@event4u/agent-config 14.18.0 → 14.20.0

package/src/config/gate-violation-baselines.json

@@ -34,9 +34,9 @@
       "note": "The nine active non-draft roadmaps that predate the `relates:` requirement (road-to-agentic-engineering-assurance, road-to-component-library-lifecycle, road-to-council-evidence-integrity, road-to-frontend-fidelity-calibration, road-to-monorepo-scope-and-detection, road-to-observability-plate, road-to-role-scoped-spawn-profiles, road-to-skill-delivery-over-mcp, road-to-standing-payload-diet). This is a NEW obligation rather than a repaired scan root, and the ratchet is the point: `depends:` shipped in the template with nothing requiring it and measured 0 adoption, so requiring `relates:` retroactively across the estate would be an owner-reserved write with no analysis behind the edges it would have to invent (held as step 4.3, deferred). Clearing an entry here is one roadmap at a time: run `agent-config roadmap:context` on it, write the rows the probe surfaces, and lower the count."
     },
     "check_source_size_budget": {
-      "count": 18068,
-      "landed": "2026-09-05",
-      "note": "Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
+      "count": 18062,
+      "landed": "2026-09-06",
+      "note": "Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
       "reason": "Lowered 18,230 -> 18,209 on 2026-09-03 by drain/artifact-location. `doctor --strict` needed 16 lines of integration wiring in cmd_doctor.ts, which sits ~2,100 lines PAST the 1500 cap so every line there costs one excess. The branch first came in at +137 and paid its own way down rather than raising the baseline: the strict semantics, threshold, kill switch, payload helper and argv fragments moved to _cli/_doctor_strict.ts (~160 lines, under the cap, costs nothing), taking it to +15; then the 37-line drift renderer moved to _cli/_doctor_emit.ts. Net -21. The renderer was chosen deliberately: pure rendering, two dependencies, no argparse involvement and therefore none of the byte-parity risk the parser surface carries against the retired Python implementation; nothing outside cmd_doctor.ts imported it. An AI council on the residual split (a: raise by 15 / d: descope the feature); neither was taken, because a parallel branch demonstrated the same day that paying down is achievable in this codebase, which is the evidence the split lacked. This gate's own test comment prescribes it: a commit that splits a god-file lowers the excess and must carry the lowered baseline. MERGE RECONCILIATION 2026-09-03, 18,209 -> 18,205: drain/wired-instruments and drain/artifact-location each lowered from the SAME 18,230 base in parallel -- the branch to 18,226 (net -4, run_continuation_hook.ts's termination ladder moved to _lib/continuation_ladder.ts and runtime_journal.ts's prose to _lib/outcome_vocabularies.ts, both under the cap) and main to 18,209 (net -21, the doctor --strict split above). Taking either side alone is wrong in a different direction: main's value silently discards the branch's earned -4, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither -- it is the gate's own output on the merged tree, where both reductions apply. THIS LOCAL READING IS ADMISSIBLE HERE, and the discriminator matters because this file's ci-parity:local-only entry records a 165 -> 164 lowering that was reverted for exactly the opposite case: that count depends on how the environment resolves the projection surface, whereas this gate walks only SOURCE_ROOTS = ['src'] (check_source_size_budget.ts:88) counting excess lines over the 1500 ceiling, and `git status --porcelain -uall -- src/` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 18,205. If CI reads anything else, CI's number is the correct one and this note is the record of why. LOWERED 18,205 -> 18,193 on 2026-09-03 by fix/release-curation-ask. The change adds a fifth publication guard, and its own additions landed at +10 excess: release.ts 2,008 -> 2,018, every line of which is past the 1500 cap. Paid down rather than baselined, in the two ways this gate's doctrine prescribes. The guard's rationale (~13 lines of docstring, including why prMerged is a parameter rather than a call-site if) lives in release_publication.ts, 915 lines and therefore UNDER the cap, so the prose costs nothing; and the two pure text helpers _splitlines and _rstrip moved out of release.ts into release_env.ts (333 lines, also under the cap), taking release.ts to 1,996 -- 12 BELOW where it started. The branch came in at +10 and leaves at -12. Recorded while moving them: _splitlines is duplicated a third and fourth time at adoption_report.ts:106 and readme_linter.ts:418; collapsing all three onto one definition touches three modules and was left out of this change rather than done silently. LOWERED 18,193 -> 18,180 on 2026-09-03 by fix/release-branch-reuse. The step-1 branch decision -- twenty lines of if/else in release.ts -- became one call to checkout_release_branch in release_publication.ts, which is 1,019 lines and therefore UNDER the 1500 cap, so the twenty lines plus a ~35-line rationale now cost nothing. release.ts 1,996 -> 1,983, every one of those lines being past the cap. The drill grew 765 -> 918 for two new scenarios and the snapshot/restore that keeps them from writing the real CHANGELOG, and it is under the cap too. A change that adds a feature and lowers the excess is the shape this gate's doctrine asks for; the alternative was a +13 raise for logic that had no business in the god-file. LOWERED 18,180 -> 18,068 on 2026-09-05 by fix/release-gate-producer-parity. The change wires the governance-mix obligation into the writer and the two local guards and adds a release-gate locality registry; its own additions to release.ts landed at +19 excess, every one of those lines past the 1500 cap. Paid down rather than baselined, in the way this entry's doctrine prescribes: the 132-line test-count-trend unit (_TEST_COUNT_LINE_RE, _TEST_LIST_MAX_BUFFER, _count_from_list_result, _count_tests_current, _previous_test_count_from_changelog, _render_test_trend_line) moved from release.ts into release_publication.ts, which is under the cap and where it now belongs on merit rather than only on arithmetic -- the same diff makes the missing `Tests: N` footer a section-level publication blocker, so the writer that emits the footer and the guard that refuses its absence sit in one module. release.ts 1,983 -> 1,871. All four names are re-exported from release.ts, so tests/scripts/release.test.ts is unchanged. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files with the two new src/ files staged, so a clean CI checkout of this commit measures the same 18,068. If CI reads anything else, CI's number is the correct one and this note is the record of why."
     },
     "ci-parity:local-only": {
@@ -52,9 +52,9 @@
       "falsifier": "./scripts-run src/scripts/check_gate_coverage"
     },
     "lint_canonical_terms": {
-      "count": 1007,
-      "landed": "2026-08-26",
-      "note": "House-dialect debt in authored prose under src/ and docs/, measured by the gate this entry governs (road-to-canonical-terms 2.2). NOT a dead-root repair: the gate is new, and the debt is the corpus that predates the dialect decision recorded in src/config/canonical-terms.yml. A hard-zero gate was refused on the same ground the AI council refused an unconditional sweep on 2026-08-25 — `sweep_authorised: false` is a live constraint, and 1,025 occurrences cannot be rewritten in the change that introduces the check. The ratchet IS the council's staged promotion: report-only for existing debt, blocking for anything new. Measured 1,025 before the bounded pilot and 1,007 after it — the pilot was chosen by BLAST RADIUS, not by pair, per the council's explicit condition: the three smallest-radius pairs (`sub-agent`→`subagent`, `grey`→`gray`, `canonicalise`→`canonicalize`) at 18 occurrences across 12 files, with zero overlap with active work (no open PRs at the time). What remains is dominated by two large-radius pairs — `artefact`→`artifact` (619 occurrences / 239 files) and `behaviour`→`behavior` (325 / 171) — plus `hand-off`→`handoff` (46 / 36) and `licence`→`license` (17 / 12), the last of which the map flags `semantic-care-required` because licence TITLES are protected text. Shrink-only from here: each further wave lowers this number. Full classified inventory: agents/evidence/analysis/canonical-terms-inventory-2026-08-26.md.",
+      "count": 1006,
+      "landed": "2026-09-07",
+      "note": "Lowered 1007 -> 1006 on 2026-09-07 by drain/observed-learning-signal, and the gain was INCIDENTAL rather than sought: the branch's own new prose introduced five house-dialect occurrences under src/ and docs/ (four `artefact`/`artefacts`, one `behaviour`), which were rewritten LINE-SCOPED — only lines this diff authored, never a file-wide sweep, because `sweep_authorised: false` is still a live constraint. Four of the five were net-neutral (they replaced deleted lines carrying the same word) and one was a genuine reduction. The gate reported the tree at 1006 against a baseline of 1007 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THIS FILE'S check_source_size_budget ENTRY USES: the gate walks only authored prose under src/ and docs/, and `git status --porcelain -uall -- src docs` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 1006. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1007 while the tree measures 1006 would never expire at any age. PRIOR ENTRY: House-dialect debt in authored prose under src/ and docs/, measured by the gate this entry governs (road-to-canonical-terms 2.2). NOT a dead-root repair: the gate is new, and the debt is the corpus that predates the dialect decision recorded in src/config/canonical-terms.yml. A hard-zero gate was refused on the same ground the AI council refused an unconditional sweep on 2026-08-25. The ratchet IS the council's staged promotion: report-only for existing debt, blocking for anything new. What remains is dominated by two large-radius pairs — `artefact`->`artifact` and `behaviour`->`behavior` — plus `hand-off`->`handoff` and `licence`->`license`, the last of which the map flags `semantic-care-required` because licence TITLES are protected text. Shrink-only from here. Full classified inventory: agents/evidence/analysis/canonical-terms-inventory-2026-08-26.md.",
       "falsifier": "./scripts-run src/scripts/lint_canonical_terms"
     },
     "lint_handoffs": {
@@ -89,6 +89,18 @@
       "count": 243,
       "landed": "2026-09-02",
       "note": "243 pre-contract usages of `[~]` in archived roadmaps that carry no `deferred-resolution:` annotation. The annotation contract was settled by council on 2026-08-27; every file in this population predates it, the oldest by months (agents/roadmaps/archive/step-99-north-star-restructure.md:92 is 2026-05 and uses the glyph to mean 'partially green, not a regression'). They are NOT repaired: rewriting an archived roadmap's step semantics retroactively invents an intent nobody recorded, and the honest alternative glyph `[-]` is owner-reserved (archive_completed_roadmaps.ts:396). Shrink-only from here, one owner decision at a time. This ratchet covers ONLY the unannotated class; the broken-destination class -- a receiver deleted, renamed, re-parented, skipped, or archived with open steps -- is a hard failure at zero with no baseline, because deleting agents/roadmaps/road-to-council-topology-evidence-followups.md produces 38 of those and must red immediately rather than nudge a count. REMEDY WHEN THE 56-DAY NON-STAGNATION CLAUSE FIRES (from `landed`, i.e. 2026-10-28), named here because neither remedy the checker prints fits this population: \"fix the findings\" is ruled out by the sentence above -- rewriting an archived roadmap's step semantics retroactively invents an intent nobody recorded -- and \"lower the count\" is ruled out with it, since this population only shrinks when an owner decides one entry at a time. The remedy that fits is a `reaffirmed: {date, reason}` block on THIS entry (`_lib/gate_baseline.ts`), whose reason lands in the diff of the change that makes it: that is the path for debt which is genuinely unrepairable rather than merely unattended. A reaffirmation is not automatic. It asserts that the 243 were re-read and are still unrepairable, and if any of them has become repairable in the meantime the count goes down instead. Do not reaffirm at age 0 -- the clause exists so the question is asked once every 56 days, and answering it early answers nothing."
+    },
+    "lint_roadmap_later_disposition:review-by": {
+      "count": 68,
+      "landed": "2026-09-07",
+      "falsifier": "./scripts-run src/scripts/lint_roadmap_later_disposition  # the ratchet line names the current count; it fails when the count RISES above this entry",
+      "note": "Parked roadmaps under agents/roadmaps/later/ carrying no `review_by:` in their frontmatter. NOT a dead-scan-root repair — the obligation is NEW (road-to-observed-learning-signal step 3.4), so every pre-existing parked roadmap lacks it by construction and 68 of 82 is the count at introduction rather than revealed debt. A hard-zero gate was refused on this repository's own recorded ground: a gate that fails its own tree on 68 files the landing change did not cause is reverted rather than adopted. Shrink-only from here, which is the property that matters: a NEWLY parked roadmap must carry `review_by` or this reds immediately. Clearing an entry is one roadmap at a time — read what the park is waiting on, pick a date a human would actually honour, and lower the count. The figure is the gate's own output on this branch (`--json`, class `review-by`), and the same 68 was measured independently over a tree that had grown by one file since the roadmap's own pin, which is why the roadmap's stated floor and this entry agree."
+    },
+    "lint_roadmap_later_disposition:wake-condition": {
+      "count": 18,
+      "landed": "2026-09-07",
+      "falsifier": "./scripts-run src/scripts/lint_roadmap_later_disposition  # the ratchet line names the current count; it fails when the count RISES above this entry",
+      "note": "Parked roadmaps carrying no machine-readable wake condition — neither a structured three-part `entry_condition` (what / when / who) nor one of the four unambiguous body phrases. REVEALED rather than created: until 2026-09-07 the gate short-circuited on the frontmatter status word (`if (status !== 'later' && !RESUME_RE.test(body))`), so 63 of 82 parked roadmaps passed with no resume text present at all, and `trigger` was in RESUME_RE so 11 more passed on a prose mention of the word. Measured after the correction and after migrating the three pre-contract scalar `entry_condition` fields to the mapping form: 19 before the migration, 18 after. Shrink-only from here: a NEWLY parked roadmap must carry a real wake condition. A malformed `entry_condition` is deliberately OUTSIDE this ratchet and fails hard at zero — a scalar or a blank part is a defect the author introduced in the change that wrote it, not inherited debt."
     }
   },
   "retired": {

package/src/config/release-gate-locality.yml

@@ -127,3 +127,15 @@ jobs:
     verify: false
     script: ~
     guard: ~
+
+  activation-census:
+    # The one row where the local command asserts MORE than the job it mirrors,
+    # not less, so `partial` does not apply: the transcript store the census
+    # reads is keyed on the directory it runs in and does not exist on a runner,
+    # so CI can only re-take an empty reading and check the published figure
+    # against its record. Run locally, the same command reads the real store,
+    # which is the only place the census means anything.
+    local: './scripts-run src/scripts/report_skill_activation && ./scripts-run src/scripts/check_skill_activation_claim'
+    verify: true
+    script: src/scripts/report_skill_activation.ts
+    guard: ~

package/src/scripts/_cli/cmd_doctor.ts

@@ -2881,7 +2881,7 @@ function _run_checks(
         'claude-command-wrappers': _check_claude_command_wrappers,
         'surface-state': _check_surface_state,
         'hook-wiring': _check_hook_wiring,
-        ...(runtime_wiring.wiringRunners({ packageRoot: _package_root(), iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }) as unknown as Record<string, CheckRunner>),
+        ...(runtime_wiring.wiringRunners({ packageRoot: _package_root(), projectRoot: project_root, iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }) as unknown as Record<string, CheckRunner>),
         ...(install_reach.reachRunners({ projectRoot: project_root, resolvableVersion: _current_package_version() }) as unknown as Record<string, CheckRunner>),
         'stale-orphans': _check_stale_orphans,
         overrides: () => _check_overrides(project_root),
@@ -2967,7 +2967,7 @@ function _run_checks_no_manifest(
         'claude-command-wrappers': _check_claude_command_wrappers,
         'surface-state': _check_surface_state,
         'hook-wiring': _check_hook_wiring,
-        ...(runtime_wiring.wiringRunners({ packageRoot: _package_root(), iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }) as unknown as Record<string, CheckRunner>),
+        ...(runtime_wiring.wiringRunners({ packageRoot: _package_root(), projectRoot: project_root, iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }) as unknown as Record<string, CheckRunner>),
         ...(install_reach.reachRunners({ projectRoot: project_root, resolvableVersion: _current_package_version() }) as unknown as Record<string, CheckRunner>),
         'stale-orphans': _check_stale_orphans,
         // BOTH registries need the id. Registering only the first one crashed with

package/src/scripts/_cli/cmd_handoff.ts

@@ -17,7 +17,7 @@
  *                      file (legacy copy-paste mode)
  *   --launch <host>    spawn a fresh interactive host session after
  *                      generating (claude: hook-seeded; codex: handoff as
- *                      initial prompt — no hook surface there)
+ *                      initial prompt — this package binds no hook there)
  *   --llm              narrative-polish seam; v1: clear not-implemented error
  *   --root <path>      repo root override (default: cwd)
  *

package/src/scripts/_cli/cmd_session_recycle.ts

@@ -33,7 +33,8 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { ORIGIN_CWD_FALLBACK, resolve_project_root } from '../_lib/agent_settings.js';
 import {
     RECYCLE_ENVELOPE_MAX_BYTES,
-    RECYCLE_ENVELOPE_REL,
+    recycle_consumed_rel,
+    recycle_envelope_rel,
 } from '../_lib/recycle_envelope_paths.js';
 import {
     CAPSULE_SCHEMA_VERSION,
@@ -72,9 +73,42 @@ export function templateEnvelope(): Record<string, unknown> {
         next_task: '<the ONE task this envelope is written for — select content for it>',
         suggested_skills: ['<skill the successor should invoke>'],
         failed_approaches: ['<tried X, failed because Y — or the single entry "none">'],
+        successful_approaches: ['<did X, it worked because Y — or the single entry "none">'],
+        open_questions: ['<question the successor must not silently drop>'],
+        // Producer-owned, like `written_at` and `workspace`: `runSessionRecycle`
+        // deletes and re-derives it, so a value written here is discarded. It
+        // ships in the skeleton anyway so the template is a VALID record on its
+        // own — a template that cannot pass its own validator teaches the wrong
+        // shape to everyone who copies it.
+        predecessor: 'none',
     };
 }
 
+/**
+ * Which session this one continues — read, never composed.
+ *
+ * The chain is derivable without any new artifact: when this session started,
+ * its reader consumed the predecessor's record and MOVED it to this session's
+ * consumed path (`recycle_consumed_rel`). So the file sitting there is, by
+ * construction, the record this session resumed from, and its `session_id` is
+ * the predecessor.
+ *
+ * Returns the explicit string `none` when there is nothing there. `none` is a
+ * CLAIM — "this session starts a chain" — and is deliberately not an empty
+ * value: a reader must be able to tell "no predecessor" from "nobody wrote the
+ * field", because only the second one is a reason to go looking.
+ */
+export function resolvePredecessor(projectRoot: string, sessionId: string | null): string {
+    try {
+        const consumed = path.join(projectRoot, recycle_consumed_rel(sessionId));
+        const raw = JSON.parse(fs.readFileSync(consumed, 'utf-8')) as { session_id?: unknown };
+        const prior = String(raw.session_id ?? '').trim();
+        return prior === '' ? 'none' : prior;
+    } catch {
+        return 'none';
+    }
+}
+
 interface ParsedArgv {
     ok: boolean;
     message?: string;
@@ -193,7 +227,18 @@ export function runSessionRecycle(
     // order would drift from the one a test covers. A host that exports neither
     // yields `null`, and `last_verify` is then simply absent from the envelope
     // (the delete-then-set below already treats an unreadable fact as absent).
-    const grounding = collectGrounding(projectRoot, env_session_id());
+    const sessionId = env_session_id();
+    const grounding = collectGrounding(projectRoot, sessionId);
+
+    // Identity and lineage are READ, exactly like the git anchors below, and for
+    // the same reason: a model-composed predecessor is a guess about which
+    // session came before, and a wrong one hands the successor a stranger's
+    // chain. Both keys are dropped before being set so a composer cannot
+    // supply either.
+    delete envelope['session_id'];
+    delete envelope['predecessor'];
+    if (sessionId !== null && sessionId !== '') envelope['session_id'] = sessionId;
+    envelope['predecessor'] = resolvePredecessor(projectRoot, sessionId);
     // Drop the composer's factual keys UNCONDITIONALLY first. Guarding each
     // assignment on `!== null` would leave a model-composed branch or head
     // standing whenever the git read fails — the consumer would then compare
@@ -236,7 +281,10 @@ export function runSessionRecycle(
     // Absolute, not `RECYCLE_ENVELOPE_REL`: the relative form is identical for
     // every root, so it cannot tell the reader WHICH tree was written — the
     // one thing in doubt at the moment this line is read.
-    const target = path.join(projectRoot, RECYCLE_ENVELOPE_REL);
+    // Phase 2.1 — keyed by session, so two sessions in one checkout no longer
+    // overwrite each other. No id resolvable falls back to the shared name,
+    // which is exactly the pre-key behaviour rather than a lost record.
+    const target = path.join(projectRoot, recycle_envelope_rel(env_session_id()));
 
     // `--verify` stops HERE: every rejection above has already run, and the
     // only thing skipped is the write. Validating through a different path

package/src/scripts/_cli/cmd_update.ts

@@ -446,7 +446,7 @@ export async function main(argv: string[] | null = null, options: MainOptions =
     const installed_version = options.installed_version || _detect_installed_version();
     const state_path = options.state_path || update_check.DEFAULT_STATE_PATH;
 
-    // AGENT_CONFIG_OFFLINE=1 (set by `install.py --offline`) is honored as an
+    // AGENT_CONFIG_OFFLINE=1 (set by `agent-config install --offline`) is honored as an
     // env-level kill-switch. Mirrors cmd_versions.py.
     const offline = args.offline || process.env['AGENT_CONFIG_OFFLINE'] === '1';
 

package/src/scripts/_cli/cmd_versions.ts

@@ -426,7 +426,7 @@ export function main(argv: string[] | null = null, options: MainOptions = {}): n
     const err = options.err ?? _stderrSink();
     const opts = _parse(argv ?? process.argv.slice(2), out, err);
 
-    // AGENT_CONFIG_OFFLINE=1 (set by `install.py --offline`) is honored as a
+    // AGENT_CONFIG_OFFLINE=1 (set by `agent-config install --offline`) is honored as a
     // global kill-switch even when the per-command --offline flag is absent.
     const offline = opts.offline || process.env['AGENT_CONFIG_OFFLINE'] === '1';
 

package/src/scripts/_lib/adr_frontmatter.ts

@@ -483,3 +483,47 @@ export function readAdrAxisCells(text: string): AdrAxisCells {
                   : `${strength} (${discovery})`,
     };
 }
+
+/**
+ * The one shape this tool decides: a trigger whose condition IS a leading date.
+ *
+ * Deliberately anchored at the start of the string and deliberately narrow. The
+ * boundary is the whole safety property — the moment a trigger is matched on a
+ * date found anywhere in its prose, "reopens when N exceeds M" is one edit away
+ * and the machine-readable grammar two council seats rejected on 2026-08-19 has
+ * been built by increments.
+ */
+export const DATED_TRIGGER_RE = /^\s*(?:expir(?:y|es)\b\s*[:—-]?\s*)?(\d{4})-(\d{2})-(\d{2})(?!\d)/iu;
+
+/**
+ * A trigger that ANNOUNCES itself as dated, whether or not the date parses.
+ *
+ * The gap between this and `DATED_TRIGGER_RE` is the `dated-unparsed` state.
+ * Exactly one ADR in the corpus carries a dated expiry, so a parse tuned to its
+ * phrasing can fail on the second one — and the failure mode is silence,
+ * because the old answer for every trigger was `indeterminate`. This probe is
+ * what turns that silence into a reported defect.
+ */
+export const DATED_TRIGGER_PROBE = /^\s*(?:expir(?:y|es)\b|\d{4}-\d{1,2}-\d{1,2}\b)/iu;
+
+/** The UTC calendar day of an instant, as `YYYY-MM-DD`. */
+export function iso_day(d: Date): string {
+    return d.toISOString().slice(0, 10);
+}
+
+/**
+ * The calendar day a dated trigger names, or null when there is none to read.
+ *
+ * Round-tripping through `Date.UTC` rejects `2026-13-45`, which matches the
+ * shape and is not a date.
+ */
+export function dated_trigger_day(trigger: string): string | null {
+    const m = DATED_TRIGGER_RE.exec(trigger);
+    if (m === null) return null;
+    const [y, mo, d] = [Number(m[1]), Number(m[2]), Number(m[3])];
+    const at = new Date(Date.UTC(y, mo - 1, d));
+    if (at.getUTCFullYear() !== y || at.getUTCMonth() !== mo - 1 || at.getUTCDate() !== d) {
+        return null;
+    }
+    return iso_day(at);
+}

package/src/scripts/_lib/audit_field_provenance.ts

@@ -30,9 +30,28 @@
  * producer actually compute the field.
  */
 export const PRODUCER_CONSTANT_FIELDS: ReadonlyMap<string, readonly string[]> = new Map([
-    // Written identically by `orchestration_record.ts` and
-    // `review_skipped_record.ts`. Neither computes it from rules that fired.
-    ['rules_applied', ['delegation-policy']],
+    // EMPTY, and that is the assertion. `rules_applied` was the single row here
+    // until 2026-09-07: both shipped producers wrote the literal
+    // `['delegation-policy']` on every line. They now call `appliedIds` below,
+    // which carries what the caller observed and writes `[]` when the caller
+    // observed nothing — an honest absence, and the same answer
+    // `activation_receipt_producer.ts` has always given.
+    //
+    // Removing the row IS the claim that the field is now observed, so the row
+    // and the experience card that recorded the constancy
+    // (`agents/knowledge/experience-rules-applied-is-a-producer-constant.md`)
+    // were retired in the SAME change. Leaving the card standing after its
+    // falsifier fired would make the tree assert something false about itself,
+    // which is the failure the card exists to prevent.
+    //
+    // WHAT THIS DOES NOT CLAIM: the historical stream. Audit lines are
+    // append-only, so every line written before the cutover still carries the
+    // constant, and mining the real stream will keep surfacing it until new
+    // lines accumulate. The falsifier's second half — "the mined pattern's
+    // count falls below the audit line count" — is demonstrated over a fixture
+    // stream built through the changed producers
+    // (`tests/scripts/rules_applied_is_observed.test.ts`), which is the only
+    // stream where it CAN be demonstrated on the day the change lands.
 ]);
 
 /** True when a per-asset rate over this field would measure the producer. */
@@ -52,3 +71,25 @@ export function constantFieldReason(field: string): string | null {
         'producer, so any rate computed over it measures the writer rather than the work.'
     );
 }
+
+/**
+ * Normalise an applied-id array for the `rules_applied` field: drop blanks,
+ * de-duplicate, bound to <= 32 (the contract's own limit).
+ *
+ * Lives HERE, in the module that recorded the constancy, because both shipped
+ * producers now call it and the one property that must not drift between them
+ * is exactly this field's derivation. A caller that offers nothing gets `[]` —
+ * an honest absence — never a fabricated id.
+ */
+export const MAX_APPLIED_IDS = 32;
+
+export function appliedIds(values: readonly string[] | null | undefined): string[] {
+    const out: string[] = [];
+    for (const raw of values ?? []) {
+        const v = String(raw).trim();
+        if (v === '' || out.includes(v)) continue;
+        out.push(v);
+        if (out.length >= MAX_APPLIED_IDS) break;
+    }
+    return out;
+}

package/src/scripts/_lib/consequence_objects.ts

@@ -0,0 +1,152 @@
+/**
+ * consequence_objects — the consequence vocabulary's prose half.
+ *
+ * Two things live here: the phrase rows that recognise a consequence
+ * authorization, and the extraction of the OBJECT such an authorization names.
+ * An authorization for one table, one environment or one recipient class is not
+ * an authorization for another, and until this existed the ledger could express
+ * the difference for nothing but pull-request numbers.
+ *
+ * IT IS RECOGNITION AND EXTRACTION, NOT MATCHING. Nothing here decides
+ * anything; the one consumer that acts on the vocabulary is `conformance_scan`,
+ * which counts after the fact. Making the object a matching condition is the
+ * ledger item ADR-254 left to the owner.
+ *
+ * It sits beside `git_authorization_hook` rather than inside it because that
+ * file is against the per-file source-size budget, which charges every line
+ * above 1500. The split is along a real seam: the hook owns the machinery —
+ * sentence bounds, negation, fenced-paste handling — and this module owns the
+ * consequence vocabulary that machinery is applied to.
+ */
+import type { GitOp } from "../git_authorization_hook.js";
+
+/**
+ * Prose phrases, German and English, that authorize a consequence operation.
+ *
+ * Spliced into `PHRASES` at its definition, so every row inherits the
+ * interrogative filter, the clause-scoped negation check and the fenced-paste
+ * split rather than reimplementing them.
+ *
+ * Every row REQUIRES ITS OBJECT NOUN, and that is why the patterns are long. A
+ * bare verb cannot tell an authorization from a mention, and for this class the
+ * mention is the common case: "deploy" appears in a hundred sentences that
+ * authorize nothing, while "deploy nach production" appears only when someone
+ * means it.
+ *
+ * German verb endings are `(e|en)?` because the imperative drops its `-e`, and
+ * both word orders are covered — the house style stated above `PHRASES`. The
+ * leading boundary is an explicit character class rather than `\b`: JavaScript's
+ * `\b` is ASCII-only, so a word STARTING with an umlaut ("Ändere") has no
+ * boundary before it and the row silently never fires.
+ */
+export const CONSEQUENCE_PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
+  {
+    op: "prod-deploy",
+    re: /(?<![A-Za-z0-9_À-ɏ])(deploy(e|en|t|st)?|ausroll(e|en)?|ship(pe|pen)?|live\s*schalt(e|en)?|rollout)\b[^.\n]{0,30}\b(produktion|production|prod|live|prod-umgebung)\b|\b(produktion|production|prod|live)\b[^.\n]{0,30}\b(deploy(e|en)?|ausrollen|ausroll(e|en)?|live\s*schalten|rollout)\b/i,
+  },
+  {
+    op: "prod-data-destroy",
+    re: /(?<![A-Za-z0-9_À-ɏ])(l(ö|oe)sch(e|en)?|entfern(e|en)?|leer(e|en)?|verwerf(e|en)?|drop|truncate|delete|wipe|purge|zerst(ö|oe)r(e|en)?)\b[^.\n]{0,40}\b(tabelle|tabellen|datenbank|daten|bucket|collection|zeilen|rows|table|database|dataset)\b|\b(tabelle|tabellen|datenbank|daten|bucket|collection|table|database)\b[^.\n]{0,40}\b(l(ö|oe)schen|leeren|verwerfen|droppen|truncaten|entfernen|drop|truncate|delete|wipe|purge)\b/i,
+  },
+  {
+    op: "prod-infra-change",
+    re: /(?<![A-Za-z0-9_À-ɏ])((ver)?(ä|ae)nder(e|n)?|anpass(e|en)?|umbau(e|en)?|apply|destroy|(neu\s*)?provisionier(e|en)?)\b[^.\n]{0,40}\b(infrastruktur|infrastructure|cluster|terraform|iam|dns|netzwerk|network|firewall|policy|policies|security[-\s]group)\b|\b(infrastruktur|infrastructure|cluster|terraform|iam|dns|netzwerk|firewall)\b[^.\n]{0,40}\b((ver)?(ä|ae)ndern|anpassen|umbauen|zerst(ö|oe)ren|apply|destroy)\b/i,
+  },
+  {
+    op: "external-send",
+    re: /(?<![A-Za-z0-9_À-ɏ])(schick(e|en)?|verschick(e|en)?|send(e|en|et)?|mail(e|en)?|raussend(e|en)?|versend(e|en)?|post|publish)\b[^.\n]{0,40}\b(mail|mails|email|e-mail|nachricht|nachrichten|newsletter|webhook|kunden|kundin|kunde|empf(ä|ae)nger|customers?|recipients?|message)\b|\b(mail|email|e-mail|nachricht|newsletter|kunden|customers?)\b[^.\n]{0,40}\b(schicken|verschicken|senden|versenden|rausschicken|send|deliver)\b/i,
+  },
+  {
+    op: "money-movement",
+    re: /(?<![A-Za-z0-9_À-ɏ])(erstatt(e|en)?|r(ü|ue)ckerstatt(e|en)?|zahl(e|en)?|(ü|ue)berweis(e|en)?|abbuch(e|en)?|belast(e|en)?|refund|charge|payout|transfer|bill)\b[^.\n]{0,40}\b(betrag|geld|rechnung|zahlung|euro|dollar|kunde|kunden|karte|konto|invoice|payment|customer|card|account)\b|\b(betrag|geld|rechnung|zahlung|invoice|payment)\b[^.\n]{0,40}\b(erstatten|zur(ü|ue)ckzahlen|(ü|ue)berweisen|abbuchen|belasten|refund|charge|transfer)\b/i,
+  },
+  {
+    op: "trunk-force-push",
+    re: /(?<![A-Za-z0-9_À-ɏ])(force[-\s]?push(e|en|t)?|force[-\s]?pushen|(ü|ue)berschreib(e|en)?)\b[^.\n]{0,40}\b(main|master|trunk|produktions?[-\s]?branch|production|release[-\s]?branch)\b|\b(main|master|trunk|production)\b[^.\n]{0,40}\b(force[-\s]?pushen|force[-\s]?push|(ü|ue)berschreiben)\b/i,
+  },
+  {
+    op: "out-of-scope-destruction",
+    re: /(?<![A-Za-z0-9_À-ɏ])(l(ö|oe)sch(e|en)?|entfern(e|en)?|r(ä|ae)um(e|en)?\s*auf|aufr(ä|ae)um(e|en)?|delete|remove|wipe)\b[^.\n]{0,40}\b(au(ß|ss)erhalb|ausserhalb|unabh(ä|ae)ngig|nicht\s+zur\s+aufgabe|outside\s+(the\s+)?(task|scope)|unrelated|everything\s+else|alles\s+andere)\b|\b(au(ß|ss)erhalb|outside\s+(the\s+)?(task|scope)|unrelated)\b[^.\n]{0,40}\b(l(ö|oe)schen|entfernen|aufr(ä|ae)umen|delete|remove|wipe)\b/i,
+  },
+];
+
+/**
+ * Operations whose authorization is meaningless without its object.
+ *
+ * "Delete the table" is not an authorization to delete a table; it is an
+ * authorization to delete THAT table. The same holds for a recipient class and
+ * for a payment. The other four consequence operations are environment-scoped
+ * rather than object-scoped, so an object is recorded for them when the prose
+ * names one and never required.
+ */
+export const OBJECT_REQUIRED_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
+  "prod-data-destroy",
+  "external-send",
+  "money-movement",
+]);
+
+/**
+ * Words that can follow an object noun and are never the object's NAME.
+ *
+ * "Lösch die Tabelle bitte" names no table; the extractor's next-token rule
+ * captures `bitte` unless something says otherwise. A stop list is the honest
+ * shape for that — the same reviewable-keyword-list discipline the negation and
+ * pasted-output vocabularies above use, and for the same reason: a parser that
+ * guessed here would record a fabricated object, and a fabricated object is
+ * worse than a missing one because the conformance count treats a recorded
+ * object as an authorization the turn actually gave.
+ */
+const OBJECT_STOP_WORDS: ReadonlySet<string> = new Set([
+  "bitte", "doch", "mal", "nicht", "jetzt", "gleich", "auch", "noch", "wieder",
+  "in", "im", "aus", "von", "vom", ": ", "der", "die", "das", "den", "dem",
+  "und", "oder", "mit", "auf", "zu", "komplett", "ganz", "alle", "allen",
+  "please", "now", "again", "too", "also", "from", "and", "or", "the", "a",
+  "an", "there", "here", "completely", "all", "with", "on", "to", "in",
+]);
+
+/** Lower-case, strip surrounding quotes and trailing punctuation. */
+function _normalizeObject(raw: string): string {
+  return raw.trim().replace(/^["'`]+|["'`]+$/g, "").replace(/[.,;:]+$/, "").toLowerCase();
+}
+
+/** Per-operation object patterns, each with the capture group that holds it. */
+const OBJECT_PATTERNS: Readonly<Record<string, readonly RegExp[]>> = {
+  "prod-data-destroy": [
+    /\b(?:tabelle|table|datenbank|database|schema|collection|index)\s+["'`]?([A-Za-z_][\w.$-]*)/gi,
+    /\bs3:\/\/([\w.-]+)/gi,
+    /\b(?:bucket)\s+["'`]?([A-Za-z_][\w.-]*)/gi,
+  ],
+  "external-send": [
+    /([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g,
+    /\bhttps?:\/\/([^\s/"'`]+)/gi,
+    /\b(?:an\s+(?:die|den|alle)|to\s+(?:the|all))\s+([A-Za-z][\w-]*)/gi,
+  ],
+  "money-movement": [
+    /(\d[\d.,]*)\s*(?:€|eur\b|euro\b|\$|usd\b)/gi,
+    /(?:€|\$)\s*(\d[\d.,]*)/g,
+    /\b(?:kunde|kunden|customer|account|konto)\s+["'`]?([A-Za-z0-9][\w.-]*)/gi,
+  ],
+};
+
+/**
+ * The objects a sentence names for one operation.
+ *
+ * Returns `[]` when the prose names none — which is a real answer and the one
+ * `conformance_scan` reads as "the record does not name this object". An empty
+ * list is never widened into a wildcard.
+ */
+export function extractObjects(op: GitOp, text: string): string[] {
+  const patterns = OBJECT_PATTERNS[op];
+  if (!patterns) return [];
+  const out: string[] = [];
+  for (const re of patterns) {
+    const local = new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`);
+    let m: RegExpExecArray | null;
+    while ((m = local.exec(text)) !== null) {
+      const value = _normalizeObject(m[1] ?? "");
+      if (value && !OBJECT_STOP_WORDS.has(value) && !out.includes(value)) out.push(value);
+      if (m.index === local.lastIndex) local.lastIndex++;
+    }
+  }
+  return out;
+}

package/src/scripts/_lib/exec_evidence.ts

@@ -68,6 +68,13 @@ export const ALLOWLIST_PREFIXES: readonly (readonly string[])[] = [
     // a name. Read-only, deterministic, model-free, and already run in CI for its
     // own reasons — the same class as its neighbours here.
     ['check_no_external_sources'],
+    // Compares two COMMITTED files — the skill-activation census record against
+    // the sentence `docs/CLAIMS.md` publishes — so its exit code IS the verdict
+    // for that claim rather than evidence that some report exists. The census
+    // itself is deliberately NOT here: it reads a transcript store under `$HOME`
+    // that is absent on a runner, which would make the verdict an artifact of
+    // where it ran.
+    ['check_skill_activation_claim'],
     ['check_token_regression'],
     ['lint_agent_security'],
     ['measure_lexical_ranking'],

package/src/scripts/_lib/global_deploy_inventory.ts

@@ -356,7 +356,7 @@ function as_posix(p: string): string {
  *
  * `dry_run=true` computes and returns the would-delete set (only paths that
  * currently exist on disk) WITHOUT unlinking anything or pruning empty
- * directories — the preview surface for `install.py --dry-run`. The selection
+ * directories — the preview surface for `agent-config install --dry-run`. The selection
  * logic (orphan diff, containment proof, directory guard) is identical to the
  * live path, so the preview is exact.
  */
@@ -456,7 +456,7 @@ export function reap_stale(
  *
  * `dry_run=true` returns the would-delete set (tagged orphans actually present
  * on disk) WITHOUT unlinking or pruning — the preview surface for
- * `install.py --dry-run`. Selection logic is identical to the live path.
+ * `agent-config install --dry-run`. Selection logic is identical to the live path.
  */
 export function reap_tagged_orphans(
   anchor: string,

package/src/scripts/_lib/host_capability.ts

@@ -67,6 +67,33 @@ export interface HostCapabilityManifest {
      * stop-loss behaviour — loudly, never silently.
      */
     worker_respawn: boolean;
+    /**
+     * The host reads a PROJECT-scope MCP config file (`.mcp.json` or its
+     * per-host equivalent) and starts the servers it names.
+     *
+     * Added because nothing in this tree could answer it: the installer writes
+     * `.mcp.json` for `claude-code` alone while writing other hosts' config
+     * files for hooks, and no code could say whether that omission was a
+     * measured absence or an unasked question.
+     *
+     * Same discipline as `worker_respawn`: `true` only once OBSERVED on a host,
+     * never inferred from the fact that a host supports MCP at all — a host may
+     * read a user-scope config and ignore a project one, which is precisely the
+     * distinction a consumer needs and the one an inference would erase.
+     */
+    reads_project_mcp_config: boolean;
+    /**
+     * The host requires a human action after installation before the MCP server
+     * is live — an approval dialog, a restart, a manual enable.
+     *
+     * `true` is the SAFE default here, and it is the opposite of every other
+     * field in this manifest. The others answer "can the host do X", where an
+     * unknown must not read as a capability. This one answers "is there a step
+     * left for the user", where an unknown must not read as "nothing to do":
+     * an install that silently omits a required step leaves a server nobody
+     * started and no message saying so.
+     */
+    mcp_needs_manual_activation: boolean;
 }
 
 /** Safe default — unknown host assumes no subagent primitive. */
@@ -78,6 +105,10 @@ const SAFE_DEFAULT: HostCapabilityManifest = {
     separate_quota_pool: false,
     agent_teams: false,
     worker_respawn: false,
+    reads_project_mcp_config: false,
+    // `true` because the safe answer here is "there is still a step", not
+    // "there is nothing to do" — see the field's own note.
+    mcp_needs_manual_activation: true,
 };
 
 /** Coerce one field: only a strict boolean `true` survives; everything else is `false`. */
@@ -106,6 +137,11 @@ export function normalizeHostManifest(input: unknown): HostCapabilityManifest {
         separate_quota_pool: asBool(src.separate_quota_pool),
         agent_teams: asBool(src.agent_teams),
         worker_respawn: asBool(src.worker_respawn),
+        reads_project_mcp_config: asBool(src.reads_project_mcp_config),
+        // Inverted coercion, matching the inverted default: only an explicit
+        // `false` clears the residual, so an absent or malformed value keeps
+        // the manual step visible instead of silently dropping it.
+        mcp_needs_manual_activation: src.mcp_needs_manual_activation !== false,
     };
 }
 
@@ -287,6 +323,8 @@ const CAPABILITY_FIELDS: readonly CapabilityField[] = [
     'separate_quota_pool',
     'agent_teams',
     'worker_respawn',
+    'reads_project_mcp_config',
+    'mcp_needs_manual_activation',
 ];
 
 /**