@event4u/agent-config 14.12.0 → 14.14.0

package/dist/agent-src/scripts/update_roadmap_progress.ts

@@ -12,7 +12,7 @@
  * `archive_completed_roadmaps` can consume it the same way Python does. snake_case
  * is kept on the public surface.
  *
- * Scans every roadmap under `agents/roadmaps/` (excluding `archive/`, `skipped/`,
+ * Scans every roadmap under `agents/roadmaps/` (excluding `archive/`, `skipped/`,  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * `template.md`, `README.md`, `open-questions*.md`), counts checkbox states per
  * phase, and writes a dashboard at `agents/roadmaps-progress.md` (outside the
  * `roadmaps/` folder to keep it clean) with:
@@ -71,6 +71,8 @@ import {
     type DashboardMode,
 } from './dashboard_mode.js';
 import type * as YamlModule from 'yaml';
+import { headerFragment as stubHeaderFragment } from './stubs_due.js';
+import { reportGuardedBaselines } from './guarded_baseline.js'; // third step state; contract lives there
 
 const _HERE = fileURLToPath(import.meta.url);
 const _require = createRequire(import.meta.url);
@@ -94,7 +96,7 @@ const EXCLUDE_DIRS: ReadonlySet<string> = new Set(['archive', 'skipped', 'stubs'
 
 // FRONTMATTER_RE = re.compile(r"\A---\n(.*?)\n---\s*\n", re.DOTALL)
 const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---[ \t\n\r\f\v]*\n/;
-const DRAFT_VALUES: ReadonlySet<string> = new Set(['draft']);
+const UNSCHEDULED_VALUES: ReadonlySet<string> = new Set(['draft', 'carrier']);
 
 const MERGE_GATED_RE = /merge-gated/i;
 // PR_NUM_RE = re.compile(r"pr\s*[=#:]?\s*#?\s*(\d+)", re.IGNORECASE)
@@ -287,8 +289,8 @@ function _stripQuotes(s: string): string {
     return out;
 }
 
-function is_draft(fm: Record<string, string>): boolean {
-    return DRAFT_VALUES.has((fm['status'] ?? '').toLowerCase());
+function is_unscheduled(fm: Record<string, string>): boolean {
+    return UNSCHEDULED_VALUES.has((fm['status'] ?? '').toLowerCase());
 }
 
 /**
@@ -750,7 +752,7 @@ function collect(roadmap_root: string): RoadmapStats[] {
             continue;
         }
         const text = fs.readFileSync(p, { encoding: 'utf-8' });
-        if (is_draft(parse_frontmatter(text))) {
+        if (is_unscheduled(parse_frontmatter(text))) {
             continue;
         }
         const stats = parse_roadmap(p, roadmap_root);
@@ -818,7 +820,7 @@ function collect_parked(roadmap_root: string): ParkedRoadmap[] {
         } catch {
             continue;
         }
-        if (is_draft(parse_frontmatter(text))) {
+        if (is_unscheduled(parse_frontmatter(text))) {
             continue;
         }
         const cell = resume_cell(text);
@@ -995,6 +997,8 @@ function render(roadmaps: RoadmapStats[], bundles: Bundle[] | null, roadmap_root
                   ? `, **${user_open_blockers}** need you → \`agent-config gates\``
                   : '')
             : '') +
+        // Two integers, never a row — see `stubs_due.headerFragment`.
+        stubHeaderFragment(path.join(roadmap_root, 'stubs')) +
         '\n';
     lines.push(
         // Honest provenance (road-to-roadmap-archival-robustness, gap C): name a
@@ -1301,7 +1305,7 @@ function _parseArgs(argv: readonly string[]): Args {
 }
 
 /**
- * When the default cwd carries no `agents/roadmaps/`, fall back to the git
+ * When the default cwd carries no `agents/roadmaps/`, fall back to the git  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * toplevel — hook and IDE invocations often run from a subdirectory, and a
  * cwd-only resolution silently skipped the dashboard there. An explicit
  * `--repo-root` always wins; a cwd that has the directory is used as-is
@@ -1362,8 +1366,8 @@ function main(argv?: readonly string[]): number {
             return 1;
         }
     }
-    const roadmaps = collect(roadmap_root);
-    const new_text = render(roadmaps, collect_bundles(repo_root), roadmap_root);
+    const roadmaps = collect(roadmap_root), guarded = reportGuardedBaselines(roadmaps, repo_root);
+    const new_text = render(roadmaps, collect_bundles(repo_root), roadmap_root) + guarded.section;
     const complete = unarchived_complete(roadmaps);
     const pending = pending_iron_law_3(roadmaps);
     const gated = merge_gated_pending(roadmaps);
@@ -1395,7 +1399,7 @@ function main(argv?: readonly string[]): number {
         });
         if (r.stderr) process.stderr.write(r.stderr);
         if (r.stdout) process.stdout.write(r.stdout);
-        return r.rc;
+        return guarded.problems > 0 ? 1 : r.rc;
     }
     fs.writeFileSync(target, new_text, { encoding: 'utf-8' });
     process.stdout.write(
@@ -1431,7 +1435,7 @@ function main(argv?: readonly string[]): number {
     if (gated.length) {
         _warn_merge_gated();
     }
-    return 0;
+    return guarded.problems > 0 ? 1 : 0;
 }
 
 function _isCliEntry(): boolean {
@@ -1475,7 +1479,7 @@ export {
     TITLE_RE,
     FRONTMATTER_RE,
     parse_frontmatter,
-    is_draft,
+    is_unscheduled,
     is_roadmap_candidate,
     count_checkboxes,
     parse_blockers,

package/dist/agent-src/skills/brand-asset-generation/SKILL.md

@@ -28,16 +28,29 @@ adapters — not a second image-gen stack.
 
 ## When to use
 
-- User asks to generate a banner, social card, header image, or CIP (corporate identity) element.
+- User asks to generate a banner, social card, header image, **platform profile
+  or cover image** (a LinkedIn cover, an X header, a YouTube channel art), or a
+  CIP (corporate identity) element.
 - Branded asset production where palette, typography, or voice must stay consistent.
 - When brand tokens are available and should drive the visual output.
 - When a brief alone (no tokens) still needs a governance-aware image output.
 
 ## Procedure
 
-1. **Identify asset type and spec** — determine format (banner, social card, CIP element),
-   output dimensions (e.g. 1200×630 for Open Graph, 1080×1080 for square social),
-   and target channel (web, print, social platform).
+1. **Identify asset type and spec** — determine format (banner, social card,
+   platform profile/cover image, CIP element), output dimensions (e.g. 1200×630
+   for Open Graph, 1080×1080 for square social), and target channel (web, print,
+   social platform).
+
+   **A platform cover is a dimension constraint, not a new asset class**, and it
+   is the one case where guessing the number is the whole failure: a cover
+   rendered at the wrong aspect ratio is cropped by the platform, so the brand
+   marks land outside the visible area and the asset is unusable rather than
+   merely off-brand. Take the required dimensions from the platform's own
+   current spec at generation time — never from memory, and never from a number
+   written here, because these change without notice. If the spec cannot be
+   established, say so and ask rather than emitting an asset that will be
+   cropped.
 2. **Inject brand tokens when present** — if `pack-brand` is installed, load `.tokens.json`
    (colors, typography, voice). Feed hex values, font names, and tone keywords directly
    into the prompt. Without tokens, derive palette and type from the brief itself;

package/dist/agent-src/skills/brand-audit/SKILL.md

@@ -35,6 +35,23 @@ Method skill. Inventories current brand expression across touchpoints and flags
 
 1. **Gather the source of truth.** Collect the consumer brand's defined tokens (palette, type scale, logo rules), voice profile, and strategy doc if they exist. Consumer brand definition is authoritative; corpus defaults are gap-fill only.
 2. **Inventory current expression per touchpoint.** Cover logo usage, colour palette, typography, voice/copy tone, imagery style, and iconography across the relevant surfaces (site, app, decks, marketing, docs).
+
+   **Personal and company profile surfaces, including LinkedIn, X, and GitHub
+   organization profiles, are deliberately excluded regardless of whether their
+   content is fetched, pasted, or supplied as a file, pending a written
+   public-profile-field privacy floor defining what may be processed.**
+
+   Recorded so the next reader does not re-derive the gap, which has already
+   happened once. The exclusion is about **handling**, not retrieval: a pasted
+   profile is mechanically a different thing from a network fetch, but the
+   missing artefact is a field-level classification saying which profile fields
+   are brand surface (logo, palette, bio messaging) and which are PII-adjacent
+   (employment history, contributor names, location). A profile's About text
+   carries both in one field. Without that classification the skill cannot
+   distinguish them, and no test can assert that it did. AI council 2/2,
+   2026-08-25. Include user-supplied profile inputs once a written, testable
+   field-level privacy floor exists; include fetched inputs only after both that
+   floor and a host-agent fetch contract exist.
 3. **UI surface.** Invoke `existing-ui-audit` for UI component inventory. Do not re-implement it here — take its output as an input to this audit.
 4. **Compare observed vs. defined.** For each touchpoint value, check it against the matching token or voice rule.
 5. **Classify each finding.** Three buckets: `on-brand` (matches the defined token), `drift` (observed value diverges from the token), `undefined` (no token exists to audit against — this is a governance gap, not automatically wrong).
@@ -42,6 +59,22 @@ Method skill. Inventories current brand expression across touchpoints and flags
 7. **Verify completeness.** Confirm every inventoried touchpoint is classified (`on-brand` / `drift` / `undefined`) — the audit is complete only when the classified count equals the inventoried count, and `existing-ui-audit` has run for every in-scope UI surface. Ensure each drift finding cites BOTH the defined value and the observed value; a finding missing either side is not yet verified.
 8. **Output the findings list** (see Output format). Do not redesign or author replacements — hand drift findings to `brand-identity` or `brand-strategy`.
 
+## Two constraints on platform-specific guidance
+
+Both are constraints on what this skill may assert, not machinery, and neither
+is a registry.
+
+- **Any platform-specific guidance carries a source tier and a review date.**
+  Platform conventions — an image aspect ratio, a character limit, where a
+  profile crops a banner — change without notice, so a number stated here
+  without a date and a source is a claim that quietly stops being true. Tier it
+  (`platform-doc` / `observed` / `inferred`) and date it, or take it from the
+  platform's own current spec at audit time instead of stating it.
+- **No engagement metric is stated as fact.** Reach, impression and
+  best-time-to-post figures are platform- and account-specific and are not
+  auditable from a brand token. Where such a figure is load-bearing to a
+  finding, attribute it; never assert it as a general truth.
+
 ## Output format
 
 1. **Source-of-truth summary** — what brand tokens, voice rules, and strategy exist and where they were found (or "none defined" if absent).

package/dist/agent-src/skills/code-intelligence/SKILL.md

@@ -77,6 +77,63 @@ Every answer built with this skill MUST:
   That is the engine being honest, not broken — do not "resolve" them yourself
   by guessing.
 
+## Measured twice, and it has not won (v2, 2026-08-29)
+
+Pre-registered, published whichever way it landed:
+`internal/bench/reports/code-graph-vs-grep-inrepo-v2-2026-08-29.md`. The native
+engine scored against disciplined `git grep` over three in-repo TypeScript
+roots, 19 questions, per-class bars fixed before the run and unchanged from v1.
+
+| Class | grep R | graph R | Δ pp | grep P | graph P | verdict |
+|---|---|---|---|---|---|---|
+| `callers` | 1.000 | 1.000 | +0.0 | 0.611 | 0.667 | TIE |
+| `transitive-impact` | 0.611 | 0.500 | −11.1 | 1.000 | 0.667 | NULL |
+| `path-between` | 0.917 | **1.000** | +8.3 | 0.778 | **1.000** | TIE |
+| `references` | 1.000 | 0.333 | −66.7 | 0.833 | 0.333 | NULL |
+
+**Zero classes met the win bar.** On `path-between` the graph is exact and is the
+only class where it out-precises grep; it still ties, because the delta is +8.3 pp
+against a +10 pp bar that was fixed before the run.
+
+**The v1 run of 2026-08-28 published a false root cause, corrected 2026-08-29.**
+It reported `path-between` as `VOID` because *"both arms measured nothing"*. Only
+the grep arm did. The graph answered all three questions and v1's scorer discarded
+the answer — it compared each returned symbol against the whole probe string
+`"cmdBuild -> getParser"`. v1 also never invoked the shipped `path <a> <b>` verb,
+and counted unresolved `symbol:` pseudo-nodes as files, which is the sole reason
+its `callers` verdict was NULL with recall tied. v1's numbers are not retro-edited
+— they were faithful to v1's own registration — and v1's report now carries the
+correction. Do not quote a `path-between` delta near +89 pp: that figure comes
+from repairing the graph arm and leaving grep on the broken probe.
+
+**The rule's own wording was corrected by this result.** `external-code-graph-interop`
+used to open by saying a committed index answers "far more precisely than a fresh
+`grep`". That was never measured, and when it was, it was false for the native
+engine on this repository's own code. The rule now gives the reasons that survive
+measurement — an index that exists is already built and structured, so it is the
+cheap first question — and drops the precision claim its own benchmark refuted.
+
+**No class is graph-first.** Query the index first because an index that already
+exists is cheap to ask and its answer is structured — not because it answers
+better. When it returns nothing, that is the common case, and grep remains the
+arm to fall back to rather than a grudging afterthought.
+
+The sentence that stood here — *"the arm that won every valid class on this
+corpus"* — is withdrawn. It is the framing v1's own report forbids: that report
+says the defensible statement is *"zero classes met the pre-registered win
+criterion"*, **not** that grep proved superior. It was also false on its own
+terms under v2: grep wins two classes, ties two, and is out-precised on both
+ties.
+
+Scope, stated so this table is not over-read: it measured the **native** engine
+on **this repository's TypeScript**, with a corpus of 19 questions. It is not
+comparable to the 2026-07-28 external-corpus run, it is not comparable to v1
+either (corpus, arm-B verb set and scorer all moved), and it says nothing about a
+consumer-shipped SCIP index. Literal-string probes are reported as a separate
+`capability-boundary` class with no floor derived from them: a symbol index
+cannot answer them at all, which is where grep stays necessary rather than a
+defect in the engine.
+
 ## Do NOT
 
 - Do NOT rebuild a **fresh** consumer-shipped index — query it (interop

package/dist/agent-src/skills/database/SKILL.md

@@ -113,6 +113,14 @@ SQLite; ORM-agnostic):
 
 ## Gotcha
 
+**MySQL and MariaDB share a query-syntax world. They never share a migration
+one.** Treat them as one engine for writing a `SELECT`, and as two engines for
+everything that changes a schema or reports on a plan: online-DDL semantics,
+lock behavior under `ALTER`, feature availability, and `EXPLAIN` output all
+diverge. Read the engine and its version from the project before making any
+claim in that second group; where the project does not declare one, say the
+engine is unknown rather than assuming.
+
 - Check existing indexes before adding — duplicates waste write performance.
 - Consider multi-tenant implications — queries may need customer DB scoping.
 - `EXPLAIN` output varies between MariaDB and MySQL.

package/dist/agent-src/skills/dependency-upgrade/SKILL.md

@@ -31,6 +31,33 @@ Before upgrading:
 - **Review upgrade guides** — many packages provide migration docs.
 - **Check runtime version requirements** — does the new version need a newer PHP / Node / Python / Go / Rust toolchain?
 
+### 1b. Find where the version is DECLARED, before naming a file to edit
+
+```
+NEVER NAME AN EDIT SITE BEFORE ASKING WHERE THE VERSION IS DECLARED.
+IN A CATALOG WORKSPACE THE MEMBER MANIFEST IS THE WRONG FILE:
+THE VERSION IS ONE ROOT LINE WITH N REFERENTS.
+```
+
+A member `package.json` is the declaration site in an ordinary repository and
+**not** in a workspace using a catalog. There, the member reads `catalog:` and
+the range lives once in the workspace definition — editing the member either
+does nothing or silently diverges from the catalog.
+
+Ask in this order, and stop at the first that answers:
+
+1. **A catalog entry for this dependency** — `pnpm-workspace.yaml` `catalogs:` /
+   `catalog:`, or the equivalent in another manager's workspace definition. If
+   the member's range starts with `catalog:`, this is the edit site. Name the
+   catalog (`default` included) in the guidance, not the member.
+2. **A root-level pin** — `overrides` / `resolutions` / `pnpm.overrides`. A
+   member edit under one of these is overridden at install time.
+3. **The member manifest** — the ordinary case, and only after 1 and 2 are
+   silent.
+
+A repository with no catalog and no root pin behaves exactly as before; this
+step adds a lookup, not a change of default.
+
 ### 2. Plan
 
 Categorize changes needed:

package/dist/agent-src/skills/design-review/SKILL.md

@@ -221,7 +221,7 @@ fields change what a finding *means*:
   all. Under `preserve` a palette or type-family delta is a **defect**; under
   `redesign` it is the point.
 - **`reference_maturity`** decides whether a difference from the reference is a
-  defect. A `wireframe` declares structure, so reproducing its grey boxes is
+  defect. A `wireframe` declares structure, so reproducing its gray boxes is
   over-fidelity, not fidelity.
 
 ```

package/dist/agent-src/skills/doc-coauthoring/SKILL.md

@@ -132,7 +132,7 @@ Verify the doc works for someone without your context.
 * **One question per turn** (Iron Law from `ask-when-uncertain`) — never bundle clarifying + brainstorm + curate prompts in one message.
 * **Never reprint the full doc** during iteration — always use `str-replace-editor`. Reprinting wastes tokens and creates merge drift.
 * **Reader test is not optional** — without it, you ship the version that makes sense to you, not to readers. Skip only on explicit user override.
-* **Sub-agent absence** — `ai-council` may not be configured. Have the manual fresh-Claude fallback ready (Stage 3 step 2).
+* **Subagent absence** — `ai-council` may not be configured. Have the manual fresh-Claude fallback ready (Stage 3 step 2).
 * **Image alt-text** — if the doc embeds images, add alt-text inline; without it, fresh-reader tools can't see them.
 * **Language discipline** — keep the doc body in English (per `language-and-tone`). For verbatim German user phrases or interview quotes, use `DE: … · EN: …` anchor blocks.
 

package/dist/agent-src/skills/existing-ui-audit/SKILL.md

@@ -79,7 +79,23 @@ Design starts from project truth, not generic aesthetic memory.
 | `vue` | `resources/js/components/`, `src/components/`, `pages/` |
 | `plain` | `resources/views/`, plus any `*.html` under `public/` |
 
-Capture each component/template as: `{path, name, kind: page|partial|component|layout, exports?: [props]}`.
+Capture each component/template as:
+`{path, name, kind: component|view|style|page, exports?: [props]}`.
+
+The `kind` set is the one `agent-config ui:audit` actually emits — its single
+definition is `AUDIT_KINDS` in `src/cli/commands/uiAudit.ts`, and a test asserts
+this line against that constant rather than restating it. It read
+`page|partial|component|layout` until 2026-08-26; only two of those four values
+existed in the code, so an artefact written by the command was being read here
+against a contract it did not satisfy.
+
+`partial` and `layout` are not in the set. Neither has an operational definition
+that survives contact with a real tree, and adding a branch for a category
+nobody can test is how the previous mismatch happened.
+
+`view` is the **Blade** classification — `*.blade.php` and `resources/views/`.
+It reads zero in a JavaScript tree by construction, which is not the same as
+unused.
 
 ### 2. Identify the design system
 

package/dist/agent-src/skills/feature-planning/SKILL.md

@@ -121,6 +121,12 @@ Discovery → Exploration → Questions → Architecture → Implementation →
 - Follow chosen architecture from Phase 4.
 - Follow codebase conventions strictly.
 - Track progress via task list or roadmap.
+- **One behavior at a time**: the failing test for that behavior, observed
+  failing, then the minimum code that makes it pass, then the next behavior.
+  Tests are a step of this phase, never a follow-up suggested in Phase 7 —
+  a plan that reaches the summary owing its tests planned test-after.
+  Exceptions are the Do-NOT list in the `test-driven-development` skill,
+  and a skipped cycle is recorded in the decision log rather than passed over.
 
 #### Phase 6: Quality Review
 - Review the implementation for:
@@ -132,7 +138,8 @@ Discovery → Exploration → Questions → Architecture → Implementation →
 
 #### Phase 7: Summary
 - Summarize what was built, key decisions, files modified.
-- Suggest next steps (tests, documentation, follow-up features).
+- Suggest next steps (documentation, follow-up features) — never tests, which
+  Phase 5 already closed per behavior.
 - Update roadmap if applicable.
 
 ## Decision log
@@ -147,7 +154,7 @@ This ensures future developers (and agents) understand the reasoning, not just t
 
 ## Bite-sized task granularity (structural roadmaps only)
 
-When a feature plan's generated roadmap declares `complexity: structural` in its frontmatter, every task bullet must be self-contained and 2–5 minutes of work. Lightweight roadmaps (the default) skip this section — coarse-grained tasks ("Add login endpoint", "Update tests") are correct when the work is well-scoped and low-risk.
+When a feature plan's generated roadmap declares `complexity: structural` in its frontmatter, every task bullet must be self-contained and 2–5 minutes of work. Lightweight roadmaps (the default) skip this section — coarse-grained tasks are correct when the work is well-scoped and low-risk — but coarse means *one behavior*, not one layer: ("Reject login with an unknown email — test, then handler", "Reject login with a wrong password — test, then handler"), never an implementation step followed by an "Update tests" step.
 
 Structural roadmap tasks must include:
 

package/dist/agent-src/skills/frontend-render-security/SKILL.md

@@ -52,6 +52,48 @@ NO SECRET, PRIVILEGED KEY, OR SESSION TOKEN LIVES IN CLIENT CODE OR localStorage
 | `target="_blank"` without `rel="noopener"` | Reverse tabnabbing (CWE-1022) | add `rel="noopener noreferrer"` |
 | Missing CSP; missing alt/label/contrast | No XSS second line of defense; a11y failures | strict CSP (no `unsafe-inline`); alt text, labels, AA contrast |
 
+## The server-composed bootstrap payload
+
+A payload assembled **server-side and serialised into the page** for a client
+island is a data-exposure surface: whatever is put in it is readable by anyone
+who can load the page — no API call, no auth check, view-source. Several
+mainstream frameworks ship their own named channel for exactly this, so the
+pattern is a documented mechanism rather than one project's arrangement.
+
+**Inspect the existing payload before judging any field.** Read what the channel
+already carries and check current call sites for what the client actually
+consumes — a field is only defensible against what the page needs, and a review
+that never opened the payload is a guess. The grep below finds it.
+
+**The per-field question, which is what this section is:**
+
+> Would I return this field from a **public, unauthenticated** endpoint?
+> If not, it does not belong in the payload.
+
+Field classes that recur and are almost always wrong there: internal ids that
+enumerate other users' rows · permission and role structures the client only
+needs a boolean of · feature-flag payloads carrying unreleased product names ·
+anything from an admin-scoped query that was convenient to reuse · a whole
+serialised model where the page needs three of its fields.
+
+**Nothing enforces this, and the split is deliberate.**
+
+| Half | What it does | What it cannot do |
+|---|---|---|
+| the grep below | **locates** a payload a field was added to | tell a privileged field from a public one |
+| this checklist entry | carries the **judgement** | run |
+
+The question is not decidable by any check: a grep over the framework-named
+payload channels cannot read intent. So the deterministic half is discovery,
+advisory and non-blocking, and its whole value is putting the question in front
+of a reader who would otherwise never see it. `enforced_by: none` is the honest
+field here — this section refuses nothing.
+
+**What may NOT be encoded.** The particular channel any one repository uses.
+What is encoded is the question and the framework-named channels; a concrete
+in-house payload shape would be one repository's implementation shipped as
+guidance.
+
 ## Backstop greps
 
 Run before committing frontend changes; each should return zero (or every hit is read and justified):
@@ -66,6 +108,8 @@ rg -n "origin:\s*['\"]\*['\"]|Access-Control-Allow-Origin.*\*"
 rg -n "addEventListener\(\s*['\"]message['\"]"   # then confirm each checks event.origin
 # Unhardened external links
 rg -n 'target=["'\'']_blank["'\'']'   # then confirm rel="noopener" present
+# Server-composed bootstrap payload — LOCATES it; the per-field judgement is yours
+rg -n '__NEXT_DATA__|__NUXT__|window\.__INITIAL_STATE__|@json\(|json_encode\([^)]*\)\s*\)?\s*</script>|dehydratedState'
 ```
 
 ## Output format

package/dist/agent-src/skills/git-workflow/SKILL.md

@@ -9,7 +9,7 @@ scope:
 execution:
   type: assisted
   handler: internal
-  allowed_tools: ["github"]
+  allowed_tools: ["Bash(git:*)", "Bash(gh:*)"]
 workspaces:
   - engineering
 packs:

package/dist/agent-src/skills/js-library-packaging/scripts/check_package_surface.ts

@@ -143,20 +143,54 @@ export const checkPackage = (root: string): SurfaceReport => {
     };
     if (exportsField !== undefined) walkConditions(exportsField, 'exports.');
 
-    // (d) — a `workspace:` range only resolves inside the workspace. Published with no
+    // (d) — a range that only resolves INSIDE the workspace. Published with no
     // `private: true` and no publishConfig, the consumer's install fails on a protocol
     // their registry has never heard of.
-    const allDeps = { ...deps, ...asRecord(manifest['devDependencies']), ...peers };
-    const workspaceRanges = Object.entries(allDeps).filter(([, v]) => typeof v === 'string' && v.startsWith('workspace:'));
+    //
+    // `catalog:` was added 2026-08-26 (road-to-internal-estate-fit 4.1) and it is the
+    // same defect, not an adjacent one: pnpm's catalog protocol resolves against the
+    // workspace's catalog definition and means nothing to a registry. It had been
+    // passing as an ordinary registry range, so the finding did not fire where it
+    // should. One predicate, two prefixes — the finding code and its reason carry over
+    // unchanged, which is why this is not a second finding type.
+    const UNPUBLISHABLE_RANGE_PREFIXES = ['workspace:', 'catalog:'] as const;
+    // Each dependency map is scanned SEPARATELY rather than spread into one
+    // object. The previous `{ ...deps, ...devDeps, ...peers }` merge let a later
+    // map SHADOW an earlier one for the same package name: a `workspace:` range
+    // in `dependencies` for a package that also appears in `peerDependencies`
+    // with a registry range was invisible, because the peer value won the spread.
+    // Found 2026-08-26 by a `catalog:` fixture for a name the test manifest also
+    // lists as a peer; fixed with 4.1 rather than noted, because it is the same
+    // predicate and the same few lines.
+    const workspaceRanges: [string, unknown][] = [
+        deps,
+        asRecord(manifest['devDependencies']),
+        peers,
+    ].flatMap((m) =>
+        Object.entries(m).filter(
+            ([, v]) =>
+                typeof v === 'string' &&
+                UNPUBLISHABLE_RANGE_PREFIXES.some((pre) => v.startsWith(pre)),
+        ),
+    );
     if (
         workspaceRanges.length > 0 &&
         manifest['private'] !== true &&
         manifest['publishConfig'] === undefined
     ) {
+        const prefixes = [
+            ...new Set(
+                workspaceRanges.map(
+                    ([, v]) =>
+                        UNPUBLISHABLE_RANGE_PREFIXES.find((pre) => (v as string).startsWith(pre)) ??
+                        '',
+                ),
+            ),
+        ].sort();
         findings.push({
             code: 'workspace-range-publishable',
             severity: 'warn',
-            message: `${String(workspaceRanges.length)} \`workspace:\` range(s) in a package that is neither private nor carrying publishConfig — the protocol does not resolve outside the workspace`,
+            message: `${String(workspaceRanges.length)} workspace-local range(s) (${prefixes.join(', ')}) in a package that is neither private nor carrying publishConfig — the protocol does not resolve outside the workspace`,
         });
     }
 

package/dist/agent-src/skills/judge-artifact-completeness/rubrics/ticket-quality-score.json

@@ -18,8 +18,8 @@
       "name": "Acceptance criteria",
       "cross_cutting": false,
       "weight": 3,
-      "criterion": "Acceptance criteria are written as verifiable Given-When-Then or numbered checklist items, not as task descriptions. Each criterion is independently testable. An implementer can write a test before touching code.",
-      "gap_signal": "AC section missing; or AC items are task descriptions ('implement the API') rather than verifiable outcomes ('returns 200 with a body matching the schema')."
+      "criterion": "Acceptance criteria are independently testable outcomes, not task descriptions — an implementer can write a test before touching code. Whether they are owed in Given-When-Then form is decided by the observable-behavior test in `src/skills/test-case-discovery/SKILL.md` § Does this change owe an executable behavior contract?, not asserted here: most tickets owe verifiable checklist items, and only a change with an audience outside the code owes a behavior contract. Where one is owed, that section's anti-script rule applies — a criterion naming a selector, a timeout or a keystroke scores as a gap, however well-formed its Given-When-Then.",
+      "gap_signal": "AC section missing; or AC items are task descriptions ('implement the API') rather than verifiable outcomes ('returns 200 with a body matching the schema'); or a Given-When-Then criterion scripts the interface ('When I click #submit') instead of stating the rule."
     },
     {
       "id": "dor_readiness",

package/dist/agent-src/skills/laravel/SKILL.md

@@ -33,6 +33,41 @@ Use this skill for all Laravel-specific code generation and editing tasks, espec
 
 This skill extends the base `php-coder` skill and applies Laravel conventions on top of the project's general PHP rules.
 
+## When NOT to use — components without the framework
+
+```
+A DEPENDENCY PROVES A LIBRARY IS AVAILABLE. ONLY THE ENTRY POINT AND THE
+ROUTER PROVE WHICH APPLICATION SHAPE IS RUNNING.
+`illuminate/*` PACKAGES WITH NO SKELETON MARKER IS A THIRD STATE, AND THIS SKILL
+DOES NOT APPLY TO IT.
+```
+
+Laravel ships its ORM, container, collections and HTTP layer as
+independently installable packages, usable with no framework present — a
+published distribution model, not one consumer's arrangement. An application
+built that way has a **custom entry point and a custom router**. Routing it here
+offers a CLI that does not exist, a request-validation primitive that is not
+wired, and a routes file that was never there: every suggestion confidently
+wrong, and the reason visible only from the entry point.
+
+**The probe set, and its cost.** A fixed set of filesystem existence checks plus
+one manifest read — no directory walk, no content scan, and never re-derived per
+session. Any ONE marker present means the framework is real:
+
+| Probe | Meaning |
+|---|---|
+| `artisan` | the console entry point the skeleton writes |
+| `config/app.php` | the skeleton's bootstrap config |
+| `bootstrap/app.php` | the application bootstrap |
+
+`illuminate/*` in `composer.json` with **none** of those markers is
+*components-without-the-framework*. Say so and route away from this skill rather
+than answering as though the framework were there.
+
+Implemented deterministically in `src/install/detect_php_shape.ts`
+(`detectPhpShape`), whose `PROBE_PATHS` is this table and whose verdict names
+what a wrong route would have offered.
+
 ## Procedure: Write Laravel code
 
 → **First apply the `php-coder` skill** — it handles project docs, module docs, patterns, and quality tools.