@event4u/agent-config 14.5.0 → 14.7.0

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -180,6 +180,86 @@ change in § 3a.
   `commit-policy` § NEVER ask about committing holds regardless of
   autonomy).
 
+### 3c. Capability screen — can the agent do this at all?
+
+```
+A RUN ALWAYS STARTS. THERE IS NO PREFLIGHT REFUSAL.
+PER OPEN STEP, ASK ONE QUESTION: CAN THE AGENT EXECUTE THIS AT ALL?
+YES → IT IS WORK. NO → IT IS THE ONLY KIND OF BLOCKER LEFT.
+WHO CONVENTIONALLY DOES A THING IS NOT A PROPERTY OF THE THING.
+```
+
+**Rewritten by [ADR-237](../../../docs/decisions/ADR-237-end-to-end-execution-authority.md),
+which supersedes ADR-235.** This section used to be a *preflight refusal*: a run
+with no "runnable" open step created no branch and wrote nothing. That is gone.
+The invocation is a delegation, so the question is no longer *is this step
+runnable under current governance* but *is this step possible for the agent at
+all.*
+
+Run once at the end of the pre-scan, and again immediately before any `blocked`
+report.
+
+**The screen, in order:**
+
+1. **Can the agent execute it?** Through the filesystem, git, `gh`, an API, a
+   CLI, a tool, a model, a council — anything machine-executable. If yes, the
+   step is **work**. Stop here; no blocker citation changes that.
+2. **Is the authority already implied by the invocation?** For a `process-full`
+   run: branches, chunked commits, pushing that branch, opening and updating the
+   PR, reversible repository/branch settings, CI runs and re-runs, merge-base
+   updates, conflict resolution, project-local dependencies, and paid calls
+   inside the cumulative USD 25 ceiling. If yes → **run it**.
+3. **Is it on the EXCLUDED list?** Merging to a production trunk, deploying,
+   production data / secrets / IAM / DNS, bulk deletion outside the roadmap's
+   scope, an irreversible external action beyond the PR itself. Those keep their
+   own this-turn confirmation ([`non-destructive-by-default`](../../rules/non-destructive-by-default.md))
+   and are a **halt**, not a blocker.
+4. **Otherwise it is externally impossible**, and only then is it a blocker: a
+   credential that does not exist and cannot be created · a purchase beyond the
+   budget · physical hardware access · another person or organisation must act ·
+   a wait that is factually mandatory and unverifiable.
+
+**A `## Blockers` entry is evidence, never a verdict.** A `Class: 3` label on an
+action the agent can perform is a **defect in the roadmap**, and the run repairs
+the label rather than obeying it — recording what it did and why. Class `0`/`1`
+entries carry a `Run:` the agent executes, exactly as before. Class `2`
+(consent-once) is pre-cleared for the duration of a `process-full` run when the
+consent it wants is one the invocation already gave; a `2` asking for something
+the invocation did NOT give (an EXCLUDED action, a spend crossing) still reaches
+the owner.
+
+**No citation → work**, and the default direction is unchanged: the failure this
+screen must not have is declining work an agent could have done.
+
+**A step this screen judges externally impossible carries a `blocked-by:` marker
+on its own line.** The obligation is unchanged and its reason is unchanged: two
+mechanisms read blockedness from two different places and only one reads this
+section — `run-continuation`, the stop-slot concern that re-engages an autonomous
+run, decides open-vs-blocked from the inline `<!-- blocked-by: <id> -->` marker
+and never parses `## Blockers`. Without the marker a step that IS impossible
+still counts as open work to the concern, which re-engages the agent into it
+every stop fire until the stall rung fires — the mechanism whose job is to detect
+a stall manufacturing one. **The residual is real and is not papered over:**
+nothing enforces the pairing, so a `## Blockers` entry authored without its
+marker is caught by review or not at all.
+
+**The gaming vector inverted, and both directions are now named.** Under ADR-235
+the vector was an agent writing itself a Class-3 blocker to stop early; the
+defence was that a qualifying blocker must **pre-date the run**, checkable from
+git. That defence is kept for the narrow blocker set that remains. ADR-237 adds
+the opposite vector — an agent that keeps going past a spend ceiling or into an
+EXCLUDED action under cover of "the roadmap needed it" — and its defences are
+step 3 above being an enumerated list rather than a characterisation, and the
+ceiling being cumulative per run rather than per action.
+
+**One imprecision, inherited and now given a test.** The class taxonomy has no
+row for *"waiting on time"* or *"waiting on another roadmap"*; both are authored
+as `3` today because an absent `Class:` already means `3`. Under step 4 a wait is
+a blocker only when it is factually mandatory and unverifiable — a soak window a
+run can simply outlast, or a cross-roadmap dependency the run can satisfy itself,
+is work. The taxonomy still lacks the row; the mislabel now has a stated test
+instead of a default.
+
 ## 4. Resolve cadences — read once, cache for the run
 
 Read both keys from `.agent-settings.yml` once and cache for the whole
@@ -430,6 +510,69 @@ artifact drafting, council enablement), not safety.
 
 On halt: stop, surface state, do **not** auto-fix outside the failing step.
 
+### Terminal outcomes — `complete`, or a genuine external impossibility
+
+The halt list above answers *"what interrupts runnable work"*. This answers
+*"what does the run report when the roadmap is not finished and the remaining
+work is not the agent's to do"* — and under
+[ADR-237](../../../docs/decisions/ADR-237-end-to-end-execution-authority.md) that
+second set is much smaller than it looks.
+
+**The measurement that motivated the old answer, and the reading that replaced
+it.** Measured 2026-08-19 across the twelve most nearly complete roadmaps:
+**zero** could reach `count_open == 0` in one PR, because every remaining step
+needed "a human action" — flip branch protection, authorise paid spend, install a
+binary, wait out a soak window, edit a file a hook denies. The census was sound.
+The reading was not: it counted actions a human *conventionally* performs,
+without asking per action whether a human was **necessary**. Flipping a branch
+setting, pushing, opening a PR, re-running CI, updating a merge base, fixing a
+test, spending inside a budget — the agent can do all of it. That is remediation
+work, and a `process-full` invocation grants it.
+
+Three outcomes, and only one of them is success:
+
+| Outcome | When | What it reports |
+|---|---|---|
+| `complete` | `count_open == 0` and the PR is open | the roadmap is finished; archival check runs (§ 6) |
+| `blocked` | every remaining open step is **externally impossible** for the agent | the work that DID close, plus the specific impossibility |
+| a halt | one of the five conditions above fired | the halt, its evidence, and what remains |
+
+`blocked-preflight` **no longer exists** (ADR-237 § 4). A run always starts.
+
+```
+`blocked` IS NEVER PRESENTED AS COMPLETION.
+count_open STAYS > 0. NO CHECKBOX IS FLIPPED TO [~] TO REACH IT.
+A PR OPENED ON A BLOCKED RUN IS LABELLED PARTIAL PROGRESS.
+BEFORE REPORTING IT, ASK PER REMAINING STEP: CAN I DO THIS AT ALL?
+ONE STEP THE AGENT COULD HAVE EXECUTED REJECTS THE CLAIM.
+```
+
+**Externally impossible — the whole list.** A required credential that does not
+exist and the agent cannot create · a purchase beyond the delegated budget ·
+physical hardware access · another person or organisation must act · a wait that
+is factually mandatory and cannot be simulated or verified.
+
+**Not externally impossible — every one of these is work.** An unprotected
+branch · a branch to create · a push · a PR to open · a repository or branch
+setting the agent can change · a workflow to start · CI to re-run · a merge base
+to update · conflicts · failing tests · local configuration · a paid call under
+the ceiling · "this could be risky" · "a maintainer should do this".
+
+The `[~]` prohibition is load-bearing and was the one point the council split on.
+Deferring a blocked step to `[~]` would let the run reach `count_open == 0` and
+report completion — laundering unfinished work through a glyph, which is exactly
+what Iron Law 3 of [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md)
+exists to catch on the archival side. So the boxes stay open and the outcome
+carries the truth instead. **ADR-237 keeps this clause verbatim** — narrowing
+`blocked` makes it more important, not less, because a run with more authority
+has more ways to reach a clean-looking count.
+
+Revalidation is the second half of the same discipline: the set is recomputed at
+the moment of reporting, because steps unblock during a run (a prerequisite
+closes, a `Run:` succeeds, a peer merges, a setting the run itself changed). If
+any remaining step is one the agent could execute, `blocked` is refused and the
+loop continues.
+
 ### Forbidden non-halt reasons — agent-invented cautions
 
 The halt list above is **exhaustive**. An agent running `process-full` (or any
@@ -446,9 +589,26 @@ a violation of the command and the user's will:
   a phase boundary emits a non-blocking status line and the run **continues**;
   the stop-and-wait reading of `phase-checkpoints` applies only to
   `process-phase`.
+- **"this step looks human-gated"** — the `blocked` outcome above is reached by
+  the § 3c test, never by a judgement about how a step feels. A step with no
+  qualifying blocker citation is runnable, and writing the citation yourself does
+  not make it one. This entry exists because the terminal outcome is the single
+  most abusable thing on this page.
+- **"the branch is not protected" / "a branch must be created" / "a PR must be
+  opened" / "a GitHub setting must change" / "CI must be re-run" / "the merge
+  base needs updating" / "there are conflicts" / "tests fail"** — every one is
+  remediation work the invocation authorised (ADR-237 § 1). Do it.
+- **"a paid service is needed"** — authorised up to a cumulative USD 25 per run
+  (§ Spend in the wrapper). Uncertainty about the exact cost is explicitly NOT a
+  reason to ask.
+- **"a maintainer should do this"** when the agent can perform the same action
+  through git, `gh`, an API or a CLI. **Capability before role**: the role of the
+  person who conventionally does a thing is not a property of the thing.
 
 If the work genuinely cannot continue, it will be because one of the five real
-halt conditions fired — surface THAT, not a manufactured caution.
+halt conditions fired, or because every remaining step is externally impossible
+by the § 3c test — surface THAT, with the specific impossibility named, not a
+manufactured caution and not a convention mistaken for a constraint.
 
 ### Non-halt — gating notes, "optional" tags
 

package/dist/agent-src/rules/context-hygiene.md

@@ -93,6 +93,8 @@ one shape the loop test above systematically misses, in both of its clauses.
   available were wait, or stop and report, and 34 licensed neither more than 31
   did. **The discriminator is the decision, not the digits.**
 
+For CI, do not hand-write the loop: `ci_settle <pr>` (mechanics below).
+
 So state it separately: pick **one** waiter for the condition and let it finish.
 Where the harness re-invokes on completion, waiting costs nothing and polling
 costs a turn per expiry — and every stacked waiter is a turn that arrives *after*

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -10,8 +10,14 @@ triggers:
   - keyword: "already decided"
   - keyword: "locked decision"
   - keyword: "budget blocks"
+  - keyword: "adr-"
+  - keyword: "adrs"
+  - keyword: "superseded"
+  - keyword: "review_trigger"
+  - phrase: "the adr"
 routes_to:
-  - "skill:decision-review"
+  - "skill:ai-council"
+  - "skill:decision-record"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 collision_ok:
@@ -28,35 +34,133 @@ obligation_frequency: "per-task"
 A LOCK IS A DECISION UNDER PAST CONDITIONS, NOT A PERMANENT LAW.
 BENEFIT BLOCKED BY A LOCK → SURFACE + OFFER RE-EVALUATION.
 NEVER SILENT COMPLIANCE. NEVER SILENT DROP OF A GOOD CHANGE.
+RE-EVALUATION GOES TO THE COUNCIL FIRST, NOT TO THE USER FIRST.
+THE USER IS REACHED FOR THE RESERVED SET — AND ALWAYS FOR IT.
+NEVER CITE A LOCK YOU HAVE NOT EVALUATED THIS TURN.
 ```
 
 An agent that finds a genuinely beneficial change blocked by a recorded
 past decision — an honest-null eval verdict, a "don't relitigate"
 memory or context note, a token-frugality/budget canon line, or an ADR —
-does not quietly comply and drop the change. It surfaces the conflict
-and offers the user a path to re-evaluate the lock. Progress means
-adaptation: locks encode what was true when they were written, not a
-ceiling on what the package may ever become.
+does not quietly comply and drop the change. It surfaces the conflict and
+re-evaluates the lock — **in the council by default**, reaching the user only
+for the reserved set below. Progress means adaptation: locks encode what was
+true when they were written, not a ceiling on what the package may ever become.
+
+**The default venue is the council, and this is a correction, not a new
+policy.** [`ai-council`](../skills/ai-council/SKILL.md) has said since its own
+Iron Law that *"a design decision the agent cannot settle from the tree goes to
+the council first, not to the user first"*, and its class table already lists
+"reopening a recorded decision". This rule used to say "offers the user a path",
+which contradicted that and made every lock an owner interrupt. The measured
+cost of the contradiction: across 26 days of transcripts, the agent reported a
+lock and waited, and the owner had to void the decision retroactively before the
+work resumed — in the two clearest cases the lock report is timestamped **before**
+the override demand. The ordering was the defect; the permission was never
+missing.
 
 **Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
 tested*, not every future proposal that resembles it — if the blocked change
 is a different mechanism, the lock does not apply; proceed, noting the
 distinction.
 
-Body migrated to [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md) (per P4 of `road-to-kernel-and-router.md`) — what-counts-as-a-lock catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs, hard structural caps), the five fire steps, when-NOT-to-fire, failure modes.
+## The five steps, carried here — the depth is elsewhere, the obligation is not
+
+1. **Mechanism-match** (above) — different mechanism, no lock, proceed.
+2. **Evaluate the lock before citing it.** An ADR may not be presented as a
+   reason not to act until its status, `review_trigger` state, amendments and
+   successors have been read. In this repository that is one command —
+   `./scripts-run src/scripts/adr_cite_check <ADR-NNN>`; elsewhere it is the
+   same four reads done by hand. A `superseded` / `deprecated` status means it is
+   not a live lock at all; a fired or indeterminate trigger means it is not an
+   **unqualified** one. `rejected` is NOT in the dead set — on an ADR it records
+   a rejected *proposal*, so the rejection binds until its premise is shown to
+   have changed.
+3. **Surface** the change, the lock, the condition it recorded, and what has
+   changed since.
+4. **Route it** — council by default (below), user only for the reserved set.
+5. **Record** the outcome with scope and `revisit-if`.
+
+These five are the obligation and they are stated here rather than only behind
+a route, because the route was measurably unreachable: `decision-revisit-gate`
+lives in the always-on `meta` pack while `decision-review` ships
+`install.default: false` in the non-default `analysis-workbench` pack, so a
+pack-legal install received the obligation and not the procedure. `routes_to`
+now names two always-on skills; the backward-audit depth in
+[`decision-review`](../skills/decision-review/SKILL.md) stays optional, which is
+the correct status for depth.
+
+Full catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs,
+hard structural caps), the per-step detail, when-NOT-to-fire and the failure
+modes remain in [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
+## Who decides — the owner-reserved set
+
+The discriminator, in one question: **does the proposed transition weaken an
+owner-reserved invariant, or create an undelegated external, irreversible, or
+destructive commitment?** No, and reversible inside the authorised envelope →
+the council decides. Yes, or not establishable from tree evidence → the owner.
+
+The routing unit is the **transition**, never the document: the same ADR may be
+strengthened by the council and weakened only by the owner.
+
+| Reserved to the owner | Council-decidable |
+|---|---|
+| Changes the project's purpose or a declared non-negotiable outcome | Any mechanism serving that purpose |
+| **Lowers or removes** a recorded security / privacy / safety / data-handling floor | Strengthening a floor, or an equivalent swap above it |
+| Irreversible or materially destructive | Reversible within the envelope |
+| Spend or liability **above** a delegated threshold | Budgeted, threshold-bounded spend |
+| Creates / removes / weakens a legal, regulatory, contractual, licensing, compatibility, or public commitment | Internal-only commitments |
+| Governance self-amendment — reopening authority, quorum, escalation, this set | What the rules already permit |
+| Cannot be bounded from available evidence | Bounded, with the evidence cited |
+
+Council split, abstention, or no quorum is an **escalation condition**, not a
+class: that transition escalates, the ADR does not become owner-reserved
+forever. Availability is `agent-config council:status`, never a project file
+([`council-availability`](council-availability.md)).
+
+Field on the ADR: `reopen_policy: directional | owner | unclassified`, absent →
+**`unclassified`**, which permits council investigation and reversible
+experiments and gates only execution of a reserved transition. Absent is
+deliberately not `owner`: with 146 accepted ADRs that default would encode
+today's blockage into the new schema. Full contract, the reopen record, and the
+precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../docs/contracts/adr-layout.md).
+
 ## See also
 
+- [`recurring-criticism`](recurring-criticism.md) — the **other entrance**: this
+  rule fires when a lock blocks a change, that one when the same criticism arrives
+  again. It reuses the five steps and the owner-reserved table below.
 - [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
   procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
 - [`decision-record`](../skills/decision-record/SKILL.md) — forward-flow decision
-  locking; the escalation litmus there names the reopening condition up front.
+  locking; its **§ 4 Lock the choice + consequences** requires the `Revisit-if:`
+  line that names the reopening condition up front. (This pointer used to cite an
+  "escalation litmus" heading; `grep` over `src/` + `docs/` returns two hits and
+  neither is in that file — the heading never existed, so the pointer led
+  nowhere. Corrected to the section that carries the obligation.)
 - [`token-budget-discipline`](token-budget-discipline.md) — the frugality-canon
   value-over-budget escalation this rule's budget-lock case defers to.
 - [`no-cheap-questions`](no-cheap-questions.md) — the question-quality floor a
   revisit-offer must still clear.
 - [`ask-when-uncertain`](ask-when-uncertain.md) — the numbered-options shape
   used to present the revisit offer.
+
+## Honest enforcement — `enforced_by: none`
+
+`adr_cite_check` is deterministic where it runs, and nothing makes it run. No
+gate can observe an agent citing a decision it never opened, so step 2 above is
+model-carried — the same honesty boundary
+[`security-sensitive-stop`](security-sensitive-stop.md) and
+[`active-remediation`](active-remediation.md) state for their own obligations.
+
+Two reach limits, named rather than implied. The tool lives in this repository's
+`src/scripts/` and is **not** exposed as an `agent-config` verb, so a consumer
+install performs step 2 by hand; wiring the verb touches six further surfaces
+plus the curated `dist/agent-src/scripts/` list and is deliberately out of this
+change. And `docs/decisions/` is projected into no agent-visible tree at all —
+the agent sees ADR *numbers* cited across rules and skills, almost never ADR
+*text*. Until that changes, "evaluate before citing" means opening the file.

package/dist/agent-src/rules/fix-what-you-see.md

@@ -0,0 +1,108 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "Saw a red check or a real defect — fix it, whoever wrote it; if you cannot, ship a tracked follow-up roadmap in the same change. Ownership is never a disposition"
+# Due when a defect is OBSERVED, not on a clock: a turn that sees nothing owes
+# nothing; a turn that sees a red check owes a disposition.
+obligation_frequency: "per-event"
+routes_to:
+  - "guideline:agent-infra/active-remediation-mechanics"
+triggers:
+  - keyword: "failing"
+  - keyword: "fails"
+  - keyword: "broken"
+  - keyword: "regression"
+  - phrase: "is red"
+  - phrase: "ci failed"
+  - phrase: "ci is"
+  - phrase: "not my"
+  - phrase: "nicht mein"
+  - phrase: "someone else's"
+  - phrase: "whose test"
+workspaces: [engineering]
+packs: [engineering-base]
+enforced_by:
+  - "none"
+---
+
+# Fix What You See
+
+## The Iron Law
+
+```
+YOU SAW IT, YOU FIX IT — WHOEVER WROTE IT.
+"NOT MY CODE" / "NOT MY TEST" / "ANOTHER SESSION OWNS THAT FILE" IS NOT A
+DISPOSITION. CANNOT FIX IT NOW → A TRACKED FOLLOW-UP ROADMAP SHIPS IN THE
+SAME CHANGE. A CHAT MENTION IS NOT ONE EITHER, NOR A "KNOWN-OPEN" LINE IN A
+PR BODY. A RED CHECK IS NEVER HANDED BACK WITH ITS CAUSE NAMED AND UNFIXED.
+```
+
+**Saw it** = a red check already in front of you (test, lint, type, CI), or a
+defect you pass while working — in your diff, a neighbouring file, a file
+another agent or a parallel session wrote. The author is irrelevant.
+
+**Two dispositions, and only two:** fix it with its verification, or land a
+roadmap under `agents/roadmaps/` in the SAME change naming the defect, its
+evidence, and what closes it.
+
+**Read the red before fixing it, with the narrowest tool.** A CI job:
+`gh run view --job <id> --log-failed | grep -E '×|FAIL|Error'` — never the whole
+log into context, and never `--watch`'s exit code, which is 0 even on a failure.
+A local red: the test runner with a filter on the one failing name, `tsc
+--noEmit` for a type error, the linter scoped to the changed files. **Reproduce
+it before you believe your diagnosis** — an environment-dependent red reproduces
+under the condition, not on your machine's defaults.
+
+Match the probe to the surface, because a passing unit test is not evidence for
+a broken surface: an HTTP red is proven with `curl` against the running
+endpoint, a UI red with a Playwright spec, a runtime red with the debugger
+(`xdebug`, breakpoints) rather than by reading the diff again.
+
+**Prove the fix with the same tool that showed the red**, in the same change.
+For a guard or a concurrency fix, prove SENSITIVITY too: neutralise the mechanism,
+watch the test fail, restore it. A test never seen red has unknown sensitivity.
+
+## Bounds
+
+Removes *ownership* as an excuse, not the diff limit:
+[`minimal-safe-diff`](minimal-safe-diff.md) still caps the change — too large
+IS the roadmap case. A fix crossing
+[`non-destructive-by-default`](non-destructive-by-default.md) still stops and
+asks; the ask becomes the work, not the exit.
+
+**Does NOT fire:** user fenced the scope this turn · no falsifiable break (a
+preference, not a red) · already decided by the user.
+
+## Why separate from `active-remediation`
+
+That rule forbids ignoring a spotted issue and its ladder permits **note + ask**.
+Two properties made it insufficient, both measured 2026-08-20: it is `type: auto`
+on `refactor`/`legacy`/`cleanup` triggers — **none of which a failing CI job
+matches**, so it does not load when the obligation matters most — and its
+note-and-ask tier is what let a session name a red check's cause, name the
+file's author, and hand it back still red.
+
+Mechanics (fix-now size criteria, follow-up shape) stay there; this rule only
+deletes the two escapes.
+
+## Honest activation gap — this rule is `auto`, and it wanted to be `always`
+
+It shipped `auto` for a budget reason, not a design one, and the gap that leaves
+is exactly the one it was written to close: **a red check the agent sees in tool
+output triggers nothing.** Keyword triggers match the PROMPT. So the rule loads
+when a human says "CI is red" or "not my test", and does NOT load when a test
+run comes back red and nobody has said a word.
+
+`check_always_budget` is the reason: the extended always-budget sat at
+60,252 / 60,254 chars — **two characters of headroom** — and the cap is a
+ratchet that may only move down. The other nine always-rules are the kernel,
+which `block_kernel_rule_writes` denies agent writes to, so no room can be made
+from this side. A 2,332-char rule puts the total at 103.9 %.
+
+Closing the gap needs one of: the ext-cap ratchet opened deliberately (a
+maintainer decision, recorded), a kernel rule shortened to make room, or a
+`post_tool_use` carrier that notices a non-zero verification exit — the only
+option that would fire on tool output rather than on wording. Until then, `auto`
+plus this paragraph is the honest state: the obligation is real, its delivery is
+partial, and the partiality is named rather than implied away.

package/dist/agent-src/rules/no-roadmap-references.md

@@ -3,11 +3,6 @@ type: "auto"
 tier: "mechanical-already"
 description: "Linking transient files (agents/roadmaps/, agents/runtime/council/) from stable artifacts — both expire; promote findings"
 alwaysApply: false
-triggers:
-  - path_prefix: "agents/roadmaps/"
-  - path_prefix: "agents/runtime/council/questions/"
-  - path_prefix: "agents/runtime/council/responses/"
-  - path_prefix: "agents/runtime/council/sessions/"
 routes_to:
   - "skill:ai-council"
   - "skill:agent-docs-writing"

package/dist/agent-src/rules/recurring-criticism.md

@@ -0,0 +1,110 @@
+---
+type: "auto"
+tier: "2b"
+description: "The same criticism arriving again indicts the system, not only the item — reopen the disposition that dismissed it, resolve on evidence, never on the repetition count"
+alwaysApply: false
+triggers:
+  - phrase: "schon mehrfach"
+  - phrase: "schon wieder"
+  - phrase: "zum dritten mal"
+  - phrase: "wie oft noch"
+  - phrase: "wie oft soll ich"
+  - phrase: "immer noch nicht"
+  - phrase: "i already told you"
+  - phrase: "told you this"
+  - phrase: "how many times"
+  - phrase: "as i mentioned before"
+routes_to:
+  - "guideline:agent-infra/recurring-criticism-mechanics"
+  - "skill:skill-improvement-pipeline"
+workspaces: [agent-config-maintainer, engineering]
+packs: [meta]
+collision_ok:
+  "schon wieder": "active-remediation makes a user 'leave it' terminal against the AGENT re-raising a closed item; this rule fires only when the USER brings it back — a decision-maker reopening their own decision is not the nagging that rule prevents"
+obligation_frequency: "per-task"
+---
+
+# Recurring Criticism
+
+[`decision-revisit-gate`](decision-revisit-gate.md) has one entrance: the agent
+wants to act and a lock is in the way. This is the other — **the same criticism
+arrives again**, from the user or from a re-arrived artifact.
+
+## The Iron Law
+
+```
+THE SAME CRITICISM ARRIVING AGAIN IS EVIDENCE ABOUT THE SYSTEM,
+NOT ONLY ABOUT THE ITEM.
+REOPEN THE DISPOSITION THAT DISMISSED IT. NAME WHICH ASSUMPTION BROKE.
+NEVER RESOLVE IT ON THE REPETITION COUNT — RESOLVE IT ON EVIDENCE.
+CAPITULATING BECAUSE IT WAS SAID TWICE IS THE SAME FAILURE
+AS DISMISSING IT TWICE.
+A LEARNING THAT DOES NOT CONSTRAIN THE NEXT RUN IS NOT A LEARNING.
+NEVER BUY A HARDENING BY WEAKENING A SAFETY FLOOR.
+```
+
+**The repetition reverses the burden of proof.** The standing rule is: same
+mechanism, no new evidence → the lock applies. Recurrence *is* the new evidence —
+not that the item is right, that the disposition did not hold. Whoever keeps the
+lock now carries the argument. **Mechanism-match still runs first**: a complaint
+resembling the old one but testing a different mechanism is a new finding.
+
+**Resolve on evidence, never on the count.** Challenging a model's answer —
+including a correct one — reliably makes it capitulate and revise toward the
+perceived expectation rather than toward truth
+<!-- harvest:reflection-sycophancy-flipflop -->, so a rule reading "said twice" as
+proof of error would be that failure mode with a procedure attached. The
+repetition opens the question; it never answers it.
+
+## Exactly three outcomes
+
+The repetition proves the **system** failed <!-- harvest:recurrence-indicts-the-system -->;
+it does not prove the **decision** was wrong. Own analysis, from that split:
+
+| Outcome | What actually broke | Hardening means |
+|---|---|---|
+| The disposition was **wrong** | the decision | reverse it, record what would have caught it |
+| **Right, never recorded** | the record | make it durable + citable, with `revisit-if` |
+| **Right, recorded, unreachable** | reachability | move it onto a surface the next run reads |
+
+In all three the system failed — only in the first was the decision wrong. A
+resolution naming none of them is an unresolved recurrence.
+
+**Look up the earlier disposition before re-deriving anything, and name the store
+you checked** — addresses, the mechanism-is-the-defect classification, the
+hardening floor and the failure modes are in
+[`recurring-criticism-mechanics`](../docs/guidelines/agent-infra/recurring-criticism-mechanics.md).
+One line does not migrate, because acting on it wrong is silent: rejections live in
+analysis prose by design, so "I found nothing" means *prose was grepped*, never
+*nothing was decided*.
+
+## When NOT to fire
+
+- **A repeated task instruction**, not a criticism — that is an instruction, do it.
+- **Mechanism-match fails** — a resemblance is not a recurrence.
+- **The agent is the one repeating** — that is [`no-cheap-questions`](no-cheap-questions.md).
+- **Already resolved this task.** Once decided, it is decided.
+
+## Honest enforcement — `enforced_by: none`
+
+One narrow deterministic signal exists. `src/scripts/_lib/self_repair.ts` keeps one
+record per defect fingerprint with an `occurrences` counter and reopens a released
+record when the user re-reports it — literally this rule's trigger state — and the
+injected queue line now carries that number, so above 1 an agent sees it. Three
+limits: `agents/runtime/` is gitignored, so the store is one machine's and empty on
+a fresh checkout; it covers only defects the complaint detector matched, where a
+phrasing outside the added patterns is a paraphrase away from silence; and it is
+hook-carried, so on a host without the slot nothing fires.
+
+The rest is model-carried, named rather than implied: **nothing** observes whether
+the earlier disposition was opened, for rejections there is nothing structured to
+open, and no gate can tell a resolution that named one of the three outcomes from
+one that asserted it. Claiming the counter as coverage for any of that would
+inflate it, so it is not claimed — skipping this rule is caught by nothing.
+
+## See also
+
+- [`decision-revisit-gate`](decision-revisit-gate.md) — the other entrance; owns the five steps and the owner-reserved routing this rule reuses instead of restating. Separate file only because that one sits four lines under the 200-line cap.
+- [`self-repair-loop`](self-repair-loop.md) — the single-occurrence intake; this rule is what its `occurrences` counter is for.
+- [`active-remediation`](active-remediation.md) — the terminal "leave it" this rule does not override (see `collision_ok`).
+- [`/analyze:inbox`](../domains/analysis-workbench/analyze/inbox/command.md) § Phase 4c — the artifact-side detection that routes here.

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -29,7 +29,7 @@ ANY ROADMAP TOUCH → REGENERATE THE DASHBOARD, SAME RESPONSE.
 NO EXCEPTIONS. NO "I'LL DO IT AT THE END". NO BATCHING ACROSS TURNS.
 ```
 
-Roadmap touch = create / rename / delete / move file, add/rename/remove a phase, OR flip any checkbox (`[ ]` ↔ `[x]` ↔ `[~]` ↔ `[-]`). Regen command: `./agent-config roadmap:progress`. Archive (`git mv` → `archive/`) the moment `count_open == 0` — same response.
+Roadmap touch = create / rename / delete / move file, add/rename/remove a phase, OR flip any checkbox (`[ ]` ↔ `[x]` ↔ `[~]` ↔ `[-]`). Regen command: `./agent-config roadmap:progress` — it passes `--archive`, so a roadmap at `count_open == 0` with no deferred item and no open blocker is `git mv`'d to `archive/` by the same run, not reported for someone to do later. `--check` never archives, and the PostToolUse hook never archives (contract + the council's recorded dissent: the `--archive` block in `update_roadmap_progress.ts`).
 
 ## Iron Law 2 — real-time checkbox cadence (autonomous execution)
 

package/dist/agent-src/rules/rule-type-governance.md

@@ -2,8 +2,6 @@
 type: "auto"
 tier: "2a"
 description: "Creating/editing rules, or auditing rule types — decides when a rule should be always vs auto"
-triggers:
-  - path_prefix: "src/rules/"
 routes_to:
   - "guideline:agent-infra/rule-type-governance"
 workspaces: [agent-config-maintainer]

package/dist/agent-src/rules/self-repair-loop.md

@@ -52,6 +52,16 @@ work, not a notification:
    the user's call, per
    [`non-destructive-by-default`](non-destructive-by-default.md).
 
+**When the line says the record has recurred, step 2 changes target.** The store
+keeps one record per fingerprint and increments it, so a repeat does not raise
+`count` — the line now carries the newest record's `occurrences` instead, and
+above 1 it is the only deterministic "this came back" signal in the session. A
+recurrence means the *earlier* fix or dismissal did not hold, so the surface that
+failed is the one that let it be closed prematurely, not only the one that let the
+behaviour happen. Resolve it through
+[`recurring-criticism`](recurring-criticism.md) — which also states the part that
+matters most here: resolve on evidence, never on the repetition count.
+
 ## Correct openly, never silently
 
 Reported by the user → redo the task properly in the same turn, visibly, saying
@@ -84,6 +94,13 @@ The user is criticising the **code**, not the agent's conduct; the fingerprint
 is already an open record (the hook increments it); or a one-off caused by
 information the agent could not have had — note it, do not queue it.
 
+**The already-an-open-record case suppresses a duplicate QUEUE ENTRY, never the
+response.** Read on its own the clause above inverts into "it came back, so do
+nothing new", which is the opposite of what a repeat means. The counter exists
+precisely so a recurrence is visible without a second entry: no new record, and a
+**stronger** obligation — [`recurring-criticism`](recurring-criticism.md) fires,
+because the earlier disposition demonstrably did not hold.
+
 ## Enforcement
 
 The hook is `fail_closed: false` and always exits 0: it records, it never

package/dist/agent-src/rules/skill-quality.md

@@ -2,8 +2,6 @@
 type: "auto"
 tier: "mechanical-already"
 description: "Creating/editing/reviewing skills — minimum quality standard; every skill executable, validated, self-contained"
-triggers:
-  - path_prefix: "src/skills/"
 routes_to:
   - "guideline:agent-infra/skill-quality-checklist"
 workspaces: [agent-config-maintainer]