@event4u/agent-config 16.2.0 → 16.4.0

package/dist/agent-src/rules/context-hygiene.md

@@ -16,17 +16,16 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "hook:context-hygiene"
-# obligation: line 67
 obligation_frequency: "per-turn"
 ---
 
 # Context Hygiene
 
-> **Enforced by:** [`scripts/context_hygiene_hook.ts`](../../scripts/context_hygiene_hook.ts)
+> **Enforced by:** `src/scripts/context_hygiene_hook.ts`
 > on Augment + Claude Code (`PostToolUse`). Run `agent-config hooks:status` to
 > see whether that slot is actually bound on the host you are on — this line is
 > a statement about the manifest, not about your install. The hook maintains
-> `agents/state/context-hygiene.json` (tool-call count, loop signal,
+> `agents/state/context-hygiene.json` (tool-call count,
 > freshness milestones at 20/40/60); the prose below is the spec the
 > hook implements and the agent-side fallback.
 >
@@ -53,9 +52,10 @@ topic · branch changed since start · ~24 hours passed.
 
 ## The 3-Failure Rule
 
-When **3 consecutive attempts** at the same task fail (code fix, test fix, config change, etc.):
+Counts **strategies**, not attempts. 3 fail at the same task (code fix,
+test fix, config change, etc.):
 
-1. **STOP** — do not attempt a 4th fix.
+1. A 4th strategy is wrong — reassess.
 2. **State dump** — summarize what was tried, what failed, and what you know so far.
 3. **Recommend fresh start** — suggest a fresh session with the state dump as context, or ask for a different approach.
 
@@ -66,7 +66,7 @@ When **3 consecutive attempts** at the same task fail (code fix, test fix, confi
 - **Same failure signature twice → stop and pivot now.** Don't burn the third attempt on a near-identical retry of a fix that already failed the same way — a repeated identical signature means the hypothesis is wrong, not under-applied. Change strategy (re-read source, new hypothesis, ask).
 - **New error signature each attempt = progress.** Peeling one error to reveal a different one is forward motion; counter continues — learning, not looping.
 
-**Hard-blocker classes — skip retries, go straight to ask/surface.** On the **first** occurrence, do not count toward the 3 — stop and surface: missing credentials / unset secret · permission denied · spend / quota / rate limit reached · external-service 5xx / outage. Retrying a hard-blocker is the canonical wasted attempt; the fix is a decision or external change only the user/environment can make.
+**Hard-blocker classes — skip retries, go straight to ask/surface.** On the **first** occurrence, do not count toward the 3 — halt and surface: missing credentials / unset secret · permission denied · spend / quota / rate limit reached · external-service 5xx / outage. Retrying a hard-blocker is the canonical wasted attempt; the fix is a decision or external change only the user/environment can make.
 
 ## Tool Loop Detection
 

package/dist/agent-src/rules/copilot-routing.md

@@ -10,7 +10,6 @@ routes_to:
   - "skill:copilot-config"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 19
 obligation_frequency: "none"
 ---
 
@@ -18,5 +17,5 @@ obligation_frequency: "none"
 
 **Iron Law.** Tuning the GitHub Copilot AI assistant itself (instructions, PR-review patterns, suggestion behavior) → load the `copilot-config` skill, not `devcontainer` (which covers the dev environment Copilot runs inside).
 
-Body migrated to `skill:copilot-config`. Disambiguates the copilot-config ↔ devcontainer cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
+Body migrated to `skill:copilot-config`. Disambiguates the copilot-config ↔ devcontainer cluster head per `docs/contracts/adr-architectural-consensus-mechanism.md`.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/council-availability.md

@@ -14,7 +14,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "instruction-only: no gate reads a chat claim about availability; check_council_config_location covers the tree side only"
-# obligation: line 27
 obligation_frequency: "per-task"
 ---
 
@@ -68,9 +67,10 @@ the user-global config into the repo to "make it work".
 
 ## If the probe really says unavailable
 
-State the resolver's own message and stop. A subagent fan-out is a legitimate
-substitute **only when named as such** — never as "the council". Same honesty
-boundary as [`evaluator-independence`](evaluator-independence.md).
+State the resolver's message and stop. A fan-out substitutes **only when named
+as such**, never as "the council"
+([`evaluator-independence`](evaluator-independence.md)), nor in a
+modification review (ADR-281).
 
 ## When NOT to fire
 

package/dist/agent-src/rules/cross-source-consistency.md

@@ -26,7 +26,6 @@ packs: [engineering-base, product-basic]
 collision_ok:
   "mockup": "a mockup is a second source — discrepancy check against the ticket text"
   "screenshot": "a screenshot is a second source — discrepancy check"
-# obligation: line 71
 obligation_frequency: "per-task"
 ---
 
@@ -59,11 +58,10 @@ OBVIOUS-TO-THE-AGENT ≠ IN-SCOPE.
 
 **Fires** while planning, refining, estimating, roadmapping, or implementing from
 a ticket/spec that carries a second source (an attachment, a code reality, or an
-internal contradiction), gated by `consistency.cross_source` in
-`.agent-settings.yml` (`on` default · `auto` = high-confidence only · `off` = inert).
-That file is the project layer of a cascade that starts user-global — never read
-the setting or its absence from it alone; `agent-config settings:get
-consistency.cross_source` reports the value and the file it came from.
+internal contradiction). It is always on: the `consistency.cross_source` key that
+offered `auto` (high-confidence only) and `off` was retired on 2026-10-09 with its
+default, `on`, as the fixed behavior. The noise control is the batching and the
+`no-cheap-questions` floor below, not a setting.
 
 **Does NOT fire** on a single clear source with no second source to compare
 against (that is plain vagueness — it belongs to `ask-when-uncertain`), on

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -1,9 +1,12 @@
 ---
 type: "auto"
 tier: "2b"
+consequence_class: "authority-bypass"
 description: "Beneficial change blocked by a lock (honest-null, don't-relitigate memory, budget canon, ADR) — surface a council re-evaluation offer, never drop"
 alwaysApply: false
 council_depth: deep
+load_context:
+  - ../contexts/authority/decision-revisit-gate-enforcement.md
 triggers:
   - keyword: "don't relitigate"
   - keyword: "honest null"
@@ -22,7 +25,6 @@ workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 collision_ok:
   "honest null": "this rule asks whether a recorded null may be REVISITED; evaluator-independence asks how one was PRODUCED — different decision points on the same artefact"
-# obligation: line 31
 enforced_by:
   - "instruction-only: no gate can observe an agent citing a decision it never opened; adr_cite_check is deterministic where it runs and nothing makes it run"
 obligation_frequency: "per-task"
@@ -51,11 +53,10 @@ what the package may ever become.
 **The default venue is the council, and this is a correction, not a new
 policy.** [`ai-council`](../skills/ai-council/SKILL.md)'s Iron Law already sends
 a decision the agent cannot settle from the tree to the council first, and its
-class table lists "reopening a recorded decision". The old "offers the user a
-path" wording made every lock an owner interrupt; measured across 26 days of
-transcripts, the agent reported a lock and waited while the owner voided the
-decision retroactively — twice with the lock report timestamped **before** the
-override demand. The ordering was the defect; the permission was never missing.
+class table lists "reopening a recorded decision". The measurement behind that
+correction, and why the five steps below are inlined rather than only routed, are
+in
+`contexts/authority/decision-revisit-gate-enforcement.md`.
 
 **Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
 tested*, not every future proposal that resembles it — if the blocked change
@@ -79,16 +80,9 @@ distinction.
 4. **Route it** — council by default (below), user only for the reserved set.
 5. **Record** the outcome with scope and `revisit-if`.
 
-The five are stated here, not only behind a route, because the route was
-measurably unreachable: `decision-review` ships `install.default: false` in the
-non-default `analysis-workbench` pack, so a pack-legal install received the
-obligation and not the procedure. `routes_to` now names two always-on skills;
-the backward-audit depth in
-[`decision-review`](../skills/decision-review/SKILL.md) stays optional.
-
 Full catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs,
 hard structural caps), the per-step detail, when-NOT-to-fire and the failure
-modes remain in [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md).
+modes remain in `skill:decision-review` § Decision-revisit gate — mechanics.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## Reading a lock — the two descriptive axes
@@ -101,7 +95,7 @@ read 6 is the agent's, because reversibility belongs to the proposed transition
 and no tool reading one record supplies it. What each field means, and what a
 `[found]` basis ref does NOT claim, is in that script's module docstring. The
 evidence-priced burden table stays in
-[`adr-layout § The reopen record`](../docs/contracts/adr-layout.md).
+`docs/contracts/adr-layout.md` § The reopen record.
 
 ```
 A GRADE IS A MEASUREMENT, NOT A PERMISSION — IT GRANTS NOTHING.
@@ -157,14 +151,14 @@ Field on the ADR: `reopen_policy: directional | owner | unclassified`, absent
 permitted; only execution of a reserved transition is gated. Absent is
 deliberately not `owner`: with 146 accepted ADRs that default would encode
 today's blockage into the new schema. Full contract, the reopen record and the
-precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../docs/contracts/adr-layout.md).
+precedent-creates-no-authority clause: `docs/contracts/adr-layout.md` § Reopen authority.
 
 ## See also
 
 - [`recurring-criticism`](recurring-criticism.md) — the **other entrance**: this
   rule fires when a lock blocks a change, that one when the same criticism arrives
   again. It reuses the five steps and the owner-reserved table above.
-- [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
+- `decision-review` — the backward-audit
   procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
@@ -180,21 +174,9 @@ precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../doc
 
 ## Honest enforcement — `instruction-only`
 
-`adr_cite_check` is deterministic where it runs, and nothing makes it run. No
-gate can observe an agent citing a decision it never opened, so step 2 above is
-model-carried — the same honesty boundary
-[`security-sensitive-stop`](security-sensitive-stop.md) and
-[`active-remediation`](active-remediation.md) state for their own obligations.
-
-Two reach limits, named rather than implied. The tool lives in this repository's
-`src/scripts/` and is **not** exposed as an `agent-config` verb, so a consumer
-install performs step 2 by hand; wiring the verb touches six further surfaces
-plus the curated `dist/agent-src/scripts/` list and is deliberately out of this
-change. And `docs/decisions/` is projected into no agent-visible tree at all —
-the agent sees ADR *numbers* cited across rules and skills, almost never ADR
-*text*. Until that changes, "evaluate before citing" means opening the file.
-
-`docs/contracts/` is unprojected on the same terms (`dist/agent-src/` carries no
-`docs/`), so the burden table this rule points at is maintainer-reachable only.
-That is why the reserved-set table above stays here rather than becoming a
-pointer: a consumer install receives these lines and not the contract.
+Step 2 is model-carried: no gate can observe an agent citing a decision it
+never opened. Why that is so, which two reach limits the tool has in a
+consumer install, and why `docs/decisions/` is projected into no
+agent-visible tree are recorded in
+`contexts/authority/decision-revisit-gate-enforcement.md`,
+named in `load_context` above.

package/dist/agent-src/rules/delegation-policy.md

@@ -20,7 +20,6 @@ routes_to:
   - "skill:subagent-orchestration"
 workspaces: [engineering]
 packs: [engineering-base]
-# obligation: line 35
 obligation_frequency: "per-task"
 ---
 
@@ -69,7 +68,7 @@ primitive → run in-session (clean no-op).
    `subagents.model_ceiling` caps the tier and the slice does not fit, the worker
    **escalates and never silently delivers the degraded result**; the
    orchestrator never raises the ceiling itself, and absent is *uncapped*.
-   [`subagent-boundary § The model ceiling`](../docs/contracts/subagent-boundary.md).
+   `docs/contracts/subagent-boundary.md` § The model ceiling.
 3. **Dispatch** via the form gate + matching `subagent-orchestration` mode
    (independent → do-in-parallel; ordered → do-in-steps; risk/correctness →
    + judge; UI-heavy → live-app judge, efficacy-gated).
@@ -116,6 +115,6 @@ on hosts without hook slots. Per-carrier detail and what each one verifies:
 ## See also
 
 - [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md) — the form gate + 9 modes this selects.
-- [`subagent-boundary`](../docs/contracts/subagent-boundary.md) — what a subagent owns vs never owns (task-meaning, memory, pack-surface, safety-floor bypass).
+- `docs/contracts/subagent-boundary.md` — what a subagent owns vs never owns (task-meaning, memory, pack-surface, safety-floor bypass).
 - [`auto-orchestration-activation`](../contexts/execution/auto-orchestration-activation.md) — the gate.
 - [`reasoning-orchestrator`](../skills/reasoning-orchestrator/SKILL.md) — RDP dispatch, now gated here.

package/dist/agent-src/rules/design-fidelity.md

@@ -2,6 +2,8 @@
 type: "auto"
 tier: "2a"
 description: "A provided prototype/mockup/design system is the spec — build 1:1; never swap fonts, controls, or layout unconfirmed"
+load_context:
+  - ../contexts/communication/rules-auto/design-fidelity-enforcement.md
 triggers:
   - keyword: "prototype"
   - keyword: "mockup"
@@ -39,7 +41,6 @@ collision_ok:
   "mockup": "a provided mockup is the spec — 1:1 fidelity floor"
 enforced_by:
   - "instruction-only: no artifact in this tree records a fidelity comparison. lint_design_slop and lint_design_quality measure generic AI-aesthetic tells and accessibility; neither reads the handover, so a 1:1 claim is model-carried"
-# obligation: line 58
 obligation_frequency: "per-edit"
 ---
 
@@ -106,7 +107,7 @@ REPRODUCING A WIREFRAME'S GREYS 1:1 HONOURS THE WRONG HALF OF THE ARTEFACT.
 ```
 
 `strict` means *do not redesign*; never *reproduce a wireframe's placeholder grays*, which
-are **non-decisions** ([`wireframe`](../skills/wireframe/SKILL.md) § Gotchas).
+are **non-decisions** (`wireframe` § Gotchas).
 **The discriminator reads the ARTEFACT, never the prose.** A finished comp whose prose
 mentions a wireframe it replaces routes **strictly** — a reference to a previous artefact,
 not a declaration about this one. **When the artefact does not declare its maturity,
@@ -155,26 +156,21 @@ a third-party builder's share link, need one word in the prompt — the
 builder-URL trigger was tried and **withdrawn** as over-broad, and stays pinned
 silent rather than merely absent.
 
-Every class carries its own near-miss row in `ROUTING_MATRIX`
-([`design_fidelity_routing.test.ts`](../../tests/scripts/design_fidelity_routing.test.ts)),
-and the row must test the direction the NEW trigger opens, not one that was
-already closed — apply that before writing a trigger, not after. Why each class
-is shaped as it is, why `*.html` and a bare builder host are refused, and the
-worked example behind the direction rule:
-[`design-fidelity-routing`](../guidelines/design-fidelity-routing.md).
+Each class carries a near-miss row in the routing matrix, and a new trigger's
+row must test the direction that trigger opens. The matrix, the reasons behind
+each class, and the worked example are in
+`design-fidelity-enforcement`.
 
 Body migrated to [`guideline:design-fidelity-mechanics`](../guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — URL / live-page handover (extraction into the `design-system.json` contract before the first UI write, the retrieval order, the lock boundary), surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## Honest enforcement — `instruction-only`
 
-Nothing records a fidelity comparison. The estate's two design linters measure
-generic AI-aesthetic tells (`lint_design_slop`) and accessibility
-(`lint_design_quality`); neither opens the handover, so nothing can tell a
-proven 1:1 from an asserted one. The proof clause in the Iron Law is therefore
-model-carried, and the committed matrix
-([`design-review`](../skills/design-review/SKILL.md) § Fidelity proof) is the
-control — a reviewer can open it, which is more than any gate here does.
+Nothing records a fidelity comparison, so the proof clause in the Iron Law is
+model-carried and the committed matrix is the control. Which two linters exist,
+what each measures and why neither can tell a proven 1:1 from an asserted one:
+`design-fidelity-enforcement`,
+named in `load_context` above.
 
 ## See also
 

package/dist/agent-src/rules/design-review-after-ui-write.md

@@ -45,7 +45,6 @@ collision_ok:
   "*.tsx": "one component file, two obligations: inventory before the write, review after it"
   "*.jsx": "one component file, two obligations: inventory before the write, review after it"
   "*.blade.php": "one template file, two obligations: inventory before the write, review after it"
-# obligation: line 39
 obligation_frequency: "per-edit"
 ---
 
@@ -74,7 +73,8 @@ STATICALLY CHECKED AND SAY SO. NEVER "LOOKS GOOD" WITH NOTHING BEHIND IT.
 The verdict is gated on evidence, not on having run a skill:
 
 - **Render capability present** (Playwright MCP, Chrome DevTools, or a live
-  preview URL) → the [design-artifact verification checklist](../docs/contracts/design-artifact-verification.md#verification-checklist)
+  preview URL) → the design-artifact verification checklist
+  (`docs/contracts/design-artifact-verification.md` § Verification checklist)
   steps 1–5. A UI task does not pass without render evidence.
 - **Render capability absent** → the verdict is **scoped to the static checks
   that actually ran** and says which those were. This is not a downgrade to be
@@ -136,7 +136,7 @@ three `platforms:` rows that carry a `pre_tool_use` key — augment, claude,
 cowork (**clarified 2026-08-17**: "hosts carrying a slot" read as a host
 property and is a manifest one; three further hosts alias a native pre-tool
 event with no binding, and only claude honours a deny — see
-[`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md)).
+`docs/contracts/hook-architecture-v1.md` § Which hosts carry pre_tool_use).
 The verdict is unchanged either way: a nudge that can be ignored is not
 enforcement, so `enforced_by:` stays `none` — it moves the day a mechanism can
 refuse, not the day a reminder appears. `agent-config hooks:status` answers

package/dist/agent-src/rules/devcontainer-routing.md

@@ -11,7 +11,6 @@ routes_to:
   - "skill:devcontainer"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 20
 obligation_frequency: "none"
 ---
 
@@ -19,5 +18,5 @@ obligation_frequency: "none"
 
 **Iron Law.** Wiring the dev environment itself (DevContainers, Codespaces, `devcontainer.json`, VS Code features) → load the `devcontainer` skill, not `copilot-config` (which tunes the Copilot AI on top).
 
-Body migrated to `skill:devcontainer`. Disambiguates the devcontainer ↔ copilot-config cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
+Body migrated to `skill:devcontainer`. Disambiguates the devcontainer ↔ copilot-config cluster head per `docs/contracts/adr-architectural-consensus-mechanism.md`.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/doc-screenshot-hygiene.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "irreversible-external"
 description: "Doc screenshots — anonymize sensitive data before shipping; data-bearing shots human-gated (published egress); terminal/CLI/IDE shots forbidden"
 triggers:
   - keyword: "screenshot"
@@ -27,7 +28,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 collision_ok:
   "screenshot": "a screenshot shipping into docs is the PII/anonymization gate"
-# obligation: line 49
 obligation_frequency: "per-event"
 ---
 

package/dist/agent-src/rules/docker-commands.md

@@ -15,7 +15,6 @@ collision_ok:
   "artisan": "artisan runs inside the project container, never on the host"
   "composer": "composer runs inside the project container"
   "docker": "its own core subject"
-# obligation: line 22
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/domain-adoption-policy.md

@@ -18,7 +18,6 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 collision_ok:
   "src/skills/": "a skill in a fresh vertical is exactly the domain-gate surface"
-# obligation: line 38
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/domain-safety-disclaimer.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "authority-bypass"
 description: "Advisory content (legal, medical, financial, consulting) — matching 'not X advice' disclaimer; refuse diagnosis/dosage"
 triggers:
   - keyword: "legal brief"
@@ -42,7 +43,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 collision_ok:
   "review this contract": "contract review is advisory-shaped — the not-legal-advice footer floor"
-# obligation: line 52
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/domain-safety-pii.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "security-boundary"
 description: "Drafts/logs/exports with real customer/candidate data — redact direct IDs, placeholders, flag quasi-ID re-identification"
 triggers:
   - keyword: "support macro"
@@ -42,7 +43,6 @@ applies_to_user_types:
   - "all"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
-# obligation: line 52
 obligation_frequency: "per-task"
 evidence:
   source_type: external-standard

package/dist/agent-src/rules/domain-safety-retention.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "irreversible-external"
 description: "Data retention — jurisdiction gap, longest floor, honor DSR/audit holds; never delete under inquiry"
 triggers:
   - keyword: "retention policy"
@@ -27,7 +28,6 @@ applies_to_user_types:
   - "gtm"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
-# obligation: line 47
 obligation_frequency: "per-turn"
 evidence:
   source_type: external-standard

package/dist/agent-src/rules/downstream-changes.md

@@ -11,7 +11,6 @@ triggers:
 self_contained: true
 workspaces: [engineering]
 packs: [engineering-base]
-# obligation: line 30
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/engineering-safety-floor.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "irreversible-external"
 description: "Production/infra/security/external-system output — blast radius + rollback; Hard-Floor never autonomous"
 triggers:
   - keyword: "production"
@@ -28,7 +29,6 @@ workspaces: [engineering]
 packs: [engineering-base]
 collision_ok:
   "migration": "a prod migration is a hard-floor evidence surface (rollback path, blast radius)"
-# obligation: line 49
 obligation_frequency: "per-commit"
 evidence:
   source_type: own-analysis

package/dist/agent-src/rules/evaluator-independence.md

@@ -6,6 +6,7 @@ norm:
   tokens: 1500
   remainder:
     - "../docs/guidelines/agent-infra/evaluator-independence-mechanics.md"
+consequence_class: "authority-bypass"
 description: "Commissioning a review/judge/blind-pass on your own work — never author the verdict, never narrow the scope, record the prompt with the result"
 triggers:
   - keyword: "blind review"
@@ -121,11 +122,11 @@ ITEM 1 IS ENFORCED. ITEMS 2, 3 AND 4 ARE NOT — 4 ONLY WARNS.
 NEVER CITE A GUARD THAT WARNS AS ONE THAT BLOCKS.
 ```
 
-[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts), a
+`src/scripts/hooks/evidence_independence.ts`, a
 `pre_tool_use` concern, BLOCKS item 1 on the one host that honours a deny and
 only WARNS on item 4. Item 2 is enforced by nothing — a narrowed scope is not
 decidable from a prompt. Item 3 is enforced by
-[`check_review_prompt_binding.ts`](../../src/scripts/check_review_prompt_binding.ts),
+`src/scripts/check_review_prompt_binding.ts`,
 where **omission beats substitution**: not committing the prompt package drops
 the round out of the checkable set with no finding.
 

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -17,7 +17,6 @@ applies_to_user_types:
 self_contained: true
 workspaces: [engineering]
 packs: [meta]
-# obligation: line 37
 obligation_frequency: "per-turn"
 ---
 

package/dist/agent-src/rules/external-reference-deep-dive.md

@@ -10,7 +10,6 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 20
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/fast-path-marker-visibility.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "1"
+consequence_class: "authority-bypass"
 description: "Low-impact council fast-path — surface the transparency marker verbatim as the reply opener"
 triggers:
   - keyword: "low-impact council"
@@ -14,7 +15,6 @@ validator_ignore:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 30
 obligation_frequency: "per-turn"
 ---
 
@@ -80,6 +80,6 @@ this rule does not constrain their output.
 
 ## See also
 
-- [`ai-council-config § Low-impact council opt-in`](../docs/contracts/ai-council-config.md#low-impact-council-opt-in)
+- `docs/contracts/ai-council-config.md` § Low-impact council opt-in
 - [`direct-answers`](direct-answers.md) — invented-facts Iron Law (provenance kin).
 - `scripts/ai_council/low_impact.ts` — marker source.

package/dist/agent-src/rules/finance-safety-floor.md

@@ -1,6 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
+consequence_class: "authority-bypass"
 description: "Finance-pack output (runway, valuation, DCF, scenarios, unit economics) — never a final invest/raise call; disclosure footer"
 triggers:
   - keyword: "runway"
@@ -33,7 +34,6 @@ packs: [finance-basic, finance-advanced]
 trust:
   level: advisory
   human_review_required: true
-# obligation: line 53
 obligation_frequency: "per-task"
 ---
 <!-- agent-config:human-review-banner -->

package/dist/agent-src/rules/fix-what-you-see.md

@@ -74,43 +74,17 @@ asks; the ask becomes the work, not the exit.
 **Does NOT fire:** user fenced the scope this turn · no falsifiable break (a
 preference, not a red) · already decided by the user.
 
-## Why separate from `active-remediation`
+## Why a separate rule, and its activation gap
 
-That rule forbids ignoring a spotted issue and its ladder permits **note + ask**.
-Two properties made it insufficient, both measured 2026-08-20: it is `type: auto`
-on `refactor`/`legacy`/`cleanup` triggers — **none of which a failing CI job
-matches**, so it does not load when the obligation matters most — and its
-note-and-ask tier is what let a session name a red check's cause, name the
-file's author, and hand it back still red.
-
-Mechanics (fix-now size criteria, follow-up shape) stay there; this rule only
-deletes the two escapes.
-
-## Honest activation gap — this rule is `auto`, and it wanted to be `always`
-
-It shipped `auto` for a budget reason, not a design one, and the gap that leaves
-is exactly the one it was written to close: **a red check the agent sees in tool
-output triggers nothing.** Keyword triggers match the PROMPT. So the rule loads
-when a human says "CI is red" or "not my test", and does NOT load when a test
-run comes back red and nobody has said a word.
-
-`check_always_budget` is the reason: the extended always-budget sat at
-60,252 / 60,254 chars — **two characters of headroom** — and the cap is a
-ratchet that may only move down. The other nine always-rules are the kernel,
-which `block_kernel_rule_writes` denies agent writes to, so no room can be made
-from this side. A 2,332-char rule puts the total at 103.9 %.
-
-Closing the gap needs one of: the ext-cap ratchet opened deliberately (a
-maintainer decision, recorded), a kernel rule shortened to make room, or a
-`post_tool_use` carrier that notices a non-zero verification exit — the only
-option that would fire on tool output rather than on wording. Until then, `auto`
-plus this paragraph is the honest state: the obligation is real, its delivery is
-partial, and the partiality is named rather than implied away.
+Why `active-remediation` alone was insufficient, and why this rule ships `auto`
+although it wanted `always` — so a red check seen only in tool output triggers
+nothing — are in
+`guideline:agent-infra/active-remediation-mechanics` § fix-what-you-see.
 
 ## Honest enforcement — `instruction-only`
 
 Nothing observes a disposition. "I fixed it", "I landed a roadmap for it" and
 "I named the author and moved on" are the same prose to every gate in this tree,
 and the issue set is whatever the agent happened to see. So the two dispositions
-above are model-carried, and the activation gap named in the previous section
+above are model-carried, and the activation gap named above
 sits on top of that rather than beside it.

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -43,7 +43,6 @@ collision_ok:
   "formrequest": "FormRequest named in a generic artifact is leakage — the lint surface"
   "phpstan": "phpstan named in a generic artifact is leakage — the lint surface"
   "rector": "rector named in a generic artifact is leakage — the lint surface"
-# obligation: line 65
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/git-history-discipline.md

@@ -2,6 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
+consequence_class: "irreversible-external"
 description: "Git history — no unasked rebase/squash/amend; never drop foreign commits; pushed rewrite → re-push same turn"
 triggers:
   - keyword: "git rebase"
@@ -23,7 +24,6 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "hook:block-no-verify"
-# obligation: line 35
 obligation_frequency: "per-commit"
 ---
 
@@ -86,6 +86,6 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`skill:git-workflow`](../skills/git-workflow/SKILL.md) — Safe Squash-After-Push protocol and Divergent-State Recovery decision tree.
 - `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**. It is *bound* on augment and cowork too, and ignored there. Everywhere else the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. To check the host you are on rather than trusting this sentence, run `agent-config hooks:status`.
 
-  **Corrected 2026-08-17, in both directions, because this line was wrong on each side.** It read "the guard has nowhere to bind" on cursor, cline, windsurf, gemini and copilot — refuted for three of the five by the manifest's own `native_event_aliases` table, which already maps `preToolUse`, `PreToolUse` and `BeforeTool` onto `pre_tool_use`: there the guard is **unbound, not unbindable**, and only windsurf and copilot carry no pre-tool alias row here. And it certified augment, claude and cowork as the enforcing set — `host_semantics.ts` verifies **claude alone**, while the augment and cowork trampolines discard dispatcher output and `exit 0` unconditionally, so a guard bound there runs and is then ignored. Both halves are the same failure: a host-capability claim this tree never established. The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md).
+  **Corrected 2026-08-17, in both directions, because this line was wrong on each side.** It read "the guard has nowhere to bind" on cursor, cline, windsurf, gemini and copilot — refuted for three of the five by the manifest's own `native_event_aliases` table, which already maps `preToolUse`, `PreToolUse` and `BeforeTool` onto `pre_tool_use`: there the guard is **unbound, not unbindable**, and only windsurf and copilot carry no pre-tool alias row here. And it certified augment, claude and cowork as the enforcing set — `host_semantics.ts` verifies **claude alone**, while the augment and cowork trampolines discard dispatcher output and `exit 0` unconditionally, so a guard bound there runs and is then ignored. Both halves are the same failure: a host-capability claim this tree never established. The four states are tabulated once in `docs/contracts/hook-architecture-v1.md` § Which hosts carry pre_tool_use.
 
   The frequency join in `check_enforcement_coverage.ts` reports this obligation uncovered on **four** platforms — cursor, cline, windsurf, gemini. It skips `fallback_only` platforms before computing, so copilot never appears in its output and must not be quoted as if it did; copilot is uncovered because this package binds nothing there.