@event4u/agent-config 16.1.0 → 16.3.0

package/src/config/gate-coverage.yml

@@ -52,15 +52,43 @@
 #                of them.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-09-13)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-10-01)
 # ----------------------------------------------------------
-# 330 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 347 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`,
 # re-run on the tree carrying these rows.)
-# **97 rows are listed below**, so the manifest covers 97/332 = 29.2 % of the
+# **109 rows are listed below**, so the manifest covers 109/347 = 31.4 % of the
 # population, and is complete for every gate that can carry a floor. The row
 # count is `grep -c '^  - id:'`, recomputed here rather than incremented.
 #
+# RECOUNTED 2026-09-29 ON A MERGE, and this is the hazard the two blocks below
+# predicted arriving in the form they predicted. Two branches each recounted
+# CORRECTLY for their own tree — 341/103 here, 341/102-then-103 there — and
+# after the merge both rows exist, so NEITHER pair describes the file. Both
+# figures are recomputed on the MERGED tree rather than reconciled or
+# incremented: 345 from `count_gate_scripts`, 107 from `grep -c '^  - id:'`.
+# The same failure `.secret-allow` records for its own line pin, in a second
+# file, for the same structural reason: a figure about an append-heavy manifest
+# drifts per-branch, not only per-commit.
+#
+# RECOUNTED 2026-09-29, on the change that adds `check_read_surface_coverage`.
+# The header said 97 rows against an actual 102 and 330 scripts against an
+# actual 341 — drift of 5 and 11 against the tolerance of 15 in
+# `check_gate_coverage.test.ts` § states an honest denominator, so nothing was
+# red and the 341st arrival would not have redded it either. Corrected on the
+# way past, which the block below says is exactly how this figure keeps ending
+# up a function of who happened to look. Both numbers are computed here, not
+# incremented: 341 from `count_gate_scripts`, 103 from `grep -c '^  - id:'`.
+# RECOUNTED 2026-09-29, on the change that adds `check_host_format_column`, and
+# BOTH figures had already drifted — which is the block below predicting itself.
+# The header read 330 scripts against a measured 341 (drift 11, against the
+# tolerance of 15 in `check_gate_coverage.test.ts` § states an honest
+# denominator) and 97 rows against a measured 102 before this change. Neither
+# was red and neither would have been for another four arrivals. Both are
+# recomputed on this tree rather than incremented, for the reason the 2026-09-13
+# block gives: an incremented figure inherits whatever error it started from,
+# and the drift above is what that inheritance looks like after sixteen days.
+#
 # RECOUNTED 2026-09-13, on a change that adds NO gate script — and that is the
 # point of this block rather than an aside. Every recount below was triggered by
 # someone adding a row and noticing the header was stale on the way past, which
@@ -1418,6 +1446,14 @@ gates:
     status: enforced
     no_canary_reason: "The gate carries its own `--self-test` (5 cases, 3 rejecting) — so this row is an adopter, not an exemption; the reason field states why a PLANTED canary is additionally unavailable. Beyond the self-test the negative controls are the 30 mechanism tests in tests/scripts/check_claims.test.ts (17) and tests/scripts/check_claims_retired_phrasings.test.ts (13), each building a throwaway tree and running the real script in it. Twenty-one assert a REJECTION, and one publishes the LITERAL historical string (`zero runtime daemon`) that shipped in package.json and .github/about.yml while claim:no-runtime-daemon was already withdrawn. A planted canary here would mean committing a retired phrasing to a real publish surface and removing it again, and a forgotten one is precisely the defect this gate exists to catch."
 
+  - id: check_kill_switch_table
+    argv: []
+    ci_invocation: .github/workflows/rule-backstops.yml
+    min_scanned: 3
+    corpus: "the three ledger targets this gate resolves — the tree enumeration over `src/scripts/hooks/` and `src/scripts/_lib/` (419 files, 29 switches at registration), the table's row set in `docs/contracts/hook-architecture-v1.md` § Kill switches (29 rows), and the set comparison between them. The FILE count is separately floored by `assertScanned`, which refuses a run that read zero source files, so a moved root fails rather than reporting an empty tree as agreement with an empty table."
+    status: enforced
+    no_canary_reason: "The gate carries its own `--self-test` (6 cases, 4 rejecting), run as its own CI step: a switch with no row, a row with no switch, one-added-plus-one-stale (which a COUNT comparison would pass and a set comparison must not), and a missing section — plus two ACCEPT cases pinning that the two esbuild `--define` identifiers stay excluded, so a gate that started rejecting everything would not pass either. A planted canary would mean committing a fake `AGENT_CONFIG_*` read into a real hook file and removing it again, and a forgotten one is an environment variable in the shipped hook layer that nothing reads — the exact defect this gate exists to catch, left behind by its own canary."
+
   - id: check_rule_evidence_declaration
     argv: []
     min_scanned: 10
@@ -1460,6 +1496,30 @@ gates:
       cannot survive a collapse: at that point the gate's own `reportScanned`
       fires first. (Set to 50 in the first version, corrected on an R2 finding.)
 
+  - id: check_verify_expectation_delta
+    argv: []
+    min_scanned: 0
+    corpus: "the `verify:` clauses a change ADDS under agents/roadmaps/ — a set difference against the base ref, not a file set, which is why the floor is 0: a change touching no roadmap legitimately adds none, and a floor above 0 would fail every unrelated pull request. The denominator the gate reports is added clauses, so a change that adds ten to one file scanned ten things."
+    status: enforced
+    no_canary_reason: >
+      A canary cannot express this gate's violation. The violation is a property
+      of the DIFF — a clause that was ADDED without an expectation — so a file
+      planted in the tree is, from the gate's point of view, a clause somebody
+      added, which is either a true positive (and the canary is indistinguishable
+      from the thing it is meant to detect) or, once committed on main, invisible
+      forever. The negative control is the gate's own `--self-test`, run as its
+      own CI step: 10 cases, 4 rejecting — an added bare clause, a bare clause
+      among expectation-carrying siblings, a `cat` command asked for an oracle
+      despite a weak exit status, and an `./path/script.ts` invocation that the
+      pointer carve-out must NOT exempt — plus six ACCEPT cases pinning what must
+      not fire (an expectation in either form, the prose MANUAL form, a backticked
+      file pointer with and without a `:line` suffix, and a bare clause already at
+      base). One limit is stated rather than implied: the already-at-base case
+      does not exercise context-line handling, because under `--unified=0` the
+      unchanged clause does not appear in the patch at all; the unit test
+      `reads ADDED lines only` is what pins that. Same class as
+      check_estate_count's diff-scoped half.
+
   - id: check_static_parity
     argv: ["--quiet"]
     min_scanned: 20
@@ -2882,6 +2942,146 @@ gates:
         A projected rule routing to a guideline body the projection does not
         contain. The gate must fail on this and pass once it is removed.
 
+  - id: check_placeholder_drift
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 400
+    corpus: "every projected command and skill source — 502 at baseline; the ratchet reads their PROSE, per the unit published in report_invocation_surface.ts"
+    status: enforced
+    no_canary_reason: >-
+      a create-only canary CAN plant a skill, and a planted body carrying a
+      foreign placeholder is exactly what this gate rejects — so the plant is
+      not impossible, it is redundant. `--self-test` already runs that plant as
+      one of five cases over a fixture root, and doing it in-tree would drop a
+      stray SKILL.md into a projected directory, reddening unrelated generator
+      and count gates before this one is reached. Discrimination is proven by
+      that self-test (5 cases, 3 rejecting) covering both directions the ratchet
+      has to separate: at the seed and BELOW it, green — it must never fail on
+      the absolute number; one occurrence over a ceiling, and a first occurrence
+      against a zero ceiling, red; and an unreadable budget refusing with exit 2
+      rather than certifying a green it could not compute.
+
+  - id: check_input_references
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 400
+    corpus: "projected commands and skill sources — 502 at baseline. Only artifacts that DECLARE an inputs block are checked, so the finding population is a subset that grows with adoption"
+    status: enforced
+    no_canary_reason: >-
+      the finding population is empty by construction until artifacts adopt the
+      optional block, so a create-only canary would have to plant a DECLARING
+      artifact carrying an unbacked reference — which is precisely what the
+      self-test plants, over a fixture root instead of into src/skills/.
+      Discrimination is proven there (3 cases, 1 rejecting) across the
+      distinction that actually matters for this gate: a backed reference
+      passes, an unbacked one fails, and an artifact with NO declaration passes
+      however it references — the scope rule that lets the gate ship green.
+
+  - id: check_argument_hint
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 200
+    corpus: "command sources under src/domains — 203 at baseline. Commands only, because argument-hint is a key of command.schema.json and of no other schema"
+    status: enforced
+    no_canary_reason: >-
+      every violation is a DISAGREEMENT between two fields of one file — a
+      hand-written hint contradicting a declaration, or a declaration with no
+      hint. A created file is a legitimate corpus member unless it carries that
+      disagreement, so the useful plant is a content plant, which the self-test
+      performs over a fixture root (4 cases, 2 rejecting): a matching hint
+      passes, a contradicting one fails, a declaration with no hint fails, and
+      an artifact with no declaration keeps its free-text hint untouched. The
+      conflict case was also reproduced by hand against the real tree on
+      2026-09-29 by planting a wrong hint on a declaring command, which exits 1.
+
+  - id: check_inputs_parity
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 400
+    corpus: "command sources, skill sources and projected commands — 705 at baseline; only those declaring an inputs block can diverge"
+    status: enforced
+    no_canary_reason: >-
+      a violation is a DIFFERENCE between two readings of one file, so nothing
+      about a file's existence can produce it — only its content can. The
+      self-test plants that content over a fixture root (5 cases, 4 rejecting),
+      one per way the stdlib-only MCP reader and a real YAML parse can part
+      company: the flow form, a nested mapping under an item key, a block
+      scalar, and a dash on its own line. The accepting case is the supported
+      block form, because a suite that only proves failures proves a gate that
+      refuses everything.
+
+  - id: check_read_surface_coverage
+    argv: ["--quiet"]
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 12
+    corpus: >
+      modules under `src/scripts/` that both bring outside bytes in through a
+      recognised inbound shape (`await fetch`, a `node:http(s)` request, a
+      subprocess of curl/wget/gh, a parse of markup on stdin, or a shape the
+      module declares at its own site) and hand a string onward — 24 at
+      baseline. The floor sits at 12 because the shape set is narrow and the
+      corpus moves by ones as a network call is added or removed; a reading
+      below it means a detector stopped matching or the walk lost `src/scripts/`,
+      not that half this repository's network calls were deleted.
+    status: enforced
+    no_canary_reason: >-
+      the canary contract is create-only, and a planted module carrying a fetch
+      would be a legitimate corpus member — the gate would emit a row for it and
+      be right to. Every violation this gate has is a DIFFERENCE between two
+      readings: the committed table against the regenerated one, the floor's
+      header against the table, the detector's text against the no-percentage
+      rule. None of those can be produced by a file's existence, only by its
+      content. Discrimination is proven by `--self-test` instead (7 cases, 6
+      rejecting: a seeded unsanitized fetch-derived emit the table does not
+      carry, a hand-flipped coverage cell, a header restating a module path the
+      table lists, a header with no pointer at all, a recall percentage in the
+      structural detector, and an empty scan root). That last case is the
+      scan-scope collapse `assertScanned` exists for, observed red on
+      2026-09-29 by planting a fixture root with no `src/scripts/` at all: it
+      exits 1 with "scanned 0 read surface(s)" rather than certifying a table it
+      never compared.
+
+  - id: check_hook_bundle_composition
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 150
+    corpus: >
+      modules esbuild inlines into `dist/hooks/dispatch.js` — 276 at baseline,
+      read from the metafile of a build this gate performs rather than from the
+      untracked bundle on disk. The floor sits at 150 because the dispatcher's
+      concern chain alone accounts for most of that graph and the figure moves by
+      ones as a concern is added or a dependency dropped; a reading below it means
+      the entry point moved or the build produced a stub, not that half the hook
+      layer was deleted. Note the floor is a MODULE count while the gate's own
+      bound is a BYTE count — deliberately two different units, because a bundle
+      can collapse to a stub at constant byte size only by also collapsing its
+      module graph, and neither number alone sees both failures.
+    status: enforced
+    no_canary_reason: >-
+      the canary contract is create-only and this gate's corpus is a BUILD
+      OUTPUT, not a tree. A planted file under `src/` is in scope only if
+      something imports it, and a planted file under `dist/hooks/` is read by
+      nothing here — the gate builds its own bundle to a temporary directory
+      precisely so no on-disk artefact can steer its verdict. Both violations it
+      has are properties of that build: a second YAML package contributing bytes,
+      and a byte count over the committed ceiling. Discrimination is proven by
+      `--self-test` instead (4 cases, 3 rejecting: a second YAML reader, a bundle
+      one byte over the ceiling, and a metafile with no entry-point output — the
+      last being the build-produced-nothing case, which must exit non-zero rather
+      than certify a composition of 0 bytes). Proven additionally against the
+      REAL artefact rather than only against fixtures: run over the metafile of
+      the pre-swap bundle, both findings fire with the measured figures
+      (`js-yaml` 95,846 B beside `yaml` 258,839 B, 1,563,576 bytes against a
+      1,500,000 ceiling), which is the regression this gate was built for seen
+      red on the bytes that actually shipped.
+    note: >
+      road-to-a-hook-bundle-with-one-yaml-reader 1.3 + 2.1. Its two siblings are
+      local-only by construction (`dist/hooks/` is untracked, so CI has no bundle
+      to read); this one is not, because it builds the bundle it measures. What it
+      deliberately does NOT claim is anything about latency — the wall-clock axis
+      is `src/config/hook-latency-budget.json` and no number here is derived from
+      it.
+
   - id: check_enforcement_matrix
     argv: ["--quiet"]
     ci_invocation: .github/workflows/consistency.yml
@@ -2905,6 +3105,77 @@ gates:
       and the phantom value wrote through; the backing set now reads the raw
       configuration fields and the same sabotage exits 1.
 
+  - id: check_host_format_column
+    argv: ["--quiet"]
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 8
+    corpus: "rows of the host table in docs/enforcement-by-host.md, found by its exact header line (9 at baseline — the nine hosts the file lists)"
+    status: enforced
+    no_canary_reason: >-
+      the corpus is the one table in ONE document at a fixed path, and the
+      canary contract is create-only. A planted second `enforcement-by-host.md`
+      would have to overwrite the real one to land in scope, and every violation
+      this gate can have is a MODIFICATION — a format cell hand-edited to name a
+      path no emitter writes. Discrimination is proven by `--self-test` instead
+      (5 cases, 4 rejecting: the historical `.cursorrules` defect planted back
+      into the Cursor cell, the near-miss `.cursor/rules.mdc`, an invented
+      surface on a correct neighbouring row, and a document whose table header
+      is gone — which must fail on the scope assertion rather than pass over an
+      empty corpus). The self-test earned that list rather than being written to
+      match: on its first run it reported the near-miss case as NOT behaving,
+      twice and for two different real defects. The first was in the matcher —
+      `USER_SCOPE_PATHS`' bare `~/.cursor/` anchor was being treated as a root
+      anything could refine, so `.cursor/rules.mdc` passed on an anchor no
+      emitter writes into; anchors are exact-match only now. The second was in
+      the fixture — it replaced the token rather than the whole row, and the
+      same token appears in the prose paragraph above the table, which this gate
+      does not scan, so `String.replace` mutated the prose and the case asserted
+      nothing. End to end by hand on 2026-09-29: restoring `.cursorrules` into
+      the committed Cursor row exits 1 naming that row and that token, and the
+      restore exits 0.
+
+  - id: lint_deny_text
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 5
+    corpus: "the `severity: blocking` concerns in src/scripts/hook_manifest.yaml, read from the manifest rather than listed in the gate (9 at baseline)"
+    status: enforced
+    no_canary_reason: >-
+      the corpus is derived from one manifest at a fixed path and the canary
+      contract is create-only. A planted extra concern file is out of scope
+      unless the manifest also names it, and every violation this gate can have
+      is a MODIFICATION — a refusal message edited to name the switch that
+      turns the guard off. Discrimination is proven by `--self-test` instead
+      (7 cases, 3 rejecting: an env assignment with its value, an `export`
+      line, a settings key in prose, and — the direction that matters for a
+      young pattern gate — a bare settings key used as a LOOKUP, which must
+      pass, because a rule that fired on it would fire on every concern that
+      reads its own configuration). An empty corpus is refused by
+      `assertScanned` before the verdict, so a manifest whose `severity:` key
+      was renamed fails rather than certifying zero concerns clean.
+
+  - id: lint_exit_codes
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 40
+    corpus: "every `.ts` under src/scripts/hooks/ except `exit_codes.ts` itself, which is where the numerals are defined (59 at baseline)"
+    status: enforced
+    no_canary_reason: >-
+      the canary contract is create-only, and a planted hook file carrying a
+      bare `process.exit(1)` WOULD be a legitimate violation the gate is right
+      to report — so a create-only canary here proves detection, not
+      discrimination, and the interesting direction is the opposite one: an
+      imported name must PASS. Discrimination is proven by `--self-test`
+      instead (6 cases, 4 rejecting: a bare deny numeral, a bare allow numeral
+      — `0` is the one people assume is harmless — a call with whitespace
+      inside it, and an empty corpus; against two accepting cases, an imported
+      name and the table file, whose fixture plants a bare exit into
+      `exit_codes.ts` every run so the one exclusion is exercised rather than
+      asserted). What a green does NOT cover is stated in the gate's header: it
+      accepts an identifier without resolving where the identifier came from, so
+      a local `const EXIT_BLOCK = 1` shadowing the import passes this gate and
+      is caught in review as a duplicate declaration.
+
   - id: check_release_holds
     argv: ['--lint']
     ci_invocation: .github/workflows/release-validation.yml
@@ -2933,3 +3204,56 @@ gates:
       inside the gate by `assertScanned` — observed red on 2026-09-19 by
       pointing the folder list at a non-existent directory, which exits 1 with
       "scanned 0 roadmap file(s)" rather than certifying an empty corpus.
+  - id: check_host_docs_digest
+    argv: []
+    min_scanned: 8
+    corpus: "verified ROWS of src/scripts/hooks/host_lowering.yaml — the (host, surface) pairs carrying a `verified:` block, which are the rows that can cite a page at all. Nine today; the floor is 8 because a host legitimately leaving the table is a one-row move, while a resolver that stopped seeing the table would read zero. Counting rows and not URLs is deliberate: `cowork` carries a verified block with `docs_url: null` and is a real row the watcher must still see and skip, so a URL count would make a correct no-url row look like corpus loss."
+    status: enforced
+    ci_invocation: .github/workflows/host-docs-digest.yml
+    no_canary_reason: >-
+      A planted file cannot express this gate's violation. The corpus is ONE
+      configuration file plus the live bodies of eight vendor pages, so there is
+      no tree a canary could be added to: the only way to make the floor fire is
+      to remove rows from `host_lowering.yaml`, which is the thing the floor
+      exists to notice and not something a canary may do to a plumbing source
+      under `check_kernel_edit_ratified`. Discrimination is proven instead by
+      two things that run. `--self-test` drives the real decision functions over
+      the real table, including both directions of every state — unchanged vs
+      changed, filled vs missed, 404 (`gone`) vs 503 (`unreachable`), and drift
+      write vs no write. And `tests/scripts/host_docs_digest.test.ts` (20 cases)
+      runs the REAL `lint_hook_manifest._check_host_lowering` over the REAL
+      writer's output, so the full drift-to-refusal chain is exercised end to
+      end rather than asserted. Both were seen RED deliberately: neutralising
+      `isDrift` fails 4 of 20, and reverting the `gone` write-skip fails the
+      case that pins it. The `filled`-vs-`missed` direction named above is
+      asserted in BOTH places — it was credited to `--self-test` before it was
+      actually there, which a review caught and which is why the assertion now
+      exists rather than the sentence being softened.
+  - id: lint_workflow_security
+    argv: []
+    min_scanned: 25
+    corpus: "workflow files under .github/workflows/ — `*.yml` then `*.yaml`, the two globs the gate scans in that order (34 today). The floor is 25 because workflows are consolidated and split routinely, so a handful leaving is normal, while a glob that stopped matching or a directory that moved reads far below it. Counting FILES and not findings is the point: this gate legitimately reports zero findings, so a floor over findings would be the false-count shape this file rejects."
+    status: enforced
+    ci_invocation: .github/workflows/consistency.yml
+    no_canary_reason: >-
+      A create-only canary cannot change this gate's verdict. It is warn-only by
+      design — the council-locked severity model (2026-06-13) makes MEDIUM
+      advisory and only `--strict` turns a HIGH into exit 1 — and the CI
+      invocation this row pins carries no `--strict`, so a planted workflow with
+      a `pull_request_target` untrusted checkout would be REPORTED and the gate
+      would still exit 0. A canary run under a different argv would prove
+      something about an invocation CI does not make, which is the drift
+      `ci_invocation` exists to stop. Discrimination is proven by `--self-test`
+      instead (5 cases, 3 rejecting), which drives the two exits the gate really
+      has rather than the one the CI invocation cannot reach: an empty workflows
+      directory exits 2 instead of printing "0 HIGH, 0 MEDIUM" over nothing, a
+      `pull_request_target` checkout of the untrusted ref exits 1 under
+      `--strict`, and an over-cap allowlist exits 2 instead of suppressing
+      silently. The two accepting cases pin the warn-only tier from the other
+      side — a MEDIUM under `--strict` must still PASS, which is the direction a
+      future re-tiering would silently break, and a clean workflow must pass at
+      all. Seen red deliberately on 2026-10-01 by emptying `DANGEROUS_TRIGGERS`:
+      the HIGH case alone fails, 4/5, and restoring it returns 5/5. Promoting the
+      tier so a canary becomes expressible is a separate decision, recorded
+      unresolved in
+      agents/evidence/analysis/workflow-security-net-degraded-decision.md.