@event4u/agent-config 16.0.0 → 16.2.0

package/dist/agent-src/guidelines/agent-infra/evaluator-independence-mechanics.md

@@ -86,6 +86,108 @@ point: this rule exists because a process that *looked* followed produced
 fabricated evidence, and claiming coverage it does not have would repeat that.
 
 
+## The audited failure, in full
+
+Migrated out of the rule on 2026-09-13 under the same P4 pattern the rest of this
+page follows: the rule keeps the obligation, this page carries the record. The
+rule was re-sending all of it on every session and every spawn.
+
+Measured, once, at maximum cost (conformance audit 2026-08-06):
+
+> The agent dispatched a "blind reviewer" over its own change. It wrote that
+> reviewer's prompt itself, put **"NO-FINDINGS is expected and welcome"** into it,
+> and narrowed the scope to four files it chose. The reviewer returned
+> NO-FINDINGS. That honest-null was committed as **binding gate evidence**. An
+> unsteered pass over the same delta later found 5 findings, one of them
+> critical, already live on the trunk.
+
+The agent's own retro named it exactly, in the maintainer's own words:
+
+*DE: "Die Fabrikation lag nicht im Weglassen des Reviews — sie lag in meinem Prompt. Ich habe die Antwort vorgeladen und dann als Evidenz verbucht." · EN: "The fabrication was not in skipping the review — it was in my prompt. I pre-loaded the answer and then booked it as evidence."*
+
+The review ran. The process was followed. The evidence was manufactured anyway.
+
+## The softer form — why the phrase list cannot see it
+
+The Iron Law forbids **authoring the verdict** into an evaluator's prompt. There
+is a weaker move that evades it while doing the same work, and it is the one an
+orchestrator reaches for without noticing: **stating an expectation**.
+
+*"NO-FINDINGS is expected"* is a prediction, not a verdict — and it steered a real
+review into an honest-null that five findings on the trunk later refuted. A prompt
+that says what the author thinks the answer is has authored the answer, whatever
+grammatical mood it used. The guard's pre-loaded-verdict detector is a PHRASE
+list, so it catches recurrences of known steering wording and not steering as
+such; this distinction is the gap it cannot close, which is why the obligation is
+stated in the rule rather than delegated to the detector.
+
+## Tests are evaluators — levels, workflow, and the weakening ladder
+
+`road-to-adversarial-verification-and-long-runs` Phase 2. The rule states the
+obligation; this section carries the detail it points at.
+
+### The five levels
+
+| Level | Author | What it actually buys |
+|---|---|---|
+| **L0** | the same agent, same session | nothing against self-confirmation. **Fallback only** — permitted when no other route exists, and then said out loud. |
+| **L1** | another session, same model | a fresh context. **Not** a different judgement: with one provider configured this is the same model reviewing its own work, holding a label that says otherwise. |
+| **L2** | another model | different training, different blind spots. The first level that buys a genuinely second opinion. |
+| **L3** | another provider | independent training data, independent failure modes, independent incentives. |
+| **L4** | a multi-provider council or team | L3 plus disagreement that is visible rather than averaged away. |
+
+**Critical behavior — security, authority, data loss, merge control — targets
+L3 or L4 wherever two providers are configured.** Wherever, not always: with one
+provider the honest ceiling is L2, and the level is read from `agent-config
+council:status`'s actual provider count rather than assumed from a config file
+that may describe an intention.
+
+### The workflow
+
+```
+acceptance behaviour → INDEPENDENT AUTHOR → RED evidence → implementer → GREEN
+→ INDEPENDENT VALIDATOR
+```
+
+Five arrows, and the two capitalised roles are the ones that may not be the
+implementer. **RED evidence** is not ceremony: a test never shown red has unknown
+sensitivity, so a suite that was green from the first run has proven nothing
+about the code and everything about the assertions being vacuous.
+
+### What an implementer may never do silently
+
+Weaken an assertion · delete a failing test · skip or `xfail` it · loosen a
+threshold · change fixture semantics to fit the code.
+
+Each of these is a legitimate change *sometimes*, which is exactly why the
+prohibition is on doing it **silently** rather than on doing it. Where the test
+genuinely looks wrong, the ladder is: **evidence** (what the test asserts, what
+the code does, why they disagree) → **independent test review** → **council or
+team** → change only after an independent verdict.
+
+**The owner is not the arbiter.** Routing this to the owner converts a technical
+disagreement the tree can settle into an interrupt only the owner can clear, and
+it is the same count-to-an-ask move the recovery ladder removes.
+
+### Test-quality validation — one question, before delivery
+
+*Would these tests fail under plausible wrong implementations?* An independent
+instance answers it, looking for: tautologies · algorithm duplication (the test
+re-implements the thing it is testing, so both are wrong together) · snapshot
+overuse · missing boundary and error cases · over-mocking (the mock, not the
+code, is what passes) · expectations changed to fit the code · a test never shown
+red.
+
+The validator's **identity and provider go into the evidence**. An unattributed
+validation is not one — it cannot be checked for the independence it claims, and
+`evaluator-independence`'s own recorded failure is exactly a verdict nobody could
+trace back to the prompt that produced it.
+
+This is deliberately **not** mutation-testing infrastructure (K3 of that
+roadmap). Mutation testing is the industrial form of the same question; one
+independent instance asking it in prose is the cheap first form, and shipping the
+cheap form now beats deferring the question until the infrastructure exists.
+
 ## See also
 
 - [`evaluator-independence`](../../rules/evaluator-independence.md) — the rule this page carries the argument for.

package/dist/agent-src/guidelines/design-fidelity-routing.md

@@ -13,6 +13,35 @@ Migrated out of `design-fidelity.md` on 2026-09-09 under the council verdict on
 the operative pointers the same verdict requires, not an arbitrary line cut. The
 rule keeps the obligations; this holds the reasoning behind them.
 
+### The matcher, and why each shipped class is shaped that way
+
+Migrated out of `design-fidelity.md` on 2026-09-18 under
+`road-to-design-fidelity-proof` Phase 1.1 — the rule keeps the operative class
+list, this holds the argument behind each one.
+
+Matching is plain lower-cased substring containment on the prompt, plus fnmatch
+over the open files. Three handover classes must reach this rule: an English
+phrasing, a German one, and a prompt carrying **no** keyword at all because the
+artifact is simply attached. The last is covered by two file patterns:
+`*design.html`, the conventional handover filename, and `*.dc.html`, the Claude
+Design canvas artboard — which `*design.html` cannot match, because it compiles
+to `^(?:.*design\.html)$` and `ToDo.dc.html` does not end in `design.html`.
+Neither is `*.html`, which would fire on every HTML edit in every project and be
+strictly worse than the gap it closes; `near-plain-html-open-file` pins that
+form silent. A handover under some other filename needs one word in the prompt.
+
+Two further handover shapes carry the artifact without any of the above:
+
+- **A capability URL.** A published artifact is handed over as a link, not a
+  file — so `phrase: "claude.site/artifacts"` fires on the *published-artifact
+  path*, not on the host. `claude.ai` alone is a chat link and must stay quiet:
+  a keyword on the bare domain would fire on "I pasted this from claude.ai",
+  which is a conversation reference, not a spec.
+- **A design-system directory.** `path_prefix: ".claude/design-system/"` — the
+  conventional location for a handed-over token/component set. The prefix is the
+  vendor-scoped directory, never a bare `design-system/`, which is a normal
+  source folder in a large fraction of frontend repos.
+
 ### The withdrawn builder-URL trigger
 
 A page built in Lovable / v0 / bolt and handed over as a share link is a

package/dist/agent-src/rules/autonomous-execution.md

@@ -47,18 +47,25 @@ Litmus: does the directive name a single concrete deliverable? Yes → task-scop
 
 A new instruction from the user mid-flight is **not** a continuation — see [`user-interrupt-priority`](user-interrupt-priority.md) for the mandatory STOP → run new task → ASK before resume protocol. Autonomy never authorizes silent-resume of the prior task.
 
-## Validation-loop budget — hard cap N=3 per target
+## Validation-loop budget — `execution.fix_loop_max`, default 10, and a ladder
 
 **Validation target** = a single identifiable artefact (file path, lint rule ID, test name, CI sub-task name) — natural-language clusters ("the linter stuff") don't count.
 
 ```
-3 CONSECUTIVE FAILED ATTEMPTS ON THE SAME VALIDATION TARGET → STOP.
-SURFACE THE 3 ATTEMPTS + BLOCKING ISSUE. ASK USER FOR GUIDANCE.
-DO NOT ITERATE BEYOND N=3 WITHOUT EXPLICIT USER APPROVAL.
-COUNTER RESETS ONLY ON A DIFFERENT TARGET OR USER-APPROVED CONTINUATION.
+THE BOUND TRIGGERS A STRATEGY CHANGE, NEVER A QUESTION.
+ATTEMPTS 1-3 — ROOT-CAUSE PLUS A TARGETED FIX.
+ATTEMPTS 4-6 — A MANDATORY STRATEGY SHIFT. REPEATING THE APPROACH IS NOT AN ATTEMPT,
+IT IS THE SAME ATTEMPT AGAIN.
+ATTEMPTS 7-10 — ESCALATE INDEPENDENTLY: A SECOND SESSION, A PROVIDER-DIVERSE
+REVIEWER, THE COUNCIL, THE TEAM, OR A ROLLBACK OF THE SLICE.
+AT THE BOUND, IN ORDER: A NEW STRATEGY FROM THE ESCALATION → A NEW EPOCH ·
+AN INDEPENDENT PHASE AVAILABLE → CONTINUE IT · THE RESIDUE OWNER-OWNED →
+ONE NATIVE ASK · AN EXTERNAL PREREQUISITE OBJECTIVELY MISSING → `BLOCKED`
+WITH EVIDENCE · OTHERWISE → A NEW EPOCH.
+NO RUNG MAPS A COUNT TO AN OWNER ASK. A COUNT IS NOT A REASON TO ASK.
 ```
 
-Failed attempt = an iteration that did not move the target red → green; tuning the tool around the target counts as an attempt.
+Failed attempt = an iteration that did not move the target red → green; tuning the tool around the target counts as one. The bound is `execution.fix_loop_max` (default 10, overridable globally, per project and per prompt). Council and team verdicts append to the run's `## Decisions`. Bands, the five bound outcomes and how to read a red: [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
 ### Antipattern — allowlist-growth as silent budget bypass
 
@@ -67,9 +74,9 @@ ALLOWLIST > 20 ENTRIES IN ONE SESSION = THE LINTER IS WRONG.
 STOP. PROPOSE LINTER REDESIGN OR REMOVAL. DO NOT EXPAND THE ALLOWLIST FURTHER.
 ```
 
-Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Enforced at tool-call time by the `block-config-weakening` PreToolUse guard (`src/scripts/hooks/block_config_weakening.ts`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**: it counts allowlist entries added per session, warns from 5, and blocks past 20. It is *bound* on augment and cowork as well, and ignored there — `host_semantics.ts` verifies claude alone, and both trampolines discard dispatcher output and `exit 0` unconditionally. Everywhere else the cap is model-carried and "enforced at tool-call time" is not a claim this rule can make. **Corrected 2026-08-17 in both directions:** this sentence used to certify augment, claude and cowork as the enforcing set (an over-claim of two hosts) and to explain the rest with "the guard has nowhere to bind" (false for cursor, cline and gemini, whose native pre-tool events `native_event_aliases` already maps onto `pre_tool_use` — unbound, not unbindable; only windsurf and copilot have no alias row). The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md). Run `agent-config hooks:status` to see which slots are bound on the host you are actually on — the sibling rules `git-history-discipline` and `evaluator-independence` qualify the identical slot, and an unqualified claim here would read as a guarantee the manifest does not give. Baselines and budget thresholds warn only — a rising count there may be a legitimate ratchet reset, which the edit alone cannot distinguish. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
+Crossing 20 entries spends the whole fix-loop bound for that target at once — fix the tool shape, not the list. Carried by the `block-config-weakening` PreToolUse guard, which blocks **on `claude` only** and is model-carried everywhere else; run `agent-config hooks:status` for the host you are on. Verify with the narrowest tool that proves the target green — a `curl` or Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through — never a meta-pipeline as per-iteration probe. Host reach, failed-attempt detail, suppression-sweep equivalents and adaptive effort (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
-Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, N=3 mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
+Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, fix-loop bound and epoch mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also

package/dist/agent-src/rules/delegation-policy.md

@@ -64,68 +64,46 @@ primitive → run in-session (clean no-op).
 
 1. **Decompose** the task into independent / ordered slices.
 2. **Tier-size** each slice (`lite|medium|high`) per the classification context —
-   never the orchestrator's own session tier (the cost win is the per-call
-   downsize; see [`subagent-routing`](../contexts/execution/subagent-routing.md)).
-   Where `subagents.model_ceiling` caps the tier and the slice does not fit under
-   it, the worker **escalates and never silently delivers the degraded result**;
-   the orchestrator re-slices, runs in-session, or surfaces the ceiling to the
-   human, and never raises the ceiling itself (class C — `settings:set` refuses
-   it by construction). Absent is *uncapped*, never a low cap. Full contract:
+   never the orchestrator's own session tier
+   ([`subagent-routing`](../contexts/execution/subagent-routing.md)). Where
+   `subagents.model_ceiling` caps the tier and the slice does not fit, the worker
+   **escalates and never silently delivers the degraded result**; the
+   orchestrator never raises the ceiling itself, and absent is *uncapped*.
    [`subagent-boundary § The model ceiling`](../docs/contracts/subagent-boundary.md).
 3. **Dispatch** via the form gate + matching `subagent-orchestration` mode
    (independent → do-in-parallel; ordered → do-in-steps; risk/correctness →
    + judge; UI-heavy → live-app judge, efficacy-gated).
 4. **Verify** every return per
    [`verify-budget`](../contexts/execution/verify-budget.md); the cross-model
-   judge Iron Law and the N=3 budget ([`autonomous-execution`](autonomous-execution.md))
+   judge Iron Law and the fix-loop bound ([`autonomous-execution`](autonomous-execution.md))
    are never lifted.
 5. **Respect the failure-type stop and the ordering gate** — two consecutive
    verification-failed returns from one subagent type stop that type for the
-   session (an application of the N=3 budget, no new mechanism), and an
+   session (an application of the fix-loop bound, no new mechanism), and an
    ordered slice never dispatches before its declared parent's return is
    verified. Both per
    [`subagent-steering`](../contexts/execution/subagent-steering.md).
-6. **Record** telemetry after each dispatch — on hook-capable hosts the
-   `orchestration-record` concern (`post_tool_use`) emits the line
-   deterministically for every Agent/Task completion; on hosts without the
-   slot, run `orchestration_record` yourself (one validated line: spawn_count,
-   token_delta + provenance, tier, task_class) per
-   [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
-   § Emit. Measured before the hook existed: 1 of 370 dispatches captured —
-   the model-carried path alone leaves the value question unmeasured.
+6. **Record** telemetry after each dispatch — the `orchestration-record` concern
+   emits it on hook-capable hosts; elsewhere run `orchestration_record` yourself
+   per [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
+   § Emit. Measured before the hook existed: 1 of 370 dispatches captured.
 
 ## Carriers — how this rule reaches a session (and what stays model-carried)
 
-No host runs the tier-2 rule router, so this file's triggers alone never load
-it. The obligation travels on three carriers instead: the always-loaded
-AGENTS.md line (delegate-by-default + end-review), the `delegation-nudge`
-concern on `user_prompt_submit` (runs `classifyTask` on cheap prompt signals
-and injects a one-line verdict ONLY when the classifier says
-`do-in-parallel`/`do-in-steps` — silence otherwise; delivery on
-`user_prompt_submit` is end-to-end verified), and the `end-review-nudge`
-concern on `stop` (ONE `review_skipped` telemetry line per mutating
-no-review session — verified; its advisory line reaches the dispatcher
-output, but host-side forwarding of stop-slot context to the model is
-unverified, so the model-facing end-review carrier is the AGENTS.md line
-plus this telemetry). The
-capability gate itself resolves from the committed host registry merged with a
-live environment probe in `src/scripts/_lib/host_capability.ts`
-(`probeHostCapabilities` — capability is a fact about the host, never a
-settings override).
+No host runs the tier-2 rule router, so this file's triggers alone never load it.
+The obligation travels on three carriers instead: the always-loaded AGENTS.md
+line, the `delegation-nudge` concern on `user_prompt_submit`, and the
+`end-review-nudge` concern on `stop`. Capability resolves from the committed host
+registry merged with a live probe — never from a settings override.
 
 **Never read a `false` capability as a host limitation without checking where it
-came from.** The registry holds one row, so on every other host all six fields
-are the all-false safe default — which records that *nobody answered*, not that
-the host cannot spawn. `agent-config routing:doctor [--platform <host>]` prints
-the value **and** its provenance per field (`registry` = a committed observation
-this repo made once · `live-probe` = established in this process · `default` =
-no answer). Run it before concluding delegation is unavailable here; the
-same-shaped wrong guess about the council is the incident
-[`council-availability`](council-availability.md) exists for. What stays
-model-carried, honestly: the decomposition itself, the per-return
-verification, and every dispatch on hosts without hook slots. The nudges are
-advisory by design — whether they change behaviour is measured by the
-telemetry, not assumed.
+came from.** The registry holds one row, so on every other host the fields are the
+all-false safe default, which records that *nobody answered*. Run `agent-config
+routing:doctor [--platform <host>]`, which prints the value **and** its
+provenance, before concluding delegation is unavailable here. What stays
+model-carried: the decomposition, the per-return verification, and every dispatch
+on hosts without hook slots. Per-carrier detail and what each one verifies:
+[`auto-orchestration-activation § Carriers`](../contexts/execution/auto-orchestration-activation.md).
 
 ## Scope — does NOT
 

package/dist/agent-src/rules/design-fidelity.md

@@ -37,6 +37,8 @@ workspaces: [engineering]
 packs: [engineering-base, frontend-design]
 collision_ok:
   "mockup": "a provided mockup is the spec — 1:1 fidelity floor"
+enforced_by:
+  - "instruction-only: no artifact in this tree records a fidelity comparison. lint_design_slop and lint_design_quality measure generic AI-aesthetic tells and accessibility; neither reads the handover, so a 1:1 claim is model-carried"
 # obligation: line 58
 obligation_frequency: "per-edit"
 ---
@@ -68,6 +70,10 @@ THE IMAGE IS THE SPEC AND THE 1:1 FLOOR ABOVE APPLIES TO IT UNCHANGED.
 WHERE THE ARTIFACT'S OWN MARKUP / CSS / JS IS STACK-COMPATIBLE, ADAPTING
 THAT CODE IS THE DEFAULT — A FROM-SCRATCH RE-DERIVATION IS A DEVIATION
 AND NEEDS THE SAME CONFIRMATION AS A SWAPPED CONTROL.
+A 1:1 CLAIM IS DISCHARGED BY A COMMITTED ARTIFACT NAMING, PER HANDOVER
+CHAPTER, THE EVIDENCE TAKEN — NEVER BY A BEHAVIOR TEST, AND NEVER BY A
+SENTENCE IN A REPLY. A GREEN SUITE THAT MEASURED BEHAVIOR ANSWERS A
+QUESTION FIDELITY DID NOT ASK.
 ```
 
 The qualifier is load-bearing, not hedging. Unqualified, the screenshot line
@@ -140,51 +146,40 @@ porting, or modifying UI to match it.
 
 ## Routing — an attached artifact is a trigger, an attached HTML file is not
 
-Matching is plain lower-cased substring containment on the prompt, plus fnmatch
-over the open files. Three handover classes must reach this rule: an English
-phrasing, a German one, and a prompt carrying **no** keyword at all because the
-artifact is simply attached. The last is covered by two file patterns:
-`*design.html`, the conventional handover filename, and `*.dc.html`, the Claude
-Design canvas artboard — which `*design.html` cannot match, because it compiles
-to `^(?:.*design\.html)$` and `ToDo.dc.html` does not end in `design.html`.
-Neither is `*.html`, which would fire on every HTML edit in every project and be
-strictly worse than the gap it closes; `near-plain-html-open-file` pins that
-form silent. A handover under some other filename needs one word in the prompt.
-
-Two further handover shapes carry the artifact without any of the above:
-
-- **A capability URL.** A published artifact is handed over as a link, not a
-  file — so `phrase: "claude.site/artifacts"` fires on the *published-artifact
-  path*, not on the host. `claude.ai` alone is a chat link and must stay quiet:
-  a keyword on the bare domain would fire on "I pasted this from claude.ai",
-  which is a conversation reference, not a spec.
-- **A design-system directory.** `path_prefix: ".claude/design-system/"` — the
-  conventional location for a handed-over token/component set. The prefix is the
-  vendor-scoped directory, never a bare `design-system/`, which is a normal
-  source folder in a large fraction of frontend repos.
-- **A third-party builder's share link — UNCOVERED, deliberately.** A page built
-  in Lovable / v0 / bolt and handed over as a link is a finished spec and this
-  rule does not route it; the trigger was tried and withdrawn as over-broad.
-  Until then the class needs one word in the prompt. Why, what closes it, and
-  the row that pins the broad form silent:
-  [`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
-
-Every class here carries its own near-miss row in `ROUTING_MATRIX`
-([`design_fidelity_routing.test.ts`](../../tests/scripts/design_fidelity_routing.test.ts));
-extending the set without one is how an over-broad trigger lands. Which row, and
-why: [`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
-
-**The near-miss must test the direction the new trigger opens, not a direction
-that was already closed** — apply this before writing a trigger, not after. The
-worked example and the review that produced the rule:
+Matching is lower-cased substring containment on the prompt plus fnmatch over
+the open files. Five classes reach this rule without a keyword being typed: the
+filename patterns `*design.html` and `*.dc.html`, the published-artifact path
+`claude.site/artifacts`, the directory prefix `.claude/design-system/`, and the
+English and German handover phrasings. A handover under any other filename, and
+a third-party builder's share link, need one word in the prompt — the
+builder-URL trigger was tried and **withdrawn** as over-broad, and stays pinned
+silent rather than merely absent.
+
+Every class carries its own near-miss row in `ROUTING_MATRIX`
+([`design_fidelity_routing.test.ts`](../../tests/scripts/design_fidelity_routing.test.ts)),
+and the row must test the direction the NEW trigger opens, not one that was
+already closed — apply that before writing a trigger, not after. Why each class
+is shaped as it is, why `*.html` and a bare builder host are refused, and the
+worked example behind the direction rule:
 [`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
 
 Body migrated to [`guideline:design-fidelity-mechanics`](../guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — URL / live-page handover (extraction into the `design-system.json` contract before the first UI write, the retrieval order, the lock boundary), surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
+## Honest enforcement — `instruction-only`
+
+Nothing records a fidelity comparison. The estate's two design linters measure
+generic AI-aesthetic tells (`lint_design_slop`) and accessibility
+(`lint_design_quality`); neither opens the handover, so nothing can tell a
+proven 1:1 from an asserted one. The proof clause in the Iron Law is therefore
+model-carried, and the committed matrix
+([`design-review`](../skills/design-review/SKILL.md) § Fidelity proof) is the
+control — a reviewer can open it, which is more than any gate here does.
+
 ## See also
 
 - [`brand-source-of-truth`](brand-source-of-truth.md) / [`brand-consistency`](brand-consistency.md) — same precedence shape, for registered brand tokens.
 - [`minimal-safe-diff`](minimal-safe-diff.md) — the code-diff analog (smallest change; no drive-by restructure).
 - [`existing-ui-audit`](../skills/existing-ui-audit/SKILL.md) / [`ui-audit-gate`](ui-audit-gate.md) — inventory existing components before adding new ones.
+- [`design-review`](../skills/design-review/SKILL.md) § Fidelity proof — the matrix that discharges the proof clause.
 - [`ask-when-uncertain`](ask-when-uncertain.md) — the one-question, numbered-option surfacing shape.

package/dist/agent-src/rules/evaluator-independence.md

@@ -52,19 +52,13 @@ A SECOND EVALUATION OF THE SAME WORK IN ONE TURN IS VERDICT SHOPPING, NOT RIGOUR
 
 ## The failure this exists to stop
 
-Measured, once, at maximum cost (conformance audit 2026-08-06):
-
-> The agent dispatched a "blind reviewer" over its own change. It wrote that
-> reviewer's prompt itself, put **"NO-FINDINGS is expected and welcome"** into it,
-> and narrowed the scope to four files it chose. The reviewer returned
-> NO-FINDINGS. That honest-null was committed as **binding gate evidence**. An
-> unsteered pass over the same delta later found 5 findings, one of them
-> critical, already live on the trunk.
-
-The agent's own retro named it exactly: *"Die Fabrikation lag nicht im Weglassen
-des Reviews — sie lag in meinem Prompt. Ich habe die Antwort vorgeladen und dann
-als Evidenz verbucht."* The review ran. The process was followed. The evidence
-was manufactured anyway.
+Measured once, at maximum cost: an agent wrote its own "blind reviewer" prompt,
+put *"NO-FINDINGS is expected and welcome"* into it, narrowed the scope to four
+files it chose, and committed the resulting honest-null as **binding gate
+evidence**. An unsteered pass over the same delta later found 5 findings, one
+critical, already live on the trunk. The review ran. The process was followed.
+The evidence was manufactured anyway. Full record:
+[`evaluator-independence-mechanics § The audited failure`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
 ## What this requires
 
@@ -81,10 +75,6 @@ was manufactured anyway.
 
 ## The softer form — stating an expectation without stating the verdict
 
-The Iron Law forbids **authoring the verdict** into an evaluator's prompt. There is a
-weaker move that evades it while doing the same work, and it is the one an orchestrator
-reaches for without noticing: **stating an expectation.**
-
 ```
 THE ORCHESTRATOR STATES NO EXPECTATION OF THE OUTCOME IN A PROMPT IT WRITES
 FOR A JUDGE OF ITS OWN WORK. NOT THE VERDICT, AND NOT THE DIRECTION.
@@ -92,25 +82,37 @@ FOR A JUDGE OF ITS OWN WORK. NOT THE VERDICT, AND NOT THE DIRECTION.
 "I EXPECT NO FINDINGS" — NONE OF THESE NAME A VERDICT, AND ALL OF THEM SUPPLY ONE.
 ```
 
-The distinction the phrase list cannot see is exactly this one: *"NO-FINDINGS is
-expected"* is a prediction, not a verdict, and it steered a real review into an
-honest-null that was later refuted by five findings on the trunk. A prompt that says what
-the author thinks the answer is has authored the answer, whatever grammatical mood it
-used.
+Write the scope, the diff and the question. Nothing about how it is expected to
+come out — including a reassurance that no outcome is expected, which is an
+expectation stated in the negative. Why the phrase list cannot see this:
+[`evaluator-independence-mechanics § The softer form`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
-**What to write instead:** the scope, the diff, and the question. Nothing about how it is
-expected to come out — including a reassurance that no particular outcome is expected,
-which is itself an expectation stated in the negative.
+## Tests are evaluators
+
+```
+A TEST IS AN EVALUATOR, AND AN IMPLEMENTER WHO WROTE IT HAS AUTHORED ITS VERDICT.
+THE ACCEPTANCE BEHAVIOUR IS NAMED, THE TEST IS WRITTEN INDEPENDENTLY, IT IS SHOWN
+RED, THEN IT IS IMPLEMENTED AGAINST, THEN AN INDEPENDENT INSTANCE VALIDATES GREEN.
+THE IMPLEMENTER NEVER SILENTLY WEAKENS AN ASSERTION, DELETES, SKIPS OR XFAILS A
+FAILING TEST, LOWERS A THRESHOLD, OR CHANGES FIXTURE SEMANTICS TO FIT THE CODE.
+WHERE THE TEST LOOKS WRONG: EVIDENCE → INDEPENDENT TEST REVIEW → COUNCIL OR TEAM
+→ CHANGE ONLY AFTER AN INDEPENDENT VERDICT. THE OWNER IS NOT THE ARBITER.
+```
+
+**Five levels:** L0 same agent — **fallback only** · L1 another session, same
+model · L2 another model · L3 another provider · L4 a multi-provider council or
+team. Critical behavior — security, authority, data loss, merge control — targets
+**L3 or L4 wherever two providers are configured**, read from `agent-config
+council:status`'s live provider count, never assumed. Levels, workflow, the
+weakening ladder and the validator's checklist:
+[`evaluator-independence-mechanics § Tests are evaluators`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
 ## When it does NOT fire
 
-- **Ordinary parallel fan-out.** Dispatching many subagents to read, map,
-  search, or implement is not evaluation and is not gated. The session that
-  produced this rule ran a seven-way analysis fan-out in one turn; none of it is
-  in scope.
+- **Ordinary parallel fan-out.** Dispatching subagents to read, map, search or
+  implement is not evaluation and is not gated.
 - A review **a human** commissioned or whose prompt a human wrote.
-- A deterministic checker (linter, test suite, CI gate) — it has no prompt to
-  steer.
+- A deterministic checker (linter, test suite, CI gate) — no prompt to steer.
 
 ## Enforcement — honest scope
 
@@ -119,26 +121,18 @@ ITEM 1 IS ENFORCED. ITEMS 2, 3 AND 4 ARE NOT — 4 ONLY WARNS.
 NEVER CITE A GUARD THAT WARNS AS ONE THAT BLOCKS.
 ```
 
-[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts) is a
-`pre_tool_use` concern reading the prompt the agent is about to send.
-
-- **Item 1 (pre-loaded verdict) BLOCKS** — `EXIT_BLOCK` at `:253`, on the one
-  host that honours a deny.
-- **Item 4 (second self-scoped evaluation) WARNS** — `EXIT_ALLOW` with
-  `decision: "warn"` (`:301-324`). The turn-budget clause is advisory.
-- **Item 2 (an honestly chosen scope) is enforced by nothing.** A narrowed scope
-  is not decidable from the prompt alone.
-- **Item 3 (recording the prompt with the verdict) IS enforced** by
-  [`check_review_prompt_binding.ts`](../../src/scripts/check_review_prompt_binding.ts),
-  with one limit that matters: **omission beats substitution** — not committing
-  the prompt package drops the round out of the checkable set with no finding.
+[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts), a
+`pre_tool_use` concern, BLOCKS item 1 on the one host that honours a deny and
+only WARNS on item 4. Item 2 is enforced by nothing — a narrowed scope is not
+decidable from a prompt. Item 3 is enforced by
+[`check_review_prompt_binding.ts`](../../src/scripts/check_review_prompt_binding.ts),
+where **omission beats substitution**: not committing the prompt package drops
+the round out of the checkable set with no finding.
 
 Where the guard does not deny, every item is model-carried. Never claim the
-review ran as if it were verified.
-
-Why each branch behaves that way, the phrase-list and turn-boundary limits, the
-four host states, the two corrections this section has taken, and the
-11-of-19 measurement behind item 3:
+review ran as if it were verified. Per-branch reasoning, the phrase-list and
+turn-boundary limits, the four host states and the 11-of-19 measurement behind
+item 3:
 [`evaluator-independence-mechanics`](../guidelines/agent-infra/evaluator-independence-mechanics.md).
 
 ## See also

package/dist/agent-src/rules/test-first.md

@@ -0,0 +1,41 @@
+---
+type: "auto"
+tier: "1"
+description: "A behavior change gets a failing test first — and the test must fail for the intended reason before any implementation is written"
+triggers:
+  - keyword: "tdd"
+  - keyword: "test-first"
+  - keyword: "failing test"
+  - keyword: "regression test"
+  - keyword: "characterization test"
+routes_to:
+  - "skill:test-driven-development"
+enforced_by:
+  - "instruction-only: no gate sees which was written first; check_test_delta and check_test_weakening catch an absence, never an order."
+obligation_frequency: "per-edit"
+workspaces: [agent-config-maintainer, engineering]
+packs: [engineering-base]
+---
+
+# Test First
+
+```
+A BEHAVIOR CHANGE GETS A FAILING TEST FIRST, WHERE A TEST IS MEANINGFUL.
+A BUG GETS A REPRODUCING REGRESSION TEST FIRST.
+UNCERTAIN LEGACY GETS A CHARACTERIZATION TEST FIRST.
+THE TEST MUST FAIL FOR THE INTENDED REASON — A TEST NEVER SEEN RED HAS
+UNKNOWN SENSITIVITY AND IS NOT EVIDENCE. REFACTOR ONLY AFTER GREEN.
+```
+
+[`test-driven-development`](../skills/test-driven-development/SKILL.md) carries the
+procedure; this rule decides **when** it is owed: for consumer code, for this
+package's own code, scripts and hooks, **and for governance changes whose
+projection, routing or lint behavior is testable** — the clause a reader escapes
+with *the artifact is markdown, so there is nothing to test*. Markdown is not the
+discriminator: a rule whose triggers decide what loads, a projection a gate reads and a lint whose verdict flips are executable contracts in a prose extension.
+
+**Where there is genuinely no executable contract** — a paragraph stating a
+reason — the obligation is an independent *review*, never a fake test: an
+assertion over prose written to satisfy this rule manufactures the evidence it exists to require.
+
+**Does NOT fire on** a rename, typo, formatting or comment-only edit · a change the user fenced this turn · a spike deleted before it lands. **Honest enforcement — `instruction-only`.** No gate sees which was written first: `check_test_delta` and `check_test_weakening` catch an absence, never an order. Model-carried; the red-first discipline is the control.

package/dist/agent-src/rules/ui-audit-gate.md

@@ -71,8 +71,7 @@ EXISTING-UI-AUDIT RUNS FIRST. ALWAYS.
 `state.ui_audit` is a non-empty dict carrying at least one of:
 
 - `components_found` — inventory entries from `existing-ui-audit`.
-- `greenfield: true` plus `greenfield_decision` ∈
-  `{scaffold, bare, external_reference}`.
+- `greenfield: true` plus a `greenfield_decision` ∈ `GREENFIELD_DECISIONS`.
 - Legacy `components` alias — back-compat.
 
 `null` or `{}` is **not** findings; empty dict is rejected on purpose.

package/dist/agent-src/skills/accessibility-auditor/data/aria-patterns.csv

@@ -3,7 +3,7 @@ Modal dialog,modal dialog overlay popup confirm,dialog role + aria-modal,"role=d
 Combobox / autocomplete,combobox autocomplete select search suggest dropdown,combobox + listbox popup,"role=combobox aria-expanded aria-controls aria-activedescendant; Down opens list, Enter selects, Esc closes; results announced via live region count","WCAG 4.1.2, 1.3.1",Re-implementing as div+onclick without keyboard model,https://www.w3.org/WAI/ARIA/apg/patterns/combobox/
 Tabs,tabs tabpanel tablist switch view,tablist/tab/tabpanel triad,"role=tablist/tab/tabpanel, aria-selected, tab order: one tabstop into list then Arrow keys; panel labelled by its tab","WCAG 2.1.1, 4.1.2",Each tab a separate Tab stop; panels not labelled,https://www.w3.org/WAI/ARIA/apg/patterns/tabs/
 Accordion / disclosure,accordion disclosure expand collapse faq section,button + aria-expanded,Header is a real button with aria-expanded + aria-controls; content region labelled; Enter/Space toggle,"WCAG 4.1.2, 1.3.1",Heading-with-onclick; hiding content with display:none while aria-expanded=true,https://www.w3.org/WAI/ARIA/apg/patterns/accordion/
-Menu / dropdown actions,menu dropdown actions kebab context,menu button + menu/menuitem,"menubutton with aria-haspopup=menu aria-expanded; Arrow navigation, Esc closes and returns focus; menuitem (not links styled as menu)",WCAG 2.1.1,Using role=menu for site navigation (use nav+links),https://www.w3.org/WAI/ARIA/apg/patterns/menubutton/
+Menu / dropdown actions,menu dropdown actions kebab context menubutton menu-button,menu button + menu/menuitem,"menu button with aria-haspopup=menu aria-expanded; Arrow navigation, Esc closes and returns focus; menuitem (not links styled as menu)",WCAG 2.1.1,Using role=menu for site navigation (use nav+links),https://www.w3.org/WAI/ARIA/apg/patterns/menu-button/
 Toast / status message,toast notification snackbar status alert,status / alert live regions,"role=status (polite) for confirmations, role=alert (assertive) sparingly for errors; never move focus to a toast; pause on hover/focus; allow dismissal","WCAG 4.1.3, 2.2.1",Focus-stealing toasts; auto-dismiss with no persistence option for critical info,https://www.w3.org/WAI/ARIA/apg/patterns/alert/
 Data table,table grid sortable data rows columns,table semantics + aria-sort,Native table elements with th scope; sortable headers are buttons inside th with aria-sort on the th; caption or aria-label names the table,WCAG 1.3.1,Div-grid for tabular data; sort state only as an icon,https://www.w3.org/WAI/ARIA/apg/patterns/table/
 Form validation feedback,form error validation invalid message field,described-by + alert summary,aria-invalid + aria-describedby on the field; on submit failure move focus to first invalid field or an error-summary with anchor links; errors persist until fixed,"WCAG 3.3.1, 3.3.3, 2.4.3",Placeholder-only labels; toast-only errors,https://www.w3.org/WAI/tutorials/forms/notifications/

package/dist/agent-src/skills/accessibility-auditor/data/manifest.json

@@ -28,7 +28,7 @@
   "refresh_cadence": "quarterly",
   "upstream": {
     "repo": "derived: W3C ARIA Authoring Practices Guide + WCAG 2.2",
-    "sha": "APG 2026 / WCAG 2.2",
-    "last_checked": "2026-06-07"
+    "sha": "WCAG 2.2 W3C-REC-2024-12-12; APG continuously-published, menu-button canonical slug",
+    "last_checked": "2026-10-01"
   }
-}
+}

package/dist/agent-src/skills/ai-council/SKILL.md

@@ -271,9 +271,17 @@ Every council reply MUST contain, in this order:
    / `accept-with-modification` / `reject` / `needs-input` plus a
    one-line reason citing host evidence (file:line, ADR, contract).
    See *Critical evaluation* above.
-5. **User-facing options** — numbered block per `user-interaction`,
-   carrying the host verdict in each option, with "discard council
-   input" always present as an option.
+5. **User-facing options — CONDITIONAL, on ownership.** A conclusive
+   **technical** verdict emits **no** options block: it is a resolution,
+   and handing it over as options routes a technical decision to a person
+   because it was hard (ADR-268 § 10). The block is owed when the verdict
+   is owner-owned (`product-owned`, `business-owned`, `destructive-owned`)
+   or when the council did not converge — then it is a numbered block per
+   `user-interaction`, carrying the host verdict in each option, with
+   "discard council input" always present. Convergence is read from the
+   record, never inferred: a record that does not say whether its members
+   converged is itself the finding. Checkable in both directions with
+   `./scripts-run src/scripts/council_record_shape <record.md>`.
 
 The host agent NEVER ships council output as its own reasoning, and
 NEVER ships the host verdict as council output. Provider attribution