@event4u/agent-config 14.8.0 → 14.9.0

package/src/config/evaluator-budgets.json

@@ -58,11 +58,11 @@
       "deterministic": false
     },
     "cli_help_command_count": {
-      "max": 102,
-      "last_measured": 102,
-      "last_measured_at": "2026-08-19",
+      "max": 104,
+      "last_measured": 104,
+      "last_measured_at": "2026-08-22",
       "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
-      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102."
+      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104."
     },
     "mcp_public_tool_count": {
       "max": 20,

package/src/config/gate-coverage.yml

@@ -42,13 +42,24 @@
 #
 # COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-18)
 # ----------------------------------------------------------
-# 269 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 272 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`,
-# re-run 2026-08-21 and it returns 269).
-# **45 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and 42 of those 45 are listed below.** The manifest is
+# re-run 2026-08-22 and it returns 272).
+# **47 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and 44 of those 47 are listed below.** The manifest is
 # therefore complete with respect to its own contract for every gate that can
-# carry a floor, and covers ~16 % of the population.
+# carry a floor, and covers ~17 % of the population.
+#
+# RECOUNTED on 2026-08-22, and it was wrong on every figure before the recount —
+# which is the fourth time, and the reason this paragraph keeps asking to be
+# computed. `check_no_stub_inventory_table` added ONE row and ONE script, but the
+# readings moved by more than one in three of the four places: population
+# 269 -> 272 (two scripts had landed since 2026-08-21 without touching this
+# prose), listed rows 42 -> 44 (the file already held 43 before this change; the
+# prose had again been adjusted instead of recounted, and the paragraph below
+# says so about its own previous revision), emitters 45 -> 47. Every number here
+# is reproducible: `grep -c '^  - id:' src/config/gate-coverage.yml` for the rows
+# and `count_gate_scripts()` for the population.
 #
 # Both halves were RE-DERIVED on 2026-08-21, not incremented, and the previous
 # reading was off by one in a way worth recording: it said "42 … and 41 of those
@@ -59,14 +70,14 @@
 # the prose was adjusted by one instead of recounted.
 #
 # The derivation now, so the next reader can check it rather than trust it:
-# `grep -c '^  - id:'` returns 42 (computable, and computed); every listed row
+# `grep -c '^  - id:'` returns 44 (computable, and computed); every listed row
 # is an emitter, because a row that did not emit could carry no floor and the
 # guard would report it `failing`; THREE emitters are deliberately unlisted —
 # `lint_evidence_artifacts` (below), `adr_cite_check` and
 # `check_new_adr_evidence` (each in the block where its row would have sat);
-# 42 + 3 = 45. The population figure comes from the function, and it stays 269
-# because `check_new_adr_evidence` matches the population prefix whether or not
-# it carries a row here.
+# 44 + 3 = 47. The population figure comes from the function, and
+# `check_new_adr_evidence` matches the population prefix whether or not it
+# carries a row here.
 #
 # `adr/evidence_census` emits a `scanned:` line too and is NOT in either number:
 # it carries no `lint|check|audit` prefix, so `count_gate_scripts()` never sees
@@ -206,11 +217,93 @@
 # contract is `dist == rewrite(src)`; `check_ci_local_parity`, whose corpus is
 # workflow files) carries no recipe and is reported UNPROVEN, never green.
 gates:
+  - id: check_pack_size
+    argv: []
+    min_scanned: 2000
+    corpus: "the `npm pack --dry-run --ignore-scripts` payload — every file package.json `files[]` resolves (2,954 in a built worktree and 2,686 in an unbuilt one on 2026-08-22, which is why the floor sits well under both)"
+    status: enforced
+    canary:
+      class: contract-violation
+      path: src/scripts/zz-canary-shipped-credential.pem
+      content: |
+        zz canary probe: not a key, and deliberately not shaped like one.
+        The credential-shaped class matches on the PATH (`\.pem$`), never on the
+        body, so the plant needs no key-shaped content to red the class - and a
+        PEM header here would be a high-confidence check_secret_leak finding in
+        this tracked file. Measured, not guessed: the first draft carried a
+        BEGIN PRIVATE KEY block and reddened the secret gate at
+        gate-coverage.yml:229 in both `diff` and the new `pack` mode. A canary
+        that breaks a sibling gate to prove its own is not a canary.
+    note: >
+      ONE canary, and the entry shape is why. `canary:` is a single recipe per
+      gate id, not a list, while this gate carries FOUR content classes — so
+      per-class red observation lives in the gate's own `--self-test` (9 cases,
+      6 rejecting), which proves every class discriminates over a synthetic
+      payload with no pack run. Two of the four cannot be planted through the
+      register at all: `compiled-test-artefact` is excluded from the payload by
+      the `files[]` negations that fixed it, so a plant never ships and never
+      reds, and `source-map` needs 121 files in a BUILT tree.
+
+      The credential class is the one that gets the recipe. It is empty today,
+      and an empty class with no check is indistinguishable from a class nobody
+      looked at — so it is the class where "has this ever been red" is a real
+      question. The plant sits under `src/scripts/`, which IS a `files[]` root;
+      an earlier attempt under `src/skills/` was silently absent from the
+      payload because that path is not shipped, and a canary that cannot reach
+      the corpus proves nothing.
+
+      Floor is a count, not a size. The size arm has a budget file; the count
+      arm is what stops an empty payload — a botched `files[]`, a pack that
+      resolved nothing — from measuring 0 MB and passing every budget. The gate
+      already exits 2 rather than 0 on that, via `assertScanned`.
+
+  - id: check_secret_leak
+    argv: ["--pack"]
+    min_scanned: 2000
+    corpus: "the npm pack payload — every file package.json `files[]` resolves, INCLUDING shipped-but-gitignored paths no git-backed mode can reach (2,684 in an unbuilt worktree on 2026-08-22)"
+    status: enforced
+    canary:
+      class: contract-violation
+      path: dist/zz-canary-shipped-and-gitignored.pem
+      content: |
+        -----BEGIN RSA PRIVATE KEY-----
+        MIIEowIBAAKCAQEAzz-canary-not-a-real-key-zz
+        -----END RSA PRIVATE KEY-----
+    note: >
+      Registered on the `--pack` argv specifically, and the canary path is the
+      whole point: `dist/` is a `files[]` root while `/dist/*` is
+      `.gitignore:206`, so this plant is shipped and untracked at the same time.
+      `git check-ignore -q` matches it and `npm pack` includes it. A canary in a
+      tracked file would pass under the pre-existing `diff` and `all` modes too
+      and would prove nothing about the scope this entry exists for.
+
+      Measured, not assumed: with the plant in place `--pack` exits 1 and names
+      the path, while the default `diff` mode exits 0. The plant carries a real
+      PEM shape because THIS gate matches on CONTENT — unlike its sibling
+      `check_pack_size`, whose credential class matches on the path and whose
+      canary therefore deliberately carries no key-shaped body.
+
+      Two reasons the scope was blind, and adding the mode only fixed the first.
+      Mode enumeration walks the git tree; the `DEFAULT_EXCLUDE` list ALSO drops
+      all of `dist/`, regardless of mode. Until that exclusion became
+      mode-aware, the new scope resolved the payload and then filtered away
+      exactly the paths it was built to reach — the mode was measurably inert.
+
+  - id: check_publish_surface
+    argv: []
+    min_scanned: 2000
+    corpus: "the npm pack payload (2,686 in an unbuilt worktree on 2026-08-22), read to classify each .npmignore pattern against what actually shipped"
+    status: enforced
+    no_canary_reason: >-
+      the violation is a MODIFICATION, not a creation: this gate reds when package.json `files[]` or `.npmignore` changes and the committed artefact does not, and the canary contract is create-only. A planted FILE cannot move either surface — the closest it gets is changing the payload-derived shadowed set, which is informational and deliberately excluded from the drift verdict, so a plant would leave the gate green and be reported as dead. Discrimination is proven by the gate's own `--self-test` (8 cases, 5 rejecting) over the pattern matcher, and end to end by hand: editing `files[]` alone exits 1, regenerating exits 0, editing `.npmignore` alone exits 1, restoring exits 0.
+
   - id: check_gate_completeness
     argv: []
     min_scanned: 180
     corpus: "gates reachable from the `ci` / `consistency` task roots (220 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      whole-graph: it parses every gate invocation in the task roots at once, so a planted file has no property to violate — the defect it detects is a MISSING edge, which cannot be planted.
     note: >
       Floor set below the live count on purpose: the registered set legitimately
       shrinks when a gate is retired, and a floor pinned at today's exact number
@@ -224,6 +317,8 @@ gates:
     min_scanned: 0
     corpus: "the five project rule directories that receive a projected tree (.claude/rules, .cursor/rules, .clinerules, .windsurf/rules, .augment/rules)"
     status: enforced
+    no_canary_reason: >-
+      cross-tree: the violation is one rule appearing in two projected trees, so it needs both trees, not a file.
     note: >
       `min_scanned: 0` is the honest floor and not the false-count shape this file
       rejects elsewhere. This gate compares a project rule directory against its
@@ -246,6 +341,8 @@ gates:
     min_scanned: 100
     corpus: "rule files under src/rules/ (117 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      whole-corpus census: it reports an aggregate over every rule; a single planted rule moves a number rather than producing a red.
     note: >
       Floor set below the live count so a legitimate rule retirement does not red
       the gate that watches activation. It is still far above a collapse: if the
@@ -339,22 +436,95 @@ gates:
     min_scanned: 8
     corpus: "declared human-authored suppression surfaces (10 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      cross-file: a suppression is a violation only against the declared surface that authorises it, so the pair is the unit.
     note: >
       The denominator is the INVENTORY, not the entry count — the gate's job is
       that every suppression surface is accounted for, and a surface list that
       collapsed to nothing must not read as "no suppressions to check".
 
+  - id: lint_adr_sweep_routing
+    argv: []
+    min_scanned: 20
+    corpus: "candidate rows (REVIEW-NOW / SUPERSEDE (candidate)) across docs/decisions/adr-evidence-sweep-*.md (26 at baseline, in one artifact)"
+    status: enforced
+    canary:
+      class: unrouted-candidate
+      path: docs/decisions/adr-evidence-sweep-zz-canary-probe.md
+      content: |
+        # ADR evidence sweep — canary probe
+
+        | Record | Disposition | Why |
+        |---|---|---|
+        | ADR-9999 | REVIEW-NOW | canary probe row |
+
+        ## Candidate routing
+
+        | Record | Disposition | Route | Dated follow-up |
+        |---|---|---|---|
+        | ADR-9999 | REVIEW-NOW | council | when we get to it |
+    note: >
+      The floor is 20 rather than 26 because a candidate LEAVING the population
+      is the point of the sweep: every disposition that lands takes its row out
+      of the count, so a tight floor would red on the gate working. It is far
+      above a collapse — a scan that stopped seeing the artifact reports 0.
+
+  - id: check_requirements_trace
+    argv: []
+    min_scanned: 15
+    corpus: "roadmap files at the top level of agents/roadmaps/ (25 at registration, 2026-08-22)"
+    status: enforced
+    no_canary_reason: >-
+      this gate is a LISTING, not an enforcement: `main()` returns 0 on every
+      path and `process.exit(main())` is its only exit, so no planted file can
+      make it red and the harness's "caught the planted defect (exit 1)"
+      observation is unreachable by construction. Verified, not assumed — a probe
+      roadmap carrying an unresolved acceptance-criteria ref left the exit code at
+      0. It is registered for its `scanned:` floor, which is the one thing about
+      it that CAN break, and that floor is the negative control here.
+    note: >
+      A LISTING gate: it exits 0 always, including on a dangling `[AC:]` ref and
+      on an empty corpus. Registered here for its `scanned:` floor rather than
+      for a pass/fail verdict — the floor is the only thing about it that can
+      break, and a scan that stops seeing agents/roadmaps/ would otherwise
+      report an empty inventory as a clean one. Floor 15 against 25 at
+      registration: the active estate is being drained deliberately and is
+      expected to shrink, so a tight floor would red on the drain working.
+
+  - id: check_council_pin_staleness
+    argv: []
+    min_scanned: 3
+    corpus: "council members carrying a `model:` in agents/templates/.ai-council.yml.example (5 at registration, 2026-08-22)"
+    status: enforced
+    no_canary_reason: >-
+      the harness is create-only and this gate reads ONE fixed path
+      (agents/templates/.ai-council.yml.example), so no planted file lands inside
+      its scan scope — making it red means EDITING that template, which the
+      harness does not do. Discrimination is proven by the gate's own
+      `--self-test` instead: 10 cases across the fresh, stale, future-date,
+      malformed, unstamped and vendor-sentinel branches.
+    note: >
+      Floor 3 against 5 at registration: the template's member list is a shipped
+      artifact rather than a draining corpus, but an exact floor would red on a
+      legitimate trim of one member. Collapse is covered more strictly from the
+      other side — `reportScanned` raises DeadScopeError at 0 members, before
+      this floor is consulted at all.
+
   - id: lint_trigger_collisions
     argv: []
     min_scanned: 90
     corpus: "src/rules/*.md frontmatters (111 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      pairwise: a collision needs two rules, and which two is the finding — a single planted file collides with nothing.
 
   - id: lint_rule_skill_pack_reach
     argv: ["--quiet"]
     min_scanned: 90
     corpus: "src/rules/*.md frontmatters joined against src/skills packs and the pack registry (116 rules at baseline)"
     status: enforced
+    no_canary_reason: >-
+      join: rule frontmatter against the skills tree and the pack registry; a planted rule needs a matching planted pack graph to be judged.
     note: >
       Advisory on findings, enforced on COVERAGE: the gate exits 0 while its
       unreachable-route set is non-empty (12 at introduction), so only this
@@ -367,6 +537,8 @@ gates:
     min_scanned: 380
     corpus: "src/ ↔ dist/agent-src/ .md pairs (429 at baseline: 111 rules + 318 skills)"
     status: enforced
+    no_canary_reason: >-
+      byte-equality between src/ and dist/agent-src/ pairs — the property is a relation between two trees, not a file.
 
   - id: check_augment_description_cap
     argv: []
@@ -477,6 +649,8 @@ gates:
     min_scanned: 340
     corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (360 measured 2026-08-13: 109 CI + 251 local)"
     status: enforced
+    no_canary_reason: >-
+      whole-graph: it parses every workflow and taskfile invocation and reports gates present in one set and absent from the other.
     note: >
       Registered 2026-08-02. It already emitted the contract line on every path,
       including the failing one — it was simply never listed, the same omission
@@ -524,6 +698,8 @@ gates:
     unavailable_exit: 2
     corpus: "built HTML pages under site/dist (25 content sources at baseline)"
     status: enforced
+    no_canary_reason: >-
+      needs the BUILT site under site/dist, which does not exist until a build runs; already reported `unavailable` when absent.
     note: >
       Registered 2026-07-30 after it was caught reporting green over a stale build —
       6 pages against 25 content sources, every source newer than the newest page.
@@ -553,6 +729,8 @@ gates:
     min_scanned: 1200
     corpus: "all .md under src/ + dist/agent-src/ plus the shipped root files (1,566 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      a planted file would be judged, but the gate is a broad scan whose baseline is the corpus size — a single red proves the matcher fires, which its own fixtures already do.
     note: >
       SCAN_DIRS named the retired authoring root, so the entire src/ tree —
       more than half the corpus — was skipped and an identifier authored there
@@ -563,6 +741,8 @@ gates:
     min_scanned: 800
     corpus: ".md under the scanned roots plus memory YAML (1,043 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      a planted broken reference is judged, but every target must exist in the real tree for the resolver to be faithful; an isolated fixture makes every reference broken.
     note: >
       src/ was absent from every reference-resolution candidate list, so a link
       resolvable only under the source of truth was reported BROKEN. The
@@ -574,6 +754,8 @@ gates:
     min_scanned: 400
     corpus: "src/rules + src/skills + src/agent-src/commands + docs/guidelines .md (533 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      thresholds are computed across the whole corpus; a single planted artefact has no population to exceed.
     note: >
       A collapse below the floor would mean the gate stopped reading the tree
       that states extraction thresholds, so a bare or diverging threshold
@@ -584,6 +766,8 @@ gates:
     min_scanned: 5
     corpus: "src/agent-src/profiles/*.yml (6 seed profiles at baseline)"
     status: enforced
+    no_canary_reason: >-
+      join: a profile is judged against the persona set it names, so both sides are needed.
     note: >
       Fewer than 5 profiles scanned would mean the gate stopped reading the
       seed-profile dir, so a defaults.personas id that resolves to no persona
@@ -594,6 +778,8 @@ gates:
     min_scanned: 200
     corpus: "src/skills/*/SKILL.md (288 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      ratio gate: the 15% rich-skill cap is a property of the corpus, so one planted skill cannot cross it.
     note: >
       A collapse below the floor would mean the gate stopped reading the skills
       tree, so a rich-tagged skill without its justification section (or a cap
@@ -604,6 +790,8 @@ gates:
     min_scanned: 350
     corpus: "skills / rules / commands .md actually judged (368 of 438 enumerated; the rest carry a declared exemption the ledger names)"
     status: enforced
+    no_canary_reason: >-
+      the allowlist is line-keyed against real files, so a planted file has no allowlist anchor and the exemption path goes untested.
     note: >
       Its human summary prints "N hits across M files", where M is files WITH
       HITS — 0 on a clean run. Reading that as coverage is precisely how a
@@ -617,6 +805,8 @@ gates:
     min_scanned: 1
     corpus: "ready roadmap files under agents/roadmaps/ top level (6 as of 2026-08-21; 19 at the original baseline: 14 grandfathered + 4 draft-exempt + 1 carrying a live register)"
     status: enforced
+    no_canary_reason: >-
+      a planted roadmap is judged, but the gate reads the ready-roadmap population to decide scope; an isolated file changes what it scans.
     note: >
       Gate R1 (docs/contracts/plan-review-gates.md § 1). The count is READY
       FILES INSPECTED incl. grandfathered/draft-exempt ones — exemptions are
@@ -704,6 +894,8 @@ gates:
     min_scanned: 1
     corpus: "findings artefacts under agents/evidence/reviews/ + the current-diff evaluation (1 at baseline — the evaluation itself; artefact count grows with gated PRs)"
     status: enforced
+    no_canary_reason: >-
+      git-dependent: it evaluates the current diff against a base ref.
     note: >
       Gate R2 (docs/contracts/plan-review-gates.md § 2). HONEST LIMIT, stated
       because a floor that cannot fail is exactly the false green this file
@@ -731,6 +923,8 @@ gates:
     min_scanned: 7
     corpus: "archived round records — `*-review.md` under agents/evidence/reviews/, excluding live `*.findings.md` (9 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      git-dependent in effect: it reads archived round records whose identity comes from the committed tree, and its own scan-scope guard fails on an empty corpus.
     note: >
       Contract § 2.7. Unlike the R2 entry above, this floor is genuinely
       trippable: the corpus is 9 frozen records and archived records are not
@@ -760,6 +954,8 @@ gates:
     min_scanned: 250
     corpus: "src/skills/*/SKILL.md (288 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      join: a handoff is a link from one skill to another, so the target skill must exist to judge the link.
     note: >
       The argv here is load-bearing, not decoration. Taskfile injects `--quiet`
       (QUIET_FLAG) and this gate read `args[0]` as a positional path, so the CI
@@ -774,6 +970,8 @@ gates:
     min_scanned: 540
     corpus: "names across src/rules + src/skills + src/agent-src + src/domains/**/command.md (621 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      collision gate across four roots at once; one planted name collides with nothing.
     note: >
       Counts NAMES, not files — the scan-scope census counts files under the same
       roots, so the two artefacts legitimately report different numbers here.
@@ -783,12 +981,16 @@ gates:
     min_scanned: 540
     corpus: "artefacts carrying frontmatter across the discovery roots (619 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      a planted artefact is judged, but the gate reports adoption across the discovery roots, so the number rather than a red is the output.
 
   - id: audit_skill_overlap
     argv: ["--quiet", "--print-table", "--strict"]
     min_scanned: 250
     corpus: "src/skills/*/SKILL.md compared pairwise (288 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      pairwise over 288 skills; overlap needs a corpus, and which pair is the finding.
     note: >
       `--strict` is part of the CI invocation and can exit non-zero on a real
       overlap finding. The guard reads the count independently of the exit code —
@@ -799,6 +1001,8 @@ gates:
     min_scanned: 90
     corpus: "src/rules/*.md (111 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      a planted rule IS judgeable — this entry is a genuine authoring gap rather than a structural one, and is the first candidate if the mode is ever built.
     note: >
       Emits on stderr, not stdout: `--format json` owns this gate's stdout and a
       count written there would corrupt the payload. The guard reads both streams.
@@ -820,6 +1024,8 @@ gates:
     min_scanned: 3
     corpus: "the three named inputs it cross-checks — src/cli/registry.ts, src/config/evaluator-budgets.json, internal/bench/reports/evaluator-measurements.json"
     status: enforced
+    no_canary_reason: >-
+      git-dependent cross-check of three named committed inputs; the property is their agreement, not any one file.
     note: >
       Registered because its count became REAL, not to pad the manifest. The
       gate always printed a hardcoded `scanned: 3`; hardening derived it from
@@ -833,6 +1039,8 @@ gates:
     min_scanned: 100
     corpus: "leaf keys in src/config/agent-settings.template.yml (140 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      the only possible violation is a MODIFICATION of two tracked files (a key added to the template, or a row removed from the contract) and the canary harness is create-only by design. Discrimination is proven by the gate's own `--self-test` instead — six rejecting cases including the dead-scan-root one.
     note: >
       Floor set well below the live 140 so retiring a settings key does not red
       the change that retires it, but high enough that the collapse this file
@@ -1032,6 +1240,8 @@ gates:
     min_scanned: 1
     corpus: "rows of the `docs/MIGRATION.md` scheduled-deprecations table (3 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      discrimination is proven by the gate's own `--self-test` (10 cases, 6 rejecting) driving the real binary, which covers the due-at-the-cut case a create-only canary could not express.
     note: >
       `argv` carries `--quiet` because that is what the task passes: the
       Taskfile resolves `{{.QUIET_FLAG}}` to `--quiet` unless
@@ -1061,6 +1271,8 @@ gates:
     min_scanned: 900
     corpus: "TypeScript sources — src/**/*.ts excluding *.d.ts and *.test.ts, the same two kinds _lib/gate_population excludes (1,063 at baseline)"
     status: enforced
+    no_canary_reason: >-
+      the canary contract is create-only and this gate's violation is a MODIFICATION — a file crossing its line ceiling. Discrimination is proven by the gate's own `--self-test`, including a boundary case and a dead scan root.
     # No `canary:` recipe, and the reason is the canary contract's own shape
     # rather than a gap. The violation this gate detects is a file OVER 1,500
     # lines, so a create-only recipe would have to inline 1,501 lines of content
@@ -1075,6 +1287,32 @@ gates:
     # last case is what pins the metric as excess lines rather than a file count;
     # a count-based ratchet passes it, and this gate must not.
 
+  - id: check_no_stub_inventory_table
+    argv: ["--quiet"]
+    min_scanned: 1
+    corpus: "the guarded watch list — agents/roadmaps/stubs/README.md (1 file; the whole scope, not a sample)"
+    status: enforced
+    no_canary_reason: >-
+      the guarded path already EXISTS, so a create-only canary cannot plant the violation. Discrimination is proven by the gate's own `--self-test`.
+    # No `canary:` recipe: the guarded path already EXISTS, and the canary
+    # contract is create-only. A recipe would have to mutate a tracked file
+    # rather than plant one, which the contract does not express. The gate
+    # reports UNPROVEN there rather than green, which is the honest state.
+    #
+    # Discrimination is proven by the gate's own `--self-test` instead, and the
+    # five cases are the sabotage probes it was verified with before landing:
+    # a restored transfer table, the inventory header alone, a DEAD watch list
+    # (the `check_safety_floor_untouched` shape — it must red, never report
+    # clean), plus two accepting cases that pin the narrowness review asked for
+    # — a glossary table and a table citing parent roadmaps one directory up
+    # must both pass. A blanket ban on markdown tables in the file would trade
+    # one regression for a permanent block on legitimate documentation.
+    #
+    # `min_scanned: 1` is the true corpus, not a weak floor: the scope is one
+    # known file. The collapse this file's rule 3 guards against is covered by
+    # `assertWatchlistResolves`, which refuses to report clean when the path
+    # does not resolve — so a rename reds the gate instead of retiring it.
+
   # check_new_adr_evidence is DELIBERATELY NOT REGISTERED here, following this
   # file's own two precedents rather than breaking them.
   #