@event4u/agent-config 16.0.0 → 16.1.0

package/dist/agent-src/guidelines/design-fidelity-routing.md

@@ -13,6 +13,35 @@ Migrated out of `design-fidelity.md` on 2026-09-09 under the council verdict on
 the operative pointers the same verdict requires, not an arbitrary line cut. The
 rule keeps the obligations; this holds the reasoning behind them.
 
+### The matcher, and why each shipped class is shaped that way
+
+Migrated out of `design-fidelity.md` on 2026-09-18 under
+`road-to-design-fidelity-proof` Phase 1.1 — the rule keeps the operative class
+list, this holds the argument behind each one.
+
+Matching is plain lower-cased substring containment on the prompt, plus fnmatch
+over the open files. Three handover classes must reach this rule: an English
+phrasing, a German one, and a prompt carrying **no** keyword at all because the
+artifact is simply attached. The last is covered by two file patterns:
+`*design.html`, the conventional handover filename, and `*.dc.html`, the Claude
+Design canvas artboard — which `*design.html` cannot match, because it compiles
+to `^(?:.*design\.html)$` and `ToDo.dc.html` does not end in `design.html`.
+Neither is `*.html`, which would fire on every HTML edit in every project and be
+strictly worse than the gap it closes; `near-plain-html-open-file` pins that
+form silent. A handover under some other filename needs one word in the prompt.
+
+Two further handover shapes carry the artifact without any of the above:
+
+- **A capability URL.** A published artifact is handed over as a link, not a
+  file — so `phrase: "claude.site/artifacts"` fires on the *published-artifact
+  path*, not on the host. `claude.ai` alone is a chat link and must stay quiet:
+  a keyword on the bare domain would fire on "I pasted this from claude.ai",
+  which is a conversation reference, not a spec.
+- **A design-system directory.** `path_prefix: ".claude/design-system/"` — the
+  conventional location for a handed-over token/component set. The prefix is the
+  vendor-scoped directory, never a bare `design-system/`, which is a normal
+  source folder in a large fraction of frontend repos.
+
 ### The withdrawn builder-URL trigger
 
 A page built in Lovable / v0 / bolt and handed over as a share link is a

package/dist/agent-src/rules/autonomous-execution.md

@@ -47,18 +47,25 @@ Litmus: does the directive name a single concrete deliverable? Yes → task-scop
 
 A new instruction from the user mid-flight is **not** a continuation — see [`user-interrupt-priority`](user-interrupt-priority.md) for the mandatory STOP → run new task → ASK before resume protocol. Autonomy never authorizes silent-resume of the prior task.
 
-## Validation-loop budget — hard cap N=3 per target
+## Validation-loop budget — `execution.fix_loop_max`, default 10, and a ladder
 
 **Validation target** = a single identifiable artefact (file path, lint rule ID, test name, CI sub-task name) — natural-language clusters ("the linter stuff") don't count.
 
 ```
-3 CONSECUTIVE FAILED ATTEMPTS ON THE SAME VALIDATION TARGET → STOP.
-SURFACE THE 3 ATTEMPTS + BLOCKING ISSUE. ASK USER FOR GUIDANCE.
-DO NOT ITERATE BEYOND N=3 WITHOUT EXPLICIT USER APPROVAL.
-COUNTER RESETS ONLY ON A DIFFERENT TARGET OR USER-APPROVED CONTINUATION.
+THE BOUND TRIGGERS A STRATEGY CHANGE, NEVER A QUESTION.
+ATTEMPTS 1-3 — ROOT-CAUSE PLUS A TARGETED FIX.
+ATTEMPTS 4-6 — A MANDATORY STRATEGY SHIFT. REPEATING THE APPROACH IS NOT AN ATTEMPT,
+IT IS THE SAME ATTEMPT AGAIN.
+ATTEMPTS 7-10 — ESCALATE INDEPENDENTLY: A SECOND SESSION, A PROVIDER-DIVERSE
+REVIEWER, THE COUNCIL, THE TEAM, OR A ROLLBACK OF THE SLICE.
+AT THE BOUND, IN ORDER: A NEW STRATEGY FROM THE ESCALATION → A NEW EPOCH ·
+AN INDEPENDENT PHASE AVAILABLE → CONTINUE IT · THE RESIDUE OWNER-OWNED →
+ONE NATIVE ASK · AN EXTERNAL PREREQUISITE OBJECTIVELY MISSING → `BLOCKED`
+WITH EVIDENCE · OTHERWISE → A NEW EPOCH.
+NO RUNG MAPS A COUNT TO AN OWNER ASK. A COUNT IS NOT A REASON TO ASK.
 ```
 
-Failed attempt = an iteration that did not move the target red → green; tuning the tool around the target counts as an attempt.
+Failed attempt = an iteration that did not move the target red → green; tuning the tool around the target counts as one. The bound is `execution.fix_loop_max` (default 10, overridable globally, per project and per prompt). Council and team verdicts append to the run's `## Decisions`. Bands, the five bound outcomes and how to read a red: [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
 ### Antipattern — allowlist-growth as silent budget bypass
 
@@ -67,9 +74,9 @@ ALLOWLIST > 20 ENTRIES IN ONE SESSION = THE LINTER IS WRONG.
 STOP. PROPOSE LINTER REDESIGN OR REMOVAL. DO NOT EXPAND THE ALLOWLIST FURTHER.
 ```
 
-Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Enforced at tool-call time by the `block-config-weakening` PreToolUse guard (`src/scripts/hooks/block_config_weakening.ts`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**: it counts allowlist entries added per session, warns from 5, and blocks past 20. It is *bound* on augment and cowork as well, and ignored there — `host_semantics.ts` verifies claude alone, and both trampolines discard dispatcher output and `exit 0` unconditionally. Everywhere else the cap is model-carried and "enforced at tool-call time" is not a claim this rule can make. **Corrected 2026-08-17 in both directions:** this sentence used to certify augment, claude and cowork as the enforcing set (an over-claim of two hosts) and to explain the rest with "the guard has nowhere to bind" (false for cursor, cline and gemini, whose native pre-tool events `native_event_aliases` already maps onto `pre_tool_use` — unbound, not unbindable; only windsurf and copilot have no alias row). The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md). Run `agent-config hooks:status` to see which slots are bound on the host you are actually on — the sibling rules `git-history-discipline` and `evaluator-independence` qualify the identical slot, and an unqualified claim here would read as a guarantee the manifest does not give. Baselines and budget thresholds warn only — a rising count there may be a legitimate ratchet reset, which the edit alone cannot distinguish. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
+Crossing 20 entries spends the whole fix-loop bound for that target at once — fix the tool shape, not the list. Carried by the `block-config-weakening` PreToolUse guard, which blocks **on `claude` only** and is model-carried everywhere else; run `agent-config hooks:status` for the host you are on. Verify with the narrowest tool that proves the target green — a `curl` or Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through — never a meta-pipeline as per-iteration probe. Host reach, failed-attempt detail, suppression-sweep equivalents and adaptive effort (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
-Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, N=3 mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
+Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, fix-loop bound and epoch mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also

package/dist/agent-src/rules/delegation-policy.md

@@ -64,68 +64,46 @@ primitive → run in-session (clean no-op).
 
 1. **Decompose** the task into independent / ordered slices.
 2. **Tier-size** each slice (`lite|medium|high`) per the classification context —
-   never the orchestrator's own session tier (the cost win is the per-call
-   downsize; see [`subagent-routing`](../contexts/execution/subagent-routing.md)).
-   Where `subagents.model_ceiling` caps the tier and the slice does not fit under
-   it, the worker **escalates and never silently delivers the degraded result**;
-   the orchestrator re-slices, runs in-session, or surfaces the ceiling to the
-   human, and never raises the ceiling itself (class C — `settings:set` refuses
-   it by construction). Absent is *uncapped*, never a low cap. Full contract:
+   never the orchestrator's own session tier
+   ([`subagent-routing`](../contexts/execution/subagent-routing.md)). Where
+   `subagents.model_ceiling` caps the tier and the slice does not fit, the worker
+   **escalates and never silently delivers the degraded result**; the
+   orchestrator never raises the ceiling itself, and absent is *uncapped*.
    [`subagent-boundary § The model ceiling`](../docs/contracts/subagent-boundary.md).
 3. **Dispatch** via the form gate + matching `subagent-orchestration` mode
    (independent → do-in-parallel; ordered → do-in-steps; risk/correctness →
    + judge; UI-heavy → live-app judge, efficacy-gated).
 4. **Verify** every return per
    [`verify-budget`](../contexts/execution/verify-budget.md); the cross-model
-   judge Iron Law and the N=3 budget ([`autonomous-execution`](autonomous-execution.md))
+   judge Iron Law and the fix-loop bound ([`autonomous-execution`](autonomous-execution.md))
    are never lifted.
 5. **Respect the failure-type stop and the ordering gate** — two consecutive
    verification-failed returns from one subagent type stop that type for the
-   session (an application of the N=3 budget, no new mechanism), and an
+   session (an application of the fix-loop bound, no new mechanism), and an
    ordered slice never dispatches before its declared parent's return is
    verified. Both per
    [`subagent-steering`](../contexts/execution/subagent-steering.md).
-6. **Record** telemetry after each dispatch — on hook-capable hosts the
-   `orchestration-record` concern (`post_tool_use`) emits the line
-   deterministically for every Agent/Task completion; on hosts without the
-   slot, run `orchestration_record` yourself (one validated line: spawn_count,
-   token_delta + provenance, tier, task_class) per
-   [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
-   § Emit. Measured before the hook existed: 1 of 370 dispatches captured —
-   the model-carried path alone leaves the value question unmeasured.
+6. **Record** telemetry after each dispatch — the `orchestration-record` concern
+   emits it on hook-capable hosts; elsewhere run `orchestration_record` yourself
+   per [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
+   § Emit. Measured before the hook existed: 1 of 370 dispatches captured.
 
 ## Carriers — how this rule reaches a session (and what stays model-carried)
 
-No host runs the tier-2 rule router, so this file's triggers alone never load
-it. The obligation travels on three carriers instead: the always-loaded
-AGENTS.md line (delegate-by-default + end-review), the `delegation-nudge`
-concern on `user_prompt_submit` (runs `classifyTask` on cheap prompt signals
-and injects a one-line verdict ONLY when the classifier says
-`do-in-parallel`/`do-in-steps` — silence otherwise; delivery on
-`user_prompt_submit` is end-to-end verified), and the `end-review-nudge`
-concern on `stop` (ONE `review_skipped` telemetry line per mutating
-no-review session — verified; its advisory line reaches the dispatcher
-output, but host-side forwarding of stop-slot context to the model is
-unverified, so the model-facing end-review carrier is the AGENTS.md line
-plus this telemetry). The
-capability gate itself resolves from the committed host registry merged with a
-live environment probe in `src/scripts/_lib/host_capability.ts`
-(`probeHostCapabilities` — capability is a fact about the host, never a
-settings override).
+No host runs the tier-2 rule router, so this file's triggers alone never load it.
+The obligation travels on three carriers instead: the always-loaded AGENTS.md
+line, the `delegation-nudge` concern on `user_prompt_submit`, and the
+`end-review-nudge` concern on `stop`. Capability resolves from the committed host
+registry merged with a live probe — never from a settings override.
 
 **Never read a `false` capability as a host limitation without checking where it
-came from.** The registry holds one row, so on every other host all six fields
-are the all-false safe default — which records that *nobody answered*, not that
-the host cannot spawn. `agent-config routing:doctor [--platform <host>]` prints
-the value **and** its provenance per field (`registry` = a committed observation
-this repo made once · `live-probe` = established in this process · `default` =
-no answer). Run it before concluding delegation is unavailable here; the
-same-shaped wrong guess about the council is the incident
-[`council-availability`](council-availability.md) exists for. What stays
-model-carried, honestly: the decomposition itself, the per-return
-verification, and every dispatch on hosts without hook slots. The nudges are
-advisory by design — whether they change behaviour is measured by the
-telemetry, not assumed.
+came from.** The registry holds one row, so on every other host the fields are the
+all-false safe default, which records that *nobody answered*. Run `agent-config
+routing:doctor [--platform <host>]`, which prints the value **and** its
+provenance, before concluding delegation is unavailable here. What stays
+model-carried: the decomposition, the per-return verification, and every dispatch
+on hosts without hook slots. Per-carrier detail and what each one verifies:
+[`auto-orchestration-activation § Carriers`](../contexts/execution/auto-orchestration-activation.md).
 
 ## Scope — does NOT
 

package/dist/agent-src/rules/design-fidelity.md

@@ -37,6 +37,8 @@ workspaces: [engineering]
 packs: [engineering-base, frontend-design]
 collision_ok:
   "mockup": "a provided mockup is the spec — 1:1 fidelity floor"
+enforced_by:
+  - "instruction-only: no artifact in this tree records a fidelity comparison. lint_design_slop and lint_design_quality measure generic AI-aesthetic tells and accessibility; neither reads the handover, so a 1:1 claim is model-carried"
 # obligation: line 58
 obligation_frequency: "per-edit"
 ---
@@ -68,6 +70,10 @@ THE IMAGE IS THE SPEC AND THE 1:1 FLOOR ABOVE APPLIES TO IT UNCHANGED.
 WHERE THE ARTIFACT'S OWN MARKUP / CSS / JS IS STACK-COMPATIBLE, ADAPTING
 THAT CODE IS THE DEFAULT — A FROM-SCRATCH RE-DERIVATION IS A DEVIATION
 AND NEEDS THE SAME CONFIRMATION AS A SWAPPED CONTROL.
+A 1:1 CLAIM IS DISCHARGED BY A COMMITTED ARTIFACT NAMING, PER HANDOVER
+CHAPTER, THE EVIDENCE TAKEN — NEVER BY A BEHAVIOR TEST, AND NEVER BY A
+SENTENCE IN A REPLY. A GREEN SUITE THAT MEASURED BEHAVIOR ANSWERS A
+QUESTION FIDELITY DID NOT ASK.
 ```
 
 The qualifier is load-bearing, not hedging. Unqualified, the screenshot line
@@ -140,51 +146,40 @@ porting, or modifying UI to match it.
 
 ## Routing — an attached artifact is a trigger, an attached HTML file is not
 
-Matching is plain lower-cased substring containment on the prompt, plus fnmatch
-over the open files. Three handover classes must reach this rule: an English
-phrasing, a German one, and a prompt carrying **no** keyword at all because the
-artifact is simply attached. The last is covered by two file patterns:
-`*design.html`, the conventional handover filename, and `*.dc.html`, the Claude
-Design canvas artboard — which `*design.html` cannot match, because it compiles
-to `^(?:.*design\.html)$` and `ToDo.dc.html` does not end in `design.html`.
-Neither is `*.html`, which would fire on every HTML edit in every project and be
-strictly worse than the gap it closes; `near-plain-html-open-file` pins that
-form silent. A handover under some other filename needs one word in the prompt.
-
-Two further handover shapes carry the artifact without any of the above:
-
-- **A capability URL.** A published artifact is handed over as a link, not a
-  file — so `phrase: "claude.site/artifacts"` fires on the *published-artifact
-  path*, not on the host. `claude.ai` alone is a chat link and must stay quiet:
-  a keyword on the bare domain would fire on "I pasted this from claude.ai",
-  which is a conversation reference, not a spec.
-- **A design-system directory.** `path_prefix: ".claude/design-system/"` — the
-  conventional location for a handed-over token/component set. The prefix is the
-  vendor-scoped directory, never a bare `design-system/`, which is a normal
-  source folder in a large fraction of frontend repos.
-- **A third-party builder's share link — UNCOVERED, deliberately.** A page built
-  in Lovable / v0 / bolt and handed over as a link is a finished spec and this
-  rule does not route it; the trigger was tried and withdrawn as over-broad.
-  Until then the class needs one word in the prompt. Why, what closes it, and
-  the row that pins the broad form silent:
-  [`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
-
-Every class here carries its own near-miss row in `ROUTING_MATRIX`
-([`design_fidelity_routing.test.ts`](../../tests/scripts/design_fidelity_routing.test.ts));
-extending the set without one is how an over-broad trigger lands. Which row, and
-why: [`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
-
-**The near-miss must test the direction the new trigger opens, not a direction
-that was already closed** — apply this before writing a trigger, not after. The
-worked example and the review that produced the rule:
+Matching is lower-cased substring containment on the prompt plus fnmatch over
+the open files. Five classes reach this rule without a keyword being typed: the
+filename patterns `*design.html` and `*.dc.html`, the published-artifact path
+`claude.site/artifacts`, the directory prefix `.claude/design-system/`, and the
+English and German handover phrasings. A handover under any other filename, and
+a third-party builder's share link, need one word in the prompt — the
+builder-URL trigger was tried and **withdrawn** as over-broad, and stays pinned
+silent rather than merely absent.
+
+Every class carries its own near-miss row in `ROUTING_MATRIX`
+([`design_fidelity_routing.test.ts`](../../tests/scripts/design_fidelity_routing.test.ts)),
+and the row must test the direction the NEW trigger opens, not one that was
+already closed — apply that before writing a trigger, not after. Why each class
+is shaped as it is, why `*.html` and a bare builder host are refused, and the
+worked example behind the direction rule:
 [`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
 
 Body migrated to [`guideline:design-fidelity-mechanics`](../guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — URL / live-page handover (extraction into the `design-system.json` contract before the first UI write, the retrieval order, the lock boundary), surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
+## Honest enforcement — `instruction-only`
+
+Nothing records a fidelity comparison. The estate's two design linters measure
+generic AI-aesthetic tells (`lint_design_slop`) and accessibility
+(`lint_design_quality`); neither opens the handover, so nothing can tell a
+proven 1:1 from an asserted one. The proof clause in the Iron Law is therefore
+model-carried, and the committed matrix
+([`design-review`](../skills/design-review/SKILL.md) § Fidelity proof) is the
+control — a reviewer can open it, which is more than any gate here does.
+
 ## See also
 
 - [`brand-source-of-truth`](brand-source-of-truth.md) / [`brand-consistency`](brand-consistency.md) — same precedence shape, for registered brand tokens.
 - [`minimal-safe-diff`](minimal-safe-diff.md) — the code-diff analog (smallest change; no drive-by restructure).
 - [`existing-ui-audit`](../skills/existing-ui-audit/SKILL.md) / [`ui-audit-gate`](ui-audit-gate.md) — inventory existing components before adding new ones.
+- [`design-review`](../skills/design-review/SKILL.md) § Fidelity proof — the matrix that discharges the proof clause.
 - [`ask-when-uncertain`](ask-when-uncertain.md) — the one-question, numbered-option surfacing shape.

package/dist/agent-src/rules/evaluator-independence.md

@@ -52,19 +52,13 @@ A SECOND EVALUATION OF THE SAME WORK IN ONE TURN IS VERDICT SHOPPING, NOT RIGOUR
 
 ## The failure this exists to stop
 
-Measured, once, at maximum cost (conformance audit 2026-08-06):
-
-> The agent dispatched a "blind reviewer" over its own change. It wrote that
-> reviewer's prompt itself, put **"NO-FINDINGS is expected and welcome"** into it,
-> and narrowed the scope to four files it chose. The reviewer returned
-> NO-FINDINGS. That honest-null was committed as **binding gate evidence**. An
-> unsteered pass over the same delta later found 5 findings, one of them
-> critical, already live on the trunk.
-
-The agent's own retro named it exactly: *"Die Fabrikation lag nicht im Weglassen
-des Reviews — sie lag in meinem Prompt. Ich habe die Antwort vorgeladen und dann
-als Evidenz verbucht."* The review ran. The process was followed. The evidence
-was manufactured anyway.
+Measured once, at maximum cost: an agent wrote its own "blind reviewer" prompt,
+put *"NO-FINDINGS is expected and welcome"* into it, narrowed the scope to four
+files it chose, and committed the resulting honest-null as **binding gate
+evidence**. An unsteered pass over the same delta later found 5 findings, one
+critical, already live on the trunk. The review ran. The process was followed.
+The evidence was manufactured anyway. Full record:
+[`evaluator-independence-mechanics § The audited failure`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
 ## What this requires
 
@@ -81,10 +75,6 @@ was manufactured anyway.
 
 ## The softer form — stating an expectation without stating the verdict
 
-The Iron Law forbids **authoring the verdict** into an evaluator's prompt. There is a
-weaker move that evades it while doing the same work, and it is the one an orchestrator
-reaches for without noticing: **stating an expectation.**
-
 ```
 THE ORCHESTRATOR STATES NO EXPECTATION OF THE OUTCOME IN A PROMPT IT WRITES
 FOR A JUDGE OF ITS OWN WORK. NOT THE VERDICT, AND NOT THE DIRECTION.
@@ -92,25 +82,37 @@ FOR A JUDGE OF ITS OWN WORK. NOT THE VERDICT, AND NOT THE DIRECTION.
 "I EXPECT NO FINDINGS" — NONE OF THESE NAME A VERDICT, AND ALL OF THEM SUPPLY ONE.
 ```
 
-The distinction the phrase list cannot see is exactly this one: *"NO-FINDINGS is
-expected"* is a prediction, not a verdict, and it steered a real review into an
-honest-null that was later refuted by five findings on the trunk. A prompt that says what
-the author thinks the answer is has authored the answer, whatever grammatical mood it
-used.
+Write the scope, the diff and the question. Nothing about how it is expected to
+come out — including a reassurance that no outcome is expected, which is an
+expectation stated in the negative. Why the phrase list cannot see this:
+[`evaluator-independence-mechanics § The softer form`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
-**What to write instead:** the scope, the diff, and the question. Nothing about how it is
-expected to come out — including a reassurance that no particular outcome is expected,
-which is itself an expectation stated in the negative.
+## Tests are evaluators
+
+```
+A TEST IS AN EVALUATOR, AND AN IMPLEMENTER WHO WROTE IT HAS AUTHORED ITS VERDICT.
+THE ACCEPTANCE BEHAVIOUR IS NAMED, THE TEST IS WRITTEN INDEPENDENTLY, IT IS SHOWN
+RED, THEN IT IS IMPLEMENTED AGAINST, THEN AN INDEPENDENT INSTANCE VALIDATES GREEN.
+THE IMPLEMENTER NEVER SILENTLY WEAKENS AN ASSERTION, DELETES, SKIPS OR XFAILS A
+FAILING TEST, LOWERS A THRESHOLD, OR CHANGES FIXTURE SEMANTICS TO FIT THE CODE.
+WHERE THE TEST LOOKS WRONG: EVIDENCE → INDEPENDENT TEST REVIEW → COUNCIL OR TEAM
+→ CHANGE ONLY AFTER AN INDEPENDENT VERDICT. THE OWNER IS NOT THE ARBITER.
+```
+
+**Five levels:** L0 same agent — **fallback only** · L1 another session, same
+model · L2 another model · L3 another provider · L4 a multi-provider council or
+team. Critical behavior — security, authority, data loss, merge control — targets
+**L3 or L4 wherever two providers are configured**, read from `agent-config
+council:status`'s live provider count, never assumed. Levels, workflow, the
+weakening ladder and the validator's checklist:
+[`evaluator-independence-mechanics § Tests are evaluators`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
 ## When it does NOT fire
 
-- **Ordinary parallel fan-out.** Dispatching many subagents to read, map,
-  search, or implement is not evaluation and is not gated. The session that
-  produced this rule ran a seven-way analysis fan-out in one turn; none of it is
-  in scope.
+- **Ordinary parallel fan-out.** Dispatching subagents to read, map, search or
+  implement is not evaluation and is not gated.
 - A review **a human** commissioned or whose prompt a human wrote.
-- A deterministic checker (linter, test suite, CI gate) — it has no prompt to
-  steer.
+- A deterministic checker (linter, test suite, CI gate) — no prompt to steer.
 
 ## Enforcement — honest scope
 
@@ -119,26 +121,18 @@ ITEM 1 IS ENFORCED. ITEMS 2, 3 AND 4 ARE NOT — 4 ONLY WARNS.
 NEVER CITE A GUARD THAT WARNS AS ONE THAT BLOCKS.
 ```
 
-[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts) is a
-`pre_tool_use` concern reading the prompt the agent is about to send.
-
-- **Item 1 (pre-loaded verdict) BLOCKS** — `EXIT_BLOCK` at `:253`, on the one
-  host that honours a deny.
-- **Item 4 (second self-scoped evaluation) WARNS** — `EXIT_ALLOW` with
-  `decision: "warn"` (`:301-324`). The turn-budget clause is advisory.
-- **Item 2 (an honestly chosen scope) is enforced by nothing.** A narrowed scope
-  is not decidable from the prompt alone.
-- **Item 3 (recording the prompt with the verdict) IS enforced** by
-  [`check_review_prompt_binding.ts`](../../src/scripts/check_review_prompt_binding.ts),
-  with one limit that matters: **omission beats substitution** — not committing
-  the prompt package drops the round out of the checkable set with no finding.
+[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts), a
+`pre_tool_use` concern, BLOCKS item 1 on the one host that honours a deny and
+only WARNS on item 4. Item 2 is enforced by nothing — a narrowed scope is not
+decidable from a prompt. Item 3 is enforced by
+[`check_review_prompt_binding.ts`](../../src/scripts/check_review_prompt_binding.ts),
+where **omission beats substitution**: not committing the prompt package drops
+the round out of the checkable set with no finding.
 
 Where the guard does not deny, every item is model-carried. Never claim the
-review ran as if it were verified.
-
-Why each branch behaves that way, the phrase-list and turn-boundary limits, the
-four host states, the two corrections this section has taken, and the
-11-of-19 measurement behind item 3:
+review ran as if it were verified. Per-branch reasoning, the phrase-list and
+turn-boundary limits, the four host states and the 11-of-19 measurement behind
+item 3:
 [`evaluator-independence-mechanics`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
 ## See also

package/dist/agent-src/rules/test-first.md

@@ -0,0 +1,41 @@
+---
+type: "auto"
+tier: "1"
+description: "A behavior change gets a failing test first — and the test must fail for the intended reason before any implementation is written"
+triggers:
+  - keyword: "tdd"
+  - keyword: "test-first"
+  - keyword: "failing test"
+  - keyword: "regression test"
+  - keyword: "characterization test"
+routes_to:
+  - "skill:test-driven-development"
+enforced_by:
+  - "instruction-only: no gate sees which was written first; check_test_delta and check_test_weakening catch an absence, never an order."
+obligation_frequency: "per-edit"
+workspaces: [agent-config-maintainer, engineering]
+packs: [engineering-base]
+---
+
+# Test First
+
+```
+A BEHAVIOR CHANGE GETS A FAILING TEST FIRST, WHERE A TEST IS MEANINGFUL.
+A BUG GETS A REPRODUCING REGRESSION TEST FIRST.
+UNCERTAIN LEGACY GETS A CHARACTERIZATION TEST FIRST.
+THE TEST MUST FAIL FOR THE INTENDED REASON — A TEST NEVER SEEN RED HAS
+UNKNOWN SENSITIVITY AND IS NOT EVIDENCE. REFACTOR ONLY AFTER GREEN.
+```
+
+[`test-driven-development`](../skills/test-driven-development/SKILL.md) carries the
+procedure; this rule decides **when** it is owed: for consumer code, for this
+package's own code, scripts and hooks, **and for governance changes whose
+projection, routing or lint behavior is testable** — the clause a reader escapes
+with *the artifact is markdown, so there is nothing to test*. Markdown is not the
+discriminator: a rule whose triggers decide what loads, a projection a gate reads and a lint whose verdict flips are executable contracts in a prose extension.
+
+**Where there is genuinely no executable contract** — a paragraph stating a
+reason — the obligation is an independent *review*, never a fake test: an
+assertion over prose written to satisfy this rule manufactures the evidence it exists to require.
+
+**Does NOT fire on** a rename, typo, formatting or comment-only edit · a change the user fenced this turn · a spike deleted before it lands. **Honest enforcement — `instruction-only`.** No gate sees which was written first: `check_test_delta` and `check_test_weakening` catch an absence, never an order. Model-carried; the red-first discipline is the control.

package/dist/agent-src/skills/accessibility-auditor/data/manifest.json

@@ -28,7 +28,7 @@
   "refresh_cadence": "quarterly",
   "upstream": {
     "repo": "derived: W3C ARIA Authoring Practices Guide + WCAG 2.2",
-    "sha": "APG 2026 / WCAG 2.2",
-    "last_checked": "2026-06-07"
+    "sha": "APG 2026 / WCAG 2.2 (W3C Recommendation 12 Dec 2024) \u2014 verified not superseded 2026-09-18",
+    "last_checked": "2026-09-18"
   }
-}
+}

package/dist/agent-src/skills/ai-council/SKILL.md

@@ -271,9 +271,17 @@ Every council reply MUST contain, in this order:
    / `accept-with-modification` / `reject` / `needs-input` plus a
    one-line reason citing host evidence (file:line, ADR, contract).
    See *Critical evaluation* above.
-5. **User-facing options** — numbered block per `user-interaction`,
-   carrying the host verdict in each option, with "discard council
-   input" always present as an option.
+5. **User-facing options — CONDITIONAL, on ownership.** A conclusive
+   **technical** verdict emits **no** options block: it is a resolution,
+   and handing it over as options routes a technical decision to a person
+   because it was hard (ADR-268 § 10). The block is owed when the verdict
+   is owner-owned (`product-owned`, `business-owned`, `destructive-owned`)
+   or when the council did not converge — then it is a numbered block per
+   `user-interaction`, carrying the host verdict in each option, with
+   "discard council input" always present. Convergence is read from the
+   record, never inferred: a record that does not say whether its members
+   converged is itself the finding. Checkable in both directions with
+   `./scripts-run src/scripts/council_record_shape <record.md>`.
 
 The host agent NEVER ships council output as its own reasoning, and
 NEVER ships the host verdict as council output. Provider attribution

package/dist/agent-src/skills/api-design/data/manifest.json

@@ -28,7 +28,7 @@
   "refresh_cadence": "quarterly",
   "upstream": {
     "repo": "derived: RFC 9110/9457/7396/8288 + httpapi WG drafts",
-    "sha": "RFC set as of 2026-06",
-    "last_checked": "2026-06-07"
+    "sha": "RFC 9110 (STD 97) / 9457 / 7396 / 8288 \u2014 verified 2026-09-18: 9110 neither obsoleted nor updated; 9457 current and obsoletes 7807",
+    "last_checked": "2026-09-18"
   }
-}
+}

package/dist/agent-src/skills/database/data/manifest.json

@@ -28,8 +28,8 @@
   "owner": "package-maintainer",
   "refresh_cadence": "quarterly",
   "upstream": {
-    "repo": "derived: PostgreSQL 16 + MySQL 8 reference docs",
-    "sha": "PostgreSQL 16.x / MySQL 8.4 docs",
-    "last_checked": "2026-06-07"
+    "repo": "derived: PostgreSQL 18 + MySQL 9.7 reference docs (previously PostgreSQL 16 + MySQL 8)",
+    "sha": "re-derived 2026-09-27 against PostgreSQL 18.x / MySQL 9.7: all 12 rows of query-tuning.csv still apply as written on both engines. Three rows gained a version-scoped annotation for a genuinely new capability rather than a rewrite \u2014 row 1 (Slow WHERE on large table) notes PG18's B-tree skip scan, which relaxes the equality-first composite-index rule on PG18+ only; row 5 (JOIN explosion) notes MySQL 9.7's Hypergraph Optimizer, now GA in Community Edition, improving join-order choices automatically; row 12 (JSON column filtering) notes that PG18 flips the GENERATED-column default from STORED to VIRTUAL, and VIRTUAL columns are not indexable, so STORED must now be explicit. PostgreSQL 16.x and MySQL 8.4 remain supported and the patterns apply there unchanged",
+    "last_checked": "2026-09-18"
   }
-}
+}

package/dist/agent-src/skills/database/data/query-tuning.csv

@@ -1,13 +1,13 @@
 Symptom,Keywords,Root Cause,Strategy,Code Good,Anti-Pattern,Verification,Severity
-Slow WHERE on large table,slow query where filter full scan seq scan,Sequential scan despite selective predicate,B-tree index on the filtered column(s); composite index ordered by equality-first then range,"CREATE INDEX idx_orders_status_created ON orders (status, created_at)",Indexing low-cardinality boolean alone; composite ordered range-first,EXPLAIN (ANALYZE) shows Index Scan; rows estimate ≈ actual,HIGH
+Slow WHERE on large table,slow query where filter full scan seq scan,Sequential scan despite selective predicate,B-tree index on the filtered column(s); composite index ordered by equality-first then range (PostgreSQL 18+: skip scan lets the planner use later columns without a leading-column equality predicate — MySQL and pre-18 Postgres still need equality-first ordering),"CREATE INDEX idx_orders_status_created ON orders (status, created_at)",Indexing low-cardinality boolean alone; composite ordered range-first,EXPLAIN (ANALYZE) shows Index Scan (PG 18+: or Index Searches for a skip scan); rows estimate ≈ actual,HIGH
 ORDER BY ... LIMIT slow,order by limit sort top n latest,Sort node over the whole table for a top-N query,Index matching the ORDER BY direction (including DESC/NULLS) so LIMIT walks the index,CREATE INDEX idx_events_created_desc ON events (created_at DESC),OFFSET pagination for infinite feeds (use keyset),Plan shows Index Scan Backward / no Sort node,HIGH
 N+1 query loop,n+1 loop per row lazy load orm repeated query,Hundreds of identical queries differing only by id,Eager-load relations / batch with IN(...) or JOIN; dataloader pattern at the API layer,SELECT * FROM comments WHERE post_id IN (...),Fixing with a cache instead of the access pattern,Query count per request flat vs item count,HIGH
 LIKE '%term%' search,like contains search wildcard fulltext,Leading-wildcard LIKE can't use B-tree,Trigram index (pg_trgm GIN) or full-text search (tsvector + GIN); dedicated engine beyond ~10M rows,CREATE INDEX idx_users_name_trgm ON users USING gin (name gin_trgm_ops),Forcing LOWER() without an expression index,Plan shows Bitmap Index Scan on the GIN index,MEDIUM
-JOIN explosion,join many tables slow hash join nested loop,Mis-estimated join order / missing join keys index,Index every FK used in joins; verify row estimates; break monster joins into CTE/temp stages when estimates collapse,ANALYZE tables; index fk columns,Disabling nested loops globally; hint-chasing before stats are fresh,Estimates within ~10x of actuals at every join node,HIGH
+JOIN explosion,join many tables slow hash join nested loop,Mis-estimated join order / missing join keys index,Index every FK used in joins; verify row estimates; break monster joins into CTE/temp stages when estimates collapse (MySQL 9.7: the Hypergraph Optimizer is now GA in Community Edition and can materially improve join-order choices on its own — verify estimates before assuming a manual rewrite is still needed),ANALYZE tables; index fk columns,Disabling nested loops globally; hint-chasing before stats are fresh,Estimates within ~10x of actuals at every join node,HIGH
 Aggregation over millions of rows,group by count sum report aggregate slow,Repeated full-table aggregation for dashboards,Pre-aggregate: materialized view / rollup table refreshed on schedule or trigger; partial indexes for hot subsets,CREATE MATERIALIZED VIEW daily_rev AS ... REFRESH CONCURRENTLY,Caching in app memory only (cold-start storms),"Dashboard reads hit the rollup, not base tables",MEDIUM
 Pagination deep offset,offset page 10000 slow deep pagination,OFFSET N scans+discards N rows,Keyset/cursor pagination on a unique ordered key,"WHERE (created_at,id) < (:c,:i) ORDER BY created_at DESC,id DESC LIMIT 20",Hiding offset behind a 'page' param and capping at 1000 as a fix,p99 latency flat across page depth,HIGH
 Write contention / lock waits,deadlock lock wait contention update hot row,"Hot-row updates serialize (counters, balances)",Row-level design: ledger inserts over UPDATE-in-place; batch with SKIP LOCKED queues; keep transactions short,SELECT ... FOR UPDATE SKIP LOCKED for workers,Retrying deadlocks blindly without ordering writes,Lock wait time ~0 under load test; deadlock rate 0,HIGH
 Missing/stale statistics,wrong plan estimate stale statistics analyze,Optimizer estimates wildly off → bad plans,Auto-analyze tuned for big tables; manual ANALYZE after bulk loads; extended statistics for correlated columns,"CREATE STATISTICS s_dist (dependencies) ON city,country FROM addr",Hinting every query instead of fixing stats,Plan estimates ≈ actuals after ANALYZE,MEDIUM
 Over-indexing writes,insert slow many indexes write amplification,Each extra index taxes every INSERT/UPDATE,Audit with index-usage stats; drop unused; covering index to replace several near-duplicates,pg_stat_user_indexes idx_scan = 0 candidates,Adding an index per slow query without retiring old ones,Write p95 recovers; no unused-index rows,MEDIUM
 SELECT * over wide rows,select star wide row toast network payload,Fetching unused columns (TOAST/LOB) dominates IO,Project needed columns; covering index enables index-only scans,"SELECT id,status,total FROM orders ...",Compressing payloads instead of trimming the select list,Plan shows Index Only Scan where applicable,LOW
-JSON column filtering,json jsonb attribute filter schemaless,Filtering inside JSON without index = full scan,"GIN index on jsonb path ops, or generated column + B-tree for hot keys",ALTER TABLE t ADD COLUMN status text GENERATED ALWAYS AS (doc->>'status') STORED; CREATE INDEX ...,Stuffing relational data into one JSON blob,Plan uses the GIN/generated-column index,MEDIUM
+JSON column filtering,json jsonb attribute filter schemaless,Filtering inside JSON without index = full scan,"GIN index on jsonb path ops, or generated column + B-tree for hot keys",ALTER TABLE t ADD COLUMN status text GENERATED ALWAYS AS (doc->>'status') STORED; CREATE INDEX ...; -- PG18+: STORED must be explicit (default flipped to VIRTUAL — not indexable),Stuffing relational data into one JSON blob; relying on the pre-PG18 STORED default,Plan uses the GIN/generated-column index,MEDIUM

package/dist/agent-src/skills/design-review/SKILL.md

@@ -234,6 +234,56 @@ THE Q1-Q6 FLOOR SET IS IDENTICAL IN ALL FOUR MODES.
 Do not re-derive any of these fields here. This skill is a declared consumer of
 that object, and the contract's consumer table names it.
 
+## Fidelity proof — the chapter matrix
+
+```
+A 1:1 CLAIM IS PROVEN BY A COMMITTED MATRIX, NEVER BY A GREEN SUITE.
+ONE ROW PER HANDOVER CHAPTER. ONE EVIDENCE KIND PER ROW. NO EMPTY CELL.
+A BEHAVIOR TEST ANSWERS "DOES IT WORK", NOT "DOES IT MATCH".
+```
+
+This discharges [`design-fidelity`](../../rules/design-fidelity.md)'s proof
+clause. It fires when a numbered handover is the spec — chapters like
+`10-datenmodell-api.md` … `46-roadmap-achse-randtage.md`, each an abgegrenzter
+contract. Such a handover is already a checklist; the failure it prevents is
+reading it and never working it as one.
+
+**Build the matrix from the handover's own numbering**, one row per chapter:
+
+| Chapter | Claim it makes | Evidence | Status |
+
+**Evidence is exactly one of four kinds**, and the row names which:
+
+1. **Element-scoped screenshot baseline** — `toHaveScreenshot` on the component,
+   not the page. Built into Playwright via pixelmatch, so no new dependency
+   ([`playwright-testing`](../playwright-testing/SKILL.md)). Mask dynamic
+   content (timestamps, running numbers, ids) or the baseline flakes on data
+   rather than on design.
+2. **`toHaveCSS` assertion on the value the chapter names** — the right kind
+   when the chapter states a token, a spacing step or a color rather than a
+   shape.
+3. **Behavior spec with a sensitivity probe** — legitimate where the chapter
+   describes an interaction. The probe is not optional: neutralise the
+   mechanism, watch the spec go red, restore it. A spec never seen red has
+   unknown sensitivity and is not evidence.
+4. **Explicitly not implemented, with the reason** — a real row, not a gap. An
+   honest `not implemented` is what makes the other three trustworthy.
+
+**The matrix is committed**, not written into a reply. A matrix that lives in a
+chat message dies with the session, which is the difference between a method and
+an artifact — and the whole reason this section exists rather than a paragraph
+telling a reviewer to be thorough.
+
+**The staleness trap.** A new handover version ships and the baselines stay
+pinned to the old one, so every screenshot row passes against a reference nobody
+uses any more. Check the baseline timestamps against the handover's own
+CHANGELOG before reading a green matrix as a pass.
+
+**What the matrix does not do.** It records what was compared, never that the
+comparison was honest — nothing in this tree reads a handover, so a row naming
+evidence nobody took looks exactly like one naming evidence that was. The
+control is that a reviewer can open it.
+
 ## Review independence — two passes, isolated, in this order
 
 ```