@event4u/agent-config 14.17.0 → 14.19.0

package/dist/agent-src/skills/using-git-worktrees/SKILL.md

@@ -105,10 +105,24 @@ Ask format:
 
 > 1. `.worktrees/` — project-local, hidden
 > 2. `worktrees/` — project-local, visible
-> 3. `~/.event4u/agent-config/worktrees/<project>/` — global
+> 3. `~/.event4u/agent-config/worktrees/<project>/` — global, **outside the
+>    repository root**: costs the persistent shell cwd (see below) and requires
+>    declaring the parent in the host's working-directory allowlist
 
 **Recommendation: 1 — `.worktrees/`** — project-local keeps the worktree next to the repo (easy cleanup), and the leading dot keeps it out of `ls`. Caveat: pick 3 if multiple repos must share a single worktree root.
 
+> **A worktree outside the repository root costs the persistent shell cwd.**
+> It sits outside the host's working-directory boundary, so a `cd` into it does
+> not survive the call — Claude Code appends `Shell cwd was reset to <root>` and
+> the next command runs in the main checkout. Every command then repeats its own
+> `cd`, and one that forgets edits the wrong tree silently. Measured 2026-09-05
+> on this repository: 2,128 transcript records carrying that line across 20
+> sessions, alongside 1,694 whose `cd` targeted a worktree placed beside the
+> repo. Choosing option 3 — or any path outside the root — means also declaring
+> the parent directory in the host's working-directory allowlist
+> (`permissions.additionalDirectories` on Claude Code). Options 1 and 2 are
+> inside the root and need nothing.
+
 ### 3. Verify ignore-safety (project-local only)
 
 ```bash
@@ -123,9 +137,22 @@ passes. For the global location, skip — path is outside the repo.
 
 ```bash
 git worktree add .worktrees/<branch-name> -b <branch-name>
-cd .worktrees/<branch-name>
 ```
 
+**Then address the worktree by flag, not by `cd`.** Every tool that matters
+takes a directory flag, and the flag survives where a `cd` does not:
+
+```bash
+git -C .worktrees/<branch-name> status
+npm --prefix .worktrees/<branch-name> test
+composer -d .worktrees/<branch-name> install
+```
+
+A `cd X && …` compound re-enters the directory on every single call, and the
+one call that forgets it edits the main checkout silently — the failure is
+invisible because the command succeeds. Where a tool genuinely has no directory
+flag, use a subshell so the change cannot leak: `( cd <path> && <cmd> )`.
+
 Branch names must match the project convention — see
 `commit-conventions` rule.
 

package/dist/agent-src/skills/verify-repair-loop/SKILL.md

@@ -94,9 +94,38 @@ Each iteration is agent turns, never executing control-flow code:
    * **Plateau** (last `plateau_window` scores within `tolerance`) → STOP; surface
      suspected flakiness or a stuck point. Do not thrash.
    * **`attempts == max_attempts`** → STOP, hand back the best envelope.
-4. **Numeric gate** — score `< threshold` and attempts remain → back to step 1
-   (attempts++). Score `≥ threshold`, no regression → **escalate** (step 4 of the
-   stage).
+4. **Tamper check (deterministic, loop-local)** — before the numeric gate is
+   allowed to say anything, run the detector over the diff this attempt
+   produced and over the recorded verdict:
+
+   ```bash
+   ./scripts-run src/scripts/detect_verification_tampering \
+       --diff <this attempt's diff> --message <this attempt's message> \
+       --verdict <the runner's recorded verdict>
+   ```
+
+   It is **fail-closed inside the loop**: outcome `violations` or
+   `stale_verdict` STOPS the loop and hands back with the finding's
+   `file:line`, whatever the score says. `clean` changes nothing — an
+   ordinary passing attempt is unaffected, because the detector reports only
+   on shapes the diff introduced.
+
+   The check answers exactly the gap the Iron Law names: `assertion-removed`,
+   `assertion-weakened`, `verification-skipped` (warn), `expectation-rewritten`,
+   `early-exit-injected`, `test-file-deleted`, `subject-mocked-away`, and
+   `stale_verdict` for a runner that finished before the last edit. A change
+   that legitimately deletes an obsolete test or relaxes an over-tight
+   assertion declares it in the attempt's message —
+   `tamper-allow: <detector-id> — <reason>` — scoped to one id, never to all.
+
+   It is **not** a CI gate and does not become one here. The tree's measured
+   lesson is that reach, not content, is the scarce thing; a new always-on
+   gate is the opposite of that lesson. Promotion owes a measured
+   false-positive rate first.
+
+5. **Numeric gate** — score `< threshold` and attempts remain → back to step 1
+   (attempts++). Score `≥ threshold`, no regression, tamper check clean →
+   **escalate** (step 4 of the stage).
 
 ### 4. Judge escalation (only after the numeric gate passes)
 
@@ -135,10 +164,13 @@ Before finalizing, confirm:
 
 1. The numeric gate **escalated to a judge** — it did not apply on its own.
 2. No baseline-green check regressed (or the loop stopped and said so).
-3. The loop stopped at `max_attempts`, a plateau, or a judge `apply` — never
+3. The tamper check ran on the final attempt and returned `clean` — or the loop
+   stopped on its finding. A green verdict recorded over a `violations` or
+   `stale_verdict` outcome is not a green verdict.
+4. The loop stopped at `max_attempts`, a plateau, or a judge `apply` — never
    ran unbounded.
-4. The judge saw only the diff + results, dispatched in fresh context.
-5. No **unsupervised** resident process introduced — and none of the four
+5. The judge saw only the diff + results, dispatched in fresh context.
+6. No **unsupervised** resident process introduced — and none of the four
    governance conditions in `resident-process-governance.md` left unmet if a
    supervised one is. (Amended 2026-08-27, ADR-249: this read "No daemon /
    persistent runtime introduced" when a daemon was prohibited outright. The
@@ -182,9 +214,15 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
 ## Gotcha
 
 * **Metric gaming** — the agent "passes" by deleting a failing test or
-  weakening an assertion. The numeric gate cannot catch this; the
-  fresh-context judge is the safeguard. If the diff *removes* checks,
+  weakening an assertion. The *numeric* gate still cannot catch this, and that
+  is why loop step 3.4 exists: `detect_verification_tampering` decides the
+  mechanical shapes deterministically, and the fresh-context judge remains the
+  safeguard for everything shape cannot decide. If the diff *removes* checks,
   that is a `reject`, not a `pass`.
+* **Phantom verification** — the loop records a green verdict it never re-ran,
+  so the exit code describes a tree that no longer exists. The verdict carries
+  the runner's own timestamp; one that predates the last edit is
+  `stale_verdict`, its own outcome, never a pass.
 * **Flake mistaken for a plateau** — a single non-deterministic test flips
   the score and the window-comparison reads it as "no improvement". Re-run
   the suspected check before declaring a plateau; surface flakiness instead
@@ -202,6 +240,9 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
 ## Do NOT
 
 * NEVER let the numeric score apply a change without judge confirmation.
+* NEVER record a green verdict over a tamper finding or a stale runner
+  timestamp — inside the loop the detector is fail-closed.
+* NEVER widen a `tamper-allow` declaration past the one id it names.
 * NEVER continue past a regression because the overall score improved.
 * NEVER run the live-app Playwright path here — it is deferred (needs a runtime).
 * NEVER judge with the generator's own context — dispatch a fresh-context judge.
@@ -215,6 +256,10 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
   review; wires this loop as an opt-in step.
 * [`playwright-testing`](../playwright-testing/SKILL.md),
   [`quality-tools`](../quality-tools/SKILL.md) — verdict sources.
+* `src/scripts/detect_verification_tampering.ts` — the loop-local tamper and
+  phantom-verification check bound at step 3.4, with its fixture corpus in
+  `tests/fixtures/tamper-corpus/` and its polarity proven both ways by
+  `--self-test`.
 * [`autonomous-execution`](../../rules/autonomous-execution.md) — the N=3 cap.
 * [`resident-process-governance`](../../../docs/contracts/resident-process-governance.md) — the
   runtime-free constraint this loop honors.

package/dist/agent-src/skills/worktree-lifecycle/SKILL.md

@@ -143,7 +143,9 @@ activity for 48 h. `review` keeps its disqualifying reason so the next sweep
 starts from a shorter list; `live` means another session may hold it. A
 worktree outside the conventional roots is never `safe` — sitting beside the
 repo it can be mistaken for a sibling package, so its removal stays a
-judgement call.
+judgement call. It is also the placement that loses the persistent shell
+cwd on a host with a working-directory boundary — see
+[`using-git-worktrees`](../using-git-worktrees/SKILL.md) § 2.
 
 The mode reports only. `--plan` prints `git worktree remove` plus
 `git branch -d` (never `-D`) for the safe set; **running it is a bulk deletion

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.17.0"
+agent_config_version: "14.19.0"
 
 # --- Project identity ---
 project:

package/dist/cli/commands/recordTriggerEval.js

@@ -3,7 +3,7 @@
  *
  * Records a live trigger-eval result into a corpus manifest's `upstream`
  * block (the second half of the corpus-refresh DoD, ADR-061 §6). It does
- * NOT run the eval — `skill_trigger_eval.py`'s confirmation gate hard-aborts
+ * NOT run the eval — `skill_trigger_eval`'s confirmation gate hard-aborts
  * under automation by design, so the live run stays a human, interactive
  * step. This command is a *post-processor*: it reads the `EvalResult` JSON the
  * live run wrote (`--output`), enforces a precision/recall floor, and writes
@@ -36,7 +36,7 @@ import { logger } from '../log/logger.js';
 // Floors shared with the weekly canary rotation (ADR-118 §4) — values
 // unchanged, single source of truth.
 import { floor_for } from '../../scripts/_lib/trigger_eval_floors.js';
-/** Subset of `skill_trigger_eval.py`'s `EvalResult` we depend on. */
+/** Subset of `skill_trigger_eval`'s `EvalResult` we depend on. */
 const EvalResultSchema = z.object({
     skill: z.string().optional(),
     model: z.string().optional(),

package/dist/cli/main.js

@@ -83,7 +83,7 @@ async function main(rawArgv) {
     program
         .command('eval:record')
         .description('Record a live trigger-eval result into a corpus manifest (ADR-061 §6 refresh DoD)')
-        .requiredOption('--eval-json <path>', 'EvalResult JSON written by skill_trigger_eval.py --output')
+        .requiredOption('--eval-json <path>', 'EvalResult JSON written by skill_trigger_eval --output')
         .requiredOption('--manifest <path>', 'corpus manifest.json to patch')
         .option('--min-recall <n>', 'Recall floor override (per-skill default otherwise)', (v) => Number.parseFloat(v))
         .option('--min-precision <n>', 'Precision floor override (per-skill default otherwise)', (v) => Number.parseFloat(v))