaps-progress.md from open roadmaps; archives completed ones (--no-archive to skip).' },
     { name: 'roadmap:progress-check', disposition: 'delegate', synopsis: 'Fail if agents/roadmaps-progress.md is stale (for CI).' },
     { name: 'roadmap:archive', disposition: 'delegate', synopsis: 'Archive completed roadmaps (PR-gate sweep).' },
+    { name: 'roadmap:set-step', disposition: 'delegate', synopsis: 'The single sanctioned writer of a checkbox glyph: advisory lock, line-anchored edit, live step-count invariant, post-write survival check.' },
+    { name: 'stubs:due', disposition: 'delegate', synopsis: 'Read-only: roadmap stubs past their review_by: date, plus the decisions routed to the owner. Writes nothing; --json, --counts, --today <ISO>.' },
     { name: 'gates', disposition: 'delegate', synopsis: 'Open decisions that need you, as actions — owner-filtered roadmap blockers; --all, --json, --reply, --pending (staged requires_confirmation actions).' },
     { name: 'capabilities:index', disposition: 'delegate', synopsis: 'Regenerate CAPABILITIES.yaml (the package coverage index); --check for CI.' },
     { name: 'adr:effective', disposition: 'delegate', synopsis: "Effective state of one ADR: status, Decision verbatim, clauses its own amendments superseded, active amendments, axes, trigger state. Authorizes nothing." },

package/dist/cli-delegate/{chunk-HYWSRNUX.js → chunk-2DK2VJWG.js}

@@ -1,11 +1,11 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
-import {
-  detectToolPresence
-} from "./chunk-OMIVVCG2.js";
 import {
   buildInstallPlan,
   sha256File
 } from "./chunk-523HCFYO.js";
+import {
+  detectToolPresence
+} from "./chunk-A4QJ6ENT.js";
 
 // src/install/preflight.ts
 import { accessSync, constants, existsSync as existsSync2, statSync } from "node:fs";

package/dist/cli-delegate/{chunk-L43NCYPB.js → chunk-4FS4WRXP.js}

@@ -4525,6 +4525,11 @@ var settingsSchema = external_exports.object({
         "PostToolUse prompt-injection scanner (road-to-security-pillar.md P3.2). Default off. When on, scans tool output (file reads, web fetches, MCP responses) for injection signatures and WARNS in context (never blocks). Runtime backstop on top of the always-on untrusted-input-defense rule; detection is probabilistic."
       )
     }).default({}),
+    runtime_journal: external_exports.object({
+      enabled: external_exports.boolean().default(false).describe(
+        "Runtime event journal (road-to-runtime-event-journal Phase 1). Default off. When on, one durable, episode-keyed record per dispatched hook event is appended to <git-common-dir>/agent-journal/journal.sqlite \u2014 a Class-A write that opens, writes and exits. It emits nothing to the model, never warns and never blocks: a locked database, a missing node:sqlite, a malformed envelope or a full disk all degrade to silence. Off rather than on because it CREATES a storage surface (a SQLite database under your .git/) rather than appending to a directory that already exists. The record type has no field able to hold free-form content \u2014 ids, an event name, a bounded capability identifier, repo-relative locators and two 12-hex digests; no prompt, no file body, no absolute path. Retention: a 30-day TTL anchored on episode close, plus explicit, time-bounded, human-only holds that themselves expire."
+      )
+    }).default({}),
     rtk_wrap: external_exports.object({
       enabled: external_exports.boolean().default(false).describe(
         'PreToolUse RTK-wrap nudge (token-saving Phase 3). Default off. When on AND the binary on PATH is verified as Rust Token Killer (a live two-stage identity probe \u2014 not a self-reported flag, and never a colliding same-name binary), warns (never blocks) "re-run wrapped with rtk" before a single verbose CLI command (git/npm/cargo/docker/\u2026) \u2014 upstream reports 60\u201390% output-token savings (their estimate). Skips completeness-critical / piped / compound commands and git diff. No-op when rtk is absent, unverified, or a different tool.'
@@ -4549,6 +4554,11 @@ var settingsSchema = external_exports.object({
       enabled: external_exports.boolean().default(false).describe(
         "PreToolUse code-graph nudge (ADR-124 Phase 4). Default off. When on AND a native code-graph cache or a consumer-shipped graph.json/SCIP index is present, warns once per session (never blocks) as the agent is about to Grep/Glob or Read a source file \u2014 query the graph first for who-calls/where-used/impact questions (or rebuild if stale, build if absent). Source G\u2019s strict block-first-read mode is deliberately un-ported."
       )
+    }).default({}),
+    suggestion_capture: external_exports.object({
+      enabled: external_exports.boolean().default(false).describe(
+        'Suggestion-block capture (road-to-suggestion-block-capture Phase 2). Default off. Two slots: `stop` reads `last_assistant_message` \u2014 a payload field, so no transcript file is read \u2014 and latches that the assistant turn carried a numbered-options block; `user_prompt_submit` CONSUMES that latch and classifies the answering turn as option_n / as_is / other / stale_block. Consume-once is the correctness guard: the latch is deleted on read, so a bare "1" three turns later meets no latch and classifies `other`, and a latch past its TTL or unparseable is `stale_block` rather than a guess. Writes COUNTS ONLY to agents/runtime/state/audit/suggestion-capture.jsonl \u2014 the record type has no field able to hold a prompt, an option label or a command name, and a test asserts the written key set against src/config/suggestion-capture.json. Off by default because this is an INSTRUMENT rather than a feature: it exists so a capture rate can be measured on a maintainer workspace over a fixed soak window, and there is nothing in it for a consumer to gain.'
+      )
     }).default({})
     // `turn_end_gate` is deliberately ABSENT. The stop-slot turn-end gate is
     // always armed (2026-08-12) and has no settings surface: whether it

package/dist/cli-delegate/{chunk-OMIVVCG2.js → chunk-A4QJ6ENT.js}

@@ -3,6 +3,28 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 // src/install/detect.ts
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
+var SCOPE_DETECT_MANIFESTS = [
+  "package.json",
+  "composer.json",
+  "pyproject.toml",
+  "Cargo.toml",
+  "go.mod",
+  "Gemfile"
+];
+var SCOPE_DETECT_AI_DIRS = [
+  ".claude",
+  ".cursor",
+  ".windsurf",
+  ".augment",
+  ".clinerules",
+  ".copilot",
+  ".gemini",
+  ".codex",
+  ".aider",
+  ".continue",
+  ".roo",
+  ".kilocode"
+];
 function detectToolPresence(root) {
   return {
     augment: isDir(join(root, ".augment")),
@@ -22,5 +44,7 @@ function isDir(path) {
 }
 
 export {
+  SCOPE_DETECT_MANIFESTS,
+  SCOPE_DETECT_AI_DIRS,
   detectToolPresence
 };