@event4u/agent-config 16.2.0 → 16.3.0

package/src/config/rule-consequence-class.json

@@ -0,0 +1,161 @@
+{
+    "_comment": "The high-consequence rule class (road-to-rule-laws-that-can-stand Phase 2). The CRITERION lives in the `consequence_class` property of src/scripts/schemas/rule.schema.json and is the only thing that selects a member — this file is the list the criterion produced, not a list chosen first, which is why `excluded` carries a reason per row and is walked by id against the router. A rule earns a row by what its own law section obligates, never by its name or its pack. `members` is the whole class. `no_stub` is the subset whose law cannot stand in a stub today — missing, or over the 2,000-char ceiling — each with the reason; those project FULL-BODIED, which is strictly safer than a shortened copy, and the subset is what stops the class being quietly shrunk by not writing a law. A member in that state and NOT in `no_stub` fails the projection. Checked by tests/scripts/rule_consequence_class.test.ts.",
+    "criterion_ref": "src/scripts/schemas/rule.schema.json#/properties/consequence_class",
+    "members": {
+        "autonomous-execution": {
+            "clause": "authority-bypass",
+            "why": "The Hard Floor and the commit default are authority boundaries."
+        },
+        "broken-access-control": {
+            "clause": "security-boundary",
+            "why": "The law is the per-object ownership and tenant check before data is returned. Violating it hands one user another user's data."
+        },
+        "command-suggestion-policy": {
+            "clause": "authority-bypass",
+            "why": "The law is SUGGEST, NEVER INVOKE. Violating it starts a command flow the user never picked."
+        },
+        "decision-revisit-gate": {
+            "clause": "authority-bypass",
+            "why": "The law routes a reopened decision to the council by default and to the owner for the reserved set. Violating it executes an owner-reserved transition on the agent's own authority."
+        },
+        "doc-screenshot-hygiene": {
+            "clause": "irreversible-external",
+            "why": "The law calls a shipped screenshot with unredacted data an irreversible published egress, in those words."
+        },
+        "domain-safety-disclaimer": {
+            "clause": "authority-bypass",
+            "why": "The law refuses diagnosis and dosage outright and makes every advisory draft carry its disclaimer. Violating it issues a professional judgement the agent is not licensed to make."
+        },
+        "domain-safety-pii": {
+            "clause": "security-boundary",
+            "why": "The law keeps raw direct identifiers out of drafts, logs and exports. Violating it is the data exposure."
+        },
+        "domain-safety-retention": {
+            "clause": "irreversible-external",
+            "why": "The law forbids recommending deletion under audit, litigation or regulatory hold. Violating it destroys records that cannot be recovered."
+        },
+        "engineering-safety-floor": {
+            "clause": "irreversible-external",
+            "why": "The law restates the Hard Floor for deploys, production-trunk merges and production data. Every trigger it names is an action this agent cannot undo."
+        },
+        "evaluator-independence": {
+            "clause": "authority-bypass",
+            "why": "The law forbids authoring the verdict into an evaluator's prompt. Violating it manufactures the independent review a gate then relies on."
+        },
+        "fast-path-marker-visibility": {
+            "clause": "authority-bypass",
+            "why": "The marker is the only signal that a fast path resolved a decision instead of the user. Swallowing it hides the substitution."
+        },
+        "finance-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a final invest or raise call. Violating it takes a decision the law assigns to the human."
+        },
+        "git-history-discipline": {
+            "clause": "irreversible-external",
+            "why": "The law forbids rewriting published history and dropping commits the session did not author. A force-push over someone else's work is not recoverable from here."
+        },
+        "image-likeness-and-rights": {
+            "clause": "irreversible-external",
+            "why": "The law gates a real person's likeness, a trademarked mark and a living artist's style behind explicit rights. The harm lands outside the repository and outlives the render."
+        },
+        "legal-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a binding legal conclusion and stops outright at individual-case examination. Violating it performs regulated activity."
+        },
+        "lethal-trifecta-guard": {
+            "clause": "security-boundary",
+            "why": "The law forbids shipping private-data access, untrusted ingestion and external comms on one autonomous path. That combination is the exfiltration shape itself."
+        },
+        "low-impact-corpus-privacy-floor": {
+            "clause": "security-boundary",
+            "why": "The law is a non-bypassable redaction gate on entries that leave the project repo. It is the last check before an upstream push."
+        },
+        "question-not-instruction": {
+            "clause": "authority-bypass",
+            "why": "A question is not authorization to act — the purest authority-bypass clause in the tree."
+        },
+        "runtime-safety": {
+            "clause": "security-boundary",
+            "why": "The rule bounds what an `automated` skill may execute and which handlers are allowlisted."
+        },
+        "secret-vcs-guard": {
+            "clause": "security-boundary",
+            "why": "The law stops before a credential reaches version control. Once committed it is leaked in every clone, and only rotation undoes it."
+        },
+        "security-sensitive-stop": {
+            "clause": "security-boundary",
+            "why": "The law requires a threat pass before the first edit to auth, tenancy, billing, secrets, uploads and public endpoints. It is the gate the other security rules assume ran."
+        },
+        "session-canary": {
+            "clause": "authority-bypass",
+            "why": "The honesty clause forbids papering over a dropped canary. Faking continuity removes the user's only signal that the session is degrading, which is their decision to make."
+        },
+        "settings-ask-protocol": {
+            "clause": "authority-bypass",
+            "why": "The law calls a silent permissive default a decision taken in the user's name, and forbids it."
+        },
+        "source-confidentiality": {
+            "clause": "security-boundary",
+            "why": "The law keeps derivation attribution out of the tracked tree. A disclosure that lands in git history is not withdrawable."
+        },
+        "strategy-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a final enter / build / buy / reorg call and names the human decision owner."
+        },
+        "tool-safety": {
+            "clause": "security-boundary",
+            "why": "The rule is the deny-by-default tool allowlist and the no-hidden-credentials floor."
+        },
+        "untrusted-input-defense": {
+            "clause": "security-boundary",
+            "why": "The law makes fetched, tool, file, RAG and MCP content data and never instructions. Violating it is how an attacker's text becomes the agent's plan."
+        },
+        "user-interrupt-priority": {
+            "clause": "authority-bypass",
+            "why": "The law stops the current task on a new instruction and asks before resuming. Silent resume continues work the user withdrew."
+        }
+    },
+    "no_stub": {
+        "autonomous-execution": {
+            "clause": "authority-bypass",
+            "why": "The Hard Floor and the commit default are authority boundaries.",
+            "reason": "No heading matching `Iron Law`: the rule states its floors under `## Hard Floor` and its bound in a fence under `## Validation-loop budget`. Promoting one of those to a law heading is authoring a law, which is a change to what the rule obligates and is out of scope for a projection change. Projects full-bodied until a law section is written deliberately."
+        },
+        "legal-safety-floor": {
+            "clause": "authority-bypass",
+            "why": "The law refuses a binding legal conclusion and stops outright at individual-case examination.",
+            "reason": "Law section is 2,023 characters, 23 over the hard ceiling, and carries a dated exception in rule-law-ceilings.json. It cannot stand in a stub until the RDG STOP block is reviewed out of the law and into the body beside it."
+        },
+        "question-not-instruction": {
+            "clause": "authority-bypass",
+            "why": "A question is not authorization to act — the purest authority-bypass clause in the tree.",
+            "reason": "No heading matching `Iron Law`: the rule opens with a bare fence under its title. The fence is the law and promoting it needs a heading, which is a rule edit rather than a projection one."
+        },
+        "runtime-safety": {
+            "clause": "security-boundary",
+            "why": "The rule bounds what an `automated` skill may execute and which handlers are allowlisted.",
+            "reason": "No heading matching `Iron Law`: the constraints are a bullet list under `## Constraints`. Named by the roadmap's own Context as one of the two sharpest cases in the 35."
+        },
+        "tool-safety": {
+            "clause": "security-boundary",
+            "why": "The rule is the deny-by-default tool allowlist and the no-hidden-credentials floor.",
+            "reason": "No heading matching `Iron Law`: the floor is stated under `## Constraints` and `## Scoped grants`. Named by the roadmap's own Context as one of the two sharpest cases in the 35."
+        }
+    },
+    "excluded": {
+        "active-remediation": "A spotted issue left unfixed costs quality and rework. Its one genuinely high-consequence branch — a live cross-user exposure — is already `broken-access-control`'s law, which is in the class.",
+        "delegation-policy": "Dispatch shape, not authority: it delegates nothing a Hard Floor would stop, and says so.",
+        "downstream-changes": "A missed caller is a broken build, which is loud and recoverable.",
+        "history-discipline": "Audit coverage is an auditability property. Its privacy interlock points at `domain-safety-pii`, which is in the class.",
+        "media-governance-routing": "A routing rule: it surfaces the project-local media policies. The rights obligation itself is `image-likeness-and-rights`, which is in the class.",
+        "media-sync-ground-truth": "The spend gate is real but the obligation its law states is a sourcing one — timing and singer come from the transcribed audio. The paid-render confirmation it builds on is `non-destructive-by-default`, a kernel rule that is never thinned.",
+        "no-attribution-footers": "An attribution footer is external but editable, so the action is not irreversible.",
+        "no-decorative-emojis-in-git-surfaces": "An emoji in a PR title or a commit subject is external but editable, and the fix is an edit rather than a rotation or a retraction. Same reason as no-attribution-footers, one surface over.",
+        "no-pr-progress-comments": "A noisy PR thread is a cost, not a boundary, and a comment can be deleted.",
+        "playbook-precedence": "Its propose-never-silently-run clause defers to the same floor `non-destructive-by-default` holds; on its own it decides which procedure to follow.",
+        "provider-lifecycle-discipline": "Tier declaration and a refuse-and-surface ask. The spend floor it defers to is a kernel rule.",
+        "scale-discipline": "An exhausted connection pool is an availability failure, not a security boundary.",
+        "senior-engineering-discipline": "The anchor that ROUTES to the invisible controls. The controls themselves are in the class; the anchor is not, or the criterion would admit every rule that mentions security.",
+        "think-before-action": "Analysis discipline. Violating it wastes work."
+    }
+}

package/src/config/rule-law-ceilings.json

@@ -0,0 +1,99 @@
+{
+    "_comment": "Per-rule law-section and body ceilings (road-to-rule-laws-that-can-stand Phase 1). SHRINK-ONLY on every axis: an id may LEAVE `missing`, never join it; a recorded exception is a ceiling the rule may fall below and never rise above. Raising one to clear a red is the config-weakening move this repo blocks by construction — `--write-baseline` refuses to raise, it only re-records the smaller of old and current. A rule at its exception is not thereby correct, only not worse. Regenerate with `lint_rule_law_section --write-baseline`; never hand-edit the counts, but DO hand-edit `owner`, `review` and `reason` — those are the review contract and the generator only seeds them.",
+    "measured_at_commit": "30f7d21f6",
+    "missing": [
+        "architecture",
+        "artifact-drafting-protocol",
+        "artifact-engagement-recording",
+        "augment-edit-discipline",
+        "autonomous-execution",
+        "cli-output-handling",
+        "commit-conventions",
+        "context-hygiene",
+        "copilot-routing",
+        "devcontainer-routing",
+        "docker-commands",
+        "external-code-graph-interop",
+        "improve-before-implement",
+        "laravel-routing",
+        "laravel-translations",
+        "linked-projects-onboarding-gate",
+        "markdown-safe-codeblocks",
+        "minimal-safe-diff",
+        "missing-tool-handling",
+        "model-recommendation",
+        "onboarding-gate",
+        "php-coding",
+        "question-not-instruction",
+        "reviewer-awareness",
+        "role-mode-adherence",
+        "rule-type-governance",
+        "runtime-safety",
+        "skill-improvement-trigger",
+        "skill-quality",
+        "slash-command-routing-policy",
+        "source-of-truth",
+        "symfony-routing",
+        "test-first",
+        "tool-safety",
+        "upstream-proposal"
+    ],
+    "law_exceptions": {
+        "legal-safety-floor": {
+            "chars": 2023,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Three laws a regulator reads literally (no final legal call, consent gate, council gate) plus the RDG STOP block whose wording is quoted verbatim to the user. At 2023 characters it is 23 over the ceiling, so the review is about whether the STOP block belongs in the law or beside it."
+        },
+        "preservation-guard": {
+            "chars": 2418,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "The law IS a checklist: each bullet names a passage class that must survive a transform, and check_condensation reads the same list. Shortening the prose would shorten the contract the gate enforces. Review target: move the reject criteria out and leave the preservation checklist."
+        },
+        "roadmap-progress-sync": {
+            "chars": 5387,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Three separate Iron Laws (dashboard sync, checkbox cadence, no silent archive) plus the preservation test that resolves a deferred item. Splitting them would create three rules with one trigger set; collapsing them would drop an obligation. Review target: move the resolution procedure under Iron Law 3 behind load_context and keep the three laws."
+        }
+    },
+    "body_exceptions": {
+        "code-provenance": {
+            "chars": 8106,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Two layers (code borrows and the knowledge/harvest layer) each with its own law, plus the no-CI-detector honesty section recording a measured gate decision."
+        },
+        "context-hygiene": {
+            "chars": 8320,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Carries the freshness ladder, the 3-failure rule, loop detection and the 15/25 read-loop rule, each with its own self-check. Already migrated once into context-hygiene-mechanics and re-grew."
+        },
+        "decision-revisit-gate": {
+            "chars": 8566,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "The largest rule in the tree. Carries the five-step gate, the two descriptive axes, the owner-reserved table and an honest-enforcement section. Phase 1.4 of road-to-rule-laws-that-can-stand names it as a first mover for the load_context split."
+        },
+        "design-fidelity": {
+            "chars": 8777,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Carries the artefact-maturity axis, the fidelity-mode table and the routing matrix. Phase 1.4 names it as a first mover."
+        },
+        "roadmap-progress-sync": {
+            "chars": 9308,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Three laws plus the deferred-item resolution procedure and the later/PR-gate dispositions. The dispositions are mechanism, not obligation, and are the load_context candidate."
+        },
+        "settings-ask-protocol": {
+            "chars": 8099,
+            "owner": "agent-config-maintainer",
+            "review": "2026-12-01",
+            "reason": "Carries the four slots, the seven keys, the non-interactive rule and the consent-verdict contract. The key inventory is reference material and is the load_context candidate."
+        }
+    }
+}

package/src/install/claudePathsPlan.ts

@@ -188,6 +188,21 @@ export interface ClaudePathsPlan {
     dropped: { pattern: string; reason: 'unresolved-placeholder' | 'over-budget' | 'mixed-triggers' }[];
 }
 
+/**
+ * The two trigger keys `derive_trigger_globs` turns into a host glob. Kept
+ * beside it deliberately: the day a third path-shaped key is added there, this
+ * set is the other half of the same edit, and a reader looking at either one
+ * sees the pair.
+ */
+const PATH_SHAPED_TRIGGER_KEYS: ReadonlySet<string> = new Set(['file_pattern', 'path_prefix']);
+
+/**
+ * Keys on a trigger object that match nothing. `reason:` documents why the
+ * trigger exists; counting it would make every annotated path trigger look
+ * mixed and scope nothing at all.
+ */
+const NON_MATCHING_TRIGGER_KEYS: ReadonlySet<string> = new Set(['reason']);
+
 /**
  * Does this rule declare any trigger that is NOT path-shaped?
  *
@@ -199,6 +214,18 @@ export interface ClaudePathsPlan {
  * rule loads unconditionally. The emitter fed both semantics from one list, so
  * a rule that declared keywords *and* one path glob silently became
  * path-gated-only on Claude.
+ *
+ * **The test is a negation, not a list of non-path kinds**, and the difference
+ * is not stylistic. The predicate used to enumerate `keyword` and `phrase`,
+ * which left `command` — a prompt route like any other — uncounted:
+ * `roadmap-progress-sync` declares one `path_prefix` and three `command`
+ * triggers, so it was emitted with an exclusive `paths:` and its three command
+ * routes never fired on this host. A list can only ever be as current as its
+ * last edit; the schema's `additionalProperties: false` means a new match key
+ * arrives as a deliberate schema change, and until someone teaches
+ * `derive_trigger_globs` to make a glob from it, treating it as promptable is
+ * the fail-safe reading — the rule stays unconditional rather than silently
+ * narrowing to a path it does not have.
  */
 export function _has_non_path_trigger(meta: Record<string, unknown>): boolean {
     const triggers = meta['triggers'];
@@ -206,8 +233,21 @@ export function _has_non_path_trigger(meta: Record<string, unknown>): boolean {
     for (const t of triggers) {
         if (t === null || typeof t !== 'object' || Array.isArray(t)) continue;
         const obj = t as Record<string, unknown>;
-        if (typeof obj['keyword'] === 'string' && obj['keyword']) return true;
-        if (typeof obj['phrase'] === 'string' && obj['phrase']) return true;
+        for (const [key, value] of Object.entries(obj)) {
+            if (PATH_SHAPED_TRIGGER_KEYS.has(key) || NON_MATCHING_TRIGGER_KEYS.has(key)) continue;
+            // A string that is not blank, or ANY non-string value. The schema
+            // types all five match keys as strings today, so the second half is
+            // for the key that arrives later: a `keyword: ["a","b"]` read as
+            // "not a string, so not a trigger" would silently narrow the rule
+            // to a path it does not have, which is the exact failure the
+            // negation above exists to prevent. Undefined and null are the one
+            // shape that means "absent".
+            if (typeof value === 'string') {
+                if (value.trim() !== '') return true;
+            } else if (value !== undefined && value !== null) {
+                return true;
+            }
+        }
     }
     return false;
 }
@@ -230,8 +270,10 @@ export function _claude_paths_plan(meta: Record<string, unknown>): ClaudePathsPl
     const globs: string[] = [];
     const dropped: ClaudePathsPlan['dropped'] = [];
 
-    // A rule that ALSO declares keyword / phrase triggers gets no `paths:` at
-    // all, and therefore keeps loading unconditionally on Claude Code.
+    // A rule that ALSO declares a non-path trigger — keyword, phrase, command,
+    // or a match key added to the schema later — gets no `paths:` at all, and
+    // therefore keeps loading unconditionally on Claude Code. The predicate is
+    // a negation of the two path-shaped keys, deliberately: see its docblock.
     //
     // Emitting `paths:` here would narrow the rule to a path match and discard
     // every keyword the author wrote, because this host reads the list as the

package/src/install/claudeRuleRewrite.ts

@@ -132,7 +132,7 @@ export function rewriteAndReport(
     quiet: boolean,
     info: (m: string) => void,
     warn: (m: string) => void,
-    wrappers?: { wrapped: readonly string[]; reserved: readonly string[] },
+    wrappers?: { wrapped: readonly string[]; reserved: readonly string[]; foreign?: readonly string[] },
     preserved: ReadonlySet<string> = new Set(),
 ): ClaudeRuleRewriteResult {
     const result = rewriteClaudeRules(rulesDir, preserved);
@@ -157,6 +157,15 @@ export function rewriteAndReport(
                     'commands remain available',
             );
         }
+        if (wrappers.foreign !== undefined && wrappers.foreign.length > 0) {
+            // Reported, never removed. The name shadows a host built-in, but
+            // this package did not write the file, so deleting it would be
+            // taking a neighbour's command away without saying so.
+            info(
+                `  claude-code: kept ${wrappers.foreign.length} neighbour command file(s) whose ` +
+                    `name is a Claude Code built-in (${wrappers.foreign.join(', ')}); not ours to remove`,
+            );
+        }
     }
     if (result.rewritten > 0 && !quiet) {
         info(

package/src/install/emit_host_rules_cli.ts

@@ -44,6 +44,14 @@ import {
     _emit_windsurf_rule,
     strip_frontmatter,
 } from '../scripts/condense.js';
+import {
+    WINDSURFRULES_HEADER,
+    cleanOwnedOnly,
+    keptLine,
+    mayWriteRuleFile,
+    mayWriteWindsurfRules,
+    ownedPaths,
+} from './host_rule_ownership.js';
 
 function _ruleFiles(rulesDir: string): string[] {
     return fs
@@ -60,63 +68,64 @@ function _ruleFiles(rulesDir: string): string[] {
         });
 }
 
-/** Remove entries not in `valid` (mirror of condense's `_clean_modern_dir`). */
-function _cleanDir(dir: string, valid: ReadonlySet<string>): void {
-    let entries: string[];
-    try {
-        entries = fs.readdirSync(dir);
-    } catch {
-        return;
-    }
-    for (const name of entries) {
-        if (name === 'README.md' || valid.has(name)) {
-            continue;
-        }
-        const full = path.join(dir, name);
-        try {
-            if (fs.lstatSync(full).isDirectory()) {
-                fs.rmSync(full, { recursive: true, force: true });
-            } else {
-                fs.unlinkSync(full);
-            }
-        } catch {
-            /* best-effort clean */
-        }
-    }
-}
-
 export function emitCursor(rulesDir: string, projectRoot: string): number {
     const targetDir = path.join(projectRoot, '.cursor', 'rules');
     const files = _ruleFiles(rulesDir);
+    const owned = ownedPaths(projectRoot);
     const valid = new Set<string>();
+    let blocked = 0;
     for (const src of files) {
         const name = `${path.basename(src, '.md')}.mdc`;
-        _emit_cursor_mdc(src, path.join(targetDir, name));
+        const target = path.join(targetDir, name);
+        // Ownership BEFORE the write: a neighbour's file under one of our
+        // names would otherwise be destroyed and then skipped by the cleanup
+        // pass, which only looks at names this run did not emit.
+        if (!mayWriteRuleFile(target, owned)) {
+            blocked += 1;
+            continue;
+        }
+        _emit_cursor_mdc(src, target);
         valid.add(name);
     }
-    _cleanDir(targetDir, valid);
+    const { kept } = cleanOwnedOnly(targetDir, valid, owned);
+    const line = keptLine(kept + blocked);
+    if (line !== null) process.stdout.write(`cursor: ${line}\n`);
     return files.length;
 }
 
 export function emitWindsurf(rulesDir: string, projectRoot: string): number {
     const perRuleDir = path.join(projectRoot, '.windsurf', 'rules');
     const files = _ruleFiles(rulesDir);
+    const owned = ownedPaths(projectRoot);
     const valid = new Set<string>();
+    let blocked = 0;
     for (const src of files) {
         const name = path.basename(src);
-        _emit_windsurf_rule(src, path.join(perRuleDir, name));
+        const target = path.join(perRuleDir, name);
+        if (!mayWriteRuleFile(target, owned)) {
+            blocked += 1;
+            continue;
+        }
+        _emit_windsurf_rule(src, target);
         valid.add(name);
     }
-    _cleanDir(perRuleDir, valid);
+    const { kept } = cleanOwnedOnly(perRuleDir, valid, owned);
+    const line = keptLine(kept + blocked);
+    if (line !== null) process.stdout.write(`windsurf: ${line}\n`);
 
     // Concatenated legacy surface — same format as the projection-path
     // generator (condense.generate_windsurfrules), consumer-sourced header.
-    const parts = ['# Auto-generated from .augment/rules/ — do not edit directly\n'];
-    for (const src of files) {
-        const content = strip_frontmatter(fs.readFileSync(src, 'utf-8'));
-        parts.push(`---\n\n${content.trim()}\n`);
+    const target = path.join(projectRoot, '.windsurfrules');
+    if (mayWriteWindsurfRules(target, owned)) {
+        const parts = [`${WINDSURFRULES_HEADER}\n`];
+        for (const src of files) {
+            const content = strip_frontmatter(fs.readFileSync(src, 'utf-8'));
+            parts.push(`---\n\n${content.trim()}\n`);
+        }
+        fs.writeFileSync(target, parts.join('\n') + '\n', 'utf-8');
+    } else {
+        process.stdout.write('windsurf: kept: 1 neighbour file(s) (.windsurfrules)\n');
     }
-    fs.writeFileSync(path.join(projectRoot, '.windsurfrules'), parts.join('\n') + '\n', 'utf-8');
     return files.length;
 }
 

package/src/install/globalRuleScope.ts

@@ -0,0 +1,109 @@
+/**
+ * The rule scope governing a GLOBAL deploy.
+ *
+ * Moved out of `src/scripts/install.ts` by
+ * `road-to-an-installed-layer-that-is-thinned` step 1.1, which adds the thinning
+ * call to the same deploy loop. `check_source_size_budget` is a one-way ratchet
+ * with no per-change headroom, and this repository's stated convention is that
+ * the total falls through EXTRACTION and never rises through a baseline edit —
+ * the same reason `claudeRuleRewrite` holds the claude-code post-copy reporting
+ * rather than the installer. This function is the nearest self-contained block
+ * to the change: it is the predicate the deploy loop resolves once per run, it
+ * reaches nothing else in the installer, and its four environment touches are
+ * already parameters in all but name.
+ *
+ * BEHAVIOUR IS UNCHANGED, DELIBERATELY. The body is the installer's, verbatim
+ * apart from the four injected seams below; `install.ts` keeps a wrapper of the
+ * same name and signature, so its re-export and every caller and test see what
+ * they saw before. A behaviour change smuggled into an extraction is the one
+ * thing that would make the line saving not worth having.
+ *
+ * The seams are injected rather than imported because each one is an
+ * install-time decision the installer owns: where the global settings doc lives,
+ * how this build reads and parses YAML, what the packaged template says, and
+ * where a warning goes.
+ */
+
+import { LEGACY_ALL, ruleScopeFromSettings, type RuleScope } from './rule_scope.js';
+
+export interface GlobalRuleScopeInputs {
+    /** The global settings file, or `null` when no artefact exists at all. */
+    readonly settingsPath: string | null;
+    /** The package being installed from. */
+    readonly packageRoot: string;
+    /** Read a file as text; throws like `fs.readFileSync` when it cannot. */
+    readonly readText: (p: string) => string;
+    /** Parse YAML permissively — anything unparseable comes back non-object. */
+    readonly parseYaml: (text: string) => unknown;
+    /** The packaged template settings, read only on a genuinely fresh machine. */
+    readonly loadDefaults: () => Record<string, unknown>;
+    /** Where a loud fallback goes. */
+    readonly warn: (message: string) => void;
+}
+
+function isPlainObject(v: unknown): boolean {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/**
+ * Resolve the rule scope governing THIS global deploy — the same way the wizard
+ * does (`src/server/routes/install.ts::_resolveRuleScope`), so the two global
+ * paths cannot ship different rule sets for the same settings.
+ *
+ * Settings resolution mirrors `_resolve_scoped_projection` above: an existing
+ * global settings doc is authoritative, and only a genuinely fresh machine falls
+ * through to the packaged template. Any read or parse failure resolves to
+ * `LEGACY_ALL` — over-shipping is the safe direction, and the compat exclusion
+ * (`source-of-truth.md`) still applies even then.
+ */
+export function resolveGlobalRuleScope(inputs: GlobalRuleScopeInputs): RuleScope {
+    const { packageRoot, warn } = inputs;
+    const settings_path = inputs.settingsPath;
+
+    // No global settings artefact at all — a genuinely fresh machine. Fall
+    // through to the packaged template silently: there is no user decision to
+    // contradict, and this is the documented upgrade-compat path.
+    if (settings_path === null) {
+        try {
+            return ruleScopeFromSettings(inputs.loadDefaults(), packageRoot);
+        } catch {
+            return LEGACY_ALL;
+        }
+    }
+
+    // A doc EXISTS, so the user has expressed a configuration. Failing to read
+    // it is not the same as not having one: falling back to legacy-all here
+    // ships the maintainer-only rules the user may have deliberately scoped out,
+    // and `_load_yaml_doc` would report that as an indistinguishable `{}`. So
+    // parse it explicitly and be LOUD when it does not parse — over-shipping
+    // stays the safe direction, but it must not be a silent one.
+    let text: string;
+    try {
+        text = inputs.readText(settings_path);
+    } catch (e) {
+        warn(
+            `could not read ${settings_path} (${String(e)}) — rule scoping falls back ` +
+                'to legacy-all, so ALL rules including maintainer-only ones will be ' +
+                'installed. Fix the file to restore scoping.',
+        );
+        return LEGACY_ALL;
+    }
+    const parsed = inputs.parseYaml(text);
+    if (!isPlainObject(parsed)) {
+        warn(
+            `${settings_path} is not a YAML mapping — rule scoping falls back to ` +
+                'legacy-all, so ALL rules including maintainer-only ones will be ' +
+                'installed. Fix the file to restore scoping.',
+        );
+        return LEGACY_ALL;
+    }
+    try {
+        return ruleScopeFromSettings(parsed as Record<string, unknown>, packageRoot);
+    } catch (e) {
+        warn(
+            `could not derive rule scope from ${settings_path} (${String(e)}) — ` +
+                'falling back to legacy-all; ALL rules will be installed.',
+        );
+        return LEGACY_ALL;
+    }
+}