@event4u/agent-config 14.12.0 → 14.13.0

package/src/scripts/sync_pr_branch.ts

@@ -115,9 +115,9 @@ const GENERATED = [
  */
 const GENERATED_PATTERNS: readonly { readonly re: RegExp; readonly why: string }[] = [
     {
-        // `generate_pack_manifests.ts:427`, and the file's own first line reads
-        // "Generated by scripts/generate_pack_manifests.ts — DO NOT EDIT BY
-        // HAND". 12 resolutions over 60 days across two packs.
+        // `generate_pack_manifests.ts:427`, and the file's own first line is
+        // the do-not-edit header that generator writes.
+        // 12 resolutions over 60 days across two packs.
         re: /^src\/domains\/[^/]+\/pack\.yaml$/,
         why: 'per-pack manifest written by generate_pack_manifests.ts',
     },

package/src/scripts/trigger_eval_grandfather.json

@@ -1,224 +1,204 @@
 {
-    "_note": "Shrink-only grandfather allowlist for check_trigger_eval_presence (road-to-composition-ratchet). Skills listed here predate the trigger-eval presence gate and may lack evals/triggers.json. Entries may ONLY be removed (when the skill gains a triggers.json or is deleted) \u2014 never added. Frozen 2026-07-08 at 221 of 264 skills.",
-    "skills": [
-        "accessibility-auditor",
-        "activation-design",
-        "adr-create",
-        "adversarial-review",
-        "agent-docs-writing",
-        "agents-md-thin-root",
-        "ai-council",
-        "analysis-autonomous-mode",
-        "analysis-skill-router",
-        "api-design",
-        "api-endpoint",
-        "api-testing",
-        "architecture-review-lens",
-        "artisan-commands",
-        "async-python-patterns",
-        "authz-review",
-        "aws-infrastructure",
-        "blade-ui",
-        "blameless-post-mortem",
-        "blast-radius-analyzer",
-        "bug-analyzer",
-        "build-buy-partner",
-        "character-consistency",
-        "check-refs",
-        "churn-prevention",
-        "code-refactoring",
-        "code-review",
-        "command-routing",
-        "command-writing",
-        "comp-banding",
-        "competitive-moat-analysis",
-        "competitive-positioning",
-        "composer-packages",
-        "condense-memory",
-        "content-funnel-design",
-        "context-authoring",
-        "context-document",
-        "contracts-cognition",
-        "conventional-commits-writing",
-        "copilot-agents-optimization",
-        "copilot-config",
-        "customer-research",
-        "dashboard-design",
-        "data-flow-mapper",
-        "data-handling-judgment",
-        "database",
-        "dcf-modeling",
-        "deal-qualification-meddic",
-        "decision-review",
-        "deep-reading-analyst",
-        "defense-in-depth",
-        "dependency-upgrade",
-        "description-assist",
-        "design-review",
-        "design-system-capture",
-        "devcontainer",
-        "developer-like-execution",
-        "discovery-interview",
-        "docker",
-        "editorial-calendar",
-        "emit-tickets",
-        "error-handling-patterns",
-        "expansion-playbook",
-        "feature-planning",
-        "file-editor",
-        "finishing-a-development-branch",
-        "flux",
-        "forecast-accuracy",
-        "forecasting",
-        "form-handler",
-        "fundraising-narrative",
-        "funnel-analysis",
-        "git-workflow",
-        "github-ci",
-        "grafana",
-        "gtm-launch",
-        "guideline-writing",
-        "hiring-loop-design",
-        "incident-commander",
-        "jira-integration",
-        "jobs-events",
-        "judge-bug-hunter",
-        "judge-code-quality",
-        "judge-security-auditor",
-        "judge-test-coverage",
-        "laravel",
-        "laravel-api-endpoint",
-        "laravel-dto",
-        "laravel-horizon",
-        "laravel-mail",
-        "laravel-middleware",
-        "laravel-migration",
-        "laravel-notifications",
-        "laravel-pennant",
-        "laravel-pulse",
-        "laravel-reverb",
-        "laravel-scheduling",
-        "laravel-validation",
-        "laravel-websocket",
-        "launch-readiness",
-        "learning-to-rule-or-skill",
-        "lint-skills",
-        "livewire",
-        "livewire-architect",
-        "logging-monitoring",
-        "market-entry-analysis",
-        "markitdown",
-        "mcp",
-        "mcp-builder",
-        "md-language-check",
-        "memory-consolidation",
-        "merge-conflicts",
-        "messaging-architecture",
-        "migration-architect",
-        "mobile-e2e-strategy",
-        "module-detect-on-the-fly",
-        "module-management",
-        "motion-choreographer",
-        "multi-tenancy",
-        "nextjs-patterns",
-        "okr-tree-modeling",
-        "onboarding-design",
-        "onboarding-program",
-        "one-on-one-cadence",
-        "openapi",
-        "org-design",
-        "override-management",
-        "perf-feedback-craft",
-        "performance",
-        "performance-analysis",
-        "persona-writing",
-        "pest-testing",
-        "php-debugging",
-        "php-service",
-        "pipeline-strategy",
-        "pixar-storyteller",
-        "playwright-architect",
-        "playwright-testing",
-        "po-discovery",
-        "positioning-strategy",
-        "premortem",
-        "privacy-review",
-        "project-analysis-core",
-        "project-analysis-hypothesis-driven",
-        "project-analysis-laravel",
-        "project-analysis-nextjs",
-        "project-analysis-node-express",
-        "project-analysis-react",
-        "project-analysis-symfony",
-        "project-analysis-zend-laminas",
-        "project-analyzer",
-        "project-docs",
-        "prompt-engineering-patterns",
-        "prompt-optimizer",
-        "quality-tools",
-        "react-native-setup",
-        "react-shadcn-ui",
-        "readme-reviewer",
-        "readme-writing",
-        "readme-writing-package",
-        "receiving-code-review",
-        "recursive-verification",
-        "refine-prompt",
-        "release-comms",
-        "repomix-packer",
-        "requesting-code-review",
-        "retention-loops",
-        "review-routing",
-        "rice-prioritization",
-        "risk-officer",
-        "roadmap-management",
-        "roadmap-writing",
-        "root-cause-frameworks",
-        "rtk-output-filtering",
-        "rule-refactor",
-        "rule-writing",
-        "runway-cognition",
-        "scenario-modeling",
-        "scene-expander",
-        "script-writing",
-        "secrets-management",
-        "security",
-        "security-audit",
-        "sentry-integration",
-        "sequential-thinking",
-        "skill-improvement-pipeline",
-        "skill-management",
-        "skill-reviewer",
-        "song-to-script",
-        "source-discovery",
-        "sql-writing",
-        "stakeholder-tradeoff",
-        "standards-from-config",
-        "subagent-orchestration",
-        "symfony-workflow",
-        "systematic-debugging",
-        "tailwind-engineer",
-        "tech-debt-tracker",
-        "technical-specification",
-        "terraform",
-        "terragrunt",
-        "test-driven-development",
-        "test-performance",
-        "testing-anti-patterns",
-        "threat-modeling",
-        "throughput-vs-morale-tradeoff",
-        "token-optimizer",
-        "traefik",
-        "ui-component-architect",
-        "unit-economics-modeling",
-        "universal-project-analysis",
-        "upstream-contribute",
-        "using-git-worktrees",
-        "validate-feature-fit",
-        "verify-completion-evidence",
-        "video-director",
-        "vision-articulation",
-        "voc-extract",
-        "voice-and-tone-design"
-    ]
+  "_note": "Shrink-only grandfather allowlist for check_trigger_eval_presence (road-to-composition-ratchet). Skills listed here predate the trigger-eval presence gate and may lack evals/triggers.json. Entries may ONLY be removed (when the skill gains a triggers.json or is deleted) \u2014 never added. Frozen 2026-07-08 at 221 of 264 skills.",
+  "skills": [
+    "accessibility-auditor",
+    "activation-design",
+    "agent-docs-writing",
+    "agents-md-thin-root",
+    "ai-council",
+    "api-design",
+    "api-endpoint",
+    "api-testing",
+    "artisan-commands",
+    "async-python-patterns",
+    "aws-infrastructure",
+    "blade-ui",
+    "build-buy-partner",
+    "character-consistency",
+    "check-refs",
+    "churn-prevention",
+    "command-routing",
+    "command-writing",
+    "comp-banding",
+    "competitive-positioning",
+    "composer-packages",
+    "condense-memory",
+    "content-funnel-design",
+    "context-authoring",
+    "context-document",
+    "contracts-cognition",
+    "conventional-commits-writing",
+    "copilot-agents-optimization",
+    "copilot-config",
+    "dashboard-design",
+    "data-handling-judgment",
+    "database",
+    "dcf-modeling",
+    "deal-qualification-meddic",
+    "decision-review",
+    "deep-reading-analyst",
+    "defense-in-depth",
+    "dependency-upgrade",
+    "description-assist",
+    "design-review",
+    "design-system-capture",
+    "devcontainer",
+    "developer-like-execution",
+    "discovery-interview",
+    "docker",
+    "editorial-calendar",
+    "emit-tickets",
+    "error-handling-patterns",
+    "expansion-playbook",
+    "feature-planning",
+    "file-editor",
+    "finishing-a-development-branch",
+    "flux",
+    "forecast-accuracy",
+    "forecasting",
+    "form-handler",
+    "fundraising-narrative",
+    "funnel-analysis",
+    "git-workflow",
+    "github-ci",
+    "grafana",
+    "gtm-launch",
+    "guideline-writing",
+    "hiring-loop-design",
+    "jira-integration",
+    "jobs-events",
+    "judge-bug-hunter",
+    "judge-code-quality",
+    "judge-security-auditor",
+    "judge-test-coverage",
+    "laravel",
+    "laravel-api-endpoint",
+    "laravel-dto",
+    "laravel-horizon",
+    "laravel-mail",
+    "laravel-middleware",
+    "laravel-migration",
+    "laravel-notifications",
+    "laravel-pennant",
+    "laravel-pulse",
+    "laravel-reverb",
+    "laravel-scheduling",
+    "laravel-validation",
+    "laravel-websocket",
+    "launch-readiness",
+    "learning-to-rule-or-skill",
+    "lint-skills",
+    "livewire",
+    "livewire-architect",
+    "market-entry-analysis",
+    "mcp",
+    "mcp-builder",
+    "md-language-check",
+    "memory-consolidation",
+    "merge-conflicts",
+    "messaging-architecture",
+    "migration-architect",
+    "mobile-e2e-strategy",
+    "module-detect-on-the-fly",
+    "module-management",
+    "motion-choreographer",
+    "multi-tenancy",
+    "nextjs-patterns",
+    "okr-tree-modeling",
+    "onboarding-design",
+    "onboarding-program",
+    "one-on-one-cadence",
+    "openapi",
+    "org-design",
+    "override-management",
+    "perf-feedback-craft",
+    "performance",
+    "performance-analysis",
+    "persona-writing",
+    "pest-testing",
+    "php-debugging",
+    "php-service",
+    "pipeline-strategy",
+    "pixar-storyteller",
+    "playwright-architect",
+    "playwright-testing",
+    "po-discovery",
+    "positioning-strategy",
+    "premortem",
+    "privacy-review",
+    "project-analysis-core",
+    "project-analysis-hypothesis-driven",
+    "project-analysis-laravel",
+    "project-analysis-nextjs",
+    "project-analysis-node-express",
+    "project-analysis-react",
+    "project-analysis-symfony",
+    "project-analysis-zend-laminas",
+    "project-analyzer",
+    "project-docs",
+    "prompt-optimizer",
+    "quality-tools",
+    "react-native-setup",
+    "react-shadcn-ui",
+    "readme-reviewer",
+    "readme-writing",
+    "readme-writing-package",
+    "receiving-code-review",
+    "recursive-verification",
+    "refine-prompt",
+    "release-comms",
+    "repomix-packer",
+    "requesting-code-review",
+    "retention-loops",
+    "review-routing",
+    "rice-prioritization",
+    "risk-officer",
+    "roadmap-management",
+    "roadmap-writing",
+    "root-cause-frameworks",
+    "rtk-output-filtering",
+    "rule-refactor",
+    "rule-writing",
+    "runway-cognition",
+    "scenario-modeling",
+    "scene-expander",
+    "script-writing",
+    "secrets-management",
+    "security",
+    "sentry-integration",
+    "sequential-thinking",
+    "skill-improvement-pipeline",
+    "skill-management",
+    "skill-reviewer",
+    "song-to-script",
+    "source-discovery",
+    "sql-writing",
+    "stakeholder-tradeoff",
+    "standards-from-config",
+    "subagent-orchestration",
+    "symfony-workflow",
+    "systematic-debugging",
+    "tailwind-engineer",
+    "tech-debt-tracker",
+    "technical-specification",
+    "terraform",
+    "terragrunt",
+    "test-driven-development",
+    "test-performance",
+    "testing-anti-patterns",
+    "throughput-vs-morale-tradeoff",
+    "token-optimizer",
+    "traefik",
+    "ui-component-architect",
+    "unit-economics-modeling",
+    "universal-project-analysis",
+    "upstream-contribute",
+    "using-git-worktrees",
+    "validate-feature-fit",
+    "verify-completion-evidence",
+    "video-director",
+    "vision-articulation",
+    "voc-extract",
+    "voice-and-tone-design"
+  ]
 }

package/src/scripts/utilization_report.ts

@@ -61,14 +61,34 @@ export interface KernelInfo {
     safety_floors: Set<string>;
 }
 
-/** Kernel rule ids (type: always / alwaysApply) + *-safety-floor ids — exempt from REAP. */
+/**
+ * A rule id that names a safety surface.
+ *
+ * WIDENED 2026-08-30 (road-to-experience-loop-broadening 6.4). The predicate
+ * was `id.endsWith('-safety-floor')`, which exempted 4 of this tree's 9 safety
+ * rules. The five it missed were `domain-safety-disclaimer`,
+ * `domain-safety-pii`, `domain-safety-retention`, `runtime-safety` and
+ * `tool-safety` — none of them kernel, so every one was REAP-eligible on low
+ * usage. A usage-based retirement proposal for `domain-safety-pii` or
+ * `tool-safety` is precisely the outcome this carve-out exists to prevent, and
+ * low usage is exactly what a safety floor that is working looks like: it fires
+ * rarely, and rarely is not the same as never needed.
+ *
+ * Matching `safety` as a hyphen-delimited token covers all nine and, verified
+ * against the 119 projected rules on the day it was written, matches nothing
+ * else. The direction is deliberately the conservative one — it can only
+ * REMOVE retirement proposals, never add one.
+ */
+const SAFETY_ID_RE = /(^|-)safety(-|$)/;
+
+/** Kernel rule ids (type: always / alwaysApply) + safety-surface ids — exempt from REAP. */
 export function read_exempt(rulesDir: string): KernelInfo {
     const kernel = new Set<string>();
     const safety = new Set<string>();
     for (const name of fs.readdirSync(rulesDir)) {
         if (!name.endsWith('.md')) continue;
         const id = name.replace(/\.md$/, '');
-        if (id.endsWith('-safety-floor')) safety.add(id);
+        if (SAFETY_ID_RE.test(id)) safety.add(id);
         const head = fs.readFileSync(path.join(rulesDir, name), 'utf-8').slice(0, 400);
         if (/^type:\s*["']?always["']?/m.test(head) || /^alwaysApply:\s*true/m.test(head)) {
             kernel.add(id);

package/src/server/schemas/settings.ts

@@ -501,6 +501,11 @@ export const settingsSchema = z.object({
                 'PostToolUse prompt-injection scanner (road-to-security-pillar.md P3.2). Default off. When on, scans tool output (file reads, web fetches, MCP responses) for injection signatures and WARNS in context (never blocks). Runtime backstop on top of the always-on untrusted-input-defense rule; detection is probabilistic.',
             ),
         }).default({}),
+        runtime_journal: z.object({
+            enabled: z.boolean().default(false).describe(
+                'Runtime event journal (road-to-runtime-event-journal Phase 1). Default off. When on, one durable, episode-keyed record per dispatched hook event is appended to <git-common-dir>/agent-journal/journal.sqlite — a Class-A write that opens, writes and exits. It emits nothing to the model, never warns and never blocks: a locked database, a missing node:sqlite, a malformed envelope or a full disk all degrade to silence. Off rather than on because it CREATES a storage surface (a SQLite database under your .git/) rather than appending to a directory that already exists. The record type has no field able to hold free-form content — ids, an event name, a bounded capability identifier, repo-relative locators and two 12-hex digests; no prompt, no file body, no absolute path. Retention: a 30-day TTL anchored on episode close, plus explicit, time-bounded, human-only holds that themselves expire.',
+            ),
+        }).default({}),
         rtk_wrap: z.object({
             enabled: z.boolean().default(false).describe(
                 'PreToolUse RTK-wrap nudge (token-saving Phase 3). Default off. When on AND the binary on PATH is verified as Rust Token Killer (a live two-stage identity probe — not a self-reported flag, and never a colliding same-name binary), warns (never blocks) "re-run wrapped with rtk" before a single verbose CLI command (git/npm/cargo/docker/…) — upstream reports 60–90% output-token savings (their estimate). Skips completeness-critical / piped / compound commands and git diff. No-op when rtk is absent, unverified, or a different tool.',

package/src/templates/marketing-copy.yml

@@ -26,7 +26,7 @@ github_topics:
   - copilot
   - aider
 
-# Marketplace listings (Anthropic, Cursor, Smithery) read these.
+# Marketplace listings and agent-tool registries read these.
 listing:
   name: event4u/agent-config
   category: agent-tooling