@event4u/agent-config 16.1.0 → 16.3.0

package/src/config/placeholder-drift-budget.json

@@ -0,0 +1,10 @@
+{
+  "owner": "maintainer",
+  "review_by": "2027-09-29",
+  "seeded_at": "2026-09-29",
+  "note": "Shrink-only ceilings on FOREIGN placeholder syntaxes in prose, per road-to-an-invocation-contract-that-reaches-the-wire 1.2. The unit is a token outside fenced blocks, indented blocks and inline code spans — defined and argued in src/scripts/report_invocation_surface.ts's module header, with the per-file breakdown in agents/evidence/analysis/invocation-surface-census.md. Seeded at what this tree measures, not at the roadmap's figures: those counted tokens inside demonstrated code (JS template literals, HCL, a table-cell marker the prose talks about) and do not reproduce. The plurality form is deliberately ungated. Raising a ceiling is a reviewable diff, and the reason belongs in it.",
+  "ceilings": {
+    "angle-upper": 3,
+    "double-brace": 0
+  }
+}

package/src/config/routing-coverage-seed.json

@@ -10,12 +10,12 @@
     },
     "seed": {
         "rules": 0.9623,
-        "skills": 0.3378
+        "skills": 0.3746
     },
     "seed_provenance": {
         "rules": "102 covered of 106 routed rules on 2026-09-13; was 101 of 105 on 2026-09-08 and 94 of 105 (tier-1 21/24, tier-2 73/81) on 2026-08-25.",
-        "skills": "101 of 299 skills carry evals/triggers.json on 2026-09-19; was 100 on 2026-08-30.",
-        "finding": "The gap between the two seeds IS the roadmap defect D1, quantified. The rules surface is ~90% covered by a deterministic corpus that can fail a PR; the skills surface -- the one production routes on -- is 25%, covered only by a harness that is advisory only, never gating (rule_trigger_eval.ts:4)."
+        "skills": "112 of 299 skills carry evals/triggers.json on 2026-10-04; was 111 on 2026-10-02, 107 on 2026-10-01, 103 earlier that day, 102 on 2026-09-30, 101 on 2026-09-19 and 100 on 2026-08-30.",
+        "finding": "The gap between the two seeds IS the roadmap defect D1, quantified. The rules surface is ~90% covered by a deterministic corpus that can fail a PR; the skills surface -- the one production routes on -- is far lower and is covered only by a harness that is advisory only, never gating (rule_trigger_eval.ts:4). The figure is deliberately not restated here (corrected 2026-10-01): it read `25%` against a seed that had since moved to 0.3445, which is the same count-drift this file's own history entries keep repairing one field away. The live value is `seed.skills`, two keys above."
     },
     "history": [
         {
@@ -59,6 +59,41 @@
             "from": 0.3344,
             "to": 0.3378,
             "reason": "road-to-release-holds-that-refuse step 1.4 authored one corpus file for `roadmap-writing` (100 -> 101 of 299) and removed its now-false entry from trigger_eval_grandfather.json. ONE file rather than a wave: the step asked for a single positive case whose expected output is a re-sequenced phase rather than a hold, and the eval set is where that expectation is pinned. The seed rises so the gain cannot be given back silently; it may never be LOWERED. Two published measurements moved with it and were re-taken in the same change -- routing-body-signal-verdict.json and the measure_delivery_sets record -- because the trigger corpus is their input, so any skill gaining an eval set re-takes both."
+        },
+        {
+            "date": "2026-09-30",
+            "scope": "skills",
+            "from": 0.3378,
+            "to": 0.3411,
+            "reason": "road-to-a-component-taxonomy-we-follow-but-never-force authored one corpus file for `ui-component-architect` (101 -> 102 of 299). Not a sought gain: the branch edits that skill's placement section, and check_routing_coverage requires a corpus for every skill a diff touches, so the file is the gate's own remedy rather than a coverage push. Five should-trigger cases, one per shape the skill decides, and five near misses whose vocabulary overlaps hardest -- styling an existing component, inventorying what the project owns (existing-ui-audit, which runs first and feeds this one), a backend composition question, a prop rename, and general React knowledge with no component to shape. The seed rises so the gain cannot be given back silently; it may never be LOWERED. The two published measurements the 2026-09-19 entry names -- routing-body-signal-verdict.json and the measure_delivery_sets record -- are re-taken in the same change, for the reason that entry gives: the trigger corpus is their input."
+        },
+        {
+            "date": "2026-10-01",
+            "scope": "skills",
+            "from": 0.3411,
+            "to": 0.3445,
+            "reason": "road-to-corpus-refresh-cadence-shape step 1.2a authored one corpus file for `accessibility-auditor` (102 -> 103 of 299). Same shape as the 2026-09-30 entry and for the same reason: that step re-checked the skill's grounding corpus against WCAG 2.2 and the APG, which edited src/skills/accessibility-auditor/data/, and check_routing_coverage requires a corpus for every skill a diff touches. Ten cases -- five exemplars including the German phrasing the skill's own description names, three near-misses -- tailwind-engineer for token-level contrast and ui-component-architect for landmarks and heading order, both named in that skill's SKILL.md, plus existing-ui-audit for component inventory, which it does not name and which is included because it runs first over the same surface -- and two counterexamples, one guarding the 'accessible' homonym. The seed rises so the gain cannot be given back silently; it may never be LOWERED. The trigger-corpus holdout pin is re-taken in the same change -- and this growth moves it for the first time on the HOLDOUT side (18 -> 19), because sha256('accessibility-auditor')[0:2] is 0x2f = 47, below the ceiling of 51. That is recorded in the holdout artefact with its ordering claim explicitly scoped to the 18 originally sealed rows. The two published measurements the 2026-09-19 and 2026-09-30 entries name -- routing-body-signal-verdict.json and the measure_delivery_sets record -- are deliberately NOT re-taken here, and the departure from those two entries is stated rather than left to be noticed. The reason is the partition, not the date: this growth is HOLDOUT-side, so the train input both measurements read is byte-identical to what it was before this change -- all 84 train rows reproduce -- and re-taking them would publish the same measurement under a newer date, which is a freshness claim nothing earned. The two artefacts are NOT in the same state, and conflating them would repeat the error this sentence replaces: routing-body-signal-verdict.json carries `corpus.partition: train` and `train_corpora: 84` and is current for the train partition; delivery-set-result-2026-08-31.md still reads `82 train corpora, 764 distinct prompts` and carries no re-take section for either the 2026-09-19 or the 2026-09-30 growth, so it is two corpora stale and those two entries' claim that it `is re-taken in the same change` is not backed by the tree. Repairing it is a train-side measurement re-run, out of scope for a holdout-side growth, and is named here so the gap is attributed rather than inherited silently. A FUTURE train-side growth owes both re-takes. Separately, TWO entries were removed from trigger_eval_grandfather.json, and the two reds are of different kinds. `ui-component-architect` was red ON MAIN: it gained a corpus on 2026-09-30 and its now-false allowlist entry was not removed then, which is the convention the 2026-09-19 entry sets and the 2026-09-30 entry omitted. `accessibility-auditor` was NOT red on main -- on main it ships no corpus at all, and check_trigger_eval_presence fires only on an allowlist entry whose skill HAS one, so its entry went stale the moment this change added the corpus. That red is created here and removed here, in the same change. Stated separately because a reader auditing why two entries were dropped would otherwise be told one pre-existing condition explains both."
+        },
+        {
+            "date": "2026-10-01",
+            "scope": "skills",
+            "from": 0.3445,
+            "to": 0.3579,
+            "reason": "road-to-a-trunk-whose-own-gates-are-green authored FOUR corpus files (103 -> 107 of 299) for review-routing, skill-improvement-pipeline, tailwind-engineer and design-system-capture. Same shape as the 2026-09-30 and the earlier 2026-10-01 entries and for the same reason: that branch de-links cross-pack references in those four skills, and check_routing_coverage requires a corpus for every skill a diff touches, so the files are the gate own remedy rather than a coverage push. Four at once rather than one because one de-link pass touched four grandfathered skills in a single change. Each file carries three positives including one German, two near-misses and one counterexample, with the case class declared per query because that discipline is forward-only and these are added files; the near-misses are the surfaces one step either side rather than easy negatives. The seed rises so the gain cannot be given back silently; it may never be LOWERED. Four entries were removed from trigger_eval_grandfather.json (196 -> 192), none of them red on main beforehand: the gate fires only on an allowlist entry whose skill HAS a corpus, so all four went stale the moment this change added one, and each red is created and removed in the same change. The partition split is 3 holdout / 1 train by name hash, which is why BOTH published train-side measurements the 2026-09-19 entry names are re-taken here rather than skipped the way the holdout-only growth above skipped them: routing-body-signal-verdict.json and delivery-set-measurement-2026-08-31.json both move, and the holdout pin gains three sealed rows plus a new set hash with its ordering claim explicitly NOT extended to them."
+        },
+        {
+            "date": "2026-10-02",
+            "scope": "skills",
+            "from": 0.3579,
+            "to": 0.3712,
+            "reason": "road-to-stacks-beyond-php steps 1.2 and 1.4 authored FOUR corpus files (107 -> 111 of 299) for quality-tools, test-driven-development, api-testing and test-performance. Same shape as both 2026-10-01 entries and for the same reason: that lane adds one ecosystem-keyed paragraph to three skill bodies and two reference bodies under a fourth, and check_routing_coverage requires a corpus for every skill a diff touches \u2014 so the files are the gate's own remedy rather than a coverage push. Each carries exemplars in DE and EN, near-misses naming the neighbour that actually owns the adjacent job rather than easy negatives, and counterexamples for the two directions its vocabulary over-claims, with the case class declared per query. The seed rises so the gain cannot be given back silently; it may never be LOWERED. The partition split is 2 holdout / 2 train by name hash \u2014 quality-tools at 0x20 = 32 and test-performance at 0x10 = 16 seal; test-driven-development at 0x47 = 71 and api-testing at 0x67 = 103 train \u2014 so BOTH published train-side measurements are re-taken here on the terms the 2026-10-01 entries set for a train-side growth: routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +7.35 pp against the +2.0 pp guard) and delivery-set-measurement-2026-08-31.json. The holdout pin gains two sealed rows with its ordering claim NOT extended to them, for the reason the 19th row already established: a row authored today predates nothing."
+        },
+        {
+            "date": "2026-10-04",
+            "scope": "skills",
+            "from": 0.3712,
+            "to": 0.3746,
+            "reason": "road-to-corpus-refresh-cadence-shape step 1.2b authored ONE corpus file for `api-design` (111 -> 112 of 299). Same shape as the 2026-10-01 entry this roadmap's 1.2a wrote, and for the same reason: that step re-checked the skill's grounding corpus against RFC 9110/9457/7396/8288, which edited src/skills/api-design/data/, and check_routing_coverage requires a corpus for every skill a diff touches -- so the file is the gate's own remedy rather than a coverage push. Ten cases: five exemplars including the 'expose this as an endpoint' phrasing the skill's own description names and one German, three near-misses -- api-endpoint for implementing an already-designed route and api-testing for covering one, both named in that skill's SKILL.md 'Do NOT use when' block, plus openapi for documenting an existing endpoint set, which it does not name and which is included because it runs over the same endpoint list immediately after design -- and two counterexamples, one guarding the 'API' homonym (consuming a third-party interface rather than designing ours). The seed rises so the gain cannot be given back silently; it may never be LOWERED. The partition is TRAIN, not holdout: sha256('api-design')[0:2] is 0xbb = 187, above the holdout ceiling of 51, which is why BOTH published train-side measurements are re-taken here on the terms the 2026-10-01 and 2026-10-02 entries set for a train-side growth -- routing-body-signal-verdict.json and delivery-set-measurement-2026-08-31.json -- and why the holdout pin is NOT touched: its sealed rows are unchanged by a train-side addition, and re-taking it would publish the same measurement under a newer date, which is a freshness claim nothing earned. ONE entry was removed from trigger_eval_grandfather.json (192 -> 191): `api-design` was NOT red on main -- on main it ships no corpus at all, and check_trigger_eval_presence fires only on an allowlist entry whose skill HAS one, so its entry went stale the moment this change added the corpus. That red is created here and removed here, in the same change. FOUR further entries are red on that gate and are deliberately left alone, with the reason named rather than inherited silently: api-testing, quality-tools, test-driven-development and test-performance all carry a corpus on origin/main already, verified by listing that tree, so their stale allowlist entries are pre-existing debt from the 2026-10-02 growth rather than anything this change created. The gate is bound in no workflow, so none of the five blocks a pull request."
         }
     ]
 }

package/src/config/rule-activation-census.json

@@ -1,11 +1,10 @@
 {
     "_comment": "Rule-activation ratchet baseline (road-to-mixed-trigger-activation-cost step 4.1). Two axes: the scoped/mixed ID SETS are pinned by identity, and the unconditional token total may only walk DOWN. Raising a number here to clear a failing check is the config-weakening move this repo blocks by construction — every raise needs a baseline_history entry whose reason is a real sentence. Regenerate with `check_rule_activation_census --write-baseline`; never hand-edit the counts.",
-    "measured_at_commit": "unrecorded",
+    "measured_at_commit": "b78ae3dbc4e328b0c91dc355e753b3ae545a1c23",
     "tokens_exact": true,
-    "unconditional_tokens": 113699,
+    "unconditional_tokens": 116633,
     "scoped_ids": [
         "design-review-after-ui-write",
-        "roadmap-progress-sync",
         "source-of-truth",
         "ui-audit-gate"
     ],
@@ -26,6 +25,7 @@
         "php-coding",
         "provider-lifecycle-discipline",
         "roadmap-ci-steps-policy",
+        "roadmap-progress-sync",
         "settings-ask-protocol"
     ],
     "baseline_history": [
@@ -48,6 +48,10 @@
         {
             "date": "2026-08-23",
             "reason": "Re-anchored for one new rule, playbook-precedence, which ships with ADR-244's sixth context type and states that a repository's OWN configured playbook outranks a shipped skill for the same task. WHY THE DELTA IS THIS LARGE, stated rather than implied: the rule is 4,398 chars of source, but it declares seven triggers and every one of them is a keyword or phrase, so the emitter writes NO `paths:` block at all and the host loads it in every session -- the same mixed-trigger cost `ui-audit-gate` and `design-review-after-ui-write` each paid before being re-scoped to paths in road-to-mixed-trigger-activation-cost Phase 2. That is the honest reading of this number: it is not the price of the obligation, it is the price of expressing the obligation with keywords. A playbook lives at a known location, so a path-scoped form is available and would return most of these tokens; it is not cut here because the trigger set is the rule author's design decision and re-cutting it inside a merge-queue drain would change routing behaviour nobody reviewed. Recorded as the next candidate for that Phase-2 treatment rather than silently absorbed."
+        },
+        {
+            "date": "2026-10-02",
+            "reason": "RE-ANCHOR for road-to-rule-triggers-and-links-that-hold step 1.1, and the moved rule is the whole point rather than a side effect. _has_non_path_trigger enumerated keyword and phrase, so a command trigger did not count: roadmap-progress-sync declares one path_prefix and three command triggers and was therefore emitted with an exclusive paths: on Claude Code, where that key is the whole gate, so its three command routes never fired. The predicate is now a negation of the two path-shaped keys. scoped 4 -> 3 and mixed 17 -> 18 are that one rule moving, and it moves in the direction that RESTORES a route rather than removing one. THE COST IS REAL AND IS NOT HIDDEN: the unconditional corpus grows 113,699 -> 116,633 exact-BPE tokens, +2,934, which is roadmap-progress-sync now loading unconditionally instead of on a path match. That is exactly the trade the roadmaps risk register anticipated (row 1, Phase 1): a rule that gains paths-less emission becomes standing text on every session, and only rules with a non-path trigger change. Paying 2,934 tokens to stop silently dropping three command routes is the trade this roadmap chose; the alternative was a rule that fires on a file touch and never on the command that is its actual subject. REVISIT IF: the thinning work lands and roadmap-progress-sync becomes a delivery-mode stub, at which point the unconditional total should fall well below this anchor rather than being re-raised."
         }
     ]
 }

package/src/config/rule-consequence-class.json

@@ -0,0 +1,161 @@
+{
+    "_comment": "The high-consequence rule class (road-to-rule-laws-that-can-stand Phase 2). The CRITERION lives in the `consequence_class` property of src/scripts/schemas/rule.schema.json and is the only thing that selects a member — this file is the list the criterion produced, not a list chosen first, which is why `excluded` carries a reason per row and is walked by id against the router. A rule earns a row by what its own law section obligates, never by its name or its pack. `members` is the whole class. `no_stub` is the subset whose law cannot stand in a stub today — missing, or over the 2,000-char ceiling — each with the reason; those project FULL-BODIED, which is strictly safer than a shortened copy, and the subset is what stops the class being quietly shrunk by not writing a law. A member in that state and NOT in `no_stub` fails the projection. Checked by tests/scripts/rule_consequence_class.test.ts.",
+    "criterion_ref": "src/scripts/schemas/rule.schema.json#/properties/consequence_class",
+    "members": {
+        "autonomous-execution": {
+            "clause": "authority-bypass",
+            "why": "The Hard Floor and the commit default are authority boundaries."
+        },
+        "broken-access-control": {
+            "clause": "security-boundary",
+            "why": "The law is the per-object ownership and tenant check before data is returned. Violating it hands one user another user's data."
+        },
+        "command-suggestion-policy": {
+            "clause": "authority-bypass",
+            "why": "The law is SUGGEST, NEVER INVOKE. Violating it starts a command flow the user never picked."
+        },
+        "decision-revisit-gate": {
+            "clause": "authority-bypass",
+            "why": "The law routes a reopened decision to the council by default and to the owner for the reserved set. Violating it executes an owner-reserved transition on the agent's own authority."
+        },
+        "doc-screenshot-hygiene": {
+            "clause": "irreversible-external",
+            "why": "The law calls a shipped screenshot with unredacted data an irreversible published egress, in those words."
+        },
+        "domain-safety-disclaimer": {
+            "clause": "authority-bypass",
+            "why": "The law refuses diagnosis and dosage outright and makes every advisory draft carry its disclaimer. Violating it issues a professional judgement the agent is not licensed to make."
+        },
+        "domain-safety-pii": {
+            "clause": "security-boundary",
+            "why": "The law keeps raw direct identifiers out of drafts, logs and exports. Violating it is the data exposure."
+        },
+        "domain-safety-retention": {
+            "clause": "irreversible-external",
+            "why": "The law forbids recommending deletion under audit, litigation or regulatory hold. Violating it destroys records that cannot be recovered."
+        },
+        "engineering-safety-floor": {
+            "clause": "irreversible-external",
+            "why": "The law restates the Hard Floor for deploys, production-trunk merges and production data. Every trigger it names is an action this agent cannot undo."
+        },
+        "evaluator-independence": {
+            "clause": "authority-bypass",
+            "why": "The law forbids authoring the verdict into an evaluator's prompt. Violating it manufactures the independent review a gate then relies on."
+        },
+        "fast-path-marker-visibility": {
+            "clause": "authority-bypass",
+            "why": "The marker is the only signal that a fast path resolved a decision instead of the user. Swallowing it hides the substitution."
+        },
+        "finance-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a final invest or raise call. Violating it takes a decision the law assigns to the human."
+        },
+        "git-history-discipline": {
+            "clause": "irreversible-external",
+            "why": "The law forbids rewriting published history and dropping commits the session did not author. A force-push over someone else's work is not recoverable from here."
+        },
+        "image-likeness-and-rights": {
+            "clause": "irreversible-external",
+            "why": "The law gates a real person's likeness, a trademarked mark and a living artist's style behind explicit rights. The harm lands outside the repository and outlives the render."
+        },
+        "legal-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a binding legal conclusion and stops outright at individual-case examination. Violating it performs regulated activity."
+        },
+        "lethal-trifecta-guard": {
+            "clause": "security-boundary",
+            "why": "The law forbids shipping private-data access, untrusted ingestion and external comms on one autonomous path. That combination is the exfiltration shape itself."
+        },
+        "low-impact-corpus-privacy-floor": {
+            "clause": "security-boundary",
+            "why": "The law is a non-bypassable redaction gate on entries that leave the project repo. It is the last check before an upstream push."
+        },
+        "question-not-instruction": {
+            "clause": "authority-bypass",
+            "why": "A question is not authorization to act — the purest authority-bypass clause in the tree."
+        },
+        "runtime-safety": {
+            "clause": "security-boundary",
+            "why": "The rule bounds what an `automated` skill may execute and which handlers are allowlisted."
+        },
+        "secret-vcs-guard": {
+            "clause": "security-boundary",
+            "why": "The law stops before a credential reaches version control. Once committed it is leaked in every clone, and only rotation undoes it."
+        },
+        "security-sensitive-stop": {
+            "clause": "security-boundary",
+            "why": "The law requires a threat pass before the first edit to auth, tenancy, billing, secrets, uploads and public endpoints. It is the gate the other security rules assume ran."
+        },
+        "session-canary": {
+            "clause": "authority-bypass",
+            "why": "The honesty clause forbids papering over a dropped canary. Faking continuity removes the user's only signal that the session is degrading, which is their decision to make."
+        },
+        "settings-ask-protocol": {
+            "clause": "authority-bypass",
+            "why": "The law calls a silent permissive default a decision taken in the user's name, and forbids it."
+        },
+        "source-confidentiality": {
+            "clause": "security-boundary",
+            "why": "The law keeps derivation attribution out of the tracked tree. A disclosure that lands in git history is not withdrawable."
+        },
+        "strategy-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a final enter / build / buy / reorg call and names the human decision owner."
+        },
+        "tool-safety": {
+            "clause": "security-boundary",
+            "why": "The rule is the deny-by-default tool allowlist and the no-hidden-credentials floor."
+        },
+        "untrusted-input-defense": {
+            "clause": "security-boundary",
+            "why": "The law makes fetched, tool, file, RAG and MCP content data and never instructions. Violating it is how an attacker's text becomes the agent's plan."
+        },
+        "user-interrupt-priority": {
+            "clause": "authority-bypass",
+            "why": "The law stops the current task on a new instruction and asks before resuming. Silent resume continues work the user withdrew."
+        }
+    },
+    "no_stub": {
+        "autonomous-execution": {
+            "clause": "authority-bypass",
+            "why": "The Hard Floor and the commit default are authority boundaries.",
+            "reason": "No heading matching `Iron Law`: the rule states its floors under `## Hard Floor` and its bound in a fence under `## Validation-loop budget`. Promoting one of those to a law heading is authoring a law, which is a change to what the rule obligates and is out of scope for a projection change. Projects full-bodied until a law section is written deliberately."
+        },
+        "legal-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a binding legal conclusion and stops outright at individual-case examination.",
+            "reason": "Law section is 2,023 characters, 23 over the hard ceiling, and carries a dated exception in rule-law-ceilings.json. It cannot stand in a stub until the RDG STOP block is reviewed out of the law and into the body beside it."
+        },
+        "question-not-instruction": {
+            "clause": "authority-bypass",
+            "why": "A question is not authorization to act — the purest authority-bypass clause in the tree.",
+            "reason": "No heading matching `Iron Law`: the rule opens with a bare fence under its title. The fence is the law and promoting it needs a heading, which is a rule edit rather than a projection one."
+        },
+        "runtime-safety": {
+            "clause": "security-boundary",
+            "why": "The rule bounds what an `automated` skill may execute and which handlers are allowlisted.",
+            "reason": "No heading matching `Iron Law`: the constraints are a bullet list under `## Constraints`. Named by the roadmap's own Context as one of the two sharpest cases in the 35."
+        },
+        "tool-safety": {
+            "clause": "security-boundary",
+            "why": "The rule is the deny-by-default tool allowlist and the no-hidden-credentials floor.",
+            "reason": "No heading matching `Iron Law`: the floor is stated under `## Constraints` and `## Scoped grants`. Named by the roadmap's own Context as one of the two sharpest cases in the 35."
+        }
+    },
+    "excluded": {
+        "active-remediation": "A spotted issue left unfixed costs quality and rework. Its one genuinely high-consequence branch — a live cross-user exposure — is already `broken-access-control`'s law, which is in the class.",
+        "delegation-policy": "Dispatch shape, not authority: it delegates nothing a Hard Floor would stop, and says so.",
+        "downstream-changes": "A missed caller is a broken build, which is loud and recoverable.",
+        "history-discipline": "Audit coverage is an auditability property. Its privacy interlock points at `domain-safety-pii`, which is in the class.",
+        "media-governance-routing": "A routing rule: it surfaces the project-local media policies. The rights obligation itself is `image-likeness-and-rights`, which is in the class.",
+        "media-sync-ground-truth": "The spend gate is real but the obligation its law states is a sourcing one — timing and singer come from the transcribed audio. The paid-render confirmation it builds on is `non-destructive-by-default`, a kernel rule that is never thinned.",
+        "no-attribution-footers": "An attribution footer is external but editable, so the action is not irreversible.",
+        "no-decorative-emojis-in-git-surfaces": "An emoji in a PR title or a commit subject is external but editable, and the fix is an edit rather than a rotation or a retraction. Same reason as no-attribution-footers, one surface over.",
+        "no-pr-progress-comments": "A noisy PR thread is a cost, not a boundary, and a comment can be deleted.",
+        "playbook-precedence": "Its propose-never-silently-run clause defers to the same floor `non-destructive-by-default` holds; on its own it decides which procedure to follow.",
+        "provider-lifecycle-discipline": "Tier declaration and a refuse-and-surface ask. The spend floor it defers to is a kernel rule.",
+        "scale-discipline": "An exhausted connection pool is an availability failure, not a security boundary.",
+        "senior-engineering-discipline": "The anchor that ROUTES to the invisible controls. The controls themselves are in the class; the anchor is not, or the criterion would admit every rule that mentions security.",
+        "think-before-action": "Analysis discipline. Violating it wastes work."
+    }
+}

package/src/config/rule-law-ceilings.json

@@ -0,0 +1,99 @@
+{
+    "_comment": "Per-rule law-section and body ceilings (road-to-rule-laws-that-can-stand Phase 1). SHRINK-ONLY on every axis: an id may LEAVE `missing`, never join it; a recorded exception is a ceiling the rule may fall below and never rise above. Raising one to clear a red is the config-weakening move this repo blocks by construction — `--write-baseline` refuses to raise, it only re-records the smaller of old and current. A rule at its exception is not thereby correct, only not worse. Regenerate with `lint_rule_law_section --write-baseline`; never hand-edit the counts, but DO hand-edit `owner`, `review` and `reason` — those are the review contract and the generator only seeds them.",
+    "measured_at_commit": "30f7d21f6",
+    "missing": [
+        "architecture",
+        "artifact-drafting-protocol",
+        "artifact-engagement-recording",
+        "augment-edit-discipline",
+        "autonomous-execution",
+        "cli-output-handling",
+        "commit-conventions",
+        "context-hygiene",
+        "copilot-routing",
+        "devcontainer-routing",
+        "docker-commands",
+        "external-code-graph-interop",
+        "improve-before-implement",
+        "laravel-routing",
+        "laravel-translations",
+        "linked-projects-onboarding-gate",
+        "markdown-safe-codeblocks",
+        "minimal-safe-diff",
+        "missing-tool-handling",
+        "model-recommendation",
+        "onboarding-gate",
+        "php-coding",
+        "question-not-instruction",
+        "reviewer-awareness",
+        "role-mode-adherence",
+        "rule-type-governance",
+        "runtime-safety",
+        "skill-improvement-trigger",
+        "skill-quality",
+        "slash-command-routing-policy",
+        "source-of-truth",
+        "symfony-routing",
+        "test-first",
+        "tool-safety",
+        "upstream-proposal"
+    ],
+    "law_exceptions": {
+        "legal-safety-floor": {
+            "chars": 2023,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Three laws a regulator reads literally (no final legal call, consent gate, council gate) plus the RDG STOP block whose wording is quoted verbatim to the user. At 2023 characters it is 23 over the ceiling, so the review is about whether the STOP block belongs in the law or beside it."
+        },
+        "preservation-guard": {
+            "chars": 2418,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "The law IS a checklist: each bullet names a passage class that must survive a transform, and check_condensation reads the same list. Shortening the prose would shorten the contract the gate enforces. Review target: move the reject criteria out and leave the preservation checklist."
+        },
+        "roadmap-progress-sync": {
+            "chars": 5387,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Three separate Iron Laws (dashboard sync, checkbox cadence, no silent archive) plus the preservation test that resolves a deferred item. Splitting them would create three rules with one trigger set; collapsing them would drop an obligation. Review target: move the resolution procedure under Iron Law 3 behind load_context and keep the three laws."
+        }
+    },
+    "body_exceptions": {
+        "code-provenance": {
+            "chars": 8106,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Two layers (code borrows and the knowledge/harvest layer) each with its own law, plus the no-CI-detector honesty section recording a measured gate decision."
+        },
+        "context-hygiene": {
+            "chars": 8320,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Carries the freshness ladder, the 3-failure rule, loop detection and the 15/25 read-loop rule, each with its own self-check. Already migrated once into context-hygiene-mechanics and re-grew."
+        },
+        "decision-revisit-gate": {
+            "chars": 8566,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "The largest rule in the tree. Carries the five-step gate, the two descriptive axes, the owner-reserved table and an honest-enforcement section. Phase 1.4 of road-to-rule-laws-that-can-stand names it as a first mover for the load_context split."
+        },
+        "design-fidelity": {
+            "chars": 8777,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Carries the artefact-maturity axis, the fidelity-mode table and the routing matrix. Phase 1.4 names it as a first mover."
+        },
+        "roadmap-progress-sync": {
+            "chars": 9308,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Three laws plus the deferred-item resolution procedure and the later/PR-gate dispositions. The dispositions are mechanism, not obligation, and are the load_context candidate."
+        },
+        "settings-ask-protocol": {
+            "chars": 8099,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Carries the four slots, the seven keys, the non-interactive rule and the consent-verdict contract. The key inventory is reference material and is the load_context candidate."
+        }
+    }
+}

package/src/install/claudePathsPlan.ts

@@ -188,6 +188,21 @@ export interface ClaudePathsPlan {
     dropped: { pattern: string; reason: 'unresolved-placeholder' | 'over-budget' | 'mixed-triggers' }[];
 }
 
+/**
+ * The two trigger keys `derive_trigger_globs` turns into a host glob. Kept
+ * beside it deliberately: the day a third path-shaped key is added there, this
+ * set is the other half of the same edit, and a reader looking at either one
+ * sees the pair.
+ */
+const PATH_SHAPED_TRIGGER_KEYS: ReadonlySet<string> = new Set(['file_pattern', 'path_prefix']);
+
+/**
+ * Keys on a trigger object that match nothing. `reason:` documents why the
+ * trigger exists; counting it would make every annotated path trigger look
+ * mixed and scope nothing at all.
+ */
+const NON_MATCHING_TRIGGER_KEYS: ReadonlySet<string> = new Set(['reason']);
+
 /**
  * Does this rule declare any trigger that is NOT path-shaped?
  *
@@ -199,6 +214,18 @@ export interface ClaudePathsPlan {
  * rule loads unconditionally. The emitter fed both semantics from one list, so
  * a rule that declared keywords *and* one path glob silently became
  * path-gated-only on Claude.
+ *
+ * **The test is a negation, not a list of non-path kinds**, and the difference
+ * is not stylistic. The predicate used to enumerate `keyword` and `phrase`,
+ * which left `command` — a prompt route like any other — uncounted:
+ * `roadmap-progress-sync` declares one `path_prefix` and three `command`
+ * triggers, so it was emitted with an exclusive `paths:` and its three command
+ * routes never fired on this host. A list can only ever be as current as its
+ * last edit; the schema's `additionalProperties: false` means a new match key
+ * arrives as a deliberate schema change, and until someone teaches
+ * `derive_trigger_globs` to make a glob from it, treating it as promptable is
+ * the fail-safe reading — the rule stays unconditional rather than silently
+ * narrowing to a path it does not have.
  */
 export function _has_non_path_trigger(meta: Record<string, unknown>): boolean {
     const triggers = meta['triggers'];
@@ -206,8 +233,21 @@ export function _has_non_path_trigger(meta: Record<string, unknown>): boolean {
     for (const t of triggers) {
         if (t === null || typeof t !== 'object' || Array.isArray(t)) continue;
         const obj = t as Record<string, unknown>;
-        if (typeof obj['keyword'] === 'string' && obj['keyword']) return true;
-        if (typeof obj['phrase'] === 'string' && obj['phrase']) return true;
+        for (const [key, value] of Object.entries(obj)) {
+            if (PATH_SHAPED_TRIGGER_KEYS.has(key) || NON_MATCHING_TRIGGER_KEYS.has(key)) continue;
+            // A string that is not blank, or ANY non-string value. The schema
+            // types all five match keys as strings today, so the second half is
+            // for the key that arrives later: a `keyword: ["a","b"]` read as
+            // "not a string, so not a trigger" would silently narrow the rule
+            // to a path it does not have, which is the exact failure the
+            // negation above exists to prevent. Undefined and null are the one
+            // shape that means "absent".
+            if (typeof value === 'string') {
+                if (value.trim() !== '') return true;
+            } else if (value !== undefined && value !== null) {
+                return true;
+            }
+        }
     }
     return false;
 }
@@ -230,8 +270,10 @@ export function _claude_paths_plan(meta: Record<string, unknown>): ClaudePathsPl
     const globs: string[] = [];
     const dropped: ClaudePathsPlan['dropped'] = [];
 
-    // A rule that ALSO declares keyword / phrase triggers gets no `paths:` at
-    // all, and therefore keeps loading unconditionally on Claude Code.
+    // A rule that ALSO declares a non-path trigger — keyword, phrase, command,
+    // or a match key added to the schema later — gets no `paths:` at all, and
+    // therefore keeps loading unconditionally on Claude Code. The predicate is
+    // a negation of the two path-shaped keys, deliberately: see its docblock.
     //
     // Emitting `paths:` here would narrow the rule to a path match and discard
     // every keyword the author wrote, because this host reads the list as the

package/src/install/claudeRuleRewrite.ts

@@ -132,7 +132,7 @@ export function rewriteAndReport(
     quiet: boolean,
     info: (m: string) => void,
     warn: (m: string) => void,
-    wrappers?: { wrapped: readonly string[]; reserved: readonly string[] },
+    wrappers?: { wrapped: readonly string[]; reserved: readonly string[]; foreign?: readonly string[] },
     preserved: ReadonlySet<string> = new Set(),
 ): ClaudeRuleRewriteResult {
     const result = rewriteClaudeRules(rulesDir, preserved);
@@ -157,6 +157,15 @@ export function rewriteAndReport(
                     'commands remain available',
             );
         }
+        if (wrappers.foreign !== undefined && wrappers.foreign.length > 0) {
+            // Reported, never removed. The name shadows a host built-in, but
+            // this package did not write the file, so deleting it would be
+            // taking a neighbour's command away without saying so.
+            info(
+                `  claude-code: kept ${wrappers.foreign.length} neighbour command file(s) whose ` +
+                    `name is a Claude Code built-in (${wrappers.foreign.join(', ')}); not ours to remove`,
+            );
+        }
     }
     if (result.rewritten > 0 && !quiet) {
         info(

package/src/install/emit_host_rules_cli.ts

@@ -44,6 +44,14 @@ import {
     _emit_windsurf_rule,
     strip_frontmatter,
 } from '../scripts/condense.js';
+import {
+    WINDSURFRULES_HEADER,
+    cleanOwnedOnly,
+    keptLine,
+    mayWriteRuleFile,
+    mayWriteWindsurfRules,
+    ownedPaths,
+} from './host_rule_ownership.js';
 
 function _ruleFiles(rulesDir: string): string[] {
     return fs
@@ -60,63 +68,64 @@ function _ruleFiles(rulesDir: string): string[] {
         });
 }
 
-/** Remove entries not in `valid` (mirror of condense's `_clean_modern_dir`). */
-function _cleanDir(dir: string, valid: ReadonlySet<string>): void {
-    let entries: string[];
-    try {
-        entries = fs.readdirSync(dir);
-    } catch {
-        return;
-    }
-    for (const name of entries) {
-        if (name === 'README.md' || valid.has(name)) {
-            continue;
-        }
-        const full = path.join(dir, name);
-        try {
-            if (fs.lstatSync(full).isDirectory()) {
-                fs.rmSync(full, { recursive: true, force: true });
-            } else {
-                fs.unlinkSync(full);
-            }
-        } catch {
-            /* best-effort clean */
-        }
-    }
-}
-
 export function emitCursor(rulesDir: string, projectRoot: string): number {
     const targetDir = path.join(projectRoot, '.cursor', 'rules');
     const files = _ruleFiles(rulesDir);
+    const owned = ownedPaths(projectRoot);
     const valid = new Set<string>();
+    let blocked = 0;
     for (const src of files) {
         const name = `${path.basename(src, '.md')}.mdc`;
-        _emit_cursor_mdc(src, path.join(targetDir, name));
+        const target = path.join(targetDir, name);
+        // Ownership BEFORE the write: a neighbour's file under one of our
+        // names would otherwise be destroyed and then skipped by the cleanup
+        // pass, which only looks at names this run did not emit.
+        if (!mayWriteRuleFile(target, owned)) {
+            blocked += 1;
+            continue;
+        }
+        _emit_cursor_mdc(src, target);
         valid.add(name);
     }
-    _cleanDir(targetDir, valid);
+    const { kept } = cleanOwnedOnly(targetDir, valid, owned);
+    const line = keptLine(kept + blocked);
+    if (line !== null) process.stdout.write(`cursor: ${line}\n`);
     return files.length;
 }
 
 export function emitWindsurf(rulesDir: string, projectRoot: string): number {
     const perRuleDir = path.join(projectRoot, '.windsurf', 'rules');
     const files = _ruleFiles(rulesDir);
+    const owned = ownedPaths(projectRoot);
     const valid = new Set<string>();
+    let blocked = 0;
     for (const src of files) {
         const name = path.basename(src);
-        _emit_windsurf_rule(src, path.join(perRuleDir, name));
+        const target = path.join(perRuleDir, name);
+        if (!mayWriteRuleFile(target, owned)) {
+            blocked += 1;
+            continue;
+        }
+        _emit_windsurf_rule(src, target);
         valid.add(name);
     }
-    _cleanDir(perRuleDir, valid);
+    const { kept } = cleanOwnedOnly(perRuleDir, valid, owned);
+    const line = keptLine(kept + blocked);
+    if (line !== null) process.stdout.write(`windsurf: ${line}\n`);
 
     // Concatenated legacy surface — same format as the projection-path
     // generator (condense.generate_windsurfrules), consumer-sourced header.
-    const parts = ['# Auto-generated from .augment/rules/ — do not edit directly\n'];
-    for (const src of files) {
-        const content = strip_frontmatter(fs.readFileSync(src, 'utf-8'));
-        parts.push(`---\n\n${content.trim()}\n`);
+    const target = path.join(projectRoot, '.windsurfrules');
+    if (mayWriteWindsurfRules(target, owned)) {
+        const parts = [`${WINDSURFRULES_HEADER}\n`];
+        for (const src of files) {
+            const content = strip_frontmatter(fs.readFileSync(src, 'utf-8'));
+            parts.push(`---\n\n${content.trim()}\n`);
+        }
+        fs.writeFileSync(target, parts.join('\n') + '\n', 'utf-8');
+    } else {
+        process.stdout.write('windsurf: kept: 1 neighbour file(s) (.windsurfrules)\n');
     }
-    fs.writeFileSync(path.join(projectRoot, '.windsurfrules'), parts.join('\n') + '\n', 'utf-8');
     return files.length;
 }