@event4u/agent-config 16.1.0 → 16.3.0

package/src/agent-src/templates/scripts/work_engine/taxonomy/place.ts

@@ -0,0 +1,183 @@
+/**
+ * Placing a new component inside the taxonomy a project already chose.
+ *
+ * Leaf module — no intra-`work_engine` imports beyond its sibling detector's
+ * `NO_TAXONOMY` constant. That one import does pull `node:fs` in transitively;
+ * "stdlib-free" was the old wording here and it was simply wrong. Public API names stay snake_case to
+ * mirror the sibling detectors 1:1, per ADR-200.
+ *
+ * The contract, and the reason it is this small: placement reads the RECORDED
+ * tier list by name and conforms to whatever it holds. There is no table of
+ * tier names here, no ordering, no per-tier rule, and no numeric budget keyed
+ * to a tier — a component is placed when the brief names a tier the project
+ * has, and is reported as a gap when it does not. Anything richer would be the
+ * compiled-in taxonomy this suite refused to hard-code, arriving as an
+ * implementation detail rather than as a decision.
+ *
+ * That is also why an unplaceable component is never quietly put somewhere
+ * else. Choosing a tier for it would need exactly the per-tier rule the line
+ * above rules out, so the honest output is a named gap the author resolves.
+ *
+ * With {@link NO_TAXONOMY} recorded — the value for a project that evidences
+ * no taxonomy — every plan comes back empty and {@link conformance_lines}
+ * returns nothing, so the authoring step's output is byte-identical to what it
+ * was before this module existed. Holding to the project's own structures is
+ * the standing rule; a project that organises its components some other way
+ * must not be able to tell that this module shipped.
+ */
+import { NO_TAXONOMY } from './detect.js';
+
+/** A component the design brief asks for. */
+export interface ComponentRequest {
+    /** The component's name, as the brief writes it. */
+    name?: unknown;
+    /** The granularity tier the brief assigns it, when it assigns one. */
+    tier?: unknown;
+}
+
+/** Where one component lands, or why it could not be placed. */
+export interface PlacementPlan {
+    /** The component's name as read from the brief. */
+    name: string;
+    /** The project's own tier name it was matched to, or `null`. */
+    tier: string | null;
+    /** The directory it belongs in, or `null` when unplaced. */
+    directory: string | null;
+    /** Why it could not be placed, or `null` when it was. */
+    gap: string | null;
+}
+
+/** Component root used when the audit recorded none. */
+/**
+ * Gap reported when a taxonomy is recorded without the root it lives under.
+ *
+ * Guessing `src/components` here is the same failure as placing a component in
+ * a tier the project does not have, at the other end of the path: a project
+ * rooted at `app/components` or `resources/js/components` — both of which the
+ * detector searches — would have been handed a directory that does not exist,
+ * with no gap and no warning. This module exists so nothing is placed
+ * somewhere the project did not choose, so it says so instead.
+ */
+export const MISSING_ROOT_GAP =
+    'the audit recorded a taxonomy but no `component_root`, so there is no ' +
+    'directory to place into — re-run the audit, or record the root by hand';
+
+/**
+ * Plan where each requested component belongs under a recorded taxonomy.
+ *
+ * @param taxonomy The recorded `state.ui_audit.component_taxonomy` value —
+ *   the project's own tiers joined with `/`, or {@link NO_TAXONOMY}.
+ * @param component_root The recorded component root, relative to the project.
+ * @param components The components the design brief asks for.
+ */
+export function plan_component_placement(
+    taxonomy: string,
+    component_root: string,
+    components: ReadonlyArray<ComponentRequest>,
+): PlacementPlan[] {
+    const tiers = read_tiers(taxonomy);
+    const root = _trim_slashes(component_root);
+    return components.map((component) => {
+        const name = _text(component.name) || '(unnamed)';
+        if (tiers.length === 0) {
+            return { name, tier: null, directory: null, gap: null };
+        }
+        if (root === '') {
+            return { name, tier: null, directory: null, gap: `\`${name}\` — ${MISSING_ROOT_GAP}` };
+        }
+        const hint = _text(component.tier);
+        if (hint === '') {
+            return {
+                name,
+                tier: null,
+                directory: null,
+                gap:
+                    `\`${name}\` names no granularity tier, and the project's ` +
+                    `taxonomy \`${taxonomy}\` carries no rule that assigns one ` +
+                    '— left unplaced for the author to decide',
+            };
+        }
+        const matched = tiers.find((tier) => _normalise(tier) === _normalise(hint));
+        if (matched === undefined) {
+            return {
+                name,
+                tier: null,
+                directory: null,
+                gap:
+                    `\`${name}\` declares tier \`${hint}\`, which the project's ` +
+                    `taxonomy \`${taxonomy}\` does not contain — left unplaced ` +
+                    'rather than moved somewhere the project did not choose',
+            };
+        }
+        return { name, tier: matched, directory: `${root}/${matched}`, gap: null };
+    });
+}
+
+/**
+ * Split a recorded taxonomy value into the project's own tier names.
+ *
+ * **The sentinel comparison is case-insensitive, and that is not politeness.**
+ * This field is written by an agent following `existing-ui-audit` § 1b, so
+ * `'None'` is reachable, and an exact comparison let it through as a
+ * one-element tier list: a project with no taxonomy then got a "conforming to
+ * `None`" banner and a conformance gap per component — precisely the output
+ * AC-2 forbids. It is the one guard standing between a no-taxonomy project and
+ * a changed authoring step, so it refuses every spelling of the sentinel.
+ */
+export function read_tiers(taxonomy: string): string[] {
+    const value = _text(taxonomy);
+    if (value === '' || value.toLowerCase() === NO_TAXONOMY) {
+        return [];
+    }
+    return value
+        .split('/')
+        .map((part) => part.trim())
+        .filter((part) => part !== '');
+}
+
+/**
+ * Render the lines the authoring step says out loud.
+ *
+ * Empty for {@link NO_TAXONOMY}, which is what keeps a no-taxonomy project's
+ * output unchanged.
+ */
+export function conformance_lines(
+    taxonomy: string,
+    component_root: string,
+    plans: ReadonlyArray<PlacementPlan>,
+): string[] {
+    if (read_tiers(taxonomy).length === 0) {
+        return [];
+    }
+    const root = _trim_slashes(component_root);
+    const under = root === '' ? 'an unrecorded component root' : `\`${root}/\``;
+    const lines: string[] = [
+        `> Conforming to the project's own component taxonomy ` +
+            `\`${taxonomy}\` under ${under} — detected, not imposed. ` +
+            'A component that fits no tier is reported, never relocated.',
+    ];
+    for (const plan of plans) {
+        if (plan.gap === null && plan.directory !== null) {
+            lines.push(
+                `>   - \`${plan.name}\` → \`${plan.directory}/\` (tier \`${plan.tier}\`)`,
+            );
+        } else if (plan.gap !== null) {
+            lines.push(`>   - conformance gap: ${plan.gap}`);
+        }
+    }
+    return lines;
+}
+
+/** Lower-case and drop a trailing plural `s`, so `Molecule` matches `molecules`. */
+function _normalise(name: string): string {
+    const lower = name.trim().toLowerCase();
+    return lower.endsWith('s') && lower.length > 2 ? lower.slice(0, -1) : lower;
+}
+
+function _text(value: unknown): string {
+    return typeof value === 'string' ? value.trim() : '';
+}
+
+function _trim_slashes(value: unknown): string {
+    return _text(value).replace(/^\/+|\/+$/gu, '');
+}

package/src/config/agent-settings.template.yml

@@ -464,6 +464,35 @@ delivery:
   # that is why this key is Class C rather than a preference.
   pr_topology: single
 
+# --- What this package may write into the HOST's own environment ---
+#
+# THE GUARANTEE IS THE SHAPE, not a list. Only request-SIZE caps live here.
+# Neither `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` nor `DISABLE_AUTOUPDATER`
+# is expressible: both reach the host's update-disabled resolver -- the blanket
+# one as its THIRD RUNG, measured on Claude Code 2.1.284 -- so a profile able to
+# write either could disable a consumer's security updates. Owner-decided
+# 2026-09-30: this package never writes them, and a schema that cannot say them
+# holds that better than an exclusion list somebody has to keep true.
+#
+# Both keys are `null` by default, and null IS the off switch -- nothing is
+# written. There is deliberately no separate enable flag: a flag plus a value
+# would be two ways to say off, and one of them would drift.
+#
+# Size, never count. Lowering either cap suppresses no telemetry, no update
+# check and no download; it bounds how big a request is, not how many there are.
+# What each variable governs is in docs/setup/host-traffic-environment.md and is
+# not copied here.
+host_environment:
+  request_size_caps:
+    # Character cap on Bash tool output placed inline into a model request.
+    # null = not written, host default 30000 applies. Max 150000 -- above that
+    # the host caps it silently, so the schema refuses rather than writing a
+    # value the host changes behind you.
+    bash_max_output_length: null
+    # Token cap on a single MCP tool result. null = not written, host default
+    # 25000 applies.
+    max_mcp_output_tokens: null
+
 # --- Augment Code projection (.augment/) ---
 #
 # Controls how rule files are written into .augment/rules/ during
@@ -924,6 +953,22 @@ consistency:
 # flags + pre-redacts — never a clearance; the gate for a data-bearing screenshot
 # is human confirmation (routing into `non-destructive-by-default`, since a
 # shipped screenshot is an irreversible published egress).
+code_graph:
+  # Extra paths, relative to the project root, where THIS project keeps a
+  # code-graph index another tool wrote. The built-in list is deliberately
+  # generic (`graph.json`, `code-graph.json`, `.code-graph/graph.json`) and
+  # names no vendor; if your tool writes its index elsewhere, name the path
+  # here rather than waiting for this package to learn about that tool.
+  #
+  # A graph found this way LOADS and answers `query` and `explain`, with every
+  # edge tagged as read-from-elsewhere. The gate verbs (`impact`, `untested`,
+  # `dead`) refuse a graph made only of such edges and say why — an empty
+  # answer from a gate reads as "nothing found" rather than "nothing trusted".
+  #
+  # Absolute paths and paths escaping the project root are ignored.
+  # Default: [] (the built-in list only).
+  consumer_index_paths: []
+
 screenshots:
   # Public identity tokens that are SAFE to show unredacted — the maintainer's
   # OWN public handles (e.g. a username shown in an admin panel) plus well-known
@@ -1453,6 +1498,27 @@ hooks:
   injection_scan:
     enabled: false
 
+  # Shadow quality pass over the files a turn edited
+  # (road-to-touched-files-that-pass-their-own-tools, Phase 1). Default `off`.
+  #
+  #   off     the recorder behaves exactly as it did before this key existed —
+  #           nothing spawns, no manifest is read, no new field is written.
+  #   shadow  at stop, the commands YOUR toolchain already resolves
+  #           (`npx eslint`, `vendor/bin/phpstan analyse`, `ruff check`, …) run
+  #           against the touched files and the result lands in `quality_runs[]`
+  #           in the per-session record. Nothing is emitted and nothing blocks.
+  #   warn    the same, plus ONE advisory line (≤ 200 bytes) naming the command
+  #           and the file when a check came back non-zero. Still exit 0 —
+  #           this hook is observability infra and never blocks.
+  #
+  # Three properties worth knowing before switching it on: a command that writes
+  # files runs only in its check form (`pint --test`) or not at all; a command
+  # with no per-file form (`tsc --noEmit`, `go vet ./...`) is skipped rather than
+  # run project-wide at every stop; and a recorded quality run is NEVER read as
+  # verification — `verified_this_turn` is unaffected by anything here.
+  verify_before_complete:
+    touched_file_quality: "off"   # quoted: bare `off` is boolean false in YAML 1.1
+
   # NOTE — `turn_end_gate` has no keys here any more. The stop-slot turn-end
   # gate is ALWAYS ARMED (2026-08-12); `hooks.turn_end_gate.*` was removed and
   # a leftover block warns once on stderr and is ignored. Whether it fires is
@@ -1547,34 +1613,37 @@ hooks:
   ui_route_nudge:
     enabled: false
 
-  # PreToolUse code-graph nudge (ADR-124 Phase 4). Default-OFF. When enabled
-  # AND a native code-graph engine has built a cache (or the repo ships a
-  # graph.json / SCIP index), WARNS once per session (exit 2, never blocks) as
-  # the agent is about to Grep/Glob or Read a source file: query the graph
-  # first for "who calls / where used / impact" questions (or rebuild if the
-  # index is stale, or build one if absent). Source G's strict block-first-read
-  # mode is deliberately un-ported. Build the cache with
-  # `agent-config code-graph build`.
+  # INERT, AND REGISTERED ON PURPOSE (ADR-124 Phase 4 -> ADR-259).
+  #
+  # Nothing reads this key. The PreToolUse nudge it used to gate was replaced
+  # on 2026-09-07 by the `code-graph-context` concern
+  # (src/scripts/hooks/code_graph_context_hook.ts), which reads no flag: it is
+  # silent whenever no graph source exists, so a consumer who never runs
+  # `agent-config code-graph build` never hears from it, and the flag's premise
+  # — "do not advertise a capability the consumer cannot have" — is gone.
+  # Setting this to `true` therefore enables nothing, and setting it to `false`
+  # disables nothing.
+  #
+  # The key STAYS because docs/MIGRATION.md (the code_graph row) commits to
+  # exactly that — "the surfaces stay registered and disabled". Deleting a key a
+  # consumer may already have set is the breaking change the commitment exists
+  # to avoid; docs/contracts/settings-classes.md classifies it accordingly
+  # (classified, not deleted).
   #
   # DEPRECATED (honest null, 2026-07-28): the pre-registered 2-arm retrieval
   # benchmark measured the native graph at recall 0.365 vs grep 0.797 on
   # graph-shaped questions across 3 real repos (internal/bench/reports/
-  # code-graph-vs-grep.md; claim code-graph-retrieval-null). `enabled: false`
-  # is the DEFAULT and is not permanent — the removal commitment this comment
-  # used to carry was withdrawn on 2026-08-15 (docs/MIGRATION.md, the code_graph
-  # row), and "permanent" was retracted with it. What holds is the default and
-  # its reopen condition, which is the same one that was always written here:
-  # external evidence — a consumer case the graph answers and disciplined grep
-  # cannot — or a re-measurement on a build that postdates the extractor repair
+  # code-graph-vs-grep.md; claim code-graph-retrieval-null). That null is about
+  # the ENGINE, not about this key, and it still stands — the reopen condition
+  # is external evidence (a consumer case the graph answers and disciplined grep
+  # cannot) or a re-measurement on a build that postdates the extractor repair
   # of 2026-08-22, which the 2026-07-28 figures predate.
   #
-  # The engine's parser pair is NO LONGER a runtime dependency (~51 MB that
-  # every consumer installed for a path none of them can reach); it is a
-  # devDependency, which npm does not install for consumers. Flipping this to
-  # `true` is therefore not sufficient — install the ABI-locked pair too:
-  #   npm i web-tree-sitter@0.24.7 tree-sitter-wasms@0.1.13
-  # Both versions are exact because the pair is ABI-coupled (grammar ABI 14).
-  # The loader raises this same hint if the pair is missing.
+  # The engine ships to consumers. `web-tree-sitter` is a runtime dependency
+  # (package.json) and the three loadable grammars are vendored at
+  # src/vendor/grammars/, so there is no separate parser install to perform and
+  # no ABI pair to line up by hand. Build the cache with
+  # `agent-config code-graph build`.
   code_graph:
     enabled: false
 

package/src/config/ci-local-parity.yml

@@ -270,6 +270,24 @@ ci_only:
   - id: release
     class: release
     reason: "tags, bumps, publishes, opens the release PR — the release itself"
+  - id: check_host_docs_digest
+    class: network
+    reason: >
+      road-to-hooks-on-every-host Phase 1.3. The watcher's whole subject is the
+      LIVE body of each host's hooks page, so its CI-side mode (`--fetch`) makes
+      eight outbound requests to vendor documentation sites. Putting that in
+      `task ci` would add eight network calls — and eight new ways to fail — to
+      every local run of an otherwise hermetic gate chain, for a signal that
+      changes on the order of vendor releases rather than of commits. It runs in
+      its own WEEKLY workflow (`host-docs-digest.yml`) and nowhere else.
+      It is also not a pull-request gate, so there is no failure a contributor
+      could discover only after pushing, which is the exact harm this checker
+      exists to prevent: a drift red is a standing finding about an upstream
+      page, never a verdict on anyone's branch.
+      Reachable locally without egress: `./scripts-run src/scripts/check_host_docs_digest`
+      (offline report) and `--self-test` (pure functions, no network); the
+      comparison logic itself is covered hermetically by
+      `tests/scripts/host_docs_digest.test.ts`.
 
 # Gates a local chain runs that no workflow does — each needs a reason it is not
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer

package/src/config/continuity-surface.json

@@ -211,6 +211,13 @@
             "locus": "src/scripts/bench_hook_injection.ts:42",
             "reason": "Hook-injection benchmark output. Measurement, not state."
         },
+        {
+            "id": "learning-dogfood.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/memory_learn_hook.ts:191",
+            "reason": "One line per session-end learning run — wall time, signals in, lessons out. The two numbers the `memory.learn_on_session_end` flip condition names, recorded so a 30-day window can read a zero rather than a silence. Measurement about a session, never state a successor session reads: deleting it costs the window its history and costs no resume anything."
+        },
         {
             "id": "injection-turn",
             "axis": "persistent_continuity_artefacts",
@@ -404,8 +411,8 @@
             "id": "tool-result-census.jsonl",
             "axis": "persistent_continuity_artefacts",
             "disposition": "excluded",
-            "locus": "src/scripts/hooks/tool_result_bytes_hook.ts:92",
-            "reason": "Tool-result byte census. Measurement output."
+            "locus": "src/scripts/hooks/tool_result_bytes_hook.ts",
+            "reason": "Tool-result byte census (raw_bytes / delivered_bytes). Measurement output, written only where the maintainer workspace resolves."
         },
         {
             "id": "turn-end-gate",

package/src/config/evaluator-budgets.json

@@ -65,11 +65,11 @@
       "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109. 109 → 110 on 2026-09-03: the `hooks:effect` verb (road-to-wired-instruments Phase 1.1 — the CLI entry for `hook_effect_doctor`) registers in the same PR that adds the surface, per this record's own contract. It exists because the probe and its five-state vocabulary were built, tested and reachable from nothing: `grep -rn 'hook_effect_doctor|hook_effect_probe' src Taskfile.yml .github` returned only the two modules themselves, and a closed roadmap recorded the wiring as landed at `src/scripts/hooks_doctor.ts:88`, a line that is the closing brace of a filesystem helper in a file with zero references to the probe. Deliberately NOT merged into `hooks:doctor`: that verb reads the MANIFEST (what is declared) and this one reads what happened (what took effect), and the probe's own header names merging them as the thing to avoid — a declaration report and an execution report are different instruments, and merging them makes the cheap one expensive. Read-only apart from a scratch root it removes in a `finally`. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 110."
     },
     "mcp_public_tool_count": {
-      "max": 25,
-      "last_measured": 25,
-      "last_measured_at": "2026-09-09",
+      "max": 26,
+      "last_measured": 26,
+      "last_measured_at": "2026-10-01",
       "method": "tools/list length on the stdio server (post-ADR-132: implemented tools only)",
-      "baseline_note": "19 → 20 on 2026-08-17 (release 13.0.0 gate). The +1 is 866bd9861 (feat(mcp): recover what the host dropped — real ranker tool + a route to it, road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 4): `suggest_skill_for_task` was promoted from a discovery STUB to a real ALLOWLIST entry and removed from STUB_TOOLS. Worth stating precisely, because the consumer-visible NAME did not grow — the stub already published that name and its `task` + `limit` input schema, which the promotion carried over verbatim. What grew is the count of tools tools/list actually returns, which is exactly what this metric measures post-ADR-132: implemented tools only. Same shape as the cli_help_command_count history above — this RECORDS growth that already shipped through its own reviewed PR (866bd9861 is on main), it does not authorize new surface. The registering PR did not move this budget, so the gate did its job: the breach warned on main and blocked on the release ref, which is the conscious-decision point rather than a silently raised cap. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 20/20. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR. 20 → 25 on 2026-09-09 (release 14.23.0 gate). The +5 are `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query` and `graph_path` — 9452f29b4 (feat(mcp): five graph tools, the pinned install hint, and the skill description; road-to-a-graph-that-is-shipped Phase 4.1), which is on main. They are the agent-facing readers of the code graph: the roadmap Risk-Register rank 1 is \"the install grows and the graph is still unread\", and an agent that has to shell out to reach a verb will not, so the tools ARE the mitigation rather than a convenience. Same shape as every entry above — this RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The registering PR did not move this budget, so the gate did its job again: the breach warned on main and BLOCKED on the release ref, which is the conscious-decision point rather than a silently raised cap. The move is +25%, over the 10% creep rule, and that is the intended reading: five tools in one commit is a surface decision, not creep. Re-measured three times via the pinned method on a freshly built dist/mcp/server.mjs: 25/25/25, the returned name set differing from the 20-tool set by exactly the five graph_* entries. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR."
+      "baseline_note": "19 → 20 on 2026-08-17 (release 13.0.0 gate). The +1 is 866bd9861 (feat(mcp): recover what the host dropped — real ranker tool + a route to it, road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 4): `suggest_skill_for_task` was promoted from a discovery STUB to a real ALLOWLIST entry and removed from STUB_TOOLS. Worth stating precisely, because the consumer-visible NAME did not grow — the stub already published that name and its `task` + `limit` input schema, which the promotion carried over verbatim. What grew is the count of tools tools/list actually returns, which is exactly what this metric measures post-ADR-132: implemented tools only. Same shape as the cli_help_command_count history above — this RECORDS growth that already shipped through its own reviewed PR (866bd9861 is on main), it does not authorize new surface. The registering PR did not move this budget, so the gate did its job: the breach warned on main and blocked on the release ref, which is the conscious-decision point rather than a silently raised cap. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 20/20. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR. 20 → 25 on 2026-09-09 (release 14.23.0 gate). The +5 are `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query` and `graph_path` — 9452f29b4 (feat(mcp): five graph tools, the pinned install hint, and the skill description; road-to-a-graph-that-is-shipped Phase 4.1), which is on main. They are the agent-facing readers of the code graph: the roadmap Risk-Register rank 1 is \"the install grows and the graph is still unread\", and an agent that has to shell out to reach a verb will not, so the tools ARE the mitigation rather than a convenience. Same shape as every entry above — this RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The registering PR did not move this budget, so the gate did its job again: the breach warned on main and BLOCKED on the release ref, which is the conscious-decision point rather than a silently raised cap. The move is +25%, over the 10% creep rule, and that is the intended reading: five tools in one commit is a surface decision, not creep. Re-measured three times via the pinned method on a freshly built dist/mcp/server.mjs: 25/25/25, the returned name set differing from the 20-tool set by exactly the five graph_* entries. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR. 25 → 26 on 2026-10-01: the +1 is `graph_node` (road-to-a-graph-that-feeds-the-gate step 3.1), and this entry moves in the SAME PR that adds the surface, which is what every entry above asks of the next one. Why a sixth graph tool rather than an argument on one of the five: the five all answer about a NEIGHBOURHOOD (`graph_query`, `graph_path`, `graph_impact`) or about a SET (`graph_dead`, `graph_tests_for`), and none answers the question an agent asks first — where does this symbol live, who reaches it, what does it reach, how connected is it — which had to be assembled from two calls plus a file read. It walks the edge maps `affected` already walks, so it adds a view and not an index. It is also the one graph tool that REFUSES rather than guesses: it resolves on the exact tiers of the existing seed ladder (node id, then label) and returns a refusal naming the candidates when a label is ambiguous or nothing matches exactly, because free-text retrieval is the row the graph measurably lost (`docs/CLAIMS.md` code-graph-retrieval-null) and every field it returns is a statement about ONE node. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 26/26, the returned name set differing from the 25-tool set by exactly `graph_node`. Headroom stays zero by design."
     }
   }
 }