@event4u/agent-config 16.0.0 → 16.2.0

package/src/config/agent-settings.template.yml

@@ -423,6 +423,76 @@ github:
   # auto                  = detect on first use and update this setting
   pr_reply_method: create_review_comment
 
+# --- Delivery: what a run does with the branch it produced ---
+#
+# ADR-268 section 3 resolves ADR-239 section 3's "undecided, not rejected" on merge
+# authority in the affirmative, and these keys are where that decision is
+# configured rather than inferred. All three are Class C in
+# docs/contracts/settings-classes.md: every agent write path refuses them, so
+# a run can read its delivery policy and can never widen it.
+#
+# NAMING IS DELIBERATE. check_no_automerge_key.ts is a namespace ratchet on the
+# three key names autoMerge / auto_merge / mergePolicy, and its own text reserves
+# its deletion to the owner. `delivery.merge` grants the same capability under a
+# name outside that closed set, so the ratchet stays green and stays standing --
+# the boundary it protects is a name, and the decision it points at was taken by
+# an ADR rather than by a key.
+delivery:
+  # Whether a run may merge the pull request it produced.
+  #   off      = default. The run ends at mergeable-green-and-open and says so.
+  #   on-green = merge is permitted, and ONLY when an object-bound grant covering
+  #              {op: prod_merge, target: <base>} exists AND the final head is
+  #              required-check-green, target-current and tamper-checked. This
+  #              key is a precondition, never the authorisation by itself.
+  # Forge auto-merge is the mechanism, so branch protection stays the gate.
+  # Required protections are never bypassed -- an invariant, not a default.
+  merge: "off"
+
+  # Whether the run stays alive until the required checks settle.
+  #   true  = default. The run drives CI and reports the settled verdict.
+  #   false = the run ends once the branch is pushed and the PR is open,
+  #           leaving the checks to be read later.
+  # Independent of `merge`: a run may wait for CI without being allowed to
+  # merge, which is the shape every drain run uses today.
+  wait_for_ci: true
+
+  # How a mission's work is shaped into pull requests.
+  #   single  = default. One branch, one pull request.
+  #   stacked = a dependent series.
+  # `stacked` is NEVER chosen by the agent and is never asked about at roadmap
+  # creation. The owner plans it in roadmap frontmatter or it does not happen;
+  # that is why this key is Class C rather than a preference.
+  pr_topology: single
+
+# --- What this package may write into the HOST's own environment ---
+#
+# THE GUARANTEE IS THE SHAPE, not a list. Only request-SIZE caps live here.
+# Neither `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` nor `DISABLE_AUTOUPDATER`
+# is expressible: both reach the host's update-disabled resolver -- the blanket
+# one as its THIRD RUNG, measured on Claude Code 2.1.284 -- so a profile able to
+# write either could disable a consumer's security updates. Owner-decided
+# 2026-09-30: this package never writes them, and a schema that cannot say them
+# holds that better than an exclusion list somebody has to keep true.
+#
+# Both keys are `null` by default, and null IS the off switch -- nothing is
+# written. There is deliberately no separate enable flag: a flag plus a value
+# would be two ways to say off, and one of them would drift.
+#
+# Size, never count. Lowering either cap suppresses no telemetry, no update
+# check and no download; it bounds how big a request is, not how many there are.
+# What each variable governs is in docs/setup/host-traffic-environment.md and is
+# not copied here.
+host_environment:
+  request_size_caps:
+    # Character cap on Bash tool output placed inline into a model request.
+    # null = not written, host default 30000 applies. Max 150000 -- above that
+    # the host caps it silently, so the schema refuses rather than writing a
+    # value the host changes behind you.
+    bash_max_output_length: null
+    # Token cap on a single MCP tool result. null = not written, host default
+    # 25000 applies.
+    max_mcp_output_tokens: null
+
 # --- Augment Code projection (.augment/) ---
 #
 # Controls how rule files are written into .augment/rules/ during
@@ -533,9 +603,23 @@ roadmap:
   # pattern: which asks are batched into the run-start execution
   # contract and where checkpoint prompts fire. It overrides NONE of
   # the keys below — `skip_pre_run_gate`, `quality_cadence`, and
-  # `dashboard_regen_cadence` keep their global meaning in every mode,
-  # and no mode lifts a safety floor. See
-  # contexts/execution/roadmap-execution-contract.md.
+  # `dashboard_regen_cadence` keep their global meaning in every mode.
+  #
+  # WHAT NO MODE LIFTS, NAMED. This sentence used to read "no mode lifts a
+  # safety floor", which is unfalsifiable: it never says which floor or how
+  # far it reaches. What no `execution.mode` value lifts is ADR-260 section 2's
+  # closed eleven-op vocabulary -- force_push, prod_merge, tag_push, release,
+  # publish, branch_protection_change, repo_delete, prod_data_delete,
+  # secret_write, payment, external_send. Each of those needs its own
+  # object-bound grant, and no interaction pattern substitutes for one.
+  #
+  # The Hard Floor in `non-destructive-by-default` is today WIDER than that
+  # vocabulary -- it also covers every `git push` and every non-prod merge --
+  # and that wider reach is what is in force right now. ADR-260 decision 11
+  # narrows it to the eleven ops and ADR-268 accepted that, but the narrowing
+  # has not landed, so read the rule's own trigger table as the authority on
+  # reach and this comment as the authority on what a MODE can change: nothing.
+  # See contexts/execution/roadmap-execution-contract.md.
 
   # Skip the /roadmap:process-* pre-run confirmation gate (true, false).
   #   true  = default. The command name names the scope; a discoverable
@@ -549,15 +633,19 @@ roadmap:
   skip_pre_run_gate: true
 
   # When to run quality tools during /roadmap execute.
-  #   end_of_roadmap = once, before archiving the completed roadmap (default — fastest, fewest tokens)
-  #   per_phase      = once after every completed phase
+  #   end_of_roadmap = once, before archiving the completed roadmap (fastest, fewest tokens)
+  #   per_phase      = once after every completed phase (default since 2026-09-13)
   #   per_step       = after every completed step (legacy verbose; highest token cost)
-  # Trade-off: end_of_roadmap saves tokens and time but lets errors compound
-  # across phases. Pick per_phase if the work is risky or unfamiliar.
-  # `quality.local_auto_run: false` (the default) suppresses local
-  # pipeline runs at EVERY cadence — remote CI is the gate; this knob
-  # only matters when `local_auto_run` is `true`.
-  quality_cadence: end_of_roadmap
+  # The default moved from end_of_roadmap to per_phase on the strength of
+  # this block's OWN trade-off sentence: end_of_roadmap saves tokens and
+  # time but lets errors compound across phases. A multi-phase autonomous
+  # run is exactly the case where compounding is expensive and nobody is
+  # watching, so the cheaper default was the wrong one to ship. Set
+  # end_of_roadmap back if the work is routine and token cost dominates.
+  # `quality.local_auto_run` (chat) and `quality.local_auto_run_in_mission`
+  # (a mission) decide WHETHER local pipeline runs happen at all; this
+  # knob only decides WHEN, and is inert wherever both resolve false.
+  quality_cadence: per_phase
 
   # Dashboard regen cadence inside autonomous runs (process-step /
   # process-phase / process-full). Controls how often
@@ -635,20 +723,26 @@ roadmap:
 # roadmaps AND feature plans — which is why these keys do not live under
 # `roadmap:`. All three default to true; a missing key behaves as true.
 planning:
-  # Gate C — plan-confidence gate, BEFORE authoring (true, false).
-  # true  = default. A plan-artifact authoring ask (/roadmap:create,
-  #         roadmap-writing, /feature:plan, /feature:roadmap) first runs
-  #         the four 95%-confidence conditions from /challenge-me vision.
-  #         All four hold → the agent creates directly and emits exactly
-  #         one marker line ("Confidence ≥ 95% — creating directly").
-  #         Any gap → the ask routes into the /challenge-me vision
-  #         interview first; hosts without that command run the inline
-  #         degrade interview (one question per turn, same stop
-  #         conditions — contexts/execution/plan-confidence-gate.md).
+  # Gate C — plan-closure pass, at the END of planning (true, false).
+  # true  = default. Every command declaring `produces_roadmap: true`
+  #         ends in a closure pass (/challenge-me closure): the open
+  #         decisions are detected, each resolved at the lowest rung
+  #         that owns it — evidence, convention, the agent, an
+  #         independent session, the council, the team, the owner last
+  #         and only for owner-owned residue — and written into the
+  #         roadmap's `## Decisions` table. The seed-confidence check
+  #         from /challenge-me vision still runs where a plan starts
+  #         from a fuzzy ask; the difference is that closure is now
+  #         measured at the END, where an open decision actually costs
+  #         a run, rather than only at the start.
   #         An explicit user bypass ("just write it") wins for that turn
-  #         and is counted (gate_c_bypass_rate).
+  #         and is counted AS A BYPASS, on its own axis — never as an
+  #         absent closure.
   # false = inert; plan asks author directly (today's behavior).
-  challenge_on_create: true
+  #
+  # `challenge_on_create` is the deprecated alias, accepted for one
+  # minor so an installed settings file keeps loading.
+  closure_pass: true
 
   # Gate R1 — plan-risk review at plan creation / substantial change
   # (true, false).
@@ -674,6 +768,35 @@ planning:
   # false = escape hatch; the validator skips (governance default is on).
   completion_review: true
 
+# --- Execution — the fix-loop bound and its escalation ladder ---
+#
+# The bound on how long the agent keeps attempting the same failing
+# target, and what happens when it is reached. Reaching the bound is a
+# STRATEGY CHANGE, never a question: `escalation` names the rungs the
+# agent walks, in order, before any owner ask is even considered.
+#
+# `owner_owned_check` is the last rung and it is NOT "ask now" — it asks
+# whether the remaining residue is owner-owned per the ownership table.
+# Where it is not, the run continues under a new strategy epoch. Removing
+# that rung by setting is refused: it is the rung that DECIDES whether a
+# residue is owner-owned at all, so dropping it turns every residue into
+# an owner ask, which is the failure the ladder exists to end.
+execution:
+  # Consecutive failed fix attempts against one validation target before
+  # the ladder's terminal rung is reached. Overridable globally, per
+  # project, and per prompt. A non-integer or non-positive value falls
+  # back to 10 — a bound of 0 makes every first attempt terminal.
+  fix_loop_max: 10
+
+  # The rungs, in order. Attempts escalate INDEPENDENTLY first: another
+  # session or a provider-diverse reviewer, then the council, then the
+  # team, and only then the owner-ownership question.
+  # A FLOW sequence, like every other list in this file: the settings
+  # writer locates a key by its `key: <value>` line, so a block sequence
+  # reads as an empty section header and the write corrupts the file.
+  escalation: [independent, council, team, owner_owned_check]
+
+
 # --- Quality / CI execution ---
 #
 # Controls whether the agent runs the project's quality pipeline
@@ -705,16 +828,34 @@ quality:
   # MUST execute it locally to prove the gate works. Without that
   # execution the new gate is unverified evidence.
   #
-  # Posture note (feedback-8.11-2): `false` is a DELIBERATE, documented
-  # design decision, not an omission — remote CI is the single
-  # authoritative gate; local full-pipeline runs duplicate it at
-  # wall-clock + token cost. It never suppresses (a) narrow diff-scoped
+  # Posture note (feedback-8.11-2, rewritten 2026-09-13): `false` is a
+  # DELIBERATE, documented design decision — and it describes a CHAT
+  # TURN, not an autonomous mission. That is the half the old wording
+  # left implicit, and naming it is the whole point of the rewrite.
+  # In a chat turn a human is present, the next action is theirs, and a
+  # local full-pipeline run duplicates remote CI at wall-clock + token
+  # cost while they wait. In an autonomous mission nobody is waiting,
+  # the next action is the agent's own, and a red discovered twenty
+  # steps later costs more than the run that would have caught it at
+  # step one — the same "lets errors compound" argument the roadmap
+  # cadence knob above already makes about itself.
+  # So: this key governs CHAT. `local_auto_run_in_mission` below
+  # governs a mission. Neither ever suppresses (a) narrow diff-scoped
   # probes (type-check/lint/tests over the agent's OWN changed files
   # before pushing — those always run), (b) the new-gate carve-out
   # above, (c) user-invoked runs. Run-end reports must say "quality
   # gates delegated to remote CI", never claim an unrun pipeline passed.
   local_auto_run: false
 
+  # Run local quality / CI tasks autonomously INSIDE a mission — an
+  # autonomous roadmap run with a claimed contract (true, false).
+  #   true  = default. A mission resolves `local_auto_run` to true.
+  #   false = a mission behaves like chat; remote CI alone is the gate.
+  # Resolution is a runtime condition, never a settings layer: outside a
+  # mission this key is inert, and `local_auto_run: true` is never
+  # LOWERED by a mission. Resolver: src/shared/missionExecution.ts.
+  local_auto_run_in_mission: true
+
 
 # --- Design fidelity ---
 #

package/src/config/auto-rule-budget.json

@@ -0,0 +1,16 @@
+{
+  "_comment": "Growth ratchet for the `auto`-tier rule bucket (road-to-design-fidelity-proof Phase 3). check_always_budget gates the nine kernel rules; measure_rule_budget already measured all 121 and gated none of them, so ~93 % of the estate's rule prose grew against nothing. Seeded AT the measurement, exactly like the preamble-payload ceiling and for the same reason: seeding below it would red every pull request from the day it lands, which is a self-inflicted CI stop rather than a gate. It may only move DOWN. Raising it to clear a failing check is the config-weakening move this repo refuses; walk the bucket back instead, or state the compensating reduction.",
+  "schema_version": 1,
+  "registered_at": "2026-09-18",
+  "owner": "maintainer",
+  "review_by": "2027-09-18",
+  "baseline_chars": 373000,
+  "baseline_history": [
+    {
+      "chars": 373000,
+      "at": "2026-09-18",
+      "why": "registered with the gate, seeded at the measured auto bucket (107 rules) after road-to-design-fidelity-proof Phase 1 returned 1,885 chars from design-fidelity.md"
+    }
+  ],
+  "_what_this_does_not_claim": "A char count is not an obligation count. The Iron-Law total printed beside it is the closer proxy for what the instruction-following research calls simultaneous constraints, and it is REPORTED, not gated \u2014 nobody has measured a threshold for this layer, and gating an unmeasured number would publish a bound as if it were a finding."
+}

package/src/config/ci-local-parity.yml

@@ -270,6 +270,24 @@ ci_only:
   - id: release
     class: release
     reason: "tags, bumps, publishes, opens the release PR — the release itself"
+  - id: check_host_docs_digest
+    class: network
+    reason: >
+      road-to-hooks-on-every-host Phase 1.3. The watcher's whole subject is the
+      LIVE body of each host's hooks page, so its CI-side mode (`--fetch`) makes
+      eight outbound requests to vendor documentation sites. Putting that in
+      `task ci` would add eight network calls — and eight new ways to fail — to
+      every local run of an otherwise hermetic gate chain, for a signal that
+      changes on the order of vendor releases rather than of commits. It runs in
+      its own WEEKLY workflow (`host-docs-digest.yml`) and nowhere else.
+      It is also not a pull-request gate, so there is no failure a contributor
+      could discover only after pushing, which is the exact harm this checker
+      exists to prevent: a drift red is a standing finding about an upstream
+      page, never a verdict on anyone's branch.
+      Reachable locally without egress: `./scripts-run src/scripts/check_host_docs_digest`
+      (offline report) and `--self-test` (pure functions, no network); the
+      comparison logic itself is covered hermetically by
+      `tests/scripts/host_docs_digest.test.ts`.
 
 # Gates a local chain runs that no workflow does — each needs a reason it is not
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer
@@ -278,11 +296,24 @@ local_only:
   - id: check_platform_anchor
     class: token-scope-unavailable
     reason: >
-      Reads `repos/{owner}/{repo}/rulesets` to check that the forge actually
-      requires what the ratification mechanism claims it does — an active branch
-      ruleset over the default branch, an approving review, last-push approval,
-      deletion and force-push blocked, strict required checks, and no
-      unconditional bypass actor.
+      Reads `repos/{owner}/{repo}/rulesets` to compare the committed expectation
+      against the live ruleset — an active branch ruleset over the default
+      branch, review-thread resolution, deletion and force-push blocked, at
+      least one required status check context, and no unconditional bypass
+      actor. `strict_required_status_checks` is a baseline expectation currently
+      covered by the recorded waiver `arr-2026-09-10-strict-status-checks`
+      (owner, expires 2026-12-09), so a deviation there is reported as an
+      accepted risk rather than a finding.
+
+      Corrected 2026-09-13. This text used to name "an approving review,
+      last-push approval" among what is checked; both dimensions were removed
+      from the trust model by owner ruling on 2026-09-10 and are now reported as
+      observed evidence, never as a requirement. It also said the gate checks
+      that the forge "actually requires what the ratification mechanism claims
+      it does" — which overstates a voluntarily invoked local control, per the
+      reviewing council of 2026-09-13, and `check_platform_anchor` must not be
+      described as enforcing repository-wide compliance. See
+      `enforcement_boundary_note` in `src/config/platform-anchor.json`.
 
       Local-only because the permission does not exist, not because remote
       enforcement is unwanted — which is the opposite of the usual reason on this

package/src/config/continuity-surface.json

@@ -148,6 +148,13 @@
             "locus": "src/scripts/hooks/design_pass_hook.ts:66",
             "reason": "Design-pass hook latch."
         },
+        {
+            "id": "obligations",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/obligations.ts:57",
+            "reason": "Per-session obligation ledger — instrumentation, not continuity. A later session must not resume from it: the rows record which obligations THIS session was delivered, and attributing them to a successor would be the one claim the ledger is forbidden to make."
+        },
         {
             "id": "design-slop-hook.json",
             "axis": "persistent_continuity_artefacts",
@@ -267,6 +274,13 @@
             "locus": "src/scripts/hooks/reread_guard_hook.ts:21",
             "reason": "Per-file re-read guard stamps, scoped to one session and never restored into another."
         },
+        {
+            "id": "memory-recall",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/memory_recall_hook.ts:429",
+            "reason": "Per-session once-per-slug latch for the memory-recall advisory, so a delivered memory is not re-injected on the next matching tool call. Slug keys and timestamps only, scoped to one session and never restored into another — a successor session SHOULD be told again."
+        },
         {
             "id": "review-axis",
             "axis": "persistent_continuity_artefacts",
@@ -390,8 +404,8 @@
             "id": "tool-result-census.jsonl",
             "axis": "persistent_continuity_artefacts",
             "disposition": "excluded",
-            "locus": "src/scripts/hooks/tool_result_bytes_hook.ts:92",
-            "reason": "Tool-result byte census. Measurement output."
+            "locus": "src/scripts/hooks/tool_result_bytes_hook.ts",
+            "reason": "Tool-result byte census (raw_bytes / delivered_bytes). Measurement output, written only where the maintainer workspace resolves."
         },
         {
             "id": "turn-end-gate",
@@ -407,6 +421,13 @@
             "locus": "src/scripts/_dispatch.bash:74",
             "reason": "UI audit output. Analysis result."
         },
+        {
+            "id": "ui-conformance.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/design_pass_hook.ts:68",
+            "reason": "Behavioural-conformance probe output. Analysis result, on the same footing as its `ui-audit.json` neighbour: keyed on a target path rather than a session, consumed by the design pass as a shadow verdict, and never read by a successor session to resume anything."
+        },
         {
             "id": "ui-route-nudge.json",
             "axis": "persistent_continuity_artefacts",