@event4u/agent-config 16.4.0 → 17.0.0

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -25,13 +25,12 @@ NO SECRETS. NO EMAILS. NO PROJECT PATHS. NO CUSTOMER NAMES.
 NO INTERNAL HOSTNAMES. NO MONEY. NO BUSINESS SQL. NO LONG CODE.
 ```
 
-The redactor lives in `scripts/ai_council/redact_low_impact_entry.ts`
-and runs at **both** gates:
+The redactor — named under *See also* — runs at **both** gates:
 
 1. **Write gate** — every intake append to
-   `agents/decisions/low-impact-decisions.md` (Phase 12 § Step 2).
-2. **Upstream gate** — every `/memory learn-low-impact` PR draft,
-   before the diff leaves the repo (Phase 12 § Step 5).
+   `agents/decisions/low-impact-decisions.md`.
+2. **Review gate** — every `/memory learn-low-impact` preview; a refused
+   entry is named, never promoted.
 
 A failure at either gate refuses the operation, surfaces the
 offending pattern, and asks the user to rephrase. The redactor never
@@ -41,7 +40,7 @@ auto-rewrites — silent rewriting is a soft gate, this is hard.
 
 | # | Class | Pattern source |
 |---|---|---|
-| 1 | Secrets | raw-key prefixes from `scripts/ai_council/config._RAW_KEY_PREFIXES` + inline `api_key:` shape |
+| 1 | Secrets | raw-key prefixes from `_RAW_KEY_PREFIXES` in `src/scripts/ai_council/config.ts` + inline `api_key:` shape |
 | 2 | Emails | RFC-5322-ish |
 | 3 | Project-rooted paths | `/Users/`, `/home/`, `/opt/`, `/private/`, drive letters, configured `repo_root` |
 | 4 | Customer / tenant names | caller-supplied list; generic placeholders (`<customer>`, `<tenant>`, `<account>`, `<user>`) survive |
@@ -52,16 +51,16 @@ auto-rewrites — silent rewriting is a soft gate, this is hard.
 
 ## Locked target types
 
-- `agents/decisions/low-impact-decisions.md` — project-local corpus.
-- `data/low-impact-decisions-seed.md` (agent-config package) —
-  upstream seed shipped with the package.
+- `agents/decisions/low-impact-decisions.md` — the project-local corpus.
+- `data/low-impact-decisions-seed.md` — the package seed, **not in the
+  tree**. Locked anyway, so a reappearing seed arrives under the floor.
 
 ## When to invoke
 
-- The host agent has just received a user intake trigger (see
-  `scripts/ai_council/low_impact_intake.TRIGGER_PHRASES`).
-- The host agent is about to write an entry to the corpus or to
-  open a `/memory learn-low-impact` PR.
+- A user intake trigger arrived (`TRIGGER_PHRASES` in
+  `src/scripts/ai_council/low_impact_intake.ts`).
+- An entry is about to reach the corpus, or a
+  `/memory learn-low-impact` preview to render.
 
 ## What to surface on refusal
 
@@ -76,6 +75,6 @@ auto-rewrite.
 
 ## See also
 
-- `scripts/ai_council/redact_low_impact_entry.ts` — the redactor.
-- `scripts/ai_council/low_impact_intake.ts` — write-gate caller.
+- `src/scripts/ai_council/redact_low_impact_entry.ts` — the redactor.
+- `src/scripts/ai_council/low_impact_intake.ts` — write-gate caller.
 - `agents/decisions/low-impact-decisions.md` — corpus + Anti-Examples list.

package/dist/agent-src/rules/missing-skill-recovery.md

@@ -50,8 +50,9 @@ NEVER REBUILD A CAPABILITY BECAUSE ITS SKILL WAS NOT DELIVERED.
 
 1. **Ask by task, not by name.** A name you cannot see is a name you cannot
    type; a task description always works. The `suggest_skill_for_task` MCP tool
-   ranks `SKILL.md` frontmatter over the source tree and returns names, scores
-   and personas — no bodies, so a wrong rank costs one read.
+   ranks `SKILL.md` frontmatter over the source tree and returns names, scores,
+   personas and each row's description — no bodies. Choose by reading them; a
+   wrong rank costs one read, not five.
 2. **Open the winner and check it yourself.** The ranker is deterministic
    keyword scoring, not judgement. A high score is a pointer, not a verdict.
 3. **Say which source answered.** "The catalogue had no entry, the ranker
@@ -61,15 +62,15 @@ NEVER REBUILD A CAPABILITY BECAUSE ITS SKILL WAS NOT DELIVERED.
    inventing one. A ranked empty list and an unreachable catalogue are
    different answers; the tool distinguishes them (`status: no_catalogue`) and
    so should you.
-5. **If the tool is not registered, say THAT — and proceed.** This rule may
-   never instruct a call it cannot verify is possible. The tool arrives with
-   this package's MCP server, which `agent-config install` registers for the
-   `claude-code` tool in the project's `.mcp.json`. No entry there, or the
-   server not started, and there is no tool to call: name the gap in one clause,
-   proceed without a skill, and — only if the missing catalogue entry actually
-   mattered — point at `agent-config mcp:check`, which reports whether
-   `.mcp.json` carries the entry. Never retry a call that is not wired, and
-   never report "no skill covers this" when what you learned is "no tool
+5. **The tool is one rung, not the path.** This rule may never instruct a call
+   it cannot verify is possible, so step 1 is a LADDER, each rung named:
+   `suggest_skill_for_task`, which `agent-config install` wires into
+   `.mcp.json`; then
+   `agent-config route:explain --skills "<task>"`, the same rows from a shell,
+   no server, package skills as a last root. An unreachable rung is NAMED and
+   dropped — never retried, never answered from memory. Both gone: say which
+   failed, proceed without a skill, and `agent-config mcp:check` says if it is
+   wired. Never report "no skill covers this" when you learned "no rung
    answered".
 
 ## When NOT to fire

package/dist/agent-src/rules/neighbour-precedence.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2b"
-description: "A neighbour package's skill, always-on text or MCP tool text disagrees with this suite or the project — follow the source order below the four authority bands; name what you followed"
+description: "A neighbour skill, always-on or MCP tool text disagrees with this suite — follow the source order below the authority bands; name what you followed"
 triggers:
   - phrase: "neighbour skill"
   - phrase: "neighbor skill"

package/dist/agent-src/rules/recurring-criticism.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2b"
-description: "The same criticism arriving again indicts the system, not only the item — reopen the disposition that dismissed it, resolve on evidence, never on the repetition count"
+description: "The same criticism arriving again indicts the system, not only the item — reopen the dismissing disposition; resolve on evidence, never on the count"
 alwaysApply: false
 triggers:
   - phrase: "schon mehrfach"

package/dist/agent-src/rules/roadmap-ci-steps-policy.md

@@ -66,8 +66,6 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 
 ## See also
 
-- [`contexts/execution/roadmap-ci-steps-mechanics`](../contexts/execution/roadmap-ci-steps-mechanics.md)
-  — the migrated body.
 - [`verify-before-complete`](verify-before-complete.md) — the
   Iron Law this rule narrows; carve-out cites it.
 - [`roadmap-progress-sync`](roadmap-progress-sync.md) — inline flip

package/dist/agent-src/rules/self-repair-loop.md

@@ -46,8 +46,8 @@ work, not a notification:
 3. **Author the fix against agent-config** — in a checkout if one exists, so
    the release can be a pull request; otherwise the report alone becomes an
    issue.
-4. **Offer the release** — `agent-config self-repair:release <fingerprint>`;
-   `--dry-run` shows route and body without touching the network. Running it is
+4. **Offer the release** — `self-repair:release <fingerprint> --dry-run`
+   shows payloads, target and digest; `--approve <digest>` then sends them. That is
    the user's call, per
    [`non-destructive-by-default`](non-destructive-by-default.md).
 

package/dist/agent-src/rules/token-budget-discipline.md

@@ -51,8 +51,8 @@ A skill claiming `rich` MUST satisfy ALL three:
    carry a `load_context` pointer instead.
 
 3. **≤ 15 % of the suite's skills may claim `rich`** — the CI linter counts
-   rich-tagged skills and hard-fails if the ratio is exceeded. With 299 skills
-   the cap is ~44. Do not claim `rich` for convenience; claim it only for
+   rich-tagged skills and hard-fails if the ratio is exceeded. With 301 skills
+   the cap is ~45. Do not claim `rich` for convenience; claim it only for
    irreducible-complexity skills.
 
 ## Telegraph-speak amendment

package/dist/agent-src/scripts/dashboard_mode.ts

@@ -136,13 +136,16 @@ export function evaluateDashboardOnDisk(opts: {
     rel: string;
     regen?: string;
     noun?: string;
+    /** Applied to both sides before comparing — drops text that changes with the clock. */
+    normalize?: (text: string) => string;
 }): DashboardStateVerdict {
     const present = fs.existsSync(opts.target);
+    const norm = opts.normalize ?? ((t: string): string => t);
     return evaluateDashboardState({
         mode: opts.mode,
         present,
         trackedInGit: opts.mode === 'untracked' && isTrackedInGit(opts.target, opts.repo_root),
-        current: present && fs.readFileSync(opts.target, { encoding: 'utf-8' }) === opts.rendered,
+        current: present && norm(fs.readFileSync(opts.target, { encoding: 'utf-8' })) === norm(opts.rendered),
         rel: opts.rel,
         ...(opts.regen === undefined ? {} : { regen: opts.regen }),
         ...(opts.noun === undefined ? {} : { noun: opts.noun }),

package/dist/agent-src/scripts/roadmap_age.ts

@@ -0,0 +1,175 @@
+/**
+ * How long each active roadmap has gone without a ticked step, read from git.
+ *
+ * The dashboard printed percentages and nothing about time, so a file that
+ * landed weeks ago with every box open looked the same as one that landed
+ * this morning. Two ages per file, both from `git log` and never from a field
+ * an author writes: days since the file landed at its current path, and days
+ * since the last commit that ticked a step in it — a commit that adds more
+ * `[x]` lines than it removes.
+ *
+ * A file with no ticked step 21 days after landing is listed as a PARK
+ * PROPOSAL. It is text: nothing here moves, archives or deletes a file, because
+ * parking is a disposition a person makes (`roadmap-progress-sync`). One
+ * frontmatter line `renewed: <YYYY-MM-DD> — <reason>` clears the proposal for
+ * 21 days from that date.
+ *
+ * No git, a shallow clone, or a path git does not know → the ages read `—` and
+ * no proposal is made; an unknown age is never reported as a stall.
+ */
+
+import { spawnSync } from 'node:child_process';
+import * as path from 'node:path';
+
+export const STALL_DAYS = 21;
+
+export interface RoadmapAge {
+    /** Date the file was added at its current path, `YYYY-MM-DD`, or null. */
+    readonly landed: string | null;
+    /** Date of the newest commit that ticked a step, or null. */
+    readonly last_tick: string | null;
+}
+
+const DONE_LINE_RE = /^[ \t]*[-*][ \t]+\[[xX]\][ \t]/;
+
+/**
+ * Parse `git log -U0 -p --no-renames --format='@@C %as'` output into ages per
+ * repo-relative path. Pure, so the parser is testable without a repository.
+ */
+export function parse_age_log(log: string): Map<string, RoadmapAge> {
+    const landed = new Map<string, string>();
+    const ticked = new Map<string, string>();
+    let date: string | null = null;
+    let file: string | null = null;
+    let net = 0;
+    const flush = (): void => {
+        if (date !== null && file !== null && net > 0 && !ticked.has(file)) {
+            ticked.set(file, date);
+        }
+        net = 0;
+    };
+    for (const line of log.split('\n')) {
+        if (line.startsWith('@@C ')) {
+            flush();
+            date = line.slice(4).trim();
+            file = null;
+        } else if (line.startsWith('diff --git ')) {
+            flush();
+            const m = / b\/(.+)$/.exec(line);
+            file = m ? m[1]! : null;
+        } else if (line.startsWith('new file mode') && file !== null && date !== null) {
+            // newest first: the first add seen is the most recent landing
+            if (!landed.has(file)) landed.set(file, date);
+        } else if (line.startsWith('+') && !line.startsWith('+++')) {
+            if (DONE_LINE_RE.test(line.slice(1))) net++;
+        } else if (line.startsWith('-') && !line.startsWith('---')) {
+            if (DONE_LINE_RE.test(line.slice(1))) net--;
+        }
+    }
+    flush();
+    const out = new Map<string, RoadmapAge>();
+    for (const f of new Set([...landed.keys(), ...ticked.keys()])) {
+        out.set(f, { landed: landed.get(f) ?? null, last_tick: ticked.get(f) ?? null });
+    }
+    return out;
+}
+
+/** Ages for the given absolute roadmap paths, one `git log` call for all of them. */
+export function collect_ages(repo_root: string, roadmap_paths: readonly string[]): Map<string, RoadmapAge> {
+    if (roadmap_paths.length === 0) return new Map();
+    // A shallow clone reports every file as added in its boundary commit, so its ages are invented.
+    const shallow = spawnSync('git', ['rev-parse', '--is-shallow-repository'], { cwd: repo_root, encoding: 'utf-8' });
+    if (shallow.status !== 0 || String(shallow.stdout).trim() !== 'false') return new Map();
+    const rels = roadmap_paths.map((p) => path.relative(repo_root, p).split(path.sep).join('/'));
+    const r = spawnSync('git', ['log', '-U0', '-p', '--no-renames', '--format=@@C %as', '--', ...rels], {
+        cwd: repo_root,
+        encoding: 'utf-8',
+        maxBuffer: 256 * 1024 * 1024,
+    });
+    if (r.status !== 0 || typeof r.stdout !== 'string') return new Map();
+    return parse_age_log(r.stdout);
+}
+
+export function days_between(from: string, to: Date): number {
+    const t = Date.parse(`${from}T00:00:00Z`);
+    if (Number.isNaN(t)) return NaN;
+    const today = Date.UTC(to.getUTCFullYear(), to.getUTCMonth(), to.getUTCDate());
+    return Math.floor((today - t) / 86_400_000);
+}
+
+const RENEWED_RE = /^renewed:[ \t]*['"]?(\d{4}-\d{2}-\d{2})[ \t]*(?:—|–|-{1,2})[ \t]*(\S[^\n]*?)['"]?[ \t]*$/m;
+
+/** The renewal date in a frontmatter block, when it carries a reason. */
+export function renewal_date(frontmatter: string): string | null {
+    const m = RENEWED_RE.exec(frontmatter);
+    return m ? m[1]! : null;
+}
+
+/** Is this file a park proposal today? Unknown ages never are. */
+export function is_park_proposal(age: RoadmapAge | undefined, frontmatter: string, now: Date): boolean {
+    if (!age || age.landed === null) return false;
+    const since_landing = days_between(age.landed, now);
+    if (!(since_landing >= STALL_DAYS)) return false;
+    if (age.last_tick !== null && age.last_tick >= age.landed) return false;
+    const renewed = renewal_date(frontmatter);
+    const since_renewal = renewed === null ? NaN : days_between(renewed, now);
+    // A renewal dated in the future would clear the proposal forever, so it renews nothing.
+    if (since_renewal >= 0 && since_renewal < STALL_DAYS) return false;
+    return true;
+}
+
+export interface AgeRow {
+    readonly rel: string;
+    readonly frontmatter: string;
+    readonly age: RoadmapAge | undefined;
+}
+
+/** The dashboard section: two ages per file, then the park proposals. */
+export function render_age_section(rows: readonly AgeRow[], now: Date): string {
+    if (rows.length === 0) return '';
+    const cell = (d: string | null): string => (d === null ? '—' : String(days_between(d, now)));
+    const lines: string[] = [];
+    lines.push('## Age\n');
+    lines.push(
+        'Days since each active roadmap landed at its path and since its last ticked step, ' +
+            'read from `git log` (`—` = unknown, or never ticked).\n',
+    );
+    lines.push('| Roadmap | Days since landing | Days since last tick |');
+    lines.push('|---|---:|---:|');
+    for (const r of rows) {
+        lines.push(`| [${r.rel}](roadmaps/${r.rel}) | ${cell(r.age?.landed ?? null)} | ${cell(r.age?.last_tick ?? null)} |`);
+    }
+    lines.push('');
+    const proposals = rows.filter((r) => is_park_proposal(r.age, r.frontmatter, now));
+    if (proposals.length > 0) {
+        lines.push('## Park proposals\n');
+        lines.push(
+            `No ticked step ${String(STALL_DAYS)}+ days after landing. A proposal, never an action: ` +
+                'park it, or keep it and add `renewed: <YYYY-MM-DD> — <reason>` to its frontmatter, ' +
+                `which clears the proposal for ${String(STALL_DAYS)} days.\n`,
+        );
+        for (const r of proposals) {
+            lines.push(`- [${r.rel}](roadmaps/${r.rel}) — landed ${r.age?.landed ?? '?'}`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n') + '\n';
+}
+
+/**
+ * The dashboard without its `## Age` and `## Park proposals` blocks. Ages are
+ * relative to today, so `--check` compares this view: a committed dashboard
+ * must not go stale at midnight with no commit.
+ */
+export function strip_age_section(text: string): string {
+    // Only lines render_age_section writes are skipped, so anything else beside the block still counts.
+    const AGE_LINE = /^(## Age|## Park proposals|Days since each |No ticked step |\| Roadmap \||\|---\||\| \[|- \[|$)/;
+    const out: string[] = [];
+    let skipping = false;
+    for (const line of text.split('\n')) {
+        if (line === '## Age' || line === '## Park proposals') skipping = true;
+        else if (skipping && !AGE_LINE.test(line)) skipping = false;
+        if (!skipping) out.push(line);
+    }
+    return out.join('\n');
+}

package/dist/agent-src/scripts/update_roadmap_progress.ts

@@ -75,6 +75,7 @@ import { headerFragment as stubHeaderFragment } from './stubs_due.js';
 
 import { isCliEntry } from './_cli_entry.js';
 import { reportGuardedBaselines } from './guarded_baseline.js'; // third step state; contract lives there
+import { collect_ages, render_age_section, strip_age_section } from './roadmap_age.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 const _require = createRequire(import.meta.url);
@@ -1374,7 +1375,14 @@ function main(argv?: readonly string[]): number {
         }
     }
     const roadmaps = collect(roadmap_root), guarded = reportGuardedBaselines(roadmaps, repo_root);
-    const new_text = render(roadmaps, collect_bundles(repo_root), roadmap_root) + guarded.section;
+    const ages = collect_ages(repo_root, roadmaps.map((r) => r.path));
+    const age_rows = roadmaps.map((r) => ({
+        rel: r.rel,
+        frontmatter: FRONTMATTER_RE.exec(fs.readFileSync(r.path, 'utf-8'))?.[1] ?? '',
+        age: ages.get(_relPosix(repo_root, r.path)),
+    }));
+    const new_text =
+        render(roadmaps, collect_bundles(repo_root), roadmap_root) + render_age_section(age_rows, new Date()) + guarded.section;
     const complete = unarchived_complete(roadmaps);
     const pending = pending_iron_law_3(roadmaps);
     const gated = merge_gated_pending(roadmaps);
@@ -1397,7 +1405,7 @@ function main(argv?: readonly string[]): number {
     if (args.check) {
         const rel = _relPosix(repo_root, target);
         const r = reportCheckVerdict({
-            verdict: evaluateDashboardOnDisk({ mode: args.mode, target, repo_root, rendered: new_text, rel }),
+            verdict: evaluateDashboardOnDisk({ mode: args.mode, target, repo_root, rendered: new_text, rel, normalize: strip_age_section }),
             complete,
             pending,
             dashboardOnly: args.dashboard_only,

package/dist/agent-src/skills/accessibility-auditor/SKILL.md

@@ -64,7 +64,7 @@ colorblind fallbacks (`--domain chart`), and mobile touch/a11y rules
 corpus row; the WCAG 2.2 AA *method* stays this skill's own checklists.
 Widget-pattern selection (dialog, combobox, tabs, toast, table, form
 errors, drag-reorder …) grounds in the ARIA-APG corpus:
-`./scripts-run <skills-root>/corpus-grounding/scripts/ground search
+`node <skills-root>/corpus-grounding/scripts/ground.mjs search
 --manifest <skills-root>/accessibility-auditor/data/manifest.json
 "<component>"` →
 pattern, implementation, WCAG refs, anti-patterns
@@ -177,8 +177,8 @@ upstream color ramp, they never vendor a hex table:
   when the brief is light-only — dark mode arrives later.
 
 The ramp itself is authoritative in [`design-tokens`](../design-tokens/SKILL.md)
-(token derivation) and the consumer's [`brand-consistency`](../../rules/brand-consistency.md)
-tokens — this procedure sits beside that authority, it does not duplicate the
+(token derivation) and the consumer's tokens (`brand-source-of-truth`
+§ Iron Law 2) — this procedure sits beside that authority, it does not duplicate the
 values.
 
 ## Gotcha

package/dist/agent-src/skills/accessibility-auditor/data/aria-patterns.csv

@@ -11,3 +11,5 @@ Skip link & landmarks,skip link landmark main nav banner region,landmarks + skip
 Drag and drop / reorder,drag drop reorder sortable kanban move,keyboard-equivalent commands,Every drag operation has a keyboard path (move-up/move-down buttons or grab mode with arrows + announcements); aria-live announces position changes,"WCAG 2.1.1, 2.5.7",Pointer-only reordering,https://www.w3.org/WAI/ARIA/apg/patterns/listbox/
 Loading / busy state,loading spinner skeleton busy progress,aria-busy + progressbar/status,Region marked aria-busy during load OR role=progressbar with valuenow; announce completion via status region; skeletons are aria-hidden,WCAG 4.1.3,Spinner gif with no text alternative; focus lost on content swap,https://www.w3.org/WAI/ARIA/apg/patterns/meter/
 Icon-only button,icon button close edit delete aria-label svg,accessible name on control,aria-label (or visually-hidden text) on the button; svg aria-hidden=true focusable=false; hit area ≥44px,"WCAG 4.1.2, 2.5.8",title attribute as the only name; emoji as icon,https://www.w3.org/WAI/ARIA/apg/patterns/button/
+Meaningful standalone graphic,svg graphic chart diagram illustration logo standalone meaningful accessible name title desc,role=img + referenced title/desc,"role=img on the svg; a direct child title (plus optional desc) referenced by aria-labelledby using ids namespaced per instance; never aria-label together with title; delivered through img, the host alt is the accessible name and the inline title is unreachable","WCAG 1.1.1, 4.1.2","Generic id=""title"" reused by two inline graphics, so both announce the first one's name; title present without role=img; aria-label and title on the same element",https://www.w3.org/WAI/tutorials/images/complex/
+Decorative graphic,decorative ornament flourish background presentational aria-hidden empty alt svg,aria-hidden + empty host alt,"aria-hidden=true and focusable=false on the svg; delivered through img, an empty alt (never a missing alt, which lets the file name become the name); the graphic carries no title",WCAG 1.1.1,Alt text describing an ornament; aria-hidden on a graphic carrying the only copy of its information,https://www.w3.org/WAI/tutorials/images/decorative/

package/dist/agent-src/skills/accessibility-auditor/data/manifest.json

@@ -27,8 +27,8 @@
   "owner": "package-maintainer",
   "refresh_cadence": "quarterly",
   "upstream": {
-    "repo": "derived: W3C ARIA Authoring Practices Guide + WCAG 2.2",
-    "sha": "WCAG 2.2 W3C-REC-2024-12-12; APG continuously-published, menu-button canonical slug",
-    "last_checked": "2026-10-01"
+    "repo": "derived: W3C ARIA Authoring Practices Guide + WCAG 2.2 + W3C WAI Images Tutorial",
+    "sha": "WCAG 2.2 W3C-REC-2024-12-12; APG continuously-published, menu-button canonical slug; the two graphic rows re-derived 2026-10-11 from the WAI Images Tutorial (complex, decorative) against WCAG 1.1.1 / 4.1.2, and both retrieval queries re-run after the append — 'meaningful standalone svg chart graphic accessible name' moved off the icon-button row, 'icon only close button' kept it",
+    "last_checked": "2026-10-11"
   }
 }

package/dist/agent-src/skills/agent-security-review/SKILL.md

@@ -21,7 +21,7 @@ code vulnerabilities, this skill asks: *given this assembled agent config
 (rules, skills, MCP servers, hooks, permissions, memory), how would an attacker
 turn it against its owner, and what defensive gap lets them?*
 
-Pairs the static signal from [`/security-audit-config`](../../agent-src/commands/) with an
+Pairs the static signal from [`/security-audit-config`](../../commands/) with an
 adversarial three-lens pass. Output is **decision support** — surface the
 trade-off, name the gap; the human decides.
 
@@ -126,6 +126,6 @@ Recommend controls; never auto-apply config changes (per
 
 ## See also
 
-- [`/security-audit-config`](../../agent-src/commands/) — the static A–F counterpart.
+- [`/security-audit-config`](../../commands/) — the static A–F counterpart.
 - [`untrusted-input-defense`](../../rules/untrusted-input-defense.md), [`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md) — the prevention rules.
 - [`threat-modeling`](../threat-modeling/SKILL.md), [`judge-security-auditor`](../judge-security-auditor/SKILL.md), [`ai-council`](../ai-council/SKILL.md).

package/dist/agent-src/skills/agents-md-thin-root/SKILL.md

@@ -75,16 +75,24 @@ Every substantive pointer specifies, on the same line or the immediately followi
 ### Wrong vs. right
 
 ❌ **Wrong** — bare link, no *why*, no anchor:
-> See [`commit-policy`](dist/agent-src/rules/commit-policy.md).
+```markdown
+See [`commit-policy`](dist/agent-src/rules/commit-policy.md).
+```
 
 ❌ **Wrong** — *why* present but < 60 chars:
-> Commit rules: [`commit-policy`](dist/agent-src/rules/commit-policy.md).
+```markdown
+Commit rules: [`commit-policy`](dist/agent-src/rules/commit-policy.md).
+```
 
 ✅ **Right** — full anatomy, anchor, *why* ≥ 60 chars:
-> Commit policy — never auto-commit, four named exceptions, Hard Floor list of bulk-deletion / infra triggers: [`commit-policy § Iron Law`](dist/agent-src/rules/commit-policy.md#the-iron-law).
+```markdown
+Commit policy — never auto-commit, four named exceptions, Hard Floor list of bulk-deletion / infra triggers: [`commit-policy § Iron Law`](dist/agent-src/rules/commit-policy.md#the-iron-law).
+```
 
 ✅ **Right** — anchor optional when target is short:
-> Mirror the user's language every reply, single Iron Law that overrides any momentum: [`language-and-tone`](dist/agent-src/rules/language-and-tone.md).
+```markdown
+Mirror the user's language every reply, single Iron Law that overrides any momentum: [`language-and-tone`](dist/agent-src/rules/language-and-tone.md).
+```
 
 ## Workspace files — `packages/<n>/AGENTS.md`
 

package/dist/agent-src/skills/ai-code-blindspots/SKILL.md

@@ -93,6 +93,13 @@ rg -n 'NEXT_PUBLIC_.*(SECRET|KEY|TOKEN)|VITE_.*(SECRET|KEY)|localStorage\.setIte
 rg -n 'query\(.*(\+|\$\{|`).*\)|(SELECT|INSERT|UPDATE|DELETE).*(\+|\$\{)'
 # Hardcoded secrets / weak hashing
 rg -n 'AKIA[0-9A-Z]{16}|sk_live_|AIza[0-9A-Za-z_\-]{35}|password\s*=\s*["\x27]|md5\(|sha1\(' .
+# A fast hash over a PASSWORD — any SHA-2 counts, and a hand-rolled salt is
+# the same defect wearing a longer digest. `hash_file`/`hash('sha256', $blob)`
+# over a file or a body is NOT this, which is why the pattern is password-scoped.
+rg -n '(md5|sha1|sha224|sha256|sha384|sha512|hash|hashlib\.\w+)\s*\(\s*[^)]*(password|passwd|pwd)' .
+# A raw comparison on a secret — token, OTP, signature, MAC. Needs a
+# constant-time compare (hash_equals, crypto.timingSafeEqual).
+rg -n '\$?(token|otp|signature|mac|hmac|digest)\s*===?\s*|===?\s*\$?(token|otp|signature|mac|hmac)' .
 # Infra: wildcard IAM / open ingress / disabled TLS
 rg -n '"Action"\s*:\s*"\*"|"Resource"\s*:\s*"\*"|0\.0\.0\.0/0|InsecureSkipVerify|verify=false|curl.*\| *bash' .
 # Raw secret in an agent/MCP/CI config (should be an env-var reference, not a literal)

package/dist/agent-src/skills/ai-council/references/advanced-modes.md

@@ -1,5 +1,15 @@
 # ai-council — advanced modes
 
+<!-- reference-toc:start (generated by generate_reference_toc — do not edit) -->
+**Contents**
+
+- [Multi-round debate (rounds:N)](#multi-round-debate-roundsn)
+- [Karpathy peer-review (opt-in)](#karpathy-peer-review-opt-in)
+- [Thinking-style advisors (replace-mode)](#thinking-style-advisors-replace-mode)
+- [Decision-replay artifact (Phase 9, audit trail)](#decision-replay-artifact-phase-9-audit-trail)
+- [Lightweight-QA fast-path (Phase 11)](#lightweight-qa-fast-path-phase-11)
+<!-- reference-toc:end -->
+
 > Mode body of the [`ai-council`](../SKILL.md) skill (router-head retrofit,
 > 2026-08-20). Content moved VERBATIM from SKILL.md — load this file when the
 > mode table in SKILL.md routes here.
@@ -231,7 +241,7 @@ One-per-provider invariant — two enabled advisors targeting the same
 member is a config error (replace-mode runs exactly one advisor per
 provider; the call plan never doubles up by accident).
 
-## Decision-replay artefact (Phase 9, audit trail)
+## Decision-replay artifact (Phase 9, audit trail)
 
 Every session that runs consensus scoring drops a
 `decision-replay.md` next to the saved `responses.json`. Pure

package/dist/agent-src/skills/ai-council/references/cost-and-redaction.md

@@ -1,5 +1,12 @@
 # ai-council — cost awareness and redaction
 
+<!-- reference-toc:start (generated by generate_reference_toc — do not edit) -->
+**Contents**
+
+- [Redaction expectations](#redaction-expectations)
+- [Cost awareness](#cost-awareness)
+<!-- reference-toc:end -->
+
 > Mode body of the [`ai-council`](../SKILL.md) skill (router-head retrofit,
 > 2026-08-20). Content moved VERBATIM from SKILL.md — load this file when the
 > mode table in SKILL.md routes here.

package/dist/agent-src/skills/ai-council/references/execution-modes.md

@@ -1,5 +1,12 @@
 # ai-council — execution and degradation modes
 
+<!-- reference-toc:start (generated by generate_reference_toc — do not edit) -->
+**Contents**
+
+- [Execution modes](#execution-modes)
+- [Degradation modes](#degradation-modes)
+<!-- reference-toc:end -->
+
 > Mode body of the [`ai-council`](../SKILL.md) skill (router-head retrofit,
 > 2026-08-20). Content moved VERBATIM from SKILL.md — load this file when the
 > mode table in SKILL.md routes here.

package/dist/agent-src/skills/ai-council/references/output-and-synthesis.md

@@ -1,5 +1,13 @@
 # ai-council — output path and synthesis
 
+<!-- reference-toc:start (generated by generate_reference_toc — do not edit) -->
+**Contents**
+
+- [Output path convention](#output-path-convention)
+- [Certainty vocabulary — one scale for evidence, and what the survivors measure](#certainty-vocabulary--one-scale-for-evidence-and-what-the-survivors-measure)
+- [Synthesis templates (lens-aware)](#synthesis-templates-lens-aware)
+<!-- reference-toc:end -->
+
 > Mode body of the [`ai-council`](../SKILL.md) skill (router-head retrofit,
 > 2026-08-20). Content moved VERBATIM from SKILL.md — load this file when the
 > mode table in SKILL.md routes here.
@@ -54,6 +62,17 @@ matching `road-to-<topic-slug>` roadmap under `agents/roadmaps/`).
   bundling its triggering question, raw responses, and synthesis
   alongside the audit's findings). The layout linter
   (`scripts/check_council_layout.ts`) skips this directory.
+- `agents/evidence/council/` — a council record deliberately kept as
+  evidence (a verbatim transcription, a synthesis, an analysis of the
+  council subsystem). The runtime dirs are pruned, so a record meant to
+  last lives here, tracked.
+- `agents/evidence/reviews/council-<branch-slug>.findings.md` — a
+  completion-review artefact, named after its branch by contract. Only
+  that shape; any other `council-*` file in `reviews/` is still a finding.
+
+Everywhere else under `agents/evidence/` stays forbidden: `tracked-durable`
+is a retention class, not a placement licence (AI council 2026-10-14,
+anthropic + openai, 2/2).
 
 `scripts/check_council_layout.ts` is the mechanical check for the
 output path convention — wire it into the package's CI pipeline so

package/dist/agent-src/skills/ai-council/references/procedure.md

@@ -1,5 +1,12 @@
 # ai-council — procedure and critical evaluation
 
+<!-- reference-toc:start (generated by generate_reference_toc — do not edit) -->
+**Contents**
+
+- [Procedure](#procedure)
+- [Critical evaluation — convener-skeptic stance](#critical-evaluation--convener-skeptic-stance)
+<!-- reference-toc:end -->
+
 > Mode body of the [`ai-council`](../SKILL.md) skill (router-head retrofit,
 > 2026-08-20). Content moved VERBATIM from SKILL.md — load this file when the
 > mode table in SKILL.md routes here.

package/dist/agent-src/skills/api-design/SKILL.md

@@ -17,8 +17,8 @@ packs:
 
 > **Grounded corpus (Tier-1 consultation):** pagination, versioning,
 > error shape (RFC 9457), idempotency, async ops, rate limiting, bulk,
-> naming, expansion, webhooks — query `./scripts-run
-> <skills-root>/corpus-grounding/scripts/ground search --manifest
+> naming, expansion, webhooks — query `node
+> <skills-root>/corpus-grounding/scripts/ground.mjs search --manifest
 > <skills-root>/api-design/data/manifest.json "<concern>"` and propose
 > the grounded pattern (+ hardening + anti-patterns + RFC link) before
 > designing from memory. Corpus: [`data/api-patterns.csv`](data/api-patterns.csv).

package/dist/agent-src/skills/api-endpoint/SKILL.md

@@ -14,8 +14,8 @@ packs:
 
 > **Grounded corpus:** endpoint-shape decisions (pagination, error
 > shape, idempotency, rate limits) are grounded via the
-> [`api-design`](../api-design/SKILL.md) corpus — `./scripts-run
-> <skills-root>/corpus-grounding/scripts/ground search
+> [`api-design`](../api-design/SKILL.md) corpus — `node
+> <skills-root>/corpus-grounding/scripts/ground.mjs search
 > --manifest <skills-root>/api-design/data/manifest.json "<concern>"`.
 
 ## When to use

package/dist/agent-src/skills/authz-review/SKILL.md

@@ -23,7 +23,7 @@ triggers:
 > **Grounded corpus (Tier-1 consultation):** the threat corpus's
 > `authorization` + `tenancy` rows (IDOR, mass-assignment escalation,
 > unscoped queries, sealed job context — each with negative tests) come
-> from `./scripts-run <skills-root>/corpus-grounding/scripts/ground ground
+> from `node <skills-root>/corpus-grounding/scripts/ground.mjs ground
 > --manifest <skills-root>/threat-modeling/data/manifest.json "<the check
 > being reviewed>"`. Cite corpus rows in findings instead of restating from
 > memory; surface the evidence gap when the corpus has no row.
@@ -247,8 +247,10 @@ Runtime confirmation (e.g. *"reproduce the cross-tenant read against staging"*,
 
 ## References
 
-- **OWASP ASVS v4.0.3** — Chapter V4 Access Control, especially V4.1
-  (General Access Control Design) and V4.2 (Operation-level Access Control).
+- **OWASP ASVS v5.0.0** — Chapter V8 Authorization. `threat-modeling`'s
+  References records the chapter renumbering and the migration guide it comes
+  from; the old numbering is deliberately not repeated here, so there is one
+  place to correct when the standard moves again.
   [owasp.org/www-project-application-security-verification-standard/](https://owasp.org/www-project-application-security-verification-standard/)
 - **OWASP Top 10 2021 — A01 Broken Access Control** — canonical failure modes
   (IDOR, missing function-level checks, forced browsing, metadata tampering).