@event4u/agent-config 14.8.0 → 14.9.0

package/dist/ui/index.html

@@ -27,7 +27,7 @@
                 document.documentElement.setAttribute('data-theme', theme);
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-C1pBRm1f.js"></script>
+      <script type="module" crossorigin src="/assets/index-Cxgy63kz.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-jSfMW8_t.css">
     </head>
     <body>

package/docs/guidelines/agent-infra/traceability-field-mechanics.md

@@ -0,0 +1,50 @@
+# Traceability field mechanics — `traceability:` in the roadmap execution contract
+
+> Migrated from [`roadmap-execution-contract`](../../../src/agent-src/contexts/execution/roadmap-execution-contract.md)
+> § 2c, 2026-08-22, because the section pushed that file past the 16,000-char
+> depth ceiling. The contract keeps the field shape and the reused grammars; the
+> semantics a reader needs before writing a row live here. Established P4
+> pattern: the obligation stays in the contract, the mechanics move.
+
+## Identity semantics — stated, because a slug grammar does not imply them
+
+- **Namespace:** the roadmap file. Two roadmaps MAY use the same
+  `requirement_id` when they reference the same external requirement; within one
+  file an id is unique.
+- **Cardinality:** one row is one `(requirement, acceptance)` pair with its
+  evidence. A requirement with two criteria is two rows.
+- **Renames:** ids are content-addressed, not path-addressed — moving or renaming
+  a roadmap does not change them.
+
+## Revision semantics — when a ref is evaluated
+
+**At the current head, always.** A ref that resolved at declaration time and no
+longer resolves is `unresolved`, and that is the intended reading rather than a
+defect in the reading: evidence that has been deleted is exactly what a
+traceability inventory exists to surface. The consequence is stated rather than
+discovered: **a completed roadmap can move from resolved to unresolved with no
+roadmap edit**, because the tree moved under it.
+
+## What "gate" means here, of the three things it could mean
+
+The council named three unresolved senses. Exactly one ships:
+
+| Sense | Status |
+|---|---|
+| **Listing** declarations | **ships** — inventory, exit 0 always |
+| **Resolving** references | ships as part of the listing, reported as a count |
+| **Enforcing** roadmap validity | **does not ship**, and does not ship until the relation model above has been exercised on a real corpus |
+
+## The `[AC:<id>]` prefix on a `verify:` line
+
+A `verify:` line may carry a leading `[AC:<acceptance_id>]` to bind that check to
+a criterion.
+
+**Nothing parses `verify:` lines structurally today** — verified 2026-08-22: a
+grep across `src/scripts/*.ts` finds the template prose emitted by
+`new_roadmap.ts` and one comment in `lint_evidence_artifacts.ts`, and nothing
+else. Both halves of that matter. **Nothing breaks**, because there is no parser
+to break. And **there is nothing to build on** either: the inventory below is
+the first structural reader of those lines, so any claim about `[AC:…]` coverage
+rests entirely on it.
+

package/docs/guidelines/agent-infra/untrusted-input-spotlighting.md

@@ -135,6 +135,23 @@ recommends. The mapping (no new gate needed):
 | LLM01 #6 — segregate and identify external content | [`untrusted-input-defense`](../../../src/rules/untrusted-input-defense.md) + this guideline |
 | LLM06 — least agency / post-action gating | [`runtime-safety`](../../../src/rules/runtime-safety.md) (manual/assisted/automated), [`verify-before-complete`](../../../src/rules/verify-before-complete.md) |
 
+## The content-scanning hook
+
+`injection_scan_hook.ts` binds to `post_tool_use`, reads tool output, and
+reports **15 measured encoding channels plus four phrase families** — measured
+over the frozen corpus at `internal/bench/corpora/encoding-channels/` at
+**99.00 % recall and a 0.85 % false-positive rate**. It is warn-only
+(`fail_closed: false`, `severity: advisory` in `hook_manifest.yaml`) and ships
+**default-OFF**.
+
+Read those two numbers as properties of that corpus, not of the wild: a channel
+nobody put in the corpus is a channel the recall figure says nothing about.
+
+It changes nothing about the rule's `enforced_by` field, and the reason is in
+[`untrusted-input-defense § Enforcement`](../../../src/rules/untrusted-input-defense.md):
+a hook that cannot refuse does not enforce. The detector narrows what an
+injection can do unnoticed; it does not make the quarantine mechanical.
+
 ## Limits
 
 Detection and spotlighting are **probabilistic** layers, not guarantees

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.8.0",
+    "version": "14.9.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,
@@ -55,7 +55,11 @@
         "LICENSE",
         "MIGRATION.md",
         "README.md",
-        "llms.txt"
+        "llms.txt",
+        "!dist/**/*.test.js",
+        "!dist/**/*.test.js.map",
+        "!dist/**/*.spec.js",
+        "!dist/**/*.spec.js.map"
     ],
     "bin": {
         "agent-config": "dist/cli/agent-config.js"
@@ -77,7 +81,7 @@
         "build:mcp-catalog": "./scripts-run src/scripts/build_mcp_catalog --write --strict",
         "build": "npm run build:cli && npm run build:install-bundle && npm run build:hooks && npm run build:mcp-bundle && npm run build:cli-delegate && npm run build:ui",
         "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.scripts.json",
-        "lint:ts": "eslint --cache 'src/**/*.ts'",
+        "lint:ts": "eslint --cache --max-warnings 0 'src/**/*.ts'",
         "test:ts": "vitest run",
         "lint:publint": "publint",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",