@event4u/agent-config 14.16.0 → 14.18.0

package/dist/agent-src/commands/pr/merge.md

@@ -34,12 +34,13 @@ ACTIVATION NEEDS THE OWNER DECISION IN THE `merge-authority` BLOCKER OF
 `road-to-drain-commands` — NEVER A COMMAND EDIT, AND NEVER A GUARD EDIT.
 ```
 
-**The invocation is the authorization, and nothing else is.** `pr-merge` is a
-`BLOCK_OPS` member in `block_unauthorized_git.ts` because it is irreversible.
-This command would consume the authorization the user's own prompt text already
-wrote to the per-session ledger on `UserPromptSubmit`; it introduces no second
-authorization store, and it never writes one. When that window closes the run
-stops and reports (§ 7) — the window never grows.
+**The invocation is the authorization, and nothing else is.** `pr-merge` is
+irreversible, and since 2026-09-04 (ADR-254) NOTHING MECHANICAL CHECKS IT —
+the gate that did was removed after it refused authorizations the owner had in
+fact given. The per-session ledger still records what the user's own prompt
+authorized, and this command still reads it as an audit trail; it introduces no
+second authorization store, and it never writes one. When the work left is
+outside what the owner authorized, the run stops and reports (§ 7).
 
 Why it ships inert rather than not at all: everything before § 9 — the target
 manifest, the four conflict classes, the superseded check, the bounded CI
@@ -266,54 +267,44 @@ exceeds the remaining window, stop entering CI-fix loops and merge everything
 already green first. Pre-greening several PRs ahead of their merge is forbidden
 under window pressure.
 
-**The signal, named — otherwise neither this rule nor § 7 is actionable.** The
-window is the per-session authorization ledger's own freshness bound. Read it,
-never write it:
+**No mechanical window remains, and that is the change.** Until 2026-09-04 the
+run read a freshness bound off the authorization ledger and paused when it
+closed. The owner removed the enforcing gate (ADR-254) after it was measured
+refusing authorizations that had in fact been given, so there is no constant to
+read and no expiry to schedule against. Authorization is carried by the
+conversation and by `non-destructive-by-default`, not by a clock.
+
+The per-session ledger is still written, and is still read-only to this run:
 
 ```bash
 cat "agents/state/git-authorization/$(<session-slug>).json"   # detected_at
 ```
 
-Remaining window = `detected_at + LEDGER_MAX_AGE_MS − now`. Take the constant
-from the guard source **only after** `check_hook_bundle_content` says the
-source and the executing bundle agree — reading the source alone is the
-2026-08-21 failure re-expressed as an instruction, since the bundle is what
-enforces the value and a source edit without a rebuild is silently inert. Under
-pressure means
-the remaining window is shorter than one CI cycle on this repository. The read
-is the whole interaction: the run never edits that file, the constant, or the
-built bundle.
+It records what a turn authorized. It no longer gates anything, so treat it as
+an audit trail, never as permission. The run never edits that file.
 
-## 7. Expiry is a reported state, never a stall
+## 7. Authorization is the owner's sentence, not a timer
 
 ```
-WHEN THE AUTHORIZATION WINDOW CLOSES WITH WORK LEFT, THE RUN PAUSES, REPORTS,
-AND ASKS FOR RE-AUTHORIZATION. IT NEVER RETRIES THE GUARD, AND IT NEVER EDITS
-THE GUARD, ITS SOURCE, OR ITS BUNDLES — READ-ONLY VERIFICATION ONLY.
+THE RUN MERGES WHAT THE OWNER AUTHORIZED AND NOTHING ELSE. WHEN THE WORK LEFT
+IS OUTSIDE WHAT WAS AUTHORIZED, THE RUN PAUSES, REPORTS, AND ASKS. IT NEVER
+INFERS A WIDER MANDATE FROM A LONG RUN OR FROM MOMENTUM.
 ```
 
-**Unreachable while the merge step is gated**, and stated rather than left for
-a reader to discover: with nothing merging, the run performs no `BLOCK_OPS`
-operation (`push` and `commit` are `WARN_OPS`), so the window governs nothing
-it does. This section is the contract for when the gate opens.
-
-Write the summary as-is with a `window-expired` disposition per unprocessed PR
-and name the exact re-authorization needed. Then STOP and wait — do not end the
-run, and do not proceed to the next PR. ADR-251 (2026-08-30) decided this
-shape: expiry is a pause, not a termination.
-
-**The operator's reply is what resumes it, and it renews the window through the
-path that already exists.** `git_authorization_hook.ts` rewrites this session's
-ledger with a fresh `detected_at` on every human-typed prompt, so a reply
-carrying the re-authorization you named resets the age the guard compares
-against — no new mechanism, and the signal still comes from text the user typed.
-Re-verify the manifest entry (number and head SHA) before resuming, exactly as
-§ 8 requires: the pause is a window in which the world can move.
-
-Widening `LEDGER_MAX_AGE_MS` is still forbidden practice, and ADR-251 kept the
-30-minute value deliberately rather than by omission: on 2026-08-21 it was
-patched to six hours for a drain run and the widening reached the trunk. The run proposes no value for it, edits neither it nor its bundles,
-and treats a refusal as the answer.
+With the gate removed nothing refuses an unauthorized merge, which makes this
+section the whole control rather than a second layer behind one. Two rules
+follow, and they are stricter than the ones they replace:
+
+- **A cardinality word does not authorize a PR the owner never named.** "All the
+  open PRs" is an instruction to work the queue as it stood when the owner said
+  it. A PR opened after that sentence is new work and needs its own go-ahead.
+- **A one-shot authorization is spent on the operation it named.** Per
+  `commit-policy`, "merge #1499" does not authorize the next merge, and a
+  conflict cycle or a CI fix in between does not renew it.
+
+Write the summary as-is with an `unauthorized` disposition per unprocessed PR
+and name the exact authorization needed. Then STOP and wait — do not end the
+run, and do not proceed to the next PR.
 
 ## 8. Kill switches, and what happens after a merge
 

package/dist/agent-src/rules/commit-conventions.md

@@ -18,7 +18,7 @@ obligation_frequency: "per-commit"
 
 # Commit Conventions
 
-**Iron Law.** Use Conventional Commits (`feat:`, `fix:`, `chore:` …); branches `<type>/<short-slug>`; never invent your own format. Subjects + branch names stay emoji-free per [`no-decorative-emojis-in-git-surfaces`](no-decorative-emojis-in-git-surfaces.md); body emojis allowed only with an in-artifact legend.
+**Iron Law.** Match the repo's configured or approved convention; else Conventional Commits (`feat:`, `fix:` …), branches `<type>/<short-slug>`; never invent one. Subjects + branch names stay emoji-free per [`no-decorative-emojis-in-git-surfaces`](no-decorative-emojis-in-git-surfaces.md); body emojis need an in-artifact legend.
 
 Body migrated to `skill:conventional-commits-writing` (per P4 of `road-to-kernel-and-router.md`).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/skills/accessibility-auditor/SKILL.md

@@ -5,6 +5,8 @@ description: "Use when reviewing UI for accessibility — WCAG 2.2 AA, keyboard
 personas:
   - frontend-engineer
 domain: quality
+enforced_by:
+  - "test:tests/contracts/accessibility_wcag_version_claim.test.ts"
 workspaces:
   - engineering
 packs:

package/dist/agent-src/skills/ai-code-blindspots/SKILL.md

@@ -47,7 +47,7 @@ Run the row(s) for what you touched. The grep is a fast authoring-time backstop
 | **HTTP endpoint / route** | authorization (this principal may act on this resource — not just authenticated); tenant scope; **the three negative tests** (unauth→401, non-owner→403/404, cross-tenant→403/404); input validation at the boundary; rate limit actually wired; state-changing → CSRF + audit log | `broken-access-control`, `authz-review`, `threat-modeling` |
 | **DB query / ORM** | parameterized, never string-built; tenant predicate present; no `SELECT *` across a serialization boundary; N+1 avoided (eager load) | `source-discovery`, `security` |
 | **Migration** | reversible (`down`); expand-contract for drop/rename (never a bare `DROP COLUMN` before code stops reading it); transaction; index on new FK/filter column | `engineering-safety-floor`, `migration-architect` |
-| **User-controlled render (FE)** | output-encoded; no `dangerouslySetInnerHTML`/`v-html`/`innerHTML`/`eval` on non-constant input; no secret/token in client code; token not in `localStorage` | `frontend-render-security` |
+| **User-controlled render (FE)** | output-encoded; no `dangerouslySetInnerHTML`/`v-html`/`innerHTML`/`eval` on non-constant input; no secret/token in client code; token not in `localStorage`. **This surface also carries the four completeness rows below — they are part of it, not an optional extra.** | `frontend-render-security` |
 | **Third-party asset in shipped markup / CSS** | delivery is self-hosted through the project's own route (framework font/asset primitive, bundled package, or locally-served file) — a font/icon/stylesheet CDN link transmits the **visitor's IP** to that third party on every page view; a hotlink only on a stated consumer opt-in; `integrity` + `crossorigin` if a CDN link stays | `design-fidelity-mechanics` § Asset & imagery discipline (owner), `typography-system` |
 | **File / outbound fetch** | path confined to an allowed base; SSRF allow-list + private-IP block on user-supplied URLs; size limit; **explicit timeout** (no unbounded/default-infinite wait); server-side validation (never client-only) | `security`, `defense-in-depth` |
 | **Infra / IaC** | least-privilege (no `Action:*`/`Resource:*`); encryption at rest; no `0.0.0.0/0` to mgmt/DB ports; no hardcoded creds; scanner-verified, not `plan`-verified | `engineering-safety-floor`, `terraform`, `secrets-management` |
@@ -57,6 +57,32 @@ Run the row(s) for what you touched. The grep is a fast authoring-time backstop
 | **Concurrency / shared state** | check-then-act guarded (DB lock / atomic op / transaction — not a read-modify-write race); retried write carries an idempotency key; no unbounded parallel fan-out; shared mutable state synchronized | `source-discovery`, `security` |
 | **Test** | asserts general behavior; expected derived from inputs/seeded data, not hardcoded; boundary + error + abuse cases, not only happy path | `testing-anti-patterns`, `test-driven-development` |
 
+### Render surface — the completeness rows
+
+Every row above is a **security** control. These four are the **completeness**
+controls for the same surface — the states an agent most reliably omits, because
+the prompt named the happy path and nothing else. A render that ships only the
+populated state is not finished; it is one of four states written.
+
+**The grep polarity is INVERTED here, and reading it the other way is the failure
+mode this table has.** Above, zero hits is the pass. Below, **zero hits next to a
+render that fetches or iterates is the prompt to look** — the state is probably
+absent. A hit is not a pass either: the column is a `heuristic`, a locator for
+code to read, never proof the state behaves. A framework abstraction can
+implement all four correctly and match none of these patterns, and a codebase can
+match all four while shipping a broken empty state.
+
+| State | Assert on the render you wrote | Backstop grep (heuristic — zero hits is the prompt) |
+|---|---|---|
+| **Empty** | the zero-rows / no-results case renders a deliberate state, not a bare frame or a collapsed layout; it says what is missing and what the user can do next | `rg -n -e '\.length\s*[=<]' -e '\bisEmpty\b' -e 'count\(\)\s*[=<]' -e '\bempty\b'` — over the file that maps the collection |
+| **Loading** | the pending case renders (skeleton, spinner, disabled control); no layout shift on arrival; the state is reachable from the actual async call, not only defined | `rg -n -e 'isLoading' -e 'isPending' -e 'isFetching' -e 'Skeleton' -e 'Spinner' -e 'aria-busy'` |
+| **Error** | the failed case renders a recoverable state with a retry or a next step; the message carries no stack, secret or PII (the `frontend-render-security` row owns that half) | `rg -n -e 'isError' -e 'onError' -e 'ErrorBoundary' -e '\.catch\(' -e 'role="alert"'` |
+| **Keyboard path** | every interactive element is reachable and operable by keyboard alone, with a visible focus ring; a click handler on a non-button element carries a role, `tabindex` and a key handler | `rg -n -e 'onClick' -e '@click' -e 'v-on:click'` lists the handlers, then `rg -n -e 'tabIndex' -e 'tabindex' -e 'onKeyDown' -e '@keydown' -e 'role='` on the same file — a handler with no match on the second is the prompt |
+
+Route to `accessibility-auditor` for the keyboard row when the surface is more
+than a handful of controls — this row asserts the path exists, it is not a WCAG
+pass.
+
 ### Backstop greps (authoring-time, cross-stack)
 
 ```bash

package/dist/agent-src/skills/aws-infrastructure/SKILL.md

@@ -127,6 +127,47 @@ are typically managed via **Terraform + Terragrunt** in a separate infrastructur
 
 See the `terraform` and `terragrunt` skills for general IaC conventions.
 
+### Least privilege and permissive defaults
+
+The conventions above describe how this project deploys. This section is the
+floor underneath them, and it holds whether or not a given resource is managed
+here or in the infrastructure repo.
+
+- **Least-privilege IAM, always.** A task role, an OIDC role, or an execution
+  role enumerates its actions and its resource ARNs. `Action: *` and
+  `Resource: *` are not shorthand for "we will scope it later" - one
+  compromised task credential then reaches every service and object in the
+  account. A wildcard needs a named, reviewed exception written beside it.
+- **Least-privilege networking.** A security group opens a port to the
+  narrowest source that works: another security group id, a prefix list, a
+  known CIDR. An internet-wide source belongs to a public listener and nothing
+  else.
+- **Permissive defaults are decisions.** A bucket with no public-access block,
+  a database with `publicly_accessible` left true, a volume or snapshot with no
+  encryption block - each of these works either way, which is why it survives
+  review. Treat an absent security block as a finding, not as a silence.
+- **Credentials come from Secrets Manager, never from a vars file.** A literal
+  password, token, or key in a `.vars.yaml` or a task-definition template is
+  the same defect as one in `.tf`, and the state and template files are as
+  readable as the code.
+
+Do not restate the mitigation here. The abuse case, the required controls, and
+the negative test for each of the four live in the `infrastructure` surface
+class of [`threat-modeling`](../threat-modeling/SKILL.md)'s corpus, which is
+their single authority. Ask that skill's grounded-corpus step for the
+`infrastructure` surface class - it carries the invocation - describing the
+change, e.g. *iam role with a wildcard action*.
+
+Those rows carry a `Decided by:` clause naming the check that actually decides
+each one. For the IAM, networking, storage, and encryption rows it reads NO
+CHECK IN THIS REPOSITORY; only the credential-in-a-file row names a real gate.
+Nothing here parses IAM policy documents or cloud config, so the discipline
+above is the enforcement, and saying otherwise would claim coverage this
+package does not have.
+
+See also the `terraform` skill's *Permissive defaults and missing security
+blocks* section for the backstop greps over a `.tf` tree.
+
 ## Output format
 
 1. Modified infrastructure config/template files

package/dist/agent-src/skills/code-intelligence/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: code-intelligence
-description: "Route codebase-structure questions (who calls X, where used, what imports, change-impact) to a code-graph first, grep fallback. Triggers 'who calls', 'where is this used', 'call graph'."
+description: "Route codebase-structure questions (who calls X, where is this used, what imports, change-impact) to an existing code-graph first: cheaper, never more precise; grep stays routine. Also 'call graph'."
 domain: engineering
 workspaces:
   - engineering
@@ -14,11 +14,14 @@ requires_skills:
 # code-intelligence
 
 > For a **structure** question — *who calls X*, *where is Y used*, *what
-> imports Z*, *what breaks if I change this symbol* — a code-graph answers far
-> more precisely than a blind `grep`, at a fraction of the tokens. This skill
-> routes such questions to the native code-graph engine (ADR-124, Class A) or a
-> consumer-shipped index first, and falls back to grep **with a stated reason**
-> when the graph cannot answer. It is the executable side of
+> imports Z*, *what breaks if I change this symbol* — ask an index that already
+> exists before rebuilding the relationship by hand: it is already built, its
+> answer is structured, and it costs a fraction of the tokens. It is **not** more
+> precise than a blind `grep` — measured on this repository's own source, zero
+> classes met the win bar (§ Measured twice) — so grep is the arm you fall back
+> to routinely and **with a stated reason**, not grudgingly. This skill routes
+> such questions to the native code-graph engine (ADR-124, Class A) or a
+> consumer-shipped index first. It is the executable side of
 > [`external-code-graph-interop`](../../rules/external-code-graph-interop.md):
 > *orchestrator first, owner where it wins*.
 
@@ -50,9 +53,15 @@ code-graph and no appetite to build one — plain `grep`/read is right there.
    - `agent-config code-graph path <a> <b>` — how two symbols connect.
    - `agent-config code-graph explain <symbol>` — 2-hop neighbourhood.
    Pass `--budget <tokens>` to cap output.
-4. **Read the confidence.** `EXTRACTED` = syntactic fact; `INFERRED` =
-   hierarchy-resolved; `AMBIGUOUS` = dynamic dispatch / facade, carries
+4. **Read the confidence.** `EXTRACTED` = syntactic fact — a symbol declared in
+   the file, or a name bound to the module specifier the file names; `INFERRED`
+   = resolved by hierarchy, or by a repo-wide same-name lookup with no binding
+   in the file to justify it; `AMBIGUOUS` = dynamic dispatch / facade, carries
    candidates — treat its target as *one of* the candidates, never as certain.
+   Two target shapes are **not nodes** and resolve to nothing you can read:
+   `symbol:<name>` (a name this repository does not declare) and
+   `external:<module>` / `external:<module>#<name>` (a name imported from
+   outside the indexed root — `external:node:path`).
 5. **Fall back honestly.** If the graph has no entry for the symbol, grep — and
    say so: *"the graph has no entry for X, so I grepped."* If this command is
    not available, grep and say so.
@@ -72,10 +81,22 @@ Every answer built with this skill MUST:
 - **A stale graph lies confidently.** If `detect` reports the index is N commits
   behind, rebuild (`agent-config code-graph build --update`) before trusting
   relationship answers, or say the answer is from a stale index.
-- **Dynamic dispatch is honestly ambiguous.** On a Laravel/JS codebase most
-  method-call edges are `AMBIGUOUS` (facades, injected services, `$obj->m()`).
-  That is the engine being honest, not broken — do not "resolve" them yourself
-  by guessing.
+- **Dynamic dispatch is honestly ambiguous — where there is anything to be
+  ambiguous ABOUT.** A `$obj->m()` whose name matches a method declared
+  somewhere in the repo is `AMBIGUOUS` and carries those candidates: the engine
+  being honest, not broken — do not "resolve" them yourself by guessing. A
+  dynamic call whose name matches **no** in-repo method (`xs.push()`,
+  `map.get()`) is not emitted at all, and the count is published as
+  `suppressed_edge_counts.dynamic_no_candidate`. It used to be 39 % of this
+  engine's own graph, pointing at `symbol:push`, which is not a node and which
+  no query verb could reach.
+- **The AMBIGUOUS share is a property of the code, not a constant.** Measured
+  2026-09-04 over the three roots the v2 benchmark uses: `AMBIGUOUS` is 0 of 495
+  edges under the package's own graph-engine root, 0 of 181 under `src/shared`, and 121 of
+  4,002 (3.0 %) under its council root — class-free TypeScript has
+  almost no in-repo method to be ambiguous between. A Laravel codebase, where
+  facades and injected services dispatch onto real in-repo methods, is the
+  opposite case. Read the counts in the graph rather than a remembered ratio.
 
 ## Measured twice, and it has not won (v2, 2026-08-29)
 
@@ -113,6 +134,33 @@ engine on this repository's own code. The rule now gives the reasons that surviv
 measurement — an index that exists is already built and structured, so it is the
 cheap first question — and drops the precision claim its own benchmark refuted.
 
+## Re-run after the extractor repair (2026-09-04) — still no class won
+
+`internal/bench/reports/code-graph-vs-grep-inrepo-v2-rerun-2026-09-04.md`. The
+SAME registration, the same corpus SHA, the same per-class bars and the same
+arm-B verbs, re-run after the import-binding repair. The 2026-08-29 report is
+untouched; this is a second report beside it, which is how v1 was handled too.
+
+| Class | graph R then | graph R now | graph P then | graph P now | verdict then → now |
+|---|---|---|---|---|---|
+| `callers` | 1.000 | 1.000 | 0.667 | 0.667 | TIE → TIE |
+| `transitive-impact` | 0.500 | **0.611** | 0.667 | **1.000** | **NULL → TIE** |
+| `path-between` | 1.000 | 1.000 | 1.000 | 1.000 | TIE → TIE |
+| `references` | 0.333 | **1.000** | 0.333 | **1.000** | **NULL → TIE** |
+
+**Zero classes met the win bar, again.** Two NULLs became TIEs and nothing
+regressed, so the routing verdict below is unchanged — a TIE is not a win, and
+no bar was renegotiated after the repair.
+
+Read with two caveats the report states in full. A measured root is live source:
+`src/shared` is byte-identical between the runs, the council root moved
+by 27 files on `main` in between, and the graph-engine root IS the engine, so
+its content necessarily moves whenever the engine does — which is also why the
+GREP arm's macro precision moved (0.806 → 0.764) in a run that changed nothing
+about grep. Both classes that changed verdict did so on rows whose root did not
+drift: `references` moved on the graph-engine and shared roots, `transitive-impact` on
+`shared` alone.
+
 **No class is graph-first.** Query the index first because an index that already
 exists is cheap to ask and its answer is structured — not because it answers
 better. When it returns nothing, that is the common case, and grep remains the

package/dist/agent-src/skills/complexity-first-planning/SKILL.md

@@ -62,6 +62,33 @@ unknown to resolve), or when the user has already fixed the sequence.
 A short ordered plan that leads with the load-bearing unknown + how it will be
 proven, then the dependent steps. One recommendation, not a survey.
 
+## The four plan criteria — what a reviewer fails the ordered plan on
+
+Risk-first ordering is one of four things a plan is judged on. All four are
+stated so a reviewer can **fail** a plan on them — each names what failing looks
+like. This skill owns the third; the other three are stated here because a plan
+reviewed on ordering alone passes while being unnecessary, insufficient, or
+built on verbs that do not exist. The same four are carried in
+`feature-planning` (pack `product-basic`), which is pruned under `projection.mode: scoped` and so is named rather than linked.
+
+1. **Necessity** — every step traces to a stated problem or acceptance criterion.
+   **Fails when** the plan carries work nothing asked for — a spike for an
+   unknown that is not load-bearing is the version of this failure this skill
+   causes.
+2. **Sufficiency** — every requirement is discharged by at least one step.
+   **Fails when** a requirement owns no step, or its only step has no verifiable
+   outcome. Walk the requirements, not the steps.
+3. **Ordering** — the load-bearing unknown is resolved before anything that
+   assumes it, and no step consumes what a later step creates. **Fails when** the
+   plan front-loads the easy parts, or ranks by effort instead of dependency
+   blast radius (see Gotchas). This is the criterion this skill exists for.
+4. **Groundedness** — every command, skill and tool the plan tells someone to run
+   exists. **Fails when** the plan names a verb that is not in the index. Check
+   it against [`CAPABILITIES.yaml`](../../../CAPABILITIES.yaml) at the repository
+   root — the generated capability index of every shipped skill and command —
+   plus the project's own script/task entry points. It is the only one of the
+   four decidable without judgement, so it is never waved through.
+
 ## Do NOT
 
 - Build the easy parts first to show progress, then discover the hard part breaks them.