@event4u/agent-config 16.2.0 → 16.4.0

package/src/agent-src/scripts/gate_budget.ts

@@ -56,9 +56,16 @@ export function gateBudgetLedgerPath(workspaceRoot: string): string {
 }
 
 /** The two caps decided by option (a). Both are USD. */
+/**
+ * The two standing caps, each independently settable.
+ *
+ * Both figures are **US dollars**. Either may be `null`, meaning that cap was
+ * not set and therefore bounds nothing; `readGateBudgetCaps` returns `null`
+ * for the whole object only when NEITHER was set.
+ */
 export interface GateBudgetCaps {
-    maxCostPerRunUsd: number;
-    maxCostPerRolling7dUsd: number;
+    maxCostPerRunUsd: number | null;
+    maxCostPerRolling7dUsd: number | null;
 }
 
 /**
@@ -105,18 +112,26 @@ function _dig(settings: unknown, keys: readonly string[]): unknown {
 /**
  * Read the caps out of an already-merged settings dict.
  *
- * Returns `null` when either cap is absent or non-numeric — deliberately NOT a
- * fallback to the template numbers. An install whose settings do not carry the
- * caps has not authorised a standing budget, and inventing one from the
- * template default would authorise spend nobody configured. The caller renders
- * the consent line instead.
+ * Each cap is returned on its own. Returns `null` only when NEITHER is set,
+ * which means no ceiling on money was configured — not that the run is
+ * unauthorised. Still deliberately NOT a fallback to the template numbers:
+ * inventing a cap from a template default would bound a run by a figure
+ * nobody chose.
+ *
+ * Until 2026-10-06 this returned `null` unless BOTH caps were numeric, with
+ * two consequences. A person who set one cap and left the other alone was
+ * bounded by NEITHER — the stricter-looking rule produced the laxer result.
+ * And absent caps were read by the caller as a refusal, so the gate would not
+ * run at all without them. ADR-279 supersedes that second reading: absence of
+ * a bound is not a bound, and `--confirm` remains the authorisation the caps
+ * only ever sized.
  */
 export function readGateBudgetCaps(settings: unknown): GateBudgetCaps | null {
     const perRun = _num(_dig(settings, ['roadmap', 'gate_budget', 'max_cost_per_run_usd']));
     const rolling = _num(
         _dig(settings, ['roadmap', 'gate_budget', 'max_cost_per_rolling_7d_usd']),
     );
-    if (perRun === null || rolling === null) {
+    if (perRun === null && rolling === null) {
         return null;
     }
     return { maxCostPerRunUsd: perRun, maxCostPerRolling7dUsd: rolling };
@@ -216,13 +231,15 @@ export function rollingSpendUsd(records: readonly GateBudgetReceipt[], now: Date
 }
 
 export type GateBudgetRefusal =
-    | 'no_caps'
+    // 'no_caps' was removed on 2026-10-06 with ADR-279: the absence of a cap
+    // is no longer a refusal, so no path can produce it and leaving it in the
+    // union would advertise a verdict nothing returns.
     | 'no_estimate'
     | 'over_per_run'
     | 'over_rolling_7d';
 
 export type GateBudgetVerdict =
-    | { ok: true; estimateUsd: number; rollingUsd: number }
+    | { ok: true; estimateUsd: number | null; rollingUsd: number }
     | { ok: false; reason: GateBudgetRefusal; detail: string };
 
 /**
@@ -230,6 +247,12 @@ export type GateBudgetVerdict =
  *
  * Every refusal path renders rather than runs — the blocker's own prescription
  * for a missing ledger, generalised to every way the budget can say no.
+ *
+ * What is NOT a refusal, per ADR-279: the absence of a cap. With no cap
+ * configured there is no ceiling on money to compare anything against, so the
+ * verdict is `ok` and the run proceeds on the authorisation `--confirm`
+ * already carries. A cap that WAS set still bounds exactly as its contract
+ * describes, and each bounds alone.
  */
 export function evaluateGateBudget(opts: {
     caps: GateBudgetCaps | null;
@@ -238,16 +261,17 @@ export function evaluateGateBudget(opts: {
     now: Date;
 }): GateBudgetVerdict {
     const { caps, records, estimateUsd, now } = opts;
-    if (caps === null) {
-        return {
-            ok: false,
-            reason: 'no_caps',
-            detail:
-                'no standing class-1 budget is configured ' +
-                '(`roadmap.gate_budget.max_cost_per_run_usd` and ' +
-                '`roadmap.gate_budget.max_cost_per_rolling_7d_usd`)',
-        };
+    const perRunCap = caps === null ? null : caps.maxCostPerRunUsd;
+    const rollingCap = caps === null ? null : caps.maxCostPerRolling7dUsd;
+    // No ceiling on money was set anywhere, so nothing here can say no.
+    // `rollingUsd` is still computed and reported — recording spend never
+    // depended on bounding it.
+    if (perRunCap === null && rollingCap === null) {
+        return { ok: true, estimateUsd, rollingUsd: rollingSpendUsd(records, now) };
     }
+    // A missing estimate refuses only because a cap exists that nothing can be
+    // compared against. With no cap there is no comparison to fail, which is
+    // why this sits BELOW the no-cap branch rather than above it.
     if (estimateUsd === null) {
         return {
             ok: false,
@@ -257,17 +281,17 @@ export function evaluateGateBudget(opts: {
                 'can be compared against it',
         };
     }
-    if (estimateUsd > caps.maxCostPerRunUsd) {
+    if (perRunCap !== null && estimateUsd > perRunCap) {
         return {
             ok: false,
             reason: 'over_per_run',
             detail:
                 `the estimate ($${estimateUsd.toFixed(2)}) exceeds the per-run cap ` +
-                `($${caps.maxCostPerRunUsd.toFixed(2)})`,
+                `($${perRunCap.toFixed(2)})`,
         };
     }
     const spent = rollingSpendUsd(records, now);
-    if (spent + estimateUsd > caps.maxCostPerRolling7dUsd) {
+    if (rollingCap !== null && spent + estimateUsd > rollingCap) {
         return {
             ok: false,
             reason: 'over_rolling_7d',
@@ -275,7 +299,7 @@ export function evaluateGateBudget(opts: {
                 `$${spent.toFixed(2)} is already receipted in the last ` +
                 `${String(ROLLING_WINDOW_DAYS)} days and this run would add ` +
                 `$${estimateUsd.toFixed(2)}, over the rolling cap ` +
-                `($${caps.maxCostPerRolling7dUsd.toFixed(2)})`,
+                `($${rollingCap.toFixed(2)})`,
         };
     }
     return { ok: true, estimateUsd, rollingUsd: spent };

package/src/agent-src/scripts/gate_execute.ts

@@ -297,7 +297,12 @@ function execute(
     // generalised to every way the budget can say no. The `--confirm`
     // requirement below is untouched: the caps bound the size of an authorised
     // spend, they never supply the authorisation.
-    let budgeted: { estimateUsd: number } | null = null;
+    // `estimateUsd` is null only on the one path that reaches here without a
+    // USD figure: a class-1 entry that states no estimate AND an install with
+    // no cap set, so there was no cap for the missing estimate to fail
+    // against. A receipt needs a number, and inventing 0 would understate the
+    // ledger, so that path runs and reports that nothing was receipted.
+    let budgeted: { estimateUsd: number | null } | null = null;
     if (cls === '1') {
         const verdict = evaluateGateBudget({
             caps: readGateBudgetCaps(load_agent_settings({ cwd: repoRoot })),
@@ -388,7 +393,7 @@ function execute(
             code: 1,
         };
     }
-    if (budgeted !== null) {
+    if (budgeted !== null && budgeted.estimateUsd !== null) {
         // Written BEFORE the file rewrite: an unreceipted spend is invisible to
         // the rolling cap, and the cap failing open is the one way this
         // mechanism could become a blank cheque. `actual_usd` is null because
@@ -421,8 +426,11 @@ function execute(
             `and the status flipped to resolved ${when}.\n` +
             (budgeted === null
                 ? ''
-                : `Receipt appended to ${LEDGER_REL} ` +
-                  `($${budgeted.estimateUsd.toFixed(2)} estimated).\n`) +
+                : budgeted.estimateUsd === null
+                  ? `No receipt appended to ${LEDGER_REL}: the entry states no USD ` +
+                    'estimate and no cap is configured, so there is no figure to record.\n'
+                  : `Receipt appended to ${LEDGER_REL} ` +
+                    `($${budgeted.estimateUsd.toFixed(2)} estimated).\n`) +
             // The dashboard is derived from the file this just rewrote, so it
             // is now stale. Saying so is the same follow-up `renderResumed`
             // already prints for its own file-move suggestion.

package/src/agent-src/scripts/update_roadmap_progress.ts

@@ -1351,7 +1351,10 @@ function main(argv?: readonly string[]): number {
     // leaves behind rather than the one it found. `--check` never archives: a
     // gate that mutates the tree it is checking cannot be trusted by CI.
     let sweep_out = '';
-    if (!args.check && args.archive && unarchived_complete(collect(roadmap_root)).length > 0) {
+    // `pending_iron_law_3` too: a 100 % roadmap with bare `[~]` steps is what the
+    // sweep's carry exists for, and gating on `deferred === 0` never spawned it.
+    const before = collect(roadmap_root);
+    if (!args.check && args.archive && unarchived_complete(before).length + pending_iron_law_3(before).length > 0) {
         const swept = run_archival_sweep(repo_root);
         sweep_out = swept.stdout;
         if (swept.stderr) {

package/src/agent-src/templates/AGENTS.md

@@ -14,7 +14,7 @@
 ## Pointers
 
 - **Filling out this AGENTS.md** — section templates, capability bullets, multi-agent entry flow, monorepo layout: [`consumer-agents-md-guide`](.augment/contexts/contracts/consumer-agents-md-guide.md).
-- **Behavior rules** (9 always-on; rest routed) — [`.augment/rules/`](.augment/rules/). Kernel rules are **immutable**; tighten only via the override registry.
+- **Behavior rules** (9 always-on; rest routed) — [`.augment/rules/`](.augment/rules/). Kernel rules change only by a ratified edit; overrides may tighten.
 - **Skills (on-demand expertise)** — domain skills surfaced by description, invoked on trigger match: [`.augment/skills/`](.augment/skills/).
 - **Commands (workflows)** — slash-commands the agent runs end-to-end (`/work`, `/create-pr`, …): [`.augment/commands/`](.augment/commands/).
 - **Project-specific docs** — your own architecture notes, roadmaps, sessions, contexts: [`agents/`](agents/).

package/src/agent-src/templates/scripts/work_engine/_lib/agent_settings.ts

@@ -207,7 +207,6 @@ export const MERGEABLE_KEYS: readonly string[] = [
     // weak-host-lift-tiering + token-program-integration verdicts; ADR
     // records the whitelist addition). Wins over rule_loading_tier.
     'discipline_profile',
-    'memory.cadence',
     'personal.bot_icon',
     'personal.autonomy',
     // Knowledge-card global cross-project sharing is a USER-GLOBAL setting
@@ -215,11 +214,6 @@ export const MERGEABLE_KEYS: readonly string[] = [
     // ~/.event4u/agent-config/agent-settings.yml values are honoured.
     'knowledge.global_sharing.enabled',
     'knowledge.global_sharing.allowed_tiers',
-    'knowledge.global_sharing.redaction.enabled',
-    'knowledge.global_sharing.redaction.halt_on_trigger',
-    'knowledge.global_sharing.auto_promote_threshold',
-    'knowledge.global_sharing.freshness.hypothesis_after_days',
-    'knowledge.global_sharing.freshness.stale_after_days',
 ];
 
 const _DEFAULTS: SettingsDict = {};

package/src/agent-src/templates/scripts/work_engine/directives/backend/_self_fix.ts

@@ -24,10 +24,13 @@
  *
  * Two floors, neither invented here:
  *
- * - **Ceiling** — {@link SELF_FIX_CEILING} attempts per lane, which is the
- *   N=3 validation-loop budget from the `autonomous-execution` rule, applied
- *   per validation target (that rule resets its counter on a different
- *   target, so the counters below are per-lane rather than per-run).
+ * - **Ceiling** — {@link SELF_FIX_CEILING} attempts per lane. This is the
+ *   engine's own number, independent of the `autonomous-execution` rule's
+ *   `execution.fix_loop_max` budget (now a default-10 ladder) — a
+ *   deterministic, critic-free retry on an already-known verdict has no
+ *   judgement call for that ladder's escalation rungs to apply to. The
+ *   counters below are per-lane rather than per-run; each lane is its own
+ *   target.
  * - **No-progress** — two consecutive attempts producing an identical verdict
  *   signature stop the loop immediately, budget remaining or not. This is the
  *   floor the `recursive-verification` skill already stated in prose ("two
@@ -47,9 +50,10 @@ import { type Any, Outcome, StepResult, agent_directive } from '../../delivery_s
 /**
  * Attempts allowed per lane before the loop exits PARTIAL.
  *
- * Deliberately the `autonomous-execution` N=3 budget rather than a fresh
- * number: a second, differently-sized retry ceiling in the same package would
- * be a rule the tree contradicts.
+ * The engine's own number — not borrowed from `autonomous-execution`'s
+ * `execution.fix_loop_max` budget, which now defaults to 10 with a
+ * strategy-shift ladder. A deterministic, critic-free retry on an
+ * already-known verdict has no judgement call that ladder's rungs apply to.
  */
 export const SELF_FIX_CEILING = 3;
 

package/src/agent-src/templates/scripts/work_engine/directives/ui/apply.ts

@@ -133,12 +133,11 @@ export function run(state: DeliveryState): StepResult {
             return _halt_coverage(state, provided, report.gaps);
         }
         notes.push(...report.fallbacks);
-        // 3.1 — reported in shadow: the outcome value is unchanged for one
-        // release, so a caller branching on it is found by the line rather
-        // than by the breakage.
-        const handed_back = _handed_back_line(report);
-        if (handed_back !== null) {
-            notes.push(handed_back);
+        // 3.2 — the shadow is now the outcome. 3.1 shipped the line one
+        // release ahead (16.2.0 carries it) so a caller branching on
+        // `SUCCESS` was found by the words before it is found by the value.
+        if (carried_nothing(report)) {
+            return _halt_carried_nothing(state, report, notes);
         }
     }
 
@@ -390,6 +389,49 @@ function _halt_coverage(
     });
 }
 
+/**
+ * BLOCKED halt — the port accounted for everything and carried none of it.
+ *
+ * The gap list is empty here by construction: a complete report and a complete
+ * surrender look identical to `coverage_gaps`, which is why this is its own
+ * halt rather than a gap. `questions` is non-empty because the dispatcher
+ * rejects a `BLOCKED` result that surfaces nothing to answer — handing the
+ * work back has to come with a way forward, not just a refusal.
+ */
+function _halt_carried_nothing(
+    state: DeliveryState,
+    report: CoverageReport,
+    fallbacks: ReadonlyArray<string>,
+): StepResult {
+    const directive = _resolve_directive(state);
+    const lines: string[] = [
+        agent_directive(directive),
+        '> Apply rejected: the coverage report accounts for every declared ' +
+            'item and the port carried none of them over.',
+        `> All ${report.declared.length} declared item(s) are in \`flagged\`:`,
+    ];
+    for (const item of report.handed_back) {
+        lines.push(`> - \`${item}\``);
+    }
+    lines.push(
+        '> A complete report and a complete hand-back are the same empty gap ' +
+            'list, so this is checked separately — flagging one handler the ' +
+            'port could not carry is the ledger working; flagging all of them ' +
+            'is the port not having run.',
+        '> 1. Continue — implement the items above and re-write ' +
+            '`ui_apply.coverage` with each one in `honoured` or `translated`, ' +
+            'leaving in `flagged` only what genuinely could not be carried',
+        '> 2. Flag deliberately — say here which of the items above are out of ' +
+            'scope for this port and why, and the operator decides',
+        '> 3. Abort — drop this UI request',
+    );
+    return new StepResult({
+        outcome: Outcome.BLOCKED,
+        questions: lines,
+        message: [...fallbacks, `UI apply rejected: ${_handed_back_line(report)}`].join('\n'),
+    });
+}
+
 /** Return the agent-written `ui_apply` envelope, or `null`. */
 function _apply_envelope(state: DeliveryState): Record<string, Any> | null {
     const data = _pyTruthy(state.ticket) ? state.ticket : {};

package/src/agent-src/templates/scripts/work_engine/hooks/builtin/decision_trace.ts

@@ -3,8 +3,9 @@
  *
  * TypeScript twin of `work_engine/hooks/builtin/decision_trace.py` (ADR-200
  * py2ts — work_engine.hooks.builtin subpackage). Implements the v1 envelope
- * from `docs/contracts/decision-trace-v1.md`. Default-off; opt-in via
- * `.agent-settings.yml` `decision_engine.surface_traces: true`.
+ * from `docs/contracts/decision-trace-v1.md`. Off: the settings key that
+ * registered it was retired, so only a caller that builds the registry
+ * directly enables it.
  *
  * The hook is purely observational — it never mutates `DeliveryState`, never
  * raises terminal errors. Stream / disk failures surface as {@link HookError}

package/src/agent-src/templates/scripts/work_engine/hooks/builtin/memory_visibility.ts

@@ -31,7 +31,8 @@ type Any = unknown;
 /**
  * Thread the `🧠 Memory: <hits>/<asks> · ids=[…]` line into the report.
  *
- * `memory_cadence` is the `memory.cadence` cadence key. `visibility_off`
+ * `memory_cadence` is the cadence the hook was built with; settings always
+ * yield `always` since the `memory.cadence` key was retired. `visibility_off`
  * mirrors `memory.visibility: off`. `asked_types` overrides the list of
  * memory types treated as `asks` in the visibility line.
  */

package/src/agent-src/templates/scripts/work_engine/hooks/settings.ts

@@ -157,7 +157,6 @@ function _settings_from_raw(data: SettingsDict): HookSettings {
 
     const memory_section = data['memory'];
     let visibility_off = false;
-    let memory_cadence = 'always';
     if (_isPlainDict(memory_section)) {
         const ms = memory_section as Record<string, Any>;
         const rawVis = ms['visibility'];
@@ -166,10 +165,6 @@ function _settings_from_raw(data: SettingsDict): HookSettings {
         } else if (typeof rawVis === 'boolean' && rawVis === false) {
             visibility_off = true;
         }
-        const cadence_raw = ms['cadence'];
-        if (cadence_raw !== null && cadence_raw !== undefined) {
-            memory_cadence = String(cadence_raw).trim().toLowerCase() || 'always';
-        }
     }
 
     const memory_hooks = hooksDict['memory_visibility'];
@@ -192,7 +187,6 @@ function _settings_from_raw(data: SettingsDict): HookSettings {
         decision_trace: decision_trace_on,
         memory_visibility: memory_visibility_on,
         memory_visibility_off: visibility_off,
-        memory_cadence,
         chat_history_enabled: chat_block_enabled && global_chat_on,
         chat_history_script: chat_script,
         decision_engine: decision_engine_settings,

package/src/agent-src/templates/scripts/work_engine/scoring/decision_engine.ts

@@ -11,9 +11,10 @@
  *
  * Schema (all keys optional; the parser rejects unknown keys hard):
  *
- * - `surface_traces` (bool, default `false`) — opt-in for
- *   `DecisionTraceHook`. Predates the gates; lives here so the
- *   `decision_engine:` block has one source-of-truth schema.
+ * - `surface_traces` — RETIRED, accepted and ignored. The trace hook stays
+ *   off (the old default). Still in `ALLOWED_KEYS` so a block that carries
+ *   the leftover key is not rejected wholesale, which would drop the gates
+ *   it configures alongside it.
  * - `min_confidence` (`low`/`medium`/`high`/`off`, default
  *   `off`) — confidence-band floor; Phase=Plan refuses to advance
  *   when the band is below.
@@ -27,8 +28,9 @@
  * - `ask_timeout_seconds` (int, default `30`) — timeout when
  *   `on_block=ask` runs in a non-interactive context (no TTY, or
  *   `CI=true`).
- * - `on_block_fallback` (`stop`/`warn`, default `stop`) —
- *   resolution after `ask_timeout` elapses.
+ * - `on_block_fallback` — RETIRED, accepted and ignored for the same
+ *   reason; the resolution after `ask_timeout` is always `stop`, the
+ *   fail-safe value.
  *
  * Gate-conflict resolution (first match wins, only one gate fires per
  * phase):
@@ -57,7 +59,6 @@ export const ALLOWED_KEYS: ReadonlySet<string> = new Set([
 const _LEVEL_VALUES: ReadonlySet<string> = new Set(['low', 'medium', 'high', 'off']);
 const _LEVEL_RANK: Record<string, number> = { low: 1, medium: 2, high: 3 };
 const _ON_BLOCK_VALUES: ReadonlySet<string> = new Set(['stop', 'ask', 'warn']);
-const _FALLBACK_VALUES: ReadonlySet<string> = new Set(['stop', 'warn']);
 
 /**
  * Conflict-resolution order. Highest-impact gate first; the first
@@ -177,17 +178,13 @@ export function parse(data: Any): DecisionEngineSettings {
         );
     }
     return new DecisionEngineSettings({
-        surface_traces: _coerce_bool(_get(d, 'surface_traces', undefined), false),
+        surface_traces: false,
         min_confidence: _coerce_level(_get(d, 'min_confidence', 'off'), 'min_confidence'),
         block_on_risk: _coerce_level(_get(d, 'block_on_risk', 'off'), 'block_on_risk'),
         require_memory_hits: _coerce_bool(_get(d, 'require_memory_hits', undefined), false),
         on_block: _coerce_choice(_get(d, 'on_block', 'stop'), 'on_block', _ON_BLOCK_VALUES),
         ask_timeout_seconds: _coerce_int(_get(d, 'ask_timeout_seconds', 30), 'ask_timeout_seconds'),
-        on_block_fallback: _coerce_choice(
-            _get(d, 'on_block_fallback', 'stop'),
-            'on_block_fallback',
-            _FALLBACK_VALUES,
-        ),
+        on_block_fallback: 'stop',
     });
 }
 

package/src/agent-src/templates/scripts/work_engine/scoring/memory_visibility.ts

@@ -284,7 +284,8 @@ export function format_changed_decisions_block(
 /**
  * Apply the cadence + opt-out gates from the contract.
  *
- * `memory_cadence` is the `memory.cadence` cadence key:
+ * `memory_cadence` is the cadence the hook was built with (the
+ * `memory.cadence` settings key is retired; settings always yield `always`):
  *
  *   - `always` (default) — emit whenever `asks >= 1`.
  *   - `auto` — emit only when `asks >= 3` (reduces noise on