@event4u/agent-config 14.7.0 → 14.9.0

package/dist/ui/index.html

@@ -27,7 +27,7 @@
                 document.documentElement.setAttribute('data-theme', theme);
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-C1pBRm1f.js"></script>
+      <script type="module" crossorigin src="/assets/index-Cxgy63kz.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-jSfMW8_t.css">
     </head>
     <body>

package/docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md

@@ -87,10 +87,54 @@ those artifacts:
   to obtain.
 - **Scope is the batch, nothing more.** An artifact NOT declared in the
   roadmap (discovered mid-run) triggers the full interactive protocol —
-  or, under the contract, the scope-out-of-roadmap halt.
+  or, under the contract, the scope-out-of-roadmap halt. That halt is the
+  **default** and stays the default; see § Late artifacts below for the one
+  declared value that changes it.
 - Batch mode never skips the Research pass itself — it relocates and
   batches it. `artifact_protocol: skip` does not exist.
 
+### Late artifacts — `halt` by default, `auto-research` only when declared
+
+The bullet above is the whole rule when the contract says nothing. A contract
+may instead declare `late_artifacts: auto-research`
+([`roadmap-execution-contract § 2a`](../../../src/agent-src/contexts/execution/roadmap-execution-contract.md)),
+and then a mid-run discovery runs **this** procedure rather than halting:
+
+1. **Re-run Phase B against current state** — the same overlap scan the batch
+   ran at contract time, now over the artifact the run just found. Nothing new
+   is invented: this is the accepted-as-non-interactive procedure, later.
+2. **Extend verdict → extend silently.** The nearest match is edited. This is
+   the outcome the overlap scan exists to produce and it needs no approval it
+   did not already have.
+3. **Create verdict → derive Phase A from what is already on the record.** The
+   understand-answers come from the roadmap step text plus the decision-sheet
+   answers the user accepted. No new question is opened.
+4. **Genuine overlap conflict → halt.** Two plausible extend targets, or a
+   match whose scope contradicts the step, is a real decision and stops the
+   run.
+5. **Cap: three per run, then halt regardless of verdict.**
+
+`halt` remains the shipped default (`decision 2026-08-20`, AI council 2/2 on
+the `autonomy-defaults-sheet` fork; record
+`agents/evidence/council/drain-blocker-dispositions-a.md`). The reasoning is
+short: the cap bounds how far an unplanned artifact can drift the run, but it
+does not decide whether the drift is wanted, and the conservative side of that
+fork is the behaviour the tree already had. Making `auto-research` a declared
+value rather than an inherited one is also what makes its own kill criterion —
+the late-artifact revisit rate — attributable to the runs that chose it.
+Reverting is one word in each of the two tables; no mechanism depends on the
+default's direction.
+
+**Kill criterion for `auto-research`, at the site rather than in a roadmap:**
+a late-artifact revisit rate above 20 % — an auto-authored or auto-extended
+artifact later reworked or reverted — removes the value and returns every
+late discovery to `halt`. **No instrument today:** nothing counts late
+artifacts or their revisits, so the rate is unmeasured rather than low, and
+the cap of three is the only live bound. Recorded here because a criterion
+that lives only in the roadmap that flipped the default becomes unreachable
+the moment that roadmap is archived.
+
+
 ## Complexity budget — the six questions before a new artefact
 
 Folded here from the 9.4.0 review (Prio 5), which named the failure mode:

package/docs/guidelines/agent-infra/false-green.md

@@ -1,6 +1,6 @@
 # False Green — the ways a passing result can be wrong here
 
-> Nine failure modes, each with the detection command that distinguishes "found nothing" from "looked at nothing". Every one is drawn from this repository's own history, not from a generic checklist.
+> Eleven failure modes, each with the detection command that distinguishes "found nothing" from "looked at nothing". Every one is drawn from this repository's own history, not from a generic checklist.
 
 _Origin: `road-to-skill-ecosystem-gate-integrity` Phase 3. The recurring shape is not that a gate reports a wrong finding — it is that a gate reports **no** finding for a reason unrelated to the property it guards, and no output distinguishes the two cases._
 
@@ -128,6 +128,52 @@ empty rendered template equals an absent target file. The gate reports
 comparing. Two absences are the absence of a comparison, not the presence of a
 match. The estate-wide audit is below.
 
+### 10. Hook-bypass override
+
+The gate never ran because the hook that runs it was disabled for that
+invocation. `git commit --no-verify` (and its short `-n` form) skips every
+pre-commit hook; `core.hooksPath` repointed at an empty directory skips them
+permanently and silently. Both produce a commit that looks exactly like a
+commit whose hooks passed. The same shape reaches the runtime hook layer: a
+concern bound in the manifest is still inert on a host that does not honour a
+deny, so "the guard is registered" is not "the guard fired".
+
+<!-- example-fence-allow: git-no-verify -- the fence teaches how to DETECT the core.hooksPath bypass; the forbidden form has to appear for the diagnostic to be readable, and every line here is a read-only query -->
+```bash
+git config --get core.hooksPath                       # empty = repo default, good
+./scripts-run src/scripts/hooks/block_no_verify --help # the tool-call guard
+agent-config hooks:status                             # per-host bindings, not the manifest
+```
+
+**Structural fix:** the bypass is blocked at tool-call time by
+`block-no-verify` on the one host that honours a deny, and the authoritative
+gate is remote CI, which no local override can skip. Never read a local green
+as evidence when the hook path was overridden — re-run in CI, or run the gate
+directly rather than through the hook.
+
+### 11. Cached-green reuse
+
+The green belongs to a different input than the one being judged. Three real
+shapes here. A gate that reads `dist/agent-src/` passes against a **stale
+projection** while the `src/` change it was meant to judge is not in the tree it
+scanned — the recorded trap is a worktree whose stale `dist` faked generator
+drift, and its mirror, a golden capture reading `dist` where the assertion was
+about `src`. A count ratchet sits inside its limit for so long that "within
+budget" stops meaning anything, which is why a baseline carries an expiry at
+all. And the conversational form: trusting a verification run earlier in the
+same session, after the tree has moved underneath it.
+
+```bash
+bash src/scripts/condense.sh --changed        # dist != rewrite(src) => the scan root is stale
+./scripts-run src/scripts/check_condensation --summary   # byte-exactness dist vs rewrite(src)
+```
+
+**Structural fix:** regenerate before judging (`task sync` then
+`task generate-tools`, in that order), and treat a baseline unchanged past
+`STALE_AFTER_DAYS` (56, `_lib/gate_baseline.ts:39`) as suppression rather than
+as headroom. A completion claim rests on a run made **after** the last edit, not
+on the freshest run you happen to remember.
+
 ## The audited sync/parity gates
 
 Comparison-shaped gates carry entry #9's failure mode by default: `diff a b`

package/docs/guidelines/agent-infra/traceability-field-mechanics.md

@@ -0,0 +1,50 @@
+# Traceability field mechanics — `traceability:` in the roadmap execution contract
+
+> Migrated from [`roadmap-execution-contract`](../../../src/agent-src/contexts/execution/roadmap-execution-contract.md)
+> § 2c, 2026-08-22, because the section pushed that file past the 16,000-char
+> depth ceiling. The contract keeps the field shape and the reused grammars; the
+> semantics a reader needs before writing a row live here. Established P4
+> pattern: the obligation stays in the contract, the mechanics move.
+
+## Identity semantics — stated, because a slug grammar does not imply them
+
+- **Namespace:** the roadmap file. Two roadmaps MAY use the same
+  `requirement_id` when they reference the same external requirement; within one
+  file an id is unique.
+- **Cardinality:** one row is one `(requirement, acceptance)` pair with its
+  evidence. A requirement with two criteria is two rows.
+- **Renames:** ids are content-addressed, not path-addressed — moving or renaming
+  a roadmap does not change them.
+
+## Revision semantics — when a ref is evaluated
+
+**At the current head, always.** A ref that resolved at declaration time and no
+longer resolves is `unresolved`, and that is the intended reading rather than a
+defect in the reading: evidence that has been deleted is exactly what a
+traceability inventory exists to surface. The consequence is stated rather than
+discovered: **a completed roadmap can move from resolved to unresolved with no
+roadmap edit**, because the tree moved under it.
+
+## What "gate" means here, of the three things it could mean
+
+The council named three unresolved senses. Exactly one ships:
+
+| Sense | Status |
+|---|---|
+| **Listing** declarations | **ships** — inventory, exit 0 always |
+| **Resolving** references | ships as part of the listing, reported as a count |
+| **Enforcing** roadmap validity | **does not ship**, and does not ship until the relation model above has been exercised on a real corpus |
+
+## The `[AC:<id>]` prefix on a `verify:` line
+
+A `verify:` line may carry a leading `[AC:<acceptance_id>]` to bind that check to
+a criterion.
+
+**Nothing parses `verify:` lines structurally today** — verified 2026-08-22: a
+grep across `src/scripts/*.ts` finds the template prose emitted by
+`new_roadmap.ts` and one comment in `lint_evidence_artifacts.ts`, and nothing
+else. Both halves of that matter. **Nothing breaks**, because there is no parser
+to break. And **there is nothing to build on** either: the inventory below is
+the first structural reader of those lines, so any claim about `[AC:…]` coverage
+rests entirely on it.
+

package/docs/guidelines/agent-infra/untrusted-input-spotlighting.md

@@ -135,6 +135,23 @@ recommends. The mapping (no new gate needed):
 | LLM01 #6 — segregate and identify external content | [`untrusted-input-defense`](../../../src/rules/untrusted-input-defense.md) + this guideline |
 | LLM06 — least agency / post-action gating | [`runtime-safety`](../../../src/rules/runtime-safety.md) (manual/assisted/automated), [`verify-before-complete`](../../../src/rules/verify-before-complete.md) |
 
+## The content-scanning hook
+
+`injection_scan_hook.ts` binds to `post_tool_use`, reads tool output, and
+reports **15 measured encoding channels plus four phrase families** — measured
+over the frozen corpus at `internal/bench/corpora/encoding-channels/` at
+**99.00 % recall and a 0.85 % false-positive rate**. It is warn-only
+(`fail_closed: false`, `severity: advisory` in `hook_manifest.yaml`) and ships
+**default-OFF**.
+
+Read those two numbers as properties of that corpus, not of the wild: a channel
+nobody put in the corpus is a channel the recall figure says nothing about.
+
+It changes nothing about the rule's `enforced_by` field, and the reason is in
+[`untrusted-input-defense § Enforcement`](../../../src/rules/untrusted-input-defense.md):
+a hook that cannot refuse does not enforce. The detector narrows what an
+injection can do unnoticed; it does not make the quarantine mechanical.
+
 ## Limits
 
 Detection and spotlighting are **probabilistic** layers, not guarantees

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.7.0",
+    "version": "14.9.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,
@@ -55,7 +55,11 @@
         "LICENSE",
         "MIGRATION.md",
         "README.md",
-        "llms.txt"
+        "llms.txt",
+        "!dist/**/*.test.js",
+        "!dist/**/*.test.js.map",
+        "!dist/**/*.spec.js",
+        "!dist/**/*.spec.js.map"
     ],
     "bin": {
         "agent-config": "dist/cli/agent-config.js"
@@ -77,7 +81,7 @@
         "build:mcp-catalog": "./scripts-run src/scripts/build_mcp_catalog --write --strict",
         "build": "npm run build:cli && npm run build:install-bundle && npm run build:hooks && npm run build:mcp-bundle && npm run build:cli-delegate && npm run build:ui",
         "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.scripts.json",
-        "lint:ts": "eslint --cache 'src/**/*.ts'",
+        "lint:ts": "eslint --cache --max-warnings 0 'src/**/*.ts'",
         "test:ts": "vitest run",
         "lint:publint": "publint",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",

package/src/agent-src/scripts/archive_completed_roadmaps.ts

@@ -398,10 +398,13 @@ function _regen_dashboard(root: string, dry_run: boolean): void {
     // Python: `_run([sys.executable, str(script)], root)`; the twin spawns the
     // dashboard generator twin through the same `tsx` runtime, cwd=root.
     _runTwin(root, script);
-    const dash = path.join(root, 'agents', 'roadmaps-progress.md');
-    if (_isFile(dash)) {
-        _run(['git', 'add', '--', 'agents/roadmaps-progress.md'], root);
-    }
+    // The dashboard is NOT staged. It is gitignored in this repository, and
+    // `git add -- <ignored-path>` exits 1 with "The following paths are ignored"
+    // -- a code `_run` returns and this call site discarded, so the previous
+    // `git add` here was a silent no-op from the moment the file was untracked
+    // (2026-08-21) and nothing objected. Regenerating it is still correct; the
+    // developer reads it on disk, and `task roadmap-progress-check` compares a
+    // present copy against a fresh render.
 }
 
 /**

package/src/agent-src/scripts/dashboard_mode.ts

@@ -0,0 +1,212 @@
+// The `--check` tracked/untracked mode table for the roadmap dashboard.
+//
+// Extracted from `update_roadmap_progress.ts` so the verdict is a pure function
+// over observable state — the generator does the I/O, this decides. It also
+// keeps that script under its per-file size cap.
+
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+
+/**
+ * Is the dashboard expected to be a committed artefact? Explicit, never
+ * inferred from git state — an unconditional "absent means pass" cannot tell a
+ * correctly-untracked repo from a generator that silently stopped producing
+ * output. `tracked` is the default and the historical behaviour.
+ */
+export type DashboardMode = 'tracked' | 'untracked';
+
+/**
+ * Is `abs` in the git index? Used only by `--check --untracked-mode`, to tell
+ * "correctly absent" from "still committed". No git at all answers `false`,
+ * which is correct: nothing is tracked there.
+ */
+export function isTrackedInGit(abs: string, repo_root: string): boolean {
+    const r = spawnSync('git', ['ls-files', '--error-unmatch', '--', abs], {
+        cwd: repo_root,
+        encoding: 'utf-8',
+        timeout: 10_000,
+    });
+    return r.status === 0;
+}
+
+export interface DashboardStateInput {
+    mode: DashboardMode;
+    /** Is the file on disk? */
+    present: boolean;
+    /** Is the file in the git index? Only consulted in `untracked` mode. */
+    trackedInGit: boolean;
+    /** Does the on-disk content equal a fresh render? Only meaningful if present. */
+    current: boolean;
+    /** Repo-relative path, for the messages. */
+    rel: string;
+    /**
+     * How to regenerate, for the stale/missing messages. Defaults to the
+     * dashboard's own command. A second caller — `build_archive_index --check`
+     * — reuses this table for a different generated artefact, and a message
+     * telling that reader to run the dashboard generator would be wrong.
+     */
+    regen?: string;
+    /**
+     * What the artefact is called in the "deliberately does not commit the X"
+     * hint. Defaults to `dashboard` so every existing message is byte-identical.
+     */
+    noun?: string;
+}
+
+export interface DashboardStateVerdict {
+    /** True when the dashboard half of `--check` fails. */
+    stale: boolean;
+    /** Diagnostic for stderr, or null. */
+    error: string | null;
+    /** Success line for stdout, or null when `stale`. */
+    ok: string | null;
+}
+
+// The SOURCE path, not `.augment/scripts/…`: that tree is a gitignored
+// projection built by `task sync`, so the advice failed outright in a fresh
+// worktree and in any CI step ordered before the sync.
+const REGEN =
+    'Run `./scripts-run src/agent-src/scripts/update_roadmap_progress` ' +
+    'to regenerate (or `task roadmap-progress` in Taskfile projects).';
+
+/**
+ * The mode table:
+ *
+ *   tracked:   absent -> fail | present+stale -> fail | present+current -> pass
+ *   untracked: in-index -> fail | absent -> pass | present+stale -> fail
+ *              | present+current -> pass
+ *
+ * Absence is distinguished ONLY in untracked mode; a present file is
+ * freshness-checked in both, so untracked never means unchecked.
+ */
+export function evaluateDashboardState(inp: DashboardStateInput): DashboardStateVerdict {
+    const { mode, present, trackedInGit, current, rel } = inp;
+    const regen = inp.regen ?? REGEN;
+    const noun = inp.noun ?? 'dashboard';
+
+    if (mode === 'untracked' && trackedInGit) {
+        // Migration incomplete: declared untracked, still carried by git.
+        // Print the fix; never run it — git-index ops are the user's.
+        return {
+            stale: true,
+            error:
+                `❌  ${rel} is still tracked by git, but this repository runs ` +
+                '`--untracked-mode`. Untrack it, keeping the working-tree file:\n' +
+                `      git rm --cached ${rel}\n`,
+            ok: null,
+        };
+    }
+
+    if (!present) {
+        if (mode === 'tracked') {
+            return {
+                stale: true,
+                error:
+                    `❌  ${rel} is missing. ` +
+                    regen.replace('to regenerate', 'to generate it') +
+                    ' If this repository deliberately does not commit the ' +
+                    `${noun}, pass \`--untracked-mode\`.\n`,
+                ok: null,
+            };
+        }
+        // untracked + absent: the declared state. "up to date" would mislead.
+        return {
+            stale: false,
+            error: null,
+            ok: `✅  ${rel} is not committed here (--untracked-mode) and no stale copy is on disk.\n`,
+        };
+    }
+
+    if (!current) {
+        return { stale: true, error: `❌  ${rel} is stale. ${regen}\n`, ok: null };
+    }
+    return { stale: false, error: null, ok: `✅  ${rel} is up to date.\n` };
+}
+
+/**
+ * `evaluateDashboardState` against the real filesystem and git index. The
+ * generator hands over the paths; every read the verdict needs happens here, so
+ * the caller's check branch stays three lines.
+ */
+export function evaluateDashboardOnDisk(opts: {
+    mode: DashboardMode;
+    target: string;
+    repo_root: string;
+    rendered: string;
+    rel: string;
+    regen?: string;
+    noun?: string;
+}): DashboardStateVerdict {
+    const present = fs.existsSync(opts.target);
+    return evaluateDashboardState({
+        mode: opts.mode,
+        present,
+        trackedInGit: opts.mode === 'untracked' && isTrackedInGit(opts.target, opts.repo_root),
+        current: present && fs.readFileSync(opts.target, { encoding: 'utf-8' }) === opts.rendered,
+        rel: opts.rel,
+        ...(opts.regen === undefined ? {} : { regen: opts.regen }),
+        ...(opts.noun === undefined ? {} : { noun: opts.noun }),
+    });
+}
+
+/** One roadmap row, as far as the estate report below needs it. */
+export interface EstateRow {
+    rel: string;
+    done: number;
+    total_active: number;
+    deferred: number;
+}
+
+/**
+ * The `--check` report: the artefact's own verdict, then the estate-wide
+ * conditions — completed-but-unarchived, and Iron Law 3 deferred items.
+ *
+ * `dashboardOnly` drops the estate half. Two obligations with two blast radii:
+ * the artefact verdict is about ONE file and is safe behind a required status
+ * check, while the estate conditions are about roadmaps an unrelated change
+ * never touched, so requiring them turns any pre-existing estate defect into a
+ * merge block on every PR. It did, on 2026-08-22.
+ *
+ * Extracted from the generator so the report is a pure function of the verdict
+ * and two lists — and because the generator sits exactly on its 1500-line
+ * source ceiling, where the honest way to add a feature is to take lines out.
+ */
+export function reportCheckVerdict(inp: {
+    verdict: DashboardStateVerdict;
+    complete: readonly EstateRow[];
+    pending: readonly EstateRow[];
+    dashboardOnly: boolean;
+    warnMergeGated: () => void;
+    gatedCount: number;
+}): { rc: number; stdout: string; stderr: string } {
+    const { verdict, dashboardOnly } = inp;
+    const complete = dashboardOnly ? [] : inp.complete;
+    const pending = dashboardOnly ? [] : inp.pending;
+    let err = verdict.error ?? '';
+    if (complete.length) {
+        err +=
+            '❌  Completed roadmaps are still in `agents/roadmaps/` — ' +
+            'move them to `agents/roadmaps/archive/` (per the ' +
+            '`roadmap-progress-sync` rule):\n';
+        for (const r of complete) err += `      - ${r.rel}  (${r.done}/${r.total_active} done)\n`;
+    }
+    if (pending.length) {
+        err +=
+            '❌  Iron Law 3 — roadmaps with unresolved `[~]` deferred ' +
+            'items must NOT auto-archive. Resolve via `roadmap-management § 4b` ' +
+            '(spawn follow-up, restore, or cancel):\n';
+        for (const r of pending) {
+            err += `      - ${r.rel}  (${r.done}/${r.total_active} done · ${r.deferred} deferred)\n`;
+        }
+    }
+    if (!dashboardOnly && inp.gatedCount > 0) inp.warnMergeGated();
+    const rc = verdict.stale || complete.length > 0 || pending.length > 0 ? 1 : 0;
+    return { rc, stdout: rc === 0 ? (verdict.ok ?? '') : '', stderr: err };
+}
+
+/** `--tracked-mode` / `--untracked-mode` → the mode, or null for any other token. */
+export function parseModeToken(tok: string): DashboardMode | null {
+    if (tok === '--tracked-mode') return 'tracked';
+    if (tok === '--untracked-mode') return 'untracked';
+    return null;
+}

package/src/agent-src/scripts/update_roadmap_progress.ts

@@ -64,6 +64,12 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { run_archival_sweep } from './archival_sweep.js';
+import {
+    evaluateDashboardOnDisk,
+    parseModeToken,
+    reportCheckVerdict,
+    type DashboardMode,
+} from './dashboard_mode.js';
 import type * as YamlModule from 'yaml';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -998,8 +1004,9 @@ function render(roadmaps: RoadmapStats[], bundles: Bundle[] | null, roadmap_root
         // script name covers the rest.
         '> Auto-generated — do not edit. Regenerate with `task roadmap-progress` ' +
             'or by running the `update_roadmap_progress` script for your install; ' +
-            'rewritten on every roadmap create / execute / completion change ' +
-            '(timestamp lives in git history).\n>\n' +
+            'rewritten on every roadmap create / execute / completion change. ' +
+            'A repository that does not commit this file has no git history for ' +
+            'it — regenerate to see the current state.\n>\n' +
             header_meta,
     );
     lines.push('## Overall\n');
@@ -1214,18 +1221,32 @@ class ArgparseExit extends Error {
 const _PROG = 'update_roadmap_progress.py';
 
 function _usage(): string {
-    return `usage: ${_PROG} [-h] [--check] [--archive | --no-archive] [--repo-root REPO_ROOT]\n`;
+    return (
+        `usage: ${_PROG} [-h] [--check] [--tracked-mode | --untracked-mode]\n` +
+        `       [--archive | --no-archive] [--repo-root REPO_ROOT] [--dashboard-only]\n`
+    );
 }
 
 interface Args {
     check: boolean;
+    mode: DashboardMode;
     archive: boolean;
     repo_root: string;
+    /**
+     * Assert ONLY this artefact's own state — tracked / absent / stale — not
+     * the estate-wide conditions `--check` also carries. Two obligations, two
+     * blast radii: why that split exists, and what it cost when it did not,
+     * is on the `roadmap-dashboard-untracked-check` task in
+     * `taskfiles/content.yml`.
+     */
+    dashboard_only: boolean;
 }
 
 function _parseArgs(argv: readonly string[]): Args {
     let check = false;
+    let mode: DashboardMode = 'tracked';
     let archive = false;
+    let dashboard_only = false;
     let repo_root = process.cwd();
     const emitError = (msg: string): never => {
         process.stderr.write(_usage());
@@ -1241,6 +1262,12 @@ function _parseArgs(argv: readonly string[]): Args {
         } else if (tok === '--check') {
             check = true;
             i += 1;
+        } else if (parseModeToken(tok) !== null) {
+            mode = parseModeToken(tok) as DashboardMode;
+            i += 1;
+        } else if (tok === '--dashboard-only') {
+            dashboard_only = true;
+            i += 1;
         } else if (tok === '--archive') {
             archive = true;
             i += 1;
@@ -1267,7 +1294,10 @@ function _parseArgs(argv: readonly string[]): Args {
         // rather than silently letting one win.
         emitError('argument --archive: not allowed with --check');
     }
-    return { check, archive, repo_root };
+    if (dashboard_only && !check) {
+        emitError('argument --dashboard-only: only meaningful with --check');
+    }
+    return { check, mode, archive, repo_root, dashboard_only };
 }
 
 /**
@@ -1334,13 +1364,10 @@ function main(argv?: readonly string[]): number {
     }
     const roadmaps = collect(roadmap_root);
     const new_text = render(roadmaps, collect_bundles(repo_root), roadmap_root);
-    const current = fs.existsSync(target) ? fs.readFileSync(target, { encoding: 'utf-8' }) : '';
     const complete = unarchived_complete(roadmaps);
     const pending = pending_iron_law_3(roadmaps);
     const gated = merge_gated_pending(roadmaps);
 
-    const _relToRepo = (p: string): string => _relPosix(repo_root, p);
-
     const _warn_merge_gated = (): void => {
         process.stderr.write(
             '⏳  Merge-gated roadmaps (every open item gated on a PR) — ' +
@@ -1357,50 +1384,22 @@ function main(argv?: readonly string[]): number {
     };
 
     if (args.check) {
-        const stale = current !== new_text;
-        if (stale) {
-            process.stderr.write(
-                `❌  ${_relToRepo(target)} is stale. ` +
-                    'Run `node node_modules/.bin/tsx .augment/scripts/update_roadmap_progress.ts` ' +
-                    'to regenerate (or `task roadmap-progress` in Taskfile ' +
-                    'projects).\n',
-            );
-        }
-        if (complete.length) {
-            process.stderr.write(
-                '❌  Completed roadmaps are still in `agents/roadmaps/` — ' +
-                    'move them to `agents/roadmaps/archive/` (per the ' +
-                    '`roadmap-progress-sync` rule):\n',
-            );
-            for (const r of complete) {
-                process.stderr.write(`      - ${r.rel}  (${r.done}/${r.total_active} done)\n`);
-            }
-        }
-        if (pending.length) {
-            process.stderr.write(
-                '❌  Iron Law 3 — roadmaps with unresolved `[~]` deferred ' +
-                    'items must NOT auto-archive. Resolve via `roadmap-management § 4b` ' +
-                    '(spawn follow-up, restore, or cancel):\n',
-            );
-            for (const r of pending) {
-                process.stderr.write(
-                    `      - ${r.rel}  (${r.done}/${r.total_active} done · ` +
-                        `${r.deferred} deferred)\n`,
-                );
-            }
-        }
-        if (gated.length) {
-            _warn_merge_gated();
-        }
-        if (stale || complete.length || pending.length) {
-            return 1;
-        }
-        process.stdout.write(`✅  ${_relToRepo(target)} is up to date.\n`);
-        return 0;
+        const rel = _relPosix(repo_root, target);
+        const r = reportCheckVerdict({
+            verdict: evaluateDashboardOnDisk({ mode: args.mode, target, repo_root, rendered: new_text, rel }),
+            complete,
+            pending,
+            dashboardOnly: args.dashboard_only,
+            warnMergeGated: _warn_merge_gated,
+            gatedCount: gated.length,
+        });
+        if (r.stderr) process.stderr.write(r.stderr);
+        if (r.stdout) process.stdout.write(r.stdout);
+        return r.rc;
     }
     fs.writeFileSync(target, new_text, { encoding: 'utf-8' });
     process.stdout.write(
-        `✅  Wrote ${_relToRepo(target)} · ` +
+        `✅  Wrote ${_relPosix(repo_root, target)} · ` +
             `${roadmaps.length} roadmap(s) · ` +
             `${roadmaps.reduce((s, r) => s + r.done, 0)}/${roadmaps.reduce((s, r) => s + r.total_active, 0)} steps done.\n`,
     );

package/src/config/ci-local-parity.yml

@@ -184,6 +184,27 @@ ci_only:
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer
 # adding it: a local-only gate is the direction that let real defects merge.
 local_only:
+  - id: check_hook_bundle_content
+    class: developer-machine-scoped
+    reason: >
+      Compares `dist/hooks/dispatch.js` — the bundle that ACTUALLY EXECUTES the
+      hooks — against a rebuild from this checkout's sources. `git ls-files
+      dist/hooks/` returns ZERO: the bundle is an untracked local build
+      artefact, so a fresh CI checkout has none and the gate can only report
+      "nothing to compare". Wiring it into a workflow would measure an artefact
+      no CI run has, which is the empty-scope false green this repo's
+      gate-coverage manifest exists to refuse. Declared rather than wired for
+      the same reason `check_single_delivery` below is. The blind spot it
+      closes is real and was measured on 2026-08-21: an edit to the git guard's
+      authorization window was never rebuilt into the bundle and the guard kept
+      enforcing the old value for a full hour. The sibling
+      `check_hook_bundle_freshness` did not miss it — that gate is pre-push and
+      was never run, and an ordinary edit moves the source mtime, so it would
+      have reddened. What it structurally cannot see is the narrower set this
+      gate covers: an mtime-preserving write, a `touch` on the bundle, a `cp -p`
+      restore. Ordering is not equivalence. That asymmetry is the finding: a green
+      CI cannot speak for the bundle a maintainer is running, and only a local
+      gate can. Cost measured, like its neighbours in the pre-push set: 0.27s.
   - id: check_single_delivery
     class: developer-machine-scoped
     reason: >