@event4u/agent-config 14.12.0 → 14.13.0

package/.augment-plugin/marketplace.json

@@ -1,20 +1,20 @@
 {
   "name": "event4u-agent-config",
   "description": "Governed agent system — skills, rules, commands, and guidelines for AI-assisted development.",
-  "version": "14.12.0",
+  "version": "14.13.0",
   "owner": {
     "name": "event4u",
     "email": "dev@event4u.app"
   },
   "metadata": {
     "description": "A policy-driven execution system that enforces quality, consistency, and developer-like behavior for AI agents.",
-    "version": "14.12.0"
+    "version": "14.13.0"
   },
   "plugins": [
     {
       "name": "agent-config",
       "description": "Full governed agent system — rules, skills, commands, guidelines, and runtime tooling.",
-      "version": "14.12.0",
+      "version": "14.13.0",
       "source": ".",
       "category": "governance",
       "tags": [

package/.augment-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-config",
   "description": "A governed skill framework for AI agents — runtime execution, tooling, observability, feedback, and lifecycle management with policy-driven quality enforcement.",
-  "version": "14.12.0",
+  "version": "14.13.0",
   "author": {
     "name": "event4u",
     "email": "dev@event4u.app"

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "14.12.0",
+    "version": "14.13.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -411,6 +411,240 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 14.13.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [14.13.0](https://github.com/event4u-app/agent-config/compare/14.12.0...14.13.0) (2026-08-31)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _auto-derived, rewrite before merge:_ rule/schema diffs, breaking commits or removed public surface in 9acdc14, af0cf0b, e9f4b31, 6a5670b, 30a75c6, 7cb1d1d +6 more.
+- **Default changes + migration:** _auto-derived, rewrite before merge:_ commits naming a default, migration or migrate in 728d147.
+- **Security and correctness:** _auto-derived, rewrite before merge:_ security-scoped commits or fixes to executable surface in 2219e00, eb4550e, e9f4b31, 60e9582, c3b0123, 2170de4 +19 more.
+- **Honest nulls:** _auto-derived, rewrite before merge:_ commits recording a null, waived or falsified result in 6a5670b, 10949a3, 98325c7, af16afe.
+- **Known limitations:** _none_
+
+### Features
+
+* **roadmap:** surface two stub counts in the dashboard header ([2a76847](https://github.com/event4u-app/agent-config/commit/2a76847d90dd964c7d4fed2046dd109a551fbbd2))
+* **cli:** add stubs:due, the read-only reader over parked-roadmap frontmatter ([1e7753c](https://github.com/event4u-app/agent-config/commit/1e7753c1d41a09bb610e599a00545574fbb6b876))
+* **skills:** the ranker fails loudly, and cross-skill links resolve in the tree a consumer receives ([bd4d021](https://github.com/event4u-app/agent-config/commit/bd4d021331135c20efd0fc3a85d141995f2859ab))
+* **code-graph:** classify the ambiguous population, and it inverts the premise ([63777fd](https://github.com/event4u-app/agent-config/commit/63777fde0903322edc2183167f6e01f79ac401ff))
+* **eval:** gate the measurement inputs, and score direction not magnitude ([031cd29](https://github.com/event4u-app/agent-config/commit/031cd2910c0580fd5aa59b306841416f3b059f17))
+* **roadmap:** close skill-ecosystem-runtime-enforcement ([7d19d88](https://github.com/event4u-app/agent-config/commit/7d19d885ab453c1a7cd9f06a1e2264c5515ef767))
+* roadmap:set-step — the single sanctioned writer of a checkbox glyph ([c3944c4](https://github.com/event4u-app/agent-config/commit/c3944c4c446add10e0801fefeb450fadbc4e69de))
+* bounded-loop guards — atomic budget, whole-line marker, dependency halt ([34dae8d](https://github.com/event4u-app/agent-config/commit/34dae8d2c46bd6f97d0d41fdf53f371d6ab08426))
+* terminal-state vocabulary, and machine-decidable retry + truncation ([f1db91c](https://github.com/event4u-app/agent-config/commit/f1db91cf3a6023a8bfafae201339333aee660700))
+* projection reach, host-tool vocabulary, and two portability gates ([a894054](https://github.com/event4u-app/agent-config/commit/a894054d57aef1faeb6af81d887d71734b947790))
+* runtime-wiring diagnostics — settings, router, hooks, inherited git env ([c3d2373](https://github.com/event4u-app/agent-config/commit/c3d23734b02401f2da2a880c112e3a8a99f097b8))
+* lint_memory_twin_parity — the two shipped copies may not drift apart again ([ac2e5db](https://github.com/event4u-app/agent-config/commit/ac2e5dbedcbb9d59809414d779c146b862b31833))
+* measure docs/ dead links, and widen check_references to the shipped root ([e3a96fe](https://github.com/event4u-app/agent-config/commit/e3a96fe3c150c16a6a9e1cd3636eb98b97481c80))
+* the beta-deadline trigger as a command, plus the gate's own discrimination proof ([0d7233a](https://github.com/event4u-app/agent-config/commit/0d7233a1fbf9ac4f0406f386020e5e62d530de1f))
+* lint_canonical_terms — hold the house dialect with a ratchet ([9b51665](https://github.com/event4u-app/agent-config/commit/9b51665b7ef44a1f712e67df1ca388748eba46dc))
+* **hooks:** add the container-only tooling shim and its session installer ([175fe4d](https://github.com/event4u-app/agent-config/commit/175fe4dfc4641960525d946664d758dd71e3331e))
+* **gates:** give check_beta_review_markers a floor, behind a no-growth ratchet ([ac0612b](https://github.com/event4u-app/agent-config/commit/ac0612b4c236741fc0124ff0204f7fbad5b51931))
+* **config:** record the canonical term map — American, sweep NOT authorised ([6a2000b](https://github.com/event4u-app/agent-config/commit/6a2000bc8f366319bec5fc84650e946be625a52b))
+* **config:** extract the drafting-channel enum into a validated data file ([efbb8c9](https://github.com/event4u-app/agent-config/commit/efbb8c956254ccfe5a69da0787844f23bc7e6abe))
+
+### Bug Fixes
+
+* **deps:** bump js-yaml from 5.3.0 to 5.4.1 in the npm-production group (#1766) ([a7ead3d](https://github.com/event4u-app/agent-config/commit/a7ead3d19025efa5f757846cb393078ab583e37f))
+* **ci:** exempt bot-generated body and commit text from the off-tree metadata gate (#1768) ([2219e00](https://github.com/event4u-app/agent-config/commit/2219e005f1444694c9653b4bf23b307e6f019df1))
+* **drain:** six defects a neutral review found in code that had just merged green (#1723) ([eb4550e](https://github.com/event4u-app/agent-config/commit/eb4550ed78cb89e659ca7c68c8e11f552e8dacee))
+* **bench:** the void class was a scorer artifact — and the +89 pp fix for it was one too (#1711) ([60e9582](https://github.com/event4u-app/agent-config/commit/60e95826ac63212801b04e4a8681a761c4a064fd))
+* **contracts:** the two value contracts lapsed yesterday and blocked every PR (#1710) ([0887651](https://github.com/event4u-app/agent-config/commit/0887651748d11a0cb22410ffc5bb2ea23264026e))
+* **gate:** the supervision pattern matched a denial, and six more review findings (#1702) ([c3b0123](https://github.com/event4u-app/agent-config/commit/c3b0123f737cd53337a780430ac64e91e69e5546))
+* **council:** a subscription-CLI answer costs nothing, and cost_usd_actual said otherwise (#1695) ([2170de4](https://github.com/event4u-app/agent-config/commit/2170de4539a9b34a084636cf0b46d4e8d5f14667))
+* **contracts:** review the three beta deadlines that lapsed on 2026-08-26 (#1687) ([258d1a1](https://github.com/event4u-app/agent-config/commit/258d1a1bdeedd39eb86278acdee67aa5ae28a9dd))
+* **roadmap:** mark the deliberately-nonexistent path with ref-ignore ([7e53be5](https://github.com/event4u-app/agent-config/commit/7e53be5813aba7960e7847179075372f24dff70f))
+* **adr:** regenerate the ADR index so ADR-246 has its row ([163b0bb](https://github.com/event4u-app/agent-config/commit/163b0bb9f4301e98e28f70913f7d70b0297f386a))
+* **adr:** ADR-246 gains its Evidence section, and the context shrinks back under its ceiling ([df20eae](https://github.com/event4u-app/agent-config/commit/df20eae32e72fff00d8c66f9fba20eb08d97b769))
+* lower the source-size baseline to the live total, as its own test requires ([42946ec](https://github.com/event4u-app/agent-config/commit/42946ec3c0479722853969ffc26b030c5ae4d76b))
+* **ci:** resolve the consistency-workflow conflict the merge left behind ([0b90410](https://github.com/event4u-app/agent-config/commit/0b90410dd9033de324e260f069c49888d8843f78))
+* **evidence:** declare the evidence type on both analysis artifacts ([06ce4e8](https://github.com/event4u-app/agent-config/commit/06ce4e8ad347b1747ebb0bc62340d183123d71e0))
+* four branch-only CI reds, each a real contract break ([3fa9718](https://github.com/event4u-app/agent-config/commit/3fa9718bfc33fc1e0c8ed90aa0e36a8e0db027ab))
+* three CI reds this branch introduced, each a real contract break ([e473906](https://github.com/event4u-app/agent-config/commit/e473906449a7e4b148421a0dbad0be4081422af6))
+* the dependency-halt rung shipped dead, and the wiring is now tested ([8828288](https://github.com/event4u-app/agent-config/commit/88282887fdbb0b8fb8f533279c874665e14e9b09))
+* **test:** memory_signal snapshots gain the restored subject key ([565ab7a](https://github.com/event4u-app/agent-config/commit/565ab7a4b0c5b43254190b2b2a37dc77dbfc2eec))
+* **memory_lookup:** the template retrieved deprecated and stale memory ([4fac3a7](https://github.com/event4u-app/agent-config/commit/4fac3a727538877e92358d02322c3382d90a41d1))
+* **check_memory_proposal:** reconcile BOTH ways — 45 non-comment lines to 12 ([0a8d6ad](https://github.com/event4u-app/agent-config/commit/0a8d6ad75868deed26b6fd1ea62486c4787a2cb5))
+* **check_memory:** reconcile the template snapshot — 195 non-comment lines to 18 ([c2a2ea5](https://github.com/event4u-app/agent-config/commit/c2a2ea51d771066010cdfaf6778494b8061a0705))
+* **memory_signal:** the template was missing ADR-130's provenance gate entirely ([126da11](https://github.com/event4u-app/agent-config/commit/126da113012f291949e576c1654aba6185e407fb))
+* drop the retired-container literal from the measurement docstring ([aed43b9](https://github.com/event4u-app/agent-config/commit/aed43b9c8d8b64a849d219b81769a224a1db1f90))
+* close the two failures this branch introduced ([7fd0acf](https://github.com/event4u-app/agent-config/commit/7fd0acf1259f56b7d0f108b33fc5d6134c1dc70d))
+* raise the routing-coverage skills seed to the live 0.3144 ([50b661b](https://github.com/event4u-app/agent-config/commit/50b661bf142ee66b28a9ac3bcddb4c458d112af3))
+* repair every dead link in shipped docs, and the .py migration class ([728d147](https://github.com/event4u-app/agent-config/commit/728d1474abf6321d9d2a1fc8bc213b4f95a89edc))
+* eight docs/contracts files were missing the required stability frontmatter ([87b3187](https://github.com/event4u-app/agent-config/commit/87b3187110c541cf0e44f9c6af43eb337024ba17))
+* agents/tickets/symptoms is not a ticket bundle ([73b9941](https://github.com/event4u-app/agent-config/commit/73b994156f25e9efc931be50dc3ff9efb5982cd9))
+* close the stale newInThisChange flag on lapsed-beta-baseline ([3f4f6c6](https://github.com/event4u-app/agent-config/commit/3f4f6c64c28407bad4091c801ab2e50feeae6ba2))
+* tighten the trigger-eval presence ratchet to green ([e039391](https://github.com/event4u-app/agent-config/commit/e039391c663b8cc85ee466c374d52af45ca6a8dc))
+* state py_format's live contract instead of fidelity to a deleted original ([e59255a](https://github.com/event4u-app/agent-config/commit/e59255aea9ce928a77c775cc5481bdc9da4c51e7))
+* give the local preamble-payload task the same ceiling CI uses ([f61714f](https://github.com/event4u-app/agent-config/commit/f61714f58ca5a8bdf6a1c49405b39ded093902b6))
+* drop the retired-container literal from lint_canonical_terms ([55e18e5](https://github.com/event4u-app/agent-config/commit/55e18e5c68a3f073191ec5a68f0de491e66c5c82))
+* restore check_gate_completeness to its baseline — four ledger adoptions ([90e87f5](https://github.com/event4u-app/agent-config/commit/90e87f5445e63e36076f02c29706568b63ed7d9d))
+* **gates:** declare the lapsed-beta baseline in SUPPRESSION_INVENTORY ([fedacbd](https://github.com/event4u-app/agent-config/commit/fedacbda61aa7975f4a2c65d6f0139ee3bc4f4cf))
+* **test:** satisfy tsc in the drafting-channel schema test ([079ed87](https://github.com/event4u-app/agent-config/commit/079ed87b8192c645e03a7b9b1b7cc7a84236bc5e))
+
+### Documentation
+
+* **evidence:** record the second 2026-08-30 PR-drain run (#1738) ([ef6ff88](https://github.com/event4u-app/agent-config/commit/ef6ff8848dc289598906fab72733baa281d9155f))
+* **evidence:** record the 2026-08-30 PR-drain run (#1732) ([5162341](https://github.com/event4u-app/agent-config/commit/51623415d168360e2620d8f18daf8e925e39ebca))
+* **evidence:** the estate/payload ratchet collision that blocks the ERD landing (#1694) ([7ee3682](https://github.com/event4u-app/agent-config/commit/7ee368224b4a7bbdfcbff8360d15f9aa6bcd7ece))
+* **evidence:** record the 2026-08-27 PR-drain run (#1690) ([5a8f6b5](https://github.com/event4u-app/agent-config/commit/5a8f6b592ecf809eed64d902174cbc808bb4b5ac))
+* **evidence:** citable skipped parents, decidable kernel decisions (#1680) ([0be1cf6](https://github.com/event4u-app/agent-config/commit/0be1cf6b797d68e9461c44a120f3ce2c8956bea4))
+* **evidence:** record the 2026-08-26 PR-drain run (#1678) ([3738c23](https://github.com/event4u-app/agent-config/commit/3738c23e31c021efc3469b431509679304c31319))
+* **roadmaps:** four database-mastery roadmaps from a verified inbox drop (#1676) ([82e47ce](https://github.com/event4u-app/agent-config/commit/82e47cefcf869ec29d9a9dc4212b5b03daed89af))
+* **roadmaps:** stop the three-tree sample from doing priority work (#1674) ([2d7cca0](https://github.com/event4u-app/agent-config/commit/2d7cca0b91593f6009082ff567940008b588e8ba))
+* **roadmaps:** road-to-consumer-repo-reality — findings from three consumer trees (#1672) ([0fcec0f](https://github.com/event4u-app/agent-config/commit/0fcec0f884b704b36f5cb0f14e6b26dcf1bdebaa))
+* **governance:** register four owner-reserved decisions, two without a position ([3c89b24](https://github.com/event4u-app/agent-config/commit/3c89b2480bf5615083e14fa2eb0e5b42f9252597))
+* **stubs:** give every parked file a next-read date and a findable probe ([c8c8aed](https://github.com/event4u-app/agent-config/commit/c8c8aed936c6e43a9f3346fb47e48da5896a1bd9))
+* **roadmap:** consolidate four test-first proposals into one verified roadmap ([d35f93b](https://github.com/event4u-app/agent-config/commit/d35f93b7761e14c5075efb973c7000b1be8c0600))
+* **roadmap:** the two blocked items are OPEN, not deferred ([537a3b7](https://github.com/event4u-app/agent-config/commit/537a3b737fdc394db1f185458ad4df9a33e21371))
+* **roadmap:** kernel invariant remedy decided; clause 1 is human-only ([ef80f0f](https://github.com/event4u-app/agent-config/commit/ef80f0f022fdbbfcb438cc3a0d8f8ba4dac9c852))
+* **roadmaps:** activate the three 2026-08-26 inbox-drain roadmaps ([e8b2376](https://github.com/event4u-app/agent-config/commit/e8b2376c4dc3acb534c94a9fa2eda0cf6c913be2))
+* **roadmaps:** land three roadmaps from the 2026-08-26 inbox drain ([af16afe](https://github.com/event4u-app/agent-config/commit/af16afed3650b6d8ae0acc3c3db88979444ca4d2))
+* close road-to-memory-twin-reconciliation ([63e562e](https://github.com/event4u-app/agent-config/commit/63e562e3eae3f5cc706971a8e0563a2941b706a7))
+* evidence + close road-to-contract-review-deadlines ([4125cbf](https://github.com/event4u-app/agent-config/commit/4125cbfaa484f21cefc83100565bcd240a939234))
+* track the kernel-invariant loss check_rule_invariants found ([959be63](https://github.com/event4u-app/agent-config/commit/959be63829bc850ebba9a2772148959a829a42c4))
+* classified canonical-terms inventory + close road-to-canonical-terms ([2166c47](https://github.com/event4u-app/agent-config/commit/2166c47f2a77e247d71c3aee2dd39bd08786e362))
+* **contracts:** record the hook performance doctrine and marker convention ([be78af0](https://github.com/event4u-app/agent-config/commit/be78af0258987455c1e2bb607743ff36f513d3a0))
+* **contracts:** record the lapsed-beta decision and close the 25% trigger ([2df5d26](https://github.com/event4u-app/agent-config/commit/2df5d26299f6758f30b383b0c1a3db66e5a87848))
+* **evidence:** inventory the 86 lapsed beta contracts with a proposed disposition ([3f4675f](https://github.com/event4u-app/agent-config/commit/3f4675f39b396f6de2b546c53dcde2c08fd40956))
+* **evidence:** correct the wording baseline — the aggregate hides a scope effect ([0cd54f3](https://github.com/event4u-app/agent-config/commit/0cd54f3ee4924e368915d7c41acc5f2cc2f8ad73))
+* **decisions:** B4 regeneration-writer architecture decision packet ([42866e1](https://github.com/event4u-app/agent-config/commit/42866e1314ac5b99f654955b5effaf235feca642))
+* **brand-asset-generation:** name the platform-cover surface class ([764fcff](https://github.com/event4u-app/agent-config/commit/764fcff4592750cf3bfaed5b1dc74538f6a902db))
+* **brand-audit:** exclude profile surfaces, and constrain platform guidance ([e6e808c](https://github.com/event4u-app/agent-config/commit/e6e808ca5188f9c4f8a0f2c9647a7b5da9ac664a))
+* **contracts:** extend write-engine's beta window to 2026-09-24 ([b72c3b2](https://github.com/event4u-app/agent-config/commit/b72c3b2b3b286f3f7677a1edbddb7bbe9c747e7d))
+* **gtm:** point the two --channel surfaces at the data file ([e5c1203](https://github.com/event4u-app/agent-config/commit/e5c12035b89b3cf9a6bb5a93e23037b755564983))
+
+### Refactoring
+
+* **roadmap:** extract the stub header fragment to pay the size ratchet ([b6d9707](https://github.com/event4u-app/agent-config/commit/b6d9707717ecfed8121928929c3509d2e381a99e))
+* extract the markdown prose classifier into _lib/md_prose_lines ([bac7c17](https://github.com/event4u-app/agent-config/commit/bac7c17e6b87a5ca511522238a169bb39ff96be6))
+
+### Chores
+
+* **deps-dev:** bump the npm-development group with 5 updates (#1767) ([56f102c](https://github.com/event4u-app/agent-config/commit/56f102c623573760e40d34dc4dde019abf5c5a21))
+* **stubs:** give the merged-in benchmark-rerun stub its review_by date ([49d6d0c](https://github.com/event4u-app/agent-config/commit/49d6d0c42cfd42c7713f38247a6be7333574780e))
+* regenerate the ADR evidence census ([25120db](https://github.com/event4u-app/agent-config/commit/25120dbd695fbf86748667f12a76d14f09fe33f7))
+* register lint_memory_twin_parity on all four surfaces ([98f65a7](https://github.com/event4u-app/agent-config/commit/98f65a7fc54618f72ef677ded753b78ad46f35aa))
+* put the beta-deadline gate where a pull request can see it ([dfdc45c](https://github.com/event4u-app/agent-config/commit/dfdc45cfbeda01973a452e69795ac109e65b0c74))
+* regenerate the stale settings reference ([853ec23](https://github.com/event4u-app/agent-config/commit/853ec23f1d558d7eb28789da8b8b299c8130071a))
+* regenerate the stale ownership matrix ([dad0264](https://github.com/event4u-app/agent-config/commit/dad0264e7981537833379f88888b9d368940477a))
+* re-pin .secret-allow after the gate-coverage row landed ([d525f05](https://github.com/event4u-app/agent-config/commit/d525f05df8986263cf242798dba4df4bd3fa28f1))
+* regenerate agents/index.md ([fca4e8a](https://github.com/event4u-app/agent-config/commit/fca4e8a6b28a10e8994a18576c1d30af69900f2e))
+* archive road-to-canonical-terms ([ba6efd4](https://github.com/event4u-app/agent-config/commit/ba6efd407d0f3b326f747fb124b7c542b5d8755f))
+* bounded canonical-terms pilot — 18 occurrences, 12 files ([0b3d0b6](https://github.com/event4u-app/agent-config/commit/0b3d0b6dd650becb356e08d53a44707953371fd7))
+* register lint_canonical_terms on all four surfaces ([dc44ba4](https://github.com/event4u-app/agent-config/commit/dc44ba47ab3112c78d270084d04347324e746c19))
+* **roadmaps:** park episode-finalizer-v2, descope its two rate steps ([69a5cc4](https://github.com/event4u-app/agent-config/commit/69a5cc4c12f7facdd42e97be8113896f9c2c07c9))
+* **roadmaps:** re-review the memory-twin risk register ([f5b29ba](https://github.com/event4u-app/agent-config/commit/f5b29baec329228f2624c41136d3407dfb77fba0))
+* **roadmaps:** memory-twin — release class decided, two twins characterised ([78df05d](https://github.com/event4u-app/agent-config/commit/78df05d916de2c9ea0d4a33b8591ea16a23c60a3))
+* **roadmaps:** resolve both blockers and land Phase 1 of runtime-enforcement ([ec59527](https://github.com/event4u-app/agent-config/commit/ec5952771b57658d05ed87227dbe4cd1d6547adf))
+* **roadmaps:** stamp the risk re-review at 2026-08-26 ([c398d94](https://github.com/event4u-app/agent-config/commit/c398d94d5ec55b6beb1b5ffb0959fccf86a33936))
+* **roadmaps:** re-review the contract-review-deadlines risk register ([40400a0](https://github.com/event4u-app/agent-config/commit/40400a02a8d1123bb5d599a2274cc272aa0186e5))
+* **evidence:** declare the inventory's artifact type ([ae898c9](https://github.com/event4u-app/agent-config/commit/ae898c9cec6a8d2f75761e0dd836392eca00cc2d))
+* **roadmaps:** close Phase 0 and Phase 1 of contract-review-deadlines ([14c4efa](https://github.com/event4u-app/agent-config/commit/14c4efa1c1764f5132fcd8f0ee97878de918a85e))
+* **roadmaps:** decide all three deferred decisions in canonical-terms ([4e757ca](https://github.com/event4u-app/agent-config/commit/4e757ca1b1b6cc0f1f82a28d4e309dd659a1c0f4))
+* **roadmaps:** park merge-surface-zero to later/, split step 3.1 ([261dd03](https://github.com/event4u-app/agent-config/commit/261dd0342de311b4d8662fff5f42202208d9769d))
+* **sync:** regenerate dist projection and pack token passport ([10d003d](https://github.com/event4u-app/agent-config/commit/10d003dd6a7a9087100de060d73f461b37551778))
+* **roadmaps:** archive channel-contract-and-profile-drift ([fedcd0b](https://github.com/event4u-app/agent-config/commit/fedcd0bb58efd0b39e93014a36829bd8c3c6619e))
+* **roadmaps:** close channel-contract-and-profile-drift ([a169f0f](https://github.com/event4u-app/agent-config/commit/a169f0f7cba37d99eca08929d5641b518997a2d5))
+* **roadmaps:** track the trigger-eval presence ratchet, 18 violations ([50da57c](https://github.com/event4u-app/agent-config/commit/50da57cee3d55ce9a4018e0250bff609f256a4b8))
+* **roadmaps:** archive web-launch-readiness ([59089c9](https://github.com/event4u-app/agent-config/commit/59089c9d5643892a96dd77efe88769f6495d5fc6))
+* **roadmaps:** close web-launch-readiness by approved rescope ([86543cb](https://github.com/event4u-app/agent-config/commit/86543cb11bb9a54b6ef958e025bf0e024ee6d121))
+* **roadmaps:** activate nine workable roadmaps out of draft ([548a891](https://github.com/event4u-app/agent-config/commit/548a891cbef214749cdb693dac5312d0484847d5))
+* **roadmaps:** un-park the two verification-track roadmaps whose slot freed ([3452528](https://github.com/event4u-app/agent-config/commit/34525288ee135a8068fc87cd7bb3590cdb987d37))
+
+### Other
+
+* council-topology 27/77 → 28/77 — a precedent settled and machine-enforced, a blocker falsified, a hidden condition carried (#1772) ([9231837](https://github.com/event4u-app/agent-config/commit/92318379afb33806f8447f142155bd8a12ab12b1))
+* governed-harness — two false claims corrected, one objection discharged, one candidate rejected (#1771) ([d9e1d7c](https://github.com/event4u-app/agent-config/commit/d9e1d7cbce6858e455c84bdad8d8a6a5c3269c98))
+* harness-promotion-bridge — the carried non-promotion condition is adjudicated, NOT discharged (#1770) ([8cc1c90](https://github.com/event4u-app/agent-config/commit/8cc1c90722e2b1d0d866ee6fdce6ad4056979dc2))
+* obligation-delivery 1.1 answered — delivery is architecturally blocked, with the number behind it (#1769) ([302f7f7](https://github.com/event4u-app/agent-config/commit/302f7f712d127e9cf55d46b8126e9052977b8189))
+* council-topology 18/77 to 26/77 — Phase 4 null-closed, Phase 2 costed at 20 UTC days (council 2/2) (#1765) ([8574cc3](https://github.com/event4u-app/agent-config/commit/8574cc3f7f7b404c94d7f39c1b7e2bec5410b87a))
+* governed-harness Phases 4-6 (9 steps), AC audit, and the Phase 7 split (council 2/2) (#1764) ([2e9f75d](https://github.com/event4u-app/agent-config/commit/2e9f75d5546b9d15b11b5b16871453591e01f7d3))
+* complete road-to-turnaround-followups (transfer + archive, council 2/2 x2) (#1763) ([7b4411e](https://github.com/event4u-app/agent-config/commit/7b4411e03e4236ec8e15764a28b03c79cd316f31))
+* drain run-7 record, and a resume probe that fires on a reference (#1762) ([60ad56b](https://github.com/event4u-app/agent-config/commit/60ad56b7cbca9ed41b3e955333b0f5aeffc30775))
+* governed-harness Phase 0 (8/8) and Phase 3 (6/6) — guard call sites close the split blocker (#1761) ([ac25013](https://github.com/event4u-app/agent-config/commit/ac2501313959a63c99e5b37fd0dccb7d7971db8a))
+* council-topology Phase 3 (4/6) — independence and judge-bias hardening (#1760) ([ccd4c45](https://github.com/event4u-app/agent-config/commit/ccd4c451ee169a66c7ddb0a10a0ce4ce625e70f4))
+* turnaround-followups — 2.1 closed on ADR-251, 1.1 deferred with an owner (#1759) ([cf968bb](https://github.com/event4u-app/agent-config/commit/cf968bb5eb6f17d07c92a502b6a04c80258edbbe))
+* drain run-6 record — five PRs, eighteen review findings, no descopes (#1758) ([de939f7](https://github.com/event4u-app/agent-config/commit/de939f769ff41b30271d62d60c5caefa54e7c99b))
+* council-topology Phase 1B (2/4) + the seven completion-review findings (#1757) ([7f58126](https://github.com/event4u-app/agent-config/commit/7f58126297fb5650435d10dd01bbf90edf8e57a0))
+* governed-harness-evolution Phase 2 (5/5) + the six completion-review findings (#1755) ([34318f7](https://github.com/event4u-app/agent-config/commit/34318f7f546ae8e06816b7f1eb15d47dad735951))
+* turnaround-followups Phase 3 — emit Claude host-form rules on the install path (#1756) ([c96fc9b](https://github.com/event4u-app/agent-config/commit/c96fc9b8b75816e70aca906a986883805fe6a3b4))
+* park capability-native-execution in later/ (split council, conservative side) (#1754) ([7b57734](https://github.com/event4u-app/agent-config/commit/7b57734cf5129706d2d7f3f1f49d030aee455e12))
+* complete road-to-agent-turnaround (MERGE disposition, council 2/2) (#1753) ([99718e0](https://github.com/event4u-app/agent-config/commit/99718e07d171086aecc979fcc0e305095008ce52))
+* complete road-to-retired-claims-stay-retired (re-target — #1746 never reached main) (#1751) ([9acdc14](https://github.com/event4u-app/agent-config/commit/9acdc14d8005cdcfbfce68d2c141f9282c099873))
+* governed-harness-evolution phases 0 and 1 (re-target — #1748 never reached main) (#1752) ([d126fe4](https://github.com/event4u-app/agent-config/commit/d126fe4efa2af9216bd81756368c86c58b1e7e6d))
+* **capability-native:** pre-register the outcome bars — the only step AC-14 permits (#1749) ([27af583](https://github.com/event4u-app/agent-config/commit/27af58334e41c41cfaa3e685a1017d5494909361))
+* **council-topology:** close Phase 0, and a re-council guard whose exact states could never fire (#1750) ([db51a05](https://github.com/event4u-app/agent-config/commit/db51a0523af94e1ae0ec402c766a63b0fa3cfda3))
+* agent-turnaround — 19/21, with the two it could not close named (#1747) ([af0cf0b](https://github.com/event4u-app/agent-config/commit/af0cf0bf001758a6d117e2a09c1f5b24b883c006))
+* complete road-to-gates-that-do-not-run (#1744) ([dfdea86](https://github.com/event4u-app/agent-config/commit/dfdea863f442547c2a86a1aca1b4c317beb62c5b))
+* promote two executable drafts to ready (#1745) ([41e7881](https://github.com/event4u-app/agent-config/commit/41e788104ce639888b2930d389691c667a79857e))
+* complete road-to-concern-admission-ratchet (#1743) ([668421a](https://github.com/event4u-app/agent-config/commit/668421a635c0b848b02118d5f5c157bfe5c55340))
+* complete road-to-experience-loop-broadening (#1742) ([36d273c](https://github.com/event4u-app/agent-config/commit/36d273c89b6241e4effeb5004adb94cd382a71a9))
+* **agent-turnaround:** measure why a one-file change costs 42 round-trips (#1741) ([4305a86](https://github.com/event4u-app/agent-config/commit/4305a86c323babcc7253be51786d09da3fe59fc7))
+* **inbox-2026-08-g:** three roadmaps from five bundles, and the one that dropped in full (#1740) ([f9543e4](https://github.com/event4u-app/agent-config/commit/f9543e481427f87d2542dff5f952ca6b7dd1ee9a))
+* **council-topology-evidence:** record the method lineage anonymously, and say which half only the maintainer can finish (#1739) ([6e37584](https://github.com/event4u-app/agent-config/commit/6e37584a172561826caa6b9246f178cd9c8226c7))
+* **governed-harness-evolution:** the Phase-0 exit criterion, and the stale blocker twin that recurred in a second roadmap (#1737) ([172b87c](https://github.com/event4u-app/agent-config/commit/172b87c6a9679adbafa9f75e27762d5c80350d73))
+* **capability-native-execution:** freeze the dispatch corpus, and unstall Phase 0 without deciding what only an owner may decide (#1736) ([e86e332](https://github.com/event4u-app/agent-config/commit/e86e332f191b217c87cff9cf48d6630853f7bea0))
+* **experience-loop-broadening:** Phase 0 — classify every runtime component, fix two boundaries, and refuse a metric with no consumer (#1735) ([6399819](https://github.com/event4u-app/agent-config/commit/6399819a07bde0757becfd3db12d017f4743ef93))
+* **source-silence-cutover:** settle the skip_paths target, ship the notices, and fix a gate that scored compliance as debt (#1733) ([970e930](https://github.com/event4u-app/agent-config/commit/970e930d098a2ccb0e48a317f2d42598f4712204))
+* **supervised-telemetry-collector:** Phases 3-5, five review rounds, and the one that found the kill switch did not stop collection (#1734) ([1906516](https://github.com/event4u-app/agent-config/commit/190651687c793360fdf9630c23d86c9ac73ad4ee))
+* complete source-silence (#1728) ([227b016](https://github.com/event4u-app/agent-config/commit/227b01697ff125f43fbe629d79f4e7eadec0ccb5))
+* **supervised-telemetry-collector:** Phases 2-3, and two steps reported done whose check could not go red (#1730) ([97687ed](https://github.com/event4u-app/agent-config/commit/97687edc3b4ec3eccdcb33772751742d6774ebcd))
+* **drain:** append the run-3 record — seven PRs, five council decisions, eight unpredicted defects (#1731) ([b59c5bd](https://github.com/event4u-app/agent-config/commit/b59c5bd00215e06b7ce111d9ea5f7b009ebd0302))
+* complete journal-host-capture-measurement (#1729) ([c950592](https://github.com/event4u-app/agent-config/commit/c9505927bb1d8614ff6311bcc617f9fad57d6ea2))
+* **council-topology-evidence:** pin shipped council behaviour and inventory 164 surfaces — with one reported correction rejected (#1727) ([5b91c5e](https://github.com/event4u-app/agent-config/commit/5b91c5e0ab81b49542521061faf5479be927f9c2))
+* **governed-harness-evolution:** close 1.4 as a reference, not a gate — the E1 ownership matrix discharged (#1726) ([0fcf7bc](https://github.com/event4u-app/agent-config/commit/0fcf7bc8900f813921f6960cf72bfa3fc8716950))
+* **capability-native-execution:** close 0.4, and a stale blocker field that was holding lint_roadmap_blockers green (#1725) ([d6edc4f](https://github.com/event4u-app/agent-config/commit/d6edc4fe8a9ceb81413b751d51a97224e4394880))
+* **experience-loop-broadening:** bind the three outcome vocabularies, and two contract claims that were false since PR #183 (#1724) ([736668a](https://github.com/event4u-app/agent-config/commit/736668a679700ec63eae03d2b04e441b9d8c63cb))
+* **journal-host-capture:** a denominator exists after all — both blockers closed on measurement (#1722) ([63d06b7](https://github.com/event4u-app/agent-config/commit/63d06b7eb2c4c6b62ce0e9ed02d3a8ddd11d2ba6))
+* **telemetry-collector:** the data contract, and a blocker that stays open after its decision (#1721) ([1468231](https://github.com/event4u-app/agent-config/commit/1468231fa2fae5a90d43a2c1a7d556419573015b))
+* **source-silence:** write-time redaction, and a council that refused the convenient fix (#1720) ([8650a70](https://github.com/event4u-app/agent-config/commit/8650a700d7c735d985488bbb4fff110ff179c263))
+* **council-topology-evidence:** lock the one-resolver invariant — six review rounds, four implementations killed (#1719) ([dc14a98](https://github.com/event4u-app/agent-config/commit/dc14a984e76e380a2d41c30e584e311e8c68fd29))
+* **experience-loop-broadening:** two blockers no gate could see, and an estate argument that was a ratchet invariant (#1716) ([b7b2bf0](https://github.com/event4u-app/agent-config/commit/b7b2bf02f483a01184e05206d94ac17ec5e3a8cf))
+* **supervised-telemetry-collector:** Phase 1 closed, and a blocker that read resolved but was not (#1714) ([df8ab5c](https://github.com/event4u-app/agent-config/commit/df8ab5c68690a0bd9ccb39661f1fcd14ada31a9f))
+* **governed-harness-evolution:** a blocker no gate could see, and the ownership matrix E1 required and never wrote (#1718) ([4ed0b7d](https://github.com/event4u-app/agent-config/commit/4ed0b7dea15f613d9efa5dfa934c938ca38aab89))
+* **capability-native-execution:** one blocker closed, one split — plus two false premises and a verify that could never pass (#1717) ([9470d3e](https://github.com/event4u-app/agent-config/commit/9470d3e98cdcbc71b52f0baa6061c0dc9a967cdf))
+* PR drain run summary, 2026-08-29 (#1715) ([919c943](https://github.com/event4u-app/agent-config/commit/919c943ab69458d1d758f27b57eb377498d1a44b))
+* a lock superseded the same day, and the shape ratchet main went red on between two green PRs (#1713) ([b9019f1](https://github.com/event4u-app/agent-config/commit/b9019f1ad2774d15983e5ec427fd5d8dc847ca6a))
+* complete runtime-event-journal — the carry was to a stub, and a stub is not a receiver (#1712) ([7a2a6f8](https://github.com/event4u-app/agent-config/commit/7a2a6f883444a466be45a6f7f7a5f03e5157d360))
+* **source-silence:** the census, the shape gate, and a security gate that was in no workflow (#1707) ([e9f4b31](https://github.com/event4u-app/agent-config/commit/e9f4b318b7991d87a1b6d4324cd64f7782d17e29))
+* runtime-event-journal — the journal, the spine, the acknowledgment, and one step honestly left open (#1706) ([7b82c6b](https://github.com/event4u-app/agent-config/commit/7b82c6b64cdbb6ec9ed3c76c5747b2494a11d382))
+* **council-topology-evidence:** resolve all five blockers, and name the one that must not be descoped (#1709) ([53621b4](https://github.com/event4u-app/agent-config/commit/53621b46548d7e75fa2bf3061cd4b7ce078a8665))
+* **supervised-telemetry-collector:** resolve all three blockers, and correct a false premise in one (#1708) ([53e0e78](https://github.com/event4u-app/agent-config/commit/53e0e78658b264908f833ee677bad9efce131696))
+* complete code-graph-evidence-that-exists (an honest null, and the class that measured nothing) (#1705) ([6a5670b](https://github.com/event4u-app/agent-config/commit/6a5670b7881a676c0da90d2afb950298087c4ccb))
+* complete runtime-context-floors (ADR-249's missing floors, two council-resolved blockers) (#1703) ([30a75c6](https://github.com/event4u-app/agent-config/commit/30a75c659caea03e2b002e50289e828d4d6ed65d))
+* five ready roadmaps from three inbox rounds, and the corrections that prevented four of their steps (#1701) ([43a8193](https://github.com/event4u-app/agent-config/commit/43a819363b2cb8ddb151513c85d93dce8a94dfa7))
+* complete runtime-governance-flip (ADR-249, and a second reader that found three more blockers) (#1700) ([68463a1](https://github.com/event4u-app/agent-config/commit/68463a1e0af5f4bcc7ffb23ab4d4b073ed26c67f))
+* park database-evolution-tactics (three blockers resolved, all three recommendations overturned) (#1699) ([9050874](https://github.com/event4u-app/agent-config/commit/90508746354412a3dbb252a1c54c4fac2f7b9180))
+* park database-relational-modeling (overlap measured at 25%, skill warranted but inadmissible) (#1698) ([c649b47](https://github.com/event4u-app/agent-config/commit/c649b476e2a0b95dc35d8bd2b43681208aad7aab))
+* park database-erd-landing (skill costs 53 tokens, 4 are available) (#1697) ([fd9b01f](https://github.com/event4u-app/agent-config/commit/fd9b01feda8d0e3521377c7cc6862913db892050))
+* park composition-review-false-positive-rate (measurement blocked on elapsed time) (#1696) ([8b08eff](https://github.com/event4u-app/agent-config/commit/8b08effec23002bcc8055e22e93eba69296a4ef1))
+* complete executable-specification-layer (#1692) ([830e31a](https://github.com/event4u-app/agent-config/commit/830e31aa3ca7329b513b53328eadad4a92d471f7))
+* complete composition-before-creation (#1693) ([7cb1d1d](https://github.com/event4u-app/agent-config/commit/7cb1d1ddfa0a67d6552d12c88461886dda377fce))
+* split the daemon out of governance, and work in two rounds of council findings (#1691) ([460b620](https://github.com/event4u-app/agent-config/commit/460b6200786e8c544a53416631b34d78ab730667))
+* complete consolidation-lineage-integrity (#1682) ([b547dc8](https://github.com/event4u-app/agent-config/commit/b547dc8bb74339e61ddb822b4c18d99250698e7d))
+* complete undeclared-obligation-disposition (the ceiling admits no declaration) (#1689) ([bc16645](https://github.com/event4u-app/agent-config/commit/bc16645b3a03096ee0463f78a954267c9b602ba8))
+* complete database-advice-correction (#1683) ([9158984](https://github.com/event4u-app/agent-config/commit/9158984474594128f51e3f372726c91edcc6a266))
+* complete turn-bound-authorization-integrity (#1686) ([1beae8d](https://github.com/event4u-app/agent-config/commit/1beae8d9a17c8a5ac355b95b8c30f72f83fb034b))
+* two ready roadmaps from the uncle-bob-swarm inbox, and the ADR the analysis named was the wrong one (#1688) ([d176082](https://github.com/event4u-app/agent-config/commit/d176082907bb0bbe6c35caa122b03c9d4b2d2c39))
+* transfer kernel-invariant-restoration, archived as transferred (#1685) ([d26edc9](https://github.com/event4u-app/agent-config/commit/d26edc97b7820be285049ced9861661699db731b))
+* complete evidence-gated-change (#1675) ([d55d1f1](https://github.com/event4u-app/agent-config/commit/d55d1f1015c5a65eae392e4a30d4d60e00a09821))
+* answer the two blocking review findings on #1681, and one roadmap out of three survivors (#1684) ([f2ed85e](https://github.com/event4u-app/agent-config/commit/f2ed85ea8d437708d2234b99f5a8b67a4da972e8))
+* complete consumer-repo-reality (#1679) ([10949a3](https://github.com/event4u-app/agent-config/commit/10949a37b2bd6894e39de7c728a6fd151c183739))
+* two roadmaps and one promotion from the mixed-analysis inbox drain (#1681) ([612b817](https://github.com/event4u-app/agent-config/commit/612b817e7362c0633508b9420b6c168f4224bdce))
+* three drafts from the evolve/evolver inbox drain (#1677) ([15447f4](https://github.com/event4u-app/agent-config/commit/15447f47f736b5cd8e570d5fca19b797ab1ce80e))
+* complete inbox-harvest-f-owner-decision-queue (#1661) ([9e8344a](https://github.com/event4u-app/agent-config/commit/9e8344a3f8dddb414e710467bbf23139004e0298))
+* complete decision-conformance (#1673) ([387dd3e](https://github.com/event4u-app/agent-config/commit/387dd3e680de40687cbb2fc47a5037ad081446e5))
+* complete internal-estate-fit (#1669) ([1899f92](https://github.com/event4u-app/agent-config/commit/1899f92b9c1ebeaf574bb9210426d88c3201cc1b))
+* complete component-granularity-vocabulary (#1671) ([e6fdfd4](https://github.com/event4u-app/agent-config/commit/e6fdfd49d182d1ae5957380230e632be9255b60f))
+* park ten-across-the-board (index, predicate unevaluable) (#1670) ([d2a4fef](https://github.com/event4u-app/agent-config/commit/d2a4fefe8ae45b4ab333ddc327872a8d51ee4de4))
+* complete published-number-truth (#1668) ([580cb11](https://github.com/event4u-app/agent-config/commit/580cb11381e1fab9134287c59a9ea065ffb6d865))
+* complete inbox-harvest-2026-08-f-owner-decision-queue ([338f22e](https://github.com/event4u-app/agent-config/commit/338f22e578e970c863d131197393d02f4aaf359b))
+* complete inbox-harvest-2026-08-f-code-graph-evidence-refresh ([98325c7](https://github.com/event4u-app/agent-config/commit/98325c70d8d2c9f521723d73d289b6b5d7daaff5))
+
+Tests: 19887 (+2222 since 14.12.0)
+
 ## [14.12.0](https://github.com/event4u-app/agent-config/compare/14.11.0...14.12.0) (2026-08-25)
 
 ### Release highlights

package/CONTRIBUTING.md

@@ -102,6 +102,44 @@ task lint-skills      # ./scripts-run src/scripts/skill_linter --all
 - Open the PR against `main` with a short description of the change,
   motivation, and any notes for reviewers.
 
+### Branch names, PR text and commit messages are a gated surface
+
+A branch name, a PR title, a PR body and a commit message are **public on push
+and effectively permanent once merged** — this repository does not rewrite trunk
+history, by a recorded decision, so a source name that lands there stays
+recoverable. None of them is a tracked file, so the tree-scanning gate
+(`check_no_external_sources`) cannot see any of them.
+
+Two checks cover that surface, and they run at different moments on purpose:
+
+- **`.github/workflows/pr-metadata-sources.yml`** — on `pull_request`
+  (including `edited`, because a title changed after opening is a new
+  disclosure). This is the backstop; by the time it runs the branch and commits
+  are already on the remote.
+- **`src/scripts/hooks/prepush_metadata_sources.sh`** — a **pre-push** hook, and
+  the only one of the two that runs while the metadata is still private. Opt-in,
+  because this repository does not write to your `.git/hooks`:
+
+  ```bash
+  ln -s ../../src/scripts/hooks/prepush_metadata_sources.sh .git/hooks/pre-push
+  ```
+
+  If you already have a pre-push hook, call it from there instead. It checks the
+  branch name and the commit messages the push would add; the PR title and body
+  do not exist locally, so those two stay CI-only — a local pass is not a full
+  pass. Bypass with `AGENT_CONFIG_SKIP_METADATA_GATE=1`.
+
+Run it by hand at any time:
+
+```bash
+./scripts-run src/scripts/sweep_source_surfaces --gate-metadata \
+  --branch "$(git rev-parse --abbrev-ref HEAD)" \
+  --commit-range origin/main..HEAD
+```
+
+Use an opaque round identifier (`inbox-2026-08-h`, `round-a91f3c`, `S17`) where
+a name is needed. See [`source-confidentiality`](src/rules/source-confidentiality.md).
+
 ## Reviewability and the self-imposed gate
 
 This is a governance standard, so the maintainer holds themselves to the same

package/CREDITS.md

@@ -0,0 +1,135 @@
+# Credits
+
+Attribution for derived work and external contributions. Two kinds of entries
+live here: **license-required attribution** for vendored/derived material
+(Apache-2.0 / MIT obligations) and **community credit** for external
+contributors whose skills, rules or commands were merged.
+
+## License-required attribution (vendored / derived material)
+
+| Artefact | Upstream | License | Detail |
+|---|---|---|---|
+| `design-intelligence` (corpus + grounding engine) | Next Level Builder — `ui-ux-pro-max-skill` | MIT | [`src/skills/design-intelligence/ATTRIBUTION.md`](src/skills/design-intelligence/ATTRIBUTION.md) |
+| `design-intelligence` (`ui-styling`-derived assets) | "claudekit" | Apache-2.0 | [`LICENSE.apache-2.0.txt`](src/skills/design-intelligence/LICENSE.apache-2.0.txt) + modified-file markers per §4b |
+| `corpus-grounding`, `design-tokens`, `react-shadcn-ui`, `tailwind-engineer` (derived slices) | see per-skill notices | MIT / Apache-2.0 | ADR-061 — the per-skill attribution notice is authoritative |
+| `src/scripts/cost/budget.mjs`, `src/scripts/cost/track.mjs` | ruvnet/ruflo — `plugins/ruflo-cost-tracker` | MIT | full notice below; transformation record in [`provenance/borrows.jsonl`](provenance/borrows.jsonl) and [`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md) |
+
+#### MIT notice — ruvnet/ruflo
+
+Reproduced in full rather than by reference, because MIT requires the copyright
+notice AND the permission notice to travel with copies or substantial portions
+of the Software. This file ships in the npm package (`package.json` → `files`),
+which is what discharges the obligation for a consumer who receives
+`src/scripts/cost/` from the registry — the source files themselves carry no
+in-file source name, per
+[`source-confidentiality`](src/rules/source-confidentiality.md), and MIT does not
+require one.
+
+```
+Copyright (c) 2024-2026 ruvnet
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+### Comparators (benchmark baselines, no vendored material)
+
+| Comparator | Pinned at | License | Where it is used |
+|---|---|---|---|
+| `Source A` — an external agent-instruction suite | `2ed6c52c` | MIT | benchmark comparator arm: [`agents/roadmaps/stubs/road-to-solution-minimalism-full-tier-run.md`](agents/roadmaps/stubs/road-to-solution-minimalism-full-tier-run.md) § The published comparator |
+
+Nothing is vendored from it — no code, no oracle text, no prose. What is used is
+its **published baseline numbers** as the external column of a two-arm report,
+and four mechanism ideas folded (never copied) into
+`road-to-trigger-delivered-rule-bodies`. It is credited under an anonymised label
+because [`source-confidentiality`](src/rules/source-confidentiality.md) forbids
+the tracked tree recording which third-party package seeded an idea; the real
+identifier resolves from the encrypted token in that roadmap's § Provenance.
+
+Per [ADR-061](docs/decisions/ADR-061-corpus-grounding-layer.md), vendored
+material keeps its upstream notice inside the skill directory; this table is
+the aggregate pointer, never a replacement for the per-skill notice.
+
+### Runtime dependencies — code-graph engine (ADR-124)
+
+**No longer shipped to consumers.** The native code-graph engine
+(`src/scripts/code_graph/`, Class-A per
+[ADR-124](docs/decisions/ADR-124-embedded-engine-doctrine.md)) once added two
+exact-pinned *runtime* dependencies. The engine returned an honest null (recall
+0.365 vs grep 0.797) and is permanently `enabled: false`, so the pair moved out
+of `dependencies` rather than shipping to every consumer for a path none of them
+can reach — ~51 MB unpacked, the largest single install item in the set.
+
+They are now `devDependencies`: npm does not install those for consumers, so a
+consumer install resolves neither, while the engine's own test suite still runs
+in CI. The exact pins live there, which keeps the ABI lock machine-checked (the
+dependency-floor gate scans only `dependencies` and no longer sees the pair):
+
+| Dependency | Version | License | Role |
+|---|---|---|---|
+| `web-tree-sitter` | 0.24.7 (exact) | MIT | WASM tree-sitter runtime — parses PHP/TS/JS with no native toolchain |
+| `tree-sitter-wasms` | 0.1.13 (exact) | Unlicense | prebuilt grammar `.wasm` (ABI 14; the pair is ABI-locked and must move together) |
+
+Re-enabling as a consumer means installing them yourself:
+`npm i web-tree-sitter@0.24.7 tree-sitter-wasms@0.1.13`.
+
+## Method lineage — inspiration, not incorporated material
+
+Three external sources shaped the *method* behind this package's AI-council
+topology: how a multi-model council is staged, how its advisor personas frame a
+question, and how the CLI is packaged. **No code or text from any of them is
+incorporated**, which is why they appear here rather than in the
+license-required section above — nothing about them is license-required, and
+recording them anyway is an epistemic obligation rather than a legal one
+(`code-provenance` § the knowledge layer: an artefact asserting an
+externally-sourced claim either cites a harvest id or labels the statement as
+own analysis).
+
+They are named **anonymously**, per `source-confidentiality`: a shipped artifact
+in this tree does not carry derivation attribution to a named external project.
+The maintainer-side record holds the real identities; the links are retained as
+`ENC1:` tokens, which are opaque here and decryptable only with the key in the
+maintainer's user-global settings.
+
+| Label | What it contributed | Link |
+|---|---|---|
+| **Source A** <!-- harvest:council-topology-three-stage-shape --> | The three-stage method shape: independent generation → blind peer evaluation → synthesis. | `ENC1:` (pending maintainer encryption) |
+| **Source B** <!-- harvest:council-advisor-lens-framing --> | The thinking-lens framing that informed the shipped advisor personas. | `ENC1:` (pending maintainer encryption) |
+| **Source C** <!-- harvest:council-cli-first-packaging --> | CLI-first / fallback packaging ergonomics. | `ENC1:` (pending maintainer encryption) |
+
+**What the `ENC1:` placeholder means, stated rather than left to look like a
+finished token.** The real links are held maintainer-side and are not encrypted
+into this file yet; `src/scripts/_lib/link_crypto.ts` needs
+`secrets.link_encryption_key`, which is deliberately absent from any tracked
+tree and from an agent's reach. The rows in `provenance/harvests.jsonl` carry
+`source_ref: opaque:…` instead, which is that ledger's own sanctioned form for a
+source that cannot be pinned to a public revision — so the record is complete on
+the ledger's terms while this column stays a placeholder.
+
+## Community contributions
+
+External contributions merged into the catalog are credited here and carry
+`provenance: community` in their frontmatter — the public catalog
+([`docs/catalog.md`](docs/catalog.md)) renders that as `community` in the
+`source` column.
+
+| Artefact | Contributor | Merged in |
+|---|---|---|
+| _none yet — yours could be the first_ | | |
+
+If your work appears in this package unattributed, please open an issue —
+attribution gaps are treated as bugs.

package/NOTICE

@@ -0,0 +1,13 @@
+event4u/agent-config
+Copyright (c) 2026 event4u
+
+This product includes material derived from the following third-party
+projects:
+
+openai/codex-plugin-cc (https://github.com/openai/codex-plugin-cc)
+Copyright OpenAI
+Licensed under the Apache License, Version 2.0
+(http://www.apache.org/licenses/LICENSE-2.0)
+  - The team-review system prompt and findings shape in
+    src/scripts/ai_team/team_dispatch.ts are derived from the plugin's
+    adversarial-review findings shape.

package/README.md

@@ -1,10 +1,12 @@
 <p align="center"><a href="https://event4u.app"><img alt="event4u Agent Config" src=".github/assets/banner.png"></a></p>
 
-# Agent Config — every claim machine-checked, including "zero runtime daemon"
+# Agent Config — every claim machine-checked, including the counts in these badges
 
 [![Smoke](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml) [![Public install smoke (3 OS × 2 Node)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml) [![npm](https://img.shields.io/npm/v/@event4u/agent-config?style=flat-square&label=npm&color=orange)](https://www.npmjs.com/package/@event4u/agent-config) [![agent-config MCP server](https://glama.ai/mcp/servers/event4u-app/agent-config/badges/score.svg)](https://glama.ai/mcp/servers/event4u-app/agent-config) [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fevent4u-app%2Fagent-config.svg)](https://mcptoplist.com/server/glama%2Fevent4u-app%2Fagent-config)
 
-[![Skills](https://img.shields.io/badge/Skills-299-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-120-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-202-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-114-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
+[![Skills](https://img.shields.io/badge/Skills-299-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-120-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-202-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-118-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/) <!-- claim:published-artifact-counts -->
+
+<sub>**How these are counted** — one canonical counter, `agent-config` → `update_counts --check`, re-derives all six from the tree and fails CI on a drift of one. Two bases are not what the linked directory shows, so they are stated here rather than left to be inferred: **Commands 202** counts every command file **recursively** (the linked directory holds 61 at its top level), and **Rules 120** counts the **source** rules while the linked projection holds 119 — one rule is dormant and is not projected. **Personas 29** excludes the directory README. Counts are of files and directories: none of them measures quality, activation, or adoption. <!-- claim:published-artifact-counts --></sub>
 
 **Try it in 30 seconds** — drop one read-only subagent into any repo and watch it gate "done": `@production-validator check this branch is actually done`. No wizard, no lock-in, nothing else installed — the [30-second wedge ↓](#quickstart) is the whole first step. Start at the proof, not the catalog: **[event4u-app.github.io/agent-config/proof/](https://event4u-app.github.io/agent-config/proof/)**.
 
@@ -14,7 +16,7 @@
 
 > **Choose your experience — developer · founder · content · agency · finance · ops. Add packs. Get a focused command set, not a 500-artefact dump.** Bring your own AI provider.
 
-**A deep library of skills, commands and governed rules** — plus a capability router that loads the right skill on intent and multi-agent orchestration with consensus review. The whole layer is compiled into **20 host agents** — of 23 detected, 3 being export-only<!-- claim:host-agent-count --> (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini CLI, Codex, Continue, Zed, JetBrains, Aider and more) — with **zero runtime daemon**.<!-- claim:no-runtime-daemon --> Six role-shaped entry paths sit on top, so any host becomes a reliable team member — without locking you to a single model or vendor.
+**A deep library of skills, commands and governed rules** — plus a capability router that loads the right skill on intent and multi-agent orchestration with consensus review. The whole layer is compiled into **20 host agents** — of 23 detected, 3 being export-only<!-- claim:host-agent-count --> (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini CLI, Codex, Continue, Zed, JetBrains, Aider and more). **Resident processes are permitted only under the supervision contract ADR-249 establishes** — a policy this repository adopted on 2026-08-27, not a description of anything running today. Six role-shaped entry paths sit on top, so any host becomes a reliable team member — without locking you to a single model or vendor.
 
 ### What's different
 
@@ -86,7 +88,7 @@ is platform operation, not a user-work flow.)
 
 <p align="center">
   <a href="CHANGELOG.md">CHANGELOG</a> ·
-  <a href="MIGRATION.md">Upgrade to 6.0</a> ·
+  <a href="MIGRATION.md">Upgrade to 14.x</a> ·
   <a href="CHANGELOG.md#breaking--v400-unified-setup-road-to-unified-setup">Breaking changes</a> ·
   <a href="https://github.com/event4u-app/agent-config/releases/latest">Latest release</a> ·
   <a href="https://github.com/event4u-app/agent-config/discussions">Discussions</a>
@@ -324,7 +326,7 @@ task mcp:cloud:secret-put    # opt in to bearer-auth (recommended for private de
 
 → Operator walkthrough: [`mcp-cloud-setup`](docs/setup/mcp-cloud-setup.md) · Per-client config: [`mcp-client-config`](docs/setup/mcp-client-config.md) · Endpoints: [`mcp-cloud-endpoints`](docs/setup/mcp-cloud-endpoints.md).
 
-> **Scope — Lite, not Full.** The Worker serves read-only governance (skills · commands · rules · guidelines · contexts) as MCP prompts and resources, plus small read-only tools (`memory_lookup`, `chat_history_read`, `list_*`). It does **not** execute the ~112 Python scripts (linters, audits, `task ci`, work-engine hooks) — those require local install per [Quickstart](#quickstart).
+> **Scope — Lite, not Full.** The Worker serves read-only governance (skills · commands · rules · guidelines · contexts) as MCP prompts and resources, plus small read-only tools (`memory_lookup`, `chat_history_read`, `list_*`). It does **not** execute the repository's local scripts (linters, audits, `task ci`, work-engine hooks) — those require local install per [Quickstart](#quickstart).
 
 > The built-in **local stdio** server is listed for discovery in the [Glama MCP Registry](https://glama.ai/mcp/servers/event4u-app/agent-config) (agent developers / contributors; requires a local checkout, not a turnkey install — see [ADR-067](docs/decisions/ADR-067-glama-registry-listing.md)).
 
@@ -597,7 +599,7 @@ task dev:setup        # boot the onboarding wizard against the working tree
 
 **Invoking the CLI from a source checkout:** `./agent-config <command>` (the maintainer shim at the repo root → `scripts/agent-config` → `dist/cli/agent-config.js`). `npx @event4u/agent-config` doesn't resolve in the source repo without a prior `npm link`, since there's no `node_modules/.bin/agent-config` symlink — use `./agent-config` instead. Build the TS binary with `npm run build:cli` if `dist/cli/agent-config.js` is missing.
 
-→ Full project structure and commands: [**docs/development.md**](docs/development.md) · [CONTRIBUTING.md](CONTRIBUTING.md). Stack: **TypeScript** CLI/UI + **Python 3.10+** build/lint scripts. MCP registry payloads render under `dist/mcp/` ([submission checklist](docs/distribution/mcp-submission-checklist.md)).
+→ Full project structure and commands: [**docs/development.md**](docs/development.md) · [CONTRIBUTING.md](CONTRIBUTING.md). Stack: **TypeScript** throughout — CLI, UI, and the build / lint scripts. MCP registry payloads render under `dist/mcp/` ([submission checklist](docs/distribution/mcp-submission-checklist.md)).
 
 ---