@event4u/agent-config 16.3.0 → 16.4.0

package/src/scripts/lint_rule_law_section.ts

@@ -33,6 +33,20 @@
  *    priced in the same unit the installed-layer report uses. Today's larger
  *    rules are named in `body_exceptions`, shrink-only on the same terms.
  *
+ * 4. TRIGGER PRESENCE (`--axis trigger`). Added by step 3.4 of
+ *    `road-to-an-installed-layer-that-is-thinned`: a stub is a pointer a prompt
+ *    must be able to pull in, so a routed rule with ZERO triggers in
+ *    `dist/router.json` cannot be discovered once it ships as a stub — the
+ *    pointer sits in the installed layer forever and the law behind it never
+ *    arrives. Four rules read zero today (measured 2026-10-06) and are named in
+ *    `no_trigger`, SHRINK-ONLY on the same terms as `missing`: each is delivered
+ *    by a mechanism other than a keyword match — a path collision
+ *    (`collision_ok`) or an unconditional load with no scoping at all — which is
+ *    a deliberate routing choice recorded in the rule's own frontmatter, not an
+ *    oversight this gate should paper over. A NEW routed rule therefore cannot
+ *    be born with no trigger a prompt can fire, same as it cannot be born
+ *    lawless.
+ *
  * WHY THE TARGET IS REPORTED AND NOT ENFORCED. A rule shortened to fit a number
  * is the failure this roadmap says it will not cause. 1,200 is where the
  * distribution sits (median 511, p90 1,787) and a rule between target and hard
@@ -51,7 +65,7 @@
  *
  * WHAT IT DOES NOT ASSERT. Not that the extracted section is the rule's real
  * obligation — a heading match is structural and checkable, "this sentence is
- * the obligation" is not; the `# obligation: line N` marker and
+ * the obligation" is not; the ids in `src/config/rule-obligations.json` and
  * `report_obligation_carriers` own that. Not that a rule at its recorded
  * exception is correct, only that it is not worse. And not a cross-commit
  * ratchet: this gate reads one tree, so "shrink-only" means the tree sits at or
@@ -100,13 +114,15 @@ export interface LawConfig {
     measured_at_commit?: string;
     /** Routed rules with no law section. Shrink-only: ids may leave, never join. */
     missing: string[];
+    /** Routed rules with no trigger a prompt can fire. Shrink-only, same terms as `missing`. */
+    no_trigger: string[];
     /** Rules whose law exceeds {@link LAW_HARD_CHARS}. */
     law_exceptions: Record<string, SizeException>;
     /** Rules whose body exceeds {@link BODY_HARD_CHARS}. */
     body_exceptions: Record<string, SizeException>;
 }
 
-export type Axis = 'presence' | 'ceiling' | 'body-ceiling' | 'all';
+export type Axis = 'presence' | 'ceiling' | 'body-ceiling' | 'trigger' | 'all';
 
 export interface Finding {
     id: string;
@@ -153,6 +169,7 @@ export function readConfig(root = REPO_ROOT): LawConfig {
     const raw = JSON.parse(fs.readFileSync(p, 'utf-8')) as Partial<LawConfig>;
     return {
         missing: Array.isArray(raw.missing) ? raw.missing : [],
+        no_trigger: Array.isArray(raw.no_trigger) ? raw.no_trigger : [],
         law_exceptions: raw.law_exceptions ?? {},
         body_exceptions: raw.body_exceptions ?? {},
         measured_at_commit: raw.measured_at_commit ?? '',
@@ -170,15 +187,47 @@ export function measureRouted(root = REPO_ROOT): RuleLawMeasure[] {
     return out;
 }
 
+/** Trigger count per routed tier rule id, straight off `dist/router.json`. */
+export function routedRuleTriggerCounts(root = REPO_ROOT): Map<string, number> {
+    const data = JSON.parse(fs.readFileSync(path.join(root, ROUTER_REL), 'utf-8')) as Record<
+        string,
+        unknown
+    >;
+    const counts = new Map<string, number>();
+    for (const tier of ['tier_1', 'tier_2']) {
+        const entries = data[tier];
+        if (!Array.isArray(entries)) continue;
+        for (const e of entries) {
+            const rec = e as Record<string, unknown>;
+            const triggers = rec['triggers'];
+            counts.set(String(rec['id']), Array.isArray(triggers) ? triggers.length : 0);
+        }
+    }
+    return counts;
+}
+
 export function lint(root = REPO_ROOT, axis: Axis = 'all'): LintResult {
     const cfg = readConfig(root);
     const measures = measureRouted(root);
+    const triggerCounts = routedRuleTriggerCounts(root);
     const findings: Finding[] = [];
     const overTarget: Array<{ id: string; chars: number }> = [];
     const baselined = new Set(cfg.missing);
+    const noTriggerBaselined = new Set(cfg.no_trigger);
     const want = (a: Exclude<Axis, 'all'>): boolean => axis === 'all' || axis === a;
 
     for (const m of measures) {
+        if (want('trigger') && (triggerCounts.get(m.id) ?? 0) === 0 && !noTriggerBaselined.has(m.id)) {
+            findings.push({
+                id: m.id,
+                axis: 'trigger',
+                kind: 'no-trigger',
+                detail:
+                    'routed rule has no trigger in `dist/router.json` — a prompt can never pull it in, ' +
+                    `so it cannot ship as a stub; add a trigger, or add the id to \`no_trigger\` in ` +
+                    `${CONFIG_REL} (that list is shrink-only, so a new routed rule may not join it)`,
+            });
+        }
         if (want('presence') && m.law === null && !baselined.has(m.id)) {
             findings.push({
                 id: m.id,
@@ -270,6 +319,30 @@ export function lint(root = REPO_ROOT, axis: Axis = 'all'): LintResult {
         }
     }
 
+    // Same stale-debt check for the trigger baseline: an id that gained a
+    // trigger, or left the routed set, is debt that was paid and never
+    // collected.
+    if (want('trigger')) {
+        const routed = new Set(measures.map((m) => m.id));
+        for (const id of cfg.no_trigger) {
+            if (!routed.has(id)) {
+                findings.push({
+                    id,
+                    axis: 'trigger',
+                    kind: 'stale-baseline-entry',
+                    detail: `is not a routed rule any more — remove it from \`no_trigger\` in ${CONFIG_REL}`,
+                });
+            } else if ((triggerCounts.get(id) ?? 0) > 0) {
+                findings.push({
+                    id,
+                    axis: 'trigger',
+                    kind: 'stale-baseline-entry',
+                    detail: `now has a trigger — remove it from \`no_trigger\` in ${CONFIG_REL}`,
+                });
+            }
+        }
+    }
+
     const kernelReported = kernelRuleIds(root).map((id) => {
         const p = path.join(root, RULES_REL, `${id}.md`);
         return { id, sections: fs.existsSync(p) ? measureRuleFile(id, p).sections : 0 };
@@ -284,9 +357,14 @@ export function lint(root = REPO_ROOT, axis: Axis = 'all'): LintResult {
 export function writeBaseline(root = REPO_ROOT, today: string): string {
     const prev = fs.existsSync(path.join(root, CONFIG_REL))
         ? readConfig(root)
-        : { missing: [], law_exceptions: {}, body_exceptions: {} };
+        : { missing: [], no_trigger: [], law_exceptions: {}, body_exceptions: {} };
     const measures = measureRouted(root);
+    const triggerCounts = routedRuleTriggerCounts(root);
     const missing = measures.filter((m) => m.law === null).map((m) => m.id).sort();
+    const no_trigger = measures
+        .filter((m) => (triggerCounts.get(m.id) ?? 0) === 0)
+        .map((m) => m.id)
+        .sort();
     const law_exceptions: Record<string, SizeException> = {};
     const body_exceptions: Record<string, SizeException> = {};
     for (const m of measures) {
@@ -311,16 +389,22 @@ export function writeBaseline(root = REPO_ROOT, today: string): string {
     }
     const cfg = {
         _comment:
-            'Per-rule law-section and body ceilings (road-to-rule-laws-that-can-stand Phase 1). ' +
-            'SHRINK-ONLY on every axis: an id may LEAVE `missing`, never join it; a recorded ' +
-            'exception is a ceiling the rule may fall below and never rise above. Raising one to ' +
-            'clear a red is the config-weakening move this repo blocks by construction — ' +
-            '`--write-baseline` refuses to raise, it only re-records the smaller of old and ' +
-            'current. A rule at its exception is not thereby correct, only not worse. Regenerate ' +
-            'with `lint_rule_law_section --write-baseline`; never hand-edit the counts, but DO ' +
-            'hand-edit `owner`, `review` and `reason` — those are the review contract and the ' +
-            'generator only seeds them.',
+            'Per-rule law-section and body ceilings (road-to-rule-laws-that-can-stand Phase 1) plus ' +
+            'the trigger-presence baseline (road-to-an-installed-layer-that-is-thinned step 3.4). Two ' +
+            'different guarantees, not one: `law_exceptions` and `body_exceptions` are numeric ' +
+            'ceilings `--write-baseline` structurally refuses to raise (it re-records the SMALLER of ' +
+            'old and current, never the current alone) — a rule at its exception is not thereby ' +
+            'correct, only not worse. `missing` and `no_trigger` are LIST membership: an id SHOULD ' +
+            'only leave, never join, but that is a review convention the generator does not enforce ' +
+            'by construction — `--write-baseline` re-records every id that currently fails ' +
+            'presence/trigger, full stop, so a newly-broken rule is swept in exactly like a ' +
+            'genuinely-fixed one is swept out. The `stale-baseline-entry` finding makes a fixed id ' +
+            'visible for removal; nothing makes a newly-broken id visible for refusal except a human ' +
+            'reading the diff. Regenerate with `lint_rule_law_section --write-baseline`; never ' +
+            'hand-edit the counts, but DO hand-edit `owner`, `review` and `reason` — those are the ' +
+            'review contract and the generator only seeds them.',
         measured_at_commit: prev.measured_at_commit ?? '',
+        no_trigger,
         missing,
         law_exceptions,
         body_exceptions,
@@ -339,7 +423,7 @@ interface Args {
 }
 
 const USAGE =
-    'usage: lint_rule_law_section [--axis presence|ceiling|body-ceiling|all] [--quiet] ' +
+    'usage: lint_rule_law_section [--axis presence|ceiling|body-ceiling|trigger|all] [--quiet] ' +
     '[--write-baseline] [--root DIR] [--self-test]\n';
 
 function parseArgs(argv: string[]): Args {
@@ -381,7 +465,7 @@ function parseArgs(argv: string[]): Args {
             process.exit(2);
         }
     }
-    if (!['presence', 'ceiling', 'body-ceiling', 'all'].includes(out.axis)) {
+    if (!['presence', 'ceiling', 'body-ceiling', 'trigger', 'all'].includes(out.axis)) {
         process.stderr.write(USAGE);
         process.stderr.write(`lint_rule_law_section: error: unknown axis: ${out.axis}\n`);
         process.exit(2);
@@ -402,23 +486,45 @@ export function selfTest(write: (s: string) => void = (s) => process.stdout.writ
         fs.mkdirSync(path.join(tmp, 'dist'), { recursive: true });
         fs.writeFileSync(
             path.join(tmp, ROUTER_REL),
-            JSON.stringify({ kernel: [], tier_1: [{ id: 'lawless' }, { id: 'lawful' }], tier_2: [] }),
+            JSON.stringify({
+                kernel: [],
+                tier_1: [
+                    { id: 'lawless', triggers: [{ keyword: 'lawless-word' }] },
+                    { id: 'lawful', triggers: [{ keyword: 'lawful-word' }] },
+                    { id: 'mute', triggers: [] },
+                    { id: 'vocal', triggers: [{ keyword: 'vocal-word' }] },
+                ],
+                tier_2: [],
+            }),
         );
         fs.writeFileSync(
             path.join(tmp, CONFIG_REL),
-            JSON.stringify({ missing: [], law_exceptions: {}, body_exceptions: {} }),
+            JSON.stringify({ missing: [], no_trigger: [], law_exceptions: {}, body_exceptions: {} }),
         );
         fs.writeFileSync(path.join(tmp, 'src/rules/lawless.md'), '---\nx: 1\n---\n\n# Lawless\n\nProse.\n');
         fs.writeFileSync(
             path.join(tmp, 'src/rules/lawful.md'),
             '---\nx: 1\n---\n\n# Lawful\n\n## The Iron Law\n\nNEVER DO THE THING.\n',
         );
+        fs.writeFileSync(
+            path.join(tmp, 'src/rules/mute.md'),
+            '---\nx: 1\n---\n\n# Mute\n\n## The Iron Law\n\nNEVER DO THE THING.\n',
+        );
+        fs.writeFileSync(
+            path.join(tmp, 'src/rules/vocal.md'),
+            '---\nx: 1\n---\n\n# Vocal\n\n## The Iron Law\n\nNEVER DO THE THING.\n',
+        );
 
         const rejecting = lint(tmp, 'presence');
         const accepting = (() => {
             fs.writeFileSync(
                 path.join(tmp, CONFIG_REL),
-                JSON.stringify({ missing: ['lawless'], law_exceptions: {}, body_exceptions: {} }),
+                JSON.stringify({
+                    missing: ['lawless'],
+                    no_trigger: [],
+                    law_exceptions: {},
+                    body_exceptions: {},
+                }),
             );
             return lint(tmp, 'presence');
         })();
@@ -426,12 +532,36 @@ export function selfTest(write: (s: string) => void = (s) => process.stdout.writ
             rejecting.findings.length === 1 &&
             rejecting.findings[0]?.kind === 'no-law-section' &&
             accepting.findings.length === 0;
+
+        // Same rejecting/accepting shape for the trigger axis (step 3.4):
+        // `mute` has a law but no trigger and is unbaselined, `vocal` has both.
+        const triggerRejecting = lint(tmp, 'trigger');
+        const triggerAccepting = (() => {
+            fs.writeFileSync(
+                path.join(tmp, CONFIG_REL),
+                JSON.stringify({
+                    missing: ['lawless'],
+                    no_trigger: ['mute'],
+                    law_exceptions: {},
+                    body_exceptions: {},
+                }),
+            );
+            return lint(tmp, 'trigger');
+        })();
+        const triggerOk =
+            triggerRejecting.findings.map((f) => f.id).sort().join(',') === 'mute' &&
+            triggerRejecting.findings.every((f) => f.kind === 'no-trigger') &&
+            triggerAccepting.findings.length === 0;
+
+        const allOk = ok && triggerOk;
         write(
-            ok
-                ? '✅  self-test: 1 rejecting case, 1 accepting case — the reading decides the verdict\n'
-                : `❌  self-test FAILED: rejecting=${rejecting.findings.length} accepting=${accepting.findings.length}\n`,
+            allOk
+                ? '✅  self-test: presence + trigger axes each have a rejecting and an accepting case\n'
+                : `❌  self-test FAILED: presence rejecting=${rejecting.findings.length} ` +
+                      `accepting=${accepting.findings.length}; trigger rejecting=` +
+                      `${triggerRejecting.findings.length} accepting=${triggerAccepting.findings.length}\n`,
         );
-        return ok ? 0 : 1;
+        return allOk ? 0 : 1;
     } finally {
         fs.rmSync(tmp, { recursive: true, force: true });
     }

package/src/scripts/lint_rule_skill_pack_reach.ts

@@ -35,6 +35,23 @@
  * the wizard may offer it and the user may decline, so an invariant that
  * counted it would pass on installs that do not exist.
  *
+ * SIBLING GATE, OPPOSITE READING, SAME REASONING (2026-10-09). Since D5 of
+ * `road-to-gates-a-pull-request-can-hear`, `lint_pack_boundaries` DOES read
+ * `suggests` — as permitting a cross-pack link. That is not a contradiction of
+ * the paragraph above, and the discriminator is the direction of the claim
+ * each gate makes:
+ *
+ *   - THIS gate asserts a route WILL RESOLVE on the installs it covers.
+ *     Counting an advisory edge would assert resolution on installs that may
+ *     not exist — a false negative in the dangerous direction.
+ *   - The boundary gate reports a link that MAY DANGLE. An advisory edge is
+ *     the author stating they accept the dangle for a declining consumer, so
+ *     reading it there downgrades a finding the author has already answered.
+ *
+ * Practical consequence, stated because it is the mistake the asymmetry
+ * invites: adding a `suggests` edge does NOT clear an `unreachable-route`
+ * finding here. It never will. Fix the route or accept the finding.
+ *
  * ADVISORY UNTIL ITS FINDING SET IS EMPTY, AND THE FIRST RUN SAYS WHY.
  * Measured on introduction: 12 `unreachable-route` and 14 `unrouted-skill`
  * findings across 116 rules. The UI pair is one instance of an estate-wide

package/src/scripts/lint_settings_classes.ts

@@ -604,7 +604,7 @@ function main(): number {
     for (const [removedKey, reason] of REMOVED_KEYS) {
         if (reason.trim() === '') {
             findings.push(
-                `src/scripts/_lib/agent_settings.ts  \`${removedKey}\` is in REMOVED_KEYS with an empty ` +
+                `src/scripts/_lib/settings_removed_keys.ts  \`${removedKey}\` is in REMOVED_KEYS with an empty ` +
                     'reason — name what decides instead, not that it is gone.',
             );
         }

package/src/scripts/lint_ticked_unmet_criteria.ts

@@ -0,0 +1,165 @@
+#!/usr/bin/env tsx
+/**
+ * Reports an acceptance criterion ticked over its own "NOT met".
+ *
+ * A `- [x] AC-<n>` item whose own text says a half of it `is NOT met` is a
+ * contradiction a reader of the checkbox never sees: the glyph says done, the
+ * prose says not. The honest glyph is `[~]`, which carries the unmet half as a
+ * deferral rather than hiding it under a tick.
+ *
+ * The criterion's text is the bullet line plus its indented continuation lines,
+ * up to a blank line, a less-indented line or the next checkbox. Fenced code is
+ * skipped, so a quoted example is not a finding. The match is the literal
+ * `NOT met` — upper-case on purpose, because that is how an author marks the
+ * unmet half, and a lower-case "not met" inside an explanation is prose.
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/lint_ticked_unmet_criteria
+ *   ./scripts-run src/scripts/lint_ticked_unmet_criteria --root <repo>
+ *
+ * Scans every `*.md` under the roadmap tree, archive included: an archived
+ * roadmap is exactly where a contradictory tick outlives the session that
+ * made it.
+ *
+ * Exit codes: 0 no hit · 1 at least one hit · 2 usage error.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { reportScanned } from './_lib/scan_scope.js';
+
+interface Hit {
+    file: string;
+    line: number;
+    criterion: string;
+}
+
+const TICKED_AC_RE = /^([ \t]*)[-*][ \t]+\[[xX]\][ \t]+(AC-[\w.-]+)/;
+const CHECKBOX_RE = /^[ \t]*[-*][ \t]+\[[ xX~-]\]/;
+const FENCE_RE = /^[ \t]*(```|~~~)/;
+const UNMET = 'NOT met';
+
+function _indent(line: string): number {
+    return (/^[ \t]*/.exec(line)?.[0] ?? '').length;
+}
+
+function scanText(text: string, file: string): Hit[] {
+    const lines = text.split('\n');
+    const hits: Hit[] = [];
+    let inFence = false;
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i] as string;
+        if (FENCE_RE.test(line)) {
+            inFence = !inFence;
+            continue;
+        }
+        if (inFence) {
+            continue;
+        }
+        const m = TICKED_AC_RE.exec(line);
+        if (!m) {
+            continue;
+        }
+        const base = (m[1] as string).length;
+        const block = [line];
+        for (let j = i + 1; j < lines.length; j += 1) {
+            const next = lines[j] as string;
+            if (next.trim() === '' || CHECKBOX_RE.test(next) || FENCE_RE.test(next) || _indent(next) <= base) {
+                break;
+            }
+            block.push(next);
+        }
+        if (block.join('\n').includes(UNMET)) {
+            hits.push({ file, line: i + 1, criterion: m[2] as string });
+        }
+    }
+    return hits;
+}
+
+function _walk(dir: string): string[] {
+    let entries: fs.Dirent[];
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+        return [];
+    }
+    const out: string[] = [];
+    for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+            out.push(..._walk(full));
+        } else if (e.isFile() && e.name.endsWith('.md')) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+
+function scanTree(root: string): { hits: Hit[]; scanned: number } {
+    const files = _walk(path.join(root, 'agents', 'roadmaps'));
+    const hits: Hit[] = [];
+    for (const abs of files) {
+        const rel = path.relative(root, abs).split(path.sep).join('/');
+        hits.push(...scanText(fs.readFileSync(abs, 'utf8'), rel));
+    }
+    return { hits, scanned: files.length };
+}
+
+const _DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+
+function main(argv: string[] = process.argv.slice(2)): number {
+    let root = _DEFAULT_ROOT;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--root') {
+            const v = argv[i + 1];
+            if (v === undefined) {
+                process.stderr.write('lint_ticked_unmet_criteria: --root requires a value\n');
+                return 2;
+            }
+            root = path.resolve(v);
+            i += 1;
+        } else {
+            process.stderr.write(`lint_ticked_unmet_criteria: unknown argument: ${String(arg)}\n`);
+            return 2;
+        }
+    }
+    const { hits, scanned } = scanTree(root);
+    reportScanned({
+        gate: 'lint_ticked_unmet_criteria',
+        scanned,
+        units: 'roadmap file(s)',
+        roots: ['agents/roadmaps'],
+        allowEmpty: 'EMPTY_VALID: a checkout with no roadmap has no criterion to tick',
+    });
+    if (hits.length === 0) {
+        process.stdout.write(`✅  lint_ticked_unmet_criteria: ${String(scanned)} roadmap file(s), no criterion ticked over "${UNMET}".\n`);
+        return 0;
+    }
+    process.stderr.write(
+        `❌  lint_ticked_unmet_criteria: ${String(hits.length)} criterion/criteria ticked [x] over their own "${UNMET}":\n`,
+    );
+    for (const h of hits) {
+        process.stderr.write(`  ${h.file}:${String(h.line)} · ${h.criterion}\n`);
+    }
+    process.stderr.write('\n    The unmet half is a deferral: use `[~]` and carry it, or meet it.\n');
+    return 1;
+}
+
+if (process.argv[1] !== undefined) {
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv1 = fs.realpathSync(path.resolve(process.argv[1]));
+        if (here === argv1) {
+            process.exit(main());
+        }
+    } catch {
+        if (import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+            process.exit(main());
+        }
+    }
+}
+
+export { scanText, scanTree, main };
+export type { Hit };

package/src/scripts/lint_workflow_security.ts

@@ -28,6 +28,9 @@
  * TIERS are untouched; only the description of what MEDIUM covers now matches
  * the code. Re-tiering the locked model is a separate decision, recorded as
  * unresolved in agents/evidence/analysis/workflow-security-net-degraded-decision.md.
+ * The CI INVOCATION is decided there too: since 2026-10-07 consistency.yml runs
+ * this gate under `--strict` (AI council, 2/2), so a HIGH fails a pull request;
+ * the tiers are unchanged.
  *
  * Script-injection detection (regex-based) is intentionally deferred — it
  * requires an AST-aware pass to avoid false positives on quoted / escaped
@@ -805,7 +808,9 @@ export function main(argv?: string[]): number {
         );
         if (high.length || medium.length) {
             process.stdout.write(
-                '  (warn-only — run with --strict to make HIGH findings block CI)\n',
+                args.strict
+                    ? '  (--strict — HIGH findings fail this run; MEDIUM stays advisory)\n'
+                    : '  (warn-only — run with --strict to make HIGH findings block CI)\n',
             );
         } else {
             process.stdout.write('  no non-allowlisted findings\n');
@@ -813,6 +818,12 @@ export function main(argv?: string[]): number {
     }
 
     if (args.strict && high.length) {
+        if (args.quiet) {
+            // --quiet suppresses the report; a failing run still names its cause.
+            process.stderr.write(
+                `workflow-security: ${high.length} HIGH under --strict — rerun without --quiet for the findings\n`,
+            );
+        }
         return 1;
     }
     return 0;

package/src/scripts/measure_skill_ranker_baseline.ts

@@ -495,6 +495,11 @@ export const RANKER_LABELS: Readonly<Record<string, RankOptions>> = {
     headings: { includeHeadings: true },
     idf: { idfWeighting: true },
     'idf+when-to-use': { idfWeighting: true, includeWhenToUse: true },
+    // `road-to-a-ranker-whose-ties-break-on-signal` Phase 3: the order inside a
+    // block of equal integer scores, alone and over the one weighting that
+    // makes the unrounded score vary.
+    ties: { tieBreakUnrounded: true },
+    'idf+ties': { idfWeighting: true, tieBreakUnrounded: true },
 };
 
 /**

package/src/scripts/model_rule_injection.ts

@@ -617,7 +617,7 @@ export function runEndpoints(corpusDir: string): EndpointResult[] {
     let deliveries = 0;
     let unequal = 0;
     for (const c of positives) {
-        const injection = buildInjection(REPO_ROOT, c.prompt, c.openFiles, null, new Set());
+        const injection = buildInjection(REPO_ROOT, c.prompt, c.openFiles, null, new Set(), false);
         if (injection === null) continue;
         for (const id of injection.rules) {
             const projected = loadRuleBody(REPO_ROOT, id);
@@ -803,12 +803,12 @@ export function runSelftest(corpusDir: string): SelftestCase[] {
     const probe = cases.find(
         (c) =>
             c.label === 'positive' &&
-            buildInjection(REPO_ROOT, c.prompt, c.openFiles, null, new Set()) !== null,
+            buildInjection(REPO_ROOT, c.prompt, c.openFiles, null, new Set(), false) !== null,
     );
     const injection =
         probe === undefined
             ? null
-            : buildInjection(REPO_ROOT, probe.prompt, probe.openFiles, null, new Set());
+            : buildInjection(REPO_ROOT, probe.prompt, probe.openFiles, null, new Set(), false);
     if (injection === null || injection.rules.length === 0) {
         out.push({
             endpoint: 'a-delivery',

package/src/scripts/onboarding_gate_hook.ts

@@ -10,7 +10,7 @@
  * deterministic state file the rule body can cite as the source of
  * truth for "do I need to prompt the user about /onboard?".
  *
- * Output is written to `agents/runtime/state/onboarding-gate.json` with:
+ * Output is written to `agents/state/onboarding-gate.json` with:
  *   {
  *     "required": <bool>,         // true → rule fires on first turn
  *     "reason":   "<string>",     // why this state was set
@@ -33,8 +33,9 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 // Re-use the shared atomic-write helper so concerns honour the single
-// `agents/runtime/state/.dispatcher.lock` discipline (hook-architecture-v1.md
-// § Concurrency, Phase 7.4).
+// `agents/state/.dispatcher.lock` discipline (hook-architecture-v1.md,
+// Concurrency, Phase 7.4) — the lock sits beside THIS hook's own target, not
+// the fixed `agents/runtime/state/` path the discipline cites generally.
 import { atomic_write_json } from "./hooks/state_io.js";
 import { readHookStdin } from "./hooks/hook_stdin.js";
 
@@ -153,11 +154,11 @@ function _now_iso(): string {
 }
 
 /**
- * Write `agents/runtime/state/onboarding-gate.json` atomically.
+ * Write `agents/state/onboarding-gate.json` atomically.
  *
- * Uses the shared `agents/runtime/state/.dispatcher.lock` so concurrent
+ * Uses the shared `agents/state/.dispatcher.lock` so concurrent
  * dispatcher invocations across platforms cannot tear the file
- * (hook-architecture-v1.md § Concurrency, Phase 7.4).
+ * (hook-architecture-v1.md, Concurrency, Phase 7.4).
  */
 function _write_state(
   consumer_root: string,

package/src/scripts/print_required_checks.ts

@@ -63,6 +63,8 @@ const DOCS_ONLY_ALLOWED_TOP: ReadonlySet<string> = new Set([
 
 // Check names below are the strings GitHub actually REPORTS, verified against
 // `gh pr checks 1108` on 2026-08-02 (road-to-renewal-foundation Phase 1).
+// `Standing payload delta + budget gate` was added to all three shapes on
+// 2026-10-07, when it was found required by the ruleset and absent here.
 //
 // They previously named a matrix that had drifted into fiction — `Consistency`,
 // `Skill Lint`, `Tests / install-tests`, `Tests / node-tests`,
@@ -79,6 +81,7 @@ const DOCS_ONLY_ALLOWED_TOP: ReadonlySet<string> = new Set([
 // change — the exact failure this reconciliation removed.
 const FEATURE_CHECKS = [
     'Sync + Generate Tools Consistency',
+    'Standing payload delta + budget gate',
     'Smoke — kernel',
     'Smoke — router',
     'Smoke — schema',
@@ -98,6 +101,7 @@ const FEATURE_CHECKS = [
 
 const RELEASE_CHECKS = [
     'Sync + Generate Tools Consistency',
+    'Standing payload delta + budget gate',
     'Smoke — kernel',
     'Smoke — router',
     'Smoke — schema',
@@ -112,6 +116,7 @@ const RELEASE_CHECKS = [
 
 const DOCS_ONLY_CHECKS = [
     'Sync + Generate Tools Consistency',
+    'Standing payload delta + budget gate',
     'Smoke — kernel',
     'Smoke — router',
     'Smoke — schema',
@@ -120,8 +125,11 @@ const DOCS_ONLY_CHECKS = [
 
 /**
  * The checks that mechanically BLOCK a merge, per the repository ruleset
- * `main protection` (id 17749383). Everything else above runs and is visible
- * on the PR but does not gate the merge button.
+ * `main protection` (id 17749383), read on 2026-10-07: two required status
+ * contexts, the second added on 2026-09-11 (ADR-276, recorded by #2169).
+ * Everything else above runs and is visible on the PR but does not gate the
+ * merge button. `standing-payload-delta.yml` runs on every `pull_request`, so
+ * the second context appears in all three shapes.
  *
  * Deliberately a constant, not an API read: this script is contractually
  * offline ("never invokes `gh`, never touches the network"). Re-verify with
@@ -129,7 +137,10 @@ const DOCS_ONLY_CHECKS = [
  * changes — `docs/contracts/branch-protection-policy.md` § Change discipline
  * owns that procedure.
  */
-const ENFORCED_CHECKS = ['Sync + Generate Tools Consistency'] as const;
+const ENFORCED_CHECKS = [
+    'Sync + Generate Tools Consistency',
+    'Standing payload delta + budget gate',
+] as const;
 
 /** `git rev-parse --abbrev-ref HEAD`, mirroring `_git(check=True)`. */
 function current_branch(): string {
@@ -314,6 +325,7 @@ export {
     FEATURE_CHECKS,
     RELEASE_CHECKS,
     DOCS_ONLY_CHECKS,
+    ENFORCED_CHECKS,
     current_branch,
     diff_files,
     is_docs_only,