@event4u/agent-config 16.1.0 → 16.3.0

package/src/scripts/ui_conformance_probe.ts

@@ -29,6 +29,37 @@
  * `not_applicable` with a reason and carries `findings: null` — never 0, which
  * would read as "ran and found nothing".
  *
+ * TWO CAUSES OF `not_applicable`, NOT ONE. The clause above was written for a
+ * host with no browser and then violated by the other empty input:
+ * `evaluate()` used to stamp all five dimensions `exercised` with `findings: 0`
+ * and return `structure_gate: 'passed'` for a reference that collected ZERO
+ * nodes — which is what every design handover in this tree produces, since none
+ * carries a `data-probe-id`. A comparison that never happened reported as a
+ * clean one. Since `road-to-a-probe-that-cannot-report-a-false-green` an empty
+ * reference takes the not-applicable path too, and its reason names the
+ * HANDOVER rather than the host, so the two causes stay tellable apart in the
+ * one field a reader looks at.
+ *
+ * THE ARTEFACT CARRIES ITS DENOMINATOR. `reference_nodes` and `target_nodes`
+ * are how many handled nodes each side actually held — `null` where nothing was
+ * observed at all, on the same never-0 contract as `findings`. Without them a
+ * zero-node run and a fully-matched run were indistinguishable in the JSON, so
+ * the cause above was readable only from prose.
+ *
+ * STRUCTURE IS SYMMETRIC. A handle present only in the target is a finding
+ * (`expected: 'absent'`, `observed: 'present'`), mirroring the reference-side
+ * one. `design-fidelity`'s Iron Law is "never omit or add an element" and the
+ * add half was unobservable while the loop read `reference.nodes` alone; a
+ * rename consequently reported one finding where it now reports two. The
+ * finding keys on the handle, never on the DOM node, so the wrapper and portal
+ * nodes a legitimate framework port inserts produce nothing.
+ *
+ * WHAT THIS DOES NOT FIX, said plainly because the fix is easy to over-read:
+ * no design handover in this tree carries a `data-probe-id` at all, so every
+ * real run still lands in the not-applicable branch. What changed is that the
+ * run now SAYS so. The correspondence problem — getting handles into a handover
+ * — is untouched, and nothing here promotes the probe out of shadow.
+ *
  * THE NOISE CONTROL. Computed-style comparison over every property fires on
  * font fallbacks and token indirection nobody cares about, so the compared set
  * is curated (`COMPARED_PROPERTIES`) to the properties a design token actually
@@ -36,6 +67,15 @@
  * `conformance.declared.json` and suppressed with its reason retained, so an
  * approved change is not re-litigated on every run.
  *
+ * THE ARTEFACT KNOWS WHAT IT READ. `generated_at` alone made a run before the
+ * last UI edit indistinguishable from one after it, so every artefact carries an
+ * `inputs` block: a content digest of the target surface, of the reference, and
+ * of the declarations file, plus the probe build that wrote them. The design-pass
+ * reader recomputes those digests and reports `stale` when they moved — a file
+ * comparison, no browser. The vocabulary is shared rather than duplicated
+ * (`_lib/probe_inputs.ts`), because a producer and a consumer with separate
+ * copies of a hash rule agree only until one of them is edited.
+ *
  * Exit codes: 0 written (with or without findings) · 1 usage error.
  */
 import fs from 'node:fs';
@@ -43,6 +83,8 @@ import { createRequire } from 'node:module';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { collectInputs, declarationsPathFor, type ProbeInputs } from './_lib/probe_inputs.js';
+
 // Type-only, and that is load-bearing rather than stylistic: these are erased
 // at compile time, so they add no second runtime path to a module that refuses
 // to be loaded twice (see `loadPlaywright`).
@@ -149,10 +191,24 @@ export interface SuppressedDeviation {
 export interface ProbeArtefact {
     schema: 'ui-conformance/v1';
     generated_at: string;
+    /**
+     * What this run read, by content. Beside `generated_at` rather than instead
+     * of it: the timestamp says when, the digests say against what — and only
+     * the second question can be re-asked later.
+     */
+    inputs: ProbeInputs;
     host_class: 'A' | 'B' | 'C' | 'unknown';
     target: string;
     reference: string | null;
+    /**
+     * The denominator each side actually had. `null` where nothing was observed
+     * at all — the same contract `findings` carries, and for the same reason: a
+     * 0 would read as "looked and saw none", which the no-browser path did not.
+     */
+    reference_nodes: number | null;
+    target_nodes: number | null;
     structure_gate: 'passed' | 'stopped';
+    /** Reference-side only: the nodes whose STYLE comparison was skipped. */
     unmatched_nodes: string[];
     dimensions: DimensionRow[];
     findings: Finding[];
@@ -201,11 +257,61 @@ const STATE_BASELINE: Record<(typeof INTERACTION_STATES)[number], 'base' | 'hove
     keyboard: 'base',
 };
 
+/**
+ * The second cause of `not_applicable`, and it is deliberately worded to be
+ * unmistakable for the first.
+ *
+ * A handover carrying no `data-probe-id` and a host carrying no browser both
+ * end in five not-applicable rows, so the reason string is the one field a
+ * reader can tell them apart by. An operator who reads "no browser" goes
+ * looking for a missing binary instead of fixing the handover — so this text
+ * names the handover and never the host, and `reference_nodes: 0` makes the
+ * same cause readable from the data without the prose being read at all.
+ */
+const EMPTY_REFERENCE_REASON =
+    'the reference observation carries no data-probe-id handles, so there was nothing to ' +
+    'compare against. The capture ran and collected zero nodes: this is a property of the ' +
+    'handover, not of this machine.';
+
 export function evaluate(
     reference: Observation,
     target: Observation,
     declarations: readonly Declaration[],
 ): ProbeArtefact {
+    // AN EMPTY COMPARISON IS NOT A CLEAN ONE.
+    // Keyed on the REFERENCE only, and that asymmetry is the whole point: a
+    // target that collected nothing is a real comparison in which every node is
+    // missing, and four real structure findings must not be collapsed into a
+    // shrug. A reference that collected nothing has no question to ask, so no
+    // dimension was entered and none may report a count.
+    if (reference.nodes.length === 0) {
+        return {
+            schema: 'ui-conformance/v1',
+            generated_at: new Date().toISOString(),
+            host_class: resolveHostClass(),
+            target: target.source,
+            reference: reference.source,
+            reference_nodes: 0,
+            target_nodes: target.nodes.length,
+            // The empty-reference path READ both sources — it found no handles
+            // in the reference, which is a property of the handover, not a
+            // failure to look. So it records the same digests the normal path
+            // does; omitting them would make a stopped run indistinguishable
+            // from one whose inputs were never seen.
+            inputs: collectInputs(target.source, reference.source),
+            structure_gate: 'stopped',
+            unmatched_nodes: [],
+            dimensions: DIMENSIONS.map((d) => ({
+                dimension: d,
+                status: 'not_applicable' as const,
+                findings: null,
+                reason: `${d} was never entered: ${EMPTY_REFERENCE_REASON}`,
+            })),
+            findings: [],
+            declared_suppressed: [],
+        };
+    }
+
     const targetById = new Map(target.nodes.map((n) => [n.probe_id, n]));
     const findings: Finding[] = [];
     const suppressed: SuppressedDeviation[] = [];
@@ -349,6 +455,37 @@ export function evaluate(
         }
     }
 
+    // --- structure, from the TARGET side. `design-fidelity`'s Iron Law is
+    // "never omit or add an element" and only the omit half was observable: the
+    // loop above reads `reference.nodes`, so a handle present only in the target
+    // reached nothing.
+    //
+    // KEYED ON THE HANDLE, NEVER ON THE DOM NODE, and that is what keeps this
+    // from reddening correct work. A faithful port into a component framework
+    // inserts wrapper and portal nodes the handover never had; none of them
+    // carries a `data-probe-id`, so none of them is observed here. Excluding the
+    // false-positive class by construction, rather than by a heuristic, is the
+    // difference between a dimension that gets acted on and one that gets muted.
+    const referenceIds = new Set(reference.nodes.map((n) => n.probe_id));
+    const addedIds = target.nodes
+        .map((n) => n.probe_id)
+        .filter((id) => !referenceIds.has(id))
+        .sort();
+    for (const id of addedIds) {
+        findings.push({
+            dimension: 'structure',
+            probe_id: id,
+            state: null,
+            property: null,
+            expected: 'absent',
+            observed: 'present',
+            detail:
+                `a node carries data-probe-id="${id}" in the target and no node carries it in ` +
+                'the reference. There is nothing to compare its style against, so it is reported ' +
+                'and then left alone — the mirror of the missing-node case above.',
+        });
+    }
+
     const dimensions: DimensionRow[] = DIMENSIONS.map((d) => ({
         dimension: d,
         status: 'exercised',
@@ -358,10 +495,17 @@ export function evaluate(
     return {
         schema: 'ui-conformance/v1',
         generated_at: new Date().toISOString(),
+        inputs: collectInputs(target.source, reference.source),
         host_class: resolveHostClass(),
         target: target.source,
         reference: reference.source,
-        structure_gate: unmatched.length ? 'stopped' : 'passed',
+        reference_nodes: reference.nodes.length,
+        target_nodes: target.nodes.length,
+        // Both directions stop the gate, because both describe a node that was
+        // never style-compared. `unmatched_nodes` keeps its narrower meaning —
+        // the reference-side nodes whose comparison was SKIPPED — so a reader of
+        // that list still learns exactly what it always said.
+        structure_gate: unmatched.length || addedIds.length ? 'stopped' : 'passed',
         unmatched_nodes: unmatched,
         dimensions,
         findings,
@@ -373,13 +517,21 @@ export function evaluate(
  * The artefact a host that cannot run the probe must still produce. Emitting
  * nothing is indistinguishable from a clean run to everything downstream.
  */
-export function unavailableArtefact(target: string, reason: string): ProbeArtefact {
+export function unavailableArtefact(target: string, reason: string, reference: string | null = null): ProbeArtefact {
     return {
         schema: 'ui-conformance/v1',
         generated_at: new Date().toISOString(),
+        // A degraded run still records what it WOULD have compared. An artefact
+        // with no inputs block reads as a version skew to the reader, which is a
+        // different and less useful statement than "this host has no browser".
+        inputs: collectInputs(target, reference),
         host_class: 'unknown',
         target,
         reference: null,
+        // Null, never 0 — nothing was observed on either side, and a 0 would
+        // read as "looked and saw none".
+        reference_nodes: null,
+        target_nodes: null,
         structure_gate: 'stopped',
         unmatched_nodes: [],
         dimensions: DIMENSIONS.map((d) => ({
@@ -596,14 +748,14 @@ async function main(): Promise<number> {
 
     let artefact: ProbeArtefact;
     if (!chromiumAvailable()) {
-        artefact = unavailableArtefact(target, 'no Chromium binary resolved from @playwright/test');
+        artefact = unavailableArtefact(target, 'no Chromium binary resolved from @playwright/test', referencePath ?? null);
     } else if (!referencePath) {
         artefact = unavailableArtefact(target, 'no --reference given; a comparison needs an intended implementation');
         for (const row of artefact.dimensions) {
             row.reason = `${row.dimension} needs a --reference to compare against; none was given`;
         }
     } else {
-        artefact = evaluate(await captureVariant(referencePath), await captureVariant(target), loadDeclarations(path.join(path.dirname(target), 'conformance.declared.json')));
+        artefact = evaluate(await captureVariant(referencePath), await captureVariant(target), loadDeclarations(declarationsPathFor(target)));
     }
 
     fs.mkdirSync(path.dirname(out), { recursive: true });

package/src/scripts/update_prices.ts

@@ -23,6 +23,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { DEFAULT_PRICES, as_rows } from './ai_council/_default_prices.js';
+import { sanitize_text } from './_lib/retrieval_sanitize.js';
 import { PRICES_FILE, _render_markdown, is_stale, load_prices } from './ai_council/pricing.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -39,6 +40,40 @@ type Json = any;
 // from the LiteLLM payload. set(DEFAULT_PRICES.keys()) → "provider model" keys.
 const ALLOW_LIST: ReadonlySet<string> = new Set(DEFAULT_PRICES.keys());
 
+/**
+ * The only shape a remote identifier may have to be considered at all.
+ *
+ * Pure ASCII letters, digits and the punctuation real provider/model names use.
+ * Every allow-list entry is ASCII, so nothing outside this can be a member —
+ * and asserting it on the UNTOUCHED bytes is what makes the case fold below
+ * safe, because within ASCII folding is lossless. A Unicode character that
+ * folds onto an ASCII letter never reaches the comparison.
+ */
+const _CANONICAL_ID = /^[A-Za-z0-9._-]+$/;
+
+/** ASCII-only case fold — never `toLowerCase`, which folds Unicode too. */
+function _asciiLower(s: string): string {
+    return s.replace(/[A-Z]/g, (c) => String.fromCharCode(c.charCodeAt(0) + 32));
+}
+
+/**
+ * Report a rejected identifier that WOULD have matched after transformation.
+ *
+ * A raw miss whose normalised form hits the allow list is a different event
+ * from an ordinary unlisted name, and printing both as the same silence is what
+ * would hide an admission attempt. Ordinary misses stay silent — the fetched
+ * catalogue carries hundreds of models nobody here lists.
+ */
+function _reportCollision(rawProvider: string, rawModel: string): void {
+    const normalised = `${sanitize_text(rawProvider).toLowerCase()} ${sanitize_text(rawModel)}`;
+    if (!ALLOW_LIST.has(normalised)) return;
+    process.stderr.write(
+        'update_prices: DROPPED a remote row whose raw identifier is not allow-listed ' +
+            `but normalises onto \`${normalised}\`. A fetched name that folds or sanitizes ` +
+            'onto a listed one is an admission attempt, not a typo.\n',
+    );
+}
+
 /**
  * Synchronous HTTPS GET so the CLI stays a straight-line script (Python uses
  * a blocking urlopen). Returns parsed JSON dict, or null on any failure
@@ -99,13 +134,60 @@ export function _toRowsFromLitellm(
         if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
             continue;
         }
-        const provider = String((entry.litellm_provider as Json) ?? '').toLowerCase();
+        // Sanitize BEFORE the allow-list compare, not after. These two strings
+        // come off the wire and end up in a tracked markdown file that agents
+        // read, so they are the model-facing copy this floor exists for. Doing
+        // it before the compare is also the only order that works: a vector
+        // inside a model name would otherwise fail the allow-list lookup and
+        // drop the row, turning an injection attempt into a silent data loss.
+        // The fetched payload itself is never written anywhere — only this
+        // rendering is transformed.
+        const rawProvider = String((entry.litellm_provider as Json) ?? '');
         // LiteLLM keys are sometimes "provider/model"; strip the prefix.
         const slash = key.indexOf('/');
-        const model = slash !== -1 ? key.slice(slash + 1) : key;
-        if (!ALLOW_LIST.has(`${provider} ${model}`)) {
+        const rawModel = slash !== -1 ? key.slice(slash + 1) : key;
+
+        // THE ADMISSION BOUNDARY: a canonical ASCII grammar first, then a
+        // comparison on values nothing has transformed.
+        //
+        // Two earlier orders were both wrong and the second is the instructive
+        // one. The first sanitized before comparing, so a poisoned name could
+        // normalise onto a listed one and be admitted as it. The fix compared
+        // "raw" values — but `.toLowerCase()` ran before the compare, and THAT
+        // IS ITSELF A LOSSY UNICODE TRANSFORM: the Kelvin sign and the Turkish
+        // dotted capital both fold onto ASCII letters, so the provider field
+        // still carried the collision the model field no longer did. An
+        // independent review named it and was right; closing one field and
+        // calling the class closed is the failure mode, not the typo.
+        //
+        // The reachable fold is ONE character: `U+212A KELVIN SIGN -> k`.
+        // Measured, not recalled — U+212B ANGSTROM folds to `å`, which is not
+        // ASCII, and an earlier note here claimed otherwise. No provider in the
+        // current list carries a `k`, so this boundary guards nothing reachable
+        // TODAY; it guards the day one is added, which is the only time a
+        // boundary of this shape can be added without a migration.
+        //
+        // So the grammar is asserted on the UNTOUCHED bytes. Pure ASCII, with
+        // the punctuation real identifiers use. Nothing outside it can be an
+        // allow-list member, because every entry is ASCII — and within ASCII,
+        // case folding is lossless, which is what makes the fold below safe to
+        // apply after the gate rather than before it.
+        if (!_CANONICAL_ID.test(rawProvider) || !_CANONICAL_ID.test(rawModel)) {
+            _reportCollision(rawProvider, rawModel);
             continue;
         }
+        const provider = _asciiLower(rawProvider);
+        if (!ALLOW_LIST.has(`${provider} ${rawModel}`)) {
+            _reportCollision(rawProvider, rawModel);
+            continue;
+        }
+
+        // Only now, and only for the rendering: the row reaches a tracked
+        // markdown file that agents read, so the model-facing copy carries the
+        // floor. The fetched payload itself is never written anywhere. Both
+        // values are already canonical ASCII here, so this is a no-op in
+        // practice and a belt on the rendering in principle.
+        const model = sanitize_text(rawModel);
         const inCost = entry.input_cost_per_token;
         const outCost = entry.output_cost_per_token;
         if (!_isNumber(inCost) || !_isNumber(outCost)) {

package/src/scripts/write_bundle_digest.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+/**
+ * write_bundle_digest.mjs — the sidecar `dist/hooks/dispatch.sha256`.
+ *
+ * Step 3.1 of `road-to-a-kernel-that-guards-its-plumbing`. The dispatcher
+ * verifies at runtime that the bundle it is executing is the bundle the build
+ * produced, and it needs something to compare against. This writes that
+ * something, in the same `npm run build:hooks` invocation that writes the
+ * bundle, so the two cannot be produced separately and cannot disagree.
+ *
+ * Plain `.mjs` rather than a TS script under `scripts-run`: it is chained into
+ * `build:hooks`, which runs before anything is compiled and on machines where
+ * a `tsx` startup is pure cost. `prepack-check.mjs` sets the precedent.
+ *
+ * Format is one line, `<64 hex>  <basename>`, i.e. what `shasum -a 256`
+ * emits — so an operator can verify the claim with a tool they already have
+ * instead of trusting this script:
+ *
+ *     shasum -a 256 -c dist/hooks/dispatch.js.sha256
+ *
+ * This is NOT a signature and does not pretend to be. Anyone who can rewrite
+ * the bundle can rewrite the sidecar beside it. What it defends against is the
+ * hand edit — a bundle changed in place between builds, which until now
+ * survived until the next build, reached every dispatch meanwhile, and was
+ * invisible in a source review. `block_plumbing_writes` refuses that edit at
+ * tool-call time; this catches one that arrived by some other route.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { basename, resolve } from 'node:path';
+import { argv, exit, stderr, stdout } from 'node:process';
+
+const bundle = resolve(argv[2] ?? 'dist/hooks/dispatch.js');
+// `dispatch.sha256`, not `dispatch.js.sha256` — the name the roadmap step
+// wrote. Either works with `shasum -c`, which reads the subject filename from
+// INSIDE the file rather than from the sidecar's own name, so the choice is
+// free and the step's spelling wins.
+const sidecar = bundle.replace(/\.js$/u, '') + '.sha256';
+
+let bytes;
+try {
+    bytes = readFileSync(bundle);
+} catch (err) {
+    stderr.write(`write_bundle_digest: cannot read ${bundle}: ${err.message}\n`);
+    // Exit non-zero: a build that produced no bundle must not report success,
+    // and a sidecar written from a missing file would be a digest of nothing.
+    exit(1);
+}
+
+const digest = createHash('sha256').update(bytes).digest('hex');
+writeFileSync(sidecar, `${digest}  ${basename(bundle)}\n`, 'utf-8');
+
+// Read back what was just written and confirm it describes the bundle beside
+// it. An independent review called a post-build verification the
+// highest-leverage addition here, and the reason is the runtime posture: a
+// MISSING or unreadable sidecar is `unverifiable` at dispatch time and ALLOWS,
+// deliberately, so that a consumer whose package predates the sidecar is not
+// wedged. That choice means a half-written or unreadable sidecar degrades the
+// check silently instead of failing anything.
+//
+// `prepack-check.mjs` catches it at packaging time, which covers the published
+// tarball and nothing else. This covers every path that produces a bundle at
+// all — local build, CI build, packaging — because it is part of producing one.
+// It costs one re-read of 78 bytes.
+const readBack = readFileSync(sidecar, 'utf-8');
+const claimed = /^([0-9a-f]{64})\s/u.exec(readBack.trim())?.[1] ?? null;
+if (claimed !== digest) {
+    stderr.write(
+        `write_bundle_digest: wrote ${sidecar} but read back ${claimed ?? '(unparseable)'} ` +
+            `instead of ${digest} — the sidecar does not describe the bundle it was written for.\n`,
+    );
+    exit(1);
+}
+stdout.write(`write_bundle_digest: ${digest}  ${basename(bundle)} (${String(bytes.length)} bytes, verified)\n`);

package/src/server/schemas/settings.ts

@@ -174,6 +174,37 @@ export const settingsSchema = z.object({
             'How a mission\'s work is shaped into pull requests. single (default) = one branch, one pull request. stacked = a dependent series. stacked is never chosen by the agent and never asked about at roadmap creation — the owner plans it or it does not happen.',
         ),
     }),
+    /**
+     * What this package may write into the HOST's own environment.
+     *
+     * THE GUARANTEE IS THE SHAPE, not a check. Only two keys exist here, and
+     * both are request-SIZE caps. Neither traffic variable is expressible —
+     * `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` and `DISABLE_AUTOUPDATER` both
+     * reach the host's update-disabled resolver (the blanket one as its third
+     * rung, measured on Claude Code 2.1.284), so a profile able to write either
+     * could disable a consumer's security updates. Owner-decided 2026-09-30:
+     * they are not writable through this package at all, and the strongest way
+     * to hold that is a schema that cannot say them rather than an exclusion
+     * list somebody has to maintain.
+     *
+     * `null` is the default on both, and it is the off switch: nothing is
+     * written. There is no separate enable flag, because a flag plus a value is
+     * two ways to say off and one of them would drift.
+     */
+    host_environment: z.object({
+        request_size_caps: z.object({
+            bash_max_output_length: z.number().int().positive().max(150_000).nullable().default(null).describe(
+                'Character cap on Bash tool output the host places inline into a model request. null (default) = this package writes nothing and the host default of 30000 applies. A number is written into the host env block. Values above 150000 are capped by the host itself, so the schema refuses them here rather than writing a value the host silently changes. Bounds request SIZE, never request COUNT: lowering it suppresses no telemetry, no update check and no download.',
+            ),
+            max_mcp_output_tokens: z.number().int().positive().nullable().default(null).describe(
+                'Token cap on a single MCP tool result the host places into a model request. null (default) = nothing written, host default 25000 applies. Same size-not-count caveat: it does not govern MCP connections, timeouts, or whether a tool runs.',
+            ),
+        }).default({}).describe(
+            'Request-size caps this package may write into the host env block. Both null by default. No traffic or auto-updater variable is expressible here, by construction — see the block comment.',
+        ),
+    }).default({}).describe(
+        'What this package may write into the host environment. ABSENT resolves to the all-null shape, which is the same thing as off — a settings file predating this section must not fail to parse, and "no section" and "both caps null" both mean write nothing.',
+    ),
     augment: z.object({
         rules_use_symlinks: z.boolean().default(false).describe(
             'When true, .augment/rules/*.md are symlinks into dist/agent-src/rules/ — edits flow back to source on save. When false (default), they are copies — safer on Windows and shared volumes, but rule edits in .augment/ are lost on the next `task sync`.',
@@ -292,6 +323,11 @@ export const settingsSchema = z.object({
         fidelity_mode: 'strict',
         approximation: { enabled: false, tolerance: { color: null, length: null } },
     }),
+    code_graph: z.object({
+        consumer_index_paths: z.array(z.string()).default([]).describe(
+            "Extra project-relative paths where THIS project keeps a code-graph index another tool wrote. The built-in list is deliberately vendor-neutral (graph.json, code-graph.json, .code-graph/graph.json) and names no tool, so a tool that writes its index elsewhere is named here rather than waited for. A graph found this way LOADS and answers query and explain with every edge tagged read-from-elsewhere; the gate verbs (impact, untested, dead) refuse a graph made only of such edges and say so, because an empty answer from a gate must not read as 'nothing found' when it means 'nothing trusted'. Absolute paths and paths escaping the project root are ignored.",
+        ),
+    }).default({}),
     consistency: z.object({
         cross_source: crossSourceMode.default('on').describe(
             'Consumed by the cross-source-consistency rule. When the agent works from multiple sources (ticket text, an attached image/mockup, the spec, the codebase) it checks them against each other and asks before proceeding on a discrepancy — instead of silently guessing. on (default) = surface every real cross-source contradiction / silent-scope-expansion as one question; auto = surface only high-confidence contradictions, state low-confidence as an assumption; off = no cross-source checking.',
@@ -559,6 +595,11 @@ export const settingsSchema = z.object({
                 'When a hook exceeds hooks.concern_budget.max_per_event, fail the run (true) instead of warning and continuing (false, default). Turn on in CI when you want hook quality to gate merges.',
             ),
         }),
+        verify_before_complete: z.object({
+            touched_file_quality: z.enum(['off', 'shadow', 'warn']).default('off').describe(
+                "Stop-slot pass that runs the project's OWN quality commands — the ones resolve_toolchain() already reports — over the files this turn edited. Default off. `shadow` records a per-run result and emits nothing; `warn` adds ONE advisory line of at most 200 bytes. Never blocks and never counts as verification: a command recorded here never reaches _lib/verification_command.ts, so a clean eslint run cannot let a turn claim it verified anything. A writing command runs only in its check form (pint --test) or not at all, and a command with no per-file form is skipped rather than run project-wide at every stop.",
+            ),
+        }).default({}),
         injection_scan: z.object({
             enabled: z.boolean().default(false).describe(
                 'PostToolUse prompt-injection scanner (road-to-security-pillar.md P3.2). Default off. When on, scans tool output (file reads, web fetches, MCP responses) for injection signatures and WARNS in context (never blocks). Runtime backstop on top of the always-on untrusted-input-defense rule; detection is probabilistic.',