@event4u/agent-config 14.7.0 → 14.8.0

package/dist/agent-src/commands/roadmap.md

@@ -38,7 +38,7 @@ paused for confirmation before every step) was removed —
 | `/roadmap:materialize` | `commands/roadmap/materialize.md` | Turn an accepted roadmap into the concrete artefacts it plans |
 | `/roadmap:process-step` | `commands/roadmap/process-step.md` | Autonomously process the next open step, then stop |
 | `/roadmap:process-phase` (**default execution scope**) | `commands/roadmap/process-phase.md` | Autonomously process every open step in the current phase |
-| `/roadmap:process-full` | `commands/roadmap/process-full.md` | Autonomously process every open step across every phase |
+| `/roadmap:process-full` | `commands/roadmap/process-full.md` | Autonomously process every open step across every phase; `--all` iterates the whole active estate, `--worktree` isolates the workspace |
 | `/roadmap:next` | `commands/roadmap/next.md` | Screen for the next executable roadmap, then carry it to a reviewable PR (selection + `process-full` + delivery) |
 
 Sub-command names match the locked contract in

package/dist/agent-src/contexts/execution/auto-dispatch-classification.md

@@ -89,14 +89,11 @@ evaluation-order accident.
 
 **Recursive-dispatch guard (2.3) — honest scope.** No verified host
 discriminator exists for "is this classification running inside a
-subagent/teammate session" — this roadmap's own `point-of-action-carrier`
-blocker records the upstream PreToolUse agent-identity request as closed
-NOT_PLANNED, and no field in this repo's hook envelope carries session
-lineage. The guard is therefore a CALLER-SUPPLIED fact
+subagent/teammate session", and no field in this repo's hook envelope carries
+session lineage. The guard is therefore a CALLER-SUPPLIED fact
 (`insideSubagentSession`), never a `process.env` probe for an unverified
-variable name — the same "no discriminator is publishable" null the
-`point-of-action-carrier` blocker already names. When set, it resolves ∅
-(in-session) for rungs 1-4; rung 0 is exempt (it never spawns).
+variable name. When set, it resolves ∅ (in-session) for rungs 1-4; rung 0 is
+exempt (it never spawns).
 
 **Relationship to the council's own necessity gate.** Rung 4's three
 signals (design decision / security downgrade / release-gate escalation)
@@ -127,6 +124,32 @@ Criteria are independent and additive in the obvious way (a slice matching
 two rows takes the higher of the two tiers); this table never lowers a
 tier `inferSliceTier` (§ below) already raised.
 
+## Cross-vendor worker direction (declared, not implemented)
+
+Deny-by-default — a direction not listed here is denied. Direction rules,
+payload allow/deny lists, the report-only boundary, the no-recursion clause and
+the human egress gate:
+[`cross-vendor-worker-direction`](../../../../docs/contracts/cross-vendor-worker-direction.md).
+Role pairs, never vendor names — `classifyLadder` carries no vendor identity
+([`subagent-routing`](subagent-routing.md) § Why vendor-neutral).
+
+Rung-1/2 slices only.
+
+| # | Direction (role pair) | Resolves to |
+|---|---|---|
+| CV-1 | a worker on the **non-authoring** vendor reviews the **authoring** vendor's output | report-only worker |
+| CV-2 | the mirror of CV-1 | report-only worker |
+
+```
+DIRECTION PERMITTED + PAYLOAD ALLOWED + HUMAN APPROVED = MAY SEND.
+ANY ONE MISSING = MAY NOT.
+A CROSS-VENDOR WORKER NEVER IMPLEMENTS, WRITES, COMMITS, ACTS,
+OR DISPATCHES ONWARD.
+```
+
+Nothing reads CV-1/CV-2 at runtime: a contract surface a future implementation
+must satisfy, replacing the phantom artefact the original survey cited.
+
 ## Per-slice tier inference (v1.5 — deterministic, task-TYPE-keyed)
 
 Once a slice is classified **delegable**, a second deterministic table infers
@@ -206,15 +229,11 @@ NEVER A SILENTLY DEGRADED ANSWER. NO LLM CLASSIFIER FALLBACK (CUT C3).
 | "does string Y exist" / "probe candidate strings" | `string-existence` | FTS one-shot (`memory_lookup` for the knowledge corpus) or capped `rg -n --max-count` for the codebase |
 | "run report Z" / "run check_*" | `report-run` | direct script run, wrapped per the **measured** rtk allowlist (`internal/bench/rtk-savings/RESULTS.md` — wrap only the ~55%-savings class) |
 
-**Why rg-first for definition/references** (council debate 2026-07-28,
-claude-sonnet-4-5 + gpt-4o, 2 rounds): the pre-registered benchmark behind the
-`code-graph-retrieval-null` claim (`docs/CLAIMS.md`) measured native-graph
-recall 0.365 vs grep 0.797 on graph-shaped questions, root cause an **indexing
-gap** (TS arrow-function exports produce no symbol nodes) that hits structured
-lookups exactly as it hits NL retrieval — and the recorded consequence bound
-keeps `code_graph.enabled` false permanently. The accelerant clause is the
-escape hatch that bound names ("unless external evidence appears"); today it
-is inert.
+**Why rg-first** (council 2026-07-28, 2 rounds): the pre-registered benchmark
+behind the `code-graph-retrieval-null` claim (`docs/CLAIMS.md`) measured
+native-graph recall 0.365 vs grep 0.797 on graph-shaped questions — an
+indexing gap that keeps `code_graph.enabled` false permanently. The accelerant
+clause in the table above is that bound's escape hatch and is inert today.
 
 **Escalation, not degradation:** a primitive that returns nothing (index miss,
 pattern too ambiguous, report script absent) — **or an unusable result**
@@ -238,26 +257,17 @@ budgeted (consume part of the N=3 autonomous budget) and opt-in. Not in v1.
 
 ## Reference implementation
 
-The deterministic rules are encoded in
-[`src/scripts/_lib/auto_dispatch.ts`](../../../../src/scripts/_lib/auto_dispatch.ts)
-(`classifyTask`, `classifyLookup` for the lookup-class rung), covered by
-[`tests/scripts/_lib_auto_dispatch.test.ts`](../../../../tests/scripts/_lib_auto_dispatch.test.ts)
-and the lookup corpus in
-[`src/scripts/_lib/auto_dispatch.corpus.test.ts`](../../../../src/scripts/_lib/auto_dispatch.corpus.test.ts)
-(`LOOKUP_CORPUS` — the four live-observed shapes + negative controls).
-
-The judgment ladder (§ above) is encoded in
-[`src/scripts/_lib/judgment_ladder.ts`](../../../../src/scripts/_lib/judgment_ladder.ts)
-(`classifyLadder`, plus the rung-0/1/3/4 signal-detection functions), covered
-by
-[`tests/scripts/_lib_judgment_ladder.test.ts`](../../../../tests/scripts/_lib_judgment_ladder.test.ts)
-(every rung, the rung-3 degrade path, the recursive-dispatch guard, and every
-∅ case). The delegation-nudge hook
-([`delegation_nudge_hook.ts`](../../../../src/scripts/hooks/delegation_nudge_hook.ts))
-is its first production caller — its injected line cites the resolved rung
-(`rung-2: dispatch do-in-parallel …`), scoped to the subagent dispatch rungs
-(1/2); a rung-0/3/4 verdict stays silent on this carrier until Phase 3/4 give
-team/council their own.
+- `classifyTask` / `classifyLookup` —
+  [`auto_dispatch.ts`](../../../../src/scripts/_lib/auto_dispatch.ts)
+- `classifyLadder` + the rung-0/1/3/4 signal detectors —
+  [`judgment_ladder.ts`](../../../../src/scripts/_lib/judgment_ladder.ts)
+- First production caller —
+  [`delegation_nudge_hook.ts`](../../../../src/scripts/hooks/delegation_nudge_hook.ts):
+  its injected line cites the resolved rung, scoped to the dispatch rungs
+  (1/2); a rung-0/3/4 verdict stays silent on this carrier.
+
+Each has a sibling `*.test.ts` under `tests/scripts/` covering every rung, the
+rung-3 degrade path, the recursive-dispatch guard and every ∅ case.
 
 ## Related
 

package/dist/agent-src/contexts/execution/autonomy-mechanics.md

@@ -86,18 +86,53 @@ In `auto` mode, flip to `on` for the rest of the conversation when the user expr
 
 Algorithm and speech-act heuristic: [`autonomy-detection.md`](autonomy-detection.md). Anchor phrases (DE+EN), no-flip patterns, counter-examples, trivial-vs-blocking taxonomy, commit-policy summary, and named failure modes: this file + [`autonomy-examples.md`](autonomy-examples.md).
 
-## Task-scope — two autonomy shapes
+## Task-scope — three autonomy shapes
 
 Depth for the rule's task-scope Iron Law (`NEW TASK → FRESH CONFIRMATION`).
-Two distinct autonomy shapes — keep them apart:
+Three distinct autonomy shapes — keep them apart:
 
 | Shape | Trigger | Scope |
 |---|---|---|
 | **Conversation-wide trivial-question suppression** | "stop asking on trivial steps, just work" — no deliverable named. | Sticky for the rest of the conversation. Suppresses trivial workflow questions only; never lifts blocking, Hard Floor, or [`scope-control`](../../rules/scope-control.md) gates. |
 | **Task-scoped autonomous execution** | "work autonomously on X", "arbeite die Roadmap Y komplett ab", "do PROJ-123 end-to-end" — a deliverable / artifact / ticket is named. | Bound to **that** task. Ends when the task ends. Does **not** authorize starting a new, distinct task autonomously. |
+| **Set-scoped autonomous execution** | An accepted execution contract whose pre-scan **enumerated** a closed, ordered set of deliverables — the set members are named on the contract screen before the single Accept. | Bound to **that enumerated set**. The loop may move from one listed member to the next without a new contact. A member not on the accepted list is a new task and needs fresh confirmation. |
 
 Litmus test: does the directive name (or unambiguously point to) a single concrete deliverable? Yes → task-scoped, scope ends with the deliverable. No → conversation-wide, trivial-question suppression only.
 
+Set-scoped is the same litmus applied to a **list** instead of a single item, and
+it is deliberately the narrowest thing that makes a set run possible:
+
+```
+SET-SCOPED AUTONOMY IS BOUNDED BY THE ENUMERATION THE USER SAW.
+A MEMBER ON THE ACCEPTED LIST IS CONTINUATION. ANYTHING ELSE IS A NEW TASK,
+AND `NEW TASK → FRESH CONFIRMATION` APPLIES TO IT VERBATIM.
+THE SET IS CLOSED AT ACCEPT TIME AND NEVER GROWS DURING THE RUN.
+```
+
+Four conditions, all of which must hold before a run may claim set scope. They
+exist because "a set" is exactly the phrasing under which an unbounded backlog
+could be smuggled in as one authorization:
+
+1. **Enumerated before Accept.** Every member is printed on the contract screen
+   — name, branch, and its own artifact count. A set the user did not read is
+   not a set they authorized.
+2. **Closed.** The list cannot grow after Accept. A roadmap discovered mid-run
+   is a new task, not a late set member; it waits.
+3. **Ordered, with independence declared.** The contract states the order and
+   which members carry no declared dependency, because that is what decides
+   whether the loop may continue past a failure (see
+   [`roadmap-process-loop § 3d`](roadmap-process-loop.md)).
+4. **One contract, one Accept.** Set scope is granted by the same single Accept
+   as any other mode. It is never inferred from the fact that several roadmaps
+   happen to be open.
+
+What set scope does **not** touch: the Hard Floor, the locked decision classes,
+the kernel-edit soak, and every
+[`scope-control`](../../rules/scope-control.md) gate. It removes the *re-ask
+between listed members* and nothing else — a set run that reaches a Hard-Floor
+action stops there exactly as a single-task run would.
+
+
 When the user later issues a **new** request — different ticket, different roadmap, different artifact, different feature — treat it as a fresh task. Re-confirm autonomy for the new scope before:
 
 - creating a branch / worktree / PR / tag for the new work,

package/dist/agent-src/contexts/execution/roadmap-execution-contract.md

@@ -4,8 +4,8 @@ Loaded by [`roadmap-process-loop § 3`](roadmap-process-loop.md) when the run's
 **derived** mode is `autonomous` or `phase-checkpoints`. The mode comes from the
 § 3a ladder — explicit invocation suffix, then frontmatter `execution.mode`,
 then the invocation form — so an ABSENT frontmatter field no longer keeps this
-context unloaded: under `process-full` / `/roadmap:next` it derives
-`autonomous`, under `process-phase` it derives `phase-checkpoints`. Only a
+context unloaded: under `process-full` it derives `autonomous`, and under
+`/roadmap:next` or `process-phase` it derives `phase-checkpoints`. Only a
 *derived* `interactive` (asked for explicitly, declared in frontmatter, or
 `process-step`) leaves this context unloaded and falls back to the legacy
 commit-step scan. Defines the run-start pre-scan,
@@ -78,6 +78,8 @@ Artifacts: <N> planned (skills/rules/commands/guidelines) —
 Open questions: <N> → decision sheet below (<M> rows); the rest via AI
      council (<members | "none configured — will halt on ambiguity">)
 Quality: <cadence> · Dashboard: <cadence>
+Late artifacts: <halt | auto-research> (default halt; cap 3 then halt)
+Deferred items: <wait | spawn-follow-up-draft | cancel-with-memo> (default wait)
 
 <decision sheet, per contract-decision-sheet — omitted entirely when M = 0>
 
@@ -97,6 +99,66 @@ re-ask inside the run. Adjust → apply, re-show once. The contract is
 re-derived on every invocation — it always reflects the roadmap's and
 repo's current state.
 
+### 2a. `late_artifacts` — what happens to an artifact the plan did not name
+
+An artifact discovered **after** Accept was outside the batched overlap check,
+so the research the contract summary reported does not cover it. Two policies,
+and the field is on the screen because the choice changes what the run may do
+without asking:
+
+| Value | Behaviour |
+|---|---|
+| `halt` (**default**) | The run stops at the discovery with the scope-out-of-roadmap halt. The artifact is reported, not authored. |
+| `auto-research` | The run re-runs Phase B (Research) and the overlap pass mid-run against the *current* artifact state — the identical procedure already accepted as non-interactive at contract time, only later. An **extend** verdict extends silently; a **create** verdict derives its understand-answers from the step text and the sheet answers; only a genuine overlap conflict halts. Capped at **three** late artifacts per run, then halt regardless. |
+
+<!-- decision 2026-08-20: the shipped default is `halt`, not `auto-research`.
+     AI council 2/2 (anthropic + openai) on the `autonomy-defaults-sheet` fork
+     of road-to-user-out-of-the-loop, record
+     agents/evidence/council/drain-blocker-dispositions-a.md. Reasoning: the
+     roadmap's own Risk 7 is that auto-research drifts the run's scope, and its
+     stated mitigation is the cap — but a cap of three is a bound on how far the
+     drift goes, not a check on whether it should happen at all. `halt` is also
+     the behaviour the tree already had, so shipping it as the default means
+     this field is purely additive: nothing that worked before changes, and the
+     aggressive path becomes a thing a run declares rather than a thing it
+     inherits. Reversibility: flipping the default is one word in this table
+     plus one word in the mechanics guideline, with no dependent mechanism to
+     unwind, and the roadmap's own kill criterion (late-artifact revisit rate)
+     only becomes measurable once some runs declare `auto-research` — which an
+     opt-in still permits and a silent default would have made unattributable. -->
+
+The cap is not negotiable by the field: a run that keeps discovering artifacts
+has a planning problem, not an autonomy problem, and the third discovery is the
+signal to say so.
+
+### 2b. `deferred_policy` — the two autonomous exits for a `[~]` item
+
+[`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md) Iron Law 3
+forbids a silent archive with unresolved deferred items. That gate is
+unchanged. What this field changes is which dispositions a run may reach
+**without a synchronous prompt**, and there are exactly two, because the
+preservation test in that rule already splits them the same way:
+
+| Value | Behaviour |
+|---|---|
+| `wait` (**default**) | The synchronous halt stands. Every disposition stays conversational. |
+| `spawn-follow-up-draft` | A roadmap closing with `[~]` items spawns the follow-up draft automatically, carrying each item **and** its blocker. The item stays alive in the active estate, which is what makes this council-decidable rather than owner-reserved. |
+| `cancel-with-memo` | An item the run can show is no longer wanted is recorded `[-]` with a reasoning memo naming what changed. This is a **drop**, so it is owner-reserved by the preservation test: the run WRITES the memo and the recommendation, and the archive still waits for the user on that item. |
+
+<!-- decision 2026-08-20: the policy offers BOTH exits — a follow-up draft and
+     an explicit cancellation with a reasoning memo — not the follow-up draft
+     alone. AI council 2/2 (anthropic + openai), same record as above.
+     Reasoning: follow-up-draft-only means every deferred item must be carried,
+     and a carried item nobody wants becomes the parking lot the roadmap's own
+     Risk 5 describes for memos. Offering cancellation makes "this is no longer
+     wanted" a statable outcome with a written reason instead of an indefinite
+     deferral wearing a follow-up roadmap. Reversibility, and it is the load-
+     bearing half: the cancellation exit does NOT lower the gate, because a
+     drop stays owner-reserved — the run produces the memo, the user still
+     decides. Removing the value later removes an option nobody was obliged to
+     use; the default stays `wait` either way. -->
+
+
 ## 3. Grants activated by acceptance
 
 | Grant | Boundary |

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -112,7 +112,8 @@ Rung 3, by wrapper:
 
 | Wrapper | Derived mode | Contract |
 |---|---|---|
-| `/roadmap:process-full`, `/roadmap:next` | `autonomous`, **preselected** | offered |
+| `/roadmap:process-full` | `autonomous`, **preselected** | offered |
+| `/roadmap:next` | `phase-checkpoints`, **preselected** | offered |
 | `/roadmap:process-phase` | `phase-checkpoints` | offered |
 | `/roadmap:process-step` | — | none (one step needs no run contract) |
 
@@ -122,6 +123,25 @@ screen's `3. Run interactive instead` option
 ([`roadmap-execution-contract § 2`](roadmap-execution-contract.md)) stays on it
 in every case, so a derived mode is always one keystroke from being refused.
 
+<!-- decision 2026-08-20: /roadmap:next preselects `phase-checkpoints`, not
+     `autonomous`. AI council 2/2 (anthropic + openai) on the
+     `autonomy-defaults-sheet` fork of road-to-user-out-of-the-loop, record
+     agents/evidence/council/drain-blocker-dispositions-a.md. Reasoning: the two
+     wrappers differ in what the user has actually seen at Accept time.
+     `process-full` names one roadmap the user chose, so `autonomous` is a
+     preselection over a scope they read. `/roadmap:next` SELECTS the roadmap
+     itself, so `autonomous` there preselects full autonomy over a target the
+     user has not seen — the one rung where the derivation picks the object and
+     the scope in the same keystroke. Reversibility: this is a preselected
+     option on a screen that still offers `1. Go — start processing
+     autonomously`, so the aggressive path costs one keystroke and no rebuild;
+     flipping the row back is a one-line edit with no dependent mechanism.
+     Deliberately scoped to `/roadmap:next` only — the blocker's question named
+     that wrapper, and Phase 1 Step 1 of the parent roadmap landed with
+     `process-full` → `autonomous` explicitly, so widening the change would
+     silently reverse an already-shipped step nobody asked to revisit. -->
+
+
 **Why the old fallback was a defect and not a conservative default.** Absent
 `execution.mode` used to mean the legacy commit-step scan, which derives no
 contract at all — no batched artifact drafting, no council auto-enable, no
@@ -132,6 +152,23 @@ path *under the wrapper built for the opposite*, and silently — the user saw a
 A default that contradicts the wrapper the user just typed is a wrong answer,
 not a safe one.
 
+**Kill criteria — carried here, at the flip, not only in the roadmap that
+made it.** A default flip whose reversal condition lives in a roadmap is a
+flip nobody can reverse once that roadmap is archived, which is why both
+conditions below sit next to the table they govern:
+
+- **The ladder itself** (absent `execution.mode` derives a mode instead of
+  falling back to interactive): `3. Run interactive instead` chosen at the
+  contract screen in **more than 40 % of 20 runs** reverts rung 3, leaving
+  the ladder at explicit-suffix-then-frontmatter only. **No instrument
+  today** — nothing records which contract option was chosen, so the rate is
+  unmeasured rather than low. Stated so the gap is visible at the flip.
+- **The `/roadmap:next` row** (`phase-checkpoints` rather than
+  `autonomous`): reverted if checkpoint-mode runs on that wrapper are
+  observed to stop at a phase boundary the user then waves through without
+  a change — that is a contact the preselection bought nothing for. Same
+  missing instrument, same honesty: this is a condition, not a reading.
+
 **What this does NOT change.** A derived mode grants nothing on its own:
 authorization is still the single Accept on the contract screen, per
 [`roadmap-execution-contract § Principle`](roadmap-execution-contract.md). The
@@ -260,6 +297,89 @@ run can simply outlast, or a cross-roadmap dependency the run can satisfy itself
 is work. The taxonomy still lacks the row; the mislabel now has a stated test
 instead of a default.
 
+### 3d. Set contract — one contract over an enumerated set
+
+A **set contract** is the ordinary contract screen rendered over a closed,
+ordered list of roadmaps instead of one. It grants
+[`autonomy-mechanics § Task-scope`](autonomy-mechanics.md)'s **set-scoped**
+shape, whose four conditions (enumerated before Accept · closed · ordered with
+independence declared · one Accept) are the authorization contract — this
+section is only the loop's side of it.
+
+**What the screen must print, per member.** Roadmap path, derived branch name,
+open-step count, artifact count from the pre-scan, and its dependency edges.
+One decision sheet spans the whole set: a question that applies to several
+members appears once, and its answer applies to all of them.
+
+**Dependency edges come from two sources, unioned.**
+
+| Source | Shape | Trust |
+|---|---|---|
+| Declared | `depends:` in the dependent roadmap's frontmatter — a list of roadmap slugs | authoritative; a declared edge is never overridden by the heuristic |
+| Inferred | **file overlap**: the intersection of the owned-path sets the two pre-scans derived | advisory; an inferred edge orders the members and marks them non-parallelizable, and is printed as inferred so the user can see why |
+
+The union feeds exactly two decisions and nothing else: **ordering** (a
+dependent member runs after its parent) and **parallelizability** (only members
+with no edge between them and disjoint owned paths are lane candidates). An
+inferred edge is deliberately allowed to be wrong in the conservative
+direction — a false edge costs serial execution, a missed edge costs a
+collision, so overlap resolves toward *serial*.
+
+#### Auto-continuity — the next member needs no new contact
+
+Under an accepted set contract, when a member closes **green** the loop pulls
+the next member whose dependencies are all satisfied and starts it without a
+new contact. Green means: its own final report ran, its quality cadence passed,
+and no halt class fired. Anything else is not green and does not continue —
+see failure isolation below.
+
+The default stays **this one only**: auto-continuity applies to
+`/roadmap:next` and to any wrapper reaching this section **only when the set
+option was chosen on the sheet**. A single-roadmap invocation is never widened
+into a set because more roadmaps happened to be open, which is condition 4 of
+the set-scoped shape read from the loop's side.
+
+#### Failure isolation — a regression halts its own member, not the set
+
+A quality regression, a failed verify probe, or a halt class firing inside one
+member terminates **that member** and leaves the rest of the set running:
+
+1. Record the member's outcome as halted, with the halt class and the evidence.
+2. Skip every member that declares a dependency on it — transitively. A
+   dependent member of a halted parent is *blocked*, not failed, and is
+   reported as such.
+3. Continue with the next independent member.
+4. Report every member's outcome in one final report at the end of the set.
+
+Two carve-outs, and they are the reason this is isolation rather than
+tolerance. A **Hard-Floor** stop and a **locked decision class** stop the whole
+set, not one member: both are about the user's authority rather than about the
+member's code, and continuing past them under a set contract would be exactly
+the "several authorizations from one Accept" failure the enumeration guards
+against. Likewise the **N=3 validation budget** is per validation target and is
+not reset by moving to the next member.
+
+#### Parallel lanes — the shape, and why they are not on yet
+
+Lanes are **staged**, not shipped: the gate is ten clean serial set runs, and
+that gate has not been reached because no set run has happened. Recorded here
+so the shape is settled before the runs rather than designed under pressure:
+
+- **Cap: two lanes** in the first iteration — a recorded decision
+  (`decision 2026-08-20`, AI council 2/2 on the `autonomy-defaults-sheet`
+  fork), chosen over the configured `subagents.max_parallel` because a
+  collision at two lanes is diagnosable and one at N is not. Reversible: the
+  cap is one number in the set contract, and raising it after the first ten
+  clean parallel runs is strictly cheaper than recovering from a lost branch.
+- **Candidate test:** no dependency edge in either direction, and disjoint
+  owned paths.
+- **Isolation:** the existing worktree scope lock
+  ([`worktree-lifecycle`](../../skills/worktree-lifecycle/SKILL.md)).
+- **Coordination:** session-register branch claims, so two sessions never share
+  a branch.
+- **Delivery:** one branch and one PR per lane.
+- **Immediate removal:** a single scope-lock collision with data loss.
+
 ## 4. Resolve cadences — read once, cache for the run
 
 Read both keys from `.agent-settings.yml` once and cache for the whole
@@ -414,7 +534,39 @@ For each open step in the working set (scope-bound — see wrapper):
    Empty output → Iron Law 2 was violated this iteration: the step
    landed work but no checkbox flipped. **Halt loudly**, surface
    "step <N> landed without checkbox flip — flip then resume", and
-   stop the run. Do not auto-fix; the user resumes on the next turn.
+   stop the run. Outside an accepted contract: do not auto-fix; the user
+   resumes on the next turn. Inside one: exactly one self-fix attempt, under
+   the four preconditions below.
+
+   **One deterministic self-fix, contract mode only.** A forgotten flip is the
+   one halt class whose repair is mechanical — the work is on disk, the step is
+   named, and the glyph follows from the outcome. Halting a contract run on it
+   spends a user contact to retype something the run can derive. So inside an
+   accepted contract the run may attempt the flip **once**, and only when all
+   four hold:
+
+   1. **The work is citable.** The step's landed change is identifiable in this
+      iteration's own output — a diff, a file path, a command result. No
+      evidence, no flip: that is a genuine halt, not a forgotten one.
+   2. **The glyph is unambiguous.** `[x]` only for a step whose evidence is
+      present and, where the step carries a `verify:` field, whose fresh green
+      run is in this reply. Anything that would be `[~]` or `[-]` is a
+      *disposition*, never a repair — those halt exactly as before, because a
+      deferral and a cancellation are decisions.
+   3. **Exactly one attempt, per run.** Not per step. A second forgotten flip
+      in the same run halts: one is a slip, two is a broken loop, and the
+      difference is the whole justification for allowing the first.
+   4. **The attempt is verified, then re-guarded.** Re-run the
+      `git status --porcelain` probe above after the flip. Still empty → halt
+      loudly as before. A self-fix that cannot prove itself is
+      indistinguishable from the failure it was repairing.
+
+   The attempt is recorded as a decision memo (§ 4 handling), so an auto-flip is
+   reviewable after the fact rather than invisible. **Kill criterion, from the
+   originating roadmap and repeated here because a flip is a write to the source
+   of truth: one wrong auto-flip removes this allowance** and returns the guard
+   to halt-always. Reversibility is the deletion of this block — the guard
+   underneath it never changed.
 
    This guard is the deterministic counterpart to the rule's
    pre-send self-check — it catches a forgotten flip per step, not

package/dist/agent-src/rules/artifact-drafting-protocol.md

@@ -55,8 +55,12 @@ Fires once per creation task, not once per edit.
 - At most two propose → reject cycles; then stop.
 - Commit only on approval.
 - Bypass is legitimate — *"just write it"* drops the protocol immediately.
+- An artifact discovered **after** an accepted contract halts by default;
+  `late_artifacts: auto-research` is the only declared value that continues,
+  capped at three per run (mechanics guideline § Late artifacts).
 
-Body migrated to [`guideline:agent-infra/artifact-drafting-protocol-mechanics`](../docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — Phase A/B/C procedure detail + the roadmap-run batch-mode carve-out (Research-once-at-contract-time, batch scope, no `artifact_protocol: skip`).
+Body migrated to [`guideline:agent-infra/artifact-drafting-protocol-mechanics`](../docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — Phase A/B/C procedure detail + the roadmap-run batch-mode carve-out (Research-once-at-contract-time, batch scope, no `artifact_protocol: skip`) + § Late artifacts (the `halt` default
+and the five-step `auto-research` procedure).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 Extends (cross-link, don't restate): `ask-when-uncertain`,

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -39,25 +39,21 @@ THE USER IS REACHED FOR THE RESERVED SET — AND ALWAYS FOR IT.
 NEVER CITE A LOCK YOU HAVE NOT EVALUATED THIS TURN.
 ```
 
-An agent that finds a genuinely beneficial change blocked by a recorded
-past decision — an honest-null eval verdict, a "don't relitigate"
-memory or context note, a token-frugality/budget canon line, or an ADR —
-does not quietly comply and drop the change. It surfaces the conflict and
-re-evaluates the lock — **in the council by default**, reaching the user only
-for the reserved set below. Progress means adaptation: locks encode what was
-true when they were written, not a ceiling on what the package may ever become.
+An agent that finds a beneficial change blocked by a recorded decision — an
+honest-null verdict, a "don't relitigate" note, a budget-canon line, or an ADR —
+does not quietly comply and drop it. It surfaces the conflict and re-evaluates
+the lock **in the council by default**, reaching the user only for the reserved
+set below. Locks encode what was true when they were written, not a ceiling on
+what the package may ever become.
 
 **The default venue is the council, and this is a correction, not a new
-policy.** [`ai-council`](../skills/ai-council/SKILL.md) has said since its own
-Iron Law that *"a design decision the agent cannot settle from the tree goes to
-the council first, not to the user first"*, and its class table already lists
-"reopening a recorded decision". This rule used to say "offers the user a path",
-which contradicted that and made every lock an owner interrupt. The measured
-cost of the contradiction: across 26 days of transcripts, the agent reported a
-lock and waited, and the owner had to void the decision retroactively before the
-work resumed — in the two clearest cases the lock report is timestamped **before**
-the override demand. The ordering was the defect; the permission was never
-missing.
+policy.** [`ai-council`](../skills/ai-council/SKILL.md)'s Iron Law already sends
+a decision the agent cannot settle from the tree to the council first, and its
+class table lists "reopening a recorded decision". The old "offers the user a
+path" wording made every lock an owner interrupt; measured across 26 days of
+transcripts, the agent reported a lock and waited while the owner voided the
+decision retroactively — twice with the lock report timestamped **before** the
+override demand. The ordering was the defect; the permission was never missing.
 
 **Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
 tested*, not every future proposal that resembles it — if the blocked change
@@ -81,20 +77,54 @@ distinction.
 4. **Route it** — council by default (below), user only for the reserved set.
 5. **Record** the outcome with scope and `revisit-if`.
 
-These five are the obligation and they are stated here rather than only behind
-a route, because the route was measurably unreachable: `decision-revisit-gate`
-lives in the always-on `meta` pack while `decision-review` ships
-`install.default: false` in the non-default `analysis-workbench` pack, so a
-pack-legal install received the obligation and not the procedure. `routes_to`
-now names two always-on skills; the backward-audit depth in
-[`decision-review`](../skills/decision-review/SKILL.md) stays optional, which is
-the correct status for depth.
+The five are stated here, not only behind a route, because the route was
+measurably unreachable: `decision-review` ships `install.default: false` in the
+non-default `analysis-workbench` pack, so a pack-legal install received the
+obligation and not the procedure. `routes_to` now names two always-on skills;
+the backward-audit depth in
+[`decision-review`](../skills/decision-review/SKILL.md) stays optional.
 
 Full catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs,
 hard structural caps), the per-step detail, when-NOT-to-fire and the failure
 modes remain in [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
+## Reading a lock — the two descriptive axes
+
+Step 2 reads, in order: **effective state** (status · amendments · successors) →
+**provenance** → **evidence strength** → **discovery** → **current evidence**
+(does the basis still resolve in a clone?) → **reversibility of the proposed
+transition** → **reserved dimensions**. `adr_cite_check` prints six of them —
+read 6 is the agent's, because reversibility belongs to the proposed transition
+and no tool reading one record supplies it. What each field means, and what a
+`[found]` basis ref does NOT claim, is in that script's module docstring. The
+evidence-priced burden table stays in
+[`adr-layout § The reopen record`](../docs/contracts/adr-layout.md).
+
+```
+A GRADE IS A MEASUREMENT, NOT A PERMISSION — IT GRANTS NOTHING.
+CITING AN E0 LOCK AS A HARD BLOCKER WITHOUT SURFACING ITS GRADE IS A VIOLATION.
+NO GRADE LETS AN AGENT SUPERSEDE A RECORD, SKIP A COUNCIL, OR TAKE ANY ACTION
+IT COULD NOT TAKE YESTERDAY. THE COUNCIL-FIRST VENUE STAYS, AT EVERY GRADE.
+AN ADR'S HISTORICAL DECISION-MAKER DOES NOT DETERMINE ITS REOPEN VENUE.
+A LOW-EVIDENCE RECORD MAY STATE A DECISION; IT DOES NOT ESTABLISH THAT ITS
+ALTERNATIVES REMAIN INVALID.
+```
+
+Venue comes from the proposed transition, the trust boundaries it touches and
+the reserved dimensions below — never from who decided originally, and never
+from a grade. A weak grade changes how much a reopen must **do**, never who may
+do it: `authority_basis: owner_intent` is surfaced with its accumulated cost and
+never overruled, and council agreement never raises `evidence.strength` —
+sources and measurements do.
+
+**No E0/E1 agent path is enabled here, and no reading of this rule enables
+one.** Whether an independently validated grade may ever reduce the
+*authorization* burden is an owner-reserved open question — the
+`authority-coupling-decision` blocker — left unanswered because the party
+assigning a grade would be the party gaining authority from it, and would be
+self-classifying the transition as reversible-internal on top.
+
 ## Who decides — the owner-reserved set
 
 The discriminator, in one question: **does the proposed transition weaken an
@@ -121,27 +151,24 @@ forever. Availability is `agent-config council:status`, never a project file
 ([`council-availability`](council-availability.md)).
 
 Field on the ADR: `reopen_policy: directional | owner | unclassified`, absent →
-**`unclassified`**, which permits council investigation and reversible
-experiments and gates only execution of a reserved transition. Absent is
+**`unclassified`** — council investigation and reversible experiments are
+permitted; only execution of a reserved transition is gated. Absent is
 deliberately not `owner`: with 146 accepted ADRs that default would encode
-today's blockage into the new schema. Full contract, the reopen record, and the
+today's blockage into the new schema. Full contract, the reopen record and the
 precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../docs/contracts/adr-layout.md).
 
 ## See also
 
 - [`recurring-criticism`](recurring-criticism.md) — the **other entrance**: this
   rule fires when a lock blocks a change, that one when the same criticism arrives
-  again. It reuses the five steps and the owner-reserved table below.
+  again. It reuses the five steps and the owner-reserved table above.
 - [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
   procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
 - [`decision-record`](../skills/decision-record/SKILL.md) — forward-flow decision
   locking; its **§ 4 Lock the choice + consequences** requires the `Revisit-if:`
-  line that names the reopening condition up front. (This pointer used to cite an
-  "escalation litmus" heading; `grep` over `src/` + `docs/` returns two hits and
-  neither is in that file — the heading never existed, so the pointer led
-  nowhere. Corrected to the section that carries the obligation.)
+  line that names the reopening condition up front.
 - [`token-budget-discipline`](token-budget-discipline.md) — the frugality-canon
   value-over-budget escalation this rule's budget-lock case defers to.
 - [`no-cheap-questions`](no-cheap-questions.md) — the question-quality floor a
@@ -164,3 +191,8 @@ plus the curated `dist/agent-src/scripts/` list and is deliberately out of this
 change. And `docs/decisions/` is projected into no agent-visible tree at all —
 the agent sees ADR *numbers* cited across rules and skills, almost never ADR
 *text*. Until that changes, "evaluate before citing" means opening the file.
+
+`docs/contracts/` is unprojected on the same terms (`dist/agent-src/` carries no
+`docs/`), so the burden table this rule points at is maintainer-reachable only.
+That is why the reserved-set table above stays here rather than becoming a
+pointer: a consumer install receives these lines and not the contract.

package/dist/agent-src/rules/recurring-criticism.md

@@ -107,4 +107,4 @@ inflate it, so it is not claimed — skipping this rule is caught by nothing.
 - [`decision-revisit-gate`](decision-revisit-gate.md) — the other entrance; owns the five steps and the owner-reserved routing this rule reuses instead of restating. Separate file only because that one sits four lines under the 200-line cap.
 - [`self-repair-loop`](self-repair-loop.md) — the single-occurrence intake; this rule is what its `occurrences` counter is for.
 - [`active-remediation`](active-remediation.md) — the terminal "leave it" this rule does not override (see `collision_ok`).
-- [`/analyze:inbox`](../domains/analysis-workbench/analyze/inbox/command.md) § Phase 4c — the artifact-side detection that routes here.
+- [`/analyze:inbox`](../commands/analyze/inbox.md) § Phase 4c — the artifact-side detection that routes here.