@event4u/agent-config 14.22.0 → 15.0.0

package/src/server/schemas/settings.ts

@@ -31,7 +31,8 @@ const confidenceBand = z.enum(['off', 'low', 'medium', 'high']);
 const onBlock = z.enum(['stop', 'ask', 'warn']);
 const onBlockFallback = z.enum(['stop', 'warn']);
 const modelAutoSwitch = z.enum(['auto', 'suggest', 'off']);
-const leanProjectionMode = z.enum(['eager-all', 'thin']);
+const leanProjectionMode = z.enum(['eager-all', 'thin', 'delivery']);
+const leanProjectionHost = z.enum(['claude-code', 'cursor', 'cline']);
 const projectionMode = z.enum(['legacy-all', 'scoped']);
 const memoryCadence = z.enum(['auto', 'always', 'never']);
 const projectAudience = z.enum(['self', 'internal', 'client', 'public']);
@@ -64,9 +65,19 @@ export const settingsSchema = z.object({
     ),
     lean_projection: z.object({
         mode: leanProjectionMode.default('eager-all').describe(
-            'How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (default, safe). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session). EXPERIMENTAL: validate with the live A/B before flipping; one-flip revert to eager-all.',
-        ),
-    }).default({ mode: 'eager-all' }),
+            'How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267, and the activation charge for it is paid in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384).',
+        ),
+        hosts: z.array(leanProjectionHost).default(['claude-code']).describe(
+            'Which hosts a thinning mode may thin (ADR-267). Absent resolves to [claude-code]. '
+            + 'Only the three hosts with a per-rule rule tree are accepted, and this enum is the '
+            + 'AUTHORING layer: an id outside it is a hard validation FAILURE here and under '
+            + 'validate_agent_settings, never a warning. resolveLeanProjectionHosts is the '
+            + 'READ-TIME backstop for a hand-edited .agent-settings.yml that passed neither, and '
+            + 'THERE the id is dropped with a warning (R2 finding 6 — the two layers answer '
+            + 'differently and neither said so). Every host outside this list receives exactly '
+            + 'what eager-all writes, asserted byte-for-byte by check_host_tree_parity.',
+        ),
+    }).default({ mode: 'eager-all', hosts: ['claude-code'] }),
     cost: z.object({
         budgets: z.object({
             daily: z.number().min(0).default(0).describe(
@@ -162,7 +173,7 @@ export const settingsSchema = z.object({
     }),
     chat_history: z.object({
         enabled: z.boolean().default(true).describe(
-            'Persist a structured log of every chat turn to .agent-config/chat-history/ so /chat-history:show, :import, and :learn can replay sessions. Turn off if you never want chat transcripts on disk.',
+            'Persist a structured log of every chat turn to agents/runtime/.agent-chat-history (JSONL). Recording only — no command in this package replays a session from the file; it is a record on disk that a human or a later tool can read. Turn off if you never want chat transcripts on disk.',
         ),
         frequency: chatFreq.default('per_turn').describe(
             'How often the chat-history writer flushes to disk. per_turn = after every user / agent exchange (default, lowest data loss on crash). per_phase = at phase boundaries (cheaper I/O). per_tool = after every tool call (highest fidelity, noisiest log).',
@@ -236,7 +247,27 @@ export const settingsSchema = z.object({
         fidelity_mode: fidelityMode.default('strict').describe(
             'How strictly the agent must follow a user-provided prototype / mockup / design system (consumed by the design-fidelity rule). strict = build 1:1, every visible deviation needs confirmation; structural = structure locked, silent gaps fillable with a stated assumption; hard-floor = any deviation is never autonomous.',
         ),
-    }).default({ fidelity_mode: 'strict' }),
+        approximation: z
+            .object({
+                enabled: z.boolean().default(false).describe(
+                    'Whether a value INSIDE the configured tolerance may be replaced by the project\'s own token without a per-value confirmation. Ships false. The distance from the artifact\'s value to the nearest project token is computed and REPORTED on every value row regardless of this switch — what it decides is whether the agent may act on it without asking. Turning it on for a whole install is a consumer-facing default flip and is owner-reserved (agents/roadmaps/stubs/road-to-frontend-power-default-flip.md); design.fidelity_mode: hard-floor overrides it to off.',
+                ),
+                tolerance: z
+                    .object({
+                        color: z.number().nullable().default(null).describe(
+                            'Colour distance below which a value may be reconciled, in OKLab ΔEOK. Ships null, and null means "preserve and report" rather than "reconcile freely". No number is set because none is supported: zero of seven design-to-code benchmarks in the evidence set score token conformance, and a number in a config file — even flagged unmeasured — shapes behavior and acquires the authority of a default. Not an RGB channel delta: RGB distance is not perceptually uniform.',
+                        ),
+                        length: z.number().nullable().default(null).describe(
+                            'Length distance below which a value may be reconciled, in absolute CSS pixels. Ships null, same reasoning as color. GitHub Primer\'s ±1px spacing widening is recorded as an externally observed candidate in src/scripts/_lib/design_tolerance.ts and is deliberately not the shipped value; max(1px, 2%) was rejected for growing more permissive at large dimensions with no evidence that this is wanted.',
+                        ),
+                    })
+                    .default({ color: null, length: null }),
+            })
+            .default({ enabled: false, tolerance: { color: null, length: null } }),
+    }).default({
+        fidelity_mode: 'strict',
+        approximation: { enabled: false, tolerance: { color: null, length: null } },
+    }),
     consistency: z.object({
         cross_source: crossSourceMode.default('on').describe(
             'Consumed by the cross-source-consistency rule. When the agent works from multiple sources (ticket text, an attached image/mockup, the spec, the codebase) it checks them against each other and asks before proceeding on a discrepancy — instead of silently guessing. on (default) = surface every real cross-source contradiction / silent-scope-expansion as one question; auto = surface only high-confidence contradictions, state low-confidence as an assumption; off = no cross-source checking.',
@@ -438,6 +469,14 @@ export const settingsSchema = z.object({
             ),
         }),
     }),
+    continuity: z.object({
+        auto_record: z.enum(['on', 'off']).default('on').describe(
+            'Deterministic continuity-record writer at session end (road-to-continuity-writer-activation Phase 1). on (default since 2026-09-10) = the session-eol concern writes the continuity_record capsule variant on Stop for a substantive session that has claimed a roadmap; every field is computed from on-disk state, with no model spend and no subprocess. off = no automatic record, and only the explicit agent-config session:recycle writes one. The default flipped once the parity evidence landed, so the normal path carries an automatic writer rather than a remembered command; session:recycle is retained because the automatic writer skips a session that claimed no roadmap and omits the git-status anchors.',
+        ),
+        run_checkpoints: z.enum(['on', 'off']).default('on').describe(
+            'Deterministic run-checkpoint production at session end (road-to-continuity-writer-activation Phase 1.4). on (default) = a session above the recycle threshold and inside a running roadmap contract leaves agents/runtime/state/checkpoints/<run>.json, so a killed run resumes from a derived checkpoint rather than from bookkeeping. off = no checkpoint; continuity writing, the recycle advisory and the context-fill surface are unaffected. Default ON because it is the behavior the tree already had — the switch exists to make the three session-end handlers independently disableable, not to change what ships.',
+        ),
+    }),
     memory: z.object({
         cadence: memoryCadence.default('always').describe(
             'Cadence of the 🧠 memory-visibility line after a memory-consulting step. always (default) = show whenever a memory type was asked; auto = show only when 3+ types were consulted (less noise); never = suppress. Distinct from rule_loading_tier — owns its own key since the 2026-06-01 untangle.',

package/src/shared/settingsSurface.ts

@@ -23,7 +23,13 @@ export type JsonLike =
     | { [key: string]: JsonLike };
 
 export interface SurfaceEntry {
-    type: string;
+    /**
+     * JSON-schema type. A STRING for an ordinary key, and an ARRAY for a
+     * nullable one (`["number", "null"]`) — which is what the generator has
+     * always produced for a `z.number().nullable()`, though this field was
+     * declared `string` until the first such key shipped.
+     */
+    type: string | string[];
     default?: JsonLike;
     enum?: Array<string | number>;
     description?: string;
@@ -129,7 +135,12 @@ export function computeSurfaceDelta(oldS: SettingsSurface, newS: SettingsSurface
             continue;
         }
         const o = oldS.entries[key] as SurfaceEntry;
-        if (o.type !== n.type) {
+        // `sameJson`, not `!==`: `type` is an array for a nullable key, and two
+        // structurally equal arrays are never `===`. Left as a strict compare
+        // it reported `type_changed` on EVERY version bump for every nullable
+        // key, forever — caught by the identical-surface test the moment the
+        // first one shipped (`design.approximation.tolerance.*`).
+        if (!sameJson(o.type, n.type)) {
             changes.push({ key, kind: 'type_changed', old: o, new: n });
         }
         if (!sameJson(o.default, n.default)) {

package/src/templates/compact-instructions.md

@@ -1,9 +1,14 @@
 # Compact-instructions template — lose less when you compact anyway
 
 Fallback lane of `road-to-token-economy-recycling` Phase 3.3. The recycle
-envelope (`agent-config session:recycle` + `/clear`) is the primary path —
-validated state, no summarizer. This template is for the user who compacts
-instead: Claude Code honours a `# Compact instructions` section in the
+envelope is the primary path — validated state, no summarizer — and since
+2026-09-10 it is written for you: the `session-eol` concern publishes the
+continuity record at session end by default (`continuity.auto_record`), so
+`/clear` resumes from it with no command to remember.
+`agent-config session:recycle` still exists as an explicit affordance for the
+cases the automatic writer does not cover (a session that claimed no roadmap, or
+a record that should carry the `git status` anchors). This template is for the
+user who compacts instead: Claude Code honours a `# Compact instructions` section in the
 project's `CLAUDE.md` when it summarizes (see the "Manage context
 proactively" section of the host's cost docs), and `/compact <instructions>`
 accepts the same guidance ad hoc.

package/src/vendor/grammars/README.md

@@ -41,6 +41,27 @@ they are annotated MIT in `REUSE.toml` and credited in `CREDITS.md`.
 are refreshed from, and the ABI smoke test in `tests/scripts/code_graph.test.ts`
 runs against it. It is deliberately not a runtime dependency.
 
+## Verification
+
+Two checks, and they answer different questions.
+
+`src/config/packed-binary-manifest.json` plus `_lib/packed_binary_predicate.ts`
+verify that these bytes are what the manifest says they are — eleven conditions,
+all of them re-derived from the bytes. Every one of them reads the manifest, so
+a commit that edits a row and its file together satisfies all eleven.
+
+`_lib/vendored_grammar_upstream.ts` verifies that these bytes are what the
+**locked upstream** says they are: it byte-compares each file against
+`node_modules/tree-sitter-wasms/out/`, after asserting that the installed
+version is the one `package-lock.json` pins. An absent or unlocked upstream is a
+refusal, never a pass. It is exercised by
+`tests/scripts/vendored_grammar_upstream.test.ts`, which also drives every
+refusal path and a real mutated grammar to failure.
+
+What neither check covers is a `package-lock.json` row pointing at a hostile
+package; that is review's job, and `packed_binary_predicate.ts`'s docblock says
+so in those words.
+
 ## Refreshing
 
 The pair is ABI-coupled and must move together:
@@ -55,7 +76,11 @@ shasum -a 256 src/vendor/grammars/*.wasm   # update the table above
 
 Then update, in the same change:
 
-- the three `BINARY_PAYLOAD_EXCEPTIONS` entries in `src/scripts/check_pack_size.ts`
-  (they are path-and-size-bound, so any size change invalidates them by design);
+- the three entries in `src/config/packed-binary-manifest.json` (they are
+  path-, sha256- and size-bound, so any refresh invalidates them by design).
+  This used to name `BINARY_PAYLOAD_EXCEPTIONS` in `src/scripts/check_pack_size.ts`,
+  a constant that no longer exists — `grep -rn BINARY_PAYLOAD_EXCEPTIONS` returned
+  this line and nothing else, so a refresher following it would have skipped the
+  manifest and reddened the pack-size gate with no pointer to why;
 - `EXPECTED_GRAMMAR_ABI` in `src/scripts/code_graph/types.ts` if the ABI moved;
 - the install-size line in `MIGRATION.md`.

package/dist/agent-src/commands/chat-history/import.md

@@ -1,170 +0,0 @@
----
-model_tier: medium
-name: chat-history-import
-pack: memory
-visibility: internal
-cluster: chat-history
-sub: import
-description: Surface prior chat-history sessions as a numbered table, let the user pick one, read it silently, and emit a short summary plus a resume offer — selective, user-driven cross-session import
-suggestion:
-  eligible: false
-  rationale: "Cluster sub-command — reached via its cluster head's routing or its explicit /cluster:sub name; not independently suggested (surface-consolidation)."
-workspaces:
-  - agent-config-maintainer
-packs:
-  - memory
----
-<!-- cloud_safe: noop -->
-
-# /chat-history import
-
-Read-only, **user-driven** cross-session import. Surfaces prior
-sessions logged in `agents/runtime/.agent-chat-history` as a numbered table,
-the user picks **one**, the agent reads that session **silently**
-and emits a 2–5 sentence summary, then offers to resume the last
-task from that session. The agent does **not** render entries
-verbatim, auto-import, or rewrite the user's context without an
-explicit instruction.
-
-This is the opt-in counterpart to the read-path filter (Phase 3 of
-`road-to-chat-history-session-isolation`): default reads stay
-session-scoped; `import` is the explicit surface for crossing the
-session boundary. For project-improving learnings derived from a
-prior session, see [`/memory mine-session --mode=proposals`](../memory/mine-session/command.md).
-
-## When NOT to use
-
-- Inspect the current session — use the host's native transcript /
-  session view, or `./scripts-run scripts/chat_history read`.
-- Generate a learning proposal from a prior session — use
-  [`/memory mine-session --mode=proposals`](../memory/mine-session/command.md),
-  which frames the session's signals and runs `learning-to-rule-or-skill`.
-- Bulk-import all sessions — out of scope for v1. One session per
-  invocation; multi-pick is v2.
-- Search prior sessions by content — out of scope for v1; no fuzzy
-  search, no full-text grep. The user picks by `last_ts` and
-  `summary` from the listing.
-
-## Steps
-
-### 1. Check if enabled
-
-Read `chat_history.enabled` from `.agent-settings.yml`. If `false`
-or the section is missing, say so and stop:
-
-```
-> 📒 chat-history is disabled (chat_history.enabled = false).
-> Set it to true in .agent-settings.yml to start logging.
-```
-
-### 2. List sessions
-
-Run `./scripts-run scripts/chat_history sessions --json --limit 20 --summary`.
-The helper returns an array of
-`{id, count, first_ts, last_ts, preview, summary}` sorted by
-`last_ts` desc. The `summary` field is built **inside the helper**
-from at most 10 sampled entries per session (5 oldest + 5 newest) —
-token-cheap, no need to ever read the full body for the picker.
-Default excludes empty buckets — only sessions with at least one
-body entry are surfaced.
-
-If the array is empty, stop:
-
-```
-> 📒 No prior sessions found in agents/runtime/.agent-chat-history.
-```
-
-### 3. Surface as a numbered table
-
-Render the sessions as a markdown table — the row number is the
-option (per `user-interaction` Iron Law: numbered options for any
-picker). The session `id` is noise to humans; keep it **internal**
-for step 5's `read --session <id>` call and never render it.
-Format:
-
-```
-Pick a session to import:
-
-| #  | Date             | Entries | Summary |
-|----|------------------|---------|---------|
-| 1  | YYYY-MM-DD HH:MM | N       | {summary} |
-| 2  | YYYY-MM-DD HH:MM | N       | {summary} |
-| …  |                  |         |           |
-| N  | —                | —       | abort — do not read any session |
-```
-
-Format the timestamp as `YYYY-MM-DD HH:MM` (drop seconds and
-timezone — the listing is for orientation, not forensics). Lead the
-`Summary` cell with the helper's `summary` field — that is the
-rough arc the user picks by (`<first user msg> → <last user msg>`
-for normal sessions, or `(N entries — no user prompts; t-mix: …)`
-for tool-only sessions). Do **not** truncate or rewrite `summary` —
-markdown table wrap handles long values. Always include an explicit
-`abort` row as the last numbered option. Track option-number → `id`
-internally so step 5 can call `./scripts-run scripts/chat_history read
---session <id>` with the right id.
-
-### 4. Wait for the pick
-
-**One question per turn** (per `ask-when-uncertain`). Do not chain
-the listing with anything else; do not auto-pick; do not surface a
-default. Wait for the user's response.
-
-If the user picks the abort option, stop without reading.
-
-### 5. Read the picked session silently
-
-Run `./scripts-run scripts/chat_history read --session <id> --last <count>`,
-where `<count>` is the picked row's `count` from step 2. The
-`--last` flag is **required** — the helper defaults to 5 entries,
-which would silently truncate any longer session. The helper returns
-the entries as JSON.
-
-**Do not render the entries.** The verbose dump was reversed by the
-user — token cost and scroll fatigue outweighed the verbatim
-contract. Read the JSON in-context, then proceed to step 6.
-
-### 6. Summarise and offer to resume
-
-Emit a **2–5 sentence** summary of the picked session: the topic,
-what was decided or built, and where it left off (the last task in
-progress, if any). Plain prose — no bullets, no headings, no
-verbatim quotes.
-
-Then offer the resume choice as numbered options
-(per `user-interaction`), one question per turn:
-
-```
-1. resume — pick up the last task from that session
-2. stop — keep the summary in context, do nothing else
-```
-
-Wait for the pick. Do **not** auto-resume. If the user picks
-`resume`, hand off to the relevant skill or command for that work;
-do not silently start editing files. The agent does not write to
-the current session's log on the user's behalf without an explicit
-instruction.
-
-## Gotchas
-
-- **Summary, not verbatim.** Earlier Council R2-2 favoured verbatim
-  rendering; reversed in practice — too slow, too token-expensive.
-  The agent reads the picked session in-context and emits a 2–5
-  sentence summary. Verbatim rendering is no longer part of the
-  contract.
-- **One pick per invocation.** Multi-pick is v2. If the user wants
-  a second session, run `/chat-history import` again.
-- **Read-only.** This command never writes to `agents/runtime/.agent-chat-history`
-  and never rotates.
-- **`<legacy>` and `<unknown>` buckets** show up like any other
-  session id when they have body entries — the user can pick them
-  too. The helper aggregates body entries with no `s` field into
-  `<legacy>` and entries with `s == "<unknown>"` into `<unknown>`.
-
-## See also
-
-- [`/memory mine-session --mode=proposals`](../memory/mine-session/command.md) — pick a prior session and turn it into a project-improving proposal via `learning-to-rule-or-skill` (the former `/chat-history learn`)
-- [`chat-history-platform-hooks`](../../../agents/settings/contexts/chat-history-platform-hooks.md) — read contract, isolation default, opt-in cross-session path
-- [`scripts/chat_history.ts`](../../../scripts/chat_history.ts) — `sessions` and `read --session` CLI surface
-- [`user-interaction`](../../rules/user-interaction.md) — numbered-options Iron Law
-- [`ask-when-uncertain`](../../rules/ask-when-uncertain.md) — one-question-per-turn Iron Law

package/dist/agent-src/commands/chat-history.md

@@ -1,63 +0,0 @@
----
-model_tier: medium
-name: chat-history
-disable-model-invocation: true
-argument-hint: "[import]"
-pack: memory
-visibility: internal
-description: Chat-history orchestrator — routes to import (selective cross-session resume). Mining moved to /memory mine-session; raw-log inspection uses the host's native transcript view.
-cluster: chat-history
-routes_to: [chat-history-import]
-type: orchestrator
-suggestion:
-  eligible: true
-  trigger_description: "import a prior session into the current chat, resume a previous session, pull a prior session in verbatim"
-  trigger_context: "user wants to pull a prior session from the agents/runtime/.agent-chat-history log into the current chat verbatim and optionally resume it"
-workspaces:
-  - agent-config-maintainer
-packs:
-  - memory
----
-
-<!-- cloud_safe: noop -->
-
-# /chat-history
-
-Top-level orchestrator for the `/chat-history` family. Writes and overflow
-handling are driven entirely by platform hooks + `scripts/chat_history.ts`
-internals (`road-to-chat-history-hook-only`); the surfaced sub-command is
-read-only on the cross-host log (`agents/runtime/.agent-chat-history`).
-Sessions coexist in one log file — each entry self-tags via the `s` field —
-so there is no ownership layer to recover from.
-
-## Sub-commands
-
-| Sub-command | Routes to | Purpose |
-|---|---|---|
-| `/chat-history import` | `commands/chat-history/import.md` | List prior sessions, pick one, render its entries verbatim — selective cross-session import + resume |
-
-**Consolidated elsewhere** (see `road-to-memory-pipeline-consolidation.md`):
-
-- **Mining a session for learnings** — use
-  [`/memory mine-session --mode=proposals`](../memory/mine-session/command.md)
-  (the former `/chat-history learn`; now the single mining command, reading the
-  same cross-host log).
-- **Inspecting the raw log** (size, entries, header) — use the host's native
-  transcript / session view; the bespoke `/chat-history show` was dropped as
-  redundant.
-
-## Dispatch
-
-1. Parse the user's argument: `/chat-history <sub-command> [args]`.
-2. The only sub-command is `import`. Bare `/chat-history` (or an unknown
-   sub-command) → route to `import`.
-3. Load `commands/chat-history/import.md` and follow its `## Steps` verbatim
-   with the remaining args.
-
-## Rules
-
-- **Do NOT commit, push, or open a PR** — `import` is read-only (it renders a
-  prior session into the current chat; it writes nothing).
-- **Do NOT chain sub-commands.** One `/chat-history import` per turn.
-- **`import` crosses the session boundary** — only run it when the user
-  explicitly asked for cross-session reading.