@event4u/agent-config 14.16.0 → 14.18.0

package/dist/agent-src/skills/testing-anti-patterns/SKILL.md

@@ -208,6 +208,46 @@ rg -n '\b(it|test|describe)\.skip\b|\.only\b|xit\(|xdescribe\(|@pytest\.mark\.(s
 
 This is the test-surface instance of the `autonomous-execution` N=3 / allowlist-growth antipattern (bulk `skip`/`xfail` to force green counts as the tool being wrong, not the content) and the `verify-before-complete` floor (green must be *earned*, not manufactured).
 
+### The named smells — canonical vocabulary, and what it does NOT cover
+
+The behaviors above are described; two of them also have field names a
+reviewer can cite, and this table is where the name meets the behavior. The
+grep column follows the shape [`ai-code-blindspots`](../ai-code-blindspots/SKILL.md)
+uses: an authoring-time backstop, zero results is the pass, a hit is a prompt
+to read that line — never an auto-fix.
+
+| Canonical name | The behavior, as already described above | Backstop grep |
+|---|---|---|
+| **Magic-number test** | Anti-Pattern 6 — "a hardcoded expected value the code will always emit". The expectation is a literal rather than something derived from the input, so the test cannot disagree with the code. | `rg -n '\b(toBe\|toEqual\|assertEquals\|assertSame)\(\s*-?[0-9]{2,}' tests/` |
+| **Assertion roulette** | The multi-case stack Anti-Pattern 6 *requires* (boundary, error, abuse in one test), written without per-assertion messages — so a failure names a line number and not a reason. The stack is right; the silence is the smell. | `rg -c '\b(expect\|assert\w*\|self\.assert\w*\|\$this->assert\w*)\(' tests/ \| awk -F: '$2 >= 8'` |
+
+Both greps are scoped to **the test file you just wrote**, not to a tree —
+`tests/` above is a placeholder for that path. Run over a whole repository
+they are useless as verdicts: measured on this repository on 2026-09-04 the
+first returns 585 lines and the second 1189 files, because an exact assertion
+against a two-digit literal and a file with eight assertions are both ordinary.
+They are authoring-time prompts to reread one file, exactly as
+`ai-code-blindspots` states, and neither is a gate.
+
+The second grep counts per **file**, not per test — no regex sees a test
+boundary.
+
+**Three further names are deliberately NOT in the table**, recorded here so a
+later round meets a record rather than a fresh argument. Measured 2026-09-04
+over both files of this skill: `roulette`, `eager`, `lazy` and `duplicate` each
+return **0** occurrences, and `hardcoded` returns **6**.
+
+- **Eager test** (one test exercising several behaviors) would carry the same
+  behavior and the same grep as assertion roulette above, and Anti-Pattern 6
+  *prescribes* the shape on purpose. A row for it would be one entry under two
+  names, which is the drift this table exists to prevent.
+- **Lazy test** (several tests over one fixture, differing only in name) is
+  described nowhere above. A row would be new guidance wearing a naming step's
+  clothes.
+- **Duplicate assert** (the same condition asserted twice in one test) is
+  likewise undescribed, and is not greppable without parsing test boundaries —
+  so it could not carry the backstop column even if it were.
+
 ## Output format
 
 1. The mocking decision recorded as a one-line comment in the test file (`// mock at <seam>: <reason>`).

package/dist/agent-src/skills/threat-modeling/data/reasoning.csv

@@ -8,3 +8,4 @@ public-endpoint,Rate limit + cache + minimal payload,"{""if_search_endpoint"": "
 billing,Ledger + idempotency + server-side amounts,"{""if_refunds"": ""one-way-state-machine"", ""if_webhooks_from_psp"": ""verify-signature-and-amount""}",Mutable balance column updates,CRITICAL
 secrets,Manager + redaction + scan,"{""if_third_party_keys"": ""scope-and-rotate-quarterly"", ""if_ci_pipeline"": ""masked-vars-only""}",Secrets in env committed to VCS,HIGH
 data-exposure,Allowlist serializers + contract tests,"{""if_admin_fields"": ""separate-serializer"", ""if_logs_contain_payloads"": ""logger-redaction-keys""}",Spreading model attributes into responses,MEDIUM
+infrastructure,Deny-by-default ingress + encryption on + scoped IAM,"{""if_management_or_db_port"": ""no-internet-cidr-use-bastion-or-private-link"", ""if_object_storage"": ""block-public-access-at-account-and-bucket"", ""if_iam_policy"": ""enumerate-actions-and-resource-arns""}",Permissive defaults left in place because the resource works either way,HIGH

package/dist/agent-src/skills/threat-modeling/data/surfaces.csv

@@ -8,3 +8,4 @@ Public unauthenticated endpoint,public endpoint health status unauthenticated an
 Billing / payment / balance mutation,billing payment charge refund invoice subscription balance credit,billing,money movement,Anything that changes an amount owed/paid
 Secrets / key handling,secret api-key signing key env vault kms rotation,secrets,credentials,"Storage, rotation, and logging paths"
 Data export / serializer / log channel,export serializer api-resource log audit csv download report,data-exposure,"PII, internal fields",Response shaping and log sinks
+Infrastructure / IaC resource definition,terraform iac infrastructure provisioning security group ingress egress cidr bucket storage iam role subnet vpc encryption,infrastructure,"network reachability, data at rest, cloud credentials",Any IaC change to networking storage IAM or encryption defaults

package/dist/agent-src/skills/threat-modeling/data/threats.csv

@@ -14,3 +14,8 @@ billing,Race condition on balance / double-spend,CWE-362,Parallel requests redee
 billing,Price/amount tampering,CWE-602,Client-supplied price or currency trusted at checkout,Recompute amounts server-side from catalog; signed cart or server-held cart only,Test: tampered client amount → server total unchanged,CRITICAL
 secrets,Secret leakage via logs / errors / VCS,"CWE-532, ATT&CK T1552","Key appears in exception payload, debug log, or committed .env",Centralized secret manager; logger redaction list; pre-commit secret scan; scoped short-lived tokens,Test: forced exception on auth path → no credential substring in log sink,HIGH
 data-exposure,Over-broad serializer / API resource,"CWE-213, OWASP API3","Serializer returns internal fields (cost, flags, foreign tenant refs) the UI ignores but attackers read",Explicit field allowlist per resource; separate admin vs public serializers; contract test on response shape,Test: schema-diff response against documented contract → no undocumented fields,MEDIUM
+infrastructure,Unrestricted ingress to a management or database port,"CWE-1327, ATT&CK T1190",Attacker reaches SSH/RDP or a database engine straight from the internet because a security-group or firewall rule allows 0.0.0.0/0,"Deny-by-default ingress; management and database ports reachable only via bastion, VPN, or private link; CIDR scoped to known ranges; never 0.0.0.0/0 on 22/3389/3306/5432/6379/27017","Test: a rule with cidr_blocks 0.0.0.0/0 on a management or database port is rejected. Decided by: NO CHECK IN THIS REPOSITORY - nothing here parses HCL or cloud config; the deciding check is the consumer's own IaC policy scanner",CRITICAL
+infrastructure,Object storage public by default,"CWE-732, OWASP A05",Bucket or container created without a block-public-access setting so any object URL is world-readable,Block public access at account AND bucket level; explicit policy allowlist instead of a public ACL; serve objects via signed URLs or a CDN origin identity,"Test: storage created with no explicit public-access block is rejected; anonymous GET of a stored object returns 403. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner or a cloud posture tool",HIGH
+infrastructure,Missing encryption at rest or in transit,"CWE-311, CWE-319",Volume snapshot bucket or database instance created with no encryption block; endpoint accepts a plaintext connection,Encryption block mandatory on every storage and database resource; customer-managed key where the data class requires it; TLS-only bucket policy and listener; reject plaintext listeners,"Test: a storage or database resource with no encryption block is rejected; a plaintext connection to the endpoint is refused. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner",HIGH
+infrastructure,Wildcard IAM action or resource,"CWE-269, ATT&CK T1078.004",A role policy grants Action * or Resource * so one compromised workload credential reaches every service and object in the account,Enumerate actions and resource ARNs; one role per workload; permission boundary or service control policy on privileged roles; no wildcard outside a named reviewed exception,"Test: a policy document containing Action ""*"" or Resource ""*"" is rejected or carries a named exception. Decided by: NO CHECK IN THIS REPOSITORY - nothing here parses IAM policy documents; the deciding check is the consumer's own IaC policy scanner",CRITICAL
+infrastructure,Credential in an IaC or vars file instead of a secret manager,"CWE-798, ATT&CK T1552.001",Password token or key written as a literal into a .tf .tfvars or .yaml file and committed,Secret-manager reference or runtime-injected env var; never a literal in IaC or vars files; treat the state file as sensitive and store it encrypted with restricted access,"Test: a literal credential in a tracked IaC or vars file fails the build. Decided by: check_secret_leak (src/scripts/check_secret_leak.ts) inside THIS repository - it has no extension allowlist so .tf and .yaml are in scope; for a CONSUMER the deciding check is the gitleaks workflow the package ships as a template that the consumer must copy",HIGH

package/dist/agent-src/skills/using-git-worktrees/SKILL.md

@@ -109,6 +109,18 @@ Ask format:
 
 **Recommendation: 1 — `.worktrees/`** — project-local keeps the worktree next to the repo (easy cleanup), and the leading dot keeps it out of `ls`. Caveat: pick 3 if multiple repos must share a single worktree root.
 
+> **A worktree outside the repository root costs the persistent shell cwd.**
+> It sits outside the host's working-directory boundary, so a `cd` into it does
+> not survive the call — Claude Code appends `Shell cwd was reset to <root>` and
+> the next command runs in the main checkout. Every command then repeats its own
+> `cd`, and one that forgets edits the wrong tree silently. Measured 2026-09-05
+> on this repository: 2,128 transcript records carrying that line across 20
+> sessions, alongside 1,694 whose `cd` targeted a worktree placed beside the
+> repo. Choosing option 3 — or any path outside the root — means also declaring
+> the parent directory in the host's working-directory allowlist
+> (`permissions.additionalDirectories` on Claude Code). Options 1 and 2 are
+> inside the root and need nothing.
+
 ### 3. Verify ignore-safety (project-local only)
 
 ```bash

package/dist/agent-src/skills/verify-repair-loop/SKILL.md

@@ -94,9 +94,38 @@ Each iteration is agent turns, never executing control-flow code:
    * **Plateau** (last `plateau_window` scores within `tolerance`) → STOP; surface
      suspected flakiness or a stuck point. Do not thrash.
    * **`attempts == max_attempts`** → STOP, hand back the best envelope.
-4. **Numeric gate** — score `< threshold` and attempts remain → back to step 1
-   (attempts++). Score `≥ threshold`, no regression → **escalate** (step 4 of the
-   stage).
+4. **Tamper check (deterministic, loop-local)** — before the numeric gate is
+   allowed to say anything, run the detector over the diff this attempt
+   produced and over the recorded verdict:
+
+   ```bash
+   ./scripts-run src/scripts/detect_verification_tampering \
+       --diff <this attempt's diff> --message <this attempt's message> \
+       --verdict <the runner's recorded verdict>
+   ```
+
+   It is **fail-closed inside the loop**: outcome `violations` or
+   `stale_verdict` STOPS the loop and hands back with the finding's
+   `file:line`, whatever the score says. `clean` changes nothing — an
+   ordinary passing attempt is unaffected, because the detector reports only
+   on shapes the diff introduced.
+
+   The check answers exactly the gap the Iron Law names: `assertion-removed`,
+   `assertion-weakened`, `verification-skipped` (warn), `expectation-rewritten`,
+   `early-exit-injected`, `test-file-deleted`, `subject-mocked-away`, and
+   `stale_verdict` for a runner that finished before the last edit. A change
+   that legitimately deletes an obsolete test or relaxes an over-tight
+   assertion declares it in the attempt's message —
+   `tamper-allow: <detector-id> — <reason>` — scoped to one id, never to all.
+
+   It is **not** a CI gate and does not become one here. The tree's measured
+   lesson is that reach, not content, is the scarce thing; a new always-on
+   gate is the opposite of that lesson. Promotion owes a measured
+   false-positive rate first.
+
+5. **Numeric gate** — score `< threshold` and attempts remain → back to step 1
+   (attempts++). Score `≥ threshold`, no regression, tamper check clean →
+   **escalate** (step 4 of the stage).
 
 ### 4. Judge escalation (only after the numeric gate passes)
 
@@ -135,10 +164,13 @@ Before finalizing, confirm:
 
 1. The numeric gate **escalated to a judge** — it did not apply on its own.
 2. No baseline-green check regressed (or the loop stopped and said so).
-3. The loop stopped at `max_attempts`, a plateau, or a judge `apply` — never
+3. The tamper check ran on the final attempt and returned `clean` — or the loop
+   stopped on its finding. A green verdict recorded over a `violations` or
+   `stale_verdict` outcome is not a green verdict.
+4. The loop stopped at `max_attempts`, a plateau, or a judge `apply` — never
    ran unbounded.
-4. The judge saw only the diff + results, dispatched in fresh context.
-5. No **unsupervised** resident process introduced — and none of the four
+5. The judge saw only the diff + results, dispatched in fresh context.
+6. No **unsupervised** resident process introduced — and none of the four
    governance conditions in `resident-process-governance.md` left unmet if a
    supervised one is. (Amended 2026-08-27, ADR-249: this read "No daemon /
    persistent runtime introduced" when a daemon was prohibited outright. The
@@ -182,9 +214,15 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
 ## Gotcha
 
 * **Metric gaming** — the agent "passes" by deleting a failing test or
-  weakening an assertion. The numeric gate cannot catch this; the
-  fresh-context judge is the safeguard. If the diff *removes* checks,
+  weakening an assertion. The *numeric* gate still cannot catch this, and that
+  is why loop step 3.4 exists: `detect_verification_tampering` decides the
+  mechanical shapes deterministically, and the fresh-context judge remains the
+  safeguard for everything shape cannot decide. If the diff *removes* checks,
   that is a `reject`, not a `pass`.
+* **Phantom verification** — the loop records a green verdict it never re-ran,
+  so the exit code describes a tree that no longer exists. The verdict carries
+  the runner's own timestamp; one that predates the last edit is
+  `stale_verdict`, its own outcome, never a pass.
 * **Flake mistaken for a plateau** — a single non-deterministic test flips
   the score and the window-comparison reads it as "no improvement". Re-run
   the suspected check before declaring a plateau; surface flakiness instead
@@ -202,6 +240,9 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
 ## Do NOT
 
 * NEVER let the numeric score apply a change without judge confirmation.
+* NEVER record a green verdict over a tamper finding or a stale runner
+  timestamp — inside the loop the detector is fail-closed.
+* NEVER widen a `tamper-allow` declaration past the one id it names.
 * NEVER continue past a regression because the overall score improved.
 * NEVER run the live-app Playwright path here — it is deferred (needs a runtime).
 * NEVER judge with the generator's own context — dispatch a fresh-context judge.
@@ -215,6 +256,10 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
   review; wires this loop as an opt-in step.
 * [`playwright-testing`](../playwright-testing/SKILL.md),
   [`quality-tools`](../quality-tools/SKILL.md) — verdict sources.
+* `src/scripts/detect_verification_tampering.ts` — the loop-local tamper and
+  phantom-verification check bound at step 3.4, with its fixture corpus in
+  `tests/fixtures/tamper-corpus/` and its polarity proven both ways by
+  `--self-test`.
 * [`autonomous-execution`](../../rules/autonomous-execution.md) — the N=3 cap.
 * [`resident-process-governance`](../../../docs/contracts/resident-process-governance.md) — the
   runtime-free constraint this loop honors.

package/dist/agent-src/skills/worktree-lifecycle/SKILL.md

@@ -143,7 +143,9 @@ activity for 48 h. `review` keeps its disqualifying reason so the next sweep
 starts from a shorter list; `live` means another session may hold it. A
 worktree outside the conventional roots is never `safe` — sitting beside the
 repo it can be mistaken for a sibling package, so its removal stays a
-judgement call.
+judgement call. It is also the placement that loses the persistent shell
+cwd on a host with a working-directory boundary — see
+[`using-git-worktrees`](../using-git-worktrees/SKILL.md) § 2.
 
 The mode reports only. `--plan` prints `git worktree remove` plus
 `git branch -d` (never `-D`) for the safe set; **running it is a bulk deletion

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.16.0"
+agent_config_version: "14.18.0"
 
 # --- Project identity ---
 project: