@event4u/agent-config 16.4.0 → 17.0.0

package/src/scripts/compile_trigger_evals.ts

@@ -0,0 +1,353 @@
+/**
+ * Compile the trigger corpus into cases the HOST's own evaluator can run.
+ *
+ * `road-to-a-trigger-suite-the-host-grades` Phases 2 and 3. The corpus is 125
+ * `src/skills/*‌/evals/triggers.json` files holding ~1,200 labelled queries, in
+ * two shapes. This emits one case per query in the shape pinned from the host
+ * in `tests/fixtures/plugin-eval/`, tagged `holdout` or `train` by the frozen
+ * partition rule, and prints — never runs — the command that would score them.
+ *
+ * ```
+ * IT PRINTS. IT DOES NOT RUN.
+ * THE SESSION THAT AUTHORED A CORPUS MAY NOT CHOOSE THE PROTOCOL THAT MEASURES IT.
+ * ```
+ *
+ * That is D1, and it is the whole reason this file stops where it does: the
+ * parked `road-to-routing-assurance-live-floors` holds the first scored run
+ * behind an un-park condition, a run is spend, and a host-written grader does
+ * not lift the independence objection because the protocol choice is the point.
+ *
+ * Output goes only under a caller-supplied directory, which the repository
+ * gitignores: a compiled case committed to the tree would be a second corpus,
+ * and the partition would then be a property of two places instead of one.
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/compile_trigger_evals --out <dir>
+ *   ./scripts-run src/scripts/compile_trigger_evals --print-run --out <dir> \
+ *       --target <plugin> --tag partition:train --runs 3 --max-cost-usd 5 \
+ *       --protocol <path>
+ */
+
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, '..', '..');
+
+/**
+ * The partition constant `trigger-corpus-holdout-2026-08-30.md` freezes.
+ * Changing it re-partitions the corpus, which is why it is read from here and
+ * from `trigger_corpus_holdout_pin.test.ts` rather than written twice.
+ */
+export const HOLDOUT_CEILING = 51;
+
+/**
+ * `holdout iff sha256(<skill-directory-name>).digest()[0] < 51`.
+ *
+ * Keyed on the DIRECTORY NAME and never on the file's contents, so editing a
+ * corpus cannot move a skill across the boundary — the property the holdout
+ * artefact calls "why this does not touch the seal".
+ */
+export function partitionOf(skill: string): 'holdout' | 'train' {
+    const bucket = parseInt(createHash('sha256').update(skill).digest('hex').slice(0, 2), 16);
+    return bucket < HOLDOUT_CEILING ? 'holdout' : 'train';
+}
+
+/** One labelled query, from either corpus shape. */
+export interface LabelledQuery {
+    skill: string;
+    /** The corpus's own id where it has one; otherwise a positional fallback. */
+    id: string;
+    query: string;
+    /** True where the query SHOULD activate `skill`. */
+    trigger: boolean;
+    /** `exemplar` / `near-miss` / `counterexample`, or null in the second shape. */
+    cls: string | null;
+}
+
+interface RawQuery {
+    id?: unknown;
+    q?: unknown;
+    query?: unknown;
+    trigger?: unknown;
+    class?: unknown;
+}
+
+function isObj(v: unknown): v is Record<string, unknown> {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/**
+ * Every labelled query under `skillsRoot`, from BOTH shapes.
+ *
+ * 123 files use `queries[]` with `trigger` and `class`; two use
+ * `should_trigger` / `should_not_trigger` string arrays. A compiler that read
+ * only the majority shape would drop the other two silently, which is the
+ * failure the fixture in the test exists to catch.
+ */
+export function readCorpus(skillsRoot: string): LabelledQuery[] {
+    const out: LabelledQuery[] = [];
+    if (!fs.existsSync(skillsRoot)) return out;
+    for (const skill of fs.readdirSync(skillsRoot).sort()) {
+        const file = path.join(skillsRoot, skill, 'evals', 'triggers.json');
+        if (!fs.existsSync(file)) continue;
+        let doc: unknown;
+        try {
+            doc = JSON.parse(fs.readFileSync(file, 'utf8'));
+        } catch (err) {
+            // A skipped file shrinks the compiled set with no trace; refuse instead.
+            throw new Error(`compile_trigger_evals: ${path.relative(skillsRoot, file)} is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+        }
+        if (!isObj(doc)) continue;
+
+        if (Array.isArray(doc['queries'])) {
+            (doc['queries'] as RawQuery[]).forEach((q, i) => {
+                if (!isObj(q)) return;
+                const text = typeof q.q === 'string' ? q.q : typeof q.query === 'string' ? q.query : null;
+                if (text === null) return;
+                out.push({
+                    skill,
+                    id: typeof q.id === 'string' && q.id !== '' ? q.id : `q${String(i + 1)}`,
+                    query: text,
+                    trigger: q.trigger === true,
+                    cls: typeof q.class === 'string' && q.class !== '' ? q.class : null,
+                });
+            });
+            continue;
+        }
+
+        for (const [key, trigger] of [
+            ['should_trigger', true],
+            ['should_not_trigger', false],
+        ] as const) {
+            const arr = doc[key];
+            if (!Array.isArray(arr)) continue;
+            arr.forEach((text, i) => {
+                if (typeof text !== 'string' || text === '') return;
+                out.push({
+                    skill,
+                    id: `${key === 'should_trigger' ? 'pos' : 'neg'}${String(i + 1)}`,
+                    query: text,
+                    trigger,
+                    cls: null,
+                });
+            });
+        }
+    }
+    return out;
+}
+
+/** One emitted case: where it was written and what it is tagged with. */
+export interface CompiledCase {
+    skill: string;
+    id: string;
+    /** Directory under the output root, one per case. */
+    dir: string;
+    tags: string[];
+}
+
+/** A filesystem-safe fragment of an arbitrary corpus id. */
+function slug(s: string): string {
+    return s.replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'case';
+}
+
+/**
+ * The grader body for one query.
+ *
+ * Risk 3 of the roadmap, and the reason this is not "no skill was used": a
+ * query that should not trigger skill A may rightly trigger skill B, and a
+ * grader asserting "no skill at all" would score that correct neighbour as a
+ * miss. The assertion is only ever about the NAMED skill.
+ */
+function graderBody(skill: string, trigger: boolean): string {
+    return trigger
+        ? [
+              '---',
+              'type: llm',
+              'weight: 1',
+              '---',
+              '',
+              `The response is successful when the \`${skill}\` skill was used to answer.`,
+              '',
+              'Judge only whether that named skill was used. Using additional skills',
+              'alongside it is not a failure.',
+              '',
+          ].join('\n')
+        : [
+              '---',
+              'type: llm',
+              'weight: 1',
+              '---',
+              '',
+              `The response is successful when the \`${skill}\` skill was not used.`,
+              '',
+              `Judge only the absence of that named skill. Another skill answering`,
+              'this query is correct behaviour and is not a failure.',
+              '',
+          ].join('\n');
+}
+
+/** The prompt body for one query, in the shape pinned from the host. */
+function promptBody(query: string): string {
+    return ['---', 'max_turns: 10', 'allowed_tools: [Read, Glob, Grep, Skill]', '---', '', query, ''].join('\n');
+}
+
+/**
+ * Refuse an output directory inside the repository that git would track.
+ *
+ * AC-3 is "no compiled case is committed to the tree", and a convention is not
+ * a mechanism: ~1,200 generated directories staged by one `git add -A` is the
+ * failure, and it only has to happen once. Outside the repository there is
+ * nothing to commit, so only the inside case is checked — and `git` deciding
+ * is deliberate, because a path list here would drift from `.gitignore`.
+ */
+function refuseTrackedOutput(outDir: string): void {
+    const abs = path.resolve(outDir);
+    const rel = path.relative(REPO_ROOT, abs);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) return;
+    const probe = path.join(abs, '.compile-probe');
+    const res = spawnSync('git', ['-C', REPO_ROOT, 'check-ignore', '-q', probe], { encoding: 'utf8' });
+    // 0 = ignored, 1 = not ignored, 128 = not a repository (then nothing can be
+    // committed). Anything else — git missing, killed — cannot say, so refuses.
+    if (res.status !== 0 && res.status !== 128) {
+        throw new Error(
+            `compile_trigger_evals: ${rel} is inside the repository and not gitignored. ` +
+                'Compiled cases are never committed (AC-3) — use a gitignored path such as ' +
+                'agents/runtime/trigger-evals, or a directory outside the repository.',
+        );
+    }
+}
+
+/**
+ * Compile `skillsRoot` into `outDir`, one case per labelled query.
+ *
+ * Writes nothing outside `outDir` — the corpus is read-only to this function,
+ * which the test asserts by comparing the corpus listing before and after.
+ */
+export function compileCorpus(skillsRoot: string, outDir: string): CompiledCase[] {
+    refuseTrackedOutput(outDir);
+    const cases: CompiledCase[] = [];
+    const owner = new Map<string, string>();
+    for (const q of readCorpus(skillsRoot)) {
+        const dir = path.join(slug(q.skill), slug(q.id));
+        const prior = owner.get(dir);
+        if (prior !== undefined) {
+            throw new Error(`compile_trigger_evals: ${q.skill}/${q.id} and ${prior} both compile to ${dir}`);
+        }
+        owner.set(dir, `${q.skill}/${q.id}`);
+        const abs = path.join(outDir, dir);
+        fs.mkdirSync(path.join(abs, 'graders'), { recursive: true });
+        fs.writeFileSync(path.join(abs, 'prompt.md'), promptBody(q.query));
+        fs.writeFileSync(path.join(abs, 'graders', 'criteria.md'), graderBody(q.skill, q.trigger));
+        const tags = [`skill:${q.skill}`, `partition:${partitionOf(q.skill)}`];
+        if (q.cls !== null) tags.push(`class:${q.cls}`);
+        fs.writeFileSync(path.join(abs, 'tags.txt'), tags.join('\n') + '\n');
+        cases.push({ skill: q.skill, id: q.id, dir, tags });
+    }
+    return cases;
+}
+
+/** Everything a printable run command must carry. */
+export interface RunRequest {
+    evalDir: string;
+    target: string;
+    tag: string;
+    runs: number;
+    maxCostUsd: number;
+    protocol: string;
+}
+
+/**
+ * The command a scored run would use — printed, never executed.
+ *
+ * It refuses to print one that is missing a part, because an incomplete
+ * command is the one somebody completes by hand under time pressure:
+ *
+ *   - `--no-publish` is not optional and not a parameter. D3: the host
+ *     publishes its HTML report to the account by DEFAULT, and that report
+ *     carries prompts and grader verdicts off the machine.
+ *   - `--runs` and `--max-cost-usd` are explicit because the host's defaults
+ *     (the case's own value, or 3) are not a decision anybody recorded.
+ *   - `--protocol` is a path to a file the RUNNER writes under the parked
+ *     roadmap's un-park condition. Without it there is no record of who chose
+ *     the protocol, which is the independence objection itself.
+ */
+export function printRunCommand(req: RunRequest): string {
+    if (req.evalDir === '') throw new Error('print-run: an eval directory is required');
+    if (req.target === '') throw new Error('print-run: a target is required');
+    if (req.tag === '') throw new Error('print-run: a tag selection is required');
+    if (!Number.isInteger(req.runs) || req.runs < 1) throw new Error('print-run: an explicit --runs count is required');
+    if (!(req.maxCostUsd > 0)) throw new Error('print-run: an explicit --max-cost-usd ceiling is required');
+    if (req.protocol === '') throw new Error('print-run: a protocol file path is required');
+    return [
+        'claude plugin eval',
+        `--eval-dir ${req.evalDir}`,
+        `--tag ${req.tag}`,
+        `--runs ${String(req.runs)}`,
+        `--max-cost-usd ${String(req.maxCostUsd)}`,
+        '--no-publish',
+        req.target,
+        `# protocol: ${req.protocol}`,
+    ].join(' ');
+}
+
+function arg(argv: readonly string[], name: string): string | null {
+    const i = argv.indexOf(`--${name}`);
+    if (i >= 0 && i + 1 < argv.length) return argv[i + 1] as string;
+    const eq = argv.find((a) => a.startsWith(`--${name}=`));
+    return eq === undefined ? null : eq.slice(name.length + 3);
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    if (argv.includes('-h') || argv.includes('--help')) {
+        process.stdout.write(
+            'usage: compile_trigger_evals --out DIR [--skills DIR]\n' +
+                '       compile_trigger_evals --print-run --out DIR --target T --tag TAG \\\n' +
+                '           --runs N --max-cost-usd N --protocol PATH\n\n' +
+                'Compiles the trigger corpus into host-shaped eval cases. It never runs them.\n',
+        );
+        return 0;
+    }
+    const out = arg(argv, 'out');
+    if (out === null) {
+        process.stderr.write('compile_trigger_evals: --out DIR is required\n');
+        return 2;
+    }
+    const skills = arg(argv, 'skills') ?? path.join(REPO_ROOT, 'src', 'skills');
+
+    if (argv.includes('--print-run')) {
+        try {
+            process.stdout.write(
+                printRunCommand({
+                    evalDir: out,
+                    target: arg(argv, 'target') ?? '',
+                    tag: arg(argv, 'tag') ?? '',
+                    runs: Number(arg(argv, 'runs') ?? 0),
+                    maxCostUsd: Number(arg(argv, 'max-cost-usd') ?? 0),
+                    protocol: arg(argv, 'protocol') ?? '',
+                }) + '\n',
+            );
+        } catch (err) {
+            process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+            return 2;
+        }
+        return 0;
+    }
+
+    const cases = compileCorpus(skills, out);
+    const holdout = cases.filter((c) => c.tags.includes('partition:holdout')).length;
+    process.stdout.write(
+        `compile_trigger_evals: ${String(cases.length)} case(s) -> ${out} ` +
+            `(${String(holdout)} holdout, ${String(cases.length - holdout)} train)\n` +
+            'Nothing was run. Print the command with --print-run; the run itself is a\n' +
+            "decision recorded on later/road-to-routing-assurance-live-floors, not here.\n",
+    );
+    return 0;
+}
+
+if (process.argv[1] !== undefined && import.meta.url === `file://${process.argv[1]}`) {
+    process.exit(main());
+}

package/src/scripts/condense.ts

@@ -53,6 +53,7 @@ import { build_claude_hook_matrix } from './_lib/claude_settings_hooks.js';
 import { describeDroppedHosts, resolveLeanProjection, thinsHost,
     writesThinFiles, type LeanProjectionHosts, type LeanProjectionMode } from './_lib/lean_projection_mode.js';
 import { is_claude_builtin_name } from './_lib/claude_builtin_names.js';
+import { nativeFieldLines } from './_lib/subagent_native_fields.js';
 import { project_settings_path, load_agent_settings } from './_lib/agent_settings.js';
 import { rule_is_compile_enabled } from './_lib/compile_time_toggles.js';
 import { resolve_rule_pack_scope } from './_lib/scoped_projection.js';
@@ -462,14 +463,12 @@ function _read_projection_scope_dedup(): boolean {
 
 
 function _lean_projection_settings(): { mode: LeanProjectionMode; hosts: LeanProjectionHosts } {
-    // Step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo`: this is
-    // now the shared resolver rather than one of three private readers. The
-    // INPUT is unchanged — `MODULE_STATE.SETTINGS_FILE` is still the file, so
-    // the projector's answer is the answer it always gave — and only the code
-    // that interprets it is shared. That is risk 2 of the roadmap's register
-    // ("making the hook agree with the projector could also move the
-    // projector") discharged by construction instead of by a test alone.
-    return resolveLeanProjection({ settingsPath: MODULE_STATE.SETTINGS_FILE });
+    // Step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo` made this
+    // the ONE shared resolver; ADR-293 changed what it reads — the settings key
+    // is gone, so the input is `PROJECT_ROOT`, where the form record lives.
+    // Projector and hook still share one reader, which is how risk 2 of that
+    // roadmap's register is discharged by construction.
+    return resolveLeanProjection({ packageRoot: MODULE_STATE.PROJECT_ROOT });
 }
 
 // --- hashing -----------------------------------------------------------------
@@ -940,10 +939,10 @@ export { _HRR_BANNER_MARKER };
 
 // ── Consumer-scoped rule projection (road-to-request-scoped-rule-load P1) ──
 //
-// Opt-in via `projection.rule_workspaces: [<workspace-id>, …]` in
-// `.agent-settings.yml`. Absent / empty = legacy-all (every rule projects —
-// today's behaviour, non-breaking). When set, a non-kernel rule projects
-// only if its `workspaces:` frontmatter intersects the configured set.
+// Scope came from `projection.rule_workspaces` until ADR-293 step 4.6 removed
+// the key; `consumerRuleWorkspaces` derives the CONSUMER scope now and the
+// MAINTAINER projection below is unscoped by construction. A non-kernel rule
+// projects into a scoped tree only if its `workspaces:` frontmatter intersects.
 // Kernel rules (`type: always` / `alwaysApply: true`) ALWAYS project —
 // the kernel is unconditional and workspace-independent by definition
 // (rule-router contract § Schema v2). Untagged rules fail safe: they ship.
@@ -957,16 +956,16 @@ function _read_projection_raw(key: string): unknown {
         : null;
 }
 
-function _read_projection_list(key: string): string[] | null {
-    const value = _read_projection_raw(key);
-    if (Array.isArray(value) && value.length > 0) {
-        return value.map((v) => String(v));
-    }
-    return null;
-}
-
+/**
+ * The MAINTAINER projection is never workspace-scoped — a constant since
+ * ADR-293 step 4.6, not a settings read. `consumerRuleWorkspaces` subtracts
+ * `agent-config-maintainer`, and this is the one tree where that subtraction
+ * would be wrong: the repository's own `.claude/rules` must carry exactly the
+ * rules it drops. So this stays the inactive axis, which is what an absent key
+ * always meant here.
+ */
 function _read_rule_workspaces(): string[] | null {
-    return _read_projection_list('rule_workspaces');
+    return null;
 }
 
 /** `runtime.active_packs` overlay, empty when unset (fresh-install default). */
@@ -1975,11 +1974,6 @@ export function generate_claude_subagents(): number {
         const tools = Array.isArray(toolsRaw) ? toolsRaw.map((t) => String(t)).join(', ') : String(toolsRaw ?? '');
         const tier = typeof fm['model_tier'] === 'string' ? (fm['model_tier'] as string) : 'inherit';
         const model = tier === 'inherit' ? 'inherit' : (_TIER_TO_CLAUDE_MODEL[tier] ?? 'inherit');
-        // Optional pinned reasoning effort (skill-quality-gates Phase 4, Source S):
-        // pass through to the native frontmatter only when the source declares it —
-        // hosts without an effort knob never see the key.
-        const effort = typeof fm['effort'] === 'string' ? (fm['effort'] as string) : null;
-
         const guardedBody =
             defense !== '' && !body.includes('prompt-defense-preamble')
                 ? `\n${defense}\n${body}`
@@ -1990,7 +1984,7 @@ export function generate_claude_subagents(): number {
             `description: ${description}\n` +
             `tools: ${tools}\n` +
             `model: ${model}\n` +
-            (effort !== null ? `effort: ${effort}\n` : '') +
+            nativeFieldLines(fm) + // effort, maxTurns, background, skills, omitClaudeMd — only when declared
             '---\n' +
             guardedBody;
 
@@ -2165,10 +2159,10 @@ description: >-
 
 # Install agent-config
 
-This plugin is a **bootstrap shim**. It exists so the marketplace listing
-stays discoverable and existing plugin installs keep working hooks — the
-content surface (skills, rules, commands, personas) is distributed as a
-file projection, not through this plugin.
+This plugin is a **bootstrap shim** kept so the marketplace listing stays
+discoverable. Its hooks run only alongside a global npm install of the package (never a project-local one) —
+on a plugin-only install no hook runs, so the \`fail_closed\` guards (\`block-no-verify\`, \`block-kernel-rule-writes\`,
+\`block-plumbing-writes\`) are **off**; the session start says so once. Content ships as a file projection.
 
 ## Install (canonical, one command)
 

package/src/scripts/consumer_matrix.ts

@@ -43,6 +43,13 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { MANAGED_SIGNATURE } from './_lib/claude_settings_hooks.js';
+import {
+    classifySettingsDelta,
+    compareInstallerDelta,
+    emitReleasedSurface,
+    readReleasedSurface,
+    type InstallerDelta,
+} from './_lib/release_settings_surface.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
@@ -622,9 +629,19 @@ function legUninstall(ctx: Ctx): string {
         env: binEnv(ctx),
     });
     if (r.status !== 0) throw new Error(`uninstall exit ${r.status}: ${(r.stdout + r.stderr).slice(-600)}`);
+    // A plain uninstall preserves ~/.claude, so the lockfile it records is kept
+    // for the purge that can still remove it; only the purge may delete it.
     const lock = path.join(ctx.tmpRoot, 'home', '.event4u', 'agent-config', 'installed.lock');
-    if (fs.existsSync(lock)) throw new Error(`global lockfile still present after uninstall: ${lock}`);
-    return 'uninstall --global green, lockfile removed';
+    if (!fs.existsSync(lock)) throw new Error(`plain uninstall deleted the lockfile the purge needs: ${lock}`);
+    const p = run(ctx.bin, ['uninstall', '--global', '--tools=claude-code,cursor,windsurf', '--purge', '--force'], {
+        cwd: ctx.projectDir,
+        env: binEnv(ctx),
+    });
+    if (p.status !== 0) throw new Error(`uninstall --purge exit ${p.status}: ${(p.stdout + p.stderr).slice(-600)}`);
+    if (fs.existsSync(lock)) throw new Error(`global lockfile still present after uninstall --purge: ${lock}`);
+    const runtime = path.join(ctx.tmpRoot, 'home', '.event4u', 'agent-config', 'runtime');
+    if (fs.existsSync(runtime)) throw new Error(`staged hook runtime still present after uninstall --purge: ${runtime}`);
+    return 'uninstall --global keeps the lockfile; --purge removes it and the staged runtime';
 }
 
 function legUpgrade(ctx: Ctx): string {
@@ -657,7 +674,48 @@ function legUpgrade(ctx: Ctx): string {
     if (r.status !== 0) {
         throw new Error(`conformance red after ${published} → tarball upgrade: ${(r.stdout + r.stderr).slice(-600)}`);
     }
-    return `upgrade ${published} → packed tarball, conformance green`;
+    return `upgrade ${published} → packed tarball, conformance green; ${assertUpgradeDelta(upHome, published)}`;
+}
+
+/**
+ * The assertion the archived upgrade step promised and never wrote.
+ *
+ * `road-to-proof-under-real-conditions` closed a step reading "settings-sync
+ * produces the expected upgrade-delta" and named `conformance` as the probe.
+ * `conformance` reads no delta, so the leg installed two versions and asserted
+ * nothing about the surface between them. This reads the delta the UPGRADE
+ * wrote from shipped bytes and requires it to equal the one the release
+ * computes from its committed file for the same pair.
+ *
+ * Absent delta file: the installer only writes one when the two versions
+ * differ and something changed. Nothing to compare is not a disagreement, and
+ * saying so is the honest reading — the test for this comparison lives in
+ * `tests/scripts/consumer_matrix_settings_delta.test.ts`, which does not need
+ * the network to exercise the branches.
+ */
+export function assertUpgradeDelta(upHome: string, published: string): string {
+    const deltaPath = path.join(upHome, '.event4u', 'agent-config', 'state', 'settings-delta.json');
+    if (!fs.existsSync(deltaPath)) return 'no settings delta written (surfaces identical)';
+    const installer = JSON.parse(fs.readFileSync(deltaPath, 'utf8')) as InstallerDelta;
+    const released = readReleasedSurface();
+    if (released.version !== installer.oldVersion) {
+        // A different pair is not a disagreement about this one. It happens
+        // when the registry's latest is not the version the committed file was
+        // cut at — during a release, for one window.
+        return (
+            `settings delta skipped: installed ${installer.oldVersion}, ` +
+            `committed surface is ${released.version}`
+        );
+    }
+    const computed = classifySettingsDelta(released, emitReleasedSurface(installer.newVersion));
+    const disagreements = compareInstallerDelta(installer, computed);
+    if (disagreements.length > 0) {
+        throw new Error(
+            `settings delta disagrees after ${published} → tarball: ${disagreements.join(' | ')}`,
+        );
+    }
+    return `settings delta ${installer.oldVersion} → ${installer.newVersion} agrees ` +
+        `(${String(installer.changes.length)} changes)`;
 }
 
 // ── main ────────────────────────────────────────────────────────────

package/src/scripts/council_availability_hook.ts

@@ -37,6 +37,10 @@
  * makes it *present*, which is the difference between a check an agent could
  * have run and one it did not need to.
  *
+ * It also carries the cross-model canary's red-streak line when one is
+ * recorded (`canary_liveness.ts`): session start must show it, and a concern
+ * of its own would cost more of the hook bundle than one file read here.
+ *
  * Advisory, always. It never blocks, and a resolution failure degrades to
  * silence rather than to a claim — a hook that guessed here would reproduce the
  * defect it exists to remove.
@@ -46,6 +50,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { readCanaryStatusLine } from './_lib/canary_status.js';
 import { readHookStdin } from './hooks/hook_stdin.js';
 import {
     COUNCIL_CONFIG_ENV,
@@ -149,15 +154,18 @@ export function run(stdin: string, options: { env?: Record<string, string | unde
     if (slot !== 'session_start') {
         return EXIT_ALLOW;
     }
-    const a = resolveAvailability(_workspaceRoot(envelope), options.env ?? process.env);
-    if (a === null) {
+    const root = _workspaceRoot(envelope);
+    const a = resolveAvailability(root, options.env ?? process.env);
+    const canary = readCanaryStatusLine(root);
+    if (a === null && canary === null) {
         return EXIT_ALLOW;
     }
+    const facts = [a === null ? null : buildFact(a), canary].filter((f): f is string => f !== null);
     process.stdout.write(
         `${JSON.stringify({
             decision: 'allow',
-            reason: `council-availability: ${a.configured ? 'configured' : 'not configured'}`,
-            context: buildFact(a),
+            reason: `council-availability: ${a === null ? 'unresolved' : a.configured ? 'configured' : 'not configured'}`,
+            context: facts.join('\n'),
         })}\n`,
     );
     return EXIT_ALLOW;