@event4u/agent-config 16.2.0 → 16.4.0

package/dist/agent-src/scripts/gate_budget.ts

@@ -56,9 +56,16 @@ export function gateBudgetLedgerPath(workspaceRoot: string): string {
 }
 
 /** The two caps decided by option (a). Both are USD. */
+/**
+ * The two standing caps, each independently settable.
+ *
+ * Both figures are **US dollars**. Either may be `null`, meaning that cap was
+ * not set and therefore bounds nothing; `readGateBudgetCaps` returns `null`
+ * for the whole object only when NEITHER was set.
+ */
 export interface GateBudgetCaps {
-    maxCostPerRunUsd: number;
-    maxCostPerRolling7dUsd: number;
+    maxCostPerRunUsd: number | null;
+    maxCostPerRolling7dUsd: number | null;
 }
 
 /**
@@ -105,18 +112,26 @@ function _dig(settings: unknown, keys: readonly string[]): unknown {
 /**
  * Read the caps out of an already-merged settings dict.
  *
- * Returns `null` when either cap is absent or non-numeric — deliberately NOT a
- * fallback to the template numbers. An install whose settings do not carry the
- * caps has not authorised a standing budget, and inventing one from the
- * template default would authorise spend nobody configured. The caller renders
- * the consent line instead.
+ * Each cap is returned on its own. Returns `null` only when NEITHER is set,
+ * which means no ceiling on money was configured — not that the run is
+ * unauthorised. Still deliberately NOT a fallback to the template numbers:
+ * inventing a cap from a template default would bound a run by a figure
+ * nobody chose.
+ *
+ * Until 2026-10-06 this returned `null` unless BOTH caps were numeric, with
+ * two consequences. A person who set one cap and left the other alone was
+ * bounded by NEITHER — the stricter-looking rule produced the laxer result.
+ * And absent caps were read by the caller as a refusal, so the gate would not
+ * run at all without them. ADR-279 supersedes that second reading: absence of
+ * a bound is not a bound, and `--confirm` remains the authorisation the caps
+ * only ever sized.
  */
 export function readGateBudgetCaps(settings: unknown): GateBudgetCaps | null {
     const perRun = _num(_dig(settings, ['roadmap', 'gate_budget', 'max_cost_per_run_usd']));
     const rolling = _num(
         _dig(settings, ['roadmap', 'gate_budget', 'max_cost_per_rolling_7d_usd']),
     );
-    if (perRun === null || rolling === null) {
+    if (perRun === null && rolling === null) {
         return null;
     }
     return { maxCostPerRunUsd: perRun, maxCostPerRolling7dUsd: rolling };
@@ -216,13 +231,15 @@ export function rollingSpendUsd(records: readonly GateBudgetReceipt[], now: Date
 }
 
 export type GateBudgetRefusal =
-    | 'no_caps'
+    // 'no_caps' was removed on 2026-10-06 with ADR-279: the absence of a cap
+    // is no longer a refusal, so no path can produce it and leaving it in the
+    // union would advertise a verdict nothing returns.
     | 'no_estimate'
     | 'over_per_run'
     | 'over_rolling_7d';
 
 export type GateBudgetVerdict =
-    | { ok: true; estimateUsd: number; rollingUsd: number }
+    | { ok: true; estimateUsd: number | null; rollingUsd: number }
     | { ok: false; reason: GateBudgetRefusal; detail: string };
 
 /**
@@ -230,6 +247,12 @@ export type GateBudgetVerdict =
  *
  * Every refusal path renders rather than runs — the blocker's own prescription
  * for a missing ledger, generalised to every way the budget can say no.
+ *
+ * What is NOT a refusal, per ADR-279: the absence of a cap. With no cap
+ * configured there is no ceiling on money to compare anything against, so the
+ * verdict is `ok` and the run proceeds on the authorisation `--confirm`
+ * already carries. A cap that WAS set still bounds exactly as its contract
+ * describes, and each bounds alone.
  */
 export function evaluateGateBudget(opts: {
     caps: GateBudgetCaps | null;
@@ -238,16 +261,17 @@ export function evaluateGateBudget(opts: {
     now: Date;
 }): GateBudgetVerdict {
     const { caps, records, estimateUsd, now } = opts;
-    if (caps === null) {
-        return {
-            ok: false,
-            reason: 'no_caps',
-            detail:
-                'no standing class-1 budget is configured ' +
-                '(`roadmap.gate_budget.max_cost_per_run_usd` and ' +
-                '`roadmap.gate_budget.max_cost_per_rolling_7d_usd`)',
-        };
+    const perRunCap = caps === null ? null : caps.maxCostPerRunUsd;
+    const rollingCap = caps === null ? null : caps.maxCostPerRolling7dUsd;
+    // No ceiling on money was set anywhere, so nothing here can say no.
+    // `rollingUsd` is still computed and reported — recording spend never
+    // depended on bounding it.
+    if (perRunCap === null && rollingCap === null) {
+        return { ok: true, estimateUsd, rollingUsd: rollingSpendUsd(records, now) };
     }
+    // A missing estimate refuses only because a cap exists that nothing can be
+    // compared against. With no cap there is no comparison to fail, which is
+    // why this sits BELOW the no-cap branch rather than above it.
     if (estimateUsd === null) {
         return {
             ok: false,
@@ -257,17 +281,17 @@ export function evaluateGateBudget(opts: {
                 'can be compared against it',
         };
     }
-    if (estimateUsd > caps.maxCostPerRunUsd) {
+    if (perRunCap !== null && estimateUsd > perRunCap) {
         return {
             ok: false,
             reason: 'over_per_run',
             detail:
                 `the estimate ($${estimateUsd.toFixed(2)}) exceeds the per-run cap ` +
-                `($${caps.maxCostPerRunUsd.toFixed(2)})`,
+                `($${perRunCap.toFixed(2)})`,
         };
     }
     const spent = rollingSpendUsd(records, now);
-    if (spent + estimateUsd > caps.maxCostPerRolling7dUsd) {
+    if (rollingCap !== null && spent + estimateUsd > rollingCap) {
         return {
             ok: false,
             reason: 'over_rolling_7d',
@@ -275,7 +299,7 @@ export function evaluateGateBudget(opts: {
                 `$${spent.toFixed(2)} is already receipted in the last ` +
                 `${String(ROLLING_WINDOW_DAYS)} days and this run would add ` +
                 `$${estimateUsd.toFixed(2)}, over the rolling cap ` +
-                `($${caps.maxCostPerRolling7dUsd.toFixed(2)})`,
+                `($${rollingCap.toFixed(2)})`,
         };
     }
     return { ok: true, estimateUsd, rollingUsd: spent };

package/dist/agent-src/scripts/gate_execute.ts

@@ -297,7 +297,12 @@ function execute(
     // generalised to every way the budget can say no. The `--confirm`
     // requirement below is untouched: the caps bound the size of an authorised
     // spend, they never supply the authorisation.
-    let budgeted: { estimateUsd: number } | null = null;
+    // `estimateUsd` is null only on the one path that reaches here without a
+    // USD figure: a class-1 entry that states no estimate AND an install with
+    // no cap set, so there was no cap for the missing estimate to fail
+    // against. A receipt needs a number, and inventing 0 would understate the
+    // ledger, so that path runs and reports that nothing was receipted.
+    let budgeted: { estimateUsd: number | null } | null = null;
     if (cls === '1') {
         const verdict = evaluateGateBudget({
             caps: readGateBudgetCaps(load_agent_settings({ cwd: repoRoot })),
@@ -388,7 +393,7 @@ function execute(
             code: 1,
         };
     }
-    if (budgeted !== null) {
+    if (budgeted !== null && budgeted.estimateUsd !== null) {
         // Written BEFORE the file rewrite: an unreceipted spend is invisible to
         // the rolling cap, and the cap failing open is the one way this
         // mechanism could become a blank cheque. `actual_usd` is null because
@@ -421,8 +426,11 @@ function execute(
             `and the status flipped to resolved ${when}.\n` +
             (budgeted === null
                 ? ''
-                : `Receipt appended to ${LEDGER_REL} ` +
-                  `($${budgeted.estimateUsd.toFixed(2)} estimated).\n`) +
+                : budgeted.estimateUsd === null
+                  ? `No receipt appended to ${LEDGER_REL}: the entry states no USD ` +
+                    'estimate and no cap is configured, so there is no figure to record.\n'
+                  : `Receipt appended to ${LEDGER_REL} ` +
+                    `($${budgeted.estimateUsd.toFixed(2)} estimated).\n`) +
             // The dashboard is derived from the file this just rewrote, so it
             // is now stale. Saying so is the same follow-up `renderResumed`
             // already prints for its own file-move suggestion.

package/dist/agent-src/scripts/update_roadmap_progress.ts

@@ -1351,7 +1351,10 @@ function main(argv?: readonly string[]): number {
     // leaves behind rather than the one it found. `--check` never archives: a
     // gate that mutates the tree it is checking cannot be trusted by CI.
     let sweep_out = '';
-    if (!args.check && args.archive && unarchived_complete(collect(roadmap_root)).length > 0) {
+    // `pending_iron_law_3` too: a 100 % roadmap with bare `[~]` steps is what the
+    // sweep's carry exists for, and gating on `deferred === 0` never spawned it.
+    const before = collect(roadmap_root);
+    if (!args.check && args.archive && unarchived_complete(before).length + pending_iron_law_3(before).length > 0) {
         const swept = run_archival_sweep(repo_root);
         sweep_out = swept.stdout;
         if (swept.stderr) {

package/dist/agent-src/skills/ai-council/SKILL.md

@@ -67,7 +67,10 @@ things follow, and the first is the one under pressure:
 2. **Do not bounce to the user just because the council failed.** An
    unreachable council does not upgrade a decidable question into a
    user-required one. Decide it, label it own analysis, state the reason the
-   council was unavailable, and name what would change the answer.
+   council was unavailable, and name what would change the answer. Not for a
+   modification review (a change to the gated surface or one the learning
+   lanes originate, ADR-281): there an unavailable council stops the run for
+   the user per `docs/contracts/ratification-artifact.md`.
 3. **Escalate only if it is genuinely undecidable without them** — the two
    options are close AND the cost of being wrong is high AND nothing in the tree
    separates them. Then say the council was attempted and why it failed, so the
@@ -311,9 +314,9 @@ attributed to the host.
   identity — that primes the reviewer and collapses diversity.
 - Do NOT silently truncate a too-large bundle — surface the size and
   ask for narrower scope.
-- Do NOT spend against an unbounded budget without asking — a billable
-  member with neither `max_total_usd` nor `daily_limit_usd` set has no
-  ceiling, and autonomy is not a ceiling.
+- Do NOT ask for permission because no cap is set. ADR-279: a spend bound
+  applies only where one was set, and the absence of one is not a reason
+  to ask. Show the estimate as information and run.
 - Do NOT reuse SDK clients across invocations — re-load keys via
   `load_*_key()` each call.
 

package/dist/agent-src/skills/ai-council/references/cost-and-redaction.md

@@ -47,6 +47,10 @@ table)` and render a per-member table. Heuristic: `len(text) / 4` for
 input, member's `max_tokens` ceiling for output (actual spend is
 usually lower).
 
+This block is **information shown before the run**, not a prompt. Per
+ADR-279 the absence of a cap is not a reason to ask, so there are no
+numbered options here and nothing waits for an answer.
+
 > External council call — billable
 >
 > Mode: roadmap · Target: `agents/roadmaps/<name>.md` (~3 KB after redaction)
@@ -57,21 +61,27 @@ usually lower).
 > | openai / gpt-4o                 |      ~750 / 1024     |  $0.0121 |
 > | **total**                       |                      | **$0.0297** |
 >
-> Budget: 50k in / 20k out tokens · USD ceiling: $0.50
->
-> 1. Run the consultation
-> 2. Cancel
+> Budget: no cap set — token and USD ceilings are `0`.
+
+The `Budget:` line states whatever the user configured. With nothing
+configured it says so plainly, as above; with a cap set it names the
+figure and its unit (`50k in / 20k out tokens · USD ceiling: $0.50`).
+A cap that exists is what `on_overrun` fires against, below.
 
-### Stale price-table gate
+### Stale price table — stated, not asked
 
-If `pricing.is_stale(table)` returns true, ask before proceeding:
+If `pricing.is_stale(table)` returns true, say so in the same block and
+proceed. ADR-237 § 3 already requires that a cost which cannot be
+determined exactly is estimated conservatively and asked nothing about,
+and a stale table is exactly that case:
 
-> Price table is stale (last_updated: YYYY-MM-DD)
-> 1. Refresh now (`./scripts-run src/scripts/update_prices`)
-> 2. Continue with the stale table
-> 3. Cancel
+> Note: price table last updated YYYY-MM-DD and may be stale, so the
+> figures above are an estimate. Refresh with
+> `./scripts-run src/scripts/update_prices`.
 
-Do not silently auto-refresh — the user keeps control.
+Do not silently auto-refresh — the user keeps control of when prices
+change. Stating the staleness is what keeps that control without
+turning it into a question.
 
 ### Mid-flow overrun callback (`on_overrun`)
 

package/dist/agent-src/skills/ai-council/references/procedure.md

@@ -45,14 +45,20 @@ have not migrated yet).
      authorization the user already gave. Render the estimate and fan out.
      `on_overrun` still fires per member on breach (below) — that is where
      the user regains the decision.
-   - **Billable members with no ceiling at all** (`max_total_usd: 0` AND
-     `daily_limit_usd: 0`) → unbounded paid spend, so surface the estimate
-     and require an explicit `1`. Nothing bounds the call, so the user must.
+   - **Billable members with no cap set** (`max_total_usd: 0` AND
+     `daily_limit_usd: 0`, which is the shipped default) → render the
+     estimate as information and fan out. **No ask.** Per ADR-279 a spend
+     bound applies only where one was set, and the absence of one is not
+     a reason to ask.
 
-   Autonomy settings do not *create* a bound and do not lift the last case.
-   Consumers who want the old per-run gate back set a small
+   All three cases now behave the same way: the estimate is information,
+   never a prompt. What differs is only whether a cap exists for
+   `on_overrun` to fire against.
+
+   Consumers who want a per-run gate set a small
    `cost_budget.max_total_usd`: every call then breaches and `on_overrun`
-   asks, per member.
+   asks, per member. That is a bound they chose, which is the only kind
+   this procedure recognises.
 4. **Fan out.** Dispatch the bundle to each enabled council member via
    `scripts/ai_council/orchestrator.ts`. Each member receives the
    neutrality preamble from `prompts.ts` plus the artefact — nothing

package/dist/agent-src/skills/analysis-autonomous-mode/SKILL.md

@@ -109,7 +109,7 @@ Constraint: **attack the biggest unknown first** (not breadth-first). Repeat unt
 | New evidence appears | Re-evaluate all conclusions |
 | Stuck in one skill | Broaden — switch to `universal-project-analysis` |
 | Clear pattern recognized | Narrow — go deep with the right specialist |
-| 3 failed attempts | Stop — summarize state, ask user for direction |
+| 3 failed attempts | Change approach — `autonomous-execution`'s mandatory strategy shift, never a stop |
 
 ## Learning from past analyses
 

package/dist/agent-src/skills/api-design/data/manifest.json

@@ -28,7 +28,7 @@
   "refresh_cadence": "quarterly",
   "upstream": {
     "repo": "derived: RFC 9110/9457/7396/8288 + httpapi WG drafts",
-    "sha": "RFC 9110 (STD 97) / 9457 / 7396 / 8288 \u2014 verified 2026-09-18: 9110 neither obsoleted nor updated; 9457 current and obsoletes 7807",
-    "last_checked": "2026-09-18"
+    "sha": "RFC 9110 (STD 97, 2022-06) / 9457 (2023-07, obsoletes 7807) / 7396 (2014-10) / 8288 (2017-10) \u2014 all Standards Track",
+    "last_checked": "2026-10-04"
   }
 }

package/dist/agent-src/skills/api-testing/SKILL.md

@@ -234,3 +234,20 @@ When a test fails, do not retry blindly with tweaked assertions until something
 ## Clarification guard — ambiguous contract → ask
 
 If the endpoint contract is ambiguous (unclear status code, optional fields, error envelope shape), do not assume. Ask the user or check the OpenAPI spec / route definition before writing assertions — never guess the response shape from the route name.
+
+## The HTTP-assertion idiom, per ecosystem
+
+The examples above are Laravel's. The *shape* they teach — assert the status,
+then the body contract, then the side effect, and keep one behavior per test —
+transfers unchanged; the API does not. Resolve the runner with
+`resolve_toolchain` and read its `ecosystems`:
+
+| `ecosystems` | Request + assertion surface |
+|---|---|
+| `php` | `$this->getJson(...)` / `assertStatus` / `assertJsonPath` |
+| `js` | `supertest` or the framework's own test client, with `expect(res.status)` |
+| `python` | `httpx.AsyncClient` / framework `TestClient`; `assert res.status_code` |
+| `go` | `httptest.NewServer` + `net/http`, or the router's own `ServeHTTP` |
+
+Whatever the surface, the negative tests are not optional: unauthenticated,
+not-owner and cross-tenant each get their own case, per `broken-access-control`.

package/dist/agent-src/skills/bug-analyzer/SKILL.md

@@ -53,7 +53,7 @@ Pattern matching:
 - `fix/DEV-1234/description` → extract `DEV-1234`
 - `fix/PROJ-567-some-bug` → extract `PROJ-567`
 - `hotfix/DEV-999` → extract `DEV-999`
-- Regex: `[A-Z]+-[0-9]+`
+- Read it with `agent-config git:convention ticket` — [`commit-subject`](../git-workflow/references/commit-subject.md) § Reading the ticket
 
 If found, auto-fetch the ticket and confirm with the user.
 

package/dist/agent-src/skills/code-intelligence/SKILL.md

@@ -245,14 +245,26 @@ paragraph claiming "the same five answers" directly after a list of four:
 | `graph_dead` | `dead` |
 | `graph_query` | `query` |
 | `graph_path` | `path` |
+| `graph_node` | no CLI verb — one symbol's location, in-edges, out-edges and degree |
 
 `untested` has no tool of its own; it is a flag on `graph_impact`, because the
-two answer the same question over the same diff and a sixth tool would have cost
-standing context for a boolean. `graph_impact` is the only one that is not
+two answer the same question over the same diff and a separate tool would have
+cost standing context for a boolean. `graph_impact` is the only one that is not
 read-only — it runs `git diff --name-only` to resolve its rev — and
 `graph_dead`'s refusal arrives as `status: "refused"`, never as `status: "ok"`
 with an empty list.
 
+`graph_node` is the one entry with no CLI verb behind it, and the one that
+REFUSES a seed it cannot resolve exactly. Every other reader answers about a
+neighbourhood or a set, where a best-guess seed costs the caller one wrong line
+among several; a node view's every field — the location, the degree, both edge
+lists — is a statement about ONE node, so a guess is wrong in all of them at
+once. It resolves on the exact tiers of the same seed ladder (node id, then
+label) and returns `status: "refused"` naming the candidates when a label is
+ambiguous, rather than scoring free text — which is the retrieval class the
+measured null covers (`docs/CLAIMS.md`, `code-graph-retrieval-null`). Use
+`graph_query` when a best-guess match is what you want.
+
 **No ordering claim is added here, and no measurement claim either.** These
 verbs are cheaper than reconstructing the same relationship by hand — that is a
 claim about the ALTERNATIVE being a manual reconstruction, not about grep.

package/dist/agent-src/skills/command-routing/SKILL.md

@@ -99,11 +99,10 @@ Read `github.pr_reply_method` from `.agent-settings.yml`:
 | `create_review_comment` | `POST /repos/{owner}/{repo}/pulls/{number}/comments` with `{"body": "...", "in_reply_to": comment_id}` |
 | `auto` | Try `replies_endpoint` first. If it works → update setting. If 404/error → try `create_review_comment`. |
 
-### 2. Bot icon prefix
+### 2. No bot icon prefix
 
-Read `personal.pr_comment_bot_icon` from `.agent-settings.yml`:
-- `true` → prefix reply body with `🤖 `.
-- `false` or not set → no prefix.
+Never prefix the reply body with `🤖 ` — `🤖` is on the universal blacklist of
+[`no-decorative-emojis-in-git-surfaces`](../../rules/no-decorative-emojis-in-git-surfaces.md).
 
 ### 3. API call rules