@event4u/agent-config 14.18.0 → 14.19.0

package/src/scripts/_lib/adr_frontmatter.ts

@@ -483,3 +483,47 @@ export function readAdrAxisCells(text: string): AdrAxisCells {
                   : `${strength} (${discovery})`,
     };
 }
+
+/**
+ * The one shape this tool decides: a trigger whose condition IS a leading date.
+ *
+ * Deliberately anchored at the start of the string and deliberately narrow. The
+ * boundary is the whole safety property — the moment a trigger is matched on a
+ * date found anywhere in its prose, "reopens when N exceeds M" is one edit away
+ * and the machine-readable grammar two council seats rejected on 2026-08-19 has
+ * been built by increments.
+ */
+export const DATED_TRIGGER_RE = /^\s*(?:expir(?:y|es)\b\s*[:—-]?\s*)?(\d{4})-(\d{2})-(\d{2})(?!\d)/iu;
+
+/**
+ * A trigger that ANNOUNCES itself as dated, whether or not the date parses.
+ *
+ * The gap between this and `DATED_TRIGGER_RE` is the `dated-unparsed` state.
+ * Exactly one ADR in the corpus carries a dated expiry, so a parse tuned to its
+ * phrasing can fail on the second one — and the failure mode is silence,
+ * because the old answer for every trigger was `indeterminate`. This probe is
+ * what turns that silence into a reported defect.
+ */
+export const DATED_TRIGGER_PROBE = /^\s*(?:expir(?:y|es)\b|\d{4}-\d{1,2}-\d{1,2}\b)/iu;
+
+/** The UTC calendar day of an instant, as `YYYY-MM-DD`. */
+export function iso_day(d: Date): string {
+    return d.toISOString().slice(0, 10);
+}
+
+/**
+ * The calendar day a dated trigger names, or null when there is none to read.
+ *
+ * Round-tripping through `Date.UTC` rejects `2026-13-45`, which matches the
+ * shape and is not a date.
+ */
+export function dated_trigger_day(trigger: string): string | null {
+    const m = DATED_TRIGGER_RE.exec(trigger);
+    if (m === null) return null;
+    const [y, mo, d] = [Number(m[1]), Number(m[2]), Number(m[3])];
+    const at = new Date(Date.UTC(y, mo - 1, d));
+    if (at.getUTCFullYear() !== y || at.getUTCMonth() !== mo - 1 || at.getUTCDate() !== d) {
+        return null;
+    }
+    return iso_day(at);
+}

package/src/scripts/_lib/consequence_objects.ts

@@ -0,0 +1,152 @@
+/**
+ * consequence_objects — the consequence vocabulary's prose half.
+ *
+ * Two things live here: the phrase rows that recognise a consequence
+ * authorization, and the extraction of the OBJECT such an authorization names.
+ * An authorization for one table, one environment or one recipient class is not
+ * an authorization for another, and until this existed the ledger could express
+ * the difference for nothing but pull-request numbers.
+ *
+ * IT IS RECOGNITION AND EXTRACTION, NOT MATCHING. Nothing here decides
+ * anything; the one consumer that acts on the vocabulary is `conformance_scan`,
+ * which counts after the fact. Making the object a matching condition is the
+ * ledger item ADR-254 left to the owner.
+ *
+ * It sits beside `git_authorization_hook` rather than inside it because that
+ * file is against the per-file source-size budget, which charges every line
+ * above 1500. The split is along a real seam: the hook owns the machinery —
+ * sentence bounds, negation, fenced-paste handling — and this module owns the
+ * consequence vocabulary that machinery is applied to.
+ */
+import type { GitOp } from "../git_authorization_hook.js";
+
+/**
+ * Prose phrases, German and English, that authorize a consequence operation.
+ *
+ * Spliced into `PHRASES` at its definition, so every row inherits the
+ * interrogative filter, the clause-scoped negation check and the fenced-paste
+ * split rather than reimplementing them.
+ *
+ * Every row REQUIRES ITS OBJECT NOUN, and that is why the patterns are long. A
+ * bare verb cannot tell an authorization from a mention, and for this class the
+ * mention is the common case: "deploy" appears in a hundred sentences that
+ * authorize nothing, while "deploy nach production" appears only when someone
+ * means it.
+ *
+ * German verb endings are `(e|en)?` because the imperative drops its `-e`, and
+ * both word orders are covered — the house style stated above `PHRASES`. The
+ * leading boundary is an explicit character class rather than `\b`: JavaScript's
+ * `\b` is ASCII-only, so a word STARTING with an umlaut ("Ändere") has no
+ * boundary before it and the row silently never fires.
+ */
+export const CONSEQUENCE_PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
+  {
+    op: "prod-deploy",
+    re: /(?<![A-Za-z0-9_À-ɏ])(deploy(e|en|t|st)?|ausroll(e|en)?|ship(pe|pen)?|live\s*schalt(e|en)?|rollout)\b[^.\n]{0,30}\b(produktion|production|prod|live|prod-umgebung)\b|\b(produktion|production|prod|live)\b[^.\n]{0,30}\b(deploy(e|en)?|ausrollen|ausroll(e|en)?|live\s*schalten|rollout)\b/i,
+  },
+  {
+    op: "prod-data-destroy",
+    re: /(?<![A-Za-z0-9_À-ɏ])(l(ö|oe)sch(e|en)?|entfern(e|en)?|leer(e|en)?|verwerf(e|en)?|drop|truncate|delete|wipe|purge|zerst(ö|oe)r(e|en)?)\b[^.\n]{0,40}\b(tabelle|tabellen|datenbank|daten|bucket|collection|zeilen|rows|table|database|dataset)\b|\b(tabelle|tabellen|datenbank|daten|bucket|collection|table|database)\b[^.\n]{0,40}\b(l(ö|oe)schen|leeren|verwerfen|droppen|truncaten|entfernen|drop|truncate|delete|wipe|purge)\b/i,
+  },
+  {
+    op: "prod-infra-change",
+    re: /(?<![A-Za-z0-9_À-ɏ])((ver)?(ä|ae)nder(e|n)?|anpass(e|en)?|umbau(e|en)?|apply|destroy|(neu\s*)?provisionier(e|en)?)\b[^.\n]{0,40}\b(infrastruktur|infrastructure|cluster|terraform|iam|dns|netzwerk|network|firewall|policy|policies|security[-\s]group)\b|\b(infrastruktur|infrastructure|cluster|terraform|iam|dns|netzwerk|firewall)\b[^.\n]{0,40}\b((ver)?(ä|ae)ndern|anpassen|umbauen|zerst(ö|oe)ren|apply|destroy)\b/i,
+  },
+  {
+    op: "external-send",
+    re: /(?<![A-Za-z0-9_À-ɏ])(schick(e|en)?|verschick(e|en)?|send(e|en|et)?|mail(e|en)?|raussend(e|en)?|versend(e|en)?|post|publish)\b[^.\n]{0,40}\b(mail|mails|email|e-mail|nachricht|nachrichten|newsletter|webhook|kunden|kundin|kunde|empf(ä|ae)nger|customers?|recipients?|message)\b|\b(mail|email|e-mail|nachricht|newsletter|kunden|customers?)\b[^.\n]{0,40}\b(schicken|verschicken|senden|versenden|rausschicken|send|deliver)\b/i,
+  },
+  {
+    op: "money-movement",
+    re: /(?<![A-Za-z0-9_À-ɏ])(erstatt(e|en)?|r(ü|ue)ckerstatt(e|en)?|zahl(e|en)?|(ü|ue)berweis(e|en)?|abbuch(e|en)?|belast(e|en)?|refund|charge|payout|transfer|bill)\b[^.\n]{0,40}\b(betrag|geld|rechnung|zahlung|euro|dollar|kunde|kunden|karte|konto|invoice|payment|customer|card|account)\b|\b(betrag|geld|rechnung|zahlung|invoice|payment)\b[^.\n]{0,40}\b(erstatten|zur(ü|ue)ckzahlen|(ü|ue)berweisen|abbuchen|belasten|refund|charge|transfer)\b/i,
+  },
+  {
+    op: "trunk-force-push",
+    re: /(?<![A-Za-z0-9_À-ɏ])(force[-\s]?push(e|en|t)?|force[-\s]?pushen|(ü|ue)berschreib(e|en)?)\b[^.\n]{0,40}\b(main|master|trunk|produktions?[-\s]?branch|production|release[-\s]?branch)\b|\b(main|master|trunk|production)\b[^.\n]{0,40}\b(force[-\s]?pushen|force[-\s]?push|(ü|ue)berschreiben)\b/i,
+  },
+  {
+    op: "out-of-scope-destruction",
+    re: /(?<![A-Za-z0-9_À-ɏ])(l(ö|oe)sch(e|en)?|entfern(e|en)?|r(ä|ae)um(e|en)?\s*auf|aufr(ä|ae)um(e|en)?|delete|remove|wipe)\b[^.\n]{0,40}\b(au(ß|ss)erhalb|ausserhalb|unabh(ä|ae)ngig|nicht\s+zur\s+aufgabe|outside\s+(the\s+)?(task|scope)|unrelated|everything\s+else|alles\s+andere)\b|\b(au(ß|ss)erhalb|outside\s+(the\s+)?(task|scope)|unrelated)\b[^.\n]{0,40}\b(l(ö|oe)schen|entfernen|aufr(ä|ae)umen|delete|remove|wipe)\b/i,
+  },
+];
+
+/**
+ * Operations whose authorization is meaningless without its object.
+ *
+ * "Delete the table" is not an authorization to delete a table; it is an
+ * authorization to delete THAT table. The same holds for a recipient class and
+ * for a payment. The other four consequence operations are environment-scoped
+ * rather than object-scoped, so an object is recorded for them when the prose
+ * names one and never required.
+ */
+export const OBJECT_REQUIRED_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
+  "prod-data-destroy",
+  "external-send",
+  "money-movement",
+]);
+
+/**
+ * Words that can follow an object noun and are never the object's NAME.
+ *
+ * "Lösch die Tabelle bitte" names no table; the extractor's next-token rule
+ * captures `bitte` unless something says otherwise. A stop list is the honest
+ * shape for that — the same reviewable-keyword-list discipline the negation and
+ * pasted-output vocabularies above use, and for the same reason: a parser that
+ * guessed here would record a fabricated object, and a fabricated object is
+ * worse than a missing one because the conformance count treats a recorded
+ * object as an authorization the turn actually gave.
+ */
+const OBJECT_STOP_WORDS: ReadonlySet<string> = new Set([
+  "bitte", "doch", "mal", "nicht", "jetzt", "gleich", "auch", "noch", "wieder",
+  "in", "im", "aus", "von", "vom", ": ", "der", "die", "das", "den", "dem",
+  "und", "oder", "mit", "auf", "zu", "komplett", "ganz", "alle", "allen",
+  "please", "now", "again", "too", "also", "from", "and", "or", "the", "a",
+  "an", "there", "here", "completely", "all", "with", "on", "to", "in",
+]);
+
+/** Lower-case, strip surrounding quotes and trailing punctuation. */
+function _normalizeObject(raw: string): string {
+  return raw.trim().replace(/^["'`]+|["'`]+$/g, "").replace(/[.,;:]+$/, "").toLowerCase();
+}
+
+/** Per-operation object patterns, each with the capture group that holds it. */
+const OBJECT_PATTERNS: Readonly<Record<string, readonly RegExp[]>> = {
+  "prod-data-destroy": [
+    /\b(?:tabelle|table|datenbank|database|schema|collection|index)\s+["'`]?([A-Za-z_][\w.$-]*)/gi,
+    /\bs3:\/\/([\w.-]+)/gi,
+    /\b(?:bucket)\s+["'`]?([A-Za-z_][\w.-]*)/gi,
+  ],
+  "external-send": [
+    /([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g,
+    /\bhttps?:\/\/([^\s/"'`]+)/gi,
+    /\b(?:an\s+(?:die|den|alle)|to\s+(?:the|all))\s+([A-Za-z][\w-]*)/gi,
+  ],
+  "money-movement": [
+    /(\d[\d.,]*)\s*(?:€|eur\b|euro\b|\$|usd\b)/gi,
+    /(?:€|\$)\s*(\d[\d.,]*)/g,
+    /\b(?:kunde|kunden|customer|account|konto)\s+["'`]?([A-Za-z0-9][\w.-]*)/gi,
+  ],
+};
+
+/**
+ * The objects a sentence names for one operation.
+ *
+ * Returns `[]` when the prose names none — which is a real answer and the one
+ * `conformance_scan` reads as "the record does not name this object". An empty
+ * list is never widened into a wildcard.
+ */
+export function extractObjects(op: GitOp, text: string): string[] {
+  const patterns = OBJECT_PATTERNS[op];
+  if (!patterns) return [];
+  const out: string[] = [];
+  for (const re of patterns) {
+    const local = new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`);
+    let m: RegExpExecArray | null;
+    while ((m = local.exec(text)) !== null) {
+      const value = _normalizeObject(m[1] ?? "");
+      if (value && !OBJECT_STOP_WORDS.has(value) && !out.includes(value)) out.push(value);
+      if (m.index === local.lastIndex) local.lastIndex++;
+    }
+  }
+  return out;
+}

package/src/scripts/_lib/exec_evidence.ts

@@ -68,6 +68,13 @@ export const ALLOWLIST_PREFIXES: readonly (readonly string[])[] = [
     // a name. Read-only, deterministic, model-free, and already run in CI for its
     // own reasons — the same class as its neighbours here.
     ['check_no_external_sources'],
+    // Compares two COMMITTED files — the skill-activation census record against
+    // the sentence `docs/CLAIMS.md` publishes — so its exit code IS the verdict
+    // for that claim rather than evidence that some report exists. The census
+    // itself is deliberately NOT here: it reads a transcript store under `$HOME`
+    // that is absent on a runner, which would make the verdict an artifact of
+    // where it ran.
+    ['check_skill_activation_claim'],
     ['check_token_regression'],
     ['lint_agent_security'],
     ['measure_lexical_ranking'],

package/src/scripts/_lib/global_deploy_inventory.ts

@@ -356,7 +356,7 @@ function as_posix(p: string): string {
  *
  * `dry_run=true` computes and returns the would-delete set (only paths that
  * currently exist on disk) WITHOUT unlinking anything or pruning empty
- * directories — the preview surface for `install.py --dry-run`. The selection
+ * directories — the preview surface for `agent-config install --dry-run`. The selection
  * logic (orphan diff, containment proof, directory guard) is identical to the
  * live path, so the preview is exact.
  */
@@ -456,7 +456,7 @@ export function reap_stale(
  *
  * `dry_run=true` returns the would-delete set (tagged orphans actually present
  * on disk) WITHOUT unlinking or pruning — the preview surface for
- * `install.py --dry-run`. Selection logic is identical to the live path.
+ * `agent-config install --dry-run`. Selection logic is identical to the live path.
  */
 export function reap_tagged_orphans(
   anchor: string,

package/src/scripts/_lib/host_permission_checks.ts

@@ -0,0 +1,251 @@
+/**
+ * host_permission_checks — report the host permission settings that produce
+ * confirmation prompts, and write none of them.
+ *
+ * WHY REPORT AND NOT WRITE. Three settings decide how often a normal coding
+ * task is interrupted, and all three belong to the consumer:
+ * `permissions.deny` rules that cover reads, the working tree's absence from
+ * `permissions.additionalDirectories`, and `permissions.defaultMode`. Writing
+ * any of them would be this package deciding a consumer's permission posture
+ * from inside their repository, which is the one thing a permission surface
+ * must never do quietly. `src/templates/consumer-settings/claude-settings.json`
+ * carries `enabledPlugins` and `hooks` and zero `permissions` keys; this check
+ * exists so that stays true and the consumer still gets the answer.
+ *
+ * WHY IT NAMES ALL THREE EVEN WHEN ALL THREE ARE ABSENT. Absent is a real
+ * answer and the most common one. A check that goes silent on the default
+ * project reports "nothing found" and "I did not look" identically, which is
+ * the measured-zero-versus-not-measured failure this tree's own report
+ * contracts argue against. So each setting is named on every run, with its
+ * resolved value or the word absent.
+ *
+ * READ ONLY, AND FAILURE-TOLERANT. An unreadable or malformed settings file is
+ * reported, never repaired: a consumer's JSON is theirs, and a doctor that
+ * rewrites what it came to inspect is not a doctor.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+import type { WiringCheck } from "./runtime_wiring_checks.js";
+
+/** Injected so a test never reads the developer's own home directory. */
+export interface HostPermissionDeps {
+    projectRoot: string;
+    homeDir: string;
+    readFile: (p: string) => string | null;
+    isDirectory: (p: string) => boolean;
+}
+
+/** The permission block as the host writes it; every field optional. */
+interface PermissionBlock {
+    allow?: unknown;
+    deny?: unknown;
+    ask?: unknown;
+    additionalDirectories?: unknown;
+    defaultMode?: unknown;
+}
+
+/** One settings layer, in the host's own precedence order. */
+export interface SettingsLayer {
+    label: string;
+    file: string;
+    present: boolean;
+    unreadable: boolean;
+    permissions: PermissionBlock;
+}
+
+/**
+ * Tool names whose every documented effect is a read, plus the read-shaped
+ * `Bash(<cmd>:*)` heads. A deny covering one of these is the class that turns a
+ * category-A call back into a prompt, which is why it is worth naming
+ * separately from a deny on a write.
+ */
+const READ_SHAPED = [
+    "Read", "Glob", "Grep", "LS", "NotebookRead",
+    "Bash(cat", "Bash(ls", "Bash(head", "Bash(tail", "Bash(grep",
+    "Bash(rg", "Bash(find", "Bash(wc", "Bash(git status", "Bash(git log",
+    "Bash(git diff", "Bash(git show",
+];
+
+/** The four `defaultMode` values probed from Claude Code 2.1.263. */
+const KNOWN_MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];
+
+function _strings(value: unknown): string[] {
+    return Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : [];
+}
+
+/** Default deps — the only place the real filesystem is touched. */
+export function defaultHostPermissionDeps(projectRoot: string): HostPermissionDeps {
+    return {
+        projectRoot,
+        homeDir: os.homedir(),
+        readFile: (p) => {
+            try {
+                return fs.readFileSync(p, "utf8");
+            } catch {
+                return null;
+            }
+        },
+        isDirectory: (p) => {
+            try {
+                return fs.statSync(p).isDirectory();
+            } catch {
+                return false;
+            }
+        },
+    };
+}
+
+/**
+ * Resolve the three settings layers the host reads, in its precedence order.
+ *
+ * There was no resolver for this before — `security_audit_config.ts` is the
+ * only place all three paths appear together, and only as glob strings — so
+ * this is the first code in the tree that reads `permissions` at all.
+ */
+export function readSettingsLayers(deps: HostPermissionDeps): SettingsLayer[] {
+    const candidates: Array<[string, string]> = [
+        ["user-global", path.join(deps.homeDir, ".claude", "settings.json")],
+        ["project", path.join(deps.projectRoot, ".claude", "settings.json")],
+        ["project-local", path.join(deps.projectRoot, ".claude", "settings.local.json")],
+    ];
+    return candidates.map(([label, file]) => {
+        const raw = deps.readFile(file);
+        if (raw === null) {
+            return { label, file, present: false, unreadable: false, permissions: {} };
+        }
+        try {
+            const parsed = JSON.parse(raw) as Record<string, unknown>;
+            const perms = parsed["permissions"];
+            return {
+                label,
+                file,
+                present: true,
+                unreadable: false,
+                permissions:
+                    perms !== null && typeof perms === "object" ? (perms as PermissionBlock) : {},
+            };
+        } catch {
+            return { label, file, present: true, unreadable: true, permissions: {} };
+        }
+    });
+}
+
+/** Deny rules that cover a read, with the layer each came from. */
+export function readDenyRules(layers: readonly SettingsLayer[]): Array<[string, string]> {
+    const hits: Array<[string, string]> = [];
+    for (const layer of layers) {
+        for (const rule of _strings(layer.permissions.deny)) {
+            if (READ_SHAPED.some((prefix) => rule.startsWith(prefix))) {
+                hits.push([layer.label, rule]);
+            }
+        }
+    }
+    return hits;
+}
+
+/** Every `additionalDirectories` entry across the layers; the host unions them. */
+export function additionalDirectories(layers: readonly SettingsLayer[]): string[] {
+    const seen: string[] = [];
+    for (const layer of layers) {
+        for (const dir of _strings(layer.permissions.additionalDirectories)) {
+            if (!seen.includes(dir)) seen.push(dir);
+        }
+    }
+    return seen;
+}
+
+/** The winning `defaultMode`, or `null` when no layer sets one. */
+export function resolvedDefaultMode(layers: readonly SettingsLayer[]): string | null {
+    let winner: string | null = null;
+    for (const layer of layers) {
+        const mode = layer.permissions.defaultMode;
+        if (typeof mode === "string" && mode.trim()) winner = mode.trim();
+    }
+    return winner;
+}
+
+/**
+ * Is the project root a LINKED worktree?
+ *
+ * A linked worktree's `.git` is a file holding a `gitdir:` pointer, never a
+ * directory. It matters here because a worktree root is a working directory the
+ * host was not started in, which is exactly the case
+ * `additionalDirectories` exists to cover — and the case a consumer is least
+ * likely to have thought about.
+ */
+export function isLinkedWorktree(deps: HostPermissionDeps): boolean {
+    const dotGit = path.join(deps.projectRoot, ".git");
+    const raw = deps.readFile(dotGit);
+    if (raw === null) return false;
+    return !deps.isDirectory(dotGit) && raw.trimStart().startsWith("gitdir:");
+}
+
+/** The copyable snippet — the consumer pastes it, this package never writes it. */
+export function permissionSnippet(projectRoot: string): string {
+    return JSON.stringify(
+        { permissions: { additionalDirectories: [projectRoot], defaultMode: "default" } },
+        null,
+        2,
+    );
+}
+
+/**
+ * The doctor row.
+ *
+ * `warn` when something reportable was found, `ok` otherwise. Never `fail`:
+ * these are the consumer's own choices, and a doctor that fails a build over a
+ * setting it is forbidden to write would be asking for a change it will not
+ * make.
+ */
+export function checkHostPermissionSettings(deps: HostPermissionDeps): WiringCheck {
+    const layers = readSettingsLayers(deps);
+    const unreadable = layers.filter((l) => l.unreadable);
+    const denies = readDenyRules(layers);
+    const dirs = additionalDirectories(layers);
+    const mode = resolvedDefaultMode(layers);
+    const worktree = isLinkedWorktree(deps);
+    const rootListed = dirs.some(
+        (d) => path.resolve(d) === path.resolve(deps.projectRoot),
+    );
+
+    const lines: string[] = [];
+    lines.push(
+        denies.length === 0
+            ? "read-deny rules: absent — no permissions.deny rule covers a read"
+            : `read-deny rules: ${denies.length} — ` +
+              denies.map(([layer, rule]) => `${rule} (${layer})`).join(", "),
+    );
+    lines.push(
+        rootListed
+            ? `working tree in additionalDirectories: present (${deps.projectRoot})`
+            : `working tree in additionalDirectories: absent (${deps.projectRoot}` +
+              `${worktree ? ", a linked worktree" : ""})`,
+    );
+    lines.push(
+        mode === null
+            ? "permissions.defaultMode: absent — the host's own built-in default applies"
+            : `permissions.defaultMode: ${mode}` +
+              (KNOWN_MODES.includes(mode) ? "" : " — not a value this tree has probed"),
+    );
+    for (const layer of unreadable) {
+        lines.push(`unreadable: ${layer.file} (${layer.label}) is not valid JSON`);
+    }
+
+    // A linked worktree unlisted in additionalDirectories is the one finding
+    // worth surfacing on its own: the host was started somewhere else, so every
+    // call into this tree is a call into a directory it was not granted.
+    const reportable =
+        denies.length > 0 || unreadable.length > 0 || (worktree && !rootListed);
+
+    return {
+        id: "host-permission-settings",
+        status: reportable ? "warn" : "ok",
+        message: lines.join("; "),
+        remedy:
+            "agent-config never writes permissions — paste this into " +
+            `${path.join(deps.projectRoot, ".claude", "settings.local.json")} yourself if you want it: ` +
+            permissionSnippet(deps.projectRoot).replace(/\s+/g, " "),
+    };
+}

package/src/scripts/_lib/model_tier.ts

@@ -11,7 +11,7 @@
  * - the repo generator (`condense.py generate_claude_skills`), which
  *   builds the package's own `.claude/skills/` tree, and
  * - the consumer install finalizer
- *   (`install.py finalize_claude_model_tiers`), which rewrites the
+ *   (the installer's `finalize_claude_model_tiers`), which rewrites the
  *   installed `.claude/skills/` tree so Claude Code performs the
  *   per-turn model switch on a consumer with `model.auto_switch: auto`.
  *

package/src/scripts/_lib/obligation_frequency.ts

@@ -275,7 +275,7 @@ export function slot_frequency(platform: string, slot: Slot): Frequency {
 }
 
 /**
- * Platforms with no hook surface at all.
+ * Platforms this package binds nothing on.
  *
  * Copilot declares `fallback_only: true` in the manifest — concerns route
  * through rule-only fallback and the dispatcher no-ops. Every hook-declared
@@ -294,7 +294,7 @@ export function is_hook_capable(platform_block: Record<string, unknown>): boolea
 export interface PlatformBinding {
     /** Platform id → slot → concern ids bound in that slot. */
     slots: Map<string, Map<Slot, string[]>>;
-    /** Platform ids that carry no hook surface at all. */
+    /** Platform ids declared `fallback_only` — this package binds nothing there. */
     fallback_only: Set<string>;
 }
 

package/src/scripts/_lib/release_highlights.ts

@@ -29,6 +29,10 @@ import {
     CURATED_HEAD_INSTRUCTION,
     MIX_RESPONSE_MARKER,
     MIX_RESPONSE_PLACEHOLDERS,
+    PROMISE_OUTCOMES,
+    PROMISE_PHRASE,
+    PROMISE_READBACK_MARKER,
+    extract_changelog_section,
 } from './release_material.js';
 
 /** The five curated labels, in the order an operator reads them. */
@@ -546,6 +550,95 @@ export function mix_response_blockers(
     return [];
 }
 
+/**
+ * The promise the PREVIOUS release head made, or null when it made none.
+ *
+ * Scoped to that section's governance-response block, not to its whole body: a
+ * product line that happens to contain the phrase is not a promise the project
+ * made about the next cycle.
+ */
+export function previous_promise(changelogText: string, previousVersion: string): string | null {
+    const section = extract_changelog_section(changelogText, previousVersion);
+    if (section === null) return null;
+    const idx = section.body.indexOf(MIX_RESPONSE_MARKER);
+    if (idx === -1) return null;
+    const block = mix_response_block(section.body, idx);
+    return block.includes(PROMISE_PHRASE) ? block : null;
+}
+
+/**
+ * The ONE predicate for "did this head answer the previous head's promise?".
+ *
+ * The defect: `_lib/release_material.ts` generates a `Next cycle ships …` line
+ * and nothing has ever read the previous one back, so an unmet promise can be
+ * restated indefinitely at zero cost — the debt is booked and never called. A
+ * promise nobody reads is not a commitment, it is a sentence.
+ *
+ * Three outcomes are accepted and one of them must be chosen, which is the
+ * whole mechanism: it does not require the promise to have been KEPT, and no
+ * ratio, deadline or count is enforced here. Refusing an unkept promise would
+ * make the honest answer the expensive one and teach an author to promise less
+ * rather than to answer truthfully.
+ *
+ * Length floor and placeholder scan reuse the governance-response discipline
+ * for the same reason it exists there: a bare marker, or the writer's own
+ * scaffolding, is not an answer a human wrote.
+ */
+export function promise_readback_blockers(
+    sectionBody: string,
+    version: string,
+    previousVersion: string,
+    promise: string | null,
+    where = '`main`',
+): string[] {
+    if (promise === null) return [];
+    const idx = sectionBody.indexOf(PROMISE_READBACK_MARKER);
+    if (idx === -1) {
+        return [
+            `the ${version} section does not answer the ${previousVersion} head's ` +
+                `\`${PROMISE_PHRASE}\` promise. Add one \`> ${PROMISE_READBACK_MARKER}\` line ` +
+                `immediately under the curated head on ${where}, naming the promise and whether ` +
+                `it ${PROMISE_OUTCOMES.join(', ')} (the last one with its reason).`,
+        ];
+    }
+    const block = mix_response_block(sectionBody, idx);
+    const left = MIX_RESPONSE_PLACEHOLDERS.filter((t) => block.includes(t));
+    if (left.length > 0) {
+        return [
+            `the ${version} previous-cycle answer still carries the writer's placeholder(s) ` +
+                `(${left.map((t) => `\`${t}\``).join(', ')}). \`CHANGELOG.md\` is published to npm. ` +
+                `Write the outcome on ${where} and re-run.`,
+        ];
+    }
+    const lower = block.toLowerCase();
+    const named = PROMISE_OUTCOMES.filter((o) => lower.includes(o));
+    if (named.length === 0) {
+        return [
+            `the ${version} previous-cycle answer names no outcome. It has to say which of ` +
+                `${PROMISE_OUTCOMES.join(', ')} applies to the ${previousVersion} promise — an ` +
+                'answer that restates the promise without resolving it is the failure this reads ' +
+                'back for.',
+        ];
+    }
+    if (readback_answer(block).length < MIX_RESPONSE_MIN_CHARS) {
+        return [
+            `the ${version} previous-cycle answer is shorter than a written answer ` +
+                `(${String(MIX_RESPONSE_MIN_CHARS)} characters after the marker). Name what was ` +
+                `promised and what became of it on ${where}, not the outcome word alone.`,
+        ];
+    }
+    return [];
+}
+
+/** What the author wrote under the read-back marker, marker and quoting removed. */
+export function readback_answer(block: string): string {
+    return block
+        .replace(PROMISE_READBACK_MARKER, '')
+        .replace(/^[>\s.]+|[>\s.]+$/gu, '')
+        .replace(/[>\s]+/gu, ' ')
+        .trim();
+}
+
 /**
  * The whole response block: the marker's line plus every blockquote line under it.
  *