@event4u/agent-config 16.2.0 → 16.3.0

package/src/scripts/check_hook_bundle_composition.ts

@@ -0,0 +1,370 @@
+#!/usr/bin/env tsx
+/**
+ * Composition gate for the self-hosted hook bundle: ONE YAML reader, and a
+ * byte ceiling.
+ *
+ * WHY THIS EXISTS — measured, not hypothetical.
+ *
+ * Every concern is inlined into one `dist/hooks/dispatch.js` that every hook
+ * event loads, so a dependency added for ONE concern is paid by all of them on
+ * every dispatch. On 2026-10-01 the bundle carried two YAML parsers: `yaml`,
+ * pulled by six modules including the dispatcher itself, and `js-yaml`, pulled
+ * by one call site in `block_config_weakening.ts` — 95,846 bytes, 6.13 % of a
+ * 1,564,211-byte bundle. Beside it, `host_lowering.ts`'s own header said the
+ * `yaml` reader was "the ONLY remaining YAML reader on that path".
+ *
+ * Nothing in this tree could see either fact. The freshness gate compares
+ * mtimes, the content gate compares digests, and neither has an opinion about
+ * what is INSIDE the bundle. So the second parser reached a release and was
+ * found by an external rescore counting bytes — a review finding where it
+ * should have been a red check. This gate is that red check.
+ *
+ * WHAT IT CHECKS
+ *
+ *   1. At most `max_yaml_packages` YAML packages contribute bytes to the
+ *      bundle. The package set is {@link YAML_PACKAGES} — a closed list, so a
+ *      third parser arriving under a name nobody listed is NOT caught here, and
+ *      that limit is stated rather than implied.
+ *   2. The bundle's byte count is at or under `max_bytes`.
+ *
+ * Both bounds live in `src/config/hook-bundle-budget.json`, never in this file:
+ * a number a reviewer has to read a script to find is a number nobody reviews.
+ *
+ * WHY IT BUILDS RATHER THAN READS. `dist/hooks/` is untracked, so a gate that
+ * read the bundle on disk would be local-only like `check_hook_bundle_content`
+ * — and the thing being bounded is what the SOURCE produces, which is a
+ * property of the commit rather than of a machine. So this builds its own
+ * bundle with `--metafile` and measures that. It runs identically in CI and
+ * locally, and it never touches the live bundle.
+ *
+ * The esbuild invocation is NOT duplicated here: it is read from
+ * `package.json`'s `build:hooks` script with only `--outfile=` rewritten, via
+ * the same `rewriteOutfile` helper `rebuild_hook_bundle` and
+ * `check_hook_bundle_content` use, so the flag set has exactly one home. The
+ * trailing `&& node src/scripts/write_bundle_digest.mjs` is stripped — this
+ * gate must not write a sidecar for a probe bundle nobody executes.
+ *
+ * WHAT IT DOES NOT DO. It says nothing about LATENCY. A smaller bundle is not
+ * a measured speed-up; `src/config/hook-latency-budget.json` owns that axis and
+ * no number here is derived from it. It says nothing about the install or MCP
+ * bundles, which carry their own module graphs.
+ *
+ * Usage:
+ *     ./scripts-run src/scripts/check_hook_bundle_composition
+ *     ./scripts-run src/scripts/check_hook_bundle_composition --metafile <path>
+ *     ./scripts-run src/scripts/check_hook_bundle_composition --self-test
+ *
+ * Exit codes: 0 = within budget · 1 = over the ceiling or a second reader ·
+ * 2 = the build or the budget file failed.
+ */
+// ledger-exempt: single-artefact transaction — one bundle build yielding one
+// aggregate verdict. The per-source accounting lives in
+// check_hook_bundle_freshness, which carries the ledger.
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
+import { reportScanned } from './_lib/scan_scope.js';
+import { buildScript } from './check_hook_bundle_content.js';
+import { rewriteOutfile } from './rebuild_hook_bundle.js';
+
+const _HERE = path.dirname(fileURLToPath(import.meta.url));
+export const REPO_ROOT = path.resolve(_HERE, '..', '..');
+export const SELF_REL = path.join('src', 'scripts', 'check_hook_bundle_composition.ts');
+export const BUDGET_REL = path.join('src', 'config', 'hook-bundle-budget.json');
+const LIVE_REL = path.join('dist', 'hooks', 'dispatch.js');
+
+/**
+ * The YAML readers this tree has ever carried, by package name.
+ *
+ * A CLOSED LIST, and the consequence is worth stating: a fourth parser arriving
+ * under a name not listed here contributes bytes the ceiling catches and the
+ * parser cap does not. The alternative — treating any package whose name
+ * contains "yaml" as a reader — would match a YAML-adjacent utility that is not
+ * a parser, and a cap that fires on the wrong package is worse than one that
+ * misses an unlisted one, because the first teaches people to raise the cap.
+ */
+export const YAML_PACKAGES: readonly string[] = ['yaml', 'js-yaml', 'yaml-js', 'yamljs'];
+
+export interface Budget {
+    readonly maxBytes: number;
+    readonly maxYamlPackages: number;
+}
+
+export interface Analysis {
+    /** Bytes of the bundle esbuild produced. */
+    readonly bytes: number;
+    /** Modules that contributed to it — the unit `scanned:` reports. */
+    readonly modules: number;
+    /** Bytes in the output, summed per owning npm package. */
+    readonly packageBytes: ReadonlyMap<string, number>;
+    /** Listed YAML packages contributing more than zero bytes, sorted. */
+    readonly yamlPackages: readonly string[];
+}
+
+/**
+ * The npm package a bundled module path belongs to, or `null` for this tree's
+ * own sources.
+ *
+ * Reads the INNERMOST `node_modules/` segment: a transitively nested copy
+ * (`node_modules/a/node_modules/yaml/…`) is still `yaml`'s bytes, and
+ * attributing it to `a` would let a second parser hide one level down.
+ */
+export function owningPackage(modulePath: string): string | null {
+    const marker = 'node_modules/';
+    const at = modulePath.lastIndexOf(marker);
+    if (at < 0) return null;
+    const parts = modulePath.slice(at + marker.length).split('/');
+    const head = parts[0] ?? '';
+    if (head === '') return null;
+    return head.startsWith('@') ? `${head}/${parts[1] ?? ''}` : head;
+}
+
+/** Parse an esbuild metafile and attribute its one entry-point output. */
+export function analyzeMetafile(json: string): Analysis {
+    const meta = JSON.parse(json) as {
+        outputs?: Record<string, { entryPoint?: string; bytes?: number; inputs?: Record<string, { bytesInOutput?: number }> }>;
+    };
+    const outputs = Object.values(meta.outputs ?? {});
+    const out = outputs.find((o) => typeof o.entryPoint === 'string');
+    if (out === undefined) {
+        throw new Error(
+            'metafile carries no entry-point output — refusing to report a composition for a build that produced nothing',
+        );
+    }
+    const packageBytes = new Map<string, number>();
+    const inputs = out.inputs ?? {};
+    for (const [p, v] of Object.entries(inputs)) {
+        const pkg = owningPackage(p);
+        if (pkg === null) continue;
+        packageBytes.set(pkg, (packageBytes.get(pkg) ?? 0) + (v.bytesInOutput ?? 0));
+    }
+    const yamlPackages = YAML_PACKAGES.filter((p) => (packageBytes.get(p) ?? 0) > 0).sort();
+    return {
+        bytes: out.bytes ?? 0,
+        modules: Object.keys(inputs).length,
+        packageBytes,
+        yamlPackages,
+    };
+}
+
+/** Read the committed budget. Throws rather than defaulting — a guessed ceiling bounds nothing. */
+export function readBudget(root: string): Budget {
+    const abs = path.join(root, BUDGET_REL);
+    const raw = JSON.parse(fs.readFileSync(abs, 'utf-8')) as Record<string, unknown>;
+    const maxBytes = raw['max_bytes'];
+    const maxYaml = raw['max_yaml_packages'];
+    if (typeof maxBytes !== 'number' || !Number.isInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error(`${BUDGET_REL}: max_bytes must be a positive integer, got ${JSON.stringify(maxBytes)}`);
+    }
+    if (typeof maxYaml !== 'number' || !Number.isInteger(maxYaml) || maxYaml < 1) {
+        throw new Error(
+            `${BUDGET_REL}: max_yaml_packages must be an integer >= 1, got ${JSON.stringify(maxYaml)}`,
+        );
+    }
+    return { maxBytes, maxYamlPackages: maxYaml };
+}
+
+/** Findings, one line each. Empty means within budget. */
+export function verdict(a: Analysis, budget: Budget): string[] {
+    const findings: string[] = [];
+    if (a.yamlPackages.length > budget.maxYamlPackages) {
+        const detail = a.yamlPackages
+            .map((p) => `${p} (${String(a.packageBytes.get(p) ?? 0)} B)`)
+            .join(', ');
+        findings.push(
+            `${String(a.yamlPackages.length)} YAML readers in the bundle, cap is ` +
+                `${String(budget.maxYamlPackages)}: ${detail}. Every dispatch loads all of them. ` +
+                'Move the odd caller onto the reader the dispatcher already uses.',
+        );
+    }
+    if (a.bytes > budget.maxBytes) {
+        findings.push(
+            `bundle is ${String(a.bytes)} bytes, ceiling is ${String(budget.maxBytes)} ` +
+                `(over by ${String(a.bytes - budget.maxBytes)}). Shrink the bundle, or raise ` +
+                `max_bytes in ${BUDGET_REL} WITH an entry in its raise_log naming what was added.`,
+        );
+    }
+    return findings;
+}
+
+/**
+ * Build the hook bundle to a throwaway path and return its metafile JSON.
+ *
+ * Throws on any failure rather than returning a sentinel: a composition read off
+ * a build that did not happen is the silent-green this gate exists to replace.
+ */
+export function buildMetafile(root: string): string {
+    const script = buildScript(root);
+    if (script === null) {
+        throw new Error('package.json has no `build:hooks` script — refusing to guess the flag set');
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hook-bundle-composition-'));
+    const outFile = path.join(dir, 'dispatch.js');
+    const metaFile = path.join(dir, 'meta.json');
+    try {
+        const rewritten = rewriteOutfile(script, outFile);
+        if (rewritten === null) {
+            throw new Error(`\`build:hooks\` no longer writes ${LIVE_REL} — refusing to build to a guessed path`);
+        }
+        // Strip the digest sidecar step: it would write `dispatch.sha256` beside
+        // a probe bundle nobody executes, and on failure it would mask the build
+        // error with a file-not-found.
+        const esbuildOnly = rewritten.split('&& node ')[0] ?? rewritten;
+        const built = spawnSync('sh', ['-c', `${esbuildOnly.trim()} --metafile=${metaFile}`], {
+            cwd: root,
+            encoding: 'utf-8',
+            maxBuffer: 64 * 1024 * 1024,
+            env: {
+                ...process.env,
+                PATH: `${path.join(root, 'node_modules', '.bin')}:${process.env['PATH'] ?? ''}`,
+            },
+        });
+        if (built.status !== 0 || !fs.existsSync(metaFile)) {
+            throw new Error(`esbuild failed (exit ${String(built.status)})\n${built.stderr ?? ''}`);
+        }
+        return fs.readFileSync(metaFile, 'utf-8');
+    } finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+
+function selfTest(): number {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hook-bundle-composition-selftest-'));
+    const write = (name: string, body: unknown): string => {
+        const p = path.join(dir, name);
+        fs.writeFileSync(p, JSON.stringify(body));
+        return p;
+    };
+    const meta = (bytes: number, inputs: Record<string, number>): unknown => ({
+        inputs: {},
+        outputs: {
+            'dist/hooks/dispatch.js': {
+                entryPoint: 'src/scripts/hooks/dispatch_entry.ts',
+                bytes,
+                inputs: Object.fromEntries(
+                    Object.entries(inputs).map(([k, v]) => [k, { bytesInOutput: v }]),
+                ),
+            },
+        },
+    });
+    const budget = readBudget(REPO_ROOT);
+    const clean = write('clean.json', meta(budget.maxBytes, { 'node_modules/yaml/dist/index.js': 10 }));
+    const twoReaders = write(
+        'two-readers.json',
+        meta(1000, {
+            'node_modules/yaml/dist/index.js': 600,
+            'node_modules/js-yaml/dist/js-yaml.mjs': 400,
+        }),
+    );
+    const oneOver = write('one-over.json', meta(budget.maxBytes + 1, { 'src/x.ts': 1 }));
+    const empty = write('empty.json', { inputs: {}, outputs: {} });
+
+    const drive = (fixture: string): number =>
+        runGateCli(REPO_ROOT, SELF_REL, ['--metafile', fixture], REPO_ROOT);
+
+    try {
+        return runSelfTest({
+            gate: 'check_hook_bundle_composition',
+            minCases: 4,
+            minRejectCases: 3,
+            cases: [
+                {
+                    name: 'one YAML reader, exactly at the ceiling → accepted',
+                    expect: 'accept',
+                    run: () => drive(clean),
+                },
+                {
+                    name: 'a second YAML reader → rejected',
+                    expect: 'reject',
+                    run: () => drive(twoReaders),
+                },
+                {
+                    name: 'one byte over the ceiling → rejected',
+                    expect: 'reject',
+                    run: () => drive(oneOver),
+                },
+                {
+                    name: 'a metafile with no entry-point output → rejected, never reported as 0 bytes',
+                    expect: 'reject',
+                    run: () => drive(empty),
+                },
+            ],
+        });
+    } finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2), root: string = REPO_ROOT): number {
+    if (argv.includes('--self-test')) {
+        return selfTest();
+    }
+    const at = argv.indexOf('--metafile');
+    const fixture = at >= 0 ? argv[at + 1] : undefined;
+
+    let budget: Budget;
+    try {
+        budget = readBudget(root);
+    } catch (e) {
+        process.stderr.write(`check_hook_bundle_composition: ${String(e instanceof Error ? e.message : e)}\n`);
+        return 2;
+    }
+
+    let json: string;
+    try {
+        json = fixture === undefined ? buildMetafile(root) : fs.readFileSync(fixture, 'utf-8');
+    } catch (e) {
+        process.stderr.write(`check_hook_bundle_composition: ${String(e instanceof Error ? e.message : e)}\n`);
+        return 2;
+    }
+
+    let analysis: Analysis;
+    try {
+        analysis = analyzeMetafile(json);
+    } catch (e) {
+        process.stderr.write(`check_hook_bundle_composition: ${String(e instanceof Error ? e.message : e)}\n`);
+        return 1;
+    }
+
+    const findings = verdict(analysis, budget);
+    // Reported on BOTH paths, red included: a census that goes quiet exactly
+    // when the gate fires is the shape `reportScanned` exists to prevent.
+    reportScanned({
+        gate: 'check_hook_bundle_composition',
+        scanned: analysis.modules,
+        units: 'bundled module(s)',
+        roots: [LIVE_REL],
+    });
+
+    if (findings.length === 0) {
+        process.stdout.write(
+            `✅  hook bundle: ${String(analysis.bytes)} B / ${String(budget.maxBytes)} B ceiling, ` +
+                `${String(analysis.yamlPackages.length)} YAML reader(s) ` +
+                `[${analysis.yamlPackages.join(', ')}], ${String(analysis.modules)} modules\n`,
+        );
+        return 0;
+    }
+    process.stderr.write('❌  hook bundle composition is out of budget\n');
+    for (const f of findings) process.stderr.write(`    - ${f}\n`);
+    process.stderr.write(`    Budget: ${BUDGET_REL}\n`);
+    return 1;
+}
+
+function _isCliEntry(): boolean {
+    const argv1 = process.argv[1];
+    if (argv1 === undefined) return false;
+    if (import.meta.url === pathToFileURL(path.resolve(argv1)).href) return true;
+    try {
+        return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(argv1));
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry()) {
+    process.exit(main());
+}

package/src/scripts/check_kernel_edit_ratified.ts

@@ -30,12 +30,14 @@
  *
  * Gated: a diff touching a kernel rule under `src/rules/` (the nine of
  * `_lib/kernel_rules.ts`), a governance hook (`src/scripts/hooks/block_*.ts`),
- * a hook-plumbing SOURCE (`hook_manifest.yaml`, `host_lowering.yaml`, a
- * `*-dispatcher.sh`, either hook budget file — see `PLUMBING_SOURCE_RE`),
- * or this gate itself — so it cannot be weakened without its own record. Such
- * a diff must carry a ratification artifact under
- * the ratifications directory with `verdict: ratified`, valid per the
- * ratification-artifact contract.
+ * hook plumbing — the YAML sources `hook_manifest.yaml` and
+ * `host_lowering.yaml`, their compiled siblings `hook_manifest.json` and
+ * `host_lowering.json`, the dispatcher `hooks/dispatch_hook.ts`, the
+ * kernel-rule list `_lib/kernel_rules.ts`, a `*-dispatcher.sh`, either hook
+ * budget file (see `PLUMBING_SOURCE_RE`) — or this gate itself, so it cannot
+ * be weakened without its own record. Such a diff must carry a ratification
+ * artifact under the ratifications directory with `verdict: ratified`, valid
+ * per the ratification-artifact contract.
  *
  * Every kernel diff is gated, not only the authority-EXPANDING ones.
  * ADR-268 § 4 makes the artifact required for authority-expanding edits. Which
@@ -141,13 +143,49 @@ const GOVERNANCE_HOOK_RE = /^src\/scripts\/hooks\/block_[a-z0-9_]+\.ts$/;
  * and every property the gate already had — base-revision code, in-repo quorum
  * policy, the whole diff as its unit — carries over unchanged.
  *
- * Sources only. `dist/hooks/dispatch.js` and `hooks/hooks.json` are BUILD
- * OUTPUTS with no legitimate hand edit at all, so they are refused at tool-call
- * time by `block_plumbing_writes.ts` rather than ratified here — a record for a
- * file whose every hand edit is illegitimate would be a record of a mistake.
+ * `dist/hooks/dispatch.js` and `hooks/hooks.json` are BUILD OUTPUTS that no
+ * reader in this repository opens — they exist only inside an installed
+ * consumer tree — and they have no legitimate hand edit at all, so they are
+ * refused at tool-call time by `block_plumbing_writes.ts` rather than ratified
+ * here: a record for a file whose every hand edit is illegitimate would be a
+ * record of a mistake.
+ *
+ * road-to-blocking-severities 2.1 WIDENS this from "sources only" to
+ * "everything the dispatcher serves at runtime", and the distinction above is
+ * why the two compiled tables land here while the two build outputs do not.
+ * `src/scripts/hook_manifest.json` and `src/scripts/hooks/host_lowering.json`
+ * are committed in THIS tree and are READ IN PREFERENCE to the YAML they were
+ * compiled from — `dispatch_hook._load_yaml` and `host_lowering.resolveTable`
+ * both serve the compiled body whenever its fingerprint matches. A diff that
+ * edits only the JSON therefore changes what every host is told about which
+ * concern runs and which slot can refuse, while the gated YAML beside it is
+ * untouched. That is the same authority change as editing the source, reached
+ * one file later, and before this step it carried no record.
+ *
+ * Two further files join for the same reason rather than by analogy:
+ *
+ *   - `src/scripts/hooks/dispatch_hook.ts` is the dispatcher itself. Every
+ *     concern's verdict passes through it, so an edit here can suppress a
+ *     refusal without touching the manifest that declares it.
+ *   - `src/scripts/_lib/kernel_rules.ts` is the list of the nine kernel rules.
+ *     THIS GATE resolves `is_kernel_rule` through it, so a diff removing a name
+ *     from that list removes a rule from this gate's own reach — the one edit
+ *     that could quietly narrow the gate while every other path kept working.
+ *
+ * Both are also denied at tool-call time, `dispatch_hook.ts` through the
+ * plumbing guard's source set and `kernel_rules.ts` through the kernel-rule
+ * write guard, so the pairing of deny-plus-record matches what the YAML sources
+ * already had.
+ *
+ * The compiled tables are REGENERATED, not hand-edited, by
+ * `./scripts-run src/scripts/compile_hook_manifest --table manifest|host-lowering`,
+ * which runs as a script rather than as an edit tool call and so is not what
+ * either mechanism refuses. A regeneration lands in the same diff as the YAML
+ * change that caused it, which already requires a record; the case this closes
+ * is the diff where only the JSON moves.
  */
 const PLUMBING_SOURCE_RE =
-    /^(?:src\/scripts\/hook_manifest\.yaml|src\/scripts\/hooks\/host_lowering\.yaml|src\/scripts\/hooks\/[a-z0-9-]+-dispatcher\.sh|src\/config\/hook-(?:token|latency)-budget\.json)$/;
+    /^(?:src\/scripts\/hook_manifest\.(?:yaml|json)|src\/scripts\/hooks\/host_lowering\.(?:yaml|json)|src\/scripts\/hooks\/dispatch_hook\.ts|src\/scripts\/_lib\/kernel_rules\.ts|src\/scripts\/hooks\/[a-z0-9-]+-dispatcher\.sh|src\/config\/hook-(?:token|latency)-budget\.json)$/;
 
 /**
  * A kernel rule, in the source tree or in any projection.

package/src/scripts/check_memory.ts

@@ -607,7 +607,13 @@ function _checkAppendOnly(base: string | null, findings: Finding[]): void {
         '--no-color',
         ref,
         '--',
-        'agents/memory/intake/',
+        // The JSONL drops, not the directory. `INTAKE_GLOB`, this module's
+        // docstring and every fixture in the suite all scope this check to
+        // `*.jsonl`; asking git for the directory made it govern the tracked
+        // skeleton too, so editing the README that documents the append-only
+        // rule was reported as a violation of it. `:(glob)` is explicit rather
+        // than relying on the default pathspec magic.
+        ':(glob)agents/memory/intake/*.jsonl',
     ]);
     if (rc !== 0) {
         findings.push(new Finding(INTAKE_GLOB, 0, 'warning', `append-only: git diff failed vs ${ref}`));

package/src/scripts/check_release_highlights.ts

@@ -79,6 +79,7 @@ import {
     CURATED_HEAD_INSTRUCTION,
     extract_changelog_section,
 } from './_lib/release_material.js';
+import { coverageLimitationNote, ledgerCoverageLabel } from './_lib/review_coverage.js';
 import { assertScanned, assertWatchlistResolves, DeadScopeError } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -339,6 +340,15 @@ export function main(argv: readonly string[]): number {
     const contradictions = highlight_contradictions(curated, derived);
     if (contradictions.length === 0) {
         process.stdout.write(`✅  curated head plausible for ${version} (span ${from}..${to})\n`);
+        // How much of the change the self-review read, printed where the head's
+        // Known-limitations field is decided. Partial coverage IS a known
+        // limitation of the record, and the ledger was the only place it was
+        // written down. A label, not a floor — the exit code above is already
+        // fixed at 0 by the time this runs, deliberately.
+        const covNote = coverageLimitationNote(ledgerCoverageLabel(REPO_ROOT, version));
+        if (covNote !== null) {
+            process.stdout.write(`${covNote}\n`);
+        }
         // Risk 2 of the roadmap that made `Known limitations` derivable, paid
         // where it lands rather than in a comment: a self-declared residual is
         // only detectable when somebody WROTE IT DOWN, so a derived `_none_`

package/src/scripts/check_release_pr_shape.ts

@@ -45,6 +45,16 @@ const ALLOWLIST_GLOBS = [
     // be able to carry the dispositions of its own self-review findings; the
     // finding-dispositions gate is red until blocking ones are recorded here.
     'agents/evidence/release-findings/*.json',
+    // Evidence-temperature census — `taskfiles/content.yml` § release-prepare
+    // writes one per release, so without this entry the pipeline generates a
+    // file its own shape step refuses. Digit classes rather than `?`: fnmatch
+    // `?` compiles to `.` under the `s` flag, so it matches any character AND
+    // crosses `/` — `????-??-??` admits `evidence-temperature-x/yz-ab-cd.md`,
+    // which `[0-9]` cannot. Two reports can appear in one release PR, and
+    // both are in shape: `--resume` re-runs release-prepare, so a release
+    // carried across UTC midnight writes a second census. What that one
+    // contains is the census's business, not this gate's.
+    'agents/evidence/analysis/evidence-temperature-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].md', // code-comment-allow provenance-comment -- the glob IS this gate's operand, not where the code came from
     // Project-settings template pin — bumped by release.ts set_template_pin and
     // its regenerated dist twin (kept in lockstep with package.json.version).
     'src/agent-src/templates/agents/agent-project-settings.example.yml',
@@ -52,16 +62,26 @@ const ALLOWLIST_GLOBS = [
 ] as const;
 
 /**
- * Translate a Python `fnmatch` shell pattern to a RegExp, mirroring
- * `fnmatch.translate`. fnmatch is case-sensitive on POSIX (fnmatchcase
- * semantics on the normalized path); `*` and `?` do NOT cross path
- * separators is NOT a property of fnmatch — `*` matches everything
- * including `/`. The allowlist relies on that (e.g. nested-file rejection
- * in the test works because none of the globs end with the file).
+ * Translate a Python `fnmatch` shell pattern to a RegExp, following
+ * `fnmatch.translate` for the constructs the allowlist actually uses: `*` and
+ * `[0-9]`. No entry uses `?`, and bracket handling beyond that one class is
+ * unverified against CPython — see the note at the bracket branch.
+ *
+ * Matching is case-sensitive, as `fnmatchcase` on a normalized path.
+ *
+ * THE PROPERTY THE WILDCARD ENTRIES TURN ON — the literal paths are unaffected:
+ * in fnmatch, `*` and `?` DO cross path separators.
+ * `*` becomes `.*` and `?` becomes `.`, both under the `s` flag, so each matches
+ * `/` like any other character. Glob syntax elsewhere (shells, .gitignore) stops
+ * `*` at a segment boundary; this does not. So the pack entry admits any depth
+ * beneath `src/packs/`, and the census entry uses digit classes precisely
+ * because they cannot match a separator. Both sides are pinned in
+ * `check_release_pr_shape.test.ts`.
  */
 function _fnmatchToRegExp(pat: string): RegExp {
-    // Mirror Python fnmatch.translate: `*` → `.*`, `?` → `.`, `[seq]` kept,
-    // everything else escaped. The full pattern is anchored with `(?s:...)\Z`.
+    // `*` → `.*`, `?` → `.`, a bracket class kept, everything else escaped.
+    // CPython does more inside a class (hyphen and set-operator escaping, `(?!)`
+    // for an empty one) and this does not — see the bracket branch below.
     let i = 0;
     const n = pat.length;
     let res = '';
@@ -87,12 +107,13 @@ function _fnmatchToRegExp(pat: string): RegExp {
                 res += '\\[';
             } else {
                 let stuff = pat.slice(i, j);
-                if (!stuff.includes('-')) {
-                    stuff = stuff.replace(/\\/g, '\\\\');
-                } else {
-                    // Rare; not used by the allowlist. Keep simple escape.
-                    stuff = stuff.replace(/\\/g, '\\\\');
-                }
+                // The two arms this replaces were byte-identical, so the branch
+                // implemented nothing. Bracket handling here is checked against
+                // `[0-9]`, the only class the allowlist uses; anything else is
+                // untested against CPython, whose behaviour also varies by
+                // version. Add a bracket glob and verify it rather than assuming
+                // this mirrors `fnmatch.translate` beyond that one case.
+                stuff = stuff.replace(/\\/g, '\\\\');
                 i = j + 1;
                 if (stuff.startsWith('!')) {
                     stuff = '^' + stuff.slice(1);
@@ -105,7 +126,9 @@ function _fnmatchToRegExp(pat: string): RegExp {
             res += c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         }
     }
-    // Python uses `(?s:%s)\Z` — dotAll + full match.
+    // Full match with dotAll. Python spells the same thing `(?s:%s)\Z`; in JS
+    // `$` without the `m` flag does not match before a trailing newline, so
+    // `^(?:…)$` is equivalent rather than merely similar.
     return new RegExp(`^(?:${res})$`, 's');
 }
 

package/src/scripts/check_standing_rule_delivery.ts

@@ -31,24 +31,44 @@
  * Exit codes: `0` under cap · `1` over cap or an unstated cap raise · `2` usage
  * error · `3` dead scan scope.
  *
- * ## This is deliberately NOT a CI gate
+ * THIS IS DELIBERATELY NOT A CI GATE, AND THE REASON IS NARROWER THAN IT WAS.
  *
- * Both inputs are machine-local by construction. `.claude/rules/` is gitignored
- * (`.gitignore:123` — it is generated by `task sync` / `task generate-tools`),
- * and no CI workflow performs a user-scope install, so on a fresh runner
- * **neither** layer exists. Wired into `ci` it would either red on a dead scope
- * or, with the empty case allowed, sit permanently green while certifying a
- * property it cannot observe — the exact failure `src/config/gate-coverage.yml`
- * was written to end. It is therefore registered as a local / doctor-surface
- * check and is absent from `gate-coverage.yml`, whose contract is CI-identical
- * invocation.
+ * **Corrected 2026-10-05 (step 0.1 of
+ * `road-to-a-rule-carrier-that-works-outside-the-repo`).** This section used to
+ * say "no CI workflow performs a user-scope install, so on a fresh runner
+ * **neither** layer exists", and then concluded that making the measurement
+ * CI-observable "needs the `InstructionsLoaded` record committed from a real
+ * session, which is a different piece of work". The first clause describes a
+ * workflow inventory; the second turns it into a capability claim, and that
+ * step does not hold. A runner CAN stage a user-scope install: the installer
+ * reads `HOME` from the environment, and
+ * `tests/install/global_install_hooks_smoke.test.ts` already drives
+ * `src/scripts/install --global --tools=claude-code` against a `mkdtemp` HOME
+ * and asserts the tree it produced. Nothing about the `InstructionsLoaded`
+ * event is required to observe the FILESYSTEM half, which is what this script's
+ * `filesystem` input reads.
  *
- * What that costs, stated plainly: the duplicate-delivery defect is not
+ * What stays true, and is the real reason this is not in `gate-coverage.yml`:
+ * **this gate measures THIS machine**, by design. `main()` resolves
+ * `os.homedir()` and `REPO_ROOT`, and the question it answers — "how much is
+ * the developer in front of me actually loading" — is about a machine, not
+ * about a commit. A CI run of it would measure the runner, which is a tree
+ * nobody works in, so the number would be real and uninteresting. The
+ * `measureStandingDelivery` function underneath takes both directories as
+ * PARAMETERS and is therefore already temp-HOME-capable; what is missing is a
+ * reason to point it at a runner, not a way to.
+ *
+ * The honest cost is unchanged: the duplicate-delivery defect is not
  * mechanically caught for anyone who never runs this locally. The enforced layer
  * is the installer gate (`install.ts::_gate_rule_layer_overlap`), which refuses
  * to CREATE the doubled state; this script measures a state that already exists.
- * Making the measurement CI-observable needs the `InstructionsLoaded` record
- * committed from a real session, which is a different piece of work.
+ *
+ * `_lib/installed_layer.ts` is the step-0.1 library that takes the same reading
+ * per host rule directory with every input as a parameter, and
+ * `installed_layer_report.ts` is its report. The two measure different things —
+ * that one counts characters after the frontmatter and block-comment strip,
+ * this one counts tokens over whole files against a cap — and neither number
+ * converts into the other.
  */
 
 import * as fs from 'node:fs';