@event4u/agent-config 16.0.0 → 16.1.0

package/dist/server/schemas/settings.js

@@ -34,6 +34,8 @@ const leanProjectionHost = z.enum(['claude-code', 'cursor', 'cline']);
 const projectionMode = z.enum(['legacy-all', 'scoped']);
 const memoryCadence = z.enum(['auto', 'always', 'never']);
 const projectAudience = z.enum(['self', 'internal', 'client', 'public']);
+const deliveryMerge = z.enum(['off', 'on-green']);
+const prTopology = z.enum(['single', 'stacked']);
 export const settingsSchema = z.object({
     agent_config_version: z.string().default('').describe('Pin the package to an exact semver (e.g. "1.4.2") so all teammates load the same skill / rule set. Leave empty to track whatever is installed locally — useful for the maintainers of this package, risky for production projects.'),
     profile: z.object({
@@ -47,7 +49,7 @@ export const settingsSchema = z.object({
     rule_loading_tier: ruleLoadingTier.default('balanced').describe('Master switch for which rule tiers load and how cautiously the agent spends tokens. minimal = only the 9 kernel rules (cheapest, fewest guardrails). balanced = kernel + tier-1 (recommended default). full = kernel + tier-1 + tier-2 (most guardrails, highest token cost). custom = roll your own in agents/overrides/. LEGACY: superseded by discipline_profile — when that key is set it wins (mapping: minimal→off, balanced→essential, full→full).'),
     discipline_profile: disciplineProfile.optional().describe('The ONE runtime knob for the discipline-rule tier (successor of rule_loading_tier; council 2026-07-07). off = kernel only (~1x tokens). essential = kernel + the measured lift-carrying rules (~3.3x, keeps the weak-host discipline lift). full = everything (~11.7x, EXPERIMENTAL — residual lift over essential not established). auto = resolve per session against the evidence-gated NULL-lift disable-list in src/config/host-capabilities.yml (measured-null host → off, otherwise → essential). Optional and opt-in until the P1/P2 evidence gates pass (agents/roadmaps/road-to-discipline-profile-tiering.md); absent = legacy rule_loading_tier applies.'),
     lean_projection: z.object({
-        mode: leanProjectionMode.default('eager-all').describe('How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267, and the activation charge for it is paid in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384).'),
+        mode: leanProjectionMode.default('eager-all').describe('How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session, exact-BPE — a different unit from the chars/4 figures below, never compare the two directly), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267. SAVING AND CHARGE, MEASURED TOGETHER so neither is published alone (2026-09-12, `check_preamble_payload_budget`): the rule bucket falls 122,769 -> 24,537 chars/4 tok per session on a thinned host (-80.0%), and a trigger match costs p50 6,728 B / p90 14,016 B / max 16,297 B per fire over 318 gate-open fires of the frozen tests/eval/routing-matrix corpus at the concern\'s 16,384 B cap. Bytes per fire and tokens per session are different denominators and are never summed; re-read both rather than quoting this line. The ceiling for that charge is registered in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384).'),
         hosts: z.array(leanProjectionHost).default(['claude-code']).describe('Which hosts a thinning mode may thin (ADR-267). Absent resolves to [claude-code]. '
             + 'Only the three hosts with a per-rule rule tree are accepted, and this enum is the '
             + 'AUTHORING layer: an id outside it is a hard validation FAILURE here and under '
@@ -94,6 +96,11 @@ export const settingsSchema = z.object({
     github: z.object({
         pr_reply_method: replyMethod.default('create_review_comment').describe('How the agent replies to PR review comments. create_review_comment = post a new review comment (works on every GitHub plan). replies_endpoint = thread the reply under the original comment (needs the newer REST endpoint). auto = detect at runtime, prefer threaded replies when available.'),
     }),
+    delivery: z.object({
+        merge: deliveryMerge.default('off').describe('Whether a run may merge the pull request it produced. off (default) = the run ends at mergeable-green-and-open and says so. on-green = merge is permitted, and only when an object-bound grant covering {op: prod_merge, target: <base>} exists and the final head is required-check-green, target-current and tamper-checked. This key is a precondition, never the authorisation by itself; forge auto-merge is the mechanism, so branch protection stays the gate.'),
+        wait_for_ci: z.boolean().default(true).describe('Whether the run stays alive until the required checks settle. true (default) = the run drives CI and reports the settled verdict. false = the run ends once the branch is pushed and the PR is open, leaving the checks to be read later. Independent of merge: a run may wait for CI without being allowed to merge.'),
+        pr_topology: prTopology.default('single').describe('How a mission\'s work is shaped into pull requests. single (default) = one branch, one pull request. stacked = a dependent series. stacked is never chosen by the agent and never asked about at roadmap creation — the owner plans it or it does not happen.'),
+    }),
     augment: z.object({
         rules_use_symlinks: z.boolean().default(false).describe('When true, .augment/rules/*.md are symlinks into dist/agent-src/rules/ — edits flow back to source on save. When false (default), they are copies — safer on Windows and shared volumes, but rule edits in .augment/ are lost on the next `task sync`.'),
     }),
@@ -115,7 +122,7 @@ export const settingsSchema = z.object({
     }),
     roadmap: z.object({
         skip_pre_run_gate: z.boolean().default(true).describe('Skip the /roadmap:process-* pre-run confirmation gate. true (default) starts processing immediately and surfaces the resolved config inline; false shows the numbered-options gate and waits. A genuine "which roadmap?" ambiguity always prompts regardless.'),
-        quality_cadence: qualityCadence.default('end_of_roadmap').describe('When the agent runs the full quality / test suite during /roadmap:process-* runs. end_of_roadmap = once, after the last step (fastest, default). per_phase = after each phase boundary. per_step = after every single step (slowest, highest confidence).'),
+        quality_cadence: qualityCadence.default('per_phase').describe('When the agent runs the full quality / test suite during /roadmap:process-* runs. per_phase = after each phase boundary (default since 2026-09-13 — end_of_roadmap lets errors compound across phases, which is expensive in a multi-phase autonomous run nobody is watching). end_of_roadmap = once, after the last step (fastest). per_step = after every single step (slowest, highest confidence).'),
         dashboard_regen_cadence: regenCadence.default('every_5_steps').describe('How often the agent regenerates agents/roadmaps/dashboard.md during a roadmap run. every_5_steps = batch the regen (default). per_step = after every step (freshest dashboard, highest subprocess overhead). phase_boundary = only at phase edges. A rename, phase add, or archive always regenerates immediately regardless.'),
         horizon_weeks: z.number().int().min(0).default(0).describe('Optional planning horizon (weeks) the agent shows in roadmap framing ("next 4 weeks"). Set 0 to omit the horizon — most teams prefer to ship without a hardcoded window.'),
         gate_budget: z.object({
@@ -124,7 +131,7 @@ export const settingsSchema = z.object({
         }).default({ max_cost_per_run_usd: 5, max_cost_per_rolling_7d_usd: 25 }),
     }),
     planning: z.object({
-        challenge_on_create: z.boolean().default(true).describe('Gate C — plan-confidence gate before authoring. true (default) = a plan-artifact ask (/roadmap:create, roadmap-writing, /feature:plan, /feature:roadmap) first checks the four 95%-confidence conditions from /challenge-me vision; any gap routes into the interview (or the inline degrade protocol) before authoring, and a confident pass emits exactly one marker line. false = inert, plan asks author directly. An explicit user bypass always wins for that turn and is counted.'),
+        closure_pass: z.boolean().default(true).describe('Gate C — plan-closure pass. true (default) = a plan-artifact ask (/roadmap:create, roadmap-writing, /feature:plan, /feature:roadmap, /roadmap:materialize, /implement-ticket, /jira-ticket, /analyze:inbox, /analyze:roadmap-repos) ends in a closure pass (/challenge-me closure): every foreseeable decision is closed at the lowest rung that owns it and written into the roadmap\'s "## Decisions" table, so a long run never meets a question planning could have closed. false = inert, plan asks author directly. An explicit user bypass always wins for that turn and is counted as a bypass rather than as an absent closure.'),
         risk_review: z.boolean().default(true).describe('Gate R1 — plan-risk review. true (default) = every ready (non-draft) plan must carry a schema-valid "## Risk Register" section (ranked risks, mitigation + anchor per row, freshness marker, exact honest-null grammar), enforced by lint_plan_risk_register at pre-push + CI. false = escape hatch, the validator skips.'),
         completion_review: z.boolean().default(true).describe('Gate R2 — completion review at 100% roadmap completion / pre-PR. true (default) = a findings-before-fixes review by a fresh reviewer context must exist for the current diff hash (or an exact honest-null / skip declaration) before fix commits and PR creation, enforced by check_completion_review at pre-push + CI (CI authoritative; a crashed validator warns and allows). false = escape hatch, the validator skips.'),
     })
@@ -135,8 +142,13 @@ export const settingsSchema = z.object({
         // test whose fixture predates the section. With the default, an absent
         // section materialises as the three `true` leaves the contract promises.
         .default({}),
+    execution: z.object({
+        fix_loop_max: z.number().int().min(1).default(10).describe('Consecutive failed fix attempts against one validation target before the escalation ladder reaches its terminal rung. Reaching the bound triggers a strategy change, never a question. Overridable globally, per project and per prompt.'),
+        escalation: z.array(z.string()).default(['independent', 'council', 'team', 'owner_owned_check']).describe('The escalation rungs, in order, walked when the fix-loop bound is reached: independent (another session or a provider-diverse reviewer), council, team, then owner_owned_check — which asks whether the residue is owner-owned, not whether to ask the owner now.'),
+    }).default({}),
     quality: z.object({
-        local_auto_run: z.boolean().default(false).describe('Run quality tools (linters, type-checks, formatters) and the local test suite autonomously after edits. Off by default — the agent never runs quality tools proactively and does not ask; the user runs them manually (e.g. /quality-fix) and remote CI is the authoritative gate. The agent only runs a quality tool on an explicit ask, a concrete CI failure, or the new-gate carve-out. Turn on to restore autonomous pipeline runs.'),
+        local_auto_run: z.boolean().default(false).describe('Run quality tools (linters, type-checks, formatters) and the local test suite autonomously after edits, IN CHAT. Off by default — in a chat turn a human is present and remote CI is the authoritative gate, so a local full-pipeline run duplicates it at wall-clock cost. The agent only runs a quality tool on an explicit ask, a concrete CI failure, or the new-gate carve-out. A mission is governed by local_auto_run_in_mission instead.'),
+        local_auto_run_in_mission: z.boolean().default(true).describe('Run quality tools autonomously inside a mission — an autonomous roadmap run with a claimed contract. On by default: nobody is waiting, the next action belongs to the agent itself, and a red found twenty steps later costs more than the run that would have caught it at step one. Inert outside a mission, and a mission never lowers local_auto_run: true.'),
     }),
     design: z.object({
         fidelity_mode: fidelityMode.default('strict').describe('How strictly the agent must follow a user-provided prototype / mockup / design system (consumed by the design-fidelity rule). strict = build 1:1, every visible deviation needs confirmation; structural = structure locked, silent gaps fillable with a stated assumption; hard-floor = any deviation is never autonomous.'),
@@ -291,7 +303,7 @@ export const settingsSchema = z.object({
             enabled: z.boolean().default(false).describe('Runtime event journal (road-to-runtime-event-journal Phase 1). Default off. When on, one durable, episode-keyed record per dispatched hook event is appended to <git-common-dir>/agent-journal/journal.sqlite — a Class-A write that opens, writes and exits. It emits nothing to the model, never warns and never blocks: a locked database, a missing node:sqlite, a malformed envelope or a full disk all degrade to silence. Off rather than on because it CREATES a storage surface (a SQLite database under your .git/) rather than appending to a directory that already exists. The record type has no field able to hold free-form content — ids, an event name, a bounded capability identifier, repo-relative locators and two 12-hex digests; no prompt, no file body, no absolute path. Retention: a 30-day TTL anchored on episode close, plus explicit, time-bounded, human-only holds that themselves expire.'),
         }).default({}),
         rtk_wrap: z.object({
-            enabled: z.boolean().default(false).describe('PreToolUse RTK-wrap nudge (token-saving Phase 3). Default off. When on AND the binary on PATH is verified as Rust Token Killer (a live two-stage identity probe — not a self-reported flag, and never a colliding same-name binary), warns (never blocks) "re-run wrapped with rtk" before a single verbose CLI command (git/npm/cargo/docker/…) — upstream reports 60–90% output-token savings (their estimate). Skips completeness-critical / piped / compound commands and git diff. No-op when rtk is absent, unverified, or a different tool.'),
+            enabled: z.boolean().default(false).describe('PreToolUse RTK-wrap nudge (token-saving Phase 3). Default off. When on AND the binary on PATH is verified as Rust Token Killer (a live two-stage identity probe — not a self-reported flag, and never a colliding same-name binary), warns (never blocks) "re-run wrapped with rtk" before a single verbose CLI command (git/npm/cargo/docker/…) — upstream reports 60–90% output-token savings (their estimate). Skips completeness-critical / piped / compound commands and git diff. No-op when rtk is absent, unverified, or a different tool. Its own activation charge is one advisory line under the 1,024 B default concern cap in src/config/hook-token-budget.json; the per-fire distribution is UNMEASURED — stated rather than estimated, because the saving above is a third-party output-token claim and not a standing-payload reduction this package measured.'),
         }).default({}),
         design_slop: z.object({
             enabled: z.boolean().default(false).describe('PreToolUse anti-slop nudge (road-to-anti-slop-detector Phase 3). Default off. When on, runs the lint_design_slop registry against about-to-be-written UI content and WARNS (never blocks) on P0/P1 aesthetic tells (side-stripe, gradient-text, magic z-index, …). Flags are rebuttable via DESIGN.md / design-slop-disable. Anti-loop: a file::rule signature surfaced 3x goes silent. Host-limited convenience layer; the universal gate is the lint_design_slop linter/CI.'),

package/dist/shared/missionExecution.js

@@ -0,0 +1,97 @@
+/**
+ * Mission execution posture — the loop bound, its escalation ladder, and the
+ * one setting whose value differs inside a mission.
+ *
+ * `road-to-adversarial-verification-and-long-runs` Phase 0. Three facts that
+ * were previously either absent or stated only in prose get one module, because
+ * all three are read by more than one surface (`doctor --json`, `settings:get`,
+ * the recovery ladder) and a constant restated per reader is the standard way a
+ * default drifts.
+ *
+ * **Why a mission changes `quality.local_auto_run` and nothing else does.** The
+ * template's own justification for shipping `false` is that remote CI is the
+ * authoritative gate and a local full-pipeline run duplicates it at wall-clock
+ * cost. That argument is about a CHAT turn, where the human is present, the next
+ * action is theirs, and the pipeline's result arrives long after the reply. It is
+ * not an argument about an autonomous mission, where nobody is waiting, the next
+ * action is the agent's own, and a red found after twenty more steps costs more
+ * than the pipeline run that would have found it at step one. The roadmap
+ * template already says as much about the sibling cadence knob — that
+ * `end_of_roadmap` lets errors compound across phases — so the two knobs are
+ * corrected together rather than one at a time.
+ *
+ * The resolution is deliberately NOT a settings-layer precedence trick. A layer
+ * is a place a human wrote a value; a mission is a runtime condition. Folding
+ * the condition into the layer stack would make `settings:get` report a source
+ * file for a value no file contains.
+ */
+/** The escalation rungs, in the order the recovery ladder walks them. */
+export const ESCALATION_LADDER = [
+    'independent',
+    'council',
+    'team',
+    'owner_owned_check',
+];
+/** Default bound on consecutive failed fix attempts against one target. */
+export const FIX_LOOP_MAX_DEFAULT = 10;
+/** Default for `quality.local_auto_run_in_mission`. */
+export const MISSION_AUTO_RUN_DEFAULT = true;
+/**
+ * Resolve `quality.local_auto_run` for the current run.
+ *
+ * Outside a mission the configured value wins unchanged — that is the whole
+ * point of leaving chat alone. Inside one, `local_auto_run_in_mission` decides.
+ *
+ * One asymmetry is deliberate: a mission never LOWERS the configured value. An
+ * operator who set `local_auto_run: true` asked for pipeline runs everywhere,
+ * and a mission is not a reason to give them fewer.
+ */
+export function resolveLocalAutoRun(inputs) {
+    if (inputs.configured)
+        return { value: true, origin: 'settings' };
+    if (!inputs.inMission)
+        return { value: false, origin: 'settings' };
+    const mission = inputs.missionValue ?? MISSION_AUTO_RUN_DEFAULT;
+    return mission ? { value: true, origin: 'mission' } : { value: false, origin: 'settings' };
+}
+/**
+ * Fold `execution.*` out of a settings-override stream, last layer wins.
+ *
+ * Takes the same `[dotted, value, file]` tuples `iter_setting_overrides` emits,
+ * so a caller never re-implements the cascade. Keys outside the `execution.`
+ * prefix are ignored rather than collected: this is a narrow reader, and a
+ * reader that accidentally carries the whole settings tree is how a doctor
+ * payload grows a field nobody declared.
+ */
+export function executionPostureFromOverrides(layers) {
+    const raw = {};
+    for (const [key, value] of layers) {
+        if (key === 'execution.fix_loop_max')
+            raw['fix_loop_max'] = value;
+        else if (key === 'execution.escalation')
+            raw['escalation'] = value;
+    }
+    return resolveExecutionPosture(raw);
+}
+/**
+ * The `execution:` block as a reader should see it, defaults filled in.
+ *
+ * A non-integer, non-positive or absent `fix_loop_max` falls back to the default
+ * rather than propagating: a bound of `0` would make every first attempt
+ * terminal, which is a configuration that can only be a mistake.
+ */
+export function resolveExecutionPosture(raw) {
+    const block = (raw ?? {});
+    const rawMax = block['fix_loop_max'];
+    const max = typeof rawMax === 'number' && Number.isInteger(rawMax) && rawMax > 0
+        ? rawMax
+        : FIX_LOOP_MAX_DEFAULT;
+    const rawLadder = block['escalation'];
+    const ladder = Array.isArray(rawLadder) &&
+        rawLadder.length > 0 &&
+        rawLadder.every((r) => typeof r === 'string')
+        ? rawLadder
+        : ESCALATION_LADDER;
+    return { fix_loop_max: max, escalation: ladder };
+}
+//# sourceMappingURL=missionExecution.js.map