@event4u/agent-config 16.4.0 → 16.5.0

package/dist/scripts/_lib/svg_urls.js

@@ -0,0 +1,67 @@
+/**
+ * How a browser reads the URLs and names in an SVG, for the safety rules in
+ * `svg_rules.ts`: references decoded, controls stripped, CSS escapes resolved,
+ * and an element prefix stripped only where it is bound to the SVG namespace.
+ * Its own module so `svg_rules.ts` stays under the source-size ceiling.
+ */
+/** Prefixes the document binds to the SVG namespace (`xmlns:svg="…/2000/svg"`). */
+export function svgPrefixes(content) {
+    const out = new Set();
+    const re = /xmlns:([\w.-]+)\s*=\s*["']http:\/\/www\.w3\.org\/2000\/svg["']/gi;
+    let m;
+    while ((m = re.exec(content)) !== null)
+        out.add((m[1] ?? '').toLowerCase());
+    return out;
+}
+/** The SVG local name: `svg:script` is a `script` where `svg` is bound to SVG; `foo:script` is not. */
+export function localName(name, prefixes) {
+    const colon = name.indexOf(':');
+    return colon !== -1 && prefixes.has(name.slice(0, colon)) ? name.slice(colon + 1) : name;
+}
+/** Attributes read from the raw tag, unquoted values included — HTML parses those. */
+export function rawAttrs(raw) {
+    const out = {};
+    const re = /([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"'`=]+))/g;
+    let m;
+    while ((m = re.exec(raw)) !== null)
+        out[(m[1] ?? '').toLowerCase()] = m[2] ?? m[3] ?? m[4] ?? '';
+    return out;
+}
+/** Attributes whose value is followed as a URL. */
+export const URL_ATTRS = new Set(['href', 'xlink:href', 'src']);
+/** A URL that executes or opens a document when followed. */
+export const isActiveUrl = (raw) => /^(javascript:|data:text\/html)/i.test(resolvedUrl(raw));
+const NAMED_URL_ENTITIES = {
+    colon: ':', sol: '/', tab: '\t', newline: '\n', period: '.', lpar: '(', rpar: ')', amp: '&',
+};
+/**
+ * The URL a browser would actually resolve from an attribute value: character
+ * references decoded, leading/trailing C0 controls and spaces stripped, tab and
+ * newline removed anywhere. The trailing `;` of a reference is optional on
+ * purpose: an `.svg` parsed as XML needs it, but the same graphic inlined in an
+ * HTML host is parsed by the HTML tokenizer, which decodes `&#106avascript:`
+ * too — over-reading XML here costs precision, under-reading HTML costs a miss.
+ * The raw value is attacker-chosen, so a scheme test
+ * against it is a test of one spelling — ` https:`, `ht\ttps:`, `javascript:`
+ * all load, and all passed.
+ */
+export function resolvedUrl(raw) {
+    const decoded = raw.replace(/&(?:#x([0-9a-f]+)|#(\d+)|([a-z]+));?/gi, (m, hex, dec, name) => {
+        const cp = hex ? parseInt(hex, 16) : dec ? parseInt(dec, 10) : NaN;
+        if (!Number.isNaN(cp))
+            return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+        return NAMED_URL_ENTITIES[name.toLowerCase()] ?? m;
+    });
+    return decoded.replace(/^[\u0000- ]+|[\u0000- ]+$/g, '').replace(/[\t\n\r]/g, '');
+}
+/** CSS escapes decoded: `\\68 ` and `\\h` both read `h`. */
+export function cssUnescape(raw) {
+    return raw.replace(/\\([0-9a-f]{1,6})\s?|\\(.)/gi, (m, hex, ch) => {
+        if (hex) {
+            const cp = parseInt(hex, 16);
+            return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+        }
+        return ch;
+    });
+}
+//# sourceMappingURL=svg_urls.js.map

package/dist/scripts/lint_svg_asset.js

@@ -0,0 +1,324 @@
+#!/usr/bin/env node
+/**
+ * lint_svg_asset — the command-line surface over the SVG rule set.
+ *
+ * The rules live in `_lib/svg_rules.ts`, because the design pass imports them
+ * into the hook bundle and must not drag a CLI in with them (see that file's
+ * header for the measurement). Everything this module adds is the part only a
+ * command needs: argument parsing, the directory walk, the project config, the
+ * scanned-nothing refusal, and the step 1.2 preservation readout.
+ *
+ * Inline-ignore (same shape as `lint_design_quality`, works in XML comments):
+ *   svg-asset-disable <rule-id> [-- reason]            (file scope)
+ *   svg-asset-disable-next-line <rule-id> [-- reason]
+ *   svg-asset-disable-line <rule-id> [-- reason]
+ *
+ * Per-project config (`.svg-asset.json` in the project root):
+ *   { "ignoreRules": ["svg-a11y-generic-id"], "ignoreFiles": ["vendor/**"] }
+ *
+ * Usage:
+ *   lint_svg_asset --dir <path> [--delivery inline|img|css-bg|document]
+ *   lint_svg_asset --file <a.svg> [--file <b.svg>] [--delivery …]
+ *   lint_svg_asset --file <after.svg> --baseline <before.svg> --allow id,id
+ *
+ * Exit codes: 0 = clean, 2 = findings, 1 = internal error (including the
+ * scanned-nothing refusal — a gate that scanned no file is not a clean gate).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+import { DELIVERY_MODES, parseElements, scanHostHtml, scanSvg, } from './_lib/svg_rules.js';
+export * from './_lib/svg_rules.js';
+/**
+ * Canonicalised attribute map — number formatting, attribute order and
+ * whitespace normalised away, so a re-serialisation that changed nothing reads
+ * as nothing changed.
+ */
+export function canonicalAttrs(attrs) {
+    const out = {};
+    for (const key of Object.keys(attrs).sort()) {
+        const v = (attrs[key] ?? '')
+            .replace(/\s+/g, ' ')
+            .trim()
+            // Numbers only where a number is what it is. A hex color is a
+            // TOKEN, not a quantity: normalising inside `#00ff00` collapses it
+            // onto `#0ff0`, and the readout then reports no change for a color
+            // edit outside the allowed ids — a surgical-edit witness that
+            // cannot see a recolour.
+            .replace(/#[0-9a-fA-F]+|-?\d+\.?\d*(?:[eE][-+]?\d+)?/g, (tok) => {
+            if (tok.startsWith('#'))
+                return tok.toLowerCase();
+            const num = Number(tok);
+            return Number.isFinite(num) ? String(Number(num.toFixed(4))) : tok;
+        });
+        out[key] = v;
+    }
+    return out;
+}
+/**
+ * Every element outside the allowed set that changed between two revisions.
+ *
+ * NO PIXEL DIFF decides this. Anti-aliasing and font metrics would make a
+ * pixel comparison a per-machine verdict, and the discipline this witnesses —
+ * `design-fidelity-mechanics.md` § surgical edits — is about which elements
+ * the edit was allowed to touch, which is an attribute fact.
+ */
+export function preservationReadout(beforeContent, afterContent, allowedIds) {
+    const allow = new Set(allowedIds.map((s) => s.trim()).filter(Boolean));
+    /**
+     * A stable key per element, and the id chain above it.
+     *
+     * An element WITHOUT an id is keyed by its nearest id-bearing ancestor plus
+     * its tag and its ordinal INSIDE that ancestor — never by a document-wide
+     * index. A document-wide index shifts for every element after an allowed
+     * deletion, so removing one child of the allowed group reported every
+     * un-idded element after it as changed. Measured on the `grouped-transforms`
+     * triple: the correct edit reported `rect#7 (element)` and the readout could
+     * not tell a clean surgical edit from a dirty one.
+     */
+    const index = (content) => {
+        const map = new Map();
+        const stack = [];
+        const ordinals = new Map();
+        for (const el of parseElements(content)) {
+            if (el.closing) {
+                if (stack[stack.length - 1]?.name === el.name)
+                    stack.pop();
+                continue;
+            }
+            const chain = stack.map((f) => f.id).filter((x) => x !== null);
+            const ownerId = [...stack].reverse().find((f) => f.id !== null)?.id ?? '';
+            const own = el.attrs['id'] ?? null;
+            let key;
+            if (own) {
+                key = own;
+            }
+            else {
+                const bucket = `${ownerId}/${el.name}`;
+                const n = (ordinals.get(bucket) ?? 0) + 1;
+                ordinals.set(bucket, n);
+                key = `${bucket}#${n}`;
+            }
+            map.set(key, { el, chain: own ? [...chain, own] : chain });
+            if (!el.selfClosing)
+                stack.push({ name: el.name, id: own });
+        }
+        return map;
+    };
+    const before = index(beforeContent);
+    const after = index(afterContent);
+    const changes = [];
+    /** An element inside an allowed subtree is itself allowed. */
+    const permitted = (entry) => Boolean(entry && entry.chain.some((id) => allow.has(id)));
+    for (const [key, beforeEntry] of before) {
+        if (permitted(beforeEntry))
+            continue;
+        const afterEntry = after.get(key);
+        if (!afterEntry) {
+            changes.push({
+                id: key,
+                element: beforeEntry.el.name,
+                attribute: '(element)',
+                before: 'present',
+                after: 'removed',
+            });
+            continue;
+        }
+        const a = canonicalAttrs(beforeEntry.el.attrs);
+        const b = canonicalAttrs(afterEntry.el.attrs);
+        for (const attr of new Set([...Object.keys(a), ...Object.keys(b)])) {
+            if ((a[attr] ?? '') === (b[attr] ?? ''))
+                continue;
+            changes.push({
+                id: key,
+                element: beforeEntry.el.name,
+                attribute: attr,
+                before: a[attr] ?? '(absent)',
+                after: b[attr] ?? '(absent)',
+            });
+        }
+    }
+    for (const [key, afterEntry] of after) {
+        if (permitted(afterEntry) || before.has(key))
+            continue;
+        changes.push({
+            id: key,
+            element: afterEntry.el.name,
+            attribute: '(element)',
+            before: 'absent',
+            after: 'added',
+        });
+    }
+    return changes;
+}
+export function loadConfig(dir) {
+    const configPath = path.join(dir, '.svg-asset.json');
+    if (!fs.existsSync(configPath))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+function* walkDir(dir, ext) {
+    if (!fs.existsSync(dir))
+        return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        if (entry.name.startsWith('.') || entry.name === 'node_modules')
+            continue;
+        if (entry.isDirectory())
+            yield* walkDir(full, ext);
+        else if (ext.test(entry.name))
+            yield full;
+    }
+}
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+function readFlag(args, name) {
+    const i = args.indexOf(name);
+    return i >= 0 ? args[i + 1] : undefined;
+}
+function readAll(args, name) {
+    const out = [];
+    for (let i = 0; i < args.length; i++)
+        if (args[i] === name && args[i + 1])
+            out.push(args[i + 1]);
+    return out;
+}
+export function main(argv = process.argv.slice(2)) {
+    const args = [...argv];
+    const jsonMode = args.includes('--json');
+    const quiet = args.includes('--quiet');
+    const deliveryRaw = readFlag(args, '--delivery');
+    if (deliveryRaw && !DELIVERY_MODES.includes(deliveryRaw)) {
+        process.stderr.write(`[lint_svg_asset] unknown --delivery "${deliveryRaw}"; expected one of ${DELIVERY_MODES.join(', ')}\n`);
+        return 1;
+    }
+    const delivery = deliveryRaw;
+    // --- step 1.2: preservation readout -------------------------------------
+    const baseline = readFlag(args, '--baseline');
+    if (baseline) {
+        const files = readAll(args, '--file');
+        const after = files[0];
+        if (!after) {
+            process.stderr.write('[lint_svg_asset] --baseline needs a --file <after.svg> to compare against\n');
+            return 1;
+        }
+        if (!fs.existsSync(baseline) || !fs.existsSync(after)) {
+            process.stderr.write('[lint_svg_asset] --baseline or --file path not found\n');
+            return 1;
+        }
+        const allow = (readFlag(args, '--allow') ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+        const changes = preservationReadout(fs.readFileSync(baseline, 'utf-8'), fs.readFileSync(after, 'utf-8'), allow);
+        if (jsonMode) {
+            process.stdout.write(`${JSON.stringify(changes, null, 2)}\n`);
+            return changes.length ? 2 : 0;
+        }
+        if (!changes.length) {
+            if (!quiet) {
+                process.stdout.write(`✅  lint_svg_asset --baseline: nothing changed outside ${allow.length} allowed id(s).\n`);
+            }
+            return 0;
+        }
+        for (const c of changes) {
+            process.stdout.write(`❌ ${after} [svg-preserve-changed-outside-allowed] <${c.element} id="${c.id}"> ` +
+                `${c.attribute}: "${c.before}" → "${c.after}"\n`);
+        }
+        process.stdout.write(`\nlint_svg_asset: ${changes.length} element change(s) outside the allowed set. ` +
+            'A surgical edit touches only what it declared.\n');
+        return 2;
+    }
+    // --- scanning -----------------------------------------------------------
+    const explicit = readAll(args, '--file');
+    const dirArg = readFlag(args, '--dir');
+    const targets = [];
+    let roots = [];
+    if (explicit.length) {
+        targets.push(...explicit.map((f) => path.resolve(f)));
+        roots = targets;
+    }
+    else {
+        const scanDir = dirArg ? path.resolve(dirArg) : path.resolve(process.cwd(), 'src');
+        roots = [scanDir];
+        if (!fs.existsSync(scanDir)) {
+            // The two cases are NOT the same, and collapsing them into exit 0
+            // made a renamed or mistyped `--dir` report success in CI. An
+            // ABSENT DEFAULT root is the opt-in escape — a consumer with no
+            // `src/` has nothing to scan and must not red. An EXPLICIT `--dir`
+            // that does not resolve is a broken invocation, and this module's
+            // own header already says a gate that scanned no file is not a
+            // clean gate.
+            if (!quiet)
+                process.stderr.write(`[lint_svg_asset] scan directory not found: ${scanDir}\n`);
+            if (dirArg)
+                return 1;
+            process.stderr.write('This linter is opt-in. Run with --dir <path> or --file <a.svg> pointing at your assets.\n');
+            return 0;
+        }
+        for (const f of walkDir(scanDir, /\.(svg|html|htm)$/i))
+            targets.push(f);
+    }
+    const config = loadConfig(process.cwd());
+    const ignoreRules = new Set((config.ignoreRules ?? []).map((r) => r.toLowerCase()));
+    const ignoreGlobs = config.ignoreFiles ?? [];
+    const scanned = targets.filter((f) => !ignoreGlobs.some((g) => f.includes(g.replace('**', ''))));
+    try {
+        assertScanned({ gate: 'lint_svg_asset', scanned: scanned.length, units: 'SVG/HTML file(s)', roots });
+    }
+    catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
+    const all = [];
+    for (const abs of scanned) {
+        const rel = path.relative(process.cwd(), abs);
+        try {
+            const content = fs.readFileSync(abs, 'utf-8');
+            const findings = /\.svg$/i.test(abs)
+                ? scanSvg(content, rel, { delivery })
+                : scanHostHtml(content, rel, { delivery });
+            all.push(...findings.filter((f) => !ignoreRules.has(f.rule.toLowerCase())));
+        }
+        catch (err) {
+            if (!quiet)
+                process.stderr.write(`[lint_svg_asset] error: ${abs}: ${err}\n`);
+        }
+    }
+    if (jsonMode) {
+        process.stdout.write(`${JSON.stringify(all, null, 2)}\n`);
+        return all.length > 0 ? 2 : 0;
+    }
+    if (!all.length) {
+        if (!quiet) {
+            process.stdout.write(`✅  lint_svg_asset: clean — ${scanned.length} file(s) checked, no violations.\n`);
+        }
+        return 0;
+    }
+    const errors = all.filter((f) => f.severity === 'error');
+    const warnings = all.filter((f) => f.severity === 'warning');
+    const inert = all.filter((f) => f.severity === 'inert');
+    for (const f of all) {
+        const icon = f.severity === 'error' ? '❌' : f.severity === 'warning' ? '⚠️ ' : 'ℹ️ ';
+        process.stdout.write(`${icon} ${f.file}:${f.line} [${f.rule}] ${f.snippet}\n`);
+    }
+    process.stdout.write(`\nlint_svg_asset: ${errors.length} error(s), ${warnings.length} warning(s), ${inert.length} inert. ` +
+        'Use svg-asset-disable-next-line <rule> -- reason or .svg-asset.json to suppress; ' +
+        'svg-safety-* findings yield only to .svg-asset.json, never to a marker in the file. ' +
+        'Advisory: an "inert" row is not a clean row — the same file inlined tomorrow is an error.\n');
+    return 2;
+}
+/* c8 ignore start — entrypoint guard, exercised by the CLI not by the tests */
+const invokedDirectly = typeof process !== 'undefined' &&
+    Array.isArray(process.argv) &&
+    /lint_svg_asset\.(ts|js)$/.test(process.argv[1] ?? '');
+if (invokedDirectly)
+    process.exit(main());
+/* c8 ignore stop */
+//# sourceMappingURL=lint_svg_asset.js.map

package/docs/guidelines/design-antipatterns.md

@@ -114,7 +114,7 @@ Within-project invariants + repetition caps. Override = declare the value in
 | V2 | Glassmorphism as decoration (`backdrop-blur` + `bg-white/10`) with no functional depth hierarchy | Model defaults to it for "premium feel"; result looks like 2021 Material You clip-art | Element genuinely sits above a complex, blurred background layer; use sparingly and only for top-level floating surfaces | craft-presumption | delete → reduce | static |
 | V3 | Ghost card: `border: 1px solid` + box-shadow ≥ 16px spread together | The combination creates visual noise — the ghost card signals no confident decision about depth | Choose either border OR shadow to indicate depth; never both on the same surface | invariant | delete → reduce | static |
 | V4 | Over-rounded small cards or badges: `border-radius` > 16px on elements < 200px wide | Excessive rounding on small surfaces looks toy-ish; standard cap is 12–16px | Pill shape (`border-radius: 9999px`) is intentional on single-line tags/chips only | craft-presumption | retune | static |
-| V5 | Hand-drawn or illustrated SVG icons mixed with crisp icon-system icons | Visual register collision; instantly reads as "generated asset" | Intentional illustrative section (hero illustration, empty-state art); isolate from the icon system | invariant | replace | render |
+| V5 | Hand-drawn or illustrated SVG icons mixed with crisp icon-system icons | Visual register collision; instantly reads as "generated asset" | Intentional illustrative section (hero illustration, empty-state art); isolate from the icon system. A genuinely missing glyph is authored under [`svg-authoring`](../../src/skills/svg-authoring/SKILL.md) against the incumbent set's own grid | invariant | replace | render |
 | V6 | Repeating diagonal stripes as a background texture | A cliché background default; reads as generated CSS art | Brand explicitly uses pattern backgrounds (e.g., a textile brand); document the stripe definition | style-preference | delete | static |
 | V7 | Nested cards: a card inside a card inside a card | Depth hierarchy collapses; user cannot parse elevation intent | A truly three-level hierarchy (e.g., project → board → card); ensure each level has distinct visual weight | invariant | delete → reduce | render |
 | V9 | Noise or grain texture laid over a gradient as a "premium" surface default | The visual sibling of V6's diagonal stripes — a generated-CSS-art texture reached for to make a flat gradient look considered, applied because it is available rather than because the surface needed a texture | The texture is part of a documented brand surface treatment (a print-inspired or analog-photographic identity) with the grain opacity defined as a token, not chosen per surface | style-preference | delete | render |

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "16.4.0",
+    "version": "16.5.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,
@@ -80,7 +80,7 @@
     "scripts": {
         "build:cli": "tsc -p tsconfig.json && chmod +x dist/cli/agent-config.js",
         "build:install-bundle": "esbuild src/scripts/install.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/install/install.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
-        "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\" && node src/scripts/write_bundle_digest.mjs",
+        "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\" && node src/scripts/write_bundle_digest.mjs && npm run build:hook-chunks",
         "build:mcp-bundle": "esbuild src/scripts/mcp_server/__main__.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/mcp/server.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_MCP_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\"",
         "clean:cli-delegate": "rm -rf dist/cli-delegate",
         "build:delegates": "npm run clean:cli-delegate && npm run build:cli-delegate && npm run build:agent-src-delegate && npm run build:delegate-aux",
@@ -100,7 +100,8 @@
         "lint:publint": "publint",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",
         "prepublishOnly": "./scripts-run src/scripts/check_release_includes_discovery",
-        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true"
+        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true",
+        "build:hook-chunks": "esbuild src/scripts/_lib/svg_rules.ts --bundle --platform=node --format=cjs --target=node20 --outfile=dist/hooks/svg_rules.chunk.cjs && node src/scripts/write_bundle_digest.mjs dist/hooks/svg_rules.chunk.cjs"
     },
     "publishConfig": {
         "access": "public",

package/src/config/gate-violation-baselines.json

@@ -66,9 +66,9 @@
       "falsifier": "./scripts-run src/scripts/check_gate_coverage"
     },
     "lint_canonical_terms": {
-      "count": 1004,
-      "landed": "2026-09-13",
-      "note": "Lowered 1005 -> 1004 on 2026-09-13 by drain/adversarial-verification, on the same shape and the same discriminator as every entry below. That branch added a routed rule and then paid its per-spawn payload cost by migrating argument prose out of three standing rules (autonomous-execution, delegation-policy, evaluator-independence) into their context and guideline files under the P4 pattern. Nothing was deleted and nothing was swept: the migrated lines were REWRITTEN CANONICAL where the diff authored them, LINE-SCOPED, because `sweep_authorised: false` is still a live constraint. Most were net-neutral -- they replaced deleted lines carrying the same word -- and one is a genuine reduction. The gate reported the tree at 1004 against a baseline of 1005 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THE ENTRIES BELOW USE: the gate walks only authored prose under src/ and docs/, and a porcelain status over those two roots reported ZERO untracked files, so a clean CI checkout of this commit measures the same 1004. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1005 while the tree measures 1004 would never expire at any age. PRIOR ENTRY: Lowered 1006 -> 1005 on 2026-09-08 by drain/graph-shipped, on the same shape as the entry below and with the same discriminator. This branch's payload migration moved a See-also line carrying `artefact` from the rule into the code-intelligence skill; keeping the word in both places would have RAISED the count, so both occurrences were written canonical LINE-SCOPED — only lines this diff authored, never a file-wide sweep. One of the two is a genuine reduction. The gate reported the tree at 1005 against a baseline of 1006 and asked for exactly this lowering. `landed` is refreshed for the reason the prior entry records: checkRatchet returns `improved` before it evaluates staleness, so an entry left high never expires. PRIOR ENTRY: Lowered 1007 -> 1006 on 2026-09-07 by drain/observed-learning-signal, and the gain was INCIDENTAL rather than sought: the branch's own new prose introduced five house-dialect occurrences under src/ and docs/ (four `artefact`/`artefacts`, one `behaviour`), which were rewritten LINE-SCOPED — only lines this diff authored, never a file-wide sweep, because `sweep_authorised: false` is still a live constraint. Four of the five were net-neutral (they replaced deleted lines carrying the same word) and one was a genuine reduction. The gate reported the tree at 1006 against a baseline of 1007 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THIS FILE'S check_source_size_budget ENTRY USES: the gate walks only authored prose under src/ and docs/, and `git status --porcelain -uall -- src docs` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 1006. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1007 while the tree measures 1006 would never expire at any age. PRIOR ENTRY: House-dialect debt in authored prose under src/ and docs/, measured by the gate this entry governs (road-to-canonical-terms 2.2). NOT a dead-root repair: the gate is new, and the debt is the corpus that predates the dialect decision recorded in src/config/canonical-terms.yml. A hard-zero gate was refused on the same ground the AI council refused an unconditional sweep on 2026-08-25. The ratchet IS the council's staged promotion: report-only for existing debt, blocking for anything new. What remains is dominated by two large-radius pairs — `artefact`->`artifact` and `behaviour`->`behavior` — plus `hand-off`->`handoff` and `licence`->`license`, the last of which the map flags `semantic-care-required` because licence TITLES are protected text. Shrink-only from here. Full classified inventory: agents/evidence/analysis/canonical-terms-inventory-2026-08-26.md.",
+      "count": 1003,
+      "landed": "2026-10-11",
+      "note": "Lowered 1004 -> 1003 on 2026-10-11 by feat/svg-with-a-witness, on the same shape and the same discriminator as every entry below. The branch's own new prose introduced four house-dialect occurrences under src/ and docs/ -- `artefact` in the svg-authoring See-also note, `greys` in the wireframe output line, and `colour`/`centre` in two comments the map does not even carry -- and they were rewritten CANONICAL where the diff authored them, LINE-SCOPED, because `sweep_authorised: false` is still a live constraint. Three were net-neutral and one is a genuine reduction. The gate reported the tree at 1003 against a baseline of 1004 and asked for exactly this lowering BY NAME, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THE ENTRIES BELOW USE: the gate walks only authored prose under src/ and docs/, and a porcelain status over those two roots reports no untracked file, so a clean CI checkout of this commit measures the same 1003. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1004 while the tree measures 1003 would never expire at any age. PRIOR ENTRY: Lowered 1005 -> 1004 on 2026-09-13 by drain/adversarial-verification, on the same shape and the same discriminator as every entry below. That branch added a routed rule and then paid its per-spawn payload cost by migrating argument prose out of three standing rules (autonomous-execution, delegation-policy, evaluator-independence) into their context and guideline files under the P4 pattern. Nothing was deleted and nothing was swept: the migrated lines were REWRITTEN CANONICAL where the diff authored them, LINE-SCOPED, because `sweep_authorised: false` is still a live constraint. Most were net-neutral -- they replaced deleted lines carrying the same word -- and one is a genuine reduction. The gate reported the tree at 1004 against a baseline of 1005 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THE ENTRIES BELOW USE: the gate walks only authored prose under src/ and docs/, and a porcelain status over those two roots reported ZERO untracked files, so a clean CI checkout of this commit measures the same 1004. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1005 while the tree measures 1004 would never expire at any age. PRIOR ENTRY: Lowered 1006 -> 1005 on 2026-09-08 by drain/graph-shipped, on the same shape as the entry below and with the same discriminator. This branch's payload migration moved a See-also line carrying `artefact` from the rule into the code-intelligence skill; keeping the word in both places would have RAISED the count, so both occurrences were written canonical LINE-SCOPED — only lines this diff authored, never a file-wide sweep. One of the two is a genuine reduction. The gate reported the tree at 1005 against a baseline of 1006 and asked for exactly this lowering. `landed` is refreshed for the reason the prior entry records: checkRatchet returns `improved` before it evaluates staleness, so an entry left high never expires. PRIOR ENTRY: Lowered 1007 -> 1006 on 2026-09-07 by drain/observed-learning-signal, and the gain was INCIDENTAL rather than sought: the branch's own new prose introduced five house-dialect occurrences under src/ and docs/ (four `artefact`/`artefacts`, one `behaviour`), which were rewritten LINE-SCOPED — only lines this diff authored, never a file-wide sweep, because `sweep_authorised: false` is still a live constraint. Four of the five were net-neutral (they replaced deleted lines carrying the same word) and one was a genuine reduction. The gate reported the tree at 1006 against a baseline of 1007 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THIS FILE'S check_source_size_budget ENTRY USES: the gate walks only authored prose under src/ and docs/, and `git status --porcelain -uall -- src docs` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 1006. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1007 while the tree measures 1006 would never expire at any age. PRIOR ENTRY: House-dialect debt in authored prose under src/ and docs/, measured by the gate this entry governs (road-to-canonical-terms 2.2). NOT a dead-root repair: the gate is new, and the debt is the corpus that predates the dialect decision recorded in src/config/canonical-terms.yml. A hard-zero gate was refused on the same ground the AI council refused an unconditional sweep on 2026-08-25. The ratchet IS the council's staged promotion: report-only for existing debt, blocking for anything new. What remains is dominated by two large-radius pairs — `artefact`->`artifact` and `behaviour`->`behavior` — plus `hand-off`->`handoff` and `licence`->`license`, the last of which the map flags `semantic-care-required` because licence TITLES are protected text. Shrink-only from here. Full classified inventory: agents/evidence/analysis/canonical-terms-inventory-2026-08-26.md.",
       "falsifier": "./scripts-run src/scripts/lint_canonical_terms"
     },
     "lint_handoffs": {

package/src/config/routing-coverage-seed.json

@@ -10,11 +10,11 @@
     },
     "seed": {
         "rules": 0.9626,
-        "skills": 0.4147
+        "skills": 0.4167
     },
     "seed_provenance": {
         "rules": "103 covered of 107 routed rules on 2026-10-06; was 102 of 106 on 2026-09-13, 101 of 105 on 2026-09-08 and 94 of 105 (tier-1 21/24, tier-2 73/81) on 2026-08-25.",
-        "skills": "124 of 299 skills carry evals/triggers.json on 2026-10-10; was 123 on 2026-10-09, 119 on 2026-10-07, 118 after the third growth of 2026-10-06, 115 after the second growth that day, 114 earlier that day, 112 on 2026-10-04, 111 on 2026-10-02, 107 on 2026-10-01, 103 earlier that day, 102 on 2026-09-30, 101 on 2026-09-19 and 100 on 2026-08-30.",
+        "skills": "125 of 300 skills carry evals/triggers.json on 2026-10-11; was 124 of 299 on 2026-10-10, 123 on 2026-10-09, 119 on 2026-10-07, 118 after the third growth of 2026-10-06, 115 after the second growth that day, 114 earlier that day, 112 on 2026-10-04, 111 on 2026-10-02, 107 on 2026-10-01, 103 earlier that day, 102 on 2026-09-30, 101 on 2026-09-19 and 100 on 2026-08-30.",
         "finding": "The gap between the two seeds IS the roadmap defect D1, quantified. The rules surface is ~90% covered by a deterministic corpus that can fail a PR; the skills surface -- the one production routes on -- is far lower and is covered only by a harness that is advisory only, never gating (rule_trigger_eval.ts:4). The figure is deliberately not restated here (corrected 2026-10-01): it read `25%` against a seed that had since moved to 0.3445, which is the same count-drift this file's own history entries keep repairing one field away. The live value is `seed.skills`, two keys above."
     },
     "history": [
@@ -136,6 +136,13 @@
             "from": 0.4114,
             "to": 0.4147,
             "reason": "road-to-corpus-refresh-cadence-shape step 1.2c re-checked the `database` grounding corpus against PostgreSQL 18 and MySQL 9.7 reference documentation, which edited src/skills/database/data/, and check_routing_coverage requires a corpus for every skill a diff touches (123 -> 124 of 299). Same shape as the 2026-10-01 and 2026-10-04 entries this roadmap's 1.2a and 1.2b wrote, and for the same reason: the file is the gate's own remedy rather than a coverage push. Ten cases: five exemplars including the bare 'this query is slow' phrasing the skill's own description names verbatim and one German, three near-misses -- ORM model work and a migration-only ask, both named in that skill's 'Do NOT use when' block, plus schema-review for a persistence-rule review, which it does not name and which is included because it reads as a database question -- and two counterexamples guarding the 'database' homonym (a vector store as an embedding index, and a hosting/billing question). The seed rises to the live value; it may never be LOWERED. The partition is TRAIN, not holdout: sha256('database')[0:2] is 0x35 = 53, above the holdout ceiling of 51, so BOTH published train-side measurements are re-taken here on the terms the 2026-10-04 and 2026-10-09 entries set -- routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +6.75 pp against the +2.0 pp guard, train corpora 96 -> 97) and delivery-set-measurement-2026-08-31.json -- while the holdout pin's sealed set is untouched, because re-taking it would publish the same measurement under a newer date. ONE entry was removed from trigger_eval_grandfather.json: `database` was NOT red on main -- on main it ships no corpus at all, and check_trigger_eval_presence fires only on an allowlist entry whose skill HAS one, so its entry went stale the moment this change added the corpus. That red is created here and removed here."
+        },
+        {
+            "date": "2026-10-11",
+            "scope": "skills",
+            "from": 0.4147,
+            "to": 0.4167,
+            "reason": "`svg-authoring` landed as a new skill on the design family's vector side and shipped its own evals/triggers.json in the same change (124 of 299 -> 125 of 300). This is the FIRST entry on the skills scope where the DENOMINATOR moves: every entry above adds a case to a fixed 299, and this one adds a unit and a case together. The _comment names that as the ratio's other failure direction -- units added without cases -- and the repair it prescribes is the corpus file, not the seed; the file landed with the skill, so the ratio ROSE across a denominator increase (0.4147 -> 0.4167) rather than falling, which is the same shape as the 2026-09-13 and 2026-10-06 entries on the RULES scope. The seed rises to the live value; it may never be LOWERED. The partition is TRAIN, not holdout: sha256('svg-authoring')[0:2] is 0x77 = 119, above the holdout ceiling of 51, so BOTH published train-side measurements are re-taken here on the terms the 2026-10-04, 2026-10-09 and 2026-10-10 entries set. routing-body-signal-verdict.json: verdict unchanged in kind, still `harmful`, false activation +7.50 pp against the +2.0 pp guard, delta-recall 2.360 -> 3.383 pp (still below the 5.0 pp bar), train corpora 97 -> 98, catalogue 299 -> 300. The holdout pin IS touched, for two reasons rather than one: svg-authoring adds a train row, and the same branch EDITED image-provider-routing's existing train corpus -- it splits the vector job shapes between a provider and hand-authoring -- which moves that row's hash while moving no count at all, the case a reader counting files would miss. The sealed holdout set is the same 27 rows and byte-identical, so the ordering claim is untouched. NO entry was removed from trigger_eval_grandfather.json: the skill is new, so it was never allowlisted, and check_trigger_eval_presence fires only on an entry whose skill HAS a corpus."
         }
     ]
 }