@event4u/agent-config 16.0.0 → 16.2.0

package/dist/cli-delegate/{chunk-3FKR64R5.js → chunk-IGD6ERX6.js}

@@ -4068,6 +4068,8 @@ var leanProjectionHost = external_exports.enum(["claude-code", "cursor", "cline"
 var projectionMode = external_exports.enum(["legacy-all", "scoped"]);
 var memoryCadence = external_exports.enum(["auto", "always", "never"]);
 var projectAudience = external_exports.enum(["self", "internal", "client", "public"]);
+var deliveryMerge = external_exports.enum(["off", "on-green"]);
+var prTopology = external_exports.enum(["single", "stacked"]);
 var settingsSchema = external_exports.object({
   agent_config_version: external_exports.string().default("").describe(
     'Pin the package to an exact semver (e.g. "1.4.2") so all teammates load the same skill / rule set. Leave empty to track whatever is installed locally \u2014 useful for the maintainers of this package, risky for production projects.'
@@ -4096,7 +4098,7 @@ var settingsSchema = external_exports.object({
   ),
   lean_projection: external_exports.object({
     mode: leanProjectionMode.default("eager-all").describe(
-      "How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267, and the activation charge for it is paid in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384)."
+      "How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session, exact-BPE \u2014 a different unit from the chars/4 figures below, never compare the two directly), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267. SAVING AND CHARGE, MEASURED TOGETHER so neither is published alone (2026-09-12, `check_preamble_payload_budget`): the rule bucket falls 122,769 -> 24,537 chars/4 tok per session on a thinned host (-80.0%), and a trigger match costs p50 6,728 B / p90 14,016 B / max 16,297 B per fire over 318 gate-open fires of the frozen tests/eval/routing-matrix corpus at the concern's 16,384 B cap. Bytes per fire and tokens per session are different denominators and are never summed; re-read both rather than quoting this line. The ceiling for that charge is registered in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384)."
     ),
     hosts: external_exports.array(leanProjectionHost).default(["claude-code"]).describe(
       "Which hosts a thinning mode may thin (ADR-267). Absent resolves to [claude-code]. Only the three hosts with a per-rule rule tree are accepted, and this enum is the AUTHORING layer: an id outside it is a hard validation FAILURE here and under validate_agent_settings, never a warning. resolveLeanProjectionHosts is the READ-TIME backstop for a hand-edited .agent-settings.yml that passed neither, and THERE the id is dropped with a warning (R2 finding 6 \u2014 the two layers answer differently and neither said so). Every host outside this list receives exactly what eager-all writes, asserted byte-for-byte by check_host_tree_parity."
@@ -4185,6 +4187,48 @@ var settingsSchema = external_exports.object({
       "How the agent replies to PR review comments. create_review_comment = post a new review comment (works on every GitHub plan). replies_endpoint = thread the reply under the original comment (needs the newer REST endpoint). auto = detect at runtime, prefer threaded replies when available."
     )
   }),
+  delivery: external_exports.object({
+    merge: deliveryMerge.default("off").describe(
+      "Whether a run may merge the pull request it produced. off (default) = the run ends at mergeable-green-and-open and says so. on-green = merge is permitted, and only when an object-bound grant covering {op: prod_merge, target: <base>} exists and the final head is required-check-green, target-current and tamper-checked. This key is a precondition, never the authorisation by itself; forge auto-merge is the mechanism, so branch protection stays the gate."
+    ),
+    wait_for_ci: external_exports.boolean().default(true).describe(
+      "Whether the run stays alive until the required checks settle. true (default) = the run drives CI and reports the settled verdict. false = the run ends once the branch is pushed and the PR is open, leaving the checks to be read later. Independent of merge: a run may wait for CI without being allowed to merge."
+    ),
+    pr_topology: prTopology.default("single").describe(
+      "How a mission's work is shaped into pull requests. single (default) = one branch, one pull request. stacked = a dependent series. stacked is never chosen by the agent and never asked about at roadmap creation \u2014 the owner plans it or it does not happen."
+    )
+  }),
+  /**
+   * What this package may write into the HOST's own environment.
+   *
+   * THE GUARANTEE IS THE SHAPE, not a check. Only two keys exist here, and
+   * both are request-SIZE caps. Neither traffic variable is expressible —
+   * `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` and `DISABLE_AUTOUPDATER` both
+   * reach the host's update-disabled resolver (the blanket one as its third
+   * rung, measured on Claude Code 2.1.284), so a profile able to write either
+   * could disable a consumer's security updates. Owner-decided 2026-09-30:
+   * they are not writable through this package at all, and the strongest way
+   * to hold that is a schema that cannot say them rather than an exclusion
+   * list somebody has to maintain.
+   *
+   * `null` is the default on both, and it is the off switch: nothing is
+   * written. There is no separate enable flag, because a flag plus a value is
+   * two ways to say off and one of them would drift.
+   */
+  host_environment: external_exports.object({
+    request_size_caps: external_exports.object({
+      bash_max_output_length: external_exports.number().int().positive().max(15e4).nullable().default(null).describe(
+        "Character cap on Bash tool output the host places inline into a model request. null (default) = this package writes nothing and the host default of 30000 applies. A number is written into the host env block. Values above 150000 are capped by the host itself, so the schema refuses them here rather than writing a value the host silently changes. Bounds request SIZE, never request COUNT: lowering it suppresses no telemetry, no update check and no download."
+      ),
+      max_mcp_output_tokens: external_exports.number().int().positive().nullable().default(null).describe(
+        "Token cap on a single MCP tool result the host places into a model request. null (default) = nothing written, host default 25000 applies. Same size-not-count caveat: it does not govern MCP connections, timeouts, or whether a tool runs."
+      )
+    }).default({}).describe(
+      "Request-size caps this package may write into the host env block. Both null by default. No traffic or auto-updater variable is expressible here, by construction \u2014 see the block comment."
+    )
+  }).default({}).describe(
+    'What this package may write into the host environment. ABSENT resolves to the all-null shape, which is the same thing as off \u2014 a settings file predating this section must not fail to parse, and "no section" and "both caps null" both mean write nothing.'
+  ),
   augment: external_exports.object({
     rules_use_symlinks: external_exports.boolean().default(false).describe(
       "When true, .augment/rules/*.md are symlinks into dist/agent-src/rules/ \u2014 edits flow back to source on save. When false (default), they are copies \u2014 safer on Windows and shared volumes, but rule edits in .augment/ are lost on the next `task sync`."
@@ -4226,8 +4270,8 @@ var settingsSchema = external_exports.object({
     skip_pre_run_gate: external_exports.boolean().default(true).describe(
       'Skip the /roadmap:process-* pre-run confirmation gate. true (default) starts processing immediately and surfaces the resolved config inline; false shows the numbered-options gate and waits. A genuine "which roadmap?" ambiguity always prompts regardless.'
     ),
-    quality_cadence: qualityCadence.default("end_of_roadmap").describe(
-      "When the agent runs the full quality / test suite during /roadmap:process-* runs. end_of_roadmap = once, after the last step (fastest, default). per_phase = after each phase boundary. per_step = after every single step (slowest, highest confidence)."
+    quality_cadence: qualityCadence.default("per_phase").describe(
+      "When the agent runs the full quality / test suite during /roadmap:process-* runs. per_phase = after each phase boundary (default since 2026-09-13 \u2014 end_of_roadmap lets errors compound across phases, which is expensive in a multi-phase autonomous run nobody is watching). end_of_roadmap = once, after the last step (fastest). per_step = after every single step (slowest, highest confidence)."
     ),
     dashboard_regen_cadence: regenCadence.default("every_5_steps").describe(
       "How often the agent regenerates agents/roadmaps/dashboard.md during a roadmap run. every_5_steps = batch the regen (default). per_step = after every step (freshest dashboard, highest subprocess overhead). phase_boundary = only at phase edges. A rename, phase add, or archive always regenerates immediately regardless."
@@ -4245,8 +4289,8 @@ var settingsSchema = external_exports.object({
     }).default({ max_cost_per_run_usd: 5, max_cost_per_rolling_7d_usd: 25 })
   }),
   planning: external_exports.object({
-    challenge_on_create: external_exports.boolean().default(true).describe(
-      "Gate C \u2014 plan-confidence gate before authoring. true (default) = a plan-artifact ask (/roadmap:create, roadmap-writing, /feature:plan, /feature:roadmap) first checks the four 95%-confidence conditions from /challenge-me vision; any gap routes into the interview (or the inline degrade protocol) before authoring, and a confident pass emits exactly one marker line. false = inert, plan asks author directly. An explicit user bypass always wins for that turn and is counted."
+    closure_pass: external_exports.boolean().default(true).describe(
+      `Gate C \u2014 plan-closure pass. true (default) = a plan-artifact ask (/roadmap:create, roadmap-writing, /feature:plan, /feature:roadmap, /roadmap:materialize, /implement-ticket, /jira-ticket, /analyze:inbox, /analyze:roadmap-repos) ends in a closure pass (/challenge-me closure): every foreseeable decision is closed at the lowest rung that owns it and written into the roadmap's "## Decisions" table, so a long run never meets a question planning could have closed. false = inert, plan asks author directly. An explicit user bypass always wins for that turn and is counted as a bypass rather than as an absent closure.`
     ),
     risk_review: external_exports.boolean().default(true).describe(
       'Gate R1 \u2014 plan-risk review. true (default) = every ready (non-draft) plan must carry a schema-valid "## Risk Register" section (ranked risks, mitigation + anchor per row, freshness marker, exact honest-null grammar), enforced by lint_plan_risk_register at pre-push + CI. false = escape hatch, the validator skips.'
@@ -4255,9 +4299,20 @@ var settingsSchema = external_exports.object({
       "Gate R2 \u2014 completion review at 100% roadmap completion / pre-PR. true (default) = a findings-before-fixes review by a fresh reviewer context must exist for the current diff hash (or an exact honest-null / skip declaration) before fix commits and PR creation, enforced by check_completion_review at pre-push + CI (CI authoritative; a crashed validator warns and allows). false = escape hatch, the validator skips."
     )
   }).default({}),
+  execution: external_exports.object({
+    fix_loop_max: external_exports.number().int().min(1).default(10).describe(
+      "Consecutive failed fix attempts against one validation target before the escalation ladder reaches its terminal rung. Reaching the bound triggers a strategy change, never a question. Overridable globally, per project and per prompt."
+    ),
+    escalation: external_exports.array(external_exports.string()).default(["independent", "council", "team", "owner_owned_check"]).describe(
+      "The escalation rungs, in order, walked when the fix-loop bound is reached: independent (another session or a provider-diverse reviewer), council, team, then owner_owned_check \u2014 which asks whether the residue is owner-owned, not whether to ask the owner now."
+    )
+  }).default({}),
   quality: external_exports.object({
     local_auto_run: external_exports.boolean().default(false).describe(
-      "Run quality tools (linters, type-checks, formatters) and the local test suite autonomously after edits. Off by default \u2014 the agent never runs quality tools proactively and does not ask; the user runs them manually (e.g. /quality-fix) and remote CI is the authoritative gate. The agent only runs a quality tool on an explicit ask, a concrete CI failure, or the new-gate carve-out. Turn on to restore autonomous pipeline runs."
+      "Run quality tools (linters, type-checks, formatters) and the local test suite autonomously after edits, IN CHAT. Off by default \u2014 in a chat turn a human is present and remote CI is the authoritative gate, so a local full-pipeline run duplicates it at wall-clock cost. The agent only runs a quality tool on an explicit ask, a concrete CI failure, or the new-gate carve-out. A mission is governed by local_auto_run_in_mission instead."
+    ),
+    local_auto_run_in_mission: external_exports.boolean().default(true).describe(
+      "Run quality tools autonomously inside a mission \u2014 an autonomous roadmap run with a claimed contract. On by default: nobody is waiting, the next action belongs to the agent itself, and a red found twenty steps later costs more than the run that would have caught it at step one. Inert outside a mission, and a mission never lowers local_auto_run: true."
     )
   }),
   design: external_exports.object({
@@ -4560,7 +4615,7 @@ var settingsSchema = external_exports.object({
     }).default({}),
     rtk_wrap: external_exports.object({
       enabled: external_exports.boolean().default(false).describe(
-        'PreToolUse RTK-wrap nudge (token-saving Phase 3). Default off. When on AND the binary on PATH is verified as Rust Token Killer (a live two-stage identity probe \u2014 not a self-reported flag, and never a colliding same-name binary), warns (never blocks) "re-run wrapped with rtk" before a single verbose CLI command (git/npm/cargo/docker/\u2026) \u2014 upstream reports 60\u201390% output-token savings (their estimate). Skips completeness-critical / piped / compound commands and git diff. No-op when rtk is absent, unverified, or a different tool.'
+        'PreToolUse RTK-wrap nudge (token-saving Phase 3). Default off. When on AND the binary on PATH is verified as Rust Token Killer (a live two-stage identity probe \u2014 not a self-reported flag, and never a colliding same-name binary), warns (never blocks) "re-run wrapped with rtk" before a single verbose CLI command (git/npm/cargo/docker/\u2026) \u2014 upstream reports 60\u201390% output-token savings (their estimate). Skips completeness-critical / piped / compound commands and git diff. No-op when rtk is absent, unverified, or a different tool. Its own activation charge is one advisory line under the 1,024 B default concern cap in src/config/hook-token-budget.json; the per-fire distribution is UNMEASURED \u2014 stated rather than estimated, because the saving above is a third-party output-token claim and not a standing-payload reduction this package measured.'
       )
     }).default({}),
     design_slop: external_exports.object({

package/dist/cli-delegate/{chunk-GYC3VRYN.js → chunk-JNMVLWLR.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-OY53J6II.js";
 import {
   load_agent_settings
-} from "./chunk-2XY7ILBT.js";
+} from "./chunk-FC75PGJE.js";
 import {
   resolve_with_fallback,
   write_target
@@ -2805,7 +2805,7 @@ function buildSecondModel(entry, cls, locked, d) {
   if (!("second_model" in entry)) return null;
   if (locked.has(cls)) {
     throw d.error(
-      `decision_resolution.classes.${cls}.second_model=${d.repr(entry["second_model"])}: a second-model rung is not configurable for high-impact / user-required decisions \u2014 those classes are LOCKED to \`user\` (Iron Law) and never resolve on a model of any kind.`
+      `decision_resolution.classes.${cls}.second_model=${d.repr(entry["second_model"])}: a second-model rung is not configurable for an owner-routed class (high-impact / user-required on the impact axis; product-owned / business-owned / destructive-owned on the ownership axis) \u2014 those classes are LOCKED to \`user\` (Iron Law) and never resolve on a model of any kind.`
     );
   }
   const raw = entry["second_model"];
@@ -2818,6 +2818,54 @@ function buildSecondModel(entry, cls, locked, d) {
   return raw;
 }
 
+// src/scripts/ai_council/ownership_classes.ts
+var OWNERSHIP_CLASSES = [
+  "deterministic",
+  "reversible-technical",
+  "contested-technical",
+  "critical-technical",
+  "product-owned",
+  "business-owned",
+  "destructive-owned",
+  "spend-exhaustion"
+];
+var OWNER_LOCKED_CLASSES = /* @__PURE__ */ new Set([
+  "product-owned",
+  "business-owned",
+  "destructive-owned"
+]);
+var NEVER_OWNER_CLASSES = /* @__PURE__ */ new Set(["spend-exhaustion"]);
+function allOwnerLocked(impactLocked) {
+  return /* @__PURE__ */ new Set([...impactLocked, ...OWNER_LOCKED_CLASSES]);
+}
+var DEFAULT_RESOLUTION_MODES = {
+  trivial: "agent",
+  low_impact: "agent",
+  medium_impact: "council",
+  high_impact: "user",
+  user_required: "user",
+  deterministic: "agent",
+  "reversible-technical": "agent",
+  "contested-technical": "council",
+  "critical-technical": "council",
+  "product-owned": "user",
+  "business-owned": "user",
+  "destructive-owned": "user",
+  "spend-exhaustion": "agent"
+};
+function defaultModeFor(cls) {
+  return DEFAULT_RESOLUTION_MODES[cls] ?? "agent";
+}
+function ownershipModeError(cls, mode, repr) {
+  if (OWNER_LOCKED_CLASSES.has(cls) && mode !== "user") {
+    return `decision_resolution.classes.${cls}.mode=${repr(mode)}: class \`${cls}\` is LOCKED to \`user\` (Iron Law) \u2014 product, business and destructive decisions are owner-owned and never resolve on a model.`;
+  }
+  if (NEVER_OWNER_CLASSES.has(cls) && mode === "user") {
+    return `decision_resolution.classes.${cls}.mode=${repr(mode)}: class \`${cls}\` is never owner-routed (Iron Law) \u2014 spend exhaustion pauses and reports, it does not ask.`;
+  }
+  return null;
+}
+
 // src/scripts/ai_council/py_format.ts
 function _pyReprStr(s) {
   const hasSingle = s.includes("'");
@@ -3445,13 +3493,7 @@ var _LOCKED_IMPACT_CLASSES = /* @__PURE__ */ new Set([
   "high_impact",
   "user_required"
 ]);
-var _DEFAULT_RESOLUTION_MODES = {
-  trivial: "agent",
-  low_impact: "agent",
-  medium_impact: "council",
-  high_impact: "user",
-  user_required: "user"
-};
+var _ALL_OWNER_LOCKED = allOwnerLocked(_LOCKED_IMPACT_CLASSES);
 function _build_decision_resolution(d) {
   if (!_isDict(d)) {
     throw new CouncilConfigError("`decision_resolution` must be a mapping.");
@@ -3469,14 +3511,14 @@ function _build_decision_resolution(d) {
     );
   }
   const classes = /* @__PURE__ */ new Map();
-  for (const cls of _IMPACT_CLASSES) {
+  for (const cls of [..._IMPACT_CLASSES, ...OWNERSHIP_CLASSES]) {
     const entry_raw = _orEmpty(classes_raw[cls] ?? null);
     if (!_isDict(entry_raw)) {
       throw new CouncilConfigError(
         `\`decision_resolution.classes.${cls}\` must be a mapping.`
       );
     }
-    const mode = _get(entry_raw, "mode", _DEFAULT_RESOLUTION_MODES[cls]);
+    const mode = _get(entry_raw, "mode", defaultModeFor(cls));
     if (!(_isStr(mode) && _VALID_RESOLUTION_MODES.has(mode))) {
       throw new CouncilConfigError(
         `decision_resolution.classes.${cls}.mode=${_pyRepr3(mode)} not in ${_sortedListRepr(_VALID_RESOLUTION_MODES)}.`
@@ -3487,7 +3529,9 @@ function _build_decision_resolution(d) {
         `decision_resolution.classes.${cls}.mode=${_pyRepr3(mode)}: class \`${cls}\` is LOCKED to \`user\` (Iron Law) \u2014 high-impact and user-required decisions never bypass the user.`
       );
     }
-    if (_LOCKED_IMPACT_CLASSES.has(cls) && "dispatch" in entry_raw) {
+    const ownErr = ownershipModeError(cls, mode, _pyRepr3);
+    if (ownErr !== null) throw new CouncilConfigError(ownErr);
+    if (_ALL_OWNER_LOCKED.has(cls) && "dispatch" in entry_raw) {
       throw new CouncilConfigError(
         `decision_resolution.classes.${cls}.dispatch=${_pyRepr3(entry_raw.dispatch)}: dispatch is not configurable for high-impact / user-required decisions \u2014 always full council.`
       );
@@ -3501,7 +3545,7 @@ function _build_decision_resolution(d) {
     const second_model = buildSecondModel(
       entry_raw,
       cls,
-      _LOCKED_IMPACT_CLASSES,
+      _ALL_OWNER_LOCKED,
       _FALLBACK_DEPS
     );
     classes.set(cls, { mode, confidence_threshold: threshold, second_model });
@@ -4227,6 +4271,16 @@ function toTokenCounts(raw) {
     ephemeral_1h_input_tokens: numOr0(cc.ephemeral_1h_input_tokens)
   };
 }
+function measureContentBytes(raw) {
+  const content = raw.message?.content;
+  if (content === void 0 || content === null) return null;
+  if (typeof content === "string") return Buffer.byteLength(content, "utf8");
+  try {
+    return Buffer.byteLength(JSON.stringify(content), "utf8");
+  } catch {
+    return null;
+  }
+}
 function classifyBucket(raw) {
   const hasAgentId = typeof raw.agentId === "string" && raw.agentId.length > 0;
   return hasAgentId || raw.isSidechain === true ? "subagent" : "main";
@@ -4304,7 +4358,8 @@ function scanTranscripts(opts = {}) {
         agentId: typeof raw.agentId === "string" ? raw.agentId : null,
         model: typeof raw.message.model === "string" ? raw.message.model : "unknown",
         timestamp: typeof raw.timestamp === "string" ? raw.timestamp : null,
-        usage: toTokenCounts(raw.message.usage)
+        usage: toTokenCounts(raw.message.usage),
+        content_bytes: opts.measureBytes === true ? measureContentBytes(raw) : null
       });
     }
   }
@@ -4316,6 +4371,34 @@ function scanTranscripts(opts = {}) {
     dedup_ratio: totalSeen > 0 ? (totalSeen - dedupedCount) / totalSeen : 0
   };
 }
+function measureBytesPerToken(records) {
+  let bytes = 0;
+  let tokens = 0;
+  let n = 0;
+  for (const rec of records) {
+    if (rec.content_bytes === null || rec.usage.output_tokens <= 0) continue;
+    bytes += rec.content_bytes;
+    tokens += rec.usage.output_tokens;
+    n += 1;
+  }
+  if (n === 0 || tokens <= 0) return null;
+  return {
+    basis: "measured",
+    content_bytes: bytes,
+    output_tokens: tokens,
+    bytes_per_token: bytes / tokens,
+    records: n
+  };
+}
+function derivedBytes(tokens, factor) {
+  if (factor === null) return null;
+  return {
+    basis: "derived",
+    tokens,
+    factor,
+    bytes: Math.round(tokens * factor.bytes_per_token)
+  };
+}
 function emptyAggregate(bucket) {
   return {
     bucket,
@@ -4359,6 +4442,8 @@ export {
   billableInputTokens,
   weightedInputUnits,
   scanTranscripts,
+  measureBytesPerToken,
+  derivedBytes,
   aggregateByBucket,
   resolveSessionRole,
   hardenedSpawnEnv,

package/dist/cli-delegate/{chunk-H32DGUJH.js → chunk-P6ZHP5W2.js}

@@ -5,7 +5,7 @@ import {
 import {
   DEFAULT_PROJECT_FILE,
   logger
-} from "./chunk-2XY7ILBT.js";
+} from "./chunk-FC75PGJE.js";
 
 // src/scripts/config/profiles.ts
 import * as fs from "node:fs";

package/dist/cli-delegate/{chunk-57PN4GYJ.js → chunk-RGNIWTEA.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-F7DQWYR5.js";
 import {
   load_agent_settings
-} from "./chunk-2XY7ILBT.js";
+} from "./chunk-FC75PGJE.js";
 
 // src/scripts/chat_history.ts
 import { createHash } from "node:crypto";

package/dist/cli-delegate/chunk-ROYYTEZU.js

@@ -0,0 +1,39 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/shared/missionExecution.ts
+var ESCALATION_LADDER = [
+  "independent",
+  "council",
+  "team",
+  "owner_owned_check"
+];
+var FIX_LOOP_MAX_DEFAULT = 10;
+var MISSION_AUTO_RUN_DEFAULT = true;
+function resolveLocalAutoRun(inputs) {
+  if (inputs.configured) return { value: true, origin: "settings" };
+  if (!inputs.inMission) return { value: false, origin: "settings" };
+  const mission = inputs.missionValue ?? MISSION_AUTO_RUN_DEFAULT;
+  return mission ? { value: true, origin: "mission" } : { value: false, origin: "settings" };
+}
+function executionPostureFromOverrides(layers) {
+  const raw = {};
+  for (const [key, value] of layers) {
+    if (key === "execution.fix_loop_max") raw["fix_loop_max"] = value;
+    else if (key === "execution.escalation") raw["escalation"] = value;
+  }
+  return resolveExecutionPosture(raw);
+}
+function resolveExecutionPosture(raw) {
+  const block = raw ?? {};
+  const rawMax = block["fix_loop_max"];
+  const max = typeof rawMax === "number" && Number.isInteger(rawMax) && rawMax > 0 ? rawMax : FIX_LOOP_MAX_DEFAULT;
+  const rawLadder = block["escalation"];
+  const ladder = Array.isArray(rawLadder) && rawLadder.length > 0 && rawLadder.every((r) => typeof r === "string") ? rawLadder : ESCALATION_LADDER;
+  return { fix_loop_max: max, escalation: ladder };
+}
+
+export {
+  resolveLocalAutoRun,
+  executionPostureFromOverrides,
+  resolveExecutionPosture
+};

package/dist/cli-delegate/{chunk-2DK2VJWG.js → chunk-WGXTVKCQ.js}

@@ -1,8 +1,10 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   buildInstallPlan,
+  classifyOwnership,
+  recordedHashesForRoot,
   sha256File
-} from "./chunk-523HCFYO.js";
+} from "./chunk-YDPILCOL.js";
 import {
   detectToolPresence
 } from "./chunk-A4QJ6ENT.js";
@@ -17,23 +19,27 @@ import { existsSync } from "node:fs";
 function isJsonTarget(entry) {
   return entry.kind === "deployed" && entry.path.endsWith(".json");
 }
-function computeConflicts(plan) {
+function computeConflicts(plan, recordedOverride) {
   if (plan.policy.force) return [];
+  const recorded = recordedOverride ?? recordedHashesForRoot(plan.root);
   const out = [];
   for (const entries of Object.values(plan.filesByTool)) {
     for (const entry of entries) {
       if (entry.kind === "bridge") continue;
       if (entry.sha256 === null) continue;
       if (!existsSync(entry.path)) continue;
-      if (plan.policy.knownPaths.has(entry.path)) continue;
       const onDisk = sha256File(entry.path);
+      const ownership = classifyOwnership(recorded.get(entry.path), onDisk);
+      if (ownership === "recorded-unchanged") continue;
+      if (ownership === "unknown" && plan.policy.knownPaths.has(entry.path)) continue;
       if (onDisk === entry.sha256) continue;
       out.push({
         path: entry.path,
         kind: entry.kind,
         plannedSha256: entry.sha256,
         existingSha256: onDisk,
-        mergeable: isJsonTarget(entry)
+        mergeable: isJsonTarget(entry),
+        ownership
       });
     }
   }
@@ -133,8 +139,16 @@ function checkConflicts(inputs) {
     id: "conflicts",
     severity: "warning",
     path: c.path,
-    message: `existing file conflicts with planned ${c.kind} content`,
-    remedy: "resolve interactively, or pass --force to overwrite"
+    message: c.ownership === "recorded-modified" ? `managed ${c.kind} file has been edited since we wrote it` : `existing file conflicts with planned ${c.kind} content`,
+    // A remedy here may only describe what an install actually does. Before
+    // the owner ruling of 2026-09-21 the writer overwrote every deployed
+    // file unconditionally, so the `recorded-modified` arm told the
+    // operator to back their edit up. It now preserves that file and stages
+    // the package content beside it, so the same sentence would be false in
+    // the opposite direction — it would understate a protection that ships.
+    // The `unknown` arm is unchanged: nothing is recorded for that path, so
+    // the writer still writes over it.
+    remedy: c.ownership === "recorded-modified" ? "installing preserves your edit and stages package content as <path>.agent-config.new; --force replaces it instead" : "back up this file \u2014 installing writes the planned content over it"
   }));
 }
 function checkHostDetection(inputs) {

package/dist/cli-delegate/chunk-YDPILCOL.js

@@ -0,0 +1,152 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+import {
+  manifest_path
+} from "./chunk-4E2W63DA.js";
+import {
+  require_dist
+} from "./chunk-OY53J6II.js";
+import {
+  __toESM
+} from "./chunk-J55WI3RR.js";
+
+// src/install/plan.ts
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+function sha256File(path) {
+  try {
+    const data = readFileSync(path);
+    return createHash("sha256").update(data).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function fileEntry(path, kind, options) {
+  return {
+    path,
+    kind,
+    sha256: options.hashContent ? sha256File(path) : null
+  };
+}
+function walkSourceTree(dir) {
+  const out = [];
+  walkInto(dir, out);
+  return out;
+}
+function walkInto(dir, out) {
+  let entries;
+  try {
+    entries = readdirSync(dir).sort();
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const full = join(dir, name);
+    let isDir;
+    try {
+      isDir = statSync(full).isDirectory();
+    } catch {
+      continue;
+    }
+    if (isDir) {
+      walkInto(full, out);
+    } else {
+      out.push(full);
+    }
+  }
+}
+function buildInstallPlan(inputs) {
+  const filesByTool = {};
+  for (const source of inputs.sources) {
+    const bucket = filesByTool[source.toolId] ?? [];
+    let files = walkSourceTree(source.srcDir);
+    if (source.fileFilter !== void 0) {
+      files = files.filter(source.fileFilter);
+    }
+    for (const srcFile of files) {
+      const rel = relative(source.srcDir, srcFile);
+      const destPath = resolve(source.destDir, rel);
+      bucket.push(
+        fileEntry(srcFile, source.kind, {
+          hashContent: source.kind !== "bridge"
+        })
+      );
+      bucket[bucket.length - 1] = {
+        ...bucket[bucket.length - 1],
+        path: destPath
+      };
+    }
+    filesByTool[source.toolId] = bucket;
+  }
+  for (const source of inputs.sources) {
+    if (!(source.toolId in filesByTool)) {
+      filesByTool[source.toolId] = [];
+    }
+  }
+  return {
+    version: 2,
+    target: inputs.target,
+    root: inputs.root,
+    filesByTool,
+    mergedKeysByTool: {},
+    policy: inputs.policy
+  };
+}
+
+// src/install/recordedOwnership.ts
+var YAML = __toESM(require_dist(), 1);
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join as join2, resolve as resolve2 } from "node:path";
+var NO_RECORDED_HASHES = /* @__PURE__ */ new Map();
+function classifyOwnership(recordedSha256, onDiskSha256) {
+  if (recordedSha256 === void 0 || recordedSha256 === null) return "unknown";
+  if (onDiskSha256 === null) return "unknown";
+  return recordedSha256 === onDiskSha256 ? "recorded-unchanged" : "recorded-modified";
+}
+function readRecordedHashes(manifestPath, projectRoot) {
+  if (!existsSync(manifestPath)) return NO_RECORDED_HASHES;
+  let doc;
+  try {
+    doc = YAML.parse(readFileSync2(manifestPath, "utf8"));
+  } catch {
+    return NO_RECORDED_HASHES;
+  }
+  if (doc === null || typeof doc !== "object" || Array.isArray(doc)) return NO_RECORDED_HASHES;
+  const tools = doc["tools"];
+  if (!Array.isArray(tools)) return NO_RECORDED_HASHES;
+  const out = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    if (tool === null || typeof tool !== "object" || Array.isArray(tool)) continue;
+    const files = tool["files"];
+    if (!Array.isArray(files)) continue;
+    for (const entry of files) {
+      if (entry === null || typeof entry !== "object" || Array.isArray(entry)) continue;
+      const rec = entry;
+      const raw = rec["path"];
+      if (typeof raw !== "string" || raw.length === 0) continue;
+      const sha = rec["sha256"];
+      const expanded = expanduser(raw);
+      const target = isAbsolute(expanded) ? resolve2(expanded) : resolve2(projectRoot, expanded);
+      out.set(target, typeof sha === "string" && sha.length > 0 ? sha : null);
+    }
+  }
+  return out;
+}
+function expanduser(p) {
+  if (p === "~") return homedir();
+  if (p.startsWith("~/") || process.platform === "win32" && p.startsWith("~\\")) {
+    return join2(homedir(), p.slice(2));
+  }
+  return p;
+}
+function recordedHashesForRoot(root, env) {
+  return readRecordedHashes(manifest_path(root, env), root);
+}
+
+export {
+  classifyOwnership,
+  recordedHashesForRoot,
+  sha256File,
+  buildInstallPlan
+};