@event4u/agent-config 16.2.0 → 16.3.0

package/dist/scripts/project_thin_rules.js

@@ -18,11 +18,10 @@
  * target dir of your choosing — it never overwrites the live `.claude/` /
  * `.augment/` projections.
  *
- * NOTE (faithful literal): the thin-entry pointer keeps the verbatim
- * `Body: [`{rule_id}`](../../dist/agent-src/rules/{rule_id}.md)`
- * Markdown link from the retired Python implementation. The same-basename `.py` twin
- * carries that literal, so the ADR-051 legacy-path guard exempts this `.ts`
- * file by twin-parity.
+ * NOTE: the thin-entry pointer literal moved with the mechanism — it is
+ * `BODY_LINK_PREFIX` in `_lib/thin_rules.ts` now, so the twin-parity argument
+ * that exempted it from the ADR-051 legacy-path guard belongs to THAT file and
+ * no longer describes this one, which holds the string nowhere.
  *
  * Historical quirks are preserved deliberately — tests and downstream consumers pin the exact behaviour.
  *
@@ -34,299 +33,20 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { pathOnlyRuleIds, triggerlessRuleIds, } from './_lib/rule_injection.js';
 import * as token_count from './_lib/token_count.js';
-const _HERE = fileURLToPath(import.meta.url);
-// REPO_ROOT = Path(__file__).resolve().parent.parent.parent — three dirs up
-// from src/scripts/<file>.
-export const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
-export const RULES_SOURCE = path.join(REPO_ROOT, 'dist/agent-src', 'rules');
-export const ROUTER = path.join(REPO_ROOT, 'dist', 'router.json');
-/** `sorted(dir.glob("*.md"))` — non-recursive, lexically sorted abs paths. */
-function _globSortedMd(dir) {
-    let names;
-    try {
-        names = fs.readdirSync(dir);
-    }
-    catch {
-        return [];
-    }
-    const out = names.filter((n) => n.endsWith('.md')).map((n) => path.join(dir, n));
-    out.sort();
-    return out;
-}
-/** The always-full-bodied set — authoritative kernel list from the router. */
-export function kernel_ids() {
-    const data = JSON.parse(fs.readFileSync(ROUTER, 'utf-8'));
-    const kernel = data.kernel;
-    if (Array.isArray(kernel)) {
-        return new Set(kernel.map((x) => String(x)));
-    }
-    return new Set();
-}
-/**
- * Tier rules the router gives NO trigger at all.
- *
- * These cannot be delivered on a match, so thinning them would remove a body
- * that nothing can ever put back — a silent hole rather than a saving. They
- * project full-bodied, and `measure` reports them by name so the residue is
- * visible instead of being absorbed into the pointer count
- * (road-to-trigger-delivered-rule-bodies 1.3).
- */
-/**
- * Rules whose ONLY triggers are path-shaped — reachable from `pre_tool_use`
- * and from no other slot (road-to-delivery-for-every-host 3.2).
- *
- * They must never be thinned while the delivery concern is NOT bound on
- * `pre_tool_use`, because a stub plus a slot nobody listens on is a rule that
- * reaches the model at no scope at all. This is the same failure the
- * `no_trigger_ids` exemption prevents, one step out: there the rule has nothing
- * to match on, here it has nothing to match ON.
- *
- * Stated as a PROPERTY rather than a list of ids. If the concern is ever bound
- * on `pre_tool_use` again, this exemption is what should be reconsidered — not
- * three names someone has to remember.
- *
- * WHAT THIS EXEMPTION DOES **NOT** COVER — recorded 2026-09-08, R2 finding 1,
- * because the silence read as coverage. The predicate is `every` trigger
- * path-shaped. A rule with BOTH path and non-path triggers is therefore THINNED,
- * and its path-shaped half then has no carrier at all: the stub carries no
- * frontmatter (`condense.ts` writes it with `_writeText`, bypassing
- * `_emit_claude_rule`'s host-native `paths:` key), `pre_tool_use` lost the
- * binding under owner ruling E2, and `user_prompt_submit` never populates
- * `openFiles`. Measured over the current `dist/router.json`: **18 such rules**,
- * all non-kernel and all thinned — augment-edit-discipline, design-fidelity,
- * doc-screenshot-hygiene, domain-adoption-policy,
- * framework-neutrality-in-generic-skills, image-likeness-and-rights,
- * laravel-translations, lethal-trifecta-guard, linked-projects-onboarding-gate,
- * low-impact-corpus-privacy-floor, markdown-safe-codeblocks, onboarding-gate,
- * persona-governance, php-coding, provider-lifecycle-discipline,
- * roadmap-ci-steps-policy, roadmap-progress-sync, settings-ask-protocol.
- *
- * They do NOT reach the model at no scope: every non-path route
- * (keyword / phrase / command) still delivers the body through the concern, and
- * on `claude-code` they never had a separate host-native path route to lose —
- * `_claude_paths_plan` emits no `paths:` for a mixed-trigger rule on purpose, so
- * under `eager-all` they loaded UNCONDITIONALLY. What is lost is the difference
- * between unconditional and prompt-triggered: a session that touches a matching
- * file and says nothing that matches gets nothing.
- *
- * The labelled corpus cannot see this and the endpoint says so rather than
- * implying otherwise — `model_rule_injection --endpoints` (b) now publishes the
- * shipped `user_prompt_submit` reach beside the pre-registered reading, and
- * every one of these 18 has at least one prompt-matching positive, so none
- * appears in its "reachable only via a path trigger" column.
- *
- * WHY THIS IS NOT WIDENED TO `some` HERE. Measured: exempting all 18 moves the
- * thin rule layer 23,592 -> 39,921 GPT tok (+16,329, +69 %), which is a budget
- * move of a magnitude no agent may take, and it would erase most of the saving
- * the flip is licensed on. Restoring a path route needs either that exemption
- * under a re-anchored baseline or a `pre_tool_use` binding under a raised slot
- * cap — both owner-reserved, so the closure is tracked rather than taken here.
- * ADR-267's Consequences section names the receiver.
- */
-/**
- * ONE spelling of the router-derived sets, shared with the injector (R2
- * finding 11).
- *
- * `path_only_ids` and `no_trigger_ids` were each a second, hand-rolled
- * implementation of `_lib/rule_injection.ts::pathOnlyRuleIds` /
- * `triggerlessRuleIds` — verified identical over the current router at the time
- * (symmetric difference empty), so drift risk rather than a live defect. It is
- * exactly the hazard `THIN_ENTRY_MARKER`'s own comment argues against one
- * screen below ("a gate that re-spelled this string would drift from the writer
- * silently"), and the two consumers here are the PROJECTOR's exemption set and
- * the INJECTOR's reachability set: they must not be able to disagree about which
- * rules the delivery path can reach.
- *
- * The finding named `path_only_ids`. The defect-pattern sweep found the SECOND
- * instance one function down — `no_trigger_ids` against `triggerlessRuleIds` —
- * and it is delegated in the same change. Count: 2 of 2 duplicated
- * router-derived sets in this file, 0 remaining.
- */
-function _router() {
-    return JSON.parse(fs.readFileSync(ROUTER, 'utf-8'));
-}
-export function path_only_ids() {
-    return pathOnlyRuleIds(_router());
-}
-export function no_trigger_ids() {
-    return new Set(triggerlessRuleIds(_router()));
-}
-/**
- * id → workspaces for every non-kernel router entry (router.json schema v2,
- * road-to-request-scoped-rule-load Phase 1). Rules absent from the map (or
- * with an empty list) fail safe: they stay in scope.
- */
-export function rule_workspaces_map() {
-    const data = JSON.parse(fs.readFileSync(ROUTER, 'utf-8'));
-    const map = new Map();
-    for (const tier of ['tier_1', 'tier_2']) {
-        const entries = data[tier];
-        if (!Array.isArray(entries))
-            continue;
-        for (const e of entries) {
-            const obj = e;
-            const ws = Array.isArray(obj.workspaces) ? obj.workspaces.map((w) => String(w)) : [];
-            map.set(String(obj.id), ws);
-        }
-    }
-    return map;
-}
-/**
- * Whether a rule id survives a workspace scope. Kernel always survives;
- * `scope === null` = legacy-all. An out-of-scope non-kernel rule is dropped
- * entirely — neither body nor pointer line (the pointer floor shrinks with
- * consumer scoping).
- */
-export function id_in_scope(rule_id, scope, kernel, wsMap, fallback_ws = []) {
-    if (scope === null || kernel.has(rule_id)) {
-        return true;
-    }
-    // Router map first (schema v2); `type: manual` rules are reference-only
-    // and never emitted to the router — their frontmatter is the fallback.
-    const ws = wsMap.get(rule_id) ?? fallback_ws;
-    if (ws.length === 0) {
-        return true; // untagged / unknown → fail safe
-    }
-    return ws.some((w) => scope.includes(w));
-}
-/** `workspaces:` list parsed straight from a rule file's frontmatter. */
-export function fm_workspaces(text) {
-    const [fm] = split_frontmatter(text);
-    // Flow style: `workspaces: [a, b, c]`
-    const flow = /^workspaces:[ \t]*\[([^\]]*)\]/m.exec(fm);
-    if (flow) {
-        return flow[1]
-            .split(',')
-            .map((s) => s.trim().replace(/^["']|["']$/g, ''))
-            .filter((s) => s.length > 0);
-    }
-    // Block style; tolerate the list being the LAST frontmatter key.
-    const m = /^workspaces:[ \t]*\n((?:[ \t]+-[ \t]+.*(?:\n|$))+)/m.exec(fm);
-    if (!m) {
-        return [];
-    }
-    return [...m[1].matchAll(/-[ \t]+(\S+)/g)].map((x) => x[1]);
-}
-/** Return [frontmatter_including_fences, body]. Empty fm if none. */
-export function split_frontmatter(text) {
-    if (text.startsWith('---\n')) {
-        const end = text.indexOf('\n---\n', 4);
-        if (end !== -1) {
-            return [text.slice(0, end + 5), text.slice(end + 5)];
-        }
-    }
-    return ['', text];
-}
-function _description(fm) {
-    // re.search(r'^description:\s*"?(.+?)"?\s*$', fm, re.MULTILINE)
-    const m = /^description:\s*"?(.+?)"?\s*$/m.exec(fm);
-    return m ? m[1].trim() : '';
-}
-// How many trigger keywords/phrases to surface as the always-on match hint.
-const _TRIGGER_HINT_LIMIT = 6;
-/** A short, comma-joined sample of the rule's trigger keywords/phrases. */
-function _trigger_hint(fm) {
-    const hits = [];
-    // re.finditer(r'^\s*-\s*(?:keyword|phrase):\s*"?(.+?)"?\s*$', fm, re.MULTILINE)
-    const re = /^\s*-\s*(?:keyword|phrase):\s*"?(.+?)"?\s*$/gm;
-    let m;
-    while ((m = re.exec(fm)) !== null) {
-        hits.push(m[1].trim());
-        if (hits.length >= _TRIGGER_HINT_LIMIT) {
-            break;
-        }
-    }
-    return hits.join(', ');
-}
-/** Python `str.title()` — uppercase first alpha of each run, rest lowercase. */
-function _title(s) {
-    return s.replace(/[A-Za-z]+/g, (w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase());
-}
-/**
- * The marker that makes a projected entry recognisable as a stub.
- *
- * Exported so the WRITER and every DETECTOR share one definition. A gate that
- * re-spelled this string would drift from the writer silently, and the failure
- * would be invisible in exactly the direction that matters: a stub the gate
- * fails to recognise reads as a complete rule body.
- */
-export const THIN_ENTRY_MARKER = '> Routed rule — load the body on trigger-match.';
-/** Is this projected entry a pointer stub rather than a rule body? */
-export function is_thin_entry(text) {
-    return text.includes(THIN_ENTRY_MARKER);
-}
 /**
- * Where a stub tells a reader the body actually is.
- *
- * FIXED 2026-09-07: this pointed into the uncondensed source tree ADR-051
- * retired — the literal path is deliberately NOT reproduced here, because
- * `check_no_uncondensed_refs` matches the string and cannot tell a repair
- * record from a live reference; `git log -S` on this file finds the old value.
- * It exists in no checkout, so EVERY stub's fallback pointer
- * resolved to nothing — invisible under `delivery`, where the hook loads the
- * body from `dist/agent-src/rules` and never follows this link, and total under
- * `thin`, where the pointer is the only path to the body there is.
+ * The mechanism lives in `_lib/thin_rules.ts`; this file is its CLI.
  *
- * KNOWN LIMIT, stated rather than discovered later: one relative prefix cannot
- * be right for every tree, because they sit at different depths — `.claude/rules`
- * and `.cursor/rules` are two levels below the repo root and `.clinerules` is
- * one. `../../` is correct for the first two, which are the only trees the
- * shipped `lean_projection.hosts` default can thin. A stub in `.clinerules`
- * needs an operator to have added `cline` to that list, and its pointer is off
- * by one level. That is strictly better than the previous state, where the
- * pointer was dead in all three, and it is recorded here so the remaining case
- * is a known limit rather than a surprise.
+ * Re-exported wholesale so every existing importer of
+ * `project_thin_rules.{build_thin,thin_entry,is_thin_entry,RULES_SOURCE,…}`
+ * keeps working unchanged. The split exists because `src/scripts/install.ts` is
+ * a bundle entry and `check_installer_import_purity` forbids it reaching a
+ * module-level `process.exit()` — which this file has, at its foot, by design.
  */
-const BODY_LINK_PREFIX = '../../dist/agent-src/rules/';
-/** Build the minimal progressive-disclosure pointer for a non-kernel rule. */
-export function thin_entry(rule_id, text) {
-    const [fm] = split_frontmatter(text);
-    const desc = _description(fm);
-    const hint = _trigger_hint(fm);
-    const title = _title(rule_id.replace(/-/g, ' '));
-    const fires = hint ? ` Fires on: ${hint}.` : '';
-    return (`## ${title}\n` +
-        `${THIN_ENTRY_MARKER}${fires} ${desc} ` +
-        `Body: [\`${rule_id}\`](${BODY_LINK_PREFIX}${rule_id}.md)\n`);
-}
-/** Map {filename: thin_or_full_text} for every rule. Kernel stays full. */
-export function build_thin(rules_dir = RULES_SOURCE, scope = null, 
-/**
- * Optional sink for the D3 diagnostic
- * (road-to-delivery-for-every-host 2.2).
- *
- * An `auto` rule the router gives NO trigger is already kept full-bodied by
- * `noTrigger` below, which is the substantive protection and predates this
- * roadmap. What did not exist is any way to SEE it happen: the rule is
- * silently exempted, so an author who removes a rule's last trigger gets a
- * silently eager rule and no signal. The line makes the exemption audible.
- */
-announce = null) {
-    const kernel = kernel_ids();
-    const noTrigger = no_trigger_ids();
-    const pathOnly = path_only_ids();
-    const wsMap = scope !== null ? rule_workspaces_map() : new Map();
-    const out = new Map();
-    for (const p of _globSortedMd(rules_dir)) {
-        const text = fs.readFileSync(p, 'utf-8');
-        const stem = path.basename(p).replace(/\.md$/, '');
-        if (!id_in_scope(stem, scope, kernel, wsMap, fm_workspaces(text))) {
-            continue; // out of workspace scope — no body, no pointer line
-        }
-        const full = kernel.has(stem) || noTrigger.has(stem) || pathOnly.has(stem);
-        if (announce !== null && noTrigger.has(stem) && !kernel.has(stem)) {
-            announce(`D3: trigger-less auto rule ${path.basename(p)} — kept full-bodied, never thinned`);
-        }
-        if (announce !== null && pathOnly.has(stem) && !kernel.has(stem) && !noTrigger.has(stem)) {
-            announce(`E2: path-only auto rule ${path.basename(p)} — kept full-bodied; its only triggers ` +
-                `are path-shaped and the delivery concern is not bound on pre_tool_use`);
-        }
-        out.set(path.basename(p), full ? text : thin_entry(stem, text));
-    }
-    return out;
-}
+export * from './_lib/thin_rules.js';
+import { _globSortedMd, build_thin, fm_workspaces, id_in_scope, kernel_ids, no_trigger_ids, REPO_ROOT, RULES_SOURCE, rule_workspaces_map, } from './_lib/thin_rules.js';
+void REPO_ROOT;
+const _HERE = fileURLToPath(import.meta.url);
 /** Python `round(x, 1)` — round-half-to-even at one decimal. */
 function _python_round1(x) {
     const scaled = x * 10;

package/dist/server/schemas/settings.js

@@ -190,6 +190,9 @@ export const settingsSchema = z.object({
         fidelity_mode: 'strict',
         approximation: { enabled: false, tolerance: { color: null, length: null } },
     }),
+    code_graph: z.object({
+        consumer_index_paths: z.array(z.string()).default([]).describe("Extra project-relative paths where THIS project keeps a code-graph index another tool wrote. The built-in list is deliberately vendor-neutral (graph.json, code-graph.json, .code-graph/graph.json) and names no tool, so a tool that writes its index elsewhere is named here rather than waited for. A graph found this way LOADS and answers query and explain with every edge tagged read-from-elsewhere; the gate verbs (impact, untested, dead) refuse a graph made only of such edges and say so, because an empty answer from a gate must not read as 'nothing found' when it means 'nothing trusted'. Absolute paths and paths escaping the project root are ignored."),
+    }).default({}),
     consistency: z.object({
         cross_source: crossSourceMode.default('on').describe('Consumed by the cross-source-consistency rule. When the agent works from multiple sources (ticket text, an attached image/mockup, the spec, the codebase) it checks them against each other and asks before proceeding on a discrepancy — instead of silently guessing. on (default) = surface every real cross-source contradiction / silent-scope-expansion as one question; auto = surface only high-confidence contradictions, state low-confidence as an assumption; off = no cross-source checking.'),
     }).default({ cross_source: 'on' }),
@@ -319,6 +322,9 @@ export const settingsSchema = z.object({
             tier1_concerns: z.array(z.string()).default([]).describe('Concern IDs (one per line) that are allowed to block the run on failure rather than warn. Reserved for high-confidence guards — leave empty unless you maintain custom hooks.'),
             hard_fail: z.boolean().default(false).describe('When a hook exceeds hooks.concern_budget.max_per_event, fail the run (true) instead of warning and continuing (false, default). Turn on in CI when you want hook quality to gate merges.'),
         }),
+        verify_before_complete: z.object({
+            touched_file_quality: z.enum(['off', 'shadow', 'warn']).default('off').describe("Stop-slot pass that runs the project's OWN quality commands — the ones resolve_toolchain() already reports — over the files this turn edited. Default off. `shadow` records a per-run result and emits nothing; `warn` adds ONE advisory line of at most 200 bytes. Never blocks and never counts as verification: a command recorded here never reaches _lib/verification_command.ts, so a clean eslint run cannot let a turn claim it verified anything. A writing command runs only in its check form (pint --test) or not at all, and a command with no per-file form is skipped rather than run project-wide at every stop."),
+        }).default({}),
         injection_scan: z.object({
             enabled: z.boolean().default(false).describe('PostToolUse prompt-injection scanner (road-to-security-pillar.md P3.2). Default off. When on, scans tool output (file reads, web fetches, MCP responses) for injection signatures and WARNS in context (never blocks). Runtime backstop on top of the always-on untrusted-input-defense rule; detection is probabilistic.'),
         }).default({}),

package/dist/shared/skillRanking.js

@@ -24,10 +24,13 @@
  * `score_skill_relevance` CLI's argparse-parity suite is the check that the move
  * changed nothing.
  *
- * THE ONE ADDITION is `triggerTerms`, off by default. Phase 3.1 of the same
- * roadmap indexes `triggers.keyword` / `triggers.phrase` text; it is an opt-in
- * parameter rather than a second function so the two rankers can be measured
- * against each other on one corpus.
+ * THE ADDITIONS ARE ALL OFF BY DEFAULT and live in one {@link RankOptions}
+ * object: three that widen the indexed TERM SOURCE (trigger prose, the skill's
+ * own `## When to use` section, the body's headings) and one that changes the
+ * WEIGHTING (inverse document frequency over the catalogue). They are opt-in
+ * parameters rather than separate functions so two configurations can be
+ * measured against each other on one corpus without becoming two rankers. With
+ * every flag off the arithmetic is the ported one, unchanged.
  *
  * Pure — no imports, no I/O, no clock.
  */
@@ -113,23 +116,78 @@ export function skillTerms(skill, opts = {}) {
     const parts = [skill.name, skill.description];
     if (opts.includeTriggers && skill.triggerText)
         parts.push(...skill.triggerText);
+    if (opts.includeWhenToUse && skill.whenToUseText)
+        parts.push(skill.whenToUseText);
+    if (opts.includeHeadings && skill.headingText)
+        parts.push(...skill.headingText);
     return tokenize(parts.join(' '));
 }
+/** True when `opts` turns on at least one term source beyond name + description. */
+export function widensTermSource(opts) {
+    return Boolean(opts.includeTriggers || opts.includeWhenToUse || opts.includeHeadings);
+}
+/**
+ * @param termSets the per-skill term sets, in the same order as `skills`.
+ *   Required rather than derived, so the catalogue is tokenized ONCE per call
+ *   instead of once here and again at the scoring loop. Tokenizing ~300 skills
+ *   twice per prompt is invisible next to re-reading them from disk, which is
+ *   exactly why it would have stayed invisible.
+ */
+export function buildTermStats(skills, termSets) {
+    const df = new Map();
+    for (const terms of termSets) {
+        for (const t of terms)
+            df.set(t, (df.get(t) ?? 0) + 1);
+    }
+    return { df, skills: skills.length };
+}
+/**
+ * The weight one matched term carries.
+ *
+ * `ln(1 + skills / (1 + df))`, the smoothed textbook form: a term on every
+ * skill tends to zero, a term on one skill carries the most. Unknown terms are
+ * treated as df 0 — a task term no skill indexes cannot be matched anyway, so
+ * its weight only affects the denominator, where counting it fully is right:
+ * failing to cover a rare term should cost more than failing to cover a common
+ * one.
+ */
+export function idf(term, stats) {
+    return Math.log(1 + stats.skills / (1 + (stats.df.get(term) ?? 0)));
+}
 /**
  * The score. `taskTerms` is `tokenize(task)`; `terms` is `skillTerms(skill)`.
  *
  * Both are passed in rather than derived here so a caller ranking N skills
  * tokenizes the task once and each skill once, which is what makes this usable
- * on a per-prompt hook path.
+ * on a per-prompt hook path. `opts` and `stats` are optional and, with them
+ * absent or every flag off, the arithmetic is exactly the Python-parity one.
  */
-export function scoreSkill(taskTerms, skill, terms) {
+export function scoreSkill(taskTerms, skill, terms, opts = {}, stats) {
+    if (opts.idfWeighting && !stats) {
+        throw new Error('scoreSkill: idfWeighting is set but no TermStats was passed — scoring unweighted here ' +
+            'would publish a baseline number under the idf label. Build stats with buildTermStats.');
+    }
     if (taskTerms.size === 0)
         return 0;
-    let inter = 0;
-    for (const t of taskTerms)
-        if (terms.has(t))
-            inter++;
-    const overlap = inter / Math.max(taskTerms.size, 1);
+    let overlap;
+    if (opts.idfWeighting && stats) {
+        let hit = 0;
+        let total = 0;
+        for (const t of taskTerms) {
+            const w = idf(t, stats);
+            total += w;
+            if (terms.has(t))
+                hit += w;
+        }
+        overlap = total > 0 ? hit / total : 0;
+    }
+    else {
+        let inter = 0;
+        for (const t of taskTerms)
+            if (terms.has(t))
+                inter++;
+        overlap = inter / Math.max(taskTerms.size, 1);
+    }
     let personaHit = 0;
     const taskLower = [...taskTerms].join(' ');
     for (const persona of skill.personas ?? []) {
@@ -147,9 +205,12 @@ export function scoreSkill(taskTerms, skill, terms) {
  */
 export function rankSkills(task, skills, opts = {}) {
     const taskTerms = tokenize(task);
+    const termSets = skills.map((s) => skillTerms(s, opts));
+    const stats = opts.idfWeighting ? buildTermStats(skills, termSets) : undefined;
     const rows = [];
-    for (const skill of skills) {
-        const score = scoreSkill(taskTerms, skill, skillTerms(skill, opts));
+    for (let i = 0; i < skills.length; i += 1) {
+        const skill = skills[i];
+        const score = scoreSkill(taskTerms, skill, termSets[i], opts, stats);
         if (score > 0)
             rows.push({ name: skill.name, score, personas: [...(skill.personas ?? [])] });
     }

package/docs/contracts/settings-classes.md

@@ -247,8 +247,8 @@ dispatch runs, not WHETHER the layer exists, so they keep their own C rows.
 |---|---|
 | A — preference | 26 |
 | B — consent | 3 |
-| C — guarded | 124 |
-| **Total** | **153** |
+| C — guarded | 126 |
+| **Total** | **155** |
 
 It rose again on 2026-09-13 when `road-to-adversarial-verification-and-long-runs`
 Phase 0 added three C keys: `quality.local_auto_run_in_mission` (`consent` — it
@@ -381,10 +381,10 @@ the template, which is the drift this contract exists to prevent.
 | Disposition | Keys |
 |---|---|
 | derivable | 83 |
-| un-inferrable | 9 |
-| consent | 47 |
+| un-inferrable | 10 |
+| consent | 48 |
 | policy | 14 |
-| **Total** | **153** |
+| **Total** | **155** |
 
 First measured 2026-08-12 at 140 leaves (derivable 88 · consent 38 ·
 un-inferrable 9 · policy 5), from the table below rather than predicted — the
@@ -562,6 +562,7 @@ Rows follow template order, so a diff against the template reads straight down.
 | `design.approximation.tolerance.color` | C | `null` | decides which colour deviations may be taken silently | policy |
 | `design.approximation.tolerance.length` | C | `null` | decides which length deviations may be taken silently | policy |
 | `consistency.cross_source` | C | `"on"` | disables the cross-source discrepancy gate | derivable — the rule's own trigger condition; a discrepancy exists only when two present sources contradict |
+| `code_graph.consumer_index_paths` | C | `[]` | names where this project's OTHER tool writes a code-graph index, so it widens what the graph reader will load and trust | un-inferrable — the path belongs to a tool this package does not ship and cannot probe for; the built-in list is deliberately vendor-neutral, so only the operator knows where their index lands |
 | `screenshots.identity_allowlist` | C | `[]` | allowlist of identities that ship unredacted | consent |
 | `screenshots.forbid_terminal_capture` | C | `true` | kill-switch over the highest-leak capture path | consent |
 | `screenshots.data_bearing_gate` | C | `"on"` | the human-confirmation gate over a published egress | consent |
@@ -622,6 +623,7 @@ Rows follow template order, so a diff against the template reads straight down.
 | `hooks.design_pass.enabled` | C | `false` | C-test 1 — it configures code that runs on every tool call and at every turn end, and unlike its two `hooks.*` neighbours its stop pass can BLOCK rather than warn | policy — whether an operator accepts a gate that can refuse a turn is a risk preference, not a fact the tree can compute. The two neighbours are `derivable` because they only ever warn; the block is the discriminator. `road-to-frontend-power` transfers the default flip to the owner for the same reason |
 | `hooks.code_graph.enabled` | C | `false` | INERT since 2026-09-07 — the nudge it gated was replaced by `code-graph-context`, which reads no flag. The KEY stays registered because `docs/MIGRATION.md` commits to exactly that ("the surfaces stay registered and disabled"): removing it is a breaking change for any consumer who set it, and the row was briefly marked REMOVED, which left the template's own leaf unclassified. Classified, not deleted. | derivable — the index-detection probe the replacement hook already runs; no index means silence |
 | `hooks.suggestion_capture.enabled` | C | `false` | configures code that runs at every turn end and every prompt | consent |
+| `hooks.verify_before_complete.touched_file_quality` | C | `"off"` | C-test 1 — it decides whether the stop hook SPAWNS the project's own quality commands over the turn's edited files, so the cost it authorises is other people's processes on the operator's machine | consent — running a consumer's toolchain against their working tree is a thing to be permitted, not a fact the tree can derive. The three values are not a severity ladder the agent may climb: `shadow` records, `warn` adds one advisory line, and the flip from one to the other is the owner decision `road-to-touched-files-that-pass-their-own-tools` 2.3 defers |
 | `decision_engine.surface_traces` | C | `false` | the decision engine’s own black box; the agent must not be able to close it | derivable — the engine's own active-gate state; there is nothing to surface when no gate fired |
 | `decision_engine.min_confidence` | C | `"off"` | the confidence gate | derivable — the confidence band the scoring engine already computes at the plan phase |
 | `decision_engine.block_on_risk` | C | `"off"` | the risk-class gate | derivable — the risk class the engine already computes at the implement phase; the Hard Floor covers the irreversible end unconditionally |

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "16.2.0",
+    "version": "16.3.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,