@event4u/agent-config 14.7.0 → 14.9.0

package/dist/agent-src/skills/code-review/evals/evals.json

@@ -1,59 +1,100 @@
 {
- "skill": "code-review",
- "_calibration": "Behavioral fixtures incl. the U2 golden-adversarial pair (reliability-measurement, 2026-07-13). finding_floor is an enforcing mechanism since the 2026-07-13 cross-host calibration (internal/bench/reports/parity-count.json); these per-fixture n values are conservative floors derived from the fixture's planted-defect count. The golden-* pair is the review regression gate: the planted-injection diff must be flagged high/block, the benign look-alike must NOT be flagged as injection.",
- "scenarios": [
-  {
-   "id": "diff-with-multiple-issues",
-   "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nfunction pay(amount) {\n  var x = amount\n  eval(userInput)\n  db.query('SELECT * FROM users WHERE id = ' + req.params.id)\n  return x\n}\n```",
-   "assertions": [
+  "skill": "code-review",
+  "_calibration": "Behavioral fixtures incl. the U2 golden-adversarial pair (reliability-measurement, 2026-07-13). finding_floor is an enforcing mechanism since the 2026-07-13 cross-host calibration (internal/bench/reports/parity-count.json); these per-fixture n values are conservative floors derived from the fixture's planted-defect count. The golden-* pair is the review regression gate: the planted-injection diff must be flagged high/block, the benign look-alike must NOT be flagged as injection.",
+  "scenarios": [
     {
-     "kind": "finding_floor",
-     "n": 2
+      "id": "diff-with-multiple-issues",
+      "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nfunction pay(amount) {\n  var x = amount\n  eval(userInput)\n  db.query('SELECT * FROM users WHERE id = ' + req.params.id)\n  return x\n}\n```",
+      "assertions": [
+        {
+          "kind": "finding_floor",
+          "n": 2
+        },
+        {
+          "kind": "contains",
+          "value": "eval"
+        }
+      ]
     },
     {
-     "kind": "contains",
-     "value": "eval"
-    }
-   ]
-  },
-  {
-   "id": "clean-diff-few-findings",
-   "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nexport function add(a: number, b: number): number {\n  return a + b\n}\n```",
-   "assertions": [
+      "id": "clean-diff-few-findings",
+      "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nexport function add(a: number, b: number): number {\n  return a + b\n}\n```",
+      "assertions": [
+        {
+          "kind": "finding_floor",
+          "n": 0
+        }
+      ]
+    },
     {
-     "kind": "finding_floor",
-     "n": 0
-    }
-   ]
-  },
-  {
-   "id": "golden-sqli-must-block",
-   "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low):\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ' + req.params.id).then(r => res.json(r));\n});\n```",
-   "assertions": [
+      "id": "golden-sqli-must-block",
+      "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low):\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ' + req.params.id).then(r => res.json(r));\n});\n```",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "injection"
+        },
+        {
+          "kind": "finding_floor",
+          "n": 1,
+          "pattern": "(?i)critical|high|block"
+        }
+      ]
+    },
     {
-     "kind": "contains",
-     "value": "injection"
+      "id": "golden-benign-lookalike-no-injection",
+      "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low). If it is clean, say 'no findings':\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ?', [req.params.id]).then(r => res.json(r));\n});\n```",
+      "assertions": [
+        {
+          "kind": "not_contains",
+          "value": "SQL injection"
+        },
+        {
+          "kind": "not_contains",
+          "value": "sql injection"
+        }
+      ]
     },
     {
-     "kind": "finding_floor",
-     "n": 1,
-     "pattern": "(?i)critical|high|block"
-    }
-   ]
-  },
-  {
-   "id": "golden-benign-lookalike-no-injection",
-   "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low). If it is clean, say 'no findings':\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ?', [req.params.id]).then(r => res.json(r));\n});\n```",
-   "assertions": [
+      "id": "golden-spec-gap-correct-but-wrong",
+      "_why": "The scenario the corpus had no shape for. Correct, clean, typed, tested — and it does not do what the criterion asked. Before the spec judge joined the default path all five judges returned green on exactly this class, which is the miss this fixture records rather than merely describes. Its pair below is the negative control: same criterion, an implementation that DOES satisfy it, so a judge that flags every diff as non-compliant fails one of the two.",
+      "prompt": "ACCEPTANCE CRITERION: \"Retries use exponential backoff, so the delay between attempts grows.\"\n\nReview this diff against the criterion above and state, for the criterion, one of SATISFIED / PARTIAL / MISSING with the hunk and the test that proves it:\n```ts\n/** Retry with a delay between attempts. */\nexport async function retry<T>(fn: () => Promise<T>, attempts = 3, delayMs = 100): Promise<T> {\n  let last: unknown;\n  for (let i = 0; i < attempts; i += 1) {\n    try {\n      return await fn();\n    } catch (err) {\n      last = err;\n      await new Promise((r) => setTimeout(r, delayMs));\n    }\n  }\n  throw last;\n}\n```\n```ts\nit('retries three times then rethrows', async () => {\n  let n = 0;\n  await expect(retry(async () => { n += 1; throw new Error('x'); })).rejects.toThrow('x');\n  expect(n).toBe(3);\n});\n```",
+      "assertions": [
+        {
+          "kind": "finding_floor",
+          "n": 1
+        },
+        {
+          "kind": "contains",
+          "value": "backoff"
+        }
+      ]
+    },
     {
-     "kind": "not_contains",
-     "value": "SQL injection"
+      "id": "golden-spec-gap-negative-control",
+      "_why": "Negative control for the pair above, on the SAME criterion. A judge that reports non-compliance on every diff would pass the fixture above for the wrong reason; this one fails it. The pair is what makes the spec axis falsifiable rather than merely present.",
+      "prompt": "ACCEPTANCE CRITERION: \"Retries use exponential backoff, so the delay between attempts grows.\"\n\nReview this diff against the criterion above and state, for the criterion, one of SATISFIED / PARTIAL / MISSING with the hunk and the test that proves it:\n```ts\nexport async function retry<T>(fn: () => Promise<T>, attempts = 3, baseMs = 100): Promise<T> {\n  let last: unknown;\n  for (let i = 0; i < attempts; i += 1) {\n    try {\n      return await fn();\n    } catch (err) {\n      last = err;\n      await new Promise((r) => setTimeout(r, baseMs * 2 ** i));\n    }\n  }\n  throw last;\n}\n```\n```ts\nit('grows the delay between attempts', async () => {\n  const waits: number[] = [];\n  vi.spyOn(global, 'setTimeout').mockImplementation(((cb: () => void, ms: number) => { waits.push(ms); cb(); return 0 as never; }) as never);\n  await expect(retry(async () => { throw new Error('x'); }, 3, 100)).rejects.toThrow();\n  expect(waits).toEqual([100, 200, 400]);\n});\n```",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "SATISFIED"
+        }
+      ]
     },
     {
-     "kind": "not_contains",
-     "value": "sql injection"
+      "id": "golden-spec-no-criteria-must-not-pass",
+      "_why": "Step 1.3, and the case where inferring the spec from the diff is most tempting: an ad-hoc review with no criteria at all. A judge that infers the requirement from the change always finds the change compliant, so SATISFIED here is the circularity failure and not a lenient reading. The expected outcome is an explicit no-criteria verdict.",
+      "prompt": "No acceptance criteria were supplied for this review.\n\nReview this diff against its acceptance criteria and report the criteria-source state first, then any per-criterion verdicts:\n```ts\nexport function slugify(s: string): string {\n  return s.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');\n}\n```",
+      "assertions": [
+        {
+          "kind": "contains",
+          "value": "not_provided"
+        },
+        {
+          "kind": "not_contains",
+          "value": "SATISFIED"
+        }
+      ]
     }
-   ]
-  }
- ]
+  ]
 }

package/dist/agent-src/skills/decision-record/SKILL.md

@@ -119,6 +119,21 @@ Write:
   law instead of a decision under current conditions; see
   [`decision-revisit-gate`](../../rules/decision-revisit-gate.md) for
   what happens when a later change is blocked by it without one.
+  It is an externally observable **condition**, never a cadence and never
+  permanence under a field name: `terminal`, `none`, "never" and "forever"
+  are invalid, and `unclassified` is legal only on an *existing* record
+  during the migration — never on the one you are locking now.
+- **Evidence + assumptions, split explicitly.** Every load-bearing factual
+  claim in the rationale either points at a basis ref — `file:line`, a URL, a
+  `docs/CLAIMS.md` claim id, a benchmark id — or is **labelled an
+  assumption**. There is no third state. Cite nothing and the record grades
+  `E0`, which is honest and publishable; a confident grade over no citations
+  is not. **Agreement is not evidence:** the council converging, or two
+  models liking the same option, is `provenance: agentic` with
+  `agentic_mode: council` — sources and measurements raise the grade,
+  consensus does not. A human product call records `E0` plus
+  `authority_basis: owner_intent` rather than a faked grade. Vocabulary:
+  [`adr-layout § Provenance and evidence`](../../../docs/contracts/adr-layout.md).
 
 ### 5. Wire the supersession chain (if any)
 
@@ -129,9 +144,34 @@ If this decision overrides a prior ADR:
   not "we now think differently".
 - Hand off the `supersedes:` linkage to `adr-create`.
 
-### 6. Hand off to file mechanics
+### 6. Admission gate — is this an ADR at all?
 
-Output the structured payload (below). The user — or
+Classify **before** handing off. A locked choice earns an ADR only when it is
+architecturally significant on at least one axis:
+
+- **Hard or costly to reverse** — a one-way door: public API shape, DB schema,
+  wire format, published identifier, migration.
+- **Broadly constraining** — it binds work outside the module that made it.
+- **Crosses a governed surface** — consumer contract, API, security or privacy
+  floor, package structure.
+
+None of the three → **no ADR**. The record still exists; it lands as a
+decision note in `agents/decisions/`, a config value, a measurement record in
+`docs/CLAIMS.md`, an experiment, or a roadmap item. Explicitly not ADRs: a
+temporary numeric threshold · a benchmark value · a model mapping · one-off
+release sequencing · a reversible local implementation detail.
+
+**The reference case is in this tree.** ADR-002 encodes `25 000 → 26 000` and
+a `4.0k` override ceiling as architecture law (`ADR-002:55`, `:62`), and
+ADR-114 then had to add another override while recording that 7 of 9 kernel
+rules already carry them (`ADR-114:74`). The *principle* — a kernel budget
+exists, is measured, and is capped — is the ADR. The numbers belong in a
+versioned budget contract with a regression gate, so a recalibration stops
+needing an architecture supersession.
+
+### 7. Hand off to file mechanics
+
+Gate passed → output the structured payload (below). The user — or
 `adr-create` — turns it into the file.
 
 ## Weighted-matrix mode (quantitative)
@@ -226,10 +266,22 @@ Consequences:
   - <becomes harder>
   ✗ <becomes impossible>
 
+Assumptions:
+  ~ <load-bearing claim with no basis ref>
+
+Evidence:
+  <basis ref>  — file:line | URL | CLAIMS id | benchmark id   (or: none — E0)
+
+Provenance: human | agentic | mixed | unknown   (agentic_mode: single | council | delegated)
+Grade:      E0 | E1 | E2 | E3 | E4             (authority_basis: evidence | owner_intent)
+
 Supersedes: <ADR-XYZ "title">  (if any)
 Trigger:    <what changed>     (if superseding)
+Revisit-if: <observable condition>
+
+Admission gate: ADR | decision note | config value | measurement | experiment | roadmap item
 
-Next: /adr-create  with the payload above
+Next: /adr-create  with the payload above   (only when the gate says ADR)
 ```
 
 ## Gotcha
@@ -240,6 +292,12 @@ Next: /adr-create  with the payload above
   cons for the chosen option, you have not understood it yet.
 - A supersession with no "what changed in the world" is a vibe
   pivot. Reject and ask.
+- An unlabelled guess is worse than a labelled one. A claim with no basis ref
+  and no assumption label reads as established fact to the next reader.
+- "The council agreed" is a provenance fact, not an evidence grade. If the
+  only support is agreement, the grade is `E0` — write it.
+- Writing an ADR for a threshold is how a recalibration becomes an
+  architecture supersession. Run the admission gate first.
 
 ## Do NOT
 

package/dist/agent-src/skills/decision-review/SKILL.md

@@ -93,6 +93,31 @@ available at the time it was made**, not against the outcome alone.
 A decision can be correct given the information then and still need
 revision now.
 
+**Read the record's axes in this order** — each step can end the review, so
+running them out of order pays for the expensive ones first:
+
+1. **Effective state** — status, `superseded_by`, amendments, whether the
+   `review_trigger` fired. `superseded`/`deprecated` is not a live lock at all.
+2. **`provenance`** (+ `agentic_mode`) — who decided; descriptive only.
+3. **`evidence.strength`** — E0–E4, claim-relative, not a count of sources.
+4. **`evidence.discovery`** — on E0, `incomplete` means *nobody looked*: a
+   discovery failure, not an evidence failure. Search before treating the
+   absence as established, or the grade measures the review, not the decision.
+5. **Current evidence** — what tree, measurements and sources say *today*.
+6. **Reversibility** — of the transition you propose, not of the original
+   decision. The routing unit is the transition, never the document.
+7. **Reserved dimensions** — `protected_dimensions`, `reopen_policy` (absent →
+   `unclassified`, which is not `owner`).
+
+Then price the reopen record from the grade × provenance burden table in
+[`adr-layout § The reopen record`](../../../docs/contracts/adr-layout.md) —
+cheap for an `E0`/`E1` agentic snapshot, *surfaced* rather than obeyed or
+overturned for `E0`/`E1` human, the standard five fields at `E2`, and those
+fields plus engaging the original evidence **in kind** at `E3`/`E4`. Read the
+table; do not reconstruct it from memory. The axes are defined by
+[`adr-layout § Provenance and evidence`](../../../docs/contracts/adr-layout.md),
+not here.
+
 ### 4. Verdict
 
 One of three:
@@ -298,6 +323,40 @@ in the rule; the lock catalog, fire steps, and failure modes live here.
    Identical ceremony for a typo-level amendment would cost more than asking
    the owner and the mechanism would die of its own weight.
 
+### The grade prices the record, never the authority
+
+```
+AN EVIDENCE GRADE IS A MEASUREMENT, NOT A PERMISSION.
+IT PRICES THE REOPEN RECORD AND THE REVIEW PRIORITY. IT CONFERS NO AUTHORITY.
+A LOW GRADE NEVER LETS AN AGENT SUPERSEDE A RECORD ON ITS OWN.
+```
+
+Nothing in the burden table changes **who** may act: venue comes from the
+discriminator, the trust boundaries the transition touches, and the
+owner-reserved rows — never from the grade.
+
+The coupling was proposed and refused: two council seats independently named it
+the design's central defect, because the party assigning the grade would also
+be the party gaining authority from it, and would additionally be
+self-classifying its own transition as `reversible-internal` — itself an
+authority-bearing classification. Calling the result "provisional" changes
+neither the trust boundary nor the blast radius. Whether an *independently
+validated* grade may ever reduce the authorization burden is owner-reserved and
+open: do not answer it here — it is the `authority-coupling-decision` blocker in
+`road-to-evidence-based-adr-governance`, and
+[`adr-layout § The reopen record`](../../../docs/contracts/adr-layout.md) closes
+on the same point.
+
+Two consequences that are easy to get backwards:
+
+- **An ADR's historical decision-maker does not determine its reopen venue.** A
+  record decided by a council does not need a council to reopen it; a record
+  decided by one agent is not thereby an agent's to overturn.
+- **A low-evidence record may state a decision; it does not establish that the
+  alternatives remain invalid.** *"We chose B because we had to choose"* is
+  legitimate and publishable — but never grounds for *"A is forbidden, the ADR
+  says B"*, which needs evidence the record never carried.
+
 ### When NOT to fire
 
 - The blocked change has no real benefit — the gate is not a lever to
@@ -324,6 +383,12 @@ in the rule; the lock catalog, fire steps, and failure modes live here.
   value-over-budget clause.
 - Silently dropping a good idea because "we already decided this" —
   the canonical failure the gate exists to stop.
+- Reading a low `evidence.strength` as permission to supersede — the grade
+  prices the record, it never moves the venue.
+- Treating `discovery: incomplete` as established absence: that grades the
+  review, not the decision.
+- Citing a low-evidence ADR as proof its rejected alternatives are still
+  invalid. It records a choice, not a refutation.
 
 ## See also
 

package/dist/agent-src/skills/humanizer/SKILL.md

@@ -71,6 +71,34 @@ human voice there; do not inject personality or restructure it.
    `npx tsx node_modules/@event4u/agent-config/src/scripts/detect_ai_tells.ts --stdin --fail`
    on the final draft. No runtime → the step-3 audit is the fallback
    (degrade, do not skip the audit).
+5b. **Carrier-Unicode strip — OPT-IN, never a default.** Runs **only** when
+   the operator explicitly asks for a carrier strip. `stripCarrierUnicode`
+   (`node_modules/@event4u/agent-config/src/scripts/detect_ai_tells.ts`, the same
+   path step 5 invokes) removes a hidden-Unicode codepoint only
+   when the codepoints on **both** sides are ASCII or absent; anything adjacent
+   to a non-ASCII character is preserved, so an emoji ZWJ sequence and a
+   complex-script joiner survive byte-identically.
+   **Why opt-in.** A default strip is a silent edit to the operator's
+   deliverable, which step 6's factual-integrity guard forbids for every other
+   kind of edit. Without an explicit request this step does not run and the
+   output is byte-identical to what the skill produces without it.
+   **This is the OUTPUT direction, and it does not touch step 0.** Step 0 scans
+   *ingested* input and surfaces findings as a warning — it never strips, because
+   there the hidden characters are an injection vector and removing them destroys
+   the evidence. Here the prose is the suite's own output and the operator has
+   asked. Two directions, two policies; reading them as one is the mistake this
+   paragraph exists to prevent.
+   **Hygiene, not a security control.** The predicate is deliberately
+   conservative, so a carrier adjacent to any non-ASCII character survives. The
+   injection vector stays covered by step 0.
+   **Emit the audit line** — `removed` and `preserved` counts, the classes
+   removed, and the reason for each preservation. An unexplained preservation is
+   the interesting half: it is what tells the operator the predicate fired
+   conservatively rather than failed. A strip with no audit line is a silent
+   edit wearing a step number.
+   Worked before/after: [`references/fixtures.md`](references/fixtures.md)
+   Fixture 3. Cases: [`evals/strip_fixtures.json`](evals/strip_fixtures.json).
+
 6. **Deterministic self-check + factual-integrity guard.** Re-scan the
    final draft against the [`anti-aiisms.md`](references/anti-aiisms.md)
    self-validation thresholds (dash density, consecutive-staccato cap,
@@ -189,6 +217,17 @@ do not infer a segment from the draft you were asked to edit.
   voice fingerprint that uses dashes overrides even that.
 - Do NOT shorten or restructure as a side effect — same coverage in,
   same coverage out.
+- Do NOT reach for `_sanitize`
+  (`node_modules/@event4u/agent-config/src/scripts/lint_hidden_unicode.ts`) or any
+  `NFKC` pass on a deliverable. It drops **every** `_classify`-flagged codepoint
+  unconditionally, and its class list contains `U+200C` and `U+200D` — so a
+  blind pass destroys emoji ZWJ sequences and complex-script joiners. It is a
+  file-repair path and correct for its own callers; on prose it corrupts the
+  text it was pointed at. Step 5b exists precisely because that shortcut is one
+  import away and looks like the same job.
+- Do NOT add a statistical-watermark rewrite or any detector-evasion mode. That
+  exclusion already stands below and this skill's carrier strip does not weaken
+  it: the strip removes invisible characters and alters no visible prose.
 
 ## Gotcha
 

package/dist/agent-src/skills/humanizer/evals/strip_fixtures.json

@@ -0,0 +1,57 @@
+{
+  "$comment": "Fixtures for stripCarrierUnicode (detect_ai_tells.ts). Six cases, reproduced offline against the real _classify export before the roadmap that added them was written. Every hidden codepoint is written as a JSON \\u escape and NEVER as a literal character: the first version of this file used literals, which (a) made the payloads invisible in review and (b) reddened lint_hidden_unicode with 20 blocking findings, since a tracked file carrying real carriers is exactly what that gate exists to refuse. JSON.parse decodes the escapes, so the test still receives the real characters at runtime.",
+  "recorded_limitation": {
+    "what": "The complex-script preservation cases are a CURATED BLOCK SET, not a Unicode Script-property lookup.",
+    "tested_blocks": [
+      "Arabic/Persian (U+0600-U+06FF)",
+      "emoji ZWJ sequences (U+1F400-U+1FAFF joined by U+200D)"
+    ],
+    "untested": "Indic (Devanagari, Bengali, Tamil, ...), Thai, Khmer, Myanmar, Mongolian, and every other script that uses a format character mid-word.",
+    "why_this_is_acceptable": "The predicate errs toward PRESERVATION: a carrier is removed only when both neighbours are ASCII, so a format character inside a non-ASCII word is preserved whatever its script. An untested script is therefore preserved rather than corrupted — the failure mode cannot occur in the unsafe direction. A full Script-property table would be a new data dependency guarding a failure that cannot happen.",
+    "what_would_change_this": "A script whose format characters legitimately appear between two ASCII characters. None is known; one would make the block set insufficient rather than merely untested."
+  },
+  "cases": [
+    {
+      "name": "ASCII-flanked zero-width space is removed",
+      "input": "the\u200bword",
+      "expect_out": "theword",
+      "expect_removed": 1,
+      "expect_preserved": 0
+    },
+    {
+      "name": "ASCII-flanked right-to-left override is removed",
+      "input": "safe\u202efile.txt",
+      "expect_out": "safefile.txt",
+      "expect_removed": 1,
+      "expect_preserved": 0
+    },
+    {
+      "name": "ASCII-flanked Unicode-tag codepoint is removed",
+      "input": "a\udb40\udc41b",
+      "expect_out": "ab",
+      "expect_removed": 1,
+      "expect_preserved": 0
+    },
+    {
+      "name": "emoji ZWJ sequence survives byte-identically",
+      "input": "👨\u200d💻 ships it",
+      "expect_out": "👨\u200d💻 ships it",
+      "expect_removed": 0,
+      "expect_preserved": 1
+    },
+    {
+      "name": "Persian ZWNJ survives byte-identically",
+      "input": "می\u200cخواهم",
+      "expect_out": "می\u200cخواهم",
+      "expect_removed": 0,
+      "expect_preserved": 1
+    },
+    {
+      "name": "clean prose is a no-op, and the strip is idempotent",
+      "input": "Nothing hidden here — just prose with an em dash.",
+      "expect_out": "Nothing hidden here — just prose with an em dash.",
+      "expect_removed": 0,
+      "expect_preserved": 0
+    }
+  ]
+}

package/dist/agent-src/skills/humanizer/references/fixtures.md

@@ -68,3 +68,57 @@ The two targets diverge on every axis — a draft matched to A is not a draft
 matched to B. Sample B is also a case where the dash-density default is
 **suppressed**: the fingerprint genuinely writes in dashes, so the fingerprint
 wins (SKILL § voice precedence).
+
+## Fixture 3 — carrier strip, and what "preserved" looks like (step 5b)
+
+The point of this fixture is the **preserved** half. A reader who only sees
+carriers disappear cannot tell a conservative predicate from a blind one, and a
+blind one corrupts emoji and complex-script text. So the input carries both.
+
+**Carriers are written as `U+XXXX` notation, never as the actual invisible
+character.** Two reasons, and the second is a gate: an invisible byte is
+unreadable in exactly the document whose job is showing what happened, and
+`lint_hidden_unicode` refuses a tracked file carrying real carriers — its own
+header says a teaching doc "writes `U+200B` as text". The first version of this
+fixture used literals and reddened that gate with 20 blocking findings.
+
+**Input** — `the⟦U+200B⟧word 👨⟦U+200D⟧💻 می⟦U+200C⟧خواهم safe⟦U+202E⟧file`
+
+| Carrier | Neighbours | Decision |
+|---|---|---|
+| `U+200B` between `e` and `w` | ASCII / ASCII | **removed** |
+| `U+200D` joining two emoji | non-ASCII / non-ASCII | preserved |
+| `U+200C` inside a Persian word | non-ASCII / non-ASCII | preserved |
+| `U+202E` between `e` and `f` | ASCII / ASCII | **removed** |
+
+**Output** — `theword 👨⟦U+200D⟧💻 می⟦U+200C⟧خواهم safefile`
+
+**Audit line** (generated by running the real function, not written by hand):
+
+```
+carrier strip: removed 2 (zero-width 1, bidi-control 1) · preserved 2
+  · U+200B  zero-width     offset 3   removed
+  · U+200D  zero-width     offset 10  preserved — adjacent to a non-ASCII codepoint, may be a joiner
+  · U+200C  zero-width     offset 15  preserved — adjacent to a non-ASCII codepoint, may be a joiner
+  · U+202E  bidi-control   offset 26  removed
+```
+
+Three things a reader should take from this:
+
+1. **`U+200B` and `U+200D` are the same class** — both `zero-width` — and get
+   opposite dispositions. The class is not the decision; the neighbours are.
+   Any strip keyed on class alone destroys the emoji.
+2. **Offsets are codepoint indices, not UTF-16 units.** The emoji before
+   `U+200D` is a surrogate pair, so a UTF-16 index would report a different
+   number and the audit line would be wrong for exactly the inputs this
+   predicate exists to protect.
+3. **A preservation always carries its reason.** An unexplained preservation
+   would be indistinguishable from a bug; the reason is what makes the
+   conservative branch auditable rather than merely quiet.
+
+Re-running the strip over the output changes nothing — `removed 0 · preserved 2`.
+Idempotence is a property of the predicate, not a coincidence: the two survivors
+still have non-ASCII neighbours the second time round.
+
+The runnable form of all six cases, with the carriers as JSON `\u` escapes, is
+[`evals/strip_fixtures.json`](../evals/strip_fixtures.json).

package/dist/agent-src/skills/judge-spec-compliance/SKILL.md

@@ -0,0 +1,154 @@
+---
+model_tier: high
+name: judge-spec-compliance
+description: "Use when a diff needs a requirement review — does it satisfy every stated acceptance criterion — dispatched by /review-changes, /do-and-judge, /judge. Never infers criteria from the diff."
+domain: quality
+parallelizable: files
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+---
+
+# judge-spec-compliance
+
+> You are a judge specialized in **requirement compliance**. Your only
+> job is: **does the diff satisfy every acceptance criterion as
+> stated?** You do **not** review style, naming, craft, correctness,
+> security or test coverage — five other judges handle those, and a
+> finding of theirs is not a finding of yours.
+
+The wording above is the SPEC COMPLIANCE judge from
+[`do-and-judge-two-stage`](../subagent-orchestration/prompts/do-and-judge-two-stage.md)
+§ Stage-1 prompt, reused rather than reinvented. That prompt worked and was
+reachable only through one orchestration mode; this skill is the same job on the
+default review path.
+
+## Why this judge exists
+
+Every other default judge asks a **craft-or-correctness** question. So a change
+that is correct, clean, well-tested and architecturally sound — and **does not do
+what was asked** — passed the default path with five green verdicts. Correctness
+and compliance are different questions, and only one of them was being asked.
+
+## When to use
+
+* A diff is ready for review and **doing the wrong thing** is the risk
+* `/review-changes` dispatches its "spec" slice to this skill
+* A reviewer asks "is this what we asked for?", "does this satisfy the AC?"
+
+Do NOT use when:
+
+* The concern is a functional bug → [`judge-bug-hunter`](../judge-bug-hunter/SKILL.md)
+* The concern is security → [`judge-security-auditor`](../judge-security-auditor/SKILL.md)
+* The concern is missing tests → [`judge-test-coverage`](../judge-test-coverage/SKILL.md)
+* The concern is readability → [`judge-code-quality`](../judge-code-quality/SKILL.md)
+* **The criteria are not available** — that is not a reason to skip; it is a
+  verdict of its own. See § No criteria.
+
+## Procedure
+
+### 1. Establish where the criteria came from — before reading the diff
+
+Read the criteria **first**, and never after forming an impression of the diff.
+The order is the control, not a preference: a judge that reads the change first
+and the requirement second reconstructs the requirement to fit what it just saw.
+
+```
+NEVER INFER AN ACCEPTANCE CRITERION FROM THE DIFF YOU ARE JUDGING.
+A JUDGE THAT DERIVES THE REQUIREMENT FROM THE CHANGE ALWAYS FINDS THE
+CHANGE COMPLIANT. THAT IS CIRCULAR BY CONSTRUCTION, NOT A BIAS A LABEL FIXES.
+```
+
+Criteria are **supplied**, or they are not. A commit message and a PR body are
+written by the same author as the diff, usually after it — so deriving criteria
+from them is a weaker form of the same circularity, not an independent source of
+lower quality.
+
+### 2. Per-AC scan
+
+For each criterion, exactly one of:
+
+| Verdict | What it requires |
+|---|---|
+| `SATISFIED` | cite the diff hunk **and** the test that proves it. A hunk with no test is not satisfied, it is claimed |
+| `PARTIAL` | cite what is missing and why it falls short |
+| `MISSING` | the criterion has no corresponding implementation |
+
+### 3. Report the criteria-source state — three, not two
+
+This mirrors [`dispatch_r2_reviewer`](../../scripts/dispatch_r2_reviewer.ts)'s
+own extraction-failure handling, which refuses to collapse the last two for the
+same reason: an unrecognised shape and a genuine absence produce the **identical
+empty result**, so asserting "declares none" would turn a silent tool failure
+into a false statement handed to the one independent check on AC conformance.
+
+| State | Meaning | How to report |
+|---|---|---|
+| `supplied` | a roadmap, ticket or explicit criteria set was handed in | run § 2 |
+| `not_provided` | no criteria exist for this review — an ad-hoc branch review | **no-criteria verdict**, never `SATISFIED` |
+| `supplied_unparseable` | criteria were handed in and could not be read | **ERROR**, not a no-criteria verdict |
+
+**`supplied_unparseable` is an error and not a third flavour of silence.** It
+means the tooling is broken or the input is malformed, and folding it into
+`not_provided` hides parser regressions behind a state that looks routine.
+
+## No criteria — the verdict, and what it does to "done"
+
+A no-criteria outcome is **not** a pass, and it is not an abstention that the
+consolidated verdict may ignore. What it changes is what "done" is allowed to
+claim:
+
+> **craft quality verified; requirement compliance NOT verified**
+
+That phrasing is the point. If this judge abstains on most reviews, the honest
+consequence is not that the axis should be dropped — it is that most reviews
+were previously reporting a confidence they had not earned. The abstention makes
+that visible instead of assuming it away.
+
+## Do NOT
+
+* Do NOT infer criteria from the diff, the commit messages, or the PR body.
+* Do NOT return `SATISFIED` when no criteria were supplied — return the
+  no-criteria verdict.
+* Do NOT collapse `supplied_unparseable` into `not_provided`.
+* Do NOT report a craft, naming, correctness or coverage finding. Another judge
+  owns it, and duplicating it here inflates the finding count without adding a
+  reading.
+* Do NOT treat a criterion as satisfied on a diff hunk alone when a test could
+  have proven it.
+
+## Gotcha
+
+* **Criteria authored after the diff are not independent.** If the criteria set
+  was written or last modified after the change it judges, say so — a criterion
+  reverse-engineered from a merged branch verifies nothing.
+* **A criterion the diff makes moot is still not satisfied.** "We no longer need
+  this" is a scope decision for a human, not a verdict this judge may reach.
+
+## Output format
+
+Ordered, and the first line is not negotiable — a reader must be able to see the
+criteria-source state before any per-criterion verdict, because every verdict
+below it is conditional on that state.
+
+1. `criteria_source: supplied | not_provided | supplied_unparseable`
+2. If `not_provided` → the no-criteria verdict and the "requirement compliance
+   NOT verified" line. **Stop.** Do not emit per-criterion rows.
+3. If `supplied_unparseable` → `ERROR` with what was handed in and what could not
+   be read. **Stop.** Do not emit per-criterion rows and do not degrade to
+   `not_provided`.
+4. If `supplied` → one row per criterion:
+   `| # | criterion (as stated) | SATISFIED / PARTIAL / MISSING | diff hunk | test |`
+   Criteria in the order they were stated, never re-ordered by verdict — a
+   reader comparing two runs needs the rows to line up.
+5. One closing line: the count of `MISSING` and `PARTIAL`. Not a severity, not a
+   recommendation — those belong to synthesis, and phrasing this as one is how a
+   spec finding gets ranked against a naming nit.
+
+## Related
+
+* [`judge-synthesis`](../judge-synthesis/SKILL.md) — consumes this verdict on
+  its **own dimension**, deliberately not on the shared severity axis.
+* [`do-and-judge-two-stage`](../subagent-orchestration/prompts/do-and-judge-two-stage.md)
+  — the stage-1 prompt this reuses.