@event4u/agent-config 14.11.0 → 14.13.0

package/docs/guidelines/component-oriented-and-oop-development.md

@@ -129,8 +129,9 @@ compose don't duplicate) is paradigm-independent; only its *shape* is OO here:
 
 Language / framework carve-outs (never restated here): PHP →
 [`php-coding-patterns`](php/php-coding-patterns.md) +
-[`patterns.md`](php/patterns.md) (+ `patterns/strategy.md`,
-`patterns/dependency-injection.md`, `patterns/factory.md`, `patterns/service-layer.md`)
+[`patterns.md`](php/patterns.md) (+ `php/patterns/strategy.md`,
+`php/patterns/dependency-injection.md`, `php/patterns/factory.md`,
+`php/patterns/service-layer.md`)
 + skills [`php-coder`](../../src/skills/php-coder/SKILL.md) /
 [`php-service`](../../src/skills/php-service/SKILL.md); Laravel →
 [`laravel`](../../src/skills/laravel/SKILL.md); Symfony →

package/docs/guidelines/cross-role-handoff.md

@@ -93,7 +93,7 @@ Council Q3 (2026-05-05) locks the disambiguation between L4
   shipping — becomes **input to L4**. The escalation is one-way:
   L4 produces the dissent log that decides whether C8's verdict
   is overridden, with the override recorded in
-  [`decision-record`](../../.agent-src.uncondensed/skills/decision-record/SKILL.md).
+  [`decision-record`](../../src/skills/decision-record/SKILL.md).
 
 The boundary keeps the two skills sharp — neither absorbs the other —
 and gives the agent a deterministic rule for which one to load when
@@ -108,7 +108,7 @@ acquisition channel is paid search, but only if CAC payback < 6 months"*:
 2. The CAC question is Wing-4 cognition — `unit-economics-modeling`.
 3. `refine-ticket` hands off via:
    - WHEN NOT entry: *"CAC / payback questions — route to
-     [`unit-economics-modeling`](../unit-economics-modeling/SKILL.md)"*.
+     [`unit-economics-modeling`](../../src/skills/unit-economics-modeling/SKILL.md)"*.
    - Composes line in the procedure step that needs the answer.
 4. The delegate's `## Input` block lists the fields (channel,
    cohort, time horizon); `refine-ticket` passes them.

package/docs/guidelines/design-fidelity-mechanics.md

@@ -161,7 +161,7 @@ The Iron Law and both discriminator clauses stay in
 
 | The artefact declares | The spec is | The spec is NOT |
 |---|---|---|
-| low fidelity — greyscale, box-and-line, placeholder copy | layout · element set · hierarchy · states shown | greys · placeholder text · borders · exact spacing |
+| low fidelity — greyscale, box-and-line, placeholder copy | layout · element set · hierarchy · states shown | grays · placeholder text · borders · exact spacing |
 | finished — colour, real copy, real assets | everything visible (the 1:1 floor, unchanged) | — |
 
 Grounded in [`wireframe`](../../src/skills/wireframe/SKILL.md) § Gotchas. The near-miss

package/docs/guidelines/docs/readme-size-and-splitting.md

@@ -38,9 +38,9 @@ Hard triggers — split immediately:
   deep links
 - **More than 3 framework adapters** → each adapter gets its own doc
 - **Architecture or design rationale > 30 lines** → `docs/architecture.md`
-- **API reference > 50 lines** → `docs/api.md` or auto-generated reference
+- **API reference > 50 lines** → `docs/api.md` or auto-generated reference <!-- ref-ignore -->
 - **Multiple audiences with different needs** → audience-specific docs
-  (`docs/consumers.md`, `docs/contributors.md`)
+  (`docs/consumers.md`, `docs/contributors.md`) <!-- ref-ignore -->
 
 Soft triggers — review and probably split:
 
@@ -122,7 +122,7 @@ deep-link the other:
 - **Package repo** → consumers primary; contributors go to
   `CONTRIBUTING.md` or `docs/development.md`
 - **Application repo** → contributors/team primary; end users (if any)
-  go to `docs/user-guide.md`
+  go to `docs/user-guide.md` <!-- ref-ignore -->
 
 The README must declare its audience within the first screen. Readers
 in the other audience must find their link within the first screen too.

package/docs/guidelines/php/database.md

@@ -7,34 +7,77 @@
 
 ## Indexing
 
+Three separate things get conflated here, and keeping them apart is what makes
+the rest of this section decidable:
+
+1. **Declaring an integrity constraint** — a uniqueness or foreign-key
+   constraint. This is a correctness decision about the data model.
+2. **Indexing the referencing column** — the child side of a foreign key, which
+   is what makes the lookup and the constraint check fast.
+3. **Adding an optional query-performance index** — everything else.
+
+The row-count guidance below governs **(3) only**. It has never governed (1),
+and it must not be read as governing (2).
+
 ### When to add indexes
 
 - Columns in `WHERE` clauses
 - Columns in `JOIN` conditions
 - Columns in `ORDER BY` (especially with pagination)
 - Foreign key columns (Laravel adds with `foreignId()`)
+- Columns carrying a declared uniqueness constraint
 
 ### When NOT to add indexes
 
+These apply to **optional performance indexes** — category (3) above:
+
 - Boolean columns with low selectivity (99% same value)
-- Small tables (< 1000 rows)
+- Tables that are both small (< 1000 rows) **and rarely accessed**
 - Frequently updated columns (indexes slow writes)
 
+**Row count decides nothing on its own.** A 40-row lookup table joined in every
+report query and a 40-row config table read twice a week are the same size and
+not the same decision — index the first on its observed access pattern, leave
+the second alone. "Small" without "rarely accessed" is the folklore half of this
+rule.
+
+**Foreign-key and uniqueness indexes are created regardless of table size.**
+They serve integrity and lookup latency, and a row count bears on neither. A
+40-row child table pointing at a customers table gets its foreign-key column
+indexed like any other. Omit one only on the strength of inspected schema
+behavior plus a representative workload measurement showing it serves no access
+path — never on an anticipated write cost.
+
 ### Composite indexes
 
-Order matters — most selective column first:
+Order matters, and what decides it is the **predicate shape**, not selectivity:
+
+1. Columns compared with **equality** (`=`, `IN`) come first.
+2. Then the column compared with a **range** (`<`, `>`, `BETWEEN`, `LIKE 'x%'`).
+3. Then columns the query only **orders by**.
+
+Selectivity is a tie-break *within* a group, never the primary key of the
+decision. An index cannot use any column after the first range predicate for
+lookup, so a highly selective range column placed first throws away every column
+behind it.
 
 ```php
+// WHERE customer_id = ? AND created_at > ?  ORDER BY created_at
 $table->index(['customer_id', 'created_at']);
 ```
 
+`customer_id` leads because it is the **equality** predicate — not because it is
+more selective. Reverse the order and the equality column sits behind a range,
+where the index can no longer seek on it. That holds even when `created_at` is
+the more selective of the two, which is exactly the case the folklore rule gets
+wrong.
+
 ## Query Optimization
 
 ### EXPLAIN analysis
 
-| Column | Bad value | Meaning |
+| Column | Value worth a second look | The question it raises |
 |---|---|---|
-| `type` | `ALL` | Full table scan — needs index |
 | `rows` | High number | Too many rows examined |
 | `Extra` | `Using filesort` | Sorting without index |
 | `Extra` | `Using temporary` | Temp table — optimize GROUP BY/DISTINCT |
@@ -42,6 +85,22 @@ $table->index(['customer_id', 'created_at']);
 
 Good values: `type` = `ref`, `eq_ref`, `const`; `Extra` = `Using index`.
 
+**`type = ALL` is a full table scan, and a full table scan is often the correct
+plan.** It belongs in no "bad value" column, because the row itself does not
+decide:
+
+- On a table small enough to sit in a page or two, the scan is **cheaper** than
+  an index lookup — the index costs a second read plus a row fetch per hit.
+- On a predicate that matches a large fraction of the table, the planner picks
+  the scan **on purpose**; forcing an index there is slower, and many planners
+  will ignore the hint.
+- On a table with hundreds of thousands of rows and a predicate matching a
+  handful, `ALL` is the defect.
+
+The question to answer is *how many rows the predicate matches, out of how
+many* — not whether `type` reads `ALL`. Compare the planner's `rows` estimate
+against the table's size before concluding anything.
+
 ### Anti-patterns
 
 | Anti-pattern | Fix |
@@ -49,9 +108,20 @@ Good values: `type` = `ref`, `eq_ref`, `const`; `Extra` = `Using index`.
 | `SELECT *` in production | Select only needed columns |
 | `LIKE '%search%'` | Fulltext search or `LIKE 'search%'` |
 | `OFFSET` on large tables | Cursor pagination |
-| Subquery in WHERE | Rewrite as JOIN |
 | `ORDER BY RAND()` | Application-level randomization |
 
+**Subqueries in `WHERE` are not on that list**, and the unconditional "rewrite
+as a JOIN" they used to carry here was wrong more often than it was right:
+
+| The subquery is | Do |
+|---|---|
+| **correlated** — it references the outer row, so it re-executes per row | rewrite as a JOIN, or as a derived table joined once. This is the case the folklore rule was built for |
+| an **uncorrelated `IN` / `EXISTS`** | leave it. Planners flatten these into a semi-join already, and the hand-written JOIN often introduces the duplicate rows a semi-join was avoiding |
+| a **bound on the driving set** — it produces a small list the outer query then filters on | leave it. Rewriting widens the driving set, which is the opposite of the intent |
+
+Check the plan before rewriting: if the subquery already shows as a semi-join or
+a materialized derived table executed once, the rewrite buys nothing and costs
+correctness.
 ### Pagination
 
 Always paginate list endpoints — never `get()` on unbounded queries:
@@ -68,10 +138,23 @@ $users = User::query()->orderBy('id')->cursorPaginate(15);
 
 - Use `php artisan make:migration` to generate.
 - Use `decimal` for money — never `float`.
-- Add foreign keys with `constrained()` + proper `onDelete()`.
+- Add foreign keys with `constrained()`, and **choose** the `onDelete()` action
+  rather than copying one: `cascade` when the child is expendable without its
+  parent, `restrict` when the child is a record in its own right (an invoice, an
+  audit row, a payment), `set null` when it survives the parent with the link
+  removed — which needs a nullable column. The decision table lives in
+  [`laravel-migration`](../../../src/skills/laravel-migration/SKILL.md)
+  § Referential action is a decision.
 - Always add indexes for searchable/filterable columns.
 - One logical change per migration.
-- Make reversible when possible (`down()` method).
+- **Declare recovery, always.** Either a `down()` that restores the prior state,
+  or — when restoration is genuinely impossible — a roll-forward plan written in
+  the migration file itself, naming why restoration is impossible with the
+  evidence, the ordered recovery steps and their inputs, the criteria that say
+  recovery succeeded, and the responsible owner. Silence is the violation, not
+  the absence of `down()`. Full contract:
+  [`laravel-migration`](../../../src/skills/laravel-migration/SKILL.md)
+  § The recovery contract.
 
 ### Multi-connection migrations
 

package/docs/guidelines/prompt-templates.md

@@ -1,8 +1,8 @@
 # Prompt Templates
 
-Reference catalogue of prompt structures the [`prompt-optimizer`](../../.agent-src.uncondensed/skills/prompt-optimizer/SKILL.md)
+Reference catalogue of prompt structures the [`prompt-optimizer`](../../src/skills/prompt-optimizer/SKILL.md)
 skill picks from during the **Develop** step of the 4-D methodology.
-Cited by the [`refine-prompt`](../../.agent-src.uncondensed/skills/refine-prompt/SKILL.md)
+Cited by the [`refine-prompt`](../../src/skills/refine-prompt/SKILL.md)
 skill in `mini` mode for stack-aware shaping.
 
 Templates are tools, not dogma. Pick by request type, not by upstream
@@ -108,7 +108,7 @@ warrants either reaction. The stance slot makes the honest-when-warranted
 contract explicit.
 
 **Package equivalents** — inside this agent-config, the
-[`adversarial-review`](../../.agent-src.uncondensed/skills/adversarial-review/SKILL.md)
+[`adversarial-review`](../../src/skills/adversarial-review/SKILL.md)
 skill implements the same stance via an Attack-Defend-Revise loop and is
 the right tool when the user submits finished work for a critical take.
 This template is for **end-users prompting their own LLM** (ChatGPT,
@@ -155,7 +155,7 @@ are slots the model cannot fill honestly.
 The catalogue's own position: a template earns its place by making a
 request *checkable*, not by making it sound authoritative. Where a rough
 prompt carries one of these three, the
-[`prompt-optimizer`](../../.agent-src.uncondensed/skills/prompt-optimizer/SKILL.md)
+[`prompt-optimizer`](../../src/skills/prompt-optimizer/SKILL.md)
 strips it in its de-inflation sub-step before any template is picked —
 and strips nothing else, because everything outside these three is a
 requirement the author meant. This section is own analysis; it records a
@@ -183,7 +183,7 @@ membership.
 
 ## See also
 
-- [`prompt-optimizer`](../../.agent-src.uncondensed/skills/prompt-optimizer/SKILL.md) — engine-outbound; cites this catalogue in its Develop step
-- [`refine-prompt`](../../.agent-src.uncondensed/skills/refine-prompt/SKILL.md) — engine-inbound; uses templates in `mini` mode for stack-aware shaping
-- [`prompt-engineering-patterns`](../../.agent-src.uncondensed/skills/prompt-engineering-patterns/SKILL.md) — production-LLM prompt patterns (sibling skill, not a catalogue)
+- [`prompt-optimizer`](../../src/skills/prompt-optimizer/SKILL.md) — engine-outbound; cites this catalogue in its Develop step
+- [`refine-prompt`](../../src/skills/refine-prompt/SKILL.md) — engine-inbound; uses templates in `mini` mode for stack-aware shaping
+- [`prompt-engineering-patterns`](../../src/skills/prompt-engineering-patterns/SKILL.md) — production-LLM prompt patterns (sibling skill, not a catalogue)
 - AI Council session: `agents/runtime/council/responses/prompt-master-mini.json` (2026-05-17) <!-- council-ref-allowed: ADR decision trace -->

package/docs/guidelines/redundancy-taxonomy.md

@@ -0,0 +1,180 @@
+# Redundancy Taxonomy
+
+> The one place this package names what duplication *is*, what may be decided
+> about it, and how to tell a second explanation that adds information from one
+> that only adds length. Cited by [`code-clarity`](code-clarity.md) at the
+> authoring moment, by `skill:code-review` at the review moment, and by
+> `skill:code-refactoring` at the refactoring moment. Those three cite it —
+> they do not restate it, because three copies of a redundancy taxonomy would
+> be the defect it describes.
+
+Finding duplication is not a decision. Every finding reaches a **named verdict**
+with a reason, and several of the verdicts keep the duplication. The goal is not
+the lowest clone percentage — it is **one honest authority per shared fact**,
+without marrying independent concepts through a wrong abstraction.
+
+## The classes
+
+**Implementation** — the same code exists twice.
+
+| Class | What it is |
+|---|---|
+| Exact clone | Same tokens. |
+| Renamed clone | Same structure; identifiers or literals differ. |
+| Near clone | Shared core with local additions or deletions. |
+| Structural pattern | Same shape, no copy/paste lineage. |
+| Boilerplate | Framework, protocol, or generated ceremony. |
+| Test repetition | Repeated setup or assertion structure. |
+| Intentional independence | Similar today, meant to diverge. |
+| Wrong abstraction | Already shared, now growing caller flags and modes. |
+
+**Knowledge** — the same *fact* is encoded twice. Usually more actionable than
+raw clone percentage, because a clone can be harmless and a divided fact rarely is.
+
+| Class | What it is |
+|---|---|
+| Knowledge duplication | One business rule, constant, or algorithm encoded more than once. |
+| Policy duplication | One governance decision represented across independent surfaces. |
+| Contract duplication | One external protocol or CLI contract reimplemented instead of consumed. |
+| Delivery-authority duplication | Two authored sources can produce the same shipped artifact. |
+
+**Representation** — the same *meaning* is presented twice to a reader: a
+comment, label, hint, tooltip, placeholder, badge, heading, caption, or toast.
+
+| Class | What it is |
+|---|---|
+| Exact text echo | The same text repeated in the same context. |
+| Paraphrase echo | A second surface restating the first in other words. |
+| Structural narration | Prose naming what the code or UI already shows. |
+| Decorative metadata | An eyebrow, badge, or heading with no scanning or semantic value. |
+| Feedback echo | Status text duplicating already-obvious state. |
+| Accessibility conflict | Removing it would delete required semantic information. |
+
+An accessibility conflict is a **hard guard, never a deletion candidate**. A
+reduction that improves the visual channel by breaking the semantic one is not a
+reduction; it is a defect.
+
+**Naming** — the *dual* of a representation echo. An echo says one meaning twice;
+divergent naming says one meaning with two words, so the reader cannot tell
+whether they are looking at one concept or two. It is a modelling defect rather
+than a style preference: a concept carries one term across the whole model, and
+several terms for one concept is the model telling you it has not decided.
+<!-- harvest:one-language-per-concept-inconsistency-is-a-model-defect -->
+
+| Class | What it is |
+|---|---|
+| Spelling variant | One word, two spellings (`artifact` / `artefact`). No semantic difference; decidable without judgement. |
+| Synonym drift | One concept, several terms. Needs a term map, because the terms may denote different things. |
+| Homonym collision | One term, several meanings. The opposite failure, and usually `keep-duplicated` when the meanings are module-local. |
+
+Naming verdicts: `canonicalize-term` · `keep-distinct` (with the recorded reason
+— an external compatibility value, a quoted name, a genuinely different concept)
+· `defer-for-context`.
+
+**Only a spelling variant is mechanically decidable, and the split between the
+prose layer and the identifier layer is decisive.** Prose is a substitution;
+filenames, symbols and their test and task references are a rename refactor with
+its own blast radius, and the same cluster can be committed to different sides on
+each layer. Measure both before proposing either — the measured example is in
+`agents/evidence/analysis/wording-baseline-2026-08-25.md`, where nothing imports
+across the split and the identifier layer is therefore `keep-duplicated` while
+the prose layer is `canonicalize-term`.
+
+Synonym drift is the class to be slowest about. Words that read as synonyms in
+translation frequently denote different mechanisms — here `route`, `dispatch`,
+`delegate`, `spawn` and `forward` are five mechanisms, not one concept spelled
+five ways — so a sweep over them destroys information the echo classes exist to
+protect.
+
+## Why any of this is worth a gate at all
+
+Generated code trends toward duplication rather than reuse: measured
+longitudinally over roughly 211 million changed lines, copy/pasted code rose from
+8.3 % to 12.3 % of changes over the period assistance became common.
+<!-- harvest:ai-agents-raise-copy-paste-share --> The pressure this document
+resists is therefore not a hypothetical — it is the default direction of the tool
+writing the code, which is why `keep-duplicated` needs to be a recorded verdict
+rather than an unstated outcome.
+
+Where enforcement follows, the shape is already known: separate the term list
+from the rules, and control false positives by **syntax awareness** — skip
+frontmatter, fenced code and inline code rather than matching inside them.
+<!-- harvest:prose-linter-vocabulary-accept-reject --> `check_md_language.ts`
+already carries exactly that skip machinery.
+
+## The verdicts
+
+For implementation and knowledge findings: `extract-local` · `extract-module` ·
+`canonicalize-knowledge` · `canonicalize-contract` · `single-copy-delivery` ·
+`data-drive` · `compose-strategy` · `generate` · **`keep-duplicated`** ·
+`defer-for-evidence` · **`de-abstract`**.
+
+For representation findings: `keep` · `drop` · `consolidate` ·
+`rewrite-for-signal` · `accessibility-block` · `defer-for-context`.
+
+`keep-duplicated` and `de-abstract` are **successful outcomes**, not failures to
+act. A wrong abstraction costs more than the duplication it replaced, so a
+recorded decision to leave two copies alone — or to split one shared unit back
+apart — closes a finding as legitimately as an extraction does. What is not
+allowed is silence: a finding with no recorded verdict stays open.
+
+## Before sharing an implementation
+
+1. Is it the same knowledge, or two facts that currently look alike?
+2. Would both copies change for the same reason?
+3. Is there one honest domain name that fits every call site?
+4. Can the common core stay free of caller-specific flags and modes?
+5. Is the dependency direction healthy?
+6. Does this reduce maintenance risk, or only line count?
+7. Are public contracts preserved, and do tests prove behavioural equivalence?
+8. Is this generated or protocol ceremony that should stay explicit?
+9. **If the two copies diverged tomorrow, would that be a defect or legitimate
+   evolution?**
+
+A "legitimate evolution" answer to the last question is decisive: prefer
+independence, verdict `keep-duplicated`.
+
+## The Information Delta Test
+
+Before adding any comment, docblock, label, hint, tooltip, placeholder, badge,
+caption, empty-state line, or explanatory sentence, in code or in a user
+interface:
+
+- **A — Information delta.** What fact becomes unavailable if this text is
+  deleted? A non-obvious reason, an invariant, a required format, a unit, a
+  consequence, a safety warning, a recovery action, a privacy implication, an
+  unfamiliar concept, an accessibility name, or necessary grouping all count. If
+  the answer is "nothing", delete it.
+- **B — Representation delta.** Is that fact already carried adequately by a
+  nearby representation — the name, the type, the component structure, the
+  semantic element, the visible control text, an icon, a test? If so,
+  consolidate; do not repeat.
+- **C — Channel preservation.** Would deleting it weaken visual comprehension,
+  semantic accessibility, or both? Never optimise one channel by breaking the
+  other.
+- **D — Persistence.** Will it still be true after the next ordinary refactor?
+  Text describing the current implementation rather than the durable constraint
+  is noise with a delay fuse.
+- **E — Actionability.** For user-facing copy: does it change what the reader
+  understands, chooses, enters, expects, or does next? If not, it is a strong
+  deletion candidate.
+
+The rule is **not** "less text". It is: if removing the text loses no
+information in any required channel, remove it — and if the information is
+required, express it once, in the strongest native form available. A visible
+form label is required information, so it stays; a placeholder repeating that
+label is an exact text echo, so it goes.
+
+## Legacy is baseline, new duplication is the finding
+
+Existing duplication does not fail an unrelated change. A review or refactor
+raises a finding when a change **introduces** high-confidence knowledge, policy,
+contract, or delivery-authority duplication — or when it touches a surface that
+already carries some. Anything else is debt with a measurement, not a blocker.
+
+## See also
+
+- [`code-clarity`](code-clarity.md) — the authoring moment; comment discipline
+  and the banned classes this test generalises.
+- [`abstraction-thresholds`](abstraction-thresholds.md) — how much repetition
+  earns an abstraction, per artifact class.

package/llms.txt

@@ -281,9 +281,9 @@ technical-specification: Use when the user says \"write a spec\", \"create RFC\"
 terraform: Use when writing Terraform — AWS modules, resources, variables, outputs, remote state — even when the user just says 'provision this infra' or 'add an S3 bucket' without naming Terraform.
 terragrunt: Use when working with Terragrunt — DRY multi-env configs, module dependencies, remote state orchestration — even when the user just says 'deploy this to staging and prod' without naming Terragrunt.
 test-case-discovery: Use BEFORE writing any test — enumerate cases per behavior (happy / boundary / error / abuse), prioritize by likelihood × impact, cross-check via subagent — even if the user just says 'add tests'.
-test-driven-development: Use when implementing a feature, fixing a bug, or refactoring — write a failing test first, then the code — even if the user just says 'add this function' or 'fix this bug'.
+test-driven-development: Use when implementing a feature, fixing a bug, or refactoring — write the failing test first, then the code, even on 'add this function'. Owns the ORDER; test shape is `testing-anti-patterns`.
 test-performance: Use when optimizing test suite performance — database setup, seeder optimization, parallel testing, CI pipeline efficiency, or RefreshDatabase alternatives.
-testing-anti-patterns: Use BEFORE writing/changing tests, adding mocks, or test-only methods on production classes — vs mocking-the-mock, production pollution, partial mocks, and overfit/tautological assertions
+testing-anti-patterns: Use BEFORE writing/changing tests or adding mocks — mocking-the-mock, production pollution, overfit assertions — even on 'is this test any good?'. Test SHAPE; the order is `test-driven-development`.
 threat-modeling: Use when adding auth, webhooks, uploads, queues, secrets, tenant boundaries, or public endpoints — produces trust boundaries + abuse cases mapped to files, BEFORE implementation.
 throughput-vs-morale-tradeoff: Use when balancing eng-team velocity vs quality vs burnout — on-call load, focus fragmentation, reorg shock. Triggers on 'team is burning out', 'why is velocity dropping'.
 token-optimizer: Use BEFORE any verbose CLI run, large file read, doc conversion, or near-context handoff — decision tree keyed by intent citing the canonical token-saving asset.

package/package.json

@@ -1,8 +1,8 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.11.0",
-    "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
+    "version": "14.13.0",
+    "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,
     "type": "module",
@@ -52,14 +52,21 @@
         "AGENTS.md",
         "CHANGELOG.md",
         "CONTRIBUTING.md",
+        "CREDITS.md",
         "LICENSE",
         "MIGRATION.md",
+        "NOTICE",
+        "docs/THIRD-PARTY-NOTICES.md",
         "README.md",
         "llms.txt",
         "!dist/**/*.test.js",
         "!dist/**/*.test.js.map",
         "!dist/**/*.spec.js",
-        "!dist/**/*.spec.js.map"
+        "!dist/**/*.spec.js.map",
+        "!src/**/*.test.ts",
+        "!src/**/*.spec.ts",
+        "!dist/agent-src/skills/**/evals/**",
+        "!dist/**/*.map"
     ],
     "bin": {
         "agent-config": "dist/cli/agent-config.js"