@event4u/agent-config 14.7.0 → 14.8.0

package/src/scripts/check_single_delivery.ts

@@ -76,9 +76,9 @@ import { reportScanned } from './_lib/scan_scope.js';
 
 // ledger-exempt: this gate has no skip semantics to account for. `_lib/gate_ledger`
 // exists so a gate that PASSES OVER targets says which and why; here the target set
-// is four fixed artefact types, every one of them appears in the output, and a type
+// is six fixed artefact types, every one of them appears in the output, and a type
 // whose layer is missing is printed as `absent` rather than quietly dropped — see
-// the `absent` field and the `types_compared=N of 4` ledger line, which together
+// the `absent` field and the `types_compared=N of 6` ledger line, which together
 // already carry what a per-target ledger would. Adding one would restate the render
 // in a second format, and the gate's own docstring warns that the degenerate pass
 // here is a marker with no argument behind it. If a future version gains a real skip
@@ -88,10 +88,51 @@ import { reportScanned } from './_lib/scan_scope.js';
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 
-/** Artefact types the host loads from both layers. */
-const TYPES = ['rules', 'skills', 'commands', 'agents'] as const;
+/**
+ * Artefact types the host loads from both layers.
+ *
+ * ## The identity key, named because it is not the same for every row
+ *
+ * Every row below compares BASENAMES within one family directory. For `rules`,
+ * `personas`, `user-types` and `agents` that IS the host's unit, so basename
+ * equality is the right key. For `commands` it is not: the host-visible unit is
+ * the invocation name `/cluster:sub`, which the colon form encodes in the PATH
+ * (`commands/<cluster>/<sub>.md`), so this gate's `commands` row compares cluster
+ * DIRECTORY names — a coarser key than the thing the host registers.
+ *
+ * That gap is recorded rather than closed, and the reason is a measurement: since
+ * `commandsWithheld` gates the colon-form generator, a machine with a verified
+ * host layer projects ZERO commands, so there is no project-side name for the
+ * coarse key to be wrong about. On a machine WITHOUT one, the project layer is
+ * the only layer and there is nothing to compare. The key is therefore imprecise
+ * exactly where it has no work to do. Closing it would mean reading each command
+ * file's own slug — real work for a row whose overlap is 0 in both topologies.
+ *
+ * `personas` and `user-types` were added 2026-08-21 (closure correction). See
+ * `unknownProjectFamilies` for what now prevents the next omission.
+ */
+const TYPES = ['rules', 'skills', 'commands', 'personas', 'user-types', 'agents'] as const;
 type ArtefactType = (typeof TYPES)[number];
 
+/**
+ * Directory names under `<repo>/.claude/` that the HOST writes, not a generator.
+ *
+ * `unknownProjectFamilies` used to rest on the premise that `<repo>/.claude/` is
+ * "written by `condense.ts` generators and nothing else". That premise is false
+ * and the gate proved it on 2026-08-22, refusing a release push over
+ * `.claude/worktrees/` — the maintainer's git-worktree root, gitignored at
+ * `.gitignore:246`, named as a conventional worktree location by
+ * `worktree_cleanup_check.STANDARD_WORKTREE_DIRS`, and excluded from
+ * `inventory_abstraction_budget`. Nothing about it is an artefact family, so
+ * "add it to TYPES" was advice that could not be taken.
+ *
+ * The set is hand-written and stays independent of any producer registry, for
+ * the same reason `TYPES` is: a verifier that derives its scope from a producer
+ * inherits that producer's omissions. It grows only on tree evidence that a name
+ * is host state — never to silence a family a generator actually emits.
+ */
+const HOST_OWNED = new Set(['worktrees']);
+
 /**
  * What a layer's entries physically ARE — symlinks, directories, or regular files.
  *
@@ -273,6 +314,54 @@ export interface Verdict {
     namesRead: number;
     /** True when no type had BOTH layers present — nothing was actually compared. */
     readNothing: boolean;
+    /**
+     * Family directories present in the PROJECT layer that `TYPES` does not name.
+     *
+     * The forcing function that makes this gate's own 2026-08-21 omission
+     * non-recurring: `personas` was written by a generator, shipped by the
+     * installer, and named by neither measurer, so it was invisible rather than
+     * reported — a gate cannot report a family it was never told exists.
+     *
+     * Only the PROJECT layer is scanned, and that is the whole reason this can be
+     * a hard refusal rather than a warning. Every entry in `<repo>/.claude/` is a
+     * family this repository chose to emit, EXCEPT the host-written names in
+     * `HOST_OWNED` — see that constant for why the unqualified version of this
+     * sentence was wrong. `~/.claude/` is the host's own directory —
+     * `plugins`, `projects`, `sessions`, `shell-snapshots`, `telemetry` and a
+     * dozen more live there — and treating an unrecognised name in it as a defect
+     * would be a false-positive generator, not a check.
+     */
+    unknownFamilies: string[];
+}
+
+/**
+ * Family directories the project layer holds that `TYPES` does not name.
+ *
+ * Deliberately NOT derived from the installer's `_CLAUDE_SKILL_BUNDLE` or from
+ * `check_generator_output_coverage`'s registry: a verifier whose scope comes from
+ * a producer inherits that producer's omissions, which is the exact defect this
+ * function exists to catch. `TYPES` stays hand-written and independent; this
+ * compares it against the filesystem the generators actually produced and refuses
+ * on disagreement.
+ */
+function unknownProjectFamilies(projectRoot: string): string[] {
+    const known = new Set<string>(TYPES);
+    let entries: fs.Dirent[];
+    try {
+        entries = fs.readdirSync(projectRoot, { withFileTypes: true });
+    } catch {
+        return []; // no project layer at all — nothing emitted, nothing to miss
+    }
+    return entries
+        .filter(
+            (e) =>
+                e.isDirectory() &&
+                !e.name.startsWith('.') &&
+                !known.has(e.name) &&
+                !HOST_OWNED.has(e.name),
+        )
+        .map((e) => e.name)
+        .sort();
 }
 
 export function evaluate(globalRoot: string, projectRoot: string): Verdict {
@@ -299,6 +388,7 @@ export function evaluate(globalRoot: string, projectRoot: string): Verdict {
             0,
         ),
         readNothing: compared === 0,
+        unknownFamilies: unknownProjectFamilies(projectRoot),
     };
 }
 
@@ -354,12 +444,24 @@ export function render(v: Verdict, globalRoot: string, projectRoot: string): str
         out.push('');
         out.push(`  layers not present (nothing to compare there): ${v.absent.join(', ')}`);
     }
+    if (v.unknownFamilies.length > 0) {
+        out.push('');
+        out.push(
+            `  ❌  unknown family in the project layer: ${v.unknownFamilies.join(', ')}` +
+                ' — add it to TYPES in this gate AND in _lib/layer_overlap_notice.ts,',
+        );
+        out.push(
+            '      or the next family shipped from two layers is invisible the way `personas`' +
+                ' was until 2026-08-21.',
+        );
+    }
     out.push('');
     out.push(
         `check_single_delivery ledger: duplicated=${v.duplicated}` +
             ` name_overlap_different_shape=${v.nameOverlapDifferentShape}` +
             ` scope_defeat=${v.defeated}` +
             ` types_compared=${v.typesCompared} of ${v.readings.length}` +
+            ` unknown_families=${v.unknownFamilies.length}` +
             ` names_read=${v.namesRead}`,
     );
     return out.join('\n');
@@ -459,6 +561,37 @@ export function main(argv?: readonly string[]): number {
             ' case (layers present but never paired) is refused separately.',
     });
 
+    // Refuses in both modes, unlike every other branch here — but ONLY over this
+    // repository's own generated tree, and that qualification was added by a
+    // neutral review (2026-08-21) rather than being there from the start.
+    //
+    // The asymmetry is the argument for the refusal: every other verdict here is
+    // a property of ONE MACHINE's two layers, which is why `--enforce` is opt-in.
+    // "this repository emits a family no measurer names" is true on every checkout
+    // and fixable in one line, so gating it behind `--enforce` would put the one
+    // topology-independent check behind the flag meant for topology-dependent
+    // ones.
+    //
+    // The qualification is the review's, and it is right: an unrecognised
+    // DIRECTORY does not by itself establish generator ownership. It does under
+    // `<repo>/.claude/`, which `condense.ts` writes and nothing else does. It does
+    // NOT under an arbitrary `--project` path, which may be a consumer tree with
+    // a host-native or project-only family that legitimately cannot overlap — and
+    // refusing there would make a nominal report exit 1 on a correct topology.
+    // So a repointed root REPORTS and does not refuse.
+    if (v.unknownFamilies.length > 0) {
+        const own = projectRoot === path.join(REPO_ROOT, '.claude');
+        process.stdout.write(
+            `${own ? '❌' : '⚠️ '}  check_single_delivery: unknown family in the project` +
+                ` layer: ${v.unknownFamilies.join(', ')}. Add measurement before it can ship` +
+                ' — TYPES in this gate and in _lib/layer_overlap_notice.ts.' +
+                (own ? '' : ' Reported, not enforced: --project is repointed, so generator' +
+                    ' ownership of this tree is not established.') +
+                '\n',
+        );
+        if (own) return 1;
+    }
+
     if (v.readNothing) {
         // Never a pass. A gate that compared nothing has not verified anything,
         // and saying "invariant holds" here is the false-green shape this repo

package/src/scripts/check_standing_rule_delivery.ts

@@ -326,8 +326,14 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
     if (pct > 1) {
         process.stderr.write(
             `❌  ${PROG}: ${total} tok of standing rule prose exceeds the ${budget.total_cap_tokens} cap. `
-                + 'If two layers overlap, `agent-config install --layer=<global|project>` suppresses one '
-                + 'without deleting a file; otherwise scope rules with `paths:` or move bodies into the digest.\n',
+                + 'If two layers overlap, that is the ADR-236 partition not yet armed on this '
+                + 'machine: run `agent-config install` so the host layer is fingerprinted in '
+                + 'installed.lock, and the next `task generate-tools` withholds the globally-owned '
+                + 'artefacts instead of writing a second copy. (Superseded advice: this line used to '
+                + 'name `install --layer=<global|project>`, the layer-suppression remedy ADR-226 '
+                + 'declined and ADR-236 replaced — a reader following it could not fix the '
+                + 'condition.) Otherwise the total is body length, not duplication: scope rules with '
+                + '`paths:` or move bodies into the digest.\n',
         );
         return 1;
     }

package/src/scripts/condense.ts

@@ -263,7 +263,9 @@ export {
     type ClaudePathsPlan,
 } from '../install/claudePathsPlan.js';
 import { rule_in_scope } from '../install/ruleInScope.js';
-import { isExclusivelyPackageOnly, partitionActive, setPartitionAnnounce } from '../install/partitionEligibility.js'; // ADR-236
+import { pruneEmptyDirs } from './_lib/prune_empty_dirs.js';
+import { commandsWithheld, partitionActive, personaPartition, setPartitionAnnounce } from '../install/partitionEligibility.js'; // ADR-236
+import { dedupableRules, partitionRulesForDir } from '../install/ruleLayerPartition.js'; // ADR-236, per-host evidence
 import { _claude_paths_plan, derive_trigger_globs } from '../install/claudePathsPlan.js';
 
 const _HERE = path.dirname(fileURLToPath(import.meta.url)); // <repo>/src/scripts
@@ -439,15 +441,6 @@ function _read_augment_rules_use_symlinks(): boolean {
     return false;
 }
 
-/**
- * Per-tool user-scope rule directory, for the scope-dedup below. Only tools
- * whose host reads a user-scope rules directory can have a redundant twin;
- * everything else has nothing to de-duplicate against.
- */
-const USER_SCOPE_RULE_DIRS: Readonly<Record<string, string>> = {
-    '.claude/rules': path.join('.claude', 'rules'),
-};
-
 function _read_projection_scope_dedup(): boolean {
     const data = load_agent_settings({ project_path: MODULE_STATE.SETTINGS_FILE });
     const projection = data['projection'];
@@ -464,60 +457,6 @@ function _read_projection_scope_dedup(): boolean {
     return false;
 }
 
-/**
- * Rules whose user-scope twin is BYTE-IDENTICAL to the source, i.e. safe to
- * skip at project scope: the host still loads the same text, once instead of
- * twice, so nothing the model sees changes.
- *
- * Byte-identity is the whole safety argument and is not negotiable. Keying on
- * the filename alone would silently let a stale globally-installed copy win
- * whenever the two scopes hold different versions — which is the NORMAL state
- * while developing the package (measured: 110/110 shared filenames differing in
- * bytes). This is deliberately not the thin-projection mechanism: no rule
- * becomes trigger-gated, so the quality floor that disabled thin projection
- * does not apply here.
- */
-function _dedupable_rules(tool_dir: string, rules: readonly string[], userHome: string): Set<string> {
-    const relative = USER_SCOPE_RULE_DIRS[tool_dir];
-    if (relative === undefined) {
-        return new Set();
-    }
-    // A hostile or simply absent $HOME must make the dedup inert, not
-    // adventurous. In a container `$HOME` is often unset (so `homedir()` can
-    // resolve to `/`) or world-writable, and this function decides which rules
-    // to STOP emitting — reading an unexpected tree there is how a projection
-    // silently loses a rule. Council review of PR #1055 raised exactly this.
-    let userDirStat: fs.Stats;
-    const userDir = path.join(userHome, relative);
-    try {
-        userDirStat = fs.statSync(userDir);
-    } catch {
-        return new Set();
-    }
-    if (!userDirStat.isDirectory()) {
-        return new Set();
-    }
-    // World-writable user scope: anyone on the box could plant a byte-identical
-    // twin and thereby delete a rule from the project projection. Refuse.
-    if ((userDirStat.mode & 0o002) !== 0) {
-        _print(`  ⚠️  ${tool_dir}: user-scope rules dir is world-writable — scope-dedup skipped`);
-        return new Set();
-    }
-    const skip = new Set<string>();
-    for (const rule of rules) {
-        const twin = path.join(userDir, rule);
-        const source = path.join(MODULE_STATE.RULES_SOURCE, rule);
-        try {
-            if (!_isFile(twin) || !_isFile(source)) continue;
-            if (fs.readFileSync(twin).equals(fs.readFileSync(source))) {
-                skip.add(rule);
-            }
-        } catch {
-            // An unreadable twin is simply not de-duplicable — emit the project copy.
-        }
-    }
-    return skip;
-}
 
 function _lean_projection_mode(): string {
     const data = load_agent_settings({ project_path: MODULE_STATE.SETTINGS_FILE });
@@ -1132,11 +1071,22 @@ function _scoped_rule_basenames(): string[] {
         // is its fourth consumer, after the router compiler, the dist writer, and
         // check_sync. Same predicate in all four; that is the point.
         .filter((p) => !skip_compile_disabled_rule(`rules/${path.basename(p)}`))
-        .filter((p) => !partitionActive(MODULE_STATE.PROJECT_ROOT) || isExclusivelyPackageOnly(p))
         .map((p) => path.basename(p))
         .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 }
 
+/** Adapter over {@link partitionRulesForDir}; that module carries the reasoning. */
+export function partition_rules_for_dir(
+    tool_dir: string,
+    rules: readonly string[],
+    user_home: string = process.env['HOME'] ?? os.homedir(),
+): string[] {
+    return partitionRulesForDir({
+        toolDir: tool_dir, rules, userHome: user_home, announce: _print,
+        projectRoot: MODULE_STATE.PROJECT_ROOT, rulesSource: MODULE_STATE.RULES_SOURCE,
+    });
+}
+
 /**
  * The emit plan of {@link generate_rule_symlinks}: active tool dir → the exact
  * rule basenames it projects there.
@@ -1161,8 +1111,12 @@ export function projected_rule_trees(
     const dedup_on = _read_projection_scope_dedup();
     const out: Record<string, string[]> = {};
     for (const tool_dir of Object.keys(_filter_tool_dirs(TOOL_DIRS))) {
-        const skip = dedup_on ? _dedupable_rules(tool_dir, rules, user_home) : new Set<string>();
-        out[tool_dir] = rules.filter((r) => !skip.has(r));
+        const skip = dedup_on
+            ? dedupableRules({ toolDir: tool_dir, rules, userHome: user_home,
+                  rulesSource: MODULE_STATE.RULES_SOURCE, announce: _print })
+            : new Set<string>();
+        const kept = rules.filter((r) => !skip.has(r));
+        out[tool_dir] = partition_rules_for_dir(tool_dir, kept, user_home);
     }
     return out;
 }
@@ -1281,7 +1235,10 @@ export function generate_rule_symlinks(): number {
 }
 
 export function generate_windsurfrules(): number {
-    const rules = _scoped_rule_basenames();
+    // Windsurf's LEGACY single-file surface — same host, so the same evidence, keyed
+    // on `.windsurf/rules`. Without this line removing the per-run filter regressed
+    // it 13 → 113: the per-run filter had been covering it by accident.
+    const rules = partition_rules_for_dir('.windsurf/rules', _scoped_rule_basenames());
     const parts = ['# Auto-generated from dist/agent-src/rules/ — do not edit directly\n'];
     for (const rule of rules) {
         const p = path.join(MODULE_STATE.RULES_SOURCE, rule);
@@ -1451,12 +1408,16 @@ function _clean_modern_dir(target_dir: string, valid_names: ReadonlySet<string>)
 export function generate_cursor_mdc_rules(): number {
     const scope = _read_rule_workspaces();
     const pack_scope = _read_rule_packs();
-    const rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
+    let rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
         .filter((p) => _isFile(p))
         .filter((p) => rule_in_scope(p, scope, pack_scope))
         // ADR-004 manual rules are reference-only — never auto-injected into a
         // per-tool tree. Same predicate as generate_rule_symlinks.
         .filter((p) => !_is_manual_rule(p));
+    // ADR-236 per-host partition (src/install/ruleLayerPartition.ts). Narrowing the
+    // list is a REMOVAL, because `_clean_modern_dir` below sweeps to `valid`.
+    const kept = new Set(partition_rules_for_dir('.cursor/rules', rules.map((r) => path.basename(r))));
+    rules = rules.filter((r) => kept.has(path.basename(r)));
     const stems = rules.map((r) => path.basename(r, '.md'));
     const valid = new Set([
         ...stems.map((s) => `${s}.mdc`),
@@ -1473,12 +1434,15 @@ export function generate_cursor_mdc_rules(): number {
 export function generate_windsurf_modern_rules(): number {
     const scope = _read_rule_workspaces();
     const pack_scope = _read_rule_packs();
-    const rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
+    let rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
         .filter((p) => _isFile(p))
         .filter((p) => rule_in_scope(p, scope, pack_scope))
         // ADR-004 manual rules are reference-only — never auto-injected into a
         // per-tool tree. Same predicate as generate_rule_symlinks.
         .filter((p) => !_is_manual_rule(p));
+    // ADR-236 per-host partition — same shape as the cursor emitter above.
+    const kept = new Set(partition_rules_for_dir('.windsurf/rules', rules.map((r) => path.basename(r))));
+    rules = rules.filter((r) => kept.has(path.basename(r)));
     const valid = new Set(rules.map((r) => path.basename(r)));
     _clean_modern_dir(_WINDSURF_RULES_DIR(), valid);
     for (const rule of rules) {
@@ -1781,18 +1745,16 @@ function _nested_command_subpath(source_file: string): string | null {
 /**
  * Project-scope `.claude/commands/<cluster>/<sub>.md` — the colon form.
  *
- * Before this, the package repo's own `.claude/` carried NO commands
- * directory: every command reached Claude Code as a hyphen-named skill
- * wrapper in `.claude/skills/`, while the colon form existed only in the
- * user-global tree written by `install.ts`. Every clustered command was
- * therefore listed TWICE for anyone with a global install
- * (`roadmap-process-full` AND `roadmap:process-full`), costing 4,214 GPT tok
- * of always-loaded catalog for zero added reach — measured 2026-08-02.
+ * Before this, the package repo's own `.claude/` carried NO commands directory:
+ * every command reached Claude Code as a hyphen-named skill wrapper in
+ * `.claude/skills/`, while the colon form existed only in the user-global tree
+ * written by `install.ts`. Every clustered command was therefore listed TWICE
+ * for anyone with a global install (`roadmap-process-full` AND
+ * `roadmap:process-full`), costing 4,214 GPT tok of catalog — measured 2026-08-02.
  *
  * Emitting the nested form here lets `generate_claude_commands` stop wrapping
  * the clustered commands: one listing, same reachability, and reachability no
- * longer depends on a global deploy having run. Claude Code dedupes project
- * and user scope by name, so the two copies of `/cluster:sub` collapse.
+ * longer depends on a global deploy. Dedup AND precedence: `commandsWithheld`.
  *
  * ADR-003 (colon canonical for clusters) and ADR-044 (flat commands stay
  * hyphenated) both hold: flat commands are untouched and keep their wrapper.
@@ -1800,6 +1762,8 @@ function _nested_command_subpath(source_file: string): string | null {
 export function generate_claude_project_commands(
     active_command_slugs: ReadonlySet<string> | null = null,
 ): number {
+    if (commandsWithheld(MODULE_STATE.PROJECT_ROOT)) active_command_slugs = new Set<string>();
+    // Returns before the stale sweep — invariant, see `commandsWithheld`.
     if (!_isDir(path.join(MODULE_STATE.PROJECT_ROOT, 'src', 'domains'))) {
         return 0;
     }
@@ -1816,8 +1780,7 @@ export function generate_claude_project_commands(
 
     const target_root = _CLAUDE_COMMANDS_DIR();
     const valid = new Set(nested.map(([, sub]) => `${sub}.md`));
-    // Sweep stale links first: a renamed or deleted command must not linger as
-    // a dangling `/cluster:sub`.
+    // Sweep stale links first — a renamed, deleted or WITHHELD command must not linger.
     if (_exists(target_root)) {
         for (const item of _rglobSorted(target_root, '*.md')) {
             const rel = _relativeToPosix(item, target_root);
@@ -1825,6 +1788,7 @@ export function generate_claude_project_commands(
                 fs.unlinkSync(item);
             }
         }
+        pruneEmptyDirs(target_root); // else the gate counts 40 empty cluster dirs as 40 commands
     }
 
     let count = 0;
@@ -2297,7 +2261,7 @@ export function generate_persona_symlinks(): number {
         .map((p) => path.basename(p))
         .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
     void personas;
-    const list = direct;
+    const partition = personaPartition(MODULE_STATE.PROJECT_ROOT, direct);
     const tool_dirs = _filter_tool_dirs(PERSONA_TOOL_DIRS);
     let total = 0;
     for (const [tool_dir, rel_prefix] of Object.entries(tool_dirs)) {
@@ -2305,11 +2269,11 @@ export function generate_persona_symlinks(): number {
         _mkdirp(target_dir);
         for (const item of _iterdirSorted(target_dir)) {
             const name = path.basename(item);
-            if (_isSymlink(item) && !list.includes(name) && name !== 'README.md') {
+            if (_isSymlink(item) && !partition.listFor(tool_dir).includes(name) && name !== 'README.md') {
                 fs.unlinkSync(item);
             }
         }
-        for (const persona of list) {
+        for (const persona of partition.listFor(tool_dir)) {
             const link = path.join(target_dir, persona);
             const target = path.join(rel_prefix, persona);
             if (_existsOrSymlink(link)) {
@@ -2319,9 +2283,8 @@ export function generate_persona_symlinks(): number {
             total += 1;
         }
     }
-    info(
-        `  ✅  Created ${total} persona symlinks across ${Object.keys(tool_dirs).length} tool directories (${list.length} personas each)`,
-    );
+    const per_dir = Object.keys(tool_dirs).map((d) => `${d}=${partition.countFor(d)}`);
+    info(`  ✅  Created ${total} persona symlinks — ${per_dir.join(' · ')}${partition.note}`);
     return total;
 }
 
@@ -2521,10 +2484,17 @@ export function project_to_augment(): void {
     const current = new Set<string>();
     let written = 0;
     if (_exists(src_rules)) {
-        const rules = _iterdirSorted(src_rules)
-            .filter((p) => p.endsWith('.md') && _isFile(p))
-            .map((p) => path.basename(p))
-            .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+        // ADR-236 per-host partition, ahead of the `use_symlinks` branch so both
+        // writers narrow; the `existing` minus `current` sweep below makes it a
+        // removal. This emitter never had the scope or ADR-004 manual filters
+        // either — why its count is 15 and the symlink trees' 13. Pre-existing.
+        const rules = partition_rules_for_dir(
+            '.augment/rules',
+            _iterdirSorted(src_rules)
+                .filter((p) => p.endsWith('.md') && _isFile(p))
+                .map((p) => path.basename(p))
+                .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
+        );
         for (const rule of rules) {
             const target = path.join(dst_rules, rule);
             if (_isSymlink(target) || _existsOrSymlink(target)) {

package/src/scripts/external_sources_denylist.json

@@ -62,7 +62,10 @@
     "\\bagent-reach\\b",
     "panniantong",
     "virgiliojr94",
-    "book-to-skill"
+    "book-to-skill",
+    "project-codeguard",
+    "\\bcodeguard\\b",
+    "\\bcosai\\b"
   ],
   "skip_paths": [
     "src/scripts/check_no_external_sources.py",

package/src/scripts/hooks/block_unauthorized_git.ts

@@ -485,8 +485,28 @@ export function commandOp(command: string): GitOp | null {
   return found;
 }
 
-/** A ledger older than this is not "this turn" under any reading. */
-export const LEDGER_MAX_AGE_MS = 6 * 60 * 60 * 1000; // TEMP: PR-drain run, revert after
+/**
+ * A ledger older than this is not "this turn" under any reading.
+ *
+ * **Widening this constant for a long run is forbidden practice.** On
+ * 2026-08-21 it was sed-patched to twelve times this value — six hours —
+ * behind a marker promising a revert that never came, so an autonomous PR-drain could
+ * merge past the 30-minute bound. The widening was committed to the trunk and
+ * left there. It is a twelvefold expansion of the authorization lifetime on
+ * the guard that gates `pr-merge`, which is a `BLOCK_OPS` member precisely
+ * because it is irreversible.
+ *
+ * Neither the widened expression nor the marker text is written out here: the
+ * obvious regression check for either is a grep, and a comment reciting the
+ * literal makes that grep match the guard's own prose on a clean tree.
+ *
+ * The supported answer to "my run is longer than the window" is that the run
+ * STOPS and REPORTS at expiry and the user re-authorizes — never that the
+ * window grows. The agent never edits this constant, this file, or the built
+ * bundle; `dist/hooks/dispatch.js` is what actually executes, and a source
+ * edit without a rebuild is silently inert.
+ */
+export const LEDGER_MAX_AGE_MS = 30 * 60 * 1000;
 
 /**
  * Load the ledger, and refuse one that does not belong to THIS session and