@event4u/agent-config 16.2.0 → 16.3.0

package/dist/agent-src/contexts/execution/session-canary-enforcement-history.md

@@ -0,0 +1,67 @@
+# Session Canary — Enforcement History
+
+Loaded by [`session-canary`](../../rules/session-canary.md). Four dated
+conformance audits of the canary carrier, moved here verbatim so the rule
+states its obligation and this file holds the record behind it. Nothing was
+rewritten; the measurements and their stated limits are as they were written.
+
+**What that fixed, stated because it was measured.** Conformance audit, 30
+sessions, 2026-08-06, under session-scope-only injection: opening canary dropped
+on ~13 of 15 task starts, often present only in the closing summary, twice
+carrying a name the settings chain did not resolve; the honesty clause fired
+zero times. The frequency join in `check_enforcement_coverage.ts` now reports the
+carrier as covering the obligation — which is a claim about firing, not about
+compliance.
+
+**What the second audit found: the carrier fires and compliance did not
+follow.** Conformance round 5, 2026-08-07, reading the five highest-turn
+sessions with the carrier bound per turn: opening canary dropped on **24 of 29**
+task starts, the honesty clause fired **0** times, and the wrong name was
+emitted **twice** — "Mathias", which resolves from no layer of the chain
+(`identity.name` is `Matze`, `git config user.name` is `matze4u`), i.e. inferred
+from the ambient environment rather than read from settings. 24/29 against the
+earlier 13/15 is not a fall, and the two windows are not identical, so they are
+stated side by side rather than as a trend — but nothing here supports the claim
+that the miss rate moved. A reminder in context is therefore not a mechanism for
+this obligation: at higher frequency it is the same request, more often.
+
+**What the next mechanism has to be.** Not another injection. It has to be able
+to **refuse** — a check at delivery (`stop` is block-capable on this host, so a
+refused turn-end continues in the same turn) that rejects a task-start reply
+carrying no greeting. Proposed, not shipped; until it is, this obligation is
+model-carried in practice, whatever the frequency join reports.
+
+**Round 7 downgrade: that proposed mechanism is UNDECIDABLE as written, and the
+obligation splits into a measured half and an unmeasurable one.** A *task* start
+is recorded nowhere in a transcript — there is no task event on any host, and
+`user-interrupt-priority`'s continuation/clarification/interrupt distinction is a
+judgement, not a field. So a delivery check "that rejects a task-start reply" has
+no way to know a task started. The proposal is not merely unbuilt; as specified it
+cannot be built, and saying "proposed, not shipped" implied otherwise.
+
+What IS decidable is the per-**session** instance, and it was measured rather than
+asserted — reproducibly, which took a correction: the probe resolves the name
+through the same settings layers this rule names and REFUSES when no layer carries
+one, so the figure below is reproduced with the name passed explicitly
+(`./scripts-run src/scripts/probe_session_canary --limit 30 --name <your name>`;
+the first version hardcoded a maintainer's nickname as its default, which made the
+number irreproducible for anyone else and silently read 0 %). Over 30 sessions on
+2026-08-12: the opening greeting is present in **25 of 28** sessions carrying
+assistant prose (89.3 %), and in **24 of 25** post-carrier (96.0 %). Of the three
+misses, two predate the carrier (2026-07-21, 2026-07-29) and one is a session whose
+first thirty turns were tool calls.
+
+Both halves of that are load-bearing. The carrier works exactly where it has a
+slot — `session_start` — which is why the session-scope figure is high; and the
+24-of-29 task-start figure above is not contradicted by it, because the two count
+different events. The honest statement is therefore: **session-scope compliance is
+measured and good; task-scope compliance is unmeasured and unmeasurable with
+today's transcript, and no gate can change that until a task boundary is recorded
+somewhere.** Do not read the 96 % as covering the obligation as a whole.
+
+**The wrong-name half needs nothing, and that is worth stating.** The beat
+already carries the resolved value — `build_canary_reminder` emits
+`Canary active for "<name>"`, and the hook no-ops when no layer resolves a name —
+and both wrong-name occurrences predate it: 2026-08-04, where the per-turn beat
+landed 2026-08-06. The inference path they measure is already closed, so a third
+audit should not re-open it.

package/dist/agent-src/contexts/execution/toolchain-resolver.md

@@ -13,7 +13,22 @@ tools and run the right one — instead of a per-stack command explosion.
 > pytest / go / cargo, not N per-stack variants. "Only genuine PHP-space
 > commands stay PHP-locked."
 
-**Size budget:** ≤ 6,000 chars.
+**Size budget: none of its own.** The enforced ceiling is
+`check_depth_budget`'s 16,000 chars, and that is the only one.
+
+This page carried a self-imposed sub-ceiling through three values — 6,000,
+then 7,500, then 8,500 — and each was set just above whatever the file
+measured that day, so the next edit of any size broke it while the same
+sentence forbade raising it. A ceiling fitted to its own artifact is not a
+constraint, it is a tripwire; and the third one was set with a sentence
+claiming "real headroom" over 66 characters, which is the trap diagnosing
+itself and walking in anyway.
+
+What actually bounds this page is **what belongs in it**: the resolver's
+contract — the axes, the detection order, the confidence tiers, the refusal
+doctrine, the cache key. Narration, worked examples and per-round history
+belong in the roadmap and the review artifacts, not here. That rule is
+checkable by a reader; a character count was only ever checkable by `wc`.
 
 ## 1. The resolver
 
@@ -29,9 +44,25 @@ for (const r of result.selected) {
 }
 ```
 
-Resolution is filesystem-cheap (a handful of small manifest reads) and
-**never raises** — a malformed manifest or unknown stack degrades to a
-`LOW`-confidence empty result so the command can ask, never crash. This
+Resolution costs **per scope**, not per repository: a fixed name list stat-ed,
+six-or-so manifests read, and the .NET probe's directory listings — three at
+the root with no .NET target present, where the native axis lists once and the
+behavior axis twice. They run in every repository, .NET or not; WITH a root
+target the descent runs too and the count rises with the project tree. A wide workspace pays that times
+its package count, so the cost is proportional and not negligible.
+
+The **cache probe is the expensive path**, with the magnitude stated, not
+implied as a SHAPE, because the arithmetic has already been published wrong
+once: `latest_manifest_mtime` stats both fixed-name lists in every scope,
+bounded at 200 scopes, each hit paying a second stat — and without
+an explicit `scopes` it also expands the globs. The guard can cost more than
+the resolution it guards, so a caller holding the scope list passes it. The
+widening is still right: a root-only key cannot see a behavior runner
+arriving in a package, and a key invalidating too often is recoverable where
+one that never invalidates is not.
+
+Resolution **never raises** — a malformed manifest or unknown stack degrades
+to a `LOW`-confidence empty result so the command can ask, never crash. This
 mirrors the recoverable-error contract of the frontend `detect_stack`.
 
 ## 2. Detection order — per ecosystem, first match wins
@@ -47,6 +78,30 @@ mirrors the recoverable-error contract of the frontend `detect_stack`.
 | Python | `pytest` in pyproject / `pytest.ini` | pytest | `pytest` |
 | Go | `go.mod` present | go-test | `go test ./...` |
 | Rust | `Cargo.toml` present | cargo-test | `cargo test` |
+| Ruby | `rspec` gem in `Gemfile`/`gems.rb`, `.rspec`, `spec/spec_helper.rb` | rspec | `bundle exec rspec`, or bare `rspec` with no Gemfile |
+| JVM | `build.gradle[.kts]` / `settings.gradle[.kts]` by PRESENCE; `pom.xml` by CONTENT | junit | `./mvnw`/`./gradlew test`, else `mvn`/`gradle test` |
+| .NET | `*.sln[x]` or `*.csproj`/`*.fsproj`/`*.vbproj` **in the scope root** | dotnet-test | `dotnet test` |
+
+Each Ruby signal stands alone, and Ruby has **no MEDIUM default** (minitest is
+in the stdlib): no signal, no row. JVM defaults to `junit` at MEDIUM when the
+build file names no runner. A wrapper wins where one exists, since it pins the
+build-tool version.
+
+**.NET needs a target in the scope ROOT, because `dotnet test` is not
+recursive.** With no project or solution in the working directory it fails
+MSB1003, whatever sits below — so the row is gated on the root listing, and
+`global.json` / `Directory.Build.props` never produce one on their own. They
+are SDK pins, not targets, and confidence does not gate `selected`
+(`_apply_guard` has never read it), so a row emitted on one would be a
+command the repository cannot run.
+
+Given a root target: HIGH when a PROJECT file names a test stack
+(`Microsoft.NET.Test.Sdk`, xunit, nunit, mstest), MEDIUM otherwise. A root
+`.sln` IS a valid target even though its own body names no package, so the
+projects it references are read to decide the tier — which is the one case
+the scan descends for. A `src/<Name>/<Name>.csproj` layout with NO root
+solution therefore emits nothing: correct, because `dotnet test` from that
+root does not run either.
 
 **Task-runner wrappers win.** When the project root has a `Makefile`
 `test:` target, a `Taskfile.yml` `test:` task, or a `package.json`
@@ -57,6 +112,33 @@ container access, env, and parallelism (the architecture rule's
 The package manager is read from the lockfile (`pnpm-lock.yaml` → pnpm,
 `yarn.lock` → yarn, else npm).
 
+## 2b. Behavior-runner axis — per scope, detection only
+
+`result.behavior_runners` is a **separate list** from `runners`: it reports
+which behavior runner each scope already owns, across the same ecosystems.
+
+- **`command` is relative to `scope_root`, not to the project root.** It is
+  built from files inside the scope (`vendor/bin/behat`, `./gradlew test`), so
+  a consumer runs it WITH `scope_root` as the working directory. Every NATIVE
+  `runners` command is root-relative; this axis is the exception.
+- **Per scope, never repository-wide.** Each row carries `scope_root` (the
+  root plus every declared workspace package). A monorepo
+  returns a row per owning package and none for the others; one answer would
+  erase which package owns it.
+- **Two of the SAME ecosystem in one scope is a refusal, not a pick** —
+  `runner: "unknown"` plus `conflict: [both names]`, the same refusal the
+  frontend detector makes between two mutually exclusive workspaces. Two
+  DIFFERENT ecosystems are a polyglot repository, not a conflict: a PHP app
+  with a JS frontend returns two rows.
+- **Detection, never adoption.** No row recommends installing anything and the
+  axis is unreachable from `selected`, so nothing runs *because* this axis
+  reported it. That is reachability, not execution: for four of the eight
+  labels the behavior command equals a native command already in `selected`
+  (`pytest-bdd`/`pytest`, `cucumber-jvm`/`jvm.command`, `reqnroll` and
+  `specflow`/`dotnet test`), and those rows are `SPEED_FAST`, so the suite
+  runs anyway as part of the native run. The axis adds nothing to what
+  executes and removes nothing from it.
+
 ## 3. Confidence tiers — declarative, shared with the non-interactive contract
 
 Each runner carries a `confidence` (`HIGH` / `MEDIUM` / `LOW`) and a
@@ -71,6 +153,17 @@ tables:
   asking (interactive) or `ambiguous_routing` (CI, per the
   non-interactive contract).
 
+**`confidence` is about the RUNNER, never about `quality`.** The three
+ecosystems this change added — ruby, jvm, dotnet — contribute a runner and NO
+quality commands, because picking `rubocop`, a Spotless task or
+`dotnet format` is an adoption decision this resolver has no standing to make.
+The consequence is worth stating because it is silent: a Ruby-, JVM- or
+.NET-only repository used to resolve `LOW` with an empty `quality`, which is
+the tier that makes a command ASK; it now resolves `HIGH` with an empty
+`quality`, which a quality pass can read as nothing to do. An empty `quality`
+means **no quality tool was resolved**, never **no quality step is needed** —
+a command that finds one should ask rather than report success.
+
 ## 4. Monorepo guard — fast by default, opt-in for the rest
 
 `resolve_toolchain` returns the full `runners` inventory **and** a
@@ -91,9 +184,10 @@ e2e and slow stay out until their flag is passed.
 
 `write_config(root, result)` persists the resolved per-stack commands to
 `agents/runtime/state/toolchain.json` (best-effort; never raises). The
-config is keyed on the manifest `mtime`, so it is re-read cheaply and
-re-resolved only when a manifest changes — the same cache-invalidation
-hook the frontend detector uses.
+config is keyed on the latest `mtime` across every scope's manifests and
+markers — not the root's alone, or a behavior runner arriving in a workspace
+package would never invalidate it. Same hook the frontend detector uses,
+widened to the scopes the behavior axis reads.
 
 ## 6. What stays stack-locked
 

package/dist/agent-src/rules/active-remediation.md

@@ -103,7 +103,7 @@ The note, the ask and the user's decision are all prose, and the issue set is
 whatever the agent happened to see, so no gate can tell a discharged issue from a
 mentioned one. This rule ships `instruction-only` — the honesty boundary
 [`security-sensitive-stop`](security-sensitive-stop.md) and
-[`ui-audit-gate`](ui-audit-gate.md) state for their own obligations. The ladder
+`ui-audit-gate` state for their own obligations. The ladder
 is the control; skipping it is caught by nothing.
 
 Body migrated to [`guideline:agent-infra/active-remediation-mechanics`](../guidelines/agent-infra/active-remediation-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — per-tier fix-now/note+ask/follow-up-PR criteria, version-gated modernization, anti-nagging guardrails.

package/dist/agent-src/rules/autonomous-execution.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "3"
+consequence_class: "authority-bypass"
 description: "Ask-or-act on a workflow step — trivial-vs-blocking, autonomy opt-in, commit default; Hard Floor stays"
 alwaysApply: false
 load_context:

package/dist/agent-src/rules/broken-access-control.md

@@ -2,6 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
+consequence_class: "security-boundary"
 description: "Endpoint/query on user/tenant data — authenticated ≠ authorized: server-derived ownership/tenant/role + negative tests (401/non-owner/cross-tenant)"
 triggers:
   - keyword: "endpoint"

package/dist/agent-src/rules/command-suggestion-policy.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "mechanical-already"
+consequence_class: "authority-bypass"
 description: "Prompt matches an eligible slash command — surface as numbered options with as-is escape; never auto-execute"
 triggers:
   - phrase: "free-form prompt"

package/dist/agent-src/rules/context-hygiene.md

@@ -22,7 +22,7 @@ obligation_frequency: "per-turn"
 
 # Context Hygiene
 
-> **Enforced by:** [`scripts/context_hygiene_hook.ts`](../../scripts/context_hygiene_hook.ts)
+> **Enforced by:** `src/scripts/context_hygiene_hook.ts`
 > on Augment + Claude Code (`PostToolUse`). Run `agent-config hooks:status` to
 > see whether that slot is actually bound on the host you are on — this line is
 > a statement about the manifest, not about your install. The hook maintains

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -1,9 +1,12 @@
 ---
 type: "auto"
 tier: "2b"
+consequence_class: "authority-bypass"
 description: "Beneficial change blocked by a lock (honest-null, don't-relitigate memory, budget canon, ADR) — surface a council re-evaluation offer, never drop"
 alwaysApply: false
 council_depth: deep
+load_context:
+  - ../contexts/authority/decision-revisit-gate-enforcement.md
 triggers:
   - keyword: "don't relitigate"
   - keyword: "honest null"
@@ -22,7 +25,7 @@ workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 collision_ok:
   "honest null": "this rule asks whether a recorded null may be REVISITED; evaluator-independence asks how one was PRODUCED — different decision points on the same artefact"
-# obligation: line 31
+# obligation: line 33
 enforced_by:
   - "instruction-only: no gate can observe an agent citing a decision it never opened; adr_cite_check is deterministic where it runs and nothing makes it run"
 obligation_frequency: "per-task"
@@ -51,11 +54,10 @@ what the package may ever become.
 **The default venue is the council, and this is a correction, not a new
 policy.** [`ai-council`](../skills/ai-council/SKILL.md)'s Iron Law already sends
 a decision the agent cannot settle from the tree to the council first, and its
-class table lists "reopening a recorded decision". The old "offers the user a
-path" wording made every lock an owner interrupt; measured across 26 days of
-transcripts, the agent reported a lock and waited while the owner voided the
-decision retroactively — twice with the lock report timestamped **before** the
-override demand. The ordering was the defect; the permission was never missing.
+class table lists "reopening a recorded decision". The measurement behind that
+correction, and why the five steps below are inlined rather than only routed, are
+in
+`contexts/authority/decision-revisit-gate-enforcement.md`.
 
 **Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
 tested*, not every future proposal that resembles it — if the blocked change
@@ -79,16 +81,9 @@ distinction.
 4. **Route it** — council by default (below), user only for the reserved set.
 5. **Record** the outcome with scope and `revisit-if`.
 
-The five are stated here, not only behind a route, because the route was
-measurably unreachable: `decision-review` ships `install.default: false` in the
-non-default `analysis-workbench` pack, so a pack-legal install received the
-obligation and not the procedure. `routes_to` now names two always-on skills;
-the backward-audit depth in
-[`decision-review`](../skills/decision-review/SKILL.md) stays optional.
-
 Full catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs,
 hard structural caps), the per-step detail, when-NOT-to-fire and the failure
-modes remain in [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md).
+modes remain in `skill:decision-review` § Decision-revisit gate — mechanics.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## Reading a lock — the two descriptive axes
@@ -164,7 +159,7 @@ precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../doc
 - [`recurring-criticism`](recurring-criticism.md) — the **other entrance**: this
   rule fires when a lock blocks a change, that one when the same criticism arrives
   again. It reuses the five steps and the owner-reserved table above.
-- [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
+- `decision-review` — the backward-audit
   procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
@@ -180,21 +175,9 @@ precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../doc
 
 ## Honest enforcement — `instruction-only`
 
-`adr_cite_check` is deterministic where it runs, and nothing makes it run. No
-gate can observe an agent citing a decision it never opened, so step 2 above is
-model-carried — the same honesty boundary
-[`security-sensitive-stop`](security-sensitive-stop.md) and
-[`active-remediation`](active-remediation.md) state for their own obligations.
-
-Two reach limits, named rather than implied. The tool lives in this repository's
-`src/scripts/` and is **not** exposed as an `agent-config` verb, so a consumer
-install performs step 2 by hand; wiring the verb touches six further surfaces
-plus the curated `dist/agent-src/scripts/` list and is deliberately out of this
-change. And `docs/decisions/` is projected into no agent-visible tree at all —
-the agent sees ADR *numbers* cited across rules and skills, almost never ADR
-*text*. Until that changes, "evaluate before citing" means opening the file.
-
-`docs/contracts/` is unprojected on the same terms (`dist/agent-src/` carries no
-`docs/`), so the burden table this rule points at is maintainer-reachable only.
-That is why the reserved-set table above stays here rather than becoming a
-pointer: a consumer install receives these lines and not the contract.
+Step 2 is model-carried: no gate can observe an agent citing a decision it
+never opened. Why that is so, which two reach limits the tool has in a
+consumer install, and why `docs/decisions/` is projected into no
+agent-visible tree are recorded in
+`contexts/authority/decision-revisit-gate-enforcement.md`,
+named in `load_context` above.

package/dist/agent-src/rules/design-fidelity.md

@@ -2,6 +2,8 @@
 type: "auto"
 tier: "2a"
 description: "A provided prototype/mockup/design system is the spec — build 1:1; never swap fonts, controls, or layout unconfirmed"
+load_context:
+  - ../contexts/communication/rules-auto/design-fidelity-enforcement.md
 triggers:
   - keyword: "prototype"
   - keyword: "mockup"
@@ -39,7 +41,7 @@ collision_ok:
   "mockup": "a provided mockup is the spec — 1:1 fidelity floor"
 enforced_by:
   - "instruction-only: no artifact in this tree records a fidelity comparison. lint_design_slop and lint_design_quality measure generic AI-aesthetic tells and accessibility; neither reads the handover, so a 1:1 claim is model-carried"
-# obligation: line 58
+# obligation: line 60
 obligation_frequency: "per-edit"
 ---
 
@@ -106,7 +108,7 @@ REPRODUCING A WIREFRAME'S GREYS 1:1 HONOURS THE WRONG HALF OF THE ARTEFACT.
 ```
 
 `strict` means *do not redesign*; never *reproduce a wireframe's placeholder grays*, which
-are **non-decisions** ([`wireframe`](../skills/wireframe/SKILL.md) § Gotchas).
+are **non-decisions** (`wireframe` § Gotchas).
 **The discriminator reads the ARTEFACT, never the prose.** A finished comp whose prose
 mentions a wireframe it replaces routes **strictly** — a reference to a previous artefact,
 not a declaration about this one. **When the artefact does not declare its maturity,
@@ -155,26 +157,21 @@ a third-party builder's share link, need one word in the prompt — the
 builder-URL trigger was tried and **withdrawn** as over-broad, and stays pinned
 silent rather than merely absent.
 
-Every class carries its own near-miss row in `ROUTING_MATRIX`
-([`design_fidelity_routing.test.ts`](../../tests/scripts/design_fidelity_routing.test.ts)),
-and the row must test the direction the NEW trigger opens, not one that was
-already closed — apply that before writing a trigger, not after. Why each class
-is shaped as it is, why `*.html` and a bare builder host are refused, and the
-worked example behind the direction rule:
-[`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
+Each class carries a near-miss row in the routing matrix, and a new trigger's
+row must test the direction that trigger opens. The matrix, the reasons behind
+each class, and the worked example are in
+`design-fidelity-enforcement`.
 
 Body migrated to [`guideline:design-fidelity-mechanics`](../guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — URL / live-page handover (extraction into the `design-system.json` contract before the first UI write, the retrieval order, the lock boundary), surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## Honest enforcement — `instruction-only`
 
-Nothing records a fidelity comparison. The estate's two design linters measure
-generic AI-aesthetic tells (`lint_design_slop`) and accessibility
-(`lint_design_quality`); neither opens the handover, so nothing can tell a
-proven 1:1 from an asserted one. The proof clause in the Iron Law is therefore
-model-carried, and the committed matrix
-([`design-review`](../skills/design-review/SKILL.md) § Fidelity proof) is the
-control — a reviewer can open it, which is more than any gate here does.
+Nothing records a fidelity comparison, so the proof clause in the Iron Law is
+model-carried and the committed matrix is the control. Which two linters exist,
+what each measures and why neither can tell a proven 1:1 from an asserted one:
+`design-fidelity-enforcement`,
+named in `load_context` above.
 
 ## See also
 

package/dist/agent-src/rules/doc-screenshot-hygiene.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "irreversible-external"
 description: "Doc screenshots — anonymize sensitive data before shipping; data-bearing shots human-gated (published egress); terminal/CLI/IDE shots forbidden"
 triggers:
   - keyword: "screenshot"

package/dist/agent-src/rules/domain-safety-disclaimer.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "authority-bypass"
 description: "Advisory content (legal, medical, financial, consulting) — matching 'not X advice' disclaimer; refuse diagnosis/dosage"
 triggers:
   - keyword: "legal brief"

package/dist/agent-src/rules/domain-safety-pii.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "security-boundary"
 description: "Drafts/logs/exports with real customer/candidate data — redact direct IDs, placeholders, flag quasi-ID re-identification"
 triggers:
   - keyword: "support macro"

package/dist/agent-src/rules/domain-safety-retention.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "irreversible-external"
 description: "Data retention — jurisdiction gap, longest floor, honor DSR/audit holds; never delete under inquiry"
 triggers:
   - keyword: "retention policy"

package/dist/agent-src/rules/engineering-safety-floor.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "irreversible-external"
 description: "Production/infra/security/external-system output — blast radius + rollback; Hard-Floor never autonomous"
 triggers:
   - keyword: "production"

package/dist/agent-src/rules/evaluator-independence.md

@@ -6,6 +6,7 @@ norm:
   tokens: 1500
   remainder:
     - "../docs/guidelines/agent-infra/evaluator-independence-mechanics.md"
+consequence_class: "authority-bypass"
 description: "Commissioning a review/judge/blind-pass on your own work — never author the verdict, never narrow the scope, record the prompt with the result"
 triggers:
   - keyword: "blind review"
@@ -121,11 +122,11 @@ ITEM 1 IS ENFORCED. ITEMS 2, 3 AND 4 ARE NOT — 4 ONLY WARNS.
 NEVER CITE A GUARD THAT WARNS AS ONE THAT BLOCKS.
 ```
 
-[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts), a
+`src/scripts/hooks/evidence_independence.ts`, a
 `pre_tool_use` concern, BLOCKS item 1 on the one host that honours a deny and
 only WARNS on item 4. Item 2 is enforced by nothing — a narrowed scope is not
 decidable from a prompt. Item 3 is enforced by
-[`check_review_prompt_binding.ts`](../../src/scripts/check_review_prompt_binding.ts),
+`src/scripts/check_review_prompt_binding.ts`,
 where **omission beats substitution**: not committing the prompt package drops
 the round out of the checkable set with no finding.
 

package/dist/agent-src/rules/fast-path-marker-visibility.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "1"
+consequence_class: "authority-bypass"
 description: "Low-impact council fast-path — surface the transparency marker verbatim as the reply opener"
 triggers:
   - keyword: "low-impact council"

package/dist/agent-src/rules/finance-safety-floor.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "authority-bypass"
 description: "Finance-pack output (runway, valuation, DCF, scenarios, unit economics) — never a final invest/raise call; disclosure footer"
 triggers:
   - keyword: "runway"

package/dist/agent-src/rules/git-history-discipline.md

@@ -2,6 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
+consequence_class: "irreversible-external"
 description: "Git history — no unasked rebase/squash/amend; never drop foreign commits; pushed rewrite → re-push same turn"
 triggers:
   - keyword: "git rebase"

package/dist/agent-src/rules/image-likeness-and-rights.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "irreversible-external"
 description: "AI image rights gate — real-person likeness, trademarked marks, named artists' styles need explicit rights/consent"
 triggers:
   - keyword: "/image:"

package/dist/agent-src/rules/legal-safety-floor.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "authority-bypass"
 description: "Legal-pack output (contract/NDA/DPA review, triage) — never a final legal call; attorney-review line; EU/DE-only"
 triggers:
   - keyword: "NDA"
@@ -57,7 +58,7 @@ THESE SKILLS ARE A RESEARCH-AND-DRAFTING AID, NOT LEGAL ADVICE.
 THEY DO NOT REPLACE A LICENSED ATTORNEY. NO ONE MAY RELY ON THEM AS DEFINITIVE.
 ```
 
-Every output is a **draft / research aid for a human attorney to verify** — not legal advice, not a legal opinion, not a substitute for a qualified lawyer. Non-removable from the pack. See [`LEGAL_NOTICE.md`](../../../LEGAL_NOTICE.md).
+Every output is a **draft / research aid for a human attorney to verify** — not legal advice, not a legal opinion, not a substitute for a qualified lawyer. Non-removable from the pack. See `LEGAL_NOTICE.md`.
 
 ## Consent gate — refuse until acknowledged
 
@@ -133,7 +134,7 @@ Active whenever any of these are in the request, the open file, or the loaded sk
 ## See also
 
 - [`legal-practice-profile`](../skills/legal-practice-profile/SKILL.md) — the migrated operating mechanics (consent gate, council gate, RDG line, headers, jurisdiction honesty, GREEN gate, privilege circle, distribution stance)
-- [`LEGAL_NOTICE.md`](../../../LEGAL_NOTICE.md) — repo-root legal notice (no advice / no attorney-client / no warranty)
+- `LEGAL_NOTICE.md` — repo-root legal notice (no advice / no attorney-client / no warranty)
 - `domain-safety-disclaimer` — generic advisory-content floor (`not-legal-advice`)
 - `domain-safety-pii` — privilege/PII markers on drafts, logs, exports
 - `lethal-trifecta-guard` — egress gate the privilege-outbound block builds on

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -2,6 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
+consequence_class: "security-boundary"
 description: "Skill/command/tool mixing private-data access + untrusted content + external comms — break one leg before shipping"
 triggers:
   - path_prefix: "src/skills/"

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "1"
+consequence_class: "security-boundary"
 description: "Writing/upstreaming low-impact-decisions corpus entries — non-bypassable privacy floor"
 triggers:
   - path_prefix: "agents/decisions/low-impact-decisions"