@event4u/agent-config 14.6.0 → 14.8.0

package/dist/agent-src/rules/artifact-drafting-protocol.md

@@ -55,8 +55,12 @@ Fires once per creation task, not once per edit.
 - At most two propose → reject cycles; then stop.
 - Commit only on approval.
 - Bypass is legitimate — *"just write it"* drops the protocol immediately.
+- An artifact discovered **after** an accepted contract halts by default;
+  `late_artifacts: auto-research` is the only declared value that continues,
+  capped at three per run (mechanics guideline § Late artifacts).
 
-Body migrated to [`guideline:agent-infra/artifact-drafting-protocol-mechanics`](../docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — Phase A/B/C procedure detail + the roadmap-run batch-mode carve-out (Research-once-at-contract-time, batch scope, no `artifact_protocol: skip`).
+Body migrated to [`guideline:agent-infra/artifact-drafting-protocol-mechanics`](../docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — Phase A/B/C procedure detail + the roadmap-run batch-mode carve-out (Research-once-at-contract-time, batch scope, no `artifact_protocol: skip`) + § Late artifacts (the `halt` default
+and the five-step `auto-research` procedure).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 Extends (cross-link, don't restate): `ask-when-uncertain`,

package/dist/agent-src/rules/context-hygiene.md

@@ -93,6 +93,8 @@ one shape the loop test above systematically misses, in both of its clauses.
   available were wait, or stop and report, and 34 licensed neither more than 31
   did. **The discriminator is the decision, not the digits.**
 
+For CI, do not hand-write the loop: `ci_settle <pr>` (mechanics below).
+
 So state it separately: pick **one** waiter for the condition and let it finish.
 Where the harness re-invokes on completion, waiting costs nothing and polling
 costs a turn per expiry — and every stacked waiter is a turn that arrives *after*

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -39,25 +39,21 @@ THE USER IS REACHED FOR THE RESERVED SET — AND ALWAYS FOR IT.
 NEVER CITE A LOCK YOU HAVE NOT EVALUATED THIS TURN.
 ```
 
-An agent that finds a genuinely beneficial change blocked by a recorded
-past decision — an honest-null eval verdict, a "don't relitigate"
-memory or context note, a token-frugality/budget canon line, or an ADR —
-does not quietly comply and drop the change. It surfaces the conflict and
-re-evaluates the lock — **in the council by default**, reaching the user only
-for the reserved set below. Progress means adaptation: locks encode what was
-true when they were written, not a ceiling on what the package may ever become.
+An agent that finds a beneficial change blocked by a recorded decision — an
+honest-null verdict, a "don't relitigate" note, a budget-canon line, or an ADR —
+does not quietly comply and drop it. It surfaces the conflict and re-evaluates
+the lock **in the council by default**, reaching the user only for the reserved
+set below. Locks encode what was true when they were written, not a ceiling on
+what the package may ever become.
 
 **The default venue is the council, and this is a correction, not a new
-policy.** [`ai-council`](../skills/ai-council/SKILL.md) has said since its own
-Iron Law that *"a design decision the agent cannot settle from the tree goes to
-the council first, not to the user first"*, and its class table already lists
-"reopening a recorded decision". This rule used to say "offers the user a path",
-which contradicted that and made every lock an owner interrupt. The measured
-cost of the contradiction: across 26 days of transcripts, the agent reported a
-lock and waited, and the owner had to void the decision retroactively before the
-work resumed — in the two clearest cases the lock report is timestamped **before**
-the override demand. The ordering was the defect; the permission was never
-missing.
+policy.** [`ai-council`](../skills/ai-council/SKILL.md)'s Iron Law already sends
+a decision the agent cannot settle from the tree to the council first, and its
+class table lists "reopening a recorded decision". The old "offers the user a
+path" wording made every lock an owner interrupt; measured across 26 days of
+transcripts, the agent reported a lock and waited while the owner voided the
+decision retroactively — twice with the lock report timestamped **before** the
+override demand. The ordering was the defect; the permission was never missing.
 
 **Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
 tested*, not every future proposal that resembles it — if the blocked change
@@ -81,20 +77,54 @@ distinction.
 4. **Route it** — council by default (below), user only for the reserved set.
 5. **Record** the outcome with scope and `revisit-if`.
 
-These five are the obligation and they are stated here rather than only behind
-a route, because the route was measurably unreachable: `decision-revisit-gate`
-lives in the always-on `meta` pack while `decision-review` ships
-`install.default: false` in the non-default `analysis-workbench` pack, so a
-pack-legal install received the obligation and not the procedure. `routes_to`
-now names two always-on skills; the backward-audit depth in
-[`decision-review`](../skills/decision-review/SKILL.md) stays optional, which is
-the correct status for depth.
+The five are stated here, not only behind a route, because the route was
+measurably unreachable: `decision-review` ships `install.default: false` in the
+non-default `analysis-workbench` pack, so a pack-legal install received the
+obligation and not the procedure. `routes_to` now names two always-on skills;
+the backward-audit depth in
+[`decision-review`](../skills/decision-review/SKILL.md) stays optional.
 
 Full catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs,
 hard structural caps), the per-step detail, when-NOT-to-fire and the failure
 modes remain in [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
+## Reading a lock — the two descriptive axes
+
+Step 2 reads, in order: **effective state** (status · amendments · successors) →
+**provenance** → **evidence strength** → **discovery** → **current evidence**
+(does the basis still resolve in a clone?) → **reversibility of the proposed
+transition** → **reserved dimensions**. `adr_cite_check` prints six of them —
+read 6 is the agent's, because reversibility belongs to the proposed transition
+and no tool reading one record supplies it. What each field means, and what a
+`[found]` basis ref does NOT claim, is in that script's module docstring. The
+evidence-priced burden table stays in
+[`adr-layout § The reopen record`](../docs/contracts/adr-layout.md).
+
+```
+A GRADE IS A MEASUREMENT, NOT A PERMISSION — IT GRANTS NOTHING.
+CITING AN E0 LOCK AS A HARD BLOCKER WITHOUT SURFACING ITS GRADE IS A VIOLATION.
+NO GRADE LETS AN AGENT SUPERSEDE A RECORD, SKIP A COUNCIL, OR TAKE ANY ACTION
+IT COULD NOT TAKE YESTERDAY. THE COUNCIL-FIRST VENUE STAYS, AT EVERY GRADE.
+AN ADR'S HISTORICAL DECISION-MAKER DOES NOT DETERMINE ITS REOPEN VENUE.
+A LOW-EVIDENCE RECORD MAY STATE A DECISION; IT DOES NOT ESTABLISH THAT ITS
+ALTERNATIVES REMAIN INVALID.
+```
+
+Venue comes from the proposed transition, the trust boundaries it touches and
+the reserved dimensions below — never from who decided originally, and never
+from a grade. A weak grade changes how much a reopen must **do**, never who may
+do it: `authority_basis: owner_intent` is surfaced with its accumulated cost and
+never overruled, and council agreement never raises `evidence.strength` —
+sources and measurements do.
+
+**No E0/E1 agent path is enabled here, and no reading of this rule enables
+one.** Whether an independently validated grade may ever reduce the
+*authorization* burden is an owner-reserved open question — the
+`authority-coupling-decision` blocker — left unanswered because the party
+assigning a grade would be the party gaining authority from it, and would be
+self-classifying the transition as reversible-internal on top.
+
 ## Who decides — the owner-reserved set
 
 The discriminator, in one question: **does the proposed transition weaken an
@@ -121,24 +151,24 @@ forever. Availability is `agent-config council:status`, never a project file
 ([`council-availability`](council-availability.md)).
 
 Field on the ADR: `reopen_policy: directional | owner | unclassified`, absent →
-**`unclassified`**, which permits council investigation and reversible
-experiments and gates only execution of a reserved transition. Absent is
+**`unclassified`** — council investigation and reversible experiments are
+permitted; only execution of a reserved transition is gated. Absent is
 deliberately not `owner`: with 146 accepted ADRs that default would encode
-today's blockage into the new schema. Full contract, the reopen record, and the
+today's blockage into the new schema. Full contract, the reopen record and the
 precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../docs/contracts/adr-layout.md).
 
 ## See also
 
+- [`recurring-criticism`](recurring-criticism.md) — the **other entrance**: this
+  rule fires when a lock blocks a change, that one when the same criticism arrives
+  again. It reuses the five steps and the owner-reserved table above.
 - [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
   procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
 - [`decision-record`](../skills/decision-record/SKILL.md) — forward-flow decision
   locking; its **§ 4 Lock the choice + consequences** requires the `Revisit-if:`
-  line that names the reopening condition up front. (This pointer used to cite an
-  "escalation litmus" heading; `grep` over `src/` + `docs/` returns two hits and
-  neither is in that file — the heading never existed, so the pointer led
-  nowhere. Corrected to the section that carries the obligation.)
+  line that names the reopening condition up front.
 - [`token-budget-discipline`](token-budget-discipline.md) — the frugality-canon
   value-over-budget escalation this rule's budget-lock case defers to.
 - [`no-cheap-questions`](no-cheap-questions.md) — the question-quality floor a
@@ -161,3 +191,8 @@ plus the curated `dist/agent-src/scripts/` list and is deliberately out of this
 change. And `docs/decisions/` is projected into no agent-visible tree at all —
 the agent sees ADR *numbers* cited across rules and skills, almost never ADR
 *text*. Until that changes, "evaluate before citing" means opening the file.
+
+`docs/contracts/` is unprojected on the same terms (`dist/agent-src/` carries no
+`docs/`), so the burden table this rule points at is maintainer-reachable only.
+That is why the reserved-set table above stays here rather than becoming a
+pointer: a consumer install receives these lines and not the contract.

package/dist/agent-src/rules/fix-what-you-see.md

@@ -0,0 +1,108 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "Saw a red check or a real defect — fix it, whoever wrote it; if you cannot, ship a tracked follow-up roadmap in the same change. Ownership is never a disposition"
+# Due when a defect is OBSERVED, not on a clock: a turn that sees nothing owes
+# nothing; a turn that sees a red check owes a disposition.
+obligation_frequency: "per-event"
+routes_to:
+  - "guideline:agent-infra/active-remediation-mechanics"
+triggers:
+  - keyword: "failing"
+  - keyword: "fails"
+  - keyword: "broken"
+  - keyword: "regression"
+  - phrase: "is red"
+  - phrase: "ci failed"
+  - phrase: "ci is"
+  - phrase: "not my"
+  - phrase: "nicht mein"
+  - phrase: "someone else's"
+  - phrase: "whose test"
+workspaces: [engineering]
+packs: [engineering-base]
+enforced_by:
+  - "none"
+---
+
+# Fix What You See
+
+## The Iron Law
+
+```
+YOU SAW IT, YOU FIX IT — WHOEVER WROTE IT.
+"NOT MY CODE" / "NOT MY TEST" / "ANOTHER SESSION OWNS THAT FILE" IS NOT A
+DISPOSITION. CANNOT FIX IT NOW → A TRACKED FOLLOW-UP ROADMAP SHIPS IN THE
+SAME CHANGE. A CHAT MENTION IS NOT ONE EITHER, NOR A "KNOWN-OPEN" LINE IN A
+PR BODY. A RED CHECK IS NEVER HANDED BACK WITH ITS CAUSE NAMED AND UNFIXED.
+```
+
+**Saw it** = a red check already in front of you (test, lint, type, CI), or a
+defect you pass while working — in your diff, a neighbouring file, a file
+another agent or a parallel session wrote. The author is irrelevant.
+
+**Two dispositions, and only two:** fix it with its verification, or land a
+roadmap under `agents/roadmaps/` in the SAME change naming the defect, its
+evidence, and what closes it.
+
+**Read the red before fixing it, with the narrowest tool.** A CI job:
+`gh run view --job <id> --log-failed | grep -E '×|FAIL|Error'` — never the whole
+log into context, and never `--watch`'s exit code, which is 0 even on a failure.
+A local red: the test runner with a filter on the one failing name, `tsc
+--noEmit` for a type error, the linter scoped to the changed files. **Reproduce
+it before you believe your diagnosis** — an environment-dependent red reproduces
+under the condition, not on your machine's defaults.
+
+Match the probe to the surface, because a passing unit test is not evidence for
+a broken surface: an HTTP red is proven with `curl` against the running
+endpoint, a UI red with a Playwright spec, a runtime red with the debugger
+(`xdebug`, breakpoints) rather than by reading the diff again.
+
+**Prove the fix with the same tool that showed the red**, in the same change.
+For a guard or a concurrency fix, prove SENSITIVITY too: neutralise the mechanism,
+watch the test fail, restore it. A test never seen red has unknown sensitivity.
+
+## Bounds
+
+Removes *ownership* as an excuse, not the diff limit:
+[`minimal-safe-diff`](minimal-safe-diff.md) still caps the change — too large
+IS the roadmap case. A fix crossing
+[`non-destructive-by-default`](non-destructive-by-default.md) still stops and
+asks; the ask becomes the work, not the exit.
+
+**Does NOT fire:** user fenced the scope this turn · no falsifiable break (a
+preference, not a red) · already decided by the user.
+
+## Why separate from `active-remediation`
+
+That rule forbids ignoring a spotted issue and its ladder permits **note + ask**.
+Two properties made it insufficient, both measured 2026-08-20: it is `type: auto`
+on `refactor`/`legacy`/`cleanup` triggers — **none of which a failing CI job
+matches**, so it does not load when the obligation matters most — and its
+note-and-ask tier is what let a session name a red check's cause, name the
+file's author, and hand it back still red.
+
+Mechanics (fix-now size criteria, follow-up shape) stay there; this rule only
+deletes the two escapes.
+
+## Honest activation gap — this rule is `auto`, and it wanted to be `always`
+
+It shipped `auto` for a budget reason, not a design one, and the gap that leaves
+is exactly the one it was written to close: **a red check the agent sees in tool
+output triggers nothing.** Keyword triggers match the PROMPT. So the rule loads
+when a human says "CI is red" or "not my test", and does NOT load when a test
+run comes back red and nobody has said a word.
+
+`check_always_budget` is the reason: the extended always-budget sat at
+60,252 / 60,254 chars — **two characters of headroom** — and the cap is a
+ratchet that may only move down. The other nine always-rules are the kernel,
+which `block_kernel_rule_writes` denies agent writes to, so no room can be made
+from this side. A 2,332-char rule puts the total at 103.9 %.
+
+Closing the gap needs one of: the ext-cap ratchet opened deliberately (a
+maintainer decision, recorded), a kernel rule shortened to make room, or a
+`post_tool_use` carrier that notices a non-zero verification exit — the only
+option that would fire on tool output rather than on wording. Until then, `auto`
+plus this paragraph is the honest state: the obligation is real, its delivery is
+partial, and the partiality is named rather than implied away.

package/dist/agent-src/rules/no-roadmap-references.md

@@ -3,11 +3,6 @@ type: "auto"
 tier: "mechanical-already"
 description: "Linking transient files (agents/roadmaps/, agents/runtime/council/) from stable artifacts — both expire; promote findings"
 alwaysApply: false
-triggers:
-  - path_prefix: "agents/roadmaps/"
-  - path_prefix: "agents/runtime/council/questions/"
-  - path_prefix: "agents/runtime/council/responses/"
-  - path_prefix: "agents/runtime/council/sessions/"
 routes_to:
   - "skill:ai-council"
   - "skill:agent-docs-writing"

package/dist/agent-src/rules/recurring-criticism.md

@@ -0,0 +1,110 @@
+---
+type: "auto"
+tier: "2b"
+description: "The same criticism arriving again indicts the system, not only the item — reopen the disposition that dismissed it, resolve on evidence, never on the repetition count"
+alwaysApply: false
+triggers:
+  - phrase: "schon mehrfach"
+  - phrase: "schon wieder"
+  - phrase: "zum dritten mal"
+  - phrase: "wie oft noch"
+  - phrase: "wie oft soll ich"
+  - phrase: "immer noch nicht"
+  - phrase: "i already told you"
+  - phrase: "told you this"
+  - phrase: "how many times"
+  - phrase: "as i mentioned before"
+routes_to:
+  - "guideline:agent-infra/recurring-criticism-mechanics"
+  - "skill:skill-improvement-pipeline"
+workspaces: [agent-config-maintainer, engineering]
+packs: [meta]
+collision_ok:
+  "schon wieder": "active-remediation makes a user 'leave it' terminal against the AGENT re-raising a closed item; this rule fires only when the USER brings it back — a decision-maker reopening their own decision is not the nagging that rule prevents"
+obligation_frequency: "per-task"
+---
+
+# Recurring Criticism
+
+[`decision-revisit-gate`](decision-revisit-gate.md) has one entrance: the agent
+wants to act and a lock is in the way. This is the other — **the same criticism
+arrives again**, from the user or from a re-arrived artifact.
+
+## The Iron Law
+
+```
+THE SAME CRITICISM ARRIVING AGAIN IS EVIDENCE ABOUT THE SYSTEM,
+NOT ONLY ABOUT THE ITEM.
+REOPEN THE DISPOSITION THAT DISMISSED IT. NAME WHICH ASSUMPTION BROKE.
+NEVER RESOLVE IT ON THE REPETITION COUNT — RESOLVE IT ON EVIDENCE.
+CAPITULATING BECAUSE IT WAS SAID TWICE IS THE SAME FAILURE
+AS DISMISSING IT TWICE.
+A LEARNING THAT DOES NOT CONSTRAIN THE NEXT RUN IS NOT A LEARNING.
+NEVER BUY A HARDENING BY WEAKENING A SAFETY FLOOR.
+```
+
+**The repetition reverses the burden of proof.** The standing rule is: same
+mechanism, no new evidence → the lock applies. Recurrence *is* the new evidence —
+not that the item is right, that the disposition did not hold. Whoever keeps the
+lock now carries the argument. **Mechanism-match still runs first**: a complaint
+resembling the old one but testing a different mechanism is a new finding.
+
+**Resolve on evidence, never on the count.** Challenging a model's answer —
+including a correct one — reliably makes it capitulate and revise toward the
+perceived expectation rather than toward truth
+<!-- harvest:reflection-sycophancy-flipflop -->, so a rule reading "said twice" as
+proof of error would be that failure mode with a procedure attached. The
+repetition opens the question; it never answers it.
+
+## Exactly three outcomes
+
+The repetition proves the **system** failed <!-- harvest:recurrence-indicts-the-system -->;
+it does not prove the **decision** was wrong. Own analysis, from that split:
+
+| Outcome | What actually broke | Hardening means |
+|---|---|---|
+| The disposition was **wrong** | the decision | reverse it, record what would have caught it |
+| **Right, never recorded** | the record | make it durable + citable, with `revisit-if` |
+| **Right, recorded, unreachable** | reachability | move it onto a surface the next run reads |
+
+In all three the system failed — only in the first was the decision wrong. A
+resolution naming none of them is an unresolved recurrence.
+
+**Look up the earlier disposition before re-deriving anything, and name the store
+you checked** — addresses, the mechanism-is-the-defect classification, the
+hardening floor and the failure modes are in
+[`recurring-criticism-mechanics`](../docs/guidelines/agent-infra/recurring-criticism-mechanics.md).
+One line does not migrate, because acting on it wrong is silent: rejections live in
+analysis prose by design, so "I found nothing" means *prose was grepped*, never
+*nothing was decided*.
+
+## When NOT to fire
+
+- **A repeated task instruction**, not a criticism — that is an instruction, do it.
+- **Mechanism-match fails** — a resemblance is not a recurrence.
+- **The agent is the one repeating** — that is [`no-cheap-questions`](no-cheap-questions.md).
+- **Already resolved this task.** Once decided, it is decided.
+
+## Honest enforcement — `enforced_by: none`
+
+One narrow deterministic signal exists. `src/scripts/_lib/self_repair.ts` keeps one
+record per defect fingerprint with an `occurrences` counter and reopens a released
+record when the user re-reports it — literally this rule's trigger state — and the
+injected queue line now carries that number, so above 1 an agent sees it. Three
+limits: `agents/runtime/` is gitignored, so the store is one machine's and empty on
+a fresh checkout; it covers only defects the complaint detector matched, where a
+phrasing outside the added patterns is a paraphrase away from silence; and it is
+hook-carried, so on a host without the slot nothing fires.
+
+The rest is model-carried, named rather than implied: **nothing** observes whether
+the earlier disposition was opened, for rejections there is nothing structured to
+open, and no gate can tell a resolution that named one of the three outcomes from
+one that asserted it. Claiming the counter as coverage for any of that would
+inflate it, so it is not claimed — skipping this rule is caught by nothing.
+
+## See also
+
+- [`decision-revisit-gate`](decision-revisit-gate.md) — the other entrance; owns the five steps and the owner-reserved routing this rule reuses instead of restating. Separate file only because that one sits four lines under the 200-line cap.
+- [`self-repair-loop`](self-repair-loop.md) — the single-occurrence intake; this rule is what its `occurrences` counter is for.
+- [`active-remediation`](active-remediation.md) — the terminal "leave it" this rule does not override (see `collision_ok`).
+- [`/analyze:inbox`](../commands/analyze/inbox.md) § Phase 4c — the artifact-side detection that routes here.

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -29,7 +29,7 @@ ANY ROADMAP TOUCH → REGENERATE THE DASHBOARD, SAME RESPONSE.
 NO EXCEPTIONS. NO "I'LL DO IT AT THE END". NO BATCHING ACROSS TURNS.
 ```
 
-Roadmap touch = create / rename / delete / move file, add/rename/remove a phase, OR flip any checkbox (`[ ]` ↔ `[x]` ↔ `[~]` ↔ `[-]`). Regen command: `./agent-config roadmap:progress`. Archive (`git mv` → `archive/`) the moment `count_open == 0` — same response.
+Roadmap touch = create / rename / delete / move file, add/rename/remove a phase, OR flip any checkbox (`[ ]` ↔ `[x]` ↔ `[~]` ↔ `[-]`). Regen command: `./agent-config roadmap:progress` — it passes `--archive`, so a roadmap at `count_open == 0` with no deferred item and no open blocker is `git mv`'d to `archive/` by the same run, not reported for someone to do later. `--check` never archives, and the PostToolUse hook never archives (contract + the council's recorded dissent: the `--archive` block in `update_roadmap_progress.ts`).
 
 ## Iron Law 2 — real-time checkbox cadence (autonomous execution)
 
@@ -97,6 +97,25 @@ in the estate?**
   [`no-cheap-questions`](no-cheap-questions.md) forbids. The gate protects the
   item, not the maintainer's attention.
 
+### `deferred_policy` — a declared contract removes the round, never the route
+
+An accepted execution contract may declare `deferred_policy`
+([`roadmap-execution-contract § 2b`](../contexts/execution/roadmap-execution-contract.md)).
+It changes **when the round happens**, never **who decides**:
+
+| Declared | Effect on the gate |
+|---|---|
+| absent / `wait` | Unchanged — the synchronous menu runs. |
+| `spawn-follow-up-draft` | The council-routed carry disposition runs **automatically** at closure, with no options round. Legal only because the table above already routes it to the council and Accept pre-authorized the run. |
+| `cancel-with-memo` | The run writes the memo and the recommendation; the `[-]` conversion stays **user**. A declared field never moves a row from user to council. |
+
+Recorded-or-it-did-not-happen applies unchanged to an automatic spawn, and
+fail-closed binds hardest here: a spawn naming a follow-up that does not exist
+yet reaches the user, because a contract cannot pre-authorize a promise.
+Reversible — `wait` is the default, so removing the field restores always-wait
+(`decision 2026-08-20`, AI council 2/2; record
+`agents/evidence/council/drain-blocker-dispositions-a.md`).
+
 ## Later disposition — blocked-for-later roadmaps are parked, never left active
 
 ```

package/dist/agent-src/rules/rule-type-governance.md

@@ -2,8 +2,6 @@
 type: "auto"
 tier: "2a"
 description: "Creating/editing rules, or auditing rule types — decides when a rule should be always vs auto"
-triggers:
-  - path_prefix: "src/rules/"
 routes_to:
   - "guideline:agent-infra/rule-type-governance"
 workspaces: [agent-config-maintainer]

package/dist/agent-src/rules/self-repair-loop.md

@@ -52,6 +52,16 @@ work, not a notification:
    the user's call, per
    [`non-destructive-by-default`](non-destructive-by-default.md).
 
+**When the line says the record has recurred, step 2 changes target.** The store
+keeps one record per fingerprint and increments it, so a repeat does not raise
+`count` — the line now carries the newest record's `occurrences` instead, and
+above 1 it is the only deterministic "this came back" signal in the session. A
+recurrence means the *earlier* fix or dismissal did not hold, so the surface that
+failed is the one that let it be closed prematurely, not only the one that let the
+behaviour happen. Resolve it through
+[`recurring-criticism`](recurring-criticism.md) — which also states the part that
+matters most here: resolve on evidence, never on the repetition count.
+
 ## Correct openly, never silently
 
 Reported by the user → redo the task properly in the same turn, visibly, saying
@@ -84,6 +94,13 @@ The user is criticising the **code**, not the agent's conduct; the fingerprint
 is already an open record (the hook increments it); or a one-off caused by
 information the agent could not have had — note it, do not queue it.
 
+**The already-an-open-record case suppresses a duplicate QUEUE ENTRY, never the
+response.** Read on its own the clause above inverts into "it came back, so do
+nothing new", which is the opposite of what a repeat means. The counter exists
+precisely so a recurrence is visible without a second entry: no new record, and a
+**stronger** obligation — [`recurring-criticism`](recurring-criticism.md) fires,
+because the earlier disposition demonstrably did not hold.
+
 ## Enforcement
 
 The hook is `fail_closed: false` and always exits 0: it records, it never

package/dist/agent-src/rules/skill-quality.md

@@ -2,8 +2,6 @@
 type: "auto"
 tier: "mechanical-already"
 description: "Creating/editing/reviewing skills — minimum quality standard; every skill executable, validated, self-contained"
-triggers:
-  - path_prefix: "src/skills/"
 routes_to:
   - "guideline:agent-infra/skill-quality-checklist"
 workspaces: [agent-config-maintainer]

package/dist/agent-src/rules/source-confidentiality.md

@@ -3,13 +3,6 @@ type: "auto"
 tier: "mechanical-already"
 description: "Naming an external repo this package copied/harvested/compared against — keep the tracked tree source-anonymous"
 alwaysApply: false
-triggers:
-  - path_prefix: "src/skills/"
-  - path_prefix: "src/rules/"
-  - path_prefix: "src/domains/"
-  - path_prefix: "docs/"
-  - path_prefix: "agents/evidence/"
-  - path_prefix: "agents/roadmaps/"
 validator_ignore:
   - type: "substring"
     pattern: "external_sources_denylist"
@@ -96,6 +89,43 @@ runs in the package CI pipeline and fails the build on any denied source token
 in a non-carve-out tracked file. The linter is a deterministic net, not a
 substitute for not writing the attribution in the first place.
 
+## Why this rule is not path-scoped
+
+Under ADR-236 (`docs/decisions/ADR-236-one-artefact-one-layer.md`) this rule is
+delivered by the PROJECT layer only — it exists to maintain this package, so the
+global layer no longer carries an unscoped twin of it. A `paths:`-scoped rule is
+**not re-injected after `/compact`** (ADR-227:79-80), so scoping it would mean the
+obligation silently disappears mid-session with nothing left to reload it.
+
+It is therefore delivered unconditionally, and the path triggers were removed
+rather than worked around. **This section is the shared record for all four such
+rules** — `no-roadmap-references`, `rule-type-governance` and `skill-quality` carry
+the same change and no note of their own. Two reasons: four copies of the rationale
+cost more standing context than the decision they explain, and the other three are
+migrated POINTER stubs held at their pointer's size by
+`check_rule_stub_ceiling` — prose added there is prose in the wrong place by that
+gate's own contract, which is what caught the first attempt to duplicate it.
+
+AI council 2026-08-20, 2/2 convergent on this option over three alternatives, with
+two independent decisive arguments. First: the obligation governs an **authoring
+decision**, which happens before any file exists for a path trigger to match — so
+path-scoping fails at greenfield creation whether or not a compaction ever occurs.
+Second: the measured cost is small against what the partition returns. Keeping an
+unscoped global copy was rejected because it re-creates the duplication the
+partition exists to remove; splitting the four by "has a CI gate" was rejected by
+both seats as the wrong axis — a validator observes an outcome, it does not hold an
+obligation during the session, and `rule-type-governance` has no gate at all.
+
+**Cost, measured and corrected.** An earlier revision of this note claimed 1,754
+tokens (1.8 % of the partition's 96,584-token saving). That figure was a
+`chars / 4` proxy over the projected files and **understated the real cost by about
+half**: `check_rule_activation_census`, which counts with the exact BPE tokenizer,
+measures the unconditional corpus growing **108,130 → 111,642, i.e. +3,512 tokens
+(3.6 %)** — and that number includes this rationale, which is why it lives in one
+place instead of four. The verdict does not depend on the figure: one seat argued
+the token axis was the wrong one entirely, the other that cost is a legitimate axis
+which simply loses this particular comparison. Both readings survive 3.6 %.
+
 ## See also
 
 - [`source-of-truth`](source-of-truth.md) — edit `src/`, never the projections.