@event4u/agent-config 14.17.0 → 14.19.0

package/src/scripts/adr_cite_check.ts

@@ -25,7 +25,7 @@
  *     (measured: ADR-035 still asserts a rejection ADR-232 reopened).
  *   - **review_trigger** — verbatim, plus a state.
  *
- * `indeterminate` is a FIRST-CLASS trigger result, not a failure. Every
+ * `indeterminate` is a FIRST-CLASS trigger result, not a failure. Almost every
  * `review_trigger` in the corpus is a semantic condition ("reopen when the
  * capacity premise changes", "if a fifth band appears"), so forcing them to a
  * boolean would convert uncertainty into either permission or blockage. Both
@@ -33,6 +33,29 @@
  * trigger grammar as a prerequisite for exactly this reason. An `indeterminate`
  * result means: this may not be presented as an unqualified lock — route it.
  *
+ * THE DATED SUB-CLASS, AND WHY THE 2026-08-19 REJECTION DOES NOT REACH IT
+ * ----------------------------------------------------------------------
+ * The sentence above used to open "Every `review_trigger` in the corpus is a
+ * semantic condition"; it is weakened rather than deleted because the claim was
+ * true when written and one record has since falsified it.
+ *
+ * What those two seats rejected was forcing SEMANTIC conditions to a boolean.
+ * A trigger that OPENS with a calendar date is not one: `fired` / `not-fired`
+ * is decided by comparing that date to `asOf()`, which is arithmetic and
+ * carries no interpretation of the tree, so a second reader of the same commit
+ * gets the same answer. That is the entire carve-out — a leading
+ * `Expiry YYYY-MM-DD`, or a bare leading ISO date, and nothing else. A
+ * condition that merely MENTIONS a date somewhere in its prose ("revisit at the
+ * 2026-11-10 review date, or earlier on either observable event") is a semantic
+ * condition and stays `indeterminate`, which is what keeps this from being the
+ * rejected grammar by increments.
+ *
+ * `dated-unparsed` exists so the carve-out cannot fail silently. A trigger that
+ * announces itself as dated and whose date this parser cannot read is a defect
+ * in the record or in the parser; returning `indeterminate` for it would hide
+ * that defect behind the exact state every trigger had before the carve-out
+ * existed, where no test could ever see it as a regression.
+ *
  * It also prints the two descriptive axes (`provenance`, `evidence`) and
  * `authority_basis`, and for an accepted E0/E1 record that does NOT carry
  * `authority_basis: owner_intent` it prints
@@ -73,12 +96,16 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import {
     type AdrFrontmatter,
     authorityBasisOf,
+    dated_trigger_day,
+    DATED_TRIGGER_PROBE,
+    iso_day,
     evidenceOf,
     isLowEvidenceAccepted,
     provenanceOf,
     readAdrFrontmatter,
     readAdrFrontmatterScalars,
 } from './_lib/adr_frontmatter.js';
+import { asOf } from './_lib/as_of.js';
 import { GateLedger } from './_lib/gate_ledger.js';
 import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
 import { DeadScopeError, reportScanned } from './_lib/scan_scope.js';
@@ -149,8 +176,12 @@ export const SURFACES_NOT_SCANNED = [
  */
 export const PARTIAL_COVERAGE: readonly string[] = [];
 
-/** A trigger state. `none` means the ADR never recorded a reopen condition. */
-export type TriggerState = 'none' | 'indeterminate' | 'fired' | 'not-fired';
+/**
+ * A trigger state. `none` means the ADR never recorded a reopen condition;
+ * `dated-unparsed` means it recorded one that announces a date this parser
+ * could not read, which is a defect and not an answer.
+ */
+export type TriggerState = 'none' | 'indeterminate' | 'fired' | 'not-fired' | 'dated-unparsed';
 
 export interface CiteResult {
     ref: string;
@@ -469,12 +500,21 @@ export function amendment_blocks(body: string): string[] {
 /**
  * A trigger's state, from what is mechanically decidable and nothing else.
  *
- * There is no clause that returns `fired` or `not-fired` from prose, and that
- * absence is the design: every trigger in the corpus is semantic. The states
- * exist in the type because a future structured trigger can carry them; today
- * the honest answers are `none` and `indeterminate`.
+ * Two clauses return a decided answer, and both read a leading calendar date
+ * and nothing else — see `DATED_TRIGGER_RE` for why the anchor is the safety
+ * property. Every semantic trigger still returns `indeterminate`, which is a
+ * first-class result here and not a failure.
+ *
+ * The clock is read ONLY when a dated trigger is actually present — `asOf()`
+ * warns on stderr for an unpinned run, and a corpus with no dated trigger has
+ * no verdict that depends on the hour, so announcing one there would be noise
+ * on a stream other tools read beside the payload.
+ *
+ * @param asOfDate the "now" to compare against; defaults to the `asOf()` seam,
+ *                 so a CI run compares against the commit date and is
+ *                 reproducible from the commit alone.
  */
-export function trigger_state(fm: Record<string, string>): TriggerState {
+export function trigger_state(fm: Record<string, string>, asOfDate?: Date): TriggerState {
     const t = (fm['review_trigger'] ?? '').trim();
     if (t === '') return 'none';
     // The transitional migration value records that no condition has been
@@ -485,6 +525,9 @@ export function trigger_state(fm: Record<string, string>): TriggerState {
     // nobody has evaluated. Found in completion review; the field did not
     // exist in this file's corpus when the mapping was written.
     if (t.toLowerCase() === 'unclassified') return 'none';
+    const day = dated_trigger_day(t);
+    if (day !== null) return iso_day(asOfDate ?? asOf()) >= day ? 'fired' : 'not-fired';
+    if (DATED_TRIGGER_PROBE.test(t)) return 'dated-unparsed';
     return 'indeterminate';
 }
 
@@ -530,6 +573,15 @@ export function verdict_for(r: Omit<CiteResult, 'verdict'>): string {
     if (r.trigger_state === 'none') {
         return 'LIVE, NO REOPEN CONDITION — the ADR records no `review_trigger`, so nothing would ever reopen it on its own. Treat that as a defect in the ADR, not as strength of the lock.';
     }
+    if (r.trigger_state === 'fired') {
+        return 'LIVE, TRIGGER FIRED — the reopen condition is a date and that date has passed. The record still binds until someone acts on it, and citing it without naming the fired trigger presents a lapsed review as a current one.';
+    }
+    if (r.trigger_state === 'not-fired') {
+        return 'LIVE, TRIGGER NOT YET FIRED — the reopen condition is a date still in the future. This is the one state in which a trigger genuinely adds nothing to the citation, and it stops being true on a known day.';
+    }
+    if (r.trigger_state === 'dated-unparsed') {
+        return 'LIVE, DATED TRIGGER UNREADABLE — the reopen condition announces a date this tool could not parse. That is a defect in the record or in the parser, not a verdict: fix the trigger to open with `Expiry YYYY-MM-DD` rather than reading this as "unknown".';
+    }
     return 'LIVE, TRIGGER INDETERMINATE — the reopen condition is semantic and this tool cannot decide it. Not an unqualified lock: evaluate the condition against the current tree and route the result.';
 }
 
@@ -823,21 +875,25 @@ export interface CorpusRow {
     /** Does the record carry a `review_trigger` at all? */
     has_trigger: boolean;
     /** Only meaningful when `has_trigger`; see `TRIGGER_VERDICTS`. */
-    trigger: 'fired' | 'not-fired' | 'indeterminate' | 'none';
+    trigger: TriggerState;
     reopen_policy: string;
     /** Cited anywhere OUTSIDE `docs/decisions/`. */
     cited_outside: boolean;
 }
 
 /**
- * The three states 2.2 requires, and why a fourth exists beside them.
+ * The states a record CARRYING a trigger can be in, and why `none` is not one.
+ *
+ * `none` is outside the denominator, not a bucket inside it: the survey asks
+ * that these sum to "the number of ADRs carrying a trigger", and a record with
+ * no trigger carries none.
  *
- * `none` is NOT one of the three. The step asks that fired + not-fired +
- * indeterminate sum to "the number of ADRs carrying a trigger", so a record
- * with no trigger is outside the denominator rather than a fourth bucket
- * inside it.
+ * `dated-unparsed` was added with the dated sub-class and belongs in the sum
+ * for the same reason `none` does not — a record in that state DOES carry a
+ * trigger. Leaving it out would have made the sum line report a mismatch, i.e.
+ * announced a defect in the survey where the defect is in the ADR.
  */
-export const TRIGGER_VERDICTS = ['fired', 'not-fired', 'indeterminate'] as const;
+export const TRIGGER_VERDICTS = ['fired', 'not-fired', 'indeterminate', 'dated-unparsed'] as const;
 
 /** Every ADR file, surveyed. */
 export function corpus_survey(repo_root: string = REPO_ROOT): CorpusRow[] {

package/src/scripts/ai_council/clients.ts

@@ -1,7 +1,7 @@
 // External-AI clients for the council — ported from the retired Python
 // `src/scripts/ai_council/clients.py` (ADR-200).
 //
-// Mirrors the contract from `scripts/skill_trigger_eval.py`:
+// Mirrors the contract from `src/scripts/skill_trigger_eval.ts`:
 // - Tokens come exclusively from `~/.event4u/agent-config/<provider>.key`
 //   (legacy `~/.config/agent-config/<provider>.key` is read as a fallback so
 //   pre-2.4 installs keep working until the user moves the files into the new

package/src/scripts/autonomy_friction_corpus.ts

@@ -0,0 +1,229 @@
+/**
+ * autonomy_friction_corpus — how many host confirmations each payload class
+ * costs, measured through the real dispatcher.
+ *
+ * WHY A CONFIRMATION COUNT AND NOT A GATE COUNT. "Three gates fire" says
+ * nothing about what the operator experiences; "this call costs one
+ * confirmation" is the quantity the round is about. A corpus counting gates
+ * would go green on a change that fired fewer gates and prompted just as often.
+ *
+ * WHAT IT MEASURES, STATED NARROWLY. The number of confirmations THIS PACKAGE
+ * leaves on the table for a call — 0 when the dispatcher hands the host an
+ * explicit `permissionDecision: allow`, 1 when it emits no permission field and
+ * the host's own machinery decides. It is NOT a measurement of what the host
+ * finally does: a consumer whose settings already allow the call is not
+ * prompted either way, and a confined session ignores our allow entirely
+ * (`permissionDecision=allow ignored: a confined session takes grants only
+ * from its command line`). Reading this as a host-behaviour measurement is the
+ * fact-about-our-plumbing-written-as-a-fact-about-the-host collapse the hook
+ * contract warns about three times.
+ *
+ * A REFUSAL IS NOT A CONFIRMATION. A case the dispatcher blocks (exit 2) is
+ * reported as `refused` and scores no confirmations — counting a refusal as
+ * friction would reward removing a gate, which is the opposite of the point.
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/autonomy_friction_corpus [--json]
+ *   ./agent-config …  (no verb — this is a package-internal measurement)
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, "..", "..");
+const ENTRY = path.join(REPO_ROOT, "src", "scripts", "hooks", "dispatch_entry.ts");
+const TSX_BIN = path.join(
+    REPO_ROOT,
+    "node_modules",
+    ".bin",
+    process.platform === "win32" ? "tsx.cmd" : "tsx",
+);
+
+/** One payload class, with the confirmations it is expected to cost. */
+export interface FrictionCase {
+    id: string;
+    /** The class the owner named, in their words. */
+    klass: string;
+    tool: string;
+    input: Record<string, unknown>;
+    /** Confirmations this call SHOULD cost. */
+    expected: number;
+    /** Why that number, in one line. */
+    because: string;
+}
+
+/** One measured result. */
+export interface FrictionResult extends FrictionCase {
+    observed: number;
+    refused: boolean;
+    pass: boolean;
+}
+
+/**
+ * The six classes the round named, plus the directory-flag form.
+ *
+ * The seventh is not padding: cases 1 and 2 are the shape the canon stopped
+ * teaching, and without the shape that replaced them the corpus would record
+ * the cost and not the fix.
+ */
+export const CASES: readonly FrictionCase[] = [
+    {
+        id: "directory-change",
+        klass: "directory change",
+        tool: "Bash",
+        input: { command: "cd sub" },
+        expected: 1,
+        because:
+            "a bare `cd` is not category A — the canon's answer is a directory flag, " +
+            "not an allow for changing directory",
+    },
+    {
+        id: "directory-change-compounded",
+        klass: "directory change compounded with a status read",
+        tool: "Bash",
+        input: { command: "cd sub && git status" },
+        expected: 1,
+        because:
+            "a compound command is refused before its argv is read — a safe head " +
+            "token must not be able to carry a second command",
+    },
+    {
+        id: "directory-flag-status",
+        klass: "the directory-flag form of the case above",
+        tool: "Bash",
+        input: { command: "git -C sub status" },
+        expected: 0,
+        because: "one simple command, a read-only git subcommand, inside the working tree",
+    },
+    {
+        id: "test-runner-in-subdirectory",
+        klass: "a test runner invoked from a subdirectory",
+        tool: "Bash",
+        input: { command: "vitest run sub" },
+        expected: 0,
+        because: "a test runner admitted by name — the name IS the operation",
+    },
+    {
+        id: "workspace-package-manager",
+        klass: "a workspace package manager",
+        tool: "Bash",
+        input: { command: "npm run test" },
+        expected: 0,
+        because: "a declared subcommand with a declared script name",
+    },
+    {
+        id: "consequence-authorized",
+        klass: "a consequence operation with the authorizing phrase present",
+        tool: "Bash",
+        input: { command: "terraform apply" },
+        expected: 1,
+        because:
+            "the phrase changes the RECORD, never the prompt — after ADR-254 the " +
+            "Hard Floor is model-held and this package grants nothing",
+    },
+    {
+        id: "consequence-unauthorized",
+        klass: "the same operation with the authorizing phrase absent",
+        tool: "Bash",
+        input: { command: "terraform apply" },
+        expected: 1,
+        because:
+            "identical to the case above BY DESIGN — that the two are the same " +
+            "number is the finding, not a defect in the corpus",
+    },
+];
+
+/** Run one case through the real dispatcher and count its confirmations. */
+export function measure(c: FrictionCase, workspace: string): FrictionResult {
+    const payload = JSON.stringify({
+        session_id: "autonomy-friction-corpus",
+        cwd: workspace,
+        hook_event_name: "PreToolUse",
+        tool_name: c.tool,
+        tool_input: c.input,
+    });
+    const r = spawnSync(
+        TSX_BIN,
+        [ENTRY, "--platform", "claude", "--event", "pre_tool_use", "--project-dir", workspace],
+        {
+            encoding: "utf-8",
+            cwd: workspace,
+            input: payload,
+            timeout: 120_000,
+            env: { ...process.env, AGENT_CONFIG_PACKAGE_ROOT: REPO_ROOT },
+        },
+    );
+    const refused = r.status === 2;
+    const allowed = !refused && (r.stdout ?? "").includes('"permissionDecision":"allow"');
+    const observed = refused || allowed ? 0 : 1;
+    return { ...c, observed, refused, pass: refused || observed === c.expected };
+}
+
+export function runCorpus(): FrictionResult[] {
+    const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "ac-friction-"));
+    fs.mkdirSync(path.join(workspace, "sub"), { recursive: true });
+    try {
+        return CASES.map((c) => measure(c, workspace));
+    } finally {
+        fs.rmSync(workspace, { recursive: true, force: true });
+    }
+}
+
+export function render(results: readonly FrictionResult[]): string {
+    const out: string[] = [];
+    out.push("autonomy_friction_corpus — confirmations per payload class");
+    out.push("");
+    out.push("  measured through the real dispatcher; a confirmation is one this");
+    out.push("  package leaves to the host, NOT one the host necessarily shows.");
+    out.push("");
+    for (const r of results) {
+        const mark = r.pass ? "✅" : "❌";
+        const obs = r.refused ? "refused" : String(r.observed);
+        out.push(`  ${mark} ${r.id.padEnd(30)} expected ${r.expected}  observed ${obs}`);
+        out.push(`       ${r.klass}`);
+        out.push(`       ${r.because}`);
+    }
+    const failures = results.filter((r) => !r.pass);
+    out.push("");
+    out.push(
+        failures.length === 0
+            ? `  ${results.length} case(s), every observation matches its expectation`
+            : `  ${failures.length} of ${results.length} case(s) miss their expectation: ` +
+              failures.map((f) => f.id).join(", "),
+    );
+    return out.join("\n") + "\n";
+}
+
+export function main(argv: string[] = process.argv.slice(2)): number {
+    const json = argv.includes("--json");
+    if (argv.includes("--help") || argv.includes("-h")) {
+        process.stdout.write(
+            "usage: autonomy_friction_corpus [--json]\n" +
+                "  Reports the confirmations each payload class costs, measured\n" +
+                "  through the real dispatcher. Exit 1 when an observation misses\n" +
+                "  its expectation.\n",
+        );
+        return 0;
+    }
+    const results = runCorpus();
+    process.stdout.write(json ? `${JSON.stringify(results, null, 2)}\n` : render(results));
+    return results.every((r) => r.pass) ? 0 : 1;
+}
+
+function _isCliEntry(): boolean {
+    const argv1 = process.argv[1];
+    if (argv1 === undefined) return false;
+    try {
+        return fs.realpathSync(argv1) === fs.realpathSync(fileURLToPath(import.meta.url));
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry()) {
+    process.exit(main());
+}

package/src/scripts/build_proof.ts

@@ -413,10 +413,20 @@ function render(): string {
     {
         const rows = collectEnforcement();
         const s = summariseEnforcement(rows);
+        // The split ships WITH the figure, and the word `yet` travels only with
+        // the half it is true of. `kernel_denied` rules cannot carry an
+        // `enforced_by` field at all — `block_kernel_rule_writes` refuses the
+        // write with no agent-accessible override — so publishing them as "not
+        // declared yet" promises a future that does not exist for them. They
+        // still count as uncovered — the counting policy is unchanged; only the
+        // claim about their future is.
         L.push(
             `**Axis 1 — enforcement level per rule.** ${s.total} rules · ` +
                 `${s.blocking} blocking (${s.blocking_pct}%) · ${s.observer} observer · ` +
-                `${s.local_only} local-only · ${s.undeclared} undeclared (no \`enforced_by\` yet).`,
+                `${s.local_only} local-only · ${s.undeclared} undeclared — of which ` +
+                `${s.kernel_denied} kernel-denied (\`block_kernel_rule_writes\` refuses an ` +
+                `\`enforced_by\` write on a kernel rule, so no declaration is reachable ` +
+                `for them at all) and ${s.undeclared - s.kernel_denied} not declared yet.`,
         );
         L.push('');
         // The denominator, WITH the frame that produced it. Until 2026-08-23 the
@@ -436,7 +446,10 @@ function render(): string {
             L.push(`| \`${r.id}\` | ${r.effective} | ${decl} |`);
         }
         L.push('');
-        L.push(`Undeclared rules (${s.undeclared}) carry no row — an honest gap beats a false claim.`);
+        L.push(
+            `Undeclared rules (${s.undeclared}, of which ${s.kernel_denied} kernel-denied) ` +
+                'carry no row — an honest gap beats a false claim.',
+        );
     }
     L.push('');
     {