@event4u/agent-config 16.1.0 → 16.2.0

package/src/scripts/ci_settle.ts

@@ -237,9 +237,30 @@ export function classifyPoll(stdout: string, stderr: string, status: number | nu
         return { kind: 'pending', total: rows.length, done };
     }
     const bad = new Set(['FAILURE', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']);
-    const failing = rows
-        .filter((r) => bad.has(String(r.conclusion).toUpperCase()))
-        .map((r) => String(r.name ?? '?'));
+    // A concurrency group that supersedes its own earlier run leaves TWO rows
+    // under one name: the superseded one CANCELLED, the one that counts
+    // SUCCESS. The forge reports that check green; this classifier reported the
+    // whole PR red, because CANCELLED sat in `bad` and nothing looked at the
+    // twin. Measured 2026-10-01 on PR #2135 (`lint commit subjects`), where the
+    // false red cost a run a diagnosis it did not owe.
+    //
+    // The reprieve is deliberately the narrowest one that fixes it: CANCELLED
+    // only, and only when a row of the SAME NAME concluded SUCCESS. A genuine
+    // cancellation — a human stopping a run, a timeout killing one — has no
+    // successful twin and stays failing. Widening this to every bad conclusion,
+    // or to CANCELLED unconditionally, would trade a false red for a false
+    // green, which is the worse error in a tool whose output is acted on.
+    const nameOf = (r: (typeof rows)[number]): string => String(r.name ?? '?');
+    const concl = (r: (typeof rows)[number]): string => String(r.conclusion).toUpperCase();
+    const succeeded = new Set(rows.filter((r) => concl(r) === 'SUCCESS').map(nameOf));
+    const failing = [
+        ...new Set(
+            rows
+                .filter((r) => bad.has(concl(r)))
+                .filter((r) => !(concl(r) === 'CANCELLED' && succeeded.has(nameOf(r))))
+                .map(nameOf),
+        ),
+    ];
     return { kind: 'settled', failing, total: rows.length };
 }
 
@@ -293,25 +314,131 @@ function sleepSync(seconds: number): void {
     });
 }
 
-export function main(argv: readonly string[]): number {
-    const positional = argv.filter((a) => !a.startsWith('--'));
-    const pr = positional[0];
-    if (pr === undefined) {
-        process.stderr.write(
-            'usage: ci_settle <pr> [--timeout-min N] [--interval-sec N]\n' +
-                `  default --timeout-min is ${String(FOREGROUND_CEILING_MIN)}, which fits inside one foreground Bash call (600 s cap).\n` +
-                '  a longer wait is a BACKGROUND job, not a bigger number — a foreground call past the cap is killed and reports nothing.\n',
+/** The only flags this waiter honours. Anything else is a caller mistake. */
+const KNOWN_FLAGS = ['--timeout-min', '--interval-sec'] as const;
+
+const USAGE =
+    'usage: ci_settle <pr> [--timeout-min N] [--interval-sec N]\n' +
+    `  default --timeout-min is ${String(FOREGROUND_CEILING_MIN)}, which fits inside one foreground Bash call (600 s cap).\n` +
+    '  a longer wait is a BACKGROUND job, not a bigger number — a foreground call past the cap is killed and reports nothing.\n';
+
+export type ParsedArgs =
+    | { kind: 'ok'; pr: string; timeoutMin: number; intervalSec: number }
+    | { kind: 'usage'; message: string };
+
+/**
+ * Parse argv, REFUSING anything this waiter would not honour.
+ *
+ * Refusal rather than a default is the whole point. The previous parser read
+ * its two knobs with `argv.indexOf(flag)` and filtered positionals on a leading
+ * `--`, so a caller who wrote the near-universal `--timeout 1700` got two
+ * silent substitutions at once: the unknown flag was ignored, and its value —
+ * carrying no dashes — survived as a second positional and was dropped. The
+ * wait then ran for the 9-minute default while the caller believed they had
+ * asked for 28, and the resulting `DID NOT SETTLE` read as a slow CI rather
+ * than as their own typo.
+ *
+ * That is the one failure a waiter must not have. Its entire product is a
+ * verdict somebody will act on, and a verdict produced under arguments the
+ * caller did not actually give is worse than no verdict, because it looks like
+ * one. So every unrecognised flag, every unusable value and every extra
+ * positional is a usage refusal, exit 2 — the code this tool already reserves
+ * for "no verdict is claimed".
+ *
+ * `--flag=value` is accepted beside `--flag value` because it is the other
+ * spelling a caller reaches for, and refusing it would trade one silent
+ * surprise for a noisy one with no safety gained.
+ */
+export function parseArgs(argv: readonly string[]): ParsedArgs {
+    const refuse = (why: string): ParsedArgs => ({ kind: 'usage', message: `ci_settle: ${why}\n${USAGE}` });
+
+    const positional: string[] = [];
+    const given = new Map<string, string>();
+
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i] as string;
+        if (!a.startsWith('--')) {
+            positional.push(a);
+            continue;
+        }
+        const eq = a.indexOf('=');
+        const name = eq === -1 ? a : a.slice(0, eq);
+        if (!(KNOWN_FLAGS as readonly string[]).includes(name)) {
+            return refuse(
+                `unknown flag ${name}. This waiter spells its deadline --timeout-min (in MINUTES), not --timeout`,
+            );
+        }
+        if (given.has(name)) return refuse(`${name} given twice`);
+        if (eq !== -1) {
+            given.set(name, a.slice(eq + 1));
+            continue;
+        }
+        const v = argv[i + 1];
+        if (v === undefined || v.startsWith('--')) return refuse(`${name} needs a value`);
+        given.set(name, v);
+        i++;
+    }
+
+    const raw = positional[0];
+    if (raw === undefined) return refuse('no PR number given');
+    if (positional.length > 1) {
+        return refuse(
+            `unexpected argument ${JSON.stringify(positional[1])} — this tool takes exactly one positional, the PR number; ` +
+                'a flag value must follow its own flag',
         );
-        return 2;
     }
-    const num = (flag: string, dflt: number): number => {
-        const i = argv.indexOf(flag);
-        if (i === -1) return dflt;
-        const v = argv[i + 1];
-        const n = v === undefined ? NaN : parseInt(v, 10);
-        return Number.isFinite(n) && n > 0 ? n : dflt;
+
+    // Finding 1 of the 2026-10-01 R2 review: the first version of this guard
+    // validated every OPTIONAL argument and waved the mandatory one through, so
+    // the failure it exists to remove stayed reachable through the front door.
+    // `ci_settle PR-2130` parsed as ok; `gh pr view PR-2130` then exits non-zero
+    // on every poll, each one classifies as unreadable, no streak caps the loop,
+    // and the run spends its entire budget to arrive at `DID NOT SETTLE` — which
+    // is read as a slow CI rather than as the typo it is. A guard that refuses
+    // the arguments a caller may omit and accepts the one they cannot is not a
+    // guard. `#123` and a PR URL are admitted because both are what a caller
+    // copies out of the forge; a branch name is NOT, because this tool's whole
+    // verdict is bound to one head and a branch makes that binding ambiguous.
+    const pr = /^#?[0-9]+$/.test(raw)
+        ? raw.replace(/^#/, '')
+        : (/^https?:\/\/[^\s]*\/pull\/([0-9]+)(?:[/?#].*)?$/.exec(raw)?.[1] ?? null);
+    if (pr === null || pr === '0' || /^0+$/.test(pr)) {
+        return refuse(
+            `${JSON.stringify(raw)} is not a PR number — give the number itself (2130), #2130, or the pull-request URL`,
+        );
+    }
+
+    const num = (flag: string, dflt: number): number | string => {
+        const v = given.get(flag);
+        if (v === undefined) return dflt;
+        const unit = flag === '--timeout-min' ? 'minutes' : 'seconds';
+        if (!/^[0-9]+$/.test(v)) return `${flag} wants a whole number of ${unit}, got ${JSON.stringify(v)}`;
+        const n = parseInt(v, 10);
+        // Finding 2: the parser this replaced guarded with `Number.isFinite`, and
+        // the digits-only test that replaced it does not. A long enough run of
+        // digits parses to Infinity, clears `n > 0`, and makes `deadline`
+        // unreachable — an unbounded wait in a tool whose contract is that it
+        // always returns a stated verdict or a stated non-verdict.
+        if (!Number.isFinite(n)) return `${flag} is too large to be a number of ${unit}`;
+        if (n <= 0) return `${flag} wants a positive number, got ${v}`;
+        return n;
     };
+
     const timeoutMin = num('--timeout-min', FOREGROUND_CEILING_MIN);
+    if (typeof timeoutMin === 'string') return refuse(timeoutMin);
+    const intervalSec = num('--interval-sec', 60);
+    if (typeof intervalSec === 'string') return refuse(intervalSec);
+
+    return { kind: 'ok', pr, timeoutMin, intervalSec };
+}
+
+export function main(argv: readonly string[]): number {
+    const parsed = parseArgs(argv);
+    if (parsed.kind === 'usage') {
+        process.stderr.write(parsed.message);
+        return 2;
+    }
+    const { pr, timeoutMin, intervalSec } = parsed;
     if (timeoutMin > FOREGROUND_CEILING_MIN) {
         // Said once, up front, rather than discovered when the call is killed:
         // a truncated wait produces no line at all, so the warning has to come
@@ -322,7 +449,6 @@ export function main(argv: readonly string[]): number {
                 'the deadline and will report nothing — run it as a background job for a wait this long.\n',
         );
     }
-    const intervalSec = num('--interval-sec', 60);
 
     // Up front, because waiting nine minutes to learn the PR was merged before
     // the wait began is the expensive way to find out.

package/src/scripts/closure_scan.ts

@@ -19,6 +19,8 @@
  *   `unpicked-alternative`     "either X or Y", "option A … option B"
  *   `unchecked-assumption`     "assuming", "presumably", "probably fine"
  *   `missing-verify`           an open step with no `verify:` line
+ *   `unfalsifiable-verify`     a step WITH a `verify:` line whose oracle
+ *                              cannot say no
  *   `ambiguous-acceptance`     a vague acceptance criterion (improve / clean up
  *                              / best practices / handle errors properly)
  *   `contradictory`            "contradicts", "conflicts with", "but also"
@@ -35,6 +37,24 @@
  * Exit codes: 0 no open decisions · 1 open decisions found · 2 bad argv.
  * Finding open decisions is the POINT, so `--strict` is what makes exit 1 a
  * failure for a caller that wants one; the default is a report.
+ *
+ * ONE FAMILY IS A LISTING AND NEVER A GATE. `unfalsifiable-verify` exits 0
+ * unconditionally — under `--strict` too — and that is a property of the
+ * family, not a flag a caller can flip. The reason is the one this script's
+ * own header already records about a detector that fires on ordinary prose,
+ * sharpened by a measurement: on 2026-09-29 the active roadmap tree carried
+ * 230 clauses and 6 machine-decidable expectations — 97.4% of them state no
+ * oracle — so a family promoted to a gate would red all but a handful of
+ * roadmaps at once, and the cheapest repair for a gate that reds on
+ * everything is to weaken it until it finds nothing. The exemption is
+ * narrow: a `tbd` in the same corpus still goes red under `--strict`.
+ *
+ * The figure is the MEASURED one, not the commissioning roadmap's. That
+ * roadmap asserted zero expectations tree-wide; a reading refuted it — six
+ * exist, all six written before the grammar was legal, and three of them are
+ * that roadmap's own verify lines. The producing
+ * command is `./scripts-run src/scripts/roadmap_verify_share`, so the number
+ * above is re-derivable rather than remembered.
  */
 
 import * as fs from 'node:fs';
@@ -42,6 +62,8 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
+import { parseVerifyClause, type VerifyClause } from './_lib/verify_clause.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 const _PROG = 'closure_scan';
 
@@ -50,6 +72,7 @@ export type Kind =
     | 'unpicked-alternative'
     | 'unchecked-assumption'
     | 'missing-verify'
+    | 'unfalsifiable-verify'
     | 'ambiguous-acceptance'
     | 'contradictory'
     | 'product-semantics'
@@ -74,6 +97,7 @@ export const OWNERSHIP_BY_KIND: Readonly<Record<Kind, string>> = {
     'unpicked-alternative': 'contested-technical',
     'unchecked-assumption': 'reversible-technical',
     'missing-verify': 'deterministic',
+    'unfalsifiable-verify': 'deterministic',
     'ambiguous-acceptance': 'reversible-technical',
     contradictory: 'contested-technical',
     'product-semantics': 'product-owned',
@@ -88,6 +112,73 @@ export const OWNER_ROUTED: ReadonlySet<string> = new Set([
     'destructive-owned',
 ]);
 
+/**
+ * Families that report and never gate — `--strict` cannot make these exit 1.
+ *
+ * A set rather than a flag, so the exemption is a property of the family that a
+ * caller cannot accidentally promote. See the header for the measurement that
+ * makes promotion a bad trade today.
+ */
+export const NON_BLOCKING_KINDS: ReadonlySet<Kind> = new Set<Kind>(['unfalsifiable-verify']);
+
+/**
+ * Command heads whose exit status is decided by something other than the
+ * property a step is claiming.
+ *
+ * Deliberately short. `echo`, `true` and `printf` cannot fail at all; `cat`,
+ * `ls`, `pwd` and `date` fail only on a missing path or a broken clock, never
+ * on the CONTENT a step asserts. Anything whose exit code already tracks the
+ * claim — `grep` (1 on no match), a linter, a test runner — is absent on
+ * purpose: including it would turn this listing into a census of every verify
+ * line in the tree, which is step 2.2's instrument, not this one.
+ */
+const FIXED_OUTPUT_HEADS: ReadonlySet<string> = new Set(['echo', 'true', 'printf', 'cat', 'ls', 'pwd', 'date']);
+
+/**
+ * Why this clause's oracle cannot say no — or `null` when it can.
+ *
+ * Three shapes, each one a way of carrying a `verify:` line that reads as
+ * verification and decides nothing.
+ *
+ * THE COUNT IS A LOWER BOUND, and saying so is the point. `scan()` assigns at
+ * most one kind per unit and the line patterns run first, so a step that also
+ * says "assuming", "merge" or "deploy" is claimed by the broader family and
+ * never reaches this one. Measured on 2026-09-29: 12 of 50 candidates were
+ * shadowed that way, so the published listing under-reports by roughly a
+ * quarter. A reader told a number and not told it is a floor would read the
+ * remainder as clean, which is the same mistake as reporting a share off a
+ * corpus nobody scanned.
+ */
+export function unfalsifiableReason(clause: VerifyClause): string | null {
+    if (clause.command === null) {
+        // A MANUAL clause asserting a QUANTITY nothing produced. Narrowed to a
+        // multi-digit number or an explicit `N of`/`N%` shape: a lone digit is
+        // usually a step id or an exit code being discussed, and firing on
+        // those would bury the real ones.
+        const quantity = /\b\d{2,}\b/.test(clause.raw) || /\b\d+\s*(?:%|of\b)/.test(clause.raw);
+        return quantity ? 'a manual clause asserts a quantity nothing here produces' : null;
+    }
+
+    const head = (clause.command.trim().split(/\s+/)[0] ?? '').split('/').pop() ?? '';
+    if (FIXED_OUTPUT_HEADS.has(head) && clause.expect?.kind !== 'regex') {
+        // A regex expectation rescues a fixed-output head: `cat f -> /x/` does
+        // decide something. An exit expectation does not — naming exit 0 on a
+        // command that cannot exit anything else adds a symbol, not an oracle.
+        return `the command head \`${head}\` produces a fixed result, so the clause cannot fail`;
+    }
+
+    if (clause.expect?.kind === 'regex') {
+        try {
+            if (new RegExp(clause.expect.source).test(clause.command)) {
+                return 'the expectation matches the command text, so an echo of the command satisfies it';
+            }
+        } catch {
+            // An expectation that cannot compile never became one upstream.
+        }
+    }
+    return null;
+}
+
 interface Pattern {
     readonly kind: Kind;
     readonly re: RegExp;
@@ -145,6 +236,17 @@ export interface Unit {
     /** 1-based line of the unit's first line. */
     readonly line: number;
     readonly text: string;
+    /**
+     * The same block with its NEWLINES intact.
+     *
+     * `text` is joined with spaces so a wrapped pattern still matches across
+     * the wrap, and that is right for the line patterns. It is wrong for the
+     * `verify:` clause: with no newline left, "to end of line" means "to end of
+     * the step", so a manual clause inherited every digit in the evidence block
+     * written under it. Measured before this field existed: 46 of 50
+     * `unfalsifiable-verify` hits fired on a quantity the clause never wrote.
+     */
+    readonly blockText: string;
     readonly inAcceptance: boolean;
     readonly isOpenStep: boolean;
     readonly hasVerify: boolean;
@@ -188,6 +290,7 @@ export function units(lines: readonly string[]): Unit[] {
                 // written with single spaces stops matching across the wrap —
                 // which is the case this unit exists to catch.
                 text: block.join(' ').replace(/\s+/g, ' '),
+                blockText: block.join('\n'),
                 inAcceptance,
                 isOpenStep: OPEN_STEP_RE.test(line),
                 hasVerify: /(?:^|\s)verify:/m.test(block.join('\n')),
@@ -198,6 +301,7 @@ export function units(lines: readonly string[]): Unit[] {
         out.push({
             line: i + 1,
             text: line,
+            blockText: line,
             inAcceptance,
             isOpenStep: false,
             hasVerify: false,
@@ -227,6 +331,14 @@ export function scan(text: string): Finding[] {
         if (matched === null && u.isOpenStep && !u.hasVerify && !u.inAcceptance) {
             matched = 'missing-verify';
         }
+        // A step that HAS a verify line, whose oracle still cannot say no.
+        // Checked on closed steps too — a `[x]` flipped on a command that
+        // could not fail is the defect in its completed form, and restricting
+        // this to open steps would hide every instance that already landed.
+        if (matched === null && u.hasVerify && !u.inAcceptance) {
+            const clause = parseVerifyClause(u.blockText);
+            if (clause !== null && unfalsifiableReason(clause) !== null) matched = 'unfalsifiable-verify';
+        }
         if (matched === null) continue;
         findings.push({
             id: '',
@@ -316,7 +428,9 @@ export function main(argv?: readonly string[]): number {
         }
     }
     if (!findings.length) return 0;
-    return strict ? 1 : 0;
+    // `--strict` goes red on the families that gate, never on the listing.
+    const blocking = findings.filter((f) => !NON_BLOCKING_KINDS.has(f.kind));
+    return strict && blocking.length > 0 ? 1 : 0;
 }
 
 function _isCliEntry(): boolean {

package/src/scripts/compile_hook_manifest.ts

@@ -44,23 +44,66 @@ import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parse as parseYaml } from 'yaml';
 
-import { _manifest_fingerprint } from './hooks/dispatch_hook.js';
+import { tableFingerprint } from './hooks/table_fingerprint.js';
 
 const REPO_ROOT = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..');
-const YAML_PATH = path.join(REPO_ROOT, 'src', 'scripts', 'hook_manifest.yaml');
-const JSON_PATH = path.join(REPO_ROOT, 'src', 'scripts', 'hook_manifest.json');
 
-export function compile(yamlText: string): string {
-    return JSON.stringify({
-        fingerprint: _manifest_fingerprint(yamlText),
-        manifest: parseYaml(yamlText, { version: '1.1' }) as unknown,
-    });
+/**
+ * The plumbing tables that carry a compiled sibling, keyed by `--table`.
+ *
+ * `key` is the wrapper field the reader looks under, and it differs per table
+ * because each reader already had one: `dispatch_hook._load_yaml` reads
+ * `manifest`, `host_lowering.loadHostLowering` reads `table`. Renaming either
+ * would be a plumbing change for cosmetics, so the writer follows the readers.
+ *
+ * `yamlVersion` is 1.1 for the manifest and default for the lowering table,
+ * again because that is what each READER passes. A compiler that parsed with
+ * different settings than the fallback path would produce a fast path that
+ * disagrees with its own slow path on `yes`/`no`/`on`/`off` scalars — a
+ * divergence no fingerprint can catch, because both files would be current.
+ */
+const TABLES = {
+    manifest: {
+        yaml: path.join(REPO_ROOT, 'src', 'scripts', 'hook_manifest.yaml'),
+        json: path.join(REPO_ROOT, 'src', 'scripts', 'hook_manifest.json'),
+        key: 'manifest',
+        yamlVersion: '1.1' as const,
+    },
+    'host-lowering': {
+        yaml: path.join(REPO_ROOT, 'src', 'scripts', 'hooks', 'host_lowering.yaml'),
+        json: path.join(REPO_ROOT, 'src', 'scripts', 'hooks', 'host_lowering.json'),
+        key: 'table',
+        yamlVersion: undefined,
+    },
+} as const;
+
+export type TableName = keyof typeof TABLES;
+
+export function compile(yamlText: string, table: TableName = 'manifest'): string {
+    const spec = TABLES[table];
+    const doc = (spec.yamlVersion === undefined
+        ? parseYaml(yamlText)
+        : parseYaml(yamlText, { version: spec.yamlVersion })) as unknown;
+    return JSON.stringify({ fingerprint: tableFingerprint(yamlText), [spec.key]: doc });
 }
 
 export function main(argv: readonly string[] = process.argv.slice(2)): number {
     let outPath: string | null = null;
+    let table: TableName = 'manifest';
     for (let i = 0; i < argv.length; i += 1) {
         const a = argv[i] as string;
+        if (a === '--table') {
+            const next = argv[i + 1];
+            if (next === undefined || !(next in TABLES)) {
+                process.stderr.write(
+                    `compile_hook_manifest: --table needs one of ${Object.keys(TABLES).join(', ')}\n`,
+                );
+                return 2;
+            }
+            table = next as TableName;
+            i += 1;
+            continue;
+        }
         if (a === '--out') {
             const next = argv[i + 1];
             if (next === undefined || next.startsWith('--')) {
@@ -73,13 +116,14 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         }
         process.stderr.write(
             `compile_hook_manifest: unknown argument ${JSON.stringify(a)}\n` +
-                'usage: compile_hook_manifest [--out <path>]\n',
+                `usage: compile_hook_manifest [--table ${Object.keys(TABLES).join('|')}] [--out <path>]\n`,
         );
         return 2;
     }
 
-    const text = fs.readFileSync(YAML_PATH, 'utf-8');
-    const next = compile(text);
+    const spec = TABLES[table];
+    const text = fs.readFileSync(spec.yaml, 'utf-8');
+    const next = compile(text, table);
 
     if (outPath !== null) {
         // Comparison copy. No `already current` short-circuit: the caller asked
@@ -89,15 +133,15 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         return 0;
     }
 
-    const current = fs.existsSync(JSON_PATH) ? fs.readFileSync(JSON_PATH, 'utf-8') : null;
+    const current = fs.existsSync(spec.json) ? fs.readFileSync(spec.json, 'utf-8') : null;
     if (current === next) {
-        process.stdout.write('compile_hook_manifest: already current\n');
+        process.stdout.write(`compile_hook_manifest: ${table} already current\n`);
         return 0;
     }
-    fs.writeFileSync(JSON_PATH, next);
+    fs.writeFileSync(spec.json, next);
     process.stdout.write(
-        `compile_hook_manifest: wrote ${path.relative(REPO_ROOT, JSON_PATH)} ` +
-            `(${String(next.length)} bytes, fingerprint ${_manifest_fingerprint(text)})\n`,
+        `compile_hook_manifest: wrote ${path.relative(REPO_ROOT, spec.json)} ` +
+            `(${String(next.length)} bytes, fingerprint ${tableFingerprint(text)})\n`,
     );
     return 0;
 }

package/src/scripts/external_sources_denylist.json

@@ -1,5 +1,5 @@
 {
-  "_README": "Denylist for check_no_external_sources.py — blocks readable inspiration/harvest/comparison source names from re-entering the tracked tree. See rule source-confidentiality + the 2026-06-13 source-confidentiality sweep. Recommending an integrated tool is allowed; recording that we copied/derived/were-inspired-by an external source is not. To intentionally retain a source link, encrypt it via src/scripts/_lib/link_crypto.py.",
+  "_README": "Denylist for check_no_external_sources.ts — blocks readable inspiration/harvest/comparison source names from re-entering the tracked tree. See rule source-confidentiality + the 2026-06-13 source-confidentiality sweep. Recommending an integrated tool is allowed; recording that we copied/derived/were-inspired-by an external source is not. To intentionally retain a source link, encrypt it via src/scripts/_lib/link_crypto.ts. A COMPARISON CORPUS IS A PRODUCER OF THIS FILE: every subject a comparison / scorecard round audits owes at least one `deny` pattern here, and the `subjects` registry at the bottom of this file is that binding made machine-checkable — tests/scripts/external_source_subject_registry.test.ts reds when a registry row is not matched by any pattern above. Adding a subject without a row is the defect that produced the 2026-09-29 reading recorded in that test. (Both filenames above read `.py` until 2026-09-29; the Python originals were retired in the ADR-200 teardown, so the pointers named files that no longer exist.)",
   "deny": [
     "kdcllc",
     "nidhinjs",
@@ -65,7 +65,17 @@
     "book-to-skill",
     "project-codeguard",
     "\\bcodeguard\\b",
-    "\\bcosai\\b"
+    "\\bcosai\\b",
+    "\\bqoderai\\b",
+    "\\bbetter-harness\\b",
+    "\\bshanraisshan\\b",
+    "claude-code-best-practice",
+    "\\boraios\\b",
+    "oraios/serena",
+    "\\bopen-gsd\\b",
+    "\\bgsd-core\\b",
+    "\\bgsd-build\\b",
+    "\\bget-shit-done\\b"
   ],
   "_deny_digests_README": "DORMANT (road-to-source-silence Phase 1.1). HMAC-SHA256 digests of the deny set, derived from the gitignored private master by src/scripts/build_source_digests.ts. It is EMPTY on purpose: the plaintext `deny` array above stays in force and is not deleted. Provisioning the CI secret SOURCE_DENY_KEY, generating production digests, removing the plaintext array and switching CI to strict mode are ONE ATOMIC MAINTAINER CHANGE (AI council 2026-08-28, blocker `where-the-key-lives`, 2/2) — splitting them leaves the gate either failing every run for want of a key or silently degraded to warn mode, which is the failure this whole programme exists to remove. Recipe: docs/maintainers/source-deny-digests.md",
   "deny_digests": [],
@@ -103,6 +113,21 @@
   },
   "_excluded_tokens": {
     "agent-os": "collides with our own coined 'Agent-OS primitive' term (universal-skills) — too FP-prone to auto-deny; scrub external 'agent-os' mentions by review.",
-    "telegraph-shrink / telegraph-condense": "collide with our own 'telegraph'/'telegraph-condensed' feature vocabulary; the telegraph upstream is guarded via 'caveman' + 'juliusbrussee' instead."
-  }
+    "telegraph-shrink / telegraph-condense": "collide with our own 'telegraph'/'telegraph-condensed' feature vocabulary; the telegraph upstream is guarded via 'caveman' + 'juliusbrussee' instead.",
+    "serena": "S8's repo half. A common given name — a bare \\bserena\\b would turn a confidentiality gate into a ban on a person's name in any example or persona. The subject is guarded by the owner token \\boraios\\b plus the owner-qualified 'oraios/serena' instead, which is exactly the standard the pre-existing 'obra/superpowers' row already meets. Measured 2026-09-29: 0 occurrences in 11,598 tracked files, so the exclusion is a policy choice about future prose, not a reaction to a live collision.",
+    "gsd": "S9/S10's shared stem. A three-letter acronym is too collision-prone to deny bare. The two subjects are guarded by the four qualified rows \\bopen-gsd\\b, \\bgsd-core\\b, \\bgsd-build\\b and \\bget-shit-done\\b instead. Note the last one is hyphenated on purpose: the spaced English phrase is ordinary prose and is deliberately NOT denied."
+  },
+  "_subjects_README": "Registry of the comparison / scorecard subject set, added 2026-09-29 by road-to-a-denylist-that-sees-every-subject. It exists so that 'a subject was audited' and 'a subject is denied' cannot drift apart again: tests/scripts/external_source_subject_registry.test.ts asserts every `slug` below is matched by at least one `deny` pattern above, and reds when a row is added without its pattern. The slugs live HERE and nowhere else in the tracked tree — this file is the one path skip_paths exempts from its own scan, and it already had to hold these tokens as deny data, so the registry discloses nothing the array above did not. A fixture that named them would be a tracked file publishing exactly what the gate exists to hide, so the test synthesises its corpus from this registry at run time and never commits a resolved name. `id` values are the S1..S10 identifiers the maintainer-held source map uses; they are deliberately opaque here.",
+  "subjects": [
+    { "id": "S1", "slug": "graphify-labs/graphify" },
+    { "id": "S2", "slug": "ruvnet/ruflo" },
+    { "id": "S3", "slug": "affaan-m/everything-claude-code" },
+    { "id": "S4", "slug": "obra/superpowers" },
+    { "id": "S5", "slug": "qoderai/better-harness", "note": "Added 2026-09-29. Owner and repo both denied; the repo half is a hyphenated compound, so the ordinary word 'harness' — which this tree uses constantly — is untouched." },
+    { "id": "S6", "slug": "github/spec-kit" },
+    { "id": "S7", "slug": "shanraisshan/claude-code-best-practice", "note": "Added 2026-09-29. The repo half is denied unanchored because the hyphenated triple is distinctive on its own; the spaced phrase 'claude code best practice' is ordinary prose and stays allowed." },
+    { "id": "S8", "slug": "oraios/serena", "note": "Added 2026-09-29. Owner-qualified on purpose — see _excluded_tokens.serena." },
+    { "id": "S9", "slug": "open-gsd/gsd-core", "note": "Added 2026-09-29. Both halves denied with \\b anchors; the bare stem is excluded — see _excluded_tokens.gsd." },
+    { "id": "S10", "slug": "gsd-build/get-shit-done", "note": "Added 2026-09-29. Archived predecessor of S9. Not re-audited, but a name is a name: it is denied on the same terms." }
+  ]
 }