@event4u/agent-config 16.3.0 → 16.5.0

package/dist/agent-src/skills/git-workflow/references/commit-subject.md

@@ -0,0 +1,205 @@
+# The ticket, the commit subject and the branch name
+
+Detail for [`git-workflow`](../SKILL.md) and
+[`conventional-commits-writing`](../../conventional-commits-writing/SKILL.md).
+The one place that says how a ticket is read out of a branch name, where it goes
+in a commit subject, which convention is in force, and how a branch name is
+rendered. `/commit`, `/commit:in-chunks`, `/fix:commit-messages`,
+`/create-pr:description-only`, `/worktree:create` and the `jira-integration`
+skill defer here.
+
+The rules are code: `agent-config git:convention` runs them, and the commands
+call it. This page is what a command reads **when the verb cannot run** — no
+`agent-config` on `PATH`, or exit `2` for a usage or unknown-verb error. Then
+apply the generated block below by reading, say once that the verb was
+unavailable, and never invent a grammar the block does not show. Exit `2` with
+`no subjects on stdin — the verb ran` is not that case: the verb ran and
+received nothing, so pipe the subjects again rather than falling back.
+
+## Reading the ticket
+
+`agent-config git:convention ticket [BRANCH] [--keys "<line>"]` — the current
+branch when `BRANCH` is omitted. It prints `ticket <ID>` or `ticket none`, then
+every candidate with its status:
+
+- **Every match counts**, in order, wherever it sits (`feat/DEV-1234/...`,
+  `DEV-1234-device-export`, `fix/DEV-1234-quantity` → `DEV-1234`). The match
+  never depends on `git.branch_pattern`, so a branch named before the pattern was
+  set still yields its ticket. The first candidate with status `ticket` wins.
+- **`standard-name`** — a key in the denylist (`UTF-8`, `ISO-8601`, `SHA-256`,
+  `CVE-2026-12345`, `CWE-79`) is never a ticket, with or without a card:
+  `fix/CVE-2026-12345-patch` yields none.
+- **`version-like`** — without a card, a protocol or language name followed
+  by a one-digit number (`HTTP-2`, `PHP-8`; the list is the `version-like names`
+  row below) is a major version, not a ticket: `feat/HTTP-2-support` yields
+  none. Two or more digits (`PHP-12`) read as a ticket, and a card that lists
+  the key keeps it a ticket.
+- **Case** — without a card only an upper-case key is detected, so
+  `feat/dev-12-export` yields none. With `--keys`, a key written in any case is
+  matched against the card and reported upper-cased (`dev-12` → `DEV-12`).
+- **`unknown-key`** — `--keys` takes the `ticket_keys` line of the approved
+  convention card (`agents/memory/curated/conventions/approved/commit-subject.md`,
+  see the [`conventional-commits-writing`](../../conventional-commits-writing/SKILL.md)
+  skill § 4), as the caller reads it. A candidate whose key is not on it is
+  asked about by `/commit` — a yes adds the key to the card — and omitted by
+  `/commit:in-chunks`. Without a card the grammar, the denylist and the
+  version-like names decide alone.
+- **`proposal`** — without `--keys`, a commitlint config's `issuePrefixes` are
+  printed as a proposed `ticket_keys` line. Offer it; the verb writes nothing.
+
+## Placing the ticket
+
+| `git.commit_format` | With a ticket | Without a ticket |
+|---|---|---|
+| `ticket-scope` (default) | `feat(DEV-1234): add export filter` | `feat: add export filter` — never `feat(): …` |
+| `ticket-conventional` | `DEV-1234 feat(exporter): add export filter` | `feat(exporter): add export filter` |
+
+Under `ticket-conventional` **a ticket is never in the scope** — not as the
+scope, not inside a compound one (`feat(api,DEV-1234)` fails). The scope names
+the system area (`api/audio`, `ci`), only where it adds clarity.
+
+**Under an approved family** (the card's `dominant_family`) the ticket is
+optional, as under `ticket-conventional`: with a ticket it stands in the
+family's leading position (`[DEV-1234] Add export filter`), without one the
+subject is the family's form without the ticket part (`Add export filter`), and
+a ticket anywhere else fails. A branch without a ticket is therefore never a
+stop under a card.
+
+Git's own `fixup!`, `squash!`, `amend!` and `Revert "…"` subjects are valid under
+both `git.commit_format` values and under every family: git writes them itself,
+so the same rule holds everywhere a subject is checked.
+
+**Area scope under `/commit:in-chunks`.** Several commits on one branch carry the
+same ticket in front of each; the scope is chosen per commit from the area that
+commit touches, and dropped where no single area fits. A chunk never inherits
+another chunk's scope.
+
+## Which convention is in force
+
+`agent-config git:convention subject` reads subjects on stdin, one per line, and
+resolves the convention in this order — the first that applies decides:
+
+1. **A declaration** — `git.commit_format` in `.git-convention.yml` (either
+   value; ADR-283), or a developer settings file value other than the template
+   default. The rule is one for both values: `settings:sync` writes the
+   template default into every project file, so a default there cannot be told
+   apart from an insert and never outranks an approved card, whichever value
+   the default is; today that makes `ticket-conventional` the only developer
+   value that counts.
+2. **An approved measurement** — the card's `dominant_family`.
+3. **The default** — Conventional Commits (`ticket-scope`).
+
+When the third case decides — no declaration and no approved card — and the
+repository has no commitlint config, `subject` and `show` add the line `no convention established — run git:convention measure`
+(`convention_established: false` under `--json`); the exit is unchanged.
+A commitlint config is the repository's own subject validator, so it
+establishes the convention: no such line, and `measure` says the config governs.
+`agent-config git:convention measure [--limit N] [--family F] [--json]` then reads
+the history of the default branch — the one the server names, else
+`refs/remotes/origin/HEAD`; with neither it samples nothing, exits 1 and says so
+(`trunk_unresolved` under `--json`) rather than guess one. It proposes a subject family when one clears the `measure bar` row
+of the block below, otherwise names the two strongest; it proposes a
+`branch_pattern` from the remote branch names, or `no clear pattern`; and it
+shows the observed update style, which is never adopted. Where the chosen family
+maps to a `git.commit_format` value or a pattern was proposed, it prints the
+ready-to-commit content of `.git-convention.yml` (`commit_format`,
+`branch_pattern`, never `update_strategy`); the verb writes nothing. A human
+creates and commits that file, or, on the user's yes this turn,
+`agent-config git:convention init --yes [--commit-format F] [--branch-pattern P]`
+creates it once — never over an existing carrier, never `update_strategy`, and
+uncommitted (ADR-283 § Creation). `/commit` asks the user once and writes the answer
+to the approved card.
+
+A repository validator — a `commit-msg` hook, a commitlint config (any of its
+config files, or a `commitlint` key in the package manifest) — does not decide, and
+the verb never guesses what it accepts: a hook's existence says nothing about
+what it checks, and a config is only known by running it. Each one found adds a
+`note:` line (and a `notes` entry under `--json`) saying it also runs at commit
+time and may be stricter; the exit is the verdict of the order above alone. A
+hook counts only where git will run it — the path git resolves, so
+`core.hooksPath` is respected and `.husky/commit-msg` counts only when
+`core.hooksPath` points at `.husky`. When the validator rejects a commit the
+verb passed, the rejection is the answer: fix the subject or settle the two in
+`.git-convention.yml`.
+
+A format that cannot be read (`malformed`, `invalid`, `discarded`), or an
+approved family with no grammar, exits `1` with the line that says why; it is
+never read as the default.
+Exit `1` also lists each failing subject with the rule it broke. Exit `2` is a
+usage error; an empty stdin is one, and says `the verb ran`. How a family is measured and approved is the
+[`conventional-commits-writing`](../../conventional-commits-writing/SKILL.md)
+skill's procedure; this page only consumes its card.
+
+## A title that becomes a commit
+
+Where the forge squash-merges — the method `/pr:merge` § 9 reads — the pull
+request title becomes the commit subject on the base, so `/create-pr:description-only`
+§ 3 builds it as a subject in the convention in force and checks it through
+`git:convention subject`, for `ticket-scope` as well as for `ticket-conventional`.
+Under any other merge method the title stays `DEV-1234: summary`.
+
+## Rendering a branch name
+
+`agent-config git:convention branch --slug <slug> [--type <type>] [--ticket <ID>]`
+renders `git.branch_pattern` (default `{type}/{slug}`) and prints the name:
+
+- an empty placeholder drops with the separator after it, or the one before it
+  when it is last (`{ticket}-{slug}` without a ticket → `<slug>`);
+- a ticket the pattern has no slot for prefixes the slug
+  (`{type}/{slug}` → `feat/DEV-1234-export`);
+- a literal character of the pattern is never rewritten, and a value outside
+  `[A-Za-z0-9._-]` is refused (exit `1`), not repaired.
+
+A guideline that shows another shape, such as `{type}/{ticket-id}/{short-description}`,
+describes a team habit; the name the agent creates follows the declared pattern.
+
+## The grammar
+
+<!-- BEGIN GENERATED: git-convention-grammar -->
+<!-- Written by `./scripts-run src/scripts/generate_git_convention_grammar` from `src/scripts/_lib/git_convention_grammar.ts` and `src/scripts/_lib/git_convention_measure.ts`; edit the modules, never this block. -->
+
+```
+ticket                                 [A-Z][A-Z0-9]+-[0-9]+
+ticket in text                         (?<![A-Za-z0-9])[A-Z][A-Z0-9]+-[0-9]+(?![0-9])
+standard names                         UTF ISO SHA RFC CVE CWE GHSA
+version-like names                     HTTP HTTPS TLS SSL OAUTH PHP PYTHON JAVA JDK NODE ES HTML CSS (one-digit number, no card)
+format ticket-scope                    ^(feat|fix|chore|docs|refactor|test|perf|style|build|ci|revert)(\([^)]+\))?!?: .+
+format ticket-conventional             ^([A-Z][A-Z0-9]+-[0-9]+ )?(feat|fix|chore|docs|refactor|test|perf|style|build|ci|revert)(\([^)]+\))?!?: .+
+family conventional                    ^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([^)]+\))?!?: 
+family ticket-conventional             ^[A-Z][A-Z0-9]+-[0-9]+ (build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([^)]+\))?!?: 
+family ticket-prefix                   ^\[[A-Z][A-Z0-9]+-[0-9]+\][: ]|^[A-Z][A-Z0-9]+-[0-9]+[: ]
+family gitmoji                         ^:[a-z0-9_+-]+:[[:space:]]|^[^ -~[:cntrl:][:space:]]
+family imperative-plain                ^[A-Z][a-z]+[[:space:]].*[^.]$
+family ticket-prefix, no ticket        ^\S.* (no ticket elsewhere in the subject)
+family ticket-conventional, no ticket  ^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([^)]+\))?!?:  (no ticket elsewhere in the subject)
+any format or family                   ^((fixup|squash|amend)! .+|Revert ".+")$ (git's own subjects)
+measure sample                         newest 200 non-merge commits since 24 months ago, or regardless of age when that window yields fewer than 30; bots, automation subjects, commits over 500 files dropped
+measure bar                            n >= 30; >= 80 % capped at 20 per author per half (3+ authors), else >= 90 % uncapped; both halves agree
+measure migration                      the newer half, or the newest 30 commits, clearing the bar on another family than the dominant one: "migrating to <family>", and that family is proposed
+measure branches                       >= 10 remote branch names, top shape >= 80 %
+```
+
+Formats are JavaScript / PCRE syntax; families are POSIX extended, matched in
+order, first hit wins. Under `format ticket-conventional` and `family
+ticket-conventional` a ticket anywhere inside the scope fails, and a standard
+name in the ticket position fails. A ticket is found in a branch or scope only as
+a whole token (`ticket in text`). Without a card, a version-like name — one of
+the keys above with a one-digit number, such as `HTTP-2` or `PHP-8` — is not a
+ticket; `HTTP2-1` still has the ticket shape. A convention card's `ticket_keys`
+settles both, and matches a key written in lower case; without a card a
+lower-case key is never detected.
+<!-- END GENERATED: git-convention-grammar -->
+
+## Patterns that are not this grammar
+
+- **Suggester metadata.** The `trigger_context:` frontmatter of
+  `src/domains/engineering-base/implement-ticket/command.md` and
+  `src/domains/product-basic/estimate-ticket/command.md`, and the same literal in
+  `src/scripts/migrate_command_suggestions.ts`, match a bare-key ticket in a
+  prompt to decide when a command is suggested. They keep their own pattern:
+  changing it changes when a command is offered.
+- **The suggester's matcher.** `src/scripts/command_suggester/match.ts` carries
+  the ticket grammar above; a test pins the two equal.
+- **A project key in a ticket body.** `src/scripts/refine_ticket_detect.ts` reads
+  a project key out of ticket text, not a branch, and is intentionally
+  independent.

package/dist/agent-src/skills/iconography/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: iconography
-description: "Resolve an icon request to a concrete Iconify name and emit the embedding for the project's stack. Use when adding icons, picking an icon set, or wiring Lucide/Heroicons/Phosphor/Tabler."
+description: "Resolve an icon request to an Iconify name and emit the stack's embedding. Use when adding icons, picking an icon set, or wiring Lucide/Heroicons/Phosphor/Tabler."
 domain: product
 personas: []
 workspaces:
@@ -102,7 +102,9 @@ Inspect stage of the
 - **No hand-rolled icons when a set exists.** If the project has an icon library
   or brand mark, use it — do not hand-author a one-off SVG that drifts from the
   system. Hand-rolling is for a genuinely missing glyph, and then it matches the
-  set's grid + stroke.
+  set's grid + stroke — read the grid, stroke and padding off the set's OWN
+  SVGs and author it under [`svg-authoring`](../svg-authoring/SKILL.md), which
+  checks the result instead of trusting that it matched.
 - **Flag substitutions when the exact asset is absent.** When the needed icon or
   brand mark does not exist in the set, pick the nearest and **state the
   substitution** ("no exact 'sync' glyph in Heroicons; used `arrow-path`") rather

package/dist/agent-src/skills/image-provider-routing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: image-provider-routing
-description: "Select the right image-generation provider from job shape — text-in-image to Ideogram, photoreal to Flux, vector/logo to Recraft, general to Gemini/GPT."
+description: "Pick the image provider from job shape — text-in-image to Ideogram, photoreal to Flux, illustrative vector to Recraft, general to Gemini/GPT."
 domain: product
 personas: []
 workspaces:
@@ -37,13 +37,24 @@ promotion per `provider-lifecycle-discipline`.
 |---|---|---|
 | Text-in-image (logo, banner, typographic art) | **Ideogram** | Best glyph rendering; raster models garble text |
 | Photoreal (product shot, portrait, scene) | **Flux** | Photorealism specialist; routed via fal/Replicate |
-| Vector / SVG logo or icon | **Recraft** | Produces genuine `<path>` SVG; raster cannot |
+| Icon the set lacks | `iconography` first, then [`svg-authoring`](../svg-authoring/SKILL.md) | The incumbent set wins; a missing glyph is hand-authored against its grid and checked — no provider involved |
+| Simple geometric mark | [`svg-authoring`](../svg-authoring/SKILL.md) | A `rect`/`circle`/`path` mark is cheaper and more editable hand-authored than generated, and it ends in a file rather than a plan |
+| Complex illustrative vector art | **Recraft** | The only job shape left for a vector provider. State the adapter's lifecycle in the answer: `experimental — scaffold tier, dry-run plumbing only`, so the caller knows no asset is produced |
 | General art / edit / multimodal | **Gemini-image** or **GPT Image 2** | Broad capability; natural-language prompts |
 | Budget-conscious 4K upscale | Flux via Replicate | Cost-competitive at high resolution |
 
-Decision order: text-in-image → Ideogram; must-be-vector → Recraft; photoreal → Flux;
-everything else → Gemini-image (default) or GPT Image 2 (when OpenAI key available
-and editing an existing image).
+Decision order: an icon → the incumbent set, then `svg-authoring` for a missing
+glyph; a simple geometric mark → `svg-authoring`; text-in-image → Ideogram;
+complex illustrative vector art → Recraft, with its scaffold-tier lifecycle
+stated; photoreal → Flux; everything else → Gemini-image (default) or GPT
+Image 2 (when an OpenAI key is available and an existing image is being edited).
+
+The split exists because the single "Vector / SVG logo or icon" row sent every
+icon and every geometric mark to an adapter whose header reads `experimental —
+scaffold tier. dry-run plumbing only` and whose live calls exit at
+the adapter's own live-call guard. The routed path ended in a plan;
+the icon floor meanwhile sent icons to the set. Neither produced an asset for
+the one case that needs one — a glyph the set does not have.
 
 ## Procedure
 

package/dist/agent-src/skills/jira-integration/SKILL.md

@@ -54,7 +54,7 @@ fix/DEV-5678/null-pointer         →  DEV-5678
 hotfix/DEV-999/critical-fix       →  DEV-999
 ```
 
-Pattern: `[A-Z]+-[0-9]+` anywhere in the branch name.
+Read it with `agent-config git:convention ticket` — [`commit-subject`](../git-workflow/references/commit-subject.md) § Reading the ticket.
 
 Use `git branch --show-current` to detect, then fetch the ticket:
 
@@ -147,8 +147,8 @@ POST /issue/DEV-1234/transitions
 ## Linking to PRs
 
 When creating PRs, include the Jira ticket in:
-- **Branch name:** `feat/DEV-1234/description`
-- **PR title:** `feat(DEV-1234): description`
+- **Branch name and PR title:** rendered by `agent-config git:convention branch` and
+  built per [`commit-subject`](../git-workflow/references/commit-subject.md)
 - **PR description:** Link to the ticket
 
 ## Related

package/dist/agent-src/skills/logo-generation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: logo-generation
-description: "Generate a logo or brand mark — structured prompt + provider routing, with a true-vector path (vector-native provider or LLM-authored SVG). Use for logo or brand mark generation."
+description: "Generate a logo or brand mark — structured prompt, provider routing, and a true-vector path. Use for logo or brand mark generation."
 domain: product
 personas:
   - design-director
@@ -40,9 +40,10 @@ governance. All adapters are scaffold-tier (dry-run) until promoted to `stable`.
    icon mark / combination), colour palette, do/don't constraints (e.g. "no gradients",
    "must be legible at 16 px").
 2. **Choose the path** — raster concept (text-in-mark → Ideogram for legible type)
-   vs. **true vector** (vector-native provider emitting `<path>` SVG for editable
-   marks, or LLM-authored SVG for simple geometric marks). Raster output is a
-   concept only — not a shippable logo asset.
+   vs. **true vector** (a vector-native provider for editable marks, or a
+   hand-authored one for simple geometric marks — authored under
+   [`svg-authoring`](../svg-authoring/SKILL.md), never free-hand). Raster output
+   is a concept only — not a shippable logo asset.
 3. **Inject brand tokens when a brand layer is present** (`pack-brand`) — pull the
    registered palette, typeface, and spacing tokens. When no brand layer exists,
    use the brief's palette and type choices directly.
@@ -51,8 +52,11 @@ governance. All adapters are scaffold-tier (dry-run) until promoted to `stable`.
    provider-specific grammar (text-literal first for Ideogram, `style: vector` param
    for a vector-native provider, direct SVG authoring for simple geometric shapes).
 5. **Dry-run + validate** — invoke the adapter (scaffold-tier; returns a dry-run
-   plan). If the vector path is taken, validate that the output contains `<path>`
-   elements before treating it as an editable mark.
+   plan). If the vector path is taken, the vector verdict comes from
+   `lint_svg_asset`'s vector-honesty family plus the render witness, not from
+   counting `<path>` elements: a raster embedded beside one dummy path passes
+   that count and is not a vector, and a mark built from `rect`/`circle` fails
+   it and is one. See [`svg-authoring`](../svg-authoring/SKILL.md).
 6. **Rights check** — never reproduce a mark that resembles an existing trademarked
    logo. Run [`image-likeness-and-rights`](../../rules/image-likeness-and-rights.md)
    when the brief names a brand, references a known mark style, or targets a
@@ -78,8 +82,8 @@ governance. All adapters are scaffold-tier (dry-run) until promoted to `stable`.
   is `stable` misleads the caller.
 
 **Good example:** Brief for a wordmark → route to a vector-native provider with
-`style: vector`, validate `<path>` elements in output, note "experimental —
-dry-run plan only."
+`style: vector`, run `lint_svg_asset` over the output and confirm it carries no
+embedded raster, note "experimental — dry-run plan only."
 
 **Bad example:** Routing a logo brief to a photoreal raster model and delivering the
 PNG as the final logo file.

package/dist/agent-src/skills/merge-conflicts/SKILL.md

@@ -222,10 +222,16 @@ git add .
 
 | Approach | When to use |
 |---|---|
-| `git merge main` | Default — preserves history, safer for shared branches |
-| `git rebase main` | Only when explicitly asked — rewrites history, cleaner log |
-
-**Never rebase without explicit permission** (per `no-commit` rule).
+| `git merge main` | Default (`git.update_strategy: merge`) — preserves history, safer for shared branches |
+| `git rebase origin/main` | `git.update_strategy: rebase` picks it — rewrites history, linear log |
+
+The setting picks the operation; it never authorises it. A rebase of a branch
+that is already pushed still needs the user's answer this turn, per
+[`git-history-discipline`](../../rules/git-history-discipline.md) § When rewrite is
+allowed — an explicit ask, an unrevoked standing instruction, or a `pull
+--rebase` the user started. Under `rebase` conflicts surface per commit, and the protocol — permission,
+stops, recovery ref, the equivalence report afterwards — is
+[`git-workflow` › branch-update](../git-workflow/references/branch-update.md).
 
 ## Output format
 

package/dist/agent-src/skills/po-discovery/SKILL.md

@@ -81,7 +81,7 @@ not name an implementation**. Use Given / When / Then or a numbered
 list. Reject ACs that hide assumptions ("works correctly", "is fast
 enough") — replace with measurable thresholds or strike them.
 
-**Cross-source discrepancy scan** (per [`cross-source-consistency`](../../rules/cross-source-consistency.md), gated by `consistency.cross_source`): when the raw input includes a screenshot / mockup alongside the story text, check the sources against each other and surface any conflict as a `gap` / open question — never resolve it silently. Watch for: story text contradicting an attached screenshot; the AC contradicting the description; a clearly-needed behavior the input never states (weekend/holiday shift, empty/error state). Batch them into one clarifying question. Taxonomy: [`cross-source-consistency-mechanics`](../../guidelines/agent-infra/cross-source-consistency-mechanics.md).
+**Cross-source discrepancy scan** (per [`cross-source-consistency`](../../rules/cross-source-consistency.md)): when the raw input includes a screenshot / mockup alongside the story text, check the sources against each other and surface any conflict as a `gap` / open question — never resolve it silently. Watch for: story text contradicting an attached screenshot; the AC contradicting the description; a clearly-needed behavior the input never states (weekend/holiday shift, empty/error state). Batch them into one clarifying question. Taxonomy: [`cross-source-consistency-mechanics`](../../guidelines/agent-infra/cross-source-consistency-mechanics.md).
 
 ### 5. Surface non-functional gaps
 

package/dist/agent-src/skills/refine-ticket/SKILL.md

@@ -86,8 +86,8 @@ selected language.
 Reuses the `jira-ticket` command's loader. Accepts:
 
 1. **Ticket key** — `/refine-ticket PROJ-123`
-2. **Branch detection** — `/refine-ticket` with no arg; regex
-   `[A-Z]+-[0-9]+` against `git branch --show-current`
+2. **Branch detection** — `/refine-ticket` with no arg; `agent-config git:convention ticket`
+   on the current branch ([`commit-subject`](../git-workflow/references/commit-subject.md) § Reading the ticket)
 3. **Pasted text** — `/refine-ticket` followed by a markdown block
 4. **URL** — `/refine-ticket https://acme.atlassian.net/browse/PROJ-123`
 
@@ -144,7 +144,7 @@ Check the loaded ticket for clarity signals before orchestrating:
 - Is the scope one feature, or multiple tangled together?
 - Any sentence that references an existing module name, feature flag, or domain concept?
 
-**Cross-source discrepancy scan** (per [`cross-source-consistency`](../../rules/cross-source-consistency.md), gated by `consistency.cross_source`): the ticket is rarely a single source. Compare every source against the others and surface any conflict as an *Open question* — never resolve it silently:
+**Cross-source discrepancy scan** (per [`cross-source-consistency`](../../rules/cross-source-consistency.md)): the ticket is rarely a single source. Compare every source against the others and surface any conflict as an *Open question* — never resolve it silently:
 - **text ↔ attachment** — does the ticket text agree with every attached mockup / screenshot / diagram? (Canonical miss: text says "birthdays **today**", the mockup shows a birthday from two days ago.) If an attachment cannot be read, say so — do not assume it agrees.
 - **silent-but-needed** — is the spec silent on a clearly-needed behavior (weekend/holiday shift, empty state, error path, timezone, permissions)? Surface it and ask before it becomes an implementation assumption — an inferred behavior is a scope expansion, not a given.
 - **intra-ticket** — do the AC, description, and comments contradict each other?
@@ -347,7 +347,7 @@ DoR check — not automatically on every refinement.
 - The model tends to invent risks that sound plausible but aren't anchored in the ticket text. Every risk in Top-5 must cite a phrase, AC bullet, or sub-skill finding — no hypotheticals.
 - Persona voices degrade into generic platitudes when the ticket is already tight. If a persona has nothing real to flag, write one sentence stating that — do not pad.
 - Sub-skills (`validate-feature-fit`, `threat-modeling`) cost tokens; orchestrate only when the trigger matrix actually matches, not defensively on every run.
-- Branch-detection matches the first `[A-Z]+-[0-9]+` in the branch name; chained keys (e.g. `feat/PROJ-1-and-PROJ-2`) pick the first and note the rest.
+- Branch-detection takes the first `ticket` that `git:convention ticket` prints; chained keys (e.g. `feat/PROJ-1-and-PROJ-2`) pick the first and note the rest.
 
 ## Do NOT
 

package/dist/agent-src/skills/roadmap-writing/SKILL.md

@@ -100,8 +100,8 @@ roadmaps.
 When the roadmap originates from a ticket/spec that carries a second
 source — an attached mockup/screenshot, a code reality, or an internal
 contradiction — run the **cross-source discrepancy scan** (per
-[`cross-source-consistency`](../../rules/cross-source-consistency.md),
-gated by `consistency.cross_source`) before writing phases. A phase plan
+[`cross-source-consistency`](../../rules/cross-source-consistency.md))
+before writing phases. A phase plan
 built over a text↔image contradiction or a silent-but-needed behavior
 (weekend/holiday shift, empty/error state) bakes the wrong assumption into
 every downstream step. Surface each discrepancy as one batched open

package/dist/agent-src/skills/skill-improvement-pipeline/SKILL.md

@@ -242,6 +242,8 @@ finding never silently becomes a hard gate. Both halves, specified in
 - **Reflexion** — [arxiv.org/abs/2303.11366](https://arxiv.org/abs/2303.11366)
   Language agents that reinforce from verbal self-reflection on past
   trials. This pipeline adapts Reflexion by gating promotion with a
-  human review step — learnings only harden into rules/skills after
-  explicit approval, never auto-commit.
+  review step — learnings only harden into rules/skills after explicit
+  approval, never auto-commit: for a proposal scoped to the package, on
+  the AI council's ratification record (user as last rung, ADR-281); for
+  a change a user asked for, on that user's approval.
 

package/dist/agent-src/skills/source-discovery/SKILL.md

@@ -117,7 +117,7 @@ card may exist in the per-user file-first store
   `evidence_report.ts add --bucket assumed --origin global …` and **re-confirm it
   against the live source this session** before use (version skew / schema drift
   across projects). Never "Verified" on the global card alone.
-- A `public`/`vendor` card seen in ≥ `auto_promote_threshold` distinct repos
+- A `public`/`vendor` card seen in ≥ 2 distinct repos
   triggers a one-tap promotion **suggestion** (never silent). `proprietary` cards
   are manual-only and never auto-shared. Record sightings via
   `_lib/knowledge_global_promote.ts record-seen`.