@event4u/agent-config 16.3.0 → 16.5.0

package/dist/agent-src/guidelines/php/git.md

@@ -34,6 +34,11 @@ hotfix/DEV-999/critical-payment-bug
 - Always include the Jira ticket ID when one exists
 - Use kebab-case for the description part
 - Keep branch names short but descriptive
+- The shape above is this guideline's convention; the agent renders branches from `git.branch_pattern` per [`commit-subject`](../../skills/git-workflow/references/commit-subject.md).
+- A team declares `git.branch_pattern`, `git.commit_format` and
+  `git.update_strategy` in `.git-convention.yml` at the repository root, committed
+  so every checkout, worktree and CI run reads the same value; there either value
+  is a declaration. `agent-config git:convention show` prints what is in force.
 
 ## Commit Messages
 
@@ -68,9 +73,14 @@ that is not better classified as `build`, `ci`, or `docs`.
 
 Use a scope when it adds clarity. Good scopes:
 
-- Jira ticket ID: `DEV-1234`
+- Jira ticket ID: placed per [`commit-subject`](../../skills/git-workflow/references/commit-subject.md) § Placing the ticket
 - Module/area: `api`, `auth`, `skills`, `rules`, `ci`, `frontend`, `linter`
 
+Under `git.commit_format: ticket-conventional` the ticket leads the subject and is
+**never** in the scope (`DEV-1234 feat(exporter-models): …`); tooling that parses
+subjects (commitlint, release automation, changelog generators) must be
+configured for that prefixed form.
+
 Do not add a scope if it adds no value. `fix(core): fix typo` → just `fix: fix typo`.
 
 ### Description rules
@@ -157,7 +167,10 @@ Before writing the commit message:
 
 ## Pull Requests
 
-- PR title follows commit message format: `feat(DEV-1234): short description`
+- PR title per [`commit-subject`](../../skills/git-workflow/references/commit-subject.md) § A title that becomes a commit
+- Bring the branch up to date per `git.update_strategy` — merge the base in
+  (default) or rebase onto `origin/main` and push with `--force-with-lease`;
+  see `git-workflow` › `references/branch-update.md`
 - Fill in the PR template (checklist, description, testing notes)
 - Link the Jira ticket in the PR description
 - Ensure all quality gates pass before requesting review

package/dist/agent-src/rules/active-remediation.md

@@ -20,7 +20,6 @@ enforced_by:
   - "instruction-only: the note, the ask and the user decision are all prose, so no gate can tell a discharged issue from a mentioned one"
 collision_ok:
   "refactor": "an explicit clean-up/refactor ask is the remediation ladder's own trigger"
-# obligation: line 31
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/analysis-skill-routing.md

@@ -10,7 +10,6 @@ routes_to:
   - "skill:analysis-skill-router"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 19
 obligation_frequency: "none"
 ---
 

package/dist/agent-src/rules/architecture.md

@@ -13,7 +13,6 @@ workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 collision_ok:
   "controller": "thin-handler floor on controller work"
-# obligation: line 26
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/artifact-drafting-protocol.md

@@ -14,7 +14,6 @@ routes_to:
   - "guideline:agent-infra/artifact-drafting-protocol-mechanics"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 41
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/artifact-engagement-recording.md

@@ -13,7 +13,6 @@ load_context:
   - "../contexts/contracts/artifact-engagement-flow.md"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 22
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/augment-edit-discipline.md

@@ -19,7 +19,6 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 collision_ok:
   ".augment/": "portability + sync floors for the .augment tree"
-# obligation: line 28
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/autonomous-execution.md

@@ -14,7 +14,6 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
-# obligation: line 4
 obligation_frequency: "per-turn"
 ---
 

package/dist/agent-src/rules/brand-consistency.md

@@ -10,7 +10,6 @@ applies_to_user_types:
 self_contained: true
 workspaces: [engineering]
 packs: [brand]
-# obligation: line 20
 obligation_frequency: "none"
 ---
 

package/dist/agent-src/rules/brand-source-of-truth.md

@@ -20,7 +20,6 @@ applies_to_user_types:
 self_contained: true
 workspaces: [engineering]
 packs: [brand]
-# obligation: line 51
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/broken-access-control.md

@@ -24,7 +24,6 @@ collision_ok:
   "controller": "controllers return user data — the ownership/tenant check floor"
   "endpoint": "every data-returning endpoint needs the three negative tests"
   "tenant": "cross-tenant isolation is this rule's core subject"
-# obligation: line 55
 obligation_frequency: "per-edit"
 evidence:
   source_type: external-standard

package/dist/agent-src/rules/cli-output-handling.md

@@ -35,7 +35,6 @@ collision_ok:
   "composer": "composer output is verbose — rtk wrap applies"
   "docker": "docker output is verbose — rtk wrap applies"
   "rector": "rector output is verbose — rtk wrap applies"
-# obligation: line 42
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/code-comment-discipline.md

@@ -20,7 +20,6 @@ packs: [engineering-base]
 collision_ok:
   "refactor": "refactors churn comments — the keep/drop discipline applies"
   "implement": "fresh implementation is where over-commenting lands"
-# obligation: line 5
 obligation_frequency: "per-edit"
 enforced_by:
   - "validator:src/scripts/lint_code_comments.ts"

package/dist/agent-src/rules/code-provenance.md

@@ -23,7 +23,6 @@ packs: [engineering-base]
 roles: [developer, reviewer, tester, po, incident, planner]
 enforced_by:
   - "instruction-only: close-the-source-and-re-derive is a pre-write reasoning step only the model observes; CI checks the ledger, never the derivation"
-# obligation: line 40
 obligation_frequency: "per-edit"
 evidence:
   source_type: external-research

package/dist/agent-src/rules/command-suggestion-policy.md

@@ -12,7 +12,6 @@ load_context:
   - "../contexts/contracts/command-suggestion-flow.md"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
-# obligation: line 18
 obligation_frequency: "per-turn"
 ---
 

package/dist/agent-src/rules/commit-conventions.md

@@ -12,13 +12,12 @@ workspaces: [engineering]
 packs: [engineering-base]
 collision_ok:
   "commit": "format floor for every commit message"
-# obligation: line 19
 obligation_frequency: "per-commit"
 ---
 
 # Commit Conventions
 
-**Iron Law.** Match the repo's configured or approved convention; else Conventional Commits (`feat:`, `fix:` …), branches `<type>/<short-slug>`; never invent one. Subjects + branch names stay emoji-free per [`no-decorative-emojis-in-git-surfaces`](no-decorative-emojis-in-git-surfaces.md); body emojis need an in-artifact legend.
+**Iron Law.** Match a repo's configured, then git.* settings, then approved convention; else Conventional Commits, branches `<type>/<short-slug>`; never invent one. Subjects + branch names stay emoji-free per [`no-decorative-emojis-in-git-surfaces`](no-decorative-emojis-in-git-surfaces.md); body emojis need an in-artifact legend.
 
 Body migrated to `skill:conventional-commits-writing` (per P4 of `road-to-kernel-and-router.md`).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/communication-through-line.md

@@ -8,7 +8,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 triggers:
   - phrase: "reporting progress"
-# obligation: line 20
 obligation_frequency: "per-turn"
 ---
 
@@ -34,7 +33,7 @@ CLOSE THE LOOP WITH ONE END-SUMMARY. NEVER MAKE THE USER RE-DERIVE WHERE THINGS
 ## When NOT to over-apply
 
 - A one-shot answer or trivial reply needs no plan-anchor or end-summary (`direct-answers` brevity wins).
-- Don't narrate for its own sake — the thread is orientation, not play-by-play (respect `personal.play_by_play`).
+- Don't narrate for its own sake — the thread is orientation, not play-by-play.
 - Never let the through-line inflate a reply past what the task needs; brevity and the one-recommendation rule win on conflict.
 
 ## See also

package/dist/agent-src/rules/content-quoting-floor.md

@@ -9,7 +9,6 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
-# obligation: line 19
 obligation_frequency: "per-event"
 ---
 
@@ -88,7 +87,7 @@ does not substitute for engaging with the source.
   **markup**: a design artifact the user hands over is their own material, so
   adapting its code is not a borrow. Third-party code arriving inside that
   handover is not covered, on either side.
-- [`docs/contracts/write-engine.md`](../docs/contracts/write-engine.md) —
+- `docs/contracts/write-engine.md` —
   ghostwriter's disclosure-footer contract; this rule's quote floor
   applies to any ghostwriter draft that cites an external source.
 - [`source-confidentiality`](source-confidentiality.md) — the license-

package/dist/agent-src/rules/context-hygiene.md

@@ -16,7 +16,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "hook:context-hygiene"
-# obligation: line 67
 obligation_frequency: "per-turn"
 ---
 
@@ -26,7 +25,7 @@ obligation_frequency: "per-turn"
 > on Augment + Claude Code (`PostToolUse`). Run `agent-config hooks:status` to
 > see whether that slot is actually bound on the host you are on — this line is
 > a statement about the manifest, not about your install. The hook maintains
-> `agents/state/context-hygiene.json` (tool-call count, loop signal,
+> `agents/state/context-hygiene.json` (tool-call count,
 > freshness milestones at 20/40/60); the prose below is the spec the
 > hook implements and the agent-side fallback.
 >
@@ -53,9 +52,10 @@ topic · branch changed since start · ~24 hours passed.
 
 ## The 3-Failure Rule
 
-When **3 consecutive attempts** at the same task fail (code fix, test fix, config change, etc.):
+Counts **strategies**, not attempts. 3 fail at the same task (code fix,
+test fix, config change, etc.):
 
-1. **STOP** — do not attempt a 4th fix.
+1. A 4th strategy is wrong — reassess.
 2. **State dump** — summarize what was tried, what failed, and what you know so far.
 3. **Recommend fresh start** — suggest a fresh session with the state dump as context, or ask for a different approach.
 
@@ -66,7 +66,7 @@ When **3 consecutive attempts** at the same task fail (code fix, test fix, confi
 - **Same failure signature twice → stop and pivot now.** Don't burn the third attempt on a near-identical retry of a fix that already failed the same way — a repeated identical signature means the hypothesis is wrong, not under-applied. Change strategy (re-read source, new hypothesis, ask).
 - **New error signature each attempt = progress.** Peeling one error to reveal a different one is forward motion; counter continues — learning, not looping.
 
-**Hard-blocker classes — skip retries, go straight to ask/surface.** On the **first** occurrence, do not count toward the 3 — stop and surface: missing credentials / unset secret · permission denied · spend / quota / rate limit reached · external-service 5xx / outage. Retrying a hard-blocker is the canonical wasted attempt; the fix is a decision or external change only the user/environment can make.
+**Hard-blocker classes — skip retries, go straight to ask/surface.** On the **first** occurrence, do not count toward the 3 — halt and surface: missing credentials / unset secret · permission denied · spend / quota / rate limit reached · external-service 5xx / outage. Retrying a hard-blocker is the canonical wasted attempt; the fix is a decision or external change only the user/environment can make.
 
 ## Tool Loop Detection
 

package/dist/agent-src/rules/copilot-routing.md

@@ -10,7 +10,6 @@ routes_to:
   - "skill:copilot-config"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 19
 obligation_frequency: "none"
 ---
 
@@ -18,5 +17,5 @@ obligation_frequency: "none"
 
 **Iron Law.** Tuning the GitHub Copilot AI assistant itself (instructions, PR-review patterns, suggestion behavior) → load the `copilot-config` skill, not `devcontainer` (which covers the dev environment Copilot runs inside).
 
-Body migrated to `skill:copilot-config`. Disambiguates the copilot-config ↔ devcontainer cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
+Body migrated to `skill:copilot-config`. Disambiguates the copilot-config ↔ devcontainer cluster head per `docs/contracts/adr-architectural-consensus-mechanism.md`.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/council-availability.md

@@ -14,7 +14,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "instruction-only: no gate reads a chat claim about availability; check_council_config_location covers the tree side only"
-# obligation: line 27
 obligation_frequency: "per-task"
 ---
 
@@ -68,9 +67,10 @@ the user-global config into the repo to "make it work".
 
 ## If the probe really says unavailable
 
-State the resolver's own message and stop. A subagent fan-out is a legitimate
-substitute **only when named as such** — never as "the council". Same honesty
-boundary as [`evaluator-independence`](evaluator-independence.md).
+State the resolver's message and stop. A fan-out substitutes **only when named
+as such**, never as "the council"
+([`evaluator-independence`](evaluator-independence.md)), nor in a
+modification review (ADR-281).
 
 ## When NOT to fire
 

package/dist/agent-src/rules/cross-source-consistency.md

@@ -26,7 +26,6 @@ packs: [engineering-base, product-basic]
 collision_ok:
   "mockup": "a mockup is a second source — discrepancy check against the ticket text"
   "screenshot": "a screenshot is a second source — discrepancy check"
-# obligation: line 71
 obligation_frequency: "per-task"
 ---
 
@@ -59,11 +58,10 @@ OBVIOUS-TO-THE-AGENT ≠ IN-SCOPE.
 
 **Fires** while planning, refining, estimating, roadmapping, or implementing from
 a ticket/spec that carries a second source (an attachment, a code reality, or an
-internal contradiction), gated by `consistency.cross_source` in
-`.agent-settings.yml` (`on` default · `auto` = high-confidence only · `off` = inert).
-That file is the project layer of a cascade that starts user-global — never read
-the setting or its absence from it alone; `agent-config settings:get
-consistency.cross_source` reports the value and the file it came from.
+internal contradiction). It is always on: the `consistency.cross_source` key that
+offered `auto` (high-confidence only) and `off` was retired on 2026-10-09 with its
+default, `on`, as the fixed behavior. The noise control is the batching and the
+`no-cheap-questions` floor below, not a setting.
 
 **Does NOT fire** on a single clear source with no second source to compare
 against (that is plain vagueness — it belongs to `ask-when-uncertain`), on

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -25,7 +25,6 @@ workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 collision_ok:
   "honest null": "this rule asks whether a recorded null may be REVISITED; evaluator-independence asks how one was PRODUCED — different decision points on the same artefact"
-# obligation: line 33
 enforced_by:
   - "instruction-only: no gate can observe an agent citing a decision it never opened; adr_cite_check is deterministic where it runs and nothing makes it run"
 obligation_frequency: "per-task"
@@ -96,7 +95,7 @@ read 6 is the agent's, because reversibility belongs to the proposed transition
 and no tool reading one record supplies it. What each field means, and what a
 `[found]` basis ref does NOT claim, is in that script's module docstring. The
 evidence-priced burden table stays in
-[`adr-layout § The reopen record`](../docs/contracts/adr-layout.md).
+`docs/contracts/adr-layout.md` § The reopen record.
 
 ```
 A GRADE IS A MEASUREMENT, NOT A PERMISSION — IT GRANTS NOTHING.
@@ -152,7 +151,7 @@ Field on the ADR: `reopen_policy: directional | owner | unclassified`, absent
 permitted; only execution of a reserved transition is gated. Absent is
 deliberately not `owner`: with 146 accepted ADRs that default would encode
 today's blockage into the new schema. Full contract, the reopen record and the
-precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../docs/contracts/adr-layout.md).
+precedent-creates-no-authority clause: `docs/contracts/adr-layout.md` § Reopen authority.
 
 ## See also
 

package/dist/agent-src/rules/delegation-policy.md

@@ -20,7 +20,6 @@ routes_to:
   - "skill:subagent-orchestration"
 workspaces: [engineering]
 packs: [engineering-base]
-# obligation: line 35
 obligation_frequency: "per-task"
 ---
 
@@ -69,7 +68,7 @@ primitive → run in-session (clean no-op).
    `subagents.model_ceiling` caps the tier and the slice does not fit, the worker
    **escalates and never silently delivers the degraded result**; the
    orchestrator never raises the ceiling itself, and absent is *uncapped*.
-   [`subagent-boundary § The model ceiling`](../docs/contracts/subagent-boundary.md).
+   `docs/contracts/subagent-boundary.md` § The model ceiling.
 3. **Dispatch** via the form gate + matching `subagent-orchestration` mode
    (independent → do-in-parallel; ordered → do-in-steps; risk/correctness →
    + judge; UI-heavy → live-app judge, efficacy-gated).
@@ -116,6 +115,6 @@ on hosts without hook slots. Per-carrier detail and what each one verifies:
 ## See also
 
 - [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md) — the form gate + 9 modes this selects.
-- [`subagent-boundary`](../docs/contracts/subagent-boundary.md) — what a subagent owns vs never owns (task-meaning, memory, pack-surface, safety-floor bypass).
+- `docs/contracts/subagent-boundary.md` — what a subagent owns vs never owns (task-meaning, memory, pack-surface, safety-floor bypass).
 - [`auto-orchestration-activation`](../contexts/execution/auto-orchestration-activation.md) — the gate.
 - [`reasoning-orchestrator`](../skills/reasoning-orchestrator/SKILL.md) — RDP dispatch, now gated here.

package/dist/agent-src/rules/design-fidelity.md

@@ -41,7 +41,6 @@ collision_ok:
   "mockup": "a provided mockup is the spec — 1:1 fidelity floor"
 enforced_by:
   - "instruction-only: no artifact in this tree records a fidelity comparison. lint_design_slop and lint_design_quality measure generic AI-aesthetic tells and accessibility; neither reads the handover, so a 1:1 claim is model-carried"
-# obligation: line 60
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/design-review-after-ui-write.md

@@ -45,7 +45,6 @@ collision_ok:
   "*.tsx": "one component file, two obligations: inventory before the write, review after it"
   "*.jsx": "one component file, two obligations: inventory before the write, review after it"
   "*.blade.php": "one template file, two obligations: inventory before the write, review after it"
-# obligation: line 39
 obligation_frequency: "per-edit"
 ---
 
@@ -74,7 +73,8 @@ STATICALLY CHECKED AND SAY SO. NEVER "LOOKS GOOD" WITH NOTHING BEHIND IT.
 The verdict is gated on evidence, not on having run a skill:
 
 - **Render capability present** (Playwright MCP, Chrome DevTools, or a live
-  preview URL) → the [design-artifact verification checklist](../docs/contracts/design-artifact-verification.md#verification-checklist)
+  preview URL) → the design-artifact verification checklist
+  (`docs/contracts/design-artifact-verification.md` § Verification checklist)
   steps 1–5. A UI task does not pass without render evidence.
 - **Render capability absent** → the verdict is **scoped to the static checks
   that actually ran** and says which those were. This is not a downgrade to be
@@ -136,7 +136,7 @@ three `platforms:` rows that carry a `pre_tool_use` key — augment, claude,
 cowork (**clarified 2026-08-17**: "hosts carrying a slot" read as a host
 property and is a manifest one; three further hosts alias a native pre-tool
 event with no binding, and only claude honours a deny — see
-[`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md)).
+`docs/contracts/hook-architecture-v1.md` § Which hosts carry pre_tool_use).
 The verdict is unchanged either way: a nudge that can be ignored is not
 enforcement, so `enforced_by:` stays `none` — it moves the day a mechanism can
 refuse, not the day a reminder appears. `agent-config hooks:status` answers

package/dist/agent-src/rules/devcontainer-routing.md

@@ -11,7 +11,6 @@ routes_to:
   - "skill:devcontainer"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 20
 obligation_frequency: "none"
 ---
 
@@ -19,5 +18,5 @@ obligation_frequency: "none"
 
 **Iron Law.** Wiring the dev environment itself (DevContainers, Codespaces, `devcontainer.json`, VS Code features) → load the `devcontainer` skill, not `copilot-config` (which tunes the Copilot AI on top).
 
-Body migrated to `skill:devcontainer`. Disambiguates the devcontainer ↔ copilot-config cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
+Body migrated to `skill:devcontainer`. Disambiguates the devcontainer ↔ copilot-config cluster head per `docs/contracts/adr-architectural-consensus-mechanism.md`.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/doc-screenshot-hygiene.md

@@ -28,7 +28,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 collision_ok:
   "screenshot": "a screenshot shipping into docs is the PII/anonymization gate"
-# obligation: line 49
 obligation_frequency: "per-event"
 ---
 

package/dist/agent-src/rules/docker-commands.md

@@ -15,7 +15,6 @@ collision_ok:
   "artisan": "artisan runs inside the project container, never on the host"
   "composer": "composer runs inside the project container"
   "docker": "its own core subject"
-# obligation: line 22
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/domain-adoption-policy.md

@@ -18,7 +18,6 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 collision_ok:
   "src/skills/": "a skill in a fresh vertical is exactly the domain-gate surface"
-# obligation: line 38
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/domain-safety-disclaimer.md

@@ -43,7 +43,6 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 collision_ok:
   "review this contract": "contract review is advisory-shaped — the not-legal-advice footer floor"
-# obligation: line 52
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/domain-safety-pii.md

@@ -43,7 +43,6 @@ applies_to_user_types:
   - "all"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
-# obligation: line 52
 obligation_frequency: "per-task"
 evidence:
   source_type: external-standard

package/dist/agent-src/rules/domain-safety-retention.md

@@ -28,7 +28,6 @@ applies_to_user_types:
   - "gtm"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
-# obligation: line 47
 obligation_frequency: "per-turn"
 evidence:
   source_type: external-standard

package/dist/agent-src/rules/downstream-changes.md

@@ -11,7 +11,6 @@ triggers:
 self_contained: true
 workspaces: [engineering]
 packs: [engineering-base]
-# obligation: line 30
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/engineering-safety-floor.md

@@ -29,7 +29,6 @@ workspaces: [engineering]
 packs: [engineering-base]
 collision_ok:
   "migration": "a prod migration is a hard-floor evidence surface (rollback path, blast radius)"
-# obligation: line 49
 obligation_frequency: "per-commit"
 evidence:
   source_type: own-analysis

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -17,7 +17,6 @@ applies_to_user_types:
 self_contained: true
 workspaces: [engineering]
 packs: [meta]
-# obligation: line 37
 obligation_frequency: "per-turn"
 ---
 

package/dist/agent-src/rules/external-reference-deep-dive.md

@@ -10,7 +10,6 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 20
 obligation_frequency: "per-task"
 ---
 

package/dist/agent-src/rules/fast-path-marker-visibility.md

@@ -15,7 +15,6 @@ validator_ignore:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
-# obligation: line 30
 obligation_frequency: "per-turn"
 ---
 
@@ -81,6 +80,6 @@ this rule does not constrain their output.
 
 ## See also
 
-- [`ai-council-config § Low-impact council opt-in`](../docs/contracts/ai-council-config.md#low-impact-council-opt-in)
+- `docs/contracts/ai-council-config.md` § Low-impact council opt-in
 - [`direct-answers`](direct-answers.md) — invented-facts Iron Law (provenance kin).
 - `scripts/ai_council/low_impact.ts` — marker source.

package/dist/agent-src/rules/finance-safety-floor.md

@@ -34,7 +34,6 @@ packs: [finance-basic, finance-advanced]
 trust:
   level: advisory
   human_review_required: true
-# obligation: line 53
 obligation_frequency: "per-task"
 ---
 <!-- agent-config:human-review-banner -->

package/dist/agent-src/rules/fix-what-you-see.md

@@ -74,43 +74,17 @@ asks; the ask becomes the work, not the exit.
 **Does NOT fire:** user fenced the scope this turn · no falsifiable break (a
 preference, not a red) · already decided by the user.
 
-## Why separate from `active-remediation`
+## Why a separate rule, and its activation gap
 
-That rule forbids ignoring a spotted issue and its ladder permits **note + ask**.
-Two properties made it insufficient, both measured 2026-08-20: it is `type: auto`
-on `refactor`/`legacy`/`cleanup` triggers — **none of which a failing CI job
-matches**, so it does not load when the obligation matters most — and its
-note-and-ask tier is what let a session name a red check's cause, name the
-file's author, and hand it back still red.
-
-Mechanics (fix-now size criteria, follow-up shape) stay there; this rule only
-deletes the two escapes.
-
-## Honest activation gap — this rule is `auto`, and it wanted to be `always`
-
-It shipped `auto` for a budget reason, not a design one, and the gap that leaves
-is exactly the one it was written to close: **a red check the agent sees in tool
-output triggers nothing.** Keyword triggers match the PROMPT. So the rule loads
-when a human says "CI is red" or "not my test", and does NOT load when a test
-run comes back red and nobody has said a word.
-
-`check_always_budget` is the reason: the extended always-budget sat at
-60,252 / 60,254 chars — **two characters of headroom** — and the cap is a
-ratchet that may only move down. The other nine always-rules are the kernel,
-which `block_kernel_rule_writes` denies agent writes to, so no room can be made
-from this side. A 2,332-char rule puts the total at 103.9 %.
-
-Closing the gap needs one of: the ext-cap ratchet opened deliberately (a
-maintainer decision, recorded), a kernel rule shortened to make room, or a
-`post_tool_use` carrier that notices a non-zero verification exit — the only
-option that would fire on tool output rather than on wording. Until then, `auto`
-plus this paragraph is the honest state: the obligation is real, its delivery is
-partial, and the partiality is named rather than implied away.
+Why `active-remediation` alone was insufficient, and why this rule ships `auto`
+although it wanted `always` — so a red check seen only in tool output triggers
+nothing — are in
+`guideline:agent-infra/active-remediation-mechanics` § fix-what-you-see.
 
 ## Honest enforcement — `instruction-only`
 
 Nothing observes a disposition. "I fixed it", "I landed a roadmap for it" and
 "I named the author and moved on" are the same prose to every gate in this tree,
 and the issue set is whatever the agent happened to see. So the two dispositions
-above are model-carried, and the activation gap named in the previous section
+above are model-carried, and the activation gap named above
 sits on top of that rather than beside it.

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -43,7 +43,6 @@ collision_ok:
   "formrequest": "FormRequest named in a generic artifact is leakage — the lint surface"
   "phpstan": "phpstan named in a generic artifact is leakage — the lint surface"
   "rector": "rector named in a generic artifact is leakage — the lint surface"
-# obligation: line 65
 obligation_frequency: "per-edit"
 ---
 

package/dist/agent-src/rules/git-history-discipline.md

@@ -24,7 +24,6 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "hook:block-no-verify"
-# obligation: line 35
 obligation_frequency: "per-commit"
 ---
 
@@ -87,6 +86,6 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`skill:git-workflow`](../skills/git-workflow/SKILL.md) — Safe Squash-After-Push protocol and Divergent-State Recovery decision tree.
 - `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**. It is *bound* on augment and cowork too, and ignored there. Everywhere else the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. To check the host you are on rather than trusting this sentence, run `agent-config hooks:status`.
 
-  **Corrected 2026-08-17, in both directions, because this line was wrong on each side.** It read "the guard has nowhere to bind" on cursor, cline, windsurf, gemini and copilot — refuted for three of the five by the manifest's own `native_event_aliases` table, which already maps `preToolUse`, `PreToolUse` and `BeforeTool` onto `pre_tool_use`: there the guard is **unbound, not unbindable**, and only windsurf and copilot carry no pre-tool alias row here. And it certified augment, claude and cowork as the enforcing set — `host_semantics.ts` verifies **claude alone**, while the augment and cowork trampolines discard dispatcher output and `exit 0` unconditionally, so a guard bound there runs and is then ignored. Both halves are the same failure: a host-capability claim this tree never established. The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md).
+  **Corrected 2026-08-17, in both directions, because this line was wrong on each side.** It read "the guard has nowhere to bind" on cursor, cline, windsurf, gemini and copilot — refuted for three of the five by the manifest's own `native_event_aliases` table, which already maps `preToolUse`, `PreToolUse` and `BeforeTool` onto `pre_tool_use`: there the guard is **unbound, not unbindable**, and only windsurf and copilot carry no pre-tool alias row here. And it certified augment, claude and cowork as the enforcing set — `host_semantics.ts` verifies **claude alone**, while the augment and cowork trampolines discard dispatcher output and `exit 0` unconditionally, so a guard bound there runs and is then ignored. Both halves are the same failure: a host-capability claim this tree never established. The four states are tabulated once in `docs/contracts/hook-architecture-v1.md` § Which hosts carry pre_tool_use.
 
   The frequency join in `check_enforcement_coverage.ts` reports this obligation uncovered on **four** platforms — cursor, cline, windsurf, gemini. It skips `fallback_only` platforms before computing, so copilot never appears in its output and must not be quoted as if it did; copilot is uncovered because this package binds nothing there.