@event4u/agent-config 14.9.0 → 14.11.0

package/dist/cli-delegate/{chunk-PLSG6UL5.js → chunk-K4FFODTS.js}

@@ -26,7 +26,7 @@ import {
   projectStoreSlug,
   scanTranscripts,
   weightedInputUnits
-} from "./chunk-77GR3VD4.js";
+} from "./chunk-FF7WAFMR.js";
 import {
   git_common_dir
 } from "./chunk-E4XIZDIB.js";
@@ -46,7 +46,7 @@ import {
   LEGACY_ALL,
   excludedRuleBasenames,
   ruleScopeFromSettings
-} from "./chunk-G23AT6GD.js";
+} from "./chunk-DMSZHXZS.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
@@ -73,17 +73,150 @@ import {
 // src/scripts/_cli/cmd_doctor.ts
 var YAML2 = __toESM(require_dist(), 1);
 import * as crypto2 from "node:crypto";
-import * as fs9 from "node:fs";
+import * as fs11 from "node:fs";
 import * as os3 from "node:os";
-import * as path13 from "node:path";
+import * as path15 from "node:path";
 import process2 from "node:process";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL4 } from "node:url";
 
-// src/scripts/_lib/duplicate_scope_census.ts
+// src/scripts/_cli/doctor_overrides.ts
 import * as fs from "node:fs";
 import * as path from "node:path";
+
+// src/scripts/_lib/kernel_rules.ts
+var KERNEL_RULE_IDS = [
+  "agent-authority",
+  "ask-when-uncertain",
+  "commit-policy",
+  "direct-answers",
+  "language-and-tone",
+  "no-cheap-questions",
+  "non-destructive-by-default",
+  "scope-control",
+  "verify-before-complete"
+];
+var KERNEL_RULE_FILENAMES = new Set(
+  KERNEL_RULE_IDS.map((id) => `${id}.md`)
+);
+var KERNEL_RULE_ID_SET = new Set(KERNEL_RULE_IDS);
+
+// src/scripts/_cli/doctor_overrides.ts
+function isDir(p) {
+  try {
+    return fs.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isFile(p) {
+  try {
+    return fs.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function _check_overrides(project_root) {
+  const dir = path.join(project_root, "agents", "overrides", "rules");
+  if (!isDir(dir)) {
+    return {
+      id: "overrides",
+      status: "skip",
+      message: "no agents/overrides/rules/ \u2014 no overrides declared",
+      remedy: ""
+    };
+  }
+  let names;
+  try {
+    names = fs.readdirSync(dir).filter((n) => n.endsWith(".md")).sort();
+  } catch {
+    return {
+      id: "overrides",
+      status: "warn",
+      message: "agents/overrides/rules/ is present but unreadable",
+      remedy: "check permissions on agents/overrides/rules/"
+    };
+  }
+  if (names.length === 0) {
+    return {
+      id: "overrides",
+      status: "ok",
+      message: "agents/overrides/rules/ present, 0 overrides declared",
+      remedy: ""
+    };
+  }
+  const registryPath = path.join(project_root, "agents", "overrides", "kernel-exceptions.yml");
+  const registered = /* @__PURE__ */ new Set();
+  if (isFile(registryPath)) {
+    let inExceptions = false;
+    for (const raw of fs.readFileSync(registryPath, "utf-8").split("\n")) {
+      const line = raw.replace(/\s+$/, "");
+      if (/^exceptions:\s*$/.test(line)) {
+        inExceptions = true;
+        continue;
+      }
+      if (!inExceptions) continue;
+      if (/^\S/.test(line)) break;
+      const m = /^\s*-?\s*rule:\s*"?([a-z0-9-]+)"?\s*$/i.exec(line);
+      if (m?.[1] !== void 0) registered.add(m[1]);
+    }
+  }
+  let kernel = 0;
+  let uncited = 0;
+  let unregisteredKernel = 0;
+  for (const n of names) {
+    const rule = n.replace(/\.md$/, "");
+    const isKernel = KERNEL_RULE_ID_SET.has(rule);
+    if (isKernel) kernel += 1;
+    const text = fs.readFileSync(path.join(dir, n), "utf-8");
+    if (!/^>\s*Overrides:/m.test(text)) uncited += 1;
+    if (isKernel && !registered.has(rule)) {
+      unregisteredKernel += 1;
+    }
+  }
+  const parts = [
+    `${String(names.length)} override(s) present`,
+    `${String(kernel)} kernel`
+  ];
+  if (kernel > 0) {
+    parts.push(`${String(kernel - unregisteredKernel)}/${String(kernel)} kernel registered`);
+  }
+  parts.push(`${String(names.length - uncited)}/${String(names.length)} cited`);
+  parts.push("delivery only \u2014 efficacy unmeasured");
+  return {
+    id: "overrides",
+    status: uncited > 0 || unregisteredKernel > 0 ? "warn" : "ok",
+    message: parts.join(", "),
+    remedy: uncited > 0 || unregisteredKernel > 0 ? "run `./scripts-run src/scripts/lint_override_kernel_guard --strict` for the detail" : ""
+  };
+}
+
+// src/scripts/_cli/doctor_install_mode.ts
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+function isFile2(p) {
+  try {
+    return fs2.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function isDir2(p) {
+  try {
+    return fs2.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var INSTALL_MODE_MARKER_RELATIVE = "agents/.agent-state/install-mode.txt";
+function _is_global_only_consumer(project_root) {
+  return isFile2(path2.join(project_root, INSTALL_MODE_MARKER_RELATIVE)) || isDir2(path2.join(project_root, "agents", "overrides"));
+}
+
+// src/scripts/_lib/duplicate_scope_census.ts
+import * as fs3 from "node:fs";
+import * as path3 from "node:path";
 function censusDuplicateScope(userRulesDir, projectRulesDir) {
-  if (!fs.existsSync(userRulesDir) || !fs.existsSync(projectRulesDir)) {
+  if (!fs3.existsSync(userRulesDir) || !fs3.existsSync(projectRulesDir)) {
     return {
       evaluable: false,
       reason: `one or both rule directories are missing (user: ${userRulesDir}, project: ${projectRulesDir})`,
@@ -91,15 +224,15 @@ function censusDuplicateScope(userRulesDir, projectRulesDir) {
       duplicate_chars: 0
     };
   }
-  const userFiles = new Set(fs.readdirSync(userRulesDir).filter((f) => f.endsWith(".md")));
-  const projectFiles = fs.readdirSync(projectRulesDir).filter((f) => f.endsWith(".md"));
+  const userFiles = new Set(fs3.readdirSync(userRulesDir).filter((f) => f.endsWith(".md")));
+  const projectFiles = fs3.readdirSync(projectRulesDir).filter((f) => f.endsWith(".md"));
   const shared = [];
   let duplicateChars = 0;
   for (const f of projectFiles) {
     if (!userFiles.has(f)) continue;
     shared.push(f);
-    const a = fs.statSync(path.join(userRulesDir, f)).size;
-    const b = fs.statSync(path.join(projectRulesDir, f)).size;
+    const a = fs3.statSync(path3.join(userRulesDir, f)).size;
+    const b = fs3.statSync(path3.join(projectRulesDir, f)).size;
     duplicateChars += Math.min(a, b);
   }
   shared.sort();
@@ -133,31 +266,31 @@ __export(preamble_byte_census_exports, {
   topRulesByCost: () => topRulesByCost
 });
 var YAML = __toESM(require_dist(), 1);
-import * as fs5 from "node:fs";
+import * as fs7 from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import * as path8 from "node:path";
+import * as path10 from "node:path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL2 } from "node:url";
 
 // src/scripts/_lib/agent_user_profile.ts
-import * as path4 from "node:path";
+import * as path6 from "node:path";
 
 // src/scripts/_lib/user_global_revocations.ts
-import * as path2 from "node:path";
-var REVOCATIONS_RELATIVE = path2.join("user", ".revocations.jsonl");
+import * as path4 from "node:path";
+var REVOCATIONS_RELATIVE = path4.join("user", ".revocations.jsonl");
 
 // src/scripts/_lib/user_memory_gate_counters.ts
-import * as path3 from "node:path";
-var GATE_COUNTERS_RELATIVE = path3.join("user", "promotion-gate-counters.json");
+import * as path5 from "node:path";
+var GATE_COUNTERS_RELATIVE = path5.join("user", "promotion-gate-counters.json");
 
 // src/scripts/_lib/agent_user_profile.ts
-var GLOBAL_PROFILE_RELATIVE = path4.join("user", "profile.md");
+var GLOBAL_PROFILE_RELATIVE = path6.join("user", "profile.md");
 function resolveGlobalProfilePath(env) {
   return resolve_with_fallback(GLOBAL_PROFILE_RELATIVE, { env: env ?? null });
 }
 
 // src/scripts/_lib/carrier_divergence.ts
-import * as fs2 from "node:fs";
-import * as path5 from "node:path";
+import * as fs4 from "node:fs";
+import * as path7 from "node:path";
 var OWNERSHIP_KEYS = ["package", "source_path"];
 function stripOwnershipKeys(text) {
   return text.split("\n").filter((line) => !OWNERSHIP_KEYS.some((k) => line.startsWith(`${k}:`))).join("\n");
@@ -207,14 +340,14 @@ function censusRuleDir(dir) {
   let chars = 0;
   let entries;
   try {
-    entries = fs2.readdirSync(dir);
+    entries = fs4.readdirSync(dir);
   } catch {
     return { files: 0, chars: 0 };
   }
   for (const name of entries) {
     if (!name.endsWith(".md")) continue;
     try {
-      chars += fs2.statSync(path5.join(dir, name)).size;
+      chars += fs4.statSync(path7.join(dir, name)).size;
       files += 1;
     } catch {
     }
@@ -224,14 +357,14 @@ function censusRuleDir(dir) {
 
 // src/scripts/cache_realization_report.ts
 import { execFileSync } from "node:child_process";
-import * as fs4 from "node:fs";
+import * as fs6 from "node:fs";
 import { homedir } from "node:os";
-import * as path7 from "node:path";
+import * as path9 from "node:path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
 
 // src/scripts/ai_council/pricing.ts
-import * as fs3 from "node:fs";
-import * as path6 from "node:path";
+import * as fs5 from "node:fs";
+import * as path8 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/scripts/ai_council/_default_prices.ts
@@ -276,8 +409,8 @@ function as_rows() {
 
 // src/scripts/ai_council/pricing.ts
 var _HERE = fileURLToPath(import.meta.url);
-var REPO_ROOT = path6.resolve(path6.dirname(_HERE), "..", "..", "..");
-var PRICES_FILE = path6.join(REPO_ROOT, "agents", "runtime", ".agent-prices.md");
+var REPO_ROOT = path8.resolve(path8.dirname(_HERE), "..", "..", "..");
+var PRICES_FILE = path8.join(REPO_ROOT, "agents", "runtime", ".agent-prices.md");
 function lookup(table, provider, model) {
   const exact = table.prices.get(priceKey(provider, model));
   if (exact !== void 0) {
@@ -336,16 +469,16 @@ function reprice_with_cache(provider, model, tokens, table, ttl = "5m") {
   };
 }
 function load_prices(p = PRICES_FILE) {
-  if (!fs3.existsSync(p)) {
+  if (!fs5.existsSync(p)) {
     bootstrap_from_defaults(p);
   }
-  return _parse(fs3.readFileSync(p, "utf-8"));
+  return _parse(fs5.readFileSync(p, "utf-8"));
 }
 function bootstrap_from_defaults(p = PRICES_FILE) {
-  fs3.mkdirSync(path6.dirname(p), { recursive: true });
+  fs5.mkdirSync(path8.dirname(p), { recursive: true });
   const rows = as_rows();
   const body = _render_markdown(LAST_UPDATED, "shipped-default", rows);
-  fs3.writeFileSync(p, body, "utf-8");
+  fs5.writeFileSync(p, body, "utf-8");
 }
 function _fmt62f(x) {
   const s = x.toFixed(2);
@@ -465,7 +598,7 @@ function _pyFloat(s) {
 
 // src/scripts/cache_realization_report.ts
 var _HERE2 = fileURLToPath2(import.meta.url);
-var REPO_ROOT2 = path7.resolve(path7.dirname(_HERE2), "..", "..");
+var REPO_ROOT2 = path9.resolve(path9.dirname(_HERE2), "..", "..");
 var C1_COLD_START_DOMINANCE_THRESHOLD = 0.5;
 var C2_DUPLICATE_SCOPE_THRESHOLD = 0.25;
 var C4_COUNCIL_MISPRICING_THRESHOLD = 0.05;
@@ -570,20 +703,20 @@ function computeDuplicateScope(userRulesDir, projectRulesDir, subagentWriteVolum
   };
 }
 function findDebateRoundFiles(councilRoot) {
-  const base = path7.join(councilRoot, "agents", "runtime", "council", "responses");
-  if (!fs4.existsSync(base)) return [];
+  const base = path9.join(councilRoot, "agents", "runtime", "council", "responses");
+  if (!fs6.existsSync(base)) return [];
   const out = [];
   const stack = [base];
   while (stack.length > 0) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = fs4.readdirSync(dir, { withFileTypes: true });
+      entries = fs6.readdirSync(dir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const full = path7.join(dir, entry.name);
+      const full = path9.join(dir, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
@@ -606,7 +739,7 @@ function computeCouncilMispricing(councilRoot) {
   }
   const groups = /* @__PURE__ */ new Map();
   for (const f of files) {
-    const dir = path7.dirname(f);
+    const dir = path9.dirname(f);
     const arr = groups.get(dir) ?? [];
     arr.push(f);
     groups.set(dir, arr);
@@ -627,7 +760,7 @@ function computeCouncilMispricing(councilRoot) {
     for (const f of groupFiles) {
       let data;
       try {
-        data = JSON.parse(fs4.readFileSync(f, "utf-8"));
+        data = JSON.parse(fs6.readFileSync(f, "utf-8"));
       } catch {
         continue;
       }
@@ -667,7 +800,7 @@ function computeCouncilMispricing(councilRoot) {
   const status = Math.abs(deltaPct) >= C4_COUNCIL_MISPRICING_THRESHOLD ? "confirmed" : "falsified";
   return {
     status,
-    session: path7.relative(councilRoot, best.dir) || "(top-level)",
+    session: path9.relative(councilRoot, best.dir) || "(top-level)",
     rounds: best.rounds,
     recorded_cost_usd: best.recorded,
     cache_aware_cost_usd: best.cacheAware,
@@ -695,8 +828,8 @@ function computeWorktreeFragmentation(projectsRoot, worktreePaths, maxAgeDays) {
   }
   const established = worktreePaths[0];
   const encodedEstablished = encodeProjectPath(established);
-  const worktreeDirs = worktreePaths.slice(1).map(encodeProjectPath).filter((d) => fs4.existsSync(path7.join(projectsRoot, d)));
-  if (!fs4.existsSync(path7.join(projectsRoot, encodedEstablished)) || worktreeDirs.length === 0) {
+  const worktreeDirs = worktreePaths.slice(1).map(encodeProjectPath).filter((d) => fs6.existsSync(path9.join(projectsRoot, d)));
+  if (!fs6.existsSync(path9.join(projectsRoot, encodedEstablished)) || worktreeDirs.length === 0) {
     return {
       status: "pending",
       reason: "no transcript directory found for both an established and a fresh-worktree checkout of this repo"
@@ -812,8 +945,8 @@ function defaultOptions() {
     maxAgeDays: 14,
     repoRoot: REPO_ROOT2,
     councilRoot: REPO_ROOT2,
-    userRulesDir: path7.join(homedir(), ".claude", "rules"),
-    projectRulesDir: path7.join(REPO_ROOT2, "dist", "agent-src", "rules")
+    userRulesDir: path9.join(homedir(), ".claude", "rules"),
+    projectRulesDir: path9.join(REPO_ROOT2, "dist", "agent-src", "rules")
   };
 }
 function parseArgs(argv) {
@@ -940,13 +1073,13 @@ function main(argv = process.argv.slice(2)) {
   return 0;
 }
 if (process.argv[1] !== void 0) {
-  const invokedUrl = pathToFileURL(path7.resolve(process.argv[1])).href;
+  const invokedUrl = pathToFileURL(path9.resolve(process.argv[1])).href;
   if (import.meta.url === invokedUrl) process.exit(main());
 }
 
 // src/scripts/preamble_byte_census.ts
 var _HERE3 = fileURLToPath3(import.meta.url);
-var REPO_ROOT3 = path8.resolve(path8.dirname(_HERE3), "..", "..");
+var REPO_ROOT3 = path10.resolve(path10.dirname(_HERE3), "..", "..");
 var CHARS_PER_TOKEN = 4;
 var SUM_TOLERANCE_PCT = 0.1;
 function tokensFromChars(chars) {
@@ -954,19 +1087,19 @@ function tokensFromChars(chars) {
 }
 function readCharsIfExists(p) {
   try {
-    return fs5.statSync(p).size;
+    return fs7.statSync(p).size;
   } catch {
     return 0;
   }
 }
 function topRulesByCost(dir, limit = 10) {
-  if (!fs5.existsSync(dir)) return [];
+  if (!fs7.existsSync(dir)) return [];
   const entries = [];
-  for (const name of fs5.readdirSync(dir)) {
+  for (const name of fs7.readdirSync(dir)) {
     if (!name.endsWith(".md")) continue;
     let chars;
     try {
-      chars = fs5.statSync(path8.join(dir, name)).size;
+      chars = fs7.statSync(path10.join(dir, name)).size;
     } catch {
       continue;
     }
@@ -979,33 +1112,33 @@ var IMPORT_LINE_RE = /^@(\S+)\s*$/;
 function parseClaudeMdImports(claudeMdPath) {
   let text;
   try {
-    text = fs5.readFileSync(claudeMdPath, "utf-8");
+    text = fs7.readFileSync(claudeMdPath, "utf-8");
   } catch {
     return [];
   }
-  const base = path8.dirname(claudeMdPath);
+  const base = path10.dirname(claudeMdPath);
   const out = [];
   for (const line of text.split("\n")) {
     const m = IMPORT_LINE_RE.exec(line.trim());
     if (!m) continue;
     const rel = m[1];
-    const resolved = path8.isAbsolute(rel) ? rel : path8.join(base, rel);
+    const resolved = path10.isAbsolute(rel) ? rel : path10.join(base, rel);
     const chars = readCharsIfExists(resolved);
     if (chars > 0) out.push({ file: rel, chars });
   }
   return out;
 }
 function censusClaudeMdHierarchy(repoRoot, userHome) {
-  const projectClaudeMd = path8.join(repoRoot, "CLAUDE.md");
-  const projectClaudeLocalMd = path8.join(repoRoot, "CLAUDE.local.md");
-  const userClaudeMd = path8.join(userHome, ".claude", "CLAUDE.md");
+  const projectClaudeMd = path10.join(repoRoot, "CLAUDE.md");
+  const projectClaudeLocalMd = path10.join(repoRoot, "CLAUDE.local.md");
+  const userClaudeMd = path10.join(userHome, ".claude", "CLAUDE.md");
   return {
     project_claude_md_chars: readCharsIfExists(projectClaudeMd),
-    project_claude_md_present: fs5.existsSync(projectClaudeMd),
+    project_claude_md_present: fs7.existsSync(projectClaudeMd),
     project_claude_local_md_chars: readCharsIfExists(projectClaudeLocalMd),
-    project_claude_local_md_present: fs5.existsSync(projectClaudeLocalMd),
+    project_claude_local_md_present: fs7.existsSync(projectClaudeLocalMd),
     user_claude_md_chars: readCharsIfExists(userClaudeMd),
-    user_claude_md_present: fs5.existsSync(userClaudeMd),
+    user_claude_md_present: fs7.existsSync(userClaudeMd),
     user_imports: parseClaudeMdImports(userClaudeMd)
   };
 }
@@ -1027,15 +1160,15 @@ function parseFrontmatter(text) {
   }
 }
 function censusSkillsCatalog(skillsDir) {
-  if (!fs5.existsSync(skillsDir)) return { skills: 0, chars: 0 };
+  if (!fs7.existsSync(skillsDir)) return { skills: 0, chars: 0 };
   let skills = 0;
   let chars = 0;
-  for (const entry of fs5.readdirSync(skillsDir, { withFileTypes: true })) {
+  for (const entry of fs7.readdirSync(skillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const skillMd = path8.join(skillsDir, entry.name, "SKILL.md");
+    const skillMd = path10.join(skillsDir, entry.name, "SKILL.md");
     let text;
     try {
-      text = fs5.readFileSync(skillMd, "utf-8");
+      text = fs7.readFileSync(skillMd, "utf-8");
     } catch {
       continue;
     }
@@ -1054,9 +1187,9 @@ function defaultOptions2() {
     format: "text",
     repoRoot: REPO_ROOT3,
     userHome,
-    userRulesDir: path8.join(userHome, ".claude", "rules"),
-    projectRulesDir: path8.join(REPO_ROOT3, "dist", "agent-src", "rules"),
-    skillsDir: path8.join(REPO_ROOT3, "dist", "agent-src", "skills"),
+    userRulesDir: path10.join(userHome, ".claude", "rules"),
+    projectRulesDir: path10.join(REPO_ROOT3, "dist", "agent-src", "rules"),
+    skillsDir: path10.join(REPO_ROOT3, "dist", "agent-src", "skills"),
     root: DEFAULT_PROJECTS_ROOT,
     maxAgeDays: 14
   };
@@ -1272,7 +1405,7 @@ function main2(argv = process.argv.slice(2)) {
 }
 var _isBundled = true;
 if (!_isBundled && process.argv[1] !== void 0) {
-  const invokedUrl = pathToFileURL2(path8.resolve(process.argv[1])).href;
+  const invokedUrl = pathToFileURL2(path10.resolve(process.argv[1])).href;
   if (import.meta.url === invokedUrl) process.exit(main2());
 }
 
@@ -1288,13 +1421,13 @@ __export(dispatch_economy_report_exports, {
   readAuditOrchestrations: () => readAuditOrchestrations,
   renderText: () => renderText3
 });
-import * as fs6 from "node:fs";
-import * as path9 from "node:path";
+import * as fs8 from "node:fs";
+import * as path11 from "node:path";
 import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL3 } from "node:url";
 var _HERE4 = fileURLToPath4(import.meta.url);
-var REPO_ROOT4 = path9.resolve(path9.dirname(_HERE4), "..", "..");
-var REGISTRATION_FILE = path9.join(REPO_ROOT4, "src", "config", "dispatch-economy-metrics.json");
-var DEFAULT_AUDIT_DIR = path9.join("agents", "runtime", "state", "audit");
+var REPO_ROOT4 = path11.resolve(path11.dirname(_HERE4), "..", "..");
+var REGISTRATION_FILE = path11.join(REPO_ROOT4, "src", "config", "dispatch-economy-metrics.json");
+var DEFAULT_AUDIT_DIR = path11.join("agents", "runtime", "state", "audit");
 var REVIEWER_TYPE_RE = /review|judge|validator/i;
 function median2(values) {
   if (values.length === 0) return null;
@@ -1340,19 +1473,19 @@ function isFiniteNonNegInt(v) {
   return typeof v === "number" && Number.isInteger(v) && v >= 0;
 }
 function readAuditOrchestrations(auditDir, opts = {}) {
-  if (!fs6.existsSync(auditDir)) return [];
+  if (!fs8.existsSync(auditDir)) return [];
   const out = [];
   const cutoffMs = opts.maxAgeDays !== void 0 ? (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.maxAgeDays * 24 * 60 * 60 * 1e3 : null;
   let entries;
   try {
-    entries = fs6.readdirSync(auditDir).filter((f) => f.endsWith(".jsonl")).sort();
+    entries = fs8.readdirSync(auditDir).filter((f) => f.endsWith(".jsonl")).sort();
   } catch {
     return [];
   }
   if (cutoffMs !== null) {
     entries = entries.filter((f) => {
       try {
-        return fs6.statSync(path9.join(auditDir, f)).mtimeMs >= cutoffMs;
+        return fs8.statSync(path11.join(auditDir, f)).mtimeMs >= cutoffMs;
       } catch {
         return false;
       }
@@ -1361,7 +1494,7 @@ function readAuditOrchestrations(auditDir, opts = {}) {
   for (const f of entries) {
     let text;
     try {
-      text = fs6.readFileSync(path9.join(auditDir, f), "utf8");
+      text = fs8.readFileSync(path11.join(auditDir, f), "utf8");
     } catch {
       continue;
     }
@@ -1383,7 +1516,7 @@ function readAuditOrchestrations(auditDir, opts = {}) {
   return out;
 }
 function buildReport3(opts) {
-  const registrationRaw = fs6.readFileSync(REGISTRATION_FILE, "utf8");
+  const registrationRaw = fs8.readFileSync(REGISTRATION_FILE, "utf8");
   const registration = JSON.parse(registrationRaw);
   const scanOpts = {
     root: opts.root,
@@ -1521,7 +1654,7 @@ function renderText3(r) {
 function main3(argv) {
   let format = "text";
   let root = DEFAULT_PROJECTS_ROOT;
-  let auditDir = path9.join(process.cwd(), DEFAULT_AUDIT_DIR);
+  let auditDir = path11.join(process.cwd(), DEFAULT_AUDIT_DIR);
   let maxAgeDays = 14;
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -1544,10 +1677,10 @@ function main3(argv) {
 function _isCliEntry() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL3(path9.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL3(path11.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    return fs6.realpathSync(fileURLToPath4(import.meta.url)) === fs6.realpathSync(path9.resolve(process.argv[1]));
+    return fs8.realpathSync(fileURLToPath4(import.meta.url)) === fs8.realpathSync(path11.resolve(process.argv[1]));
   } catch {
     return false;
   }
@@ -1556,14 +1689,14 @@ if (_isCliEntry()) process.exit(main3(process.argv.slice(2)));
 
 // src/scripts/_lib/environment_detector.ts
 import { spawnSync } from "node:child_process";
-import * as fs7 from "node:fs";
+import * as fs9 from "node:fs";
 import * as os from "node:os";
-import * as path10 from "node:path";
+import * as path12 from "node:path";
 
 // src/install/toolDetection.ts
 import { existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { delimiter, join as join10 } from "node:path";
+import { delimiter, join as join12 } from "node:path";
 var TOOL_SIGNALS = {
   "claude-code": { bins: ["claude"], homePaths: [".claude", ".claude.json", ".config/claude"] },
   "claude-desktop": { absPaths: ["/Applications/Claude.app"], homePaths: ["Library/Application Support/Claude", ".config/Claude"] },
@@ -1608,7 +1741,7 @@ function resolveBinaryPath(name, pathEnv) {
   for (const dir of pathEnv.split(delimiter)) {
     if (dir.length === 0) continue;
     for (const candidate of [name, `${name}.exe`, `${name}.cmd`]) {
-      const full = join10(dir, candidate);
+      const full = join12(dir, candidate);
       if (existsSync6(full)) return full;
     }
   }
@@ -1619,7 +1752,7 @@ function binOnPath(name, pathEnv) {
 }
 function isToolInstalled(signal, home, pathEnv) {
   for (const rel of signal.homePaths ?? []) {
-    if (existsSync6(join10(home, rel))) return true;
+    if (existsSync6(join12(home, rel))) return true;
   }
   for (const abs of signal.absPaths ?? []) {
     if (existsSync6(abs)) return true;
@@ -1681,7 +1814,7 @@ function classifyBilling(provider, source) {
 function codexHome(env) {
   const map = env ?? process.env;
   const override = (map["CODEX_HOME"] ?? "").trim();
-  return override !== "" ? override : path10.join(homeOf(env), ".codex");
+  return override !== "" ? override : path12.join(homeOf(env), ".codex");
 }
 function homeOf(env) {
   const map = env ?? process.env;
@@ -1720,16 +1853,16 @@ ${res.stderr ?? ""}`;
     return null;
   }
 }
-function isFile(p) {
+function isFile3(p) {
   try {
-    return fs7.statSync(p).isFile();
+    return fs9.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function exists(p) {
   try {
-    return fs7.existsSync(p);
+    return fs9.existsSync(p);
   } catch {
     return false;
   }
@@ -1737,7 +1870,7 @@ function exists(p) {
 function classifyCodexAuth(authPath) {
   let data;
   try {
-    data = JSON.parse(fs7.readFileSync(authPath, "utf-8"));
+    data = JSON.parse(fs9.readFileSync(authPath, "utf-8"));
   } catch {
     return "cli-api-key";
   }
@@ -1754,8 +1887,8 @@ function cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeyc
   if (provider === "anthropic") {
     const configDir = claudeConfigDir;
     for (const rel of [".credentials.json", "credentials.json"]) {
-      const p = path10.join(configDir, rel);
-      if (isFile(p)) return { source: "cli-subscription", evidence: p };
+      const p = path12.join(configDir, rel);
+      if (isFile3(p)) return { source: "cli-subscription", evidence: p };
     }
     if (probeKeychain(CLAUDE_KEYCHAIN_SERVICE)) {
       return { source: "cli-subscription", evidence: `keychain:${CLAUDE_KEYCHAIN_SERVICE}` };
@@ -1763,13 +1896,13 @@ function cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeyc
     return null;
   }
   if (provider === "openai") {
-    const p = path10.join(codexHome(env), "auth.json");
-    if (isFile(p)) return { source: classifyCodexAuth(p), evidence: p };
+    const p = path12.join(codexHome(env), "auth.json");
+    if (isFile3(p)) return { source: classifyCodexAuth(p), evidence: p };
     return null;
   }
   if (provider === "gemini") {
-    const p = path10.join(home, ".gemini", "oauth_creds.json");
-    if (isFile(p)) return { source: "cli-subscription", evidence: p };
+    const p = path12.join(home, ".gemini", "oauth_creds.json");
+    if (isFile3(p)) return { source: "cli-subscription", evidence: p };
     return null;
   }
   return null;
@@ -1800,7 +1933,7 @@ function detectHosts(opts) {
 function detectAuth(opts) {
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeOf(opts.env);
-  const claudeConfigDir = opts.home === void 0 && opts.env === void 0 ? claude_config_dir() : (env["CLAUDE_CONFIG_DIR"] ?? "").trim() || path10.join(home, ".claude");
+  const claudeConfigDir = opts.home === void 0 && opts.env === void 0 ? claude_config_dir() : (env["CLAUDE_CONFIG_DIR"] ?? "").trim() || path12.join(home, ".claude");
   const probeKeychain = opts.probeKeychain ?? defaultProbeKeychain;
   const auth = [];
   const keys = [];
@@ -1855,7 +1988,7 @@ function detectEnvironment(opts = {}) {
 }
 
 // src/scripts/_cli/detection_report.ts
-import * as path11 from "node:path";
+import * as path13 from "node:path";
 
 // src/scripts/ai_council/transport_resolver.ts
 var VALID_TRANSPORT_MODES = /* @__PURE__ */ new Set([
@@ -2057,7 +2190,7 @@ function cliBinaryPresent(environment, provider, binaryOverride) {
   const expected = PROVIDER_CLI_META[provider]?.[0];
   if (expected === void 0) return false;
   return environment.hosts.some(
-    (h) => h.binary !== null && stripExe(path11.basename(h.binary)) === expected
+    (h) => h.binary !== null && stripExe(path13.basename(h.binary)) === expected
   );
 }
 function stripExe(name) {
@@ -2218,9 +2351,9 @@ function absentCouncilFacts(configPath) {
 
 // src/scripts/ai_team/review_gate.ts
 import * as crypto from "node:crypto";
-import * as fs8 from "node:fs";
+import * as fs10 from "node:fs";
 import * as os2 from "node:os";
-import * as path12 from "node:path";
+import * as path14 from "node:path";
 
 // src/scripts/ai_team/config.ts
 var AI_TEAM_REVIEW_GATE_DEFAULTS = Object.freeze({
@@ -2236,16 +2369,16 @@ var AI_TEAM_DEFAULTS = Object.freeze({
 });
 
 // src/scripts/ai_team/review_gate.ts
-var GATE_LEDGER_RELPATH = path12.join("agents", "runtime", "team", "events.log");
+var GATE_LEDGER_RELPATH = path14.join("agents", "runtime", "team", "events.log");
 var _CODEX_PLUGIN_DATA_DIRNAME = `${CODEX_PLUGIN_ID}-${CODEX_MARKETPLACE_NAME}`;
 function _workspace_state_segment(workspace_root) {
   let canonical = workspace_root;
   try {
-    canonical = fs8.realpathSync.native(workspace_root);
+    canonical = fs10.realpathSync.native(workspace_root);
   } catch {
     canonical = workspace_root;
   }
-  const slug_source = path12.basename(workspace_root) || "workspace";
+  const slug_source = path14.basename(workspace_root) || "workspace";
   const slug = slug_source.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "workspace";
   const hash = crypto.createHash("sha256").update(canonical).digest("hex").slice(0, 16);
   return `${slug}-${hash}`;
@@ -2255,19 +2388,19 @@ function upstream_state_dir_candidates(workspace_root) {
   const candidates = [];
   const env = (process.env["CLAUDE_PLUGIN_DATA"] ?? "").trim();
   if (env !== "") {
-    candidates.push(path12.join(env, "state", segment));
+    candidates.push(path14.join(env, "state", segment));
   }
   candidates.push(
-    path12.join(claude_config_dir(), "plugins", "data", _CODEX_PLUGIN_DATA_DIRNAME, "state", segment)
+    path14.join(claude_config_dir(), "plugins", "data", _CODEX_PLUGIN_DATA_DIRNAME, "state", segment)
   );
-  candidates.push(path12.join(os2.tmpdir(), "codex-companion", segment));
+  candidates.push(path14.join(os2.tmpdir(), "codex-companion", segment));
   return candidates;
 }
 function upstream_gate_enabled(workspace_root) {
   for (const dir of upstream_state_dir_candidates(workspace_root)) {
     let parsed;
     try {
-      parsed = JSON.parse(fs8.readFileSync(path12.join(dir, "state.json"), "utf-8"));
+      parsed = JSON.parse(fs10.readFileSync(path14.join(dir, "state.json"), "utf-8"));
     } catch {
       continue;
     }
@@ -2327,41 +2460,41 @@ var ArgparseExit = class extends Error {
 function expanduser(p) {
   if (p === "~") return os3.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\")) {
-    return path13.join(os3.homedir(), p.slice(2));
+    return path15.join(os3.homedir(), p.slice(2));
   }
   return p;
 }
 function pathExists(p) {
   try {
-    fs9.statSync(p);
+    fs11.statSync(p);
     return true;
   } catch {
     return false;
   }
 }
-function isFile2(p) {
+function isFile4(p) {
   try {
-    return fs9.statSync(p).isFile();
+    return fs11.statSync(p).isFile();
   } catch {
     return false;
   }
 }
-function isDir(p) {
+function isDir3(p) {
   try {
-    return fs9.statSync(p).isDirectory();
+    return fs11.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function resolvePath(p) {
   try {
-    return fs9.realpathSync(path13.resolve(p));
+    return fs11.realpathSync(path15.resolve(p));
   } catch {
-    return path13.resolve(p);
+    return path15.resolve(p);
   }
 }
 function readText(p) {
-  return fs9.readFileSync(p, "utf-8");
+  return fs11.readFileSync(p, "utf-8");
 }
 function _jsonStrAscii(s) {
   let out = '"';
@@ -2472,8 +2605,8 @@ function _resolve_project_root(arg) {
 }
 var _INSTALL_MODE_MARKER_REL = "agents/.agent-state/install-mode.txt";
 function _detect_install_mode(project_root) {
-  const marker = path13.join(project_root, _INSTALL_MODE_MARKER_REL);
-  if (isFile2(marker)) {
+  const marker = path15.join(project_root, _INSTALL_MODE_MARKER_REL);
+  if (isFile4(marker)) {
     let value;
     try {
       value = readText(marker).trim();
@@ -2484,9 +2617,9 @@ function _detect_install_mode(project_root) {
       return [value, "marker-file"];
     }
   }
-  const has_agents_md = pathExists(path13.join(project_root, "AGENTS.md"));
+  const has_agents_md = pathExists(path15.join(project_root, "AGENTS.md"));
   const has_copilot = pathExists(
-    path13.join(project_root, ".github", "copilot-instructions.md")
+    path15.join(project_root, ".github", "copilot-instructions.md")
   );
   if (has_agents_md && has_copilot) {
     return ["full", "heuristic"];
@@ -2496,17 +2629,17 @@ function _detect_install_mode(project_root) {
 function _settings_layer_chain(project_root) {
   const layers = [];
   const user_global = resolve_with_fallback("agent-settings.yml");
-  if (user_global !== null && isFile2(user_global)) {
+  if (user_global !== null && isFile4(user_global)) {
     layers.push(String(user_global));
   }
   const project_settings = project_settings_path(project_root);
-  if (isFile2(project_settings)) {
+  if (isFile4(project_settings)) {
     layers.push(String(project_settings));
   }
   return layers;
 }
 function _detect_wrapper(project_root) {
-  const wrapper = path13.join(project_root, "agent-config");
+  const wrapper = path15.join(project_root, "agent-config");
   if (!pathExists(wrapper)) {
     return { path: String(wrapper), exists: false, embedded_root: null };
   }
@@ -2573,14 +2706,14 @@ function _emit_context_text(ctx) {
 }
 function _resolve_path(project_root, raw) {
   let p = expanduser(raw);
-  if (!path13.isAbsolute(p)) {
-    p = path13.join(project_root, p);
+  if (!path15.isAbsolute(p)) {
+    p = path15.join(project_root, p);
   }
   return p;
 }
 function _sha256(p) {
   try {
-    const data = fs9.readFileSync(p);
+    const data = fs11.readFileSync(p);
     return crypto2.createHash("sha256").update(data).digest("hex");
   } catch {
     return null;
@@ -2589,7 +2722,7 @@ function _sha256(p) {
 var PACKAGE_TAG_ID = "event4u/agent-config";
 var _FRONTMATTER_PACKAGE_RE = /^package:\s*(.+?)\s*$/m;
 function _read_inline_package_tag(p) {
-  if (path13.extname(p) !== ".md") {
+  if (path15.extname(p) !== ".md") {
     return NO_FRONTMATTER;
   }
   let text;
@@ -2690,11 +2823,11 @@ function _scan_foreign(project_root, manifest, known) {
   const seen = /* @__PURE__ */ new Set();
   for (const root_rel of roots) {
     const root = _resolve_path(project_root, String(root_rel));
-    if (!pathExists(root) || !isDir(root)) {
+    if (!pathExists(root) || !isDir3(root)) {
       continue;
     }
     for (const child of rglob(root)) {
-      if (!isFile2(child)) {
+      if (!isFile4(child)) {
         continue;
       }
       let resolved;
@@ -2718,17 +2851,17 @@ function rglob(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs9.readdirSync(dir, { withFileTypes: true });
+      entries = fs11.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const ent of entries) {
-      const full = path13.join(dir, ent.name);
+      const full = path15.join(dir, ent.name);
       out.push(full);
       let dirLike = ent.isDirectory();
       if (ent.isSymbolicLink()) {
-        dirLike = isDir(full);
+        dirLike = isDir3(full);
       }
       if (dirLike) {
         walk(full);
@@ -2799,9 +2932,9 @@ function _foreign_records(project_root, foreign) {
   return out;
 }
 function relativeTo(p, base) {
-  const rel = path13.relative(base, p);
+  const rel = path15.relative(base, p);
   if (rel === "") return rel;
-  if (rel.startsWith("..") || path13.isAbsolute(rel)) {
+  if (rel.startsWith("..") || path15.isAbsolute(rel)) {
     return null;
   }
   return rel;
@@ -2815,6 +2948,7 @@ var CHECK_IDS = [
   "surface-state",
   "hook-wiring",
   "stale-orphans",
+  "overrides",
   "rule-scope-drift",
   "manifest-integrity",
   "lockfile-freshness",
@@ -2843,6 +2977,7 @@ var GLOBAL_CHECK_IDS = /* @__PURE__ */ new Set([
   "surface-state",
   "hook-wiring",
   "stale-orphans",
+  "overrides",
   "rule-scope-drift",
   "mcp-mode",
   "mcp-beta-readiness",
@@ -2863,10 +2998,6 @@ var MANIFEST_REQUIRED_CHECK_IDS = /* @__PURE__ */ new Set([
   "lockfile-freshness",
   "unsupported-combos"
 ]);
-var INSTALL_MODE_MARKER_RELATIVE = "agents/.agent-state/install-mode.txt";
-function _is_global_only_consumer(project_root) {
-  return isFile2(path13.join(project_root, INSTALL_MODE_MARKER_RELATIVE)) || isDir(path13.join(project_root, "agents", "overrides"));
-}
 var REPAIR_IDS = ["wizard-state"];
 var MCP_BETA_GATES = [
   ["gate-1-external-client", "tests/mcp/external-clients"],
@@ -2885,7 +3016,7 @@ var STATUS_SYMBOLS = {
 var MIN_PYTHON = [3, 10];
 function _check_scope(project_root) {
   for (const marker of ["pnpm-workspace.yaml", "lerna.json"]) {
-    if (pathExists(path13.join(project_root, marker))) {
+    if (pathExists(path15.join(project_root, marker))) {
       return {
         id: "scope",
         status: "warn",
@@ -2894,7 +3025,7 @@ function _check_scope(project_root) {
       };
     }
   }
-  const pkg = path13.join(project_root, "package.json");
+  const pkg = path15.join(project_root, "package.json");
   if (pathExists(pkg)) {
     try {
       const data = JSON.parse(readText(pkg));
@@ -2920,7 +3051,7 @@ var _PLACEHOLDER_EMAIL_RE = /^(t@t\.t|.*@example\.(com|org)|.*@localhost)$/i;
 var _PLACEHOLDER_NAME_RE = /^(t|test|user|nobody|x)$/i;
 function _git_config_path(project_root) {
   const common = git_common_dir(project_root);
-  return common === null ? null : path13.join(common, "config");
+  return common === null ? null : path15.join(common, "config");
 }
 function _parse_git_user(configText) {
   let inUser = false;
@@ -2950,7 +3081,7 @@ function _check_git_identity(project_root) {
   }
   let ident = _parse_git_user(readText(cfgPath));
   if (ident.name === null && ident.email === null) {
-    const globalCfg = path13.join(os3.homedir(), ".gitconfig");
+    const globalCfg = path15.join(os3.homedir(), ".gitconfig");
     if (pathExists(globalCfg)) {
       ident = _parse_git_user(readText(globalCfg));
     }
@@ -3011,7 +3142,7 @@ function _package_root() {
 }
 function _current_package_version() {
   try {
-    const data = JSON.parse(readText(path13.join(_package_root(), "package.json")));
+    const data = JSON.parse(readText(path15.join(_package_root(), "package.json")));
     const v = data["version"];
     if (typeof v === "string" && v.trim()) {
       return v.trim();
@@ -3055,7 +3186,7 @@ function _check_lockfile_freshness(manifest) {
   };
 }
 function shutilWhich(name) {
-  if (path13.dirname(name) !== "." && (name.includes("/") || name.includes("\\"))) {
+  if (path15.dirname(name) !== "." && (name.includes("/") || name.includes("\\"))) {
     return isExecutableFile(name) ? name : null;
   }
   const pathEnv = process2.env["PATH"] || "";
@@ -3068,12 +3199,12 @@ function shutilWhich(name) {
     if (seenDirs.has(d)) continue;
     seenDirs.add(d);
     for (const ext of exts) {
-      const candidate = path13.join(d, name + (ext === "" ? "" : ext.toLowerCase() === ext ? ext : ext));
+      const candidate = path15.join(d, name + (ext === "" ? "" : ext.toLowerCase() === ext ? ext : ext));
       if (isExecutableFile(candidate)) {
         return candidate;
       }
       if (ext !== "") {
-        const upper = path13.join(d, name + ext);
+        const upper = path15.join(d, name + ext);
         if (isExecutableFile(upper)) return upper;
       }
     }
@@ -3082,10 +3213,10 @@ function shutilWhich(name) {
 }
 function isExecutableFile(p) {
   try {
-    const st = fs9.statSync(p);
+    const st = fs11.statSync(p);
     if (!st.isFile()) return false;
     if (process2.platform === "win32") return true;
-    fs9.accessSync(p, fs9.constants.X_OK);
+    fs11.accessSync(p, fs11.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -3149,8 +3280,8 @@ function _check_claude_plugin() {
       remedy: ""
     };
   }
-  const projection = path13.join(os3.homedir(), ".claude", "skills");
-  const projection_present = isDir(projection);
+  const projection = path15.join(os3.homedir(), ".claude", "skills");
+  const projection_present = isDir3(projection);
   if (projection_present) {
     return {
       id: "claude-plugin",
@@ -3186,9 +3317,9 @@ function _check_claude_command_wrappers() {
       remedy: ""
     };
   }
-  const anchor = path13.join(os3.homedir(), ".claude");
-  const commands_dir = path13.join(anchor, "commands");
-  if (!isDir(commands_dir)) {
+  const anchor = path15.join(os3.homedir(), ".claude");
+  const commands_dir = path15.join(anchor, "commands");
+  if (!isDir3(commands_dir)) {
     return {
       id: "claude-command-wrappers",
       status: "skipped",
@@ -3196,8 +3327,8 @@ function _check_claude_command_wrappers() {
       remedy: ""
     };
   }
-  const flat_probe = fs9.existsSync(path13.join(commands_dir, "commit.md"));
-  const wrapper_probe = fs9.existsSync(path13.join(anchor, "skills", "commit", "SKILL.md"));
+  const flat_probe = fs11.existsSync(path15.join(commands_dir, "commit.md"));
+  const wrapper_probe = fs11.existsSync(path15.join(anchor, "skills", "commit", "SKILL.md"));
   if (wrapper_probe) {
     return {
       id: "claude-command-wrappers",
@@ -3222,8 +3353,8 @@ function _check_claude_command_wrappers() {
   };
 }
 function _check_surface_state() {
-  const matrix_path = path13.join(_package_root(), "src", "config", "surface-matrix.yml");
-  if (!isFile2(matrix_path)) {
+  const matrix_path = path15.join(_package_root(), "src", "config", "surface-matrix.yml");
+  if (!isFile4(matrix_path)) {
     return {
       id: "surface-state",
       status: "skipped",
@@ -3246,7 +3377,7 @@ function _check_surface_state() {
       remedy: "agent-config upgrade (reinstalls the package data files)"
     };
   }
-  const _expand = (p) => p.startsWith("~/") ? path13.join(os3.homedir(), p.slice(2)) : path13.join(_package_root(), p);
+  const _expand = (p) => p.startsWith("~/") ? path15.join(os3.homedir(), p.slice(2)) : path15.join(_package_root(), p);
   const violations = [];
   const remedies = [];
   let checked = 0;
@@ -3288,7 +3419,7 @@ function _check_surface_state() {
 }
 function pathExistsAny(p) {
   try {
-    fs9.statSync(p);
+    fs11.statSync(p);
     return true;
   } catch {
     return false;
@@ -3304,13 +3435,13 @@ function _check_hook_wiring() {
       remedy: ""
     };
   }
-  const settings_path = path13.join(os3.homedir(), ".claude", "settings.json");
+  const settings_path = path15.join(os3.homedir(), ".claude", "settings.json");
   let missing;
   try {
     const matrix = build_claude_hook_matrix(
-      path13.join(_package_root(), "src", "scripts", "hook_manifest.yaml")
+      path15.join(_package_root(), "src", "scripts", "hook_manifest.yaml")
     );
-    const settings = pathExists(settings_path) ? JSON.parse(fs9.readFileSync(settings_path, "utf8")) : {};
+    const settings = pathExists(settings_path) ? JSON.parse(fs11.readFileSync(settings_path, "utf8")) : {};
     const hooks = (settings["hooks"] ?? {}) || {};
     missing = Object.keys(matrix).filter((ev) => {
       const groups = hooks[ev];
@@ -3385,7 +3516,7 @@ function _check_mcp_mode(project_root) {
   ];
   const found = [];
   for (const [rel, label] of candidates) {
-    const p = path13.join(project_root, rel);
+    const p = path15.join(project_root, rel);
     if (!pathExists(p)) {
       continue;
     }
@@ -3417,7 +3548,7 @@ function _check_mcp_mode(project_root) {
   };
 }
 function _check_offline_readiness() {
-  const script = path13.join(_package_root(), "src", "scripts", "hermetic-install.sh");
+  const script = path15.join(_package_root(), "src", "scripts", "hermetic-install.sh");
   if (!pathExists(script)) {
     return {
       id: "offline-readiness",
@@ -3461,7 +3592,7 @@ function _check_stale_orphans() {
       continue;
     }
     const anchor = expanduser(anchor_raw);
-    if (!isDir(anchor)) {
+    if (!isDir3(anchor)) {
       continue;
     }
     const recorded_set = new Set(recorded.filter((r) => typeof r === "string"));
@@ -3475,12 +3606,12 @@ function _check_stale_orphans() {
       (a, b) => a < b ? -1 : a > b ? 1 : 0
     );
     for (const root_name of ownedSorted) {
-      const root = path13.join(anchor, root_name);
-      if (!isDir(root)) {
+      const root = path15.join(anchor, root_name);
+      if (!isDir3(root)) {
         continue;
       }
       for (const md of rglob(root)) {
-        if (isDir(md)) {
+        if (isDir3(md)) {
           continue;
         }
         if (!md.endsWith(".md")) {
@@ -3490,7 +3621,7 @@ function _check_stale_orphans() {
         if (rel === null) {
           continue;
         }
-        const relPosix = rel.split(path13.sep).join("/");
+        const relPosix = rel.split(path15.sep).join("/");
         if (recorded_set.has(relPosix)) {
           continue;
         }
@@ -3537,7 +3668,7 @@ function _check_rule_scope_drift(project_root) {
   }
   let scope = LEGACY_ALL;
   const settings_file = project_settings_path(project_root);
-  if (isFile2(settings_file)) {
+  if (isFile4(settings_file)) {
     const loaded = yamlSafeLoad(readText0(settings_file));
     const raw = typeof loaded === "object" && loaded !== null && !Array.isArray(loaded) ? loaded : {};
     scope = ruleScopeFromSettings(raw);
@@ -3545,14 +3676,14 @@ function _check_rule_scope_drift(project_root) {
   let rules_dir = null;
   let found = 0;
   for (const rel of _RULE_PROJECTION_DIRS) {
-    const cand = path13.join(project_root, rel);
-    if (!isDir(cand)) {
+    const cand = path15.join(project_root, rel);
+    if (!isDir3(cand)) {
       continue;
     }
     let count = 0;
     try {
-      for (const name of fs9.readdirSync(cand)) {
-        if (name.endsWith(".md") && isFile2(path13.join(cand, name))) {
+      for (const name of fs11.readdirSync(cand)) {
+        if (name.endsWith(".md") && isFile4(path15.join(cand, name))) {
           count += 1;
         }
       }
@@ -3606,15 +3737,15 @@ function _check_rule_scope_drift(project_root) {
   };
 }
 function _check_duplicate_scope_rules(project_root, userRulesDirOverride) {
-  const user_rules_dir = userRulesDirOverride ?? path13.join(os3.homedir(), ".claude", "rules");
+  const user_rules_dir = userRulesDirOverride ?? path15.join(os3.homedir(), ".claude", "rules");
   let project_rules_dir = null;
   if (_is_source_repo(project_root)) {
-    const cand = path13.join(project_root, "dist", "agent-src", "rules");
-    if (isDir(cand)) project_rules_dir = cand;
+    const cand = path15.join(project_root, "dist", "agent-src", "rules");
+    if (isDir3(cand)) project_rules_dir = cand;
   } else {
     for (const rel of _RULE_PROJECTION_DIRS) {
-      const cand = path13.join(project_root, rel);
-      if (isDir(cand)) {
+      const cand = path15.join(project_root, rel);
+      if (isDir3(cand)) {
         project_rules_dir = cand;
         break;
       }
@@ -3682,7 +3813,7 @@ function _check_mcp_beta_readiness(project_root) {
   }
   const pending = [];
   for (const [gate_id, rel] of MCP_BETA_GATES) {
-    if (!pathExists(path13.join(project_root, rel))) {
+    if (!pathExists(path15.join(project_root, rel))) {
       pending.push(`${gate_id} (${rel})`);
     }
   }
@@ -3703,9 +3834,9 @@ function _check_mcp_beta_readiness(project_root) {
 }
 function _check_tier_usage_readiness(project_root) {
   const settings_file = project_settings_path(project_root);
-  let log_path = path13.join(project_root, ".agent-tier-usage.jsonl");
+  let log_path = path15.join(project_root, ".agent-tier-usage.jsonl");
   let enabled = false;
-  if (isFile2(settings_file)) {
+  if (isFile4(settings_file)) {
     let raw;
     const loaded = yamlSafeLoad(readText0(settings_file));
     if (loaded === null) {
@@ -3722,7 +3853,7 @@ function _check_tier_usage_readiness(project_root) {
         const outputRaw = tu["output"];
         const output = typeof outputRaw === "object" && outputRaw !== null && !Array.isArray(outputRaw) ? outputRaw : {};
         if (typeof output["path"] === "string" && output["path"].trim()) {
-          log_path = path13.join(project_root, output["path"].trim());
+          log_path = path15.join(project_root, output["path"].trim());
         }
         const val = tu["enabled"];
         if (typeof val === "boolean") {
@@ -3747,7 +3878,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "warn",
-      message: `tier-usage telemetry on but ${path13.basename(log_path)} not yet written \u2014 no signal accumulated`,
+      message: `tier-usage telemetry on but ${path15.basename(log_path)} not yet written \u2014 no signal accumulated`,
       remedy: "run any tracked command to seed the log; the dispatcher writes one record per invocation"
     };
   }
@@ -3762,7 +3893,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "fail",
-      message: `cannot read ${path13.basename(log_path)}: ${osErrorStr(exc)}`,
+      message: `cannot read ${path15.basename(log_path)}: ${osErrorStr(exc)}`,
       remedy: "fix permissions on the tier-usage log"
     };
   }
@@ -3793,7 +3924,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "fail",
-      message: `${total} record(s) in ${path13.basename(log_path)} but 0 passed the privacy floor \u2014 report would refuse to render`,
+      message: `${total} record(s) in ${path15.basename(log_path)} but 0 passed the privacy floor \u2014 report would refuse to render`,
       remedy: "inspect the log; the dispatcher is writing records the contract forbids (paths, argv, message bodies)"
     };
   }
@@ -3801,19 +3932,19 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "warn",
-      message: `${path13.basename(log_path)} present but empty \u2014 no signal yet`,
+      message: `${path15.basename(log_path)} present but empty \u2014 no signal yet`,
       remedy: "run any tracked command to seed the log"
     };
   }
   return {
     id: "tier-usage-readiness",
     status: "ok",
-    message: `${valid} record(s) past the privacy floor in ${path13.basename(log_path)} \u2014 retiering signal available`,
+    message: `${valid} record(s) past the privacy floor in ${path15.basename(log_path)} \u2014 retiering signal available`,
     remedy: ""
   };
 }
 function readText0(p) {
-  return fs9.readFileSync(p, "utf-8");
+  return fs11.readFileSync(p, "utf-8");
 }
 function osErrorStr(exc) {
   if (exc && typeof exc === "object" && "message" in exc) {
@@ -3986,7 +4117,7 @@ function _epoch_seconds(value) {
 function _codex_auth_expiry(auth_path) {
   let data;
   try {
-    data = JSON.parse(fs9.readFileSync(auth_path, "utf-8"));
+    data = JSON.parse(fs11.readFileSync(auth_path, "utf-8"));
   } catch {
     return null;
   }
@@ -4007,7 +4138,7 @@ function _codex_auth_expiry(auth_path) {
 }
 function _read_ai_team_block(project_root) {
   const settings_file = project_settings_path(project_root);
-  if (!isFile2(settings_file)) return {};
+  if (!isFile4(settings_file)) return {};
   let content;
   try {
     content = readText0(settings_file);
@@ -4132,7 +4263,7 @@ function _check_team(project_root) {
   if (binary_missing) {
     remedies.push("install the codex CLI: `npm install -g @openai/codex`");
   }
-  const auth_path = path13.join(_codex_home(), "auth.json");
+  const auth_path = path15.join(_codex_home(), "auth.json");
   const authed = pathExists(auth_path);
   let auth_str;
   if (!authed) {
@@ -4220,7 +4351,7 @@ function _check_unsupported_combos(manifest) {
   };
 }
 function _wizard_state_path() {
-  return path13.join(event4u_root(), "state", "wizard-state.json");
+  return path15.join(event4u_root(), "state", "wizard-state.json");
 }
 function _check_wizard_state() {
   const state_pth = _wizard_state_path();
@@ -4300,7 +4431,7 @@ function _check_wizard_state() {
   };
 }
 function _check_settings_review_pending() {
-  const delta_pth = path13.join(event4u_root(), "state", "settings-delta.json");
+  const delta_pth = path15.join(event4u_root(), "state", "settings-delta.json");
   if (!pathExists(delta_pth)) {
     return {
       id: "settings-review-pending",
@@ -4326,7 +4457,7 @@ function _check_settings_review_pending() {
 }
 function _check_memory_merge_union(project_root) {
   const remedy = "run: npx tsx src/scripts/sync_gitattributes.ts (or `agent-config refresh --project`)";
-  const target = path13.join(project_root, DEFAULT_GITATTRIBUTES);
+  const target = path15.join(project_root, DEFAULT_GITATTRIBUTES);
   if (!pathExists(target)) {
     return {
       id: "memory-merge-union",
@@ -4444,6 +4575,7 @@ function _run_checks(project_root, manifest, drift, only = null) {
     "surface-state": _check_surface_state,
     "hook-wiring": _check_hook_wiring,
     "stale-orphans": _check_stale_orphans,
+    overrides: () => _check_overrides(project_root),
     "rule-scope-drift": () => _check_rule_scope_drift(project_root),
     "manifest-integrity": () => _check_manifest_integrity(manifest),
     "lockfile-freshness": () => _check_lockfile_freshness(manifest),
@@ -4511,6 +4643,11 @@ function _run_checks_no_manifest(project_root, bridge_present, only = null) {
     "surface-state": _check_surface_state,
     "hook-wiring": _check_hook_wiring,
     "stale-orphans": _check_stale_orphans,
+    // BOTH registries need the id. Registering only the first one crashed with
+    // `runners[cid] is not a function` on a global-only consumer, which is the
+    // path that has no manifest — a loud failure rather than a silent skip, and
+    // worth the comment because the duplication is easy to miss.
+    overrides: () => _check_overrides(project_root),
     "rule-scope-drift": () => _check_rule_scope_drift(project_root),
     "manifest-integrity": () => _skipped_manifest_check("manifest-integrity"),
     "lockfile-freshness": () => _skipped_manifest_check("lockfile-freshness"),
@@ -4808,7 +4945,7 @@ function _run_anatomy(opts) {
   try {
     economyReport = economy.buildReport({
       root: economy.DEFAULT_PROJECTS_ROOT,
-      auditDir: path13.join(process2.cwd(), economy.DEFAULT_AUDIT_DIR),
+      auditDir: path15.join(process2.cwd(), economy.DEFAULT_AUDIT_DIR),
       maxAgeDays: 14
     });
   } catch (err) {
@@ -4847,7 +4984,7 @@ function _run_repair(opts) {
     };
     if (exists2) {
       try {
-        fs9.unlinkSync(state_pth);
+        fs11.unlinkSync(state_pth);
       } catch (exc) {
         payload["action"] = "error";
         payload["error"] = osErrorStr(exc);
@@ -4951,17 +5088,17 @@ function _isCliEntry2() {
     return false;
   }
   if (cliDelegate) {
-    if (path13.basename(process2.argv[1], ".js") === "cmd_doctor") {
+    if (path15.basename(process2.argv[1], ".js") === "cmd_doctor") {
       return true;
     }
   }
-  const argvUrl = pathToFileURL4(path13.resolve(process2.argv[1])).href;
+  const argvUrl = pathToFileURL4(path15.resolve(process2.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs9.realpathSync(fileURLToPath5(import.meta.url));
-    const argv = fs9.realpathSync(path13.resolve(process2.argv[1]));
+    const here = fs11.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs11.realpathSync(path15.resolve(process2.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -4985,6 +5122,8 @@ export {
   proseEqual,
   frontmatterPaths,
   censusRuleDir,
+  INSTALL_MODE_MARKER_RELATIVE,
+  _is_global_only_consumer,
   ArgparseExit,
   _jsonDumpsIndentAscii,
   NO_FRONTMATTER,
@@ -5002,8 +5141,6 @@ export {
   CHECK_IDS,
   GLOBAL_CHECK_IDS,
   MANIFEST_REQUIRED_CHECK_IDS,
-  INSTALL_MODE_MARKER_RELATIVE,
-  _is_global_only_consumer,
   REPAIR_IDS,
   MCP_BETA_GATES,
   STATUS_SYMBOLS,