@event4u/agent-config 16.4.0 → 17.0.0

package/src/server/io/yamlIO.ts

@@ -4,7 +4,7 @@
  * Important contract: the template ships with comments that explain
  * every key — we MUST NOT discard them when the wizard writes back.
  * `js-yaml.dump` cannot preserve comments, so we use a key-level
- * replace strategy that mirrors `scripts/install.py::_replace_template_value`:
+ * replace strategy that mirrors `_replace_template_value` in the retired Python installer:
  * scan the rendered template line-by-line, replace only the scalar
  * value at each dotted path, leave comments and indentation alone.
  *
@@ -559,7 +559,7 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 
 /**
  * Recursive dict merge — overlay wins, nested dicts are merged, lists
- * are replaced (not concatenated). Mirrors `scripts/install.py::deep_merge`
+ * are replaced (not concatenated). Mirrors `deep_merge` in the retired Python installer
  * so the Python installer and the Fastify server produce the same
  * three-layer settings tree (`defaults < global < project`).
  */

package/src/server/schemas/settings.ts

@@ -27,8 +27,6 @@ const replyMethod = z.enum(['replies_endpoint', 'create_review_comment', 'auto']
 const confidenceBand = z.enum(['off', 'low', 'medium', 'high']);
 const onBlock = z.enum(['stop', 'ask', 'warn']);
 const modelAutoSwitch = z.enum(['auto', 'suggest', 'off']);
-const leanProjectionMode = z.enum(['eager-all', 'thin', 'delivery']);
-const leanProjectionHost = z.enum(['claude-code', 'cursor', 'cline']);
 const projectionMode = z.enum(['legacy-all', 'scoped']);
 const projectAudience = z.enum(['self', 'internal', 'client', 'public']);
 const deliveryMerge = z.enum(['off', 'on-green']);
@@ -49,11 +47,8 @@ export const settingsSchema = z.object({
         mode: projectionMode.default('legacy-all').describe(
             'Whether the per-tool projector writes EVERY artefact into the host-tool trees (.claude/ .cursor/ .windsurf/) or only the active profile + packs\' artefacts (ADR-040, docs/contracts/capability-packs.md). legacy-all = (default, non-breaking) project the full surface exactly as 5.x did. scoped = project only the active profile\'s packs unioned with the runtime.active_packs overlay, expanded over the requires graph — opt in with `agent-config use --profile=<id>`. A failed scoped projection restores the full tree.',
         ),
-        rule_workspaces: z.array(z.string()).default([]).describe(
-            'Workspace scope for the RULE layer only (road-to-request-scoped-rule-load P1/P1b, opt-in). Absent or empty = legacy-all: every rule projects AND installs. Non-empty = only rules whose workspaces frontmatter intersects this list are projected (condense) and installed (install.sh + global wizard payload). Kernel rules always ship; untagged rules fail safe. The default flip to a scoped value is a HUMAN release gate — do not set this from automation.',
-        ),
         rule_packs: z.union([z.literal('auto'), z.array(z.string())]).default([]).describe(
-            'Optional second scoping axis for the RULE layer, per pack ids (src/config/discovery/packs.yml). When set, a non-kernel rule also needs a packs frontmatter intersection to ship — e.g. deselecting frontend-design drops ui-audit-gate + design-fidelity. Same opt-in / human-gate semantics as rule_workspaces. The literal "auto" derives the id list from the active-pack set (the same set the skill/command prune uses), so a domain safety floor stops shipping into installs that do not have the pack it guards; an explicit list stays supported and wins over the derivation.',
+            'Scoping axis for the RULE layer beyond the derived workspace set, per pack ids (src/config/discovery/packs.yml). When set, a non-kernel rule also needs a packs frontmatter intersection to ship — e.g. deselecting frontend-design drops ui-audit-gate + design-fidelity. Opt-in, and an empty list is inactive; the workspace axis beside it is derived rather than configured (ADR-293 step 4.6). The literal "auto" derives the id list from the active-pack set (the same set the skill/command prune uses), so a domain safety floor stops shipping into installs that do not have the pack it guards; an explicit list stays supported and wins over the derivation.',
         ),
     }).default({ mode: 'legacy-all' }),
     rule_loading_tier: ruleLoadingTier.default('balanced').describe(
@@ -62,21 +57,6 @@ export const settingsSchema = z.object({
     discipline_profile: disciplineProfile.optional().describe(
         'The ONE runtime knob for the discipline-rule tier (successor of rule_loading_tier; council 2026-07-07). off = kernel only (~1x tokens). essential = kernel + the measured lift-carrying rules (~3.3x, keeps the weak-host discipline lift). full = everything (~11.7x, EXPERIMENTAL — residual lift over essential not established). auto = resolve per session against the evidence-gated NULL-lift disable-list in src/config/host-capabilities.yml (measured-null host → off, otherwise → essential). Optional and opt-in until the P1/P2 evidence gates pass (agents/roadmaps/road-to-discipline-profile-tiering.md); absent = legacy rule_loading_tier applies.',
     ),
-    lean_projection: z.object({
-        mode: leanProjectionMode.default('eager-all').describe(
-            'How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session, exact-BPE — a different unit from the chars/4 figures below, never compare the two directly), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267. SAVING AND CHARGE, MEASURED TOGETHER so neither is published alone (2026-09-12, `check_preamble_payload_budget`): the rule bucket falls 122,769 -> 24,537 chars/4 tok per session on a thinned host (-80.0%), and a trigger match costs p50 6,728 B / p90 14,016 B / max 16,297 B per fire over 318 gate-open fires of the frozen tests/eval/routing-matrix corpus at the concern\'s 16,384 B cap. Bytes per fire and tokens per session are different denominators and are never summed; re-read both rather than quoting this line. The ceiling for that charge is registered in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384).',
-        ),
-        hosts: z.array(leanProjectionHost).default(['claude-code']).describe(
-            'Which hosts a thinning mode may thin (ADR-267). Absent resolves to [claude-code]. '
-            + 'Only the three hosts with a per-rule rule tree are accepted, and this enum is the '
-            + 'AUTHORING layer: an id outside it is a hard validation FAILURE here and under '
-            + 'validate_agent_settings, never a warning. resolveLeanProjectionHosts is the '
-            + 'READ-TIME backstop for a hand-edited .agent-settings.yml that passed neither, and '
-            + 'THERE the id is dropped with a warning (R2 finding 6 — the two layers answer '
-            + 'differently and neither said so). Every host outside this list receives exactly '
-            + 'what eager-all writes, asserted byte-for-byte by check_host_tree_parity.',
-        ),
-    }).default({ mode: 'eager-all', hosts: ['claude-code'] }),
     cost: z.object({
         budgets: z.object({
             daily: z.number().min(0).default(0).describe(
@@ -367,8 +347,8 @@ export const settingsSchema = z.object({
         model_ceiling: z.string().default('').describe(
             'Session-wide model CEILING for subagents (spend cap). Empty (default) = no ceiling. When set, suite-owned CLI spawn wrappers export CLAUDE_CODE_SUBAGENT_MODEL to the sessions they launch. Class C: a human sets it; the agent never writes or infers one.',
         ),
-        max_parallel: z.number().int().min(1).default(3).describe(
-            'Limit on subagents running in parallel during /do-in-parallel, /do-competitively, and /judge runs — a value the model reads from settings; no code counts spawns against it. Raise for faster fan-out, lower if you hit rate limits or want lower token spend.',
+        max_parallel: z.number().int().min(1).max(64).default(3).describe(
+            'Limit on subagents running in parallel during /do-in-parallel, /do-competitively, and /judge runs. On Claude Code the installer also writes it into CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS, the host cap on concurrent new spawns. That cap does not bound a resumed worker: on Claude Code 2.1.306 a resume was admitted past a cap of 1, so a resume is neither bounded by the host nor counted by any package code yet. Raise for faster fan-out, lower if you hit rate limits or want lower token spend.',
         ),
         adversarial_council: z.enum(['off', 'ask', 'on']).default('off').describe(
             'Opt-in adversarial-verification-council mode (subagent-orchestration Mode 9, ADR-122). off (default) = never runs; ask = offer it on an explicit high-risk change; on = auto-run on high-risk changes. Advisory only — a panel of distinct-model skeptics red-teams a real change for defect FINDING coverage and NEVER auto-gates it (Hard Floor). Stays default-off until the adversarial-council-finding-coverage claim is backed.',
@@ -377,6 +357,12 @@ export const settingsSchema = z.object({
     // `worktrees.mode` was DELETED (ADR-229). Worktree creation is
     // instruction-only and hardcoded; there is nothing left to configure. A
     // leftover key is ignored with one deprecation line via REMOVED_KEYS.
+    // `worktrees.cleanup` governs REMOVAL, a separate question (ADR-295).
+    worktrees: z.object({
+        cleanup: z.enum(['off', 'notify', 'auto']).default('notify').describe(
+            'What the agent may do about a worktree whose work is provably on the trunk (merged by merge commit, rebase or squash), that is clean, holds no ignored file a rebuild would not restore, and has no live session. notify (default, and what an absent key resolves to) says once a day how many exist and removes nothing; auto removes them right after /pr:merge and once a day on the first session start, without force, keeping local branches; off says nothing. The daily pass reads merged pull requests through your gh login (branch name and head commit only).',
+        ),
+    }).default({ cleanup: 'notify' }),
     ai_team: z.object({
         model: z.string().default('auto').describe(
             "Model handed to the codex CLI. 'auto' (default) = pass no --model flag so the CLI's own default applies — tracks the subscription's current strongest model instead of pinning a stale ID. Any other value passes through verbatim as `--model <value>`.",
@@ -435,6 +421,11 @@ export const settingsSchema = z.object({
             'Deterministic run-checkpoint production at session end (road-to-continuity-writer-activation Phase 1.4). on (default) = a session above the recycle threshold and inside a running roadmap contract leaves agents/runtime/state/checkpoints/<run>.json, so a killed run resumes from a derived checkpoint rather than from bookkeeping. off = no checkpoint; continuity writing, the recycle advisory and the context-fill surface are unaffected. Default ON because it is the behavior the tree already had — the switch exists to make the three session-end handlers independently disableable, not to change what ships.',
         ),
     }),
+    retro: z.object({
+        enabled: z.boolean().default(true).describe(
+            'Automatic retro after merged work (ADR-292, docs/contracts/retro-v1.md). true (default, owner directive 2026-10-12) = a merged PR and the first session of a new local day enqueue finished work; a deterministic triage picks what is worth one learning, and nothing behavior-changing is applied without a person. The one network read is the daily probe asking GitHub, through your own gh login, whether a pushed PR merged (repository and PR number only, three-second budget). false = no automatic path runs — no merge enqueue, no forge-merge marker, no daily probe and no network read; an explicit /retro still runs on request. Class C: an agent cannot set it; it cascades from the user-global file.',
+        ),
+    }).default({}),
     memory: z.object({
         redact_patterns: z.array(z.string()).default([]).describe(
             'Regex patterns (one per line) that scrub matches from chat-history transcripts and memory before they hit disk. Use for secrets, customer names, internal URLs. Patterns are anchored and case-insensitive.',
@@ -456,6 +447,13 @@ export const settingsSchema = z.object({
             ),
         }).default({}),
     }).default({}),
+    egress: z.object({
+        placeholders: z.object({
+            mode: z.enum(['off', 'observe', 'protect', 'strict']).default('off').describe(
+                'Dispatcher egress stage (docs/contracts/egress-placeholders-v1.md). off (default) = nothing. observe = detect and count listed values in prompts and tool bodies, types and counts only, and change nothing a hook concern sees. protect = also give every recording and advisory concern a copy with each value replaced by a placeholder token, so local stores keep tokens; guards still see the original. strict = as protect until the host rewrite exists. No mode yet changes what reaches the model; the rule table holds credential rules only. Project layers only.',
+            ),
+        }).default({}),
+    }).default({}),
     hooks: z.object({
         concern_budget: z.object({
             tier1_concerns: z.array(z.string()).default([]).describe(
@@ -536,6 +534,22 @@ export const settingsSchema = z.object({
             'Once per day the agent checks the npm registry for a newer agent-config release and surfaces a one-line banner if one exists. Turn off in air-gapped environments or to silence the banner.',
         ),
     }),
+    advisories: z.object({
+        mode: z.enum(['off', 'notify']).default('notify').describe(
+            'Whether the first session start of a day prints the advisory findings that need action today. notify (default) reads the local cache only — a session start never touches the network; off prints nothing, and agent-config audit:deps show still works.',
+        ),
+        egress: z.enum(['none', 'query']).default('query').describe(
+            'What leaves the machine when agent-config audit:deps refresh runs. query (default) sends names and versions of public packages to api.osv.dev and reads endoflife.date and the PHP and Node release feeds; a private package name is never sent, and a native npm or composer audit, which sends the lockfile package list to the registry that tool is configured for, runs only for a lockfile with no private package. none sends nothing, and findings read unknown rather than clear.',
+        ),
+        kev: z.enum(['off', 'on']).default('on').describe(
+            'Whether a refresh reads the CISA known-exploited catalog. on (default) downloads the whole catalog and matches it locally, so nothing about the project is sent, and a finding in it is raised one tier in a runtime scope; off leaves tiers to the other sources. Runs only where egress is query.',
+        ),
+    }).default({ mode: 'notify', egress: 'query', kev: 'on' }),
+    update: z.object({
+        mode: z.enum(['off', 'notify', 'ask', 'auto']).default('notify').describe(
+            'What the agent may do about a newer release. notify tells you and installs nothing (the default, and what an absent key resolves to); ask behaves as notify until the ring-0 exit ships a prompt; auto installs a staged release at a session start when every gate passes and no other session is live; off says nothing at all. Read from the user-global layer only — a repository cannot set how your global install updates itself.',
+        ),
+    }).default({ mode: 'notify' }),
     legal_review_prep: z.object({
         acknowledged: z.boolean().default(false).describe(
             'I understand the legal-review-prep pack provides templates and general information ONLY — it is NOT legal advice, creates no attorney-client relationship, and never replaces a licensed lawyer. Individual cases require an attorney. The pack stays inactive until this is checked.',

package/src/shared/brandTokenDocument.ts

@@ -0,0 +1,46 @@
+/**
+ * Is this text a DTCG token document? The question every reader of a brand
+ * token file has to answer before it uses one, declared once.
+ *
+ * `brand:status` answered it first and kept the answer in the CLI, so the two
+ * other readers — the UI scaffold's `token_seed` line and the asset renderer's
+ * background read — fell back to `isFile()`. A malformed `tokens.json` beside a
+ * valid `assets/tokens.json` then seeded the plan from the broken one and the
+ * renderer skipped straight to its fallback background, while `brand:status`
+ * reported the valid file as the brand. Three readers, three answers.
+ *
+ * It lives beside `brandTokenPaths.ts` for the same reason: `src/shared/` is
+ * the one home the compiled CLI, the tsx-run work-engine tree and the bundled
+ * delegates all reach at runtime. Keep it dependency-free — it takes TEXT, not
+ * a path, so nothing here touches the filesystem and every caller keeps its own
+ * read, its own error handling and its own notion of a root.
+ */
+
+/** Depth bound: a token tree this deep is pathological, not a document. */
+const MAX_DEPTH = 64;
+
+function hasDtcgToken(node: unknown, depth = 0): boolean {
+    if (depth > MAX_DEPTH || typeof node !== 'object' || node === null || Array.isArray(node)) return false;
+    if ('$value' in node) return true;
+    return Object.values(node as Record<string, unknown>).some((v) => hasDtcgToken(v, depth + 1));
+}
+
+/**
+ * Parse before present: `null` when the text is a DTCG token document, else the
+ * reason it is not one. A file that merely exists is not a brand.
+ */
+export function tokenDocumentError(text: string): string | null {
+    let doc: unknown;
+    try {
+        doc = JSON.parse(text);
+    } catch (exc) {
+        return `not JSON: ${exc instanceof Error ? exc.message : String(exc)}`;
+    }
+    if (typeof doc !== 'object' || doc === null || Array.isArray(doc)) {
+        return 'not a DTCG document: the root is not an object';
+    }
+    if (!hasDtcgToken(doc)) {
+        return 'not a DTCG document: no token carries a `$value`';
+    }
+    return null;
+}

package/src/shared/brandTokenPaths.ts

@@ -0,0 +1,43 @@
+/**
+ * The paths the brand resolver searches for a project's DTCG `tokens.json`,
+ * in its order. First hit wins. ONE declaration, three readers.
+ *
+ * Why here, and not a re-export from either side: this list was declared twice — once in the UI scaffold directive
+ * (`agent-src/templates/scripts/work_engine/directives/ui/scaffold.ts`) and
+ * once in the asset renderer's types module (`cli/commands/uiRenderAssetTypes.ts`)
+ * — and the two had already drifted: the renderer built its last entry with
+ * `path.join`, so on Windows it searched `agents\settings\brand\tokens.json`
+ * while the scaffold searched the forward-slash form. Two answers to "what
+ * counts as this project's brand" is the defect; which separator wins is only
+ * how it showed.
+ *
+ * A re-export from the renderer into the scaffold was tried first and reverted
+ * (`cli/commands/uiAudit.ts` records the same class for the coverage
+ * vocabulary): it creates a RUNTIME edge from the compiled CLI into the
+ * work-engine TEMPLATE tree, which ships as `.ts` beside the bundle rather than
+ * inside it, so the published package fails to resolve it at import time.
+ *
+ * `src/shared/` is the one home both trees can reach at runtime, and the SAME
+ * relative specifier resolves in both projections:
+ *
+ *   - `src/cli/commands/*` compiles under `rootDir: src`, so `../../shared/…`
+ *     lands on `dist/shared/brandTokenPaths.js`.
+ *   - the work-engine tree runs under tsx from `src/agent-src/templates/…` and
+ *     is projected byte-identically to `dist/agent-src/templates/…`;
+ *     `../../../../../../shared/…` is `src/shared/brandTokenPaths.ts` in the
+ *     first and `dist/shared/brandTokenPaths.js` in the second.
+ *
+ * Keep this module dependency-free. It imports nothing — not even `node:path`,
+ * which is what let the two copies disagree in the first place. These are
+ * repo-relative *conventional* paths written with forward slashes; a caller
+ * joins them onto a root with `path.join`, which accepts that form on every
+ * platform.
+ */
+
+/** The four paths the brand resolver searches, in its order. First hit wins. */
+export const BRAND_TOKEN_PATHS: ReadonlyArray<string> = [
+    'tokens.json',
+    'assets/tokens.json',
+    'resources/tokens.json',
+    'agents/settings/brand/tokens.json',
+];

package/src/shared/settingsCarveOut.ts

@@ -49,14 +49,6 @@ export const SETTINGS_CARVE_OUT: readonly CarveOutKey[] = [
             + 'Once a file exists, an absent key means legacy-all by documented contract, '
             + 'so an existing install is never silently narrowed on upgrade.',
     },
-    {
-        key: 'projection.rule_workspaces',
-        reader: 'src/install/rule_scope.ts:96 ruleScopeFromSettings',
-        absentResolvesTo: 'null — LEGACY_ALL, i.e. every rule ships including maintainer-only ones',
-        reason:
-            'Same upgrade contract as projection.mode, and the failure is louder: '
-            + 'an absent list widens the projection instead of narrowing it.',
-    },
     {
         key: 'discipline_profile',
         reader: 'work_engine/_lib/agent_settings.ts:1263',

package/src/shared/skillRanking.ts

@@ -35,11 +35,33 @@
  * Pure — no imports, no I/O, no clock.
  */
 
-// re.compile(r"[a-z][a-z0-9]+") — applied to the lowercased text.
-const TOKEN_RE = /[a-z][a-z0-9]+/g;
+/**
+ * The token shape. A LETTER followed by letters or digits, in any script.
+ *
+ * It was `re.compile(r"[a-z][a-z0-9]+")`, ported verbatim from the Python
+ * scorer, and that class cannot see a letter outside ASCII. Reproduced on the
+ * tree this replaced it in: `Prüfung` indexed as `fung`, `Größe` as nothing at
+ * all, `Abhängigkeiten` as the two fragments `abh` and `ngigkeiten`. A prompt
+ * written in German was therefore not ranked badly — most of its content words
+ * were not ranked at all, because the class split each one at its first umlaut
+ * and the pieces fell under the three-code-point floor below.
+ *
+ * `\p{L}` and `\p{N}` keep the ASCII behaviour byte-identical — the lowercased
+ * `a-z` and `0-9` are a subset of both — so this is a widening and not a
+ * different tokenizer. It is a CORRECTNESS fix and not a lift claim, and the
+ * before/after reading over the trigger corpus train slice that says so is
+ * attached to the change that made it.
+ */
+const TOKEN_RE = /[\p{L}][\p{L}\p{N}]+/gu;
 
-/** Ported verbatim from the Python scorer. Order is irrelevant; membership is not. */
-export const STOPWORDS: ReadonlySet<string> = new Set([
+/**
+ * Ported verbatim from the Python scorer. Order is irrelevant; membership is not.
+ *
+ * Kept as its own block rather than merged into the union below so that a
+ * reader can still see exactly what the parity scorer dropped, which is the
+ * thing the CLI parity suite pins.
+ */
+export const ENGLISH_STOPWORDS: ReadonlySet<string> = new Set([
     'the', 'a', 'an', 'and', 'or', 'but', 'of', 'for', 'with', 'to', 'in',
     'on', 'at', 'by', 'from', 'as', 'is', 'are', 'was', 'were', 'be', 'been',
     'this', 'that', 'these', 'those', 'it', 'its', 'use', 'when', 'even',
@@ -49,6 +71,62 @@ export const STOPWORDS: ReadonlySet<string> = new Set([
     'user', 'users', 'our', 'your', 'their', 'they', 'we', 'you', 'i', 'me',
 ]);
 
+/**
+ * The German block, beside the English one rather than inside it.
+ *
+ * WHY IT IS NEEDED AT ALL. The score is `|task ∩ skill| / |task|`, so a task
+ * term no skill indexes sits in the DENOMINATOR. Before the token class above
+ * was widened, a German function word mostly could not survive tokenization in
+ * one piece; now it can, and every one that does divides the whole score of
+ * every candidate. `das`, `die`, `der`, `und`, `für` carry no routing signal in
+ * either language and would otherwise be charged for.
+ *
+ * WHAT IS IN IT, AND WHAT IS DELIBERATELY NOT. Function words — articles,
+ * pronouns, conjunctions, prepositions, auxiliary and modal verbs — plus the
+ * direct counterparts of the generic verbs the English block already drops
+ * (`use`, `make`, `do`, `get`). Domain nouns are NOT in it: `fehler`, `test`,
+ * `datei` and `prüfung` are exactly the words a German prompt routes on, and
+ * mirroring the English block's `file` / `code` / `task` entries into German
+ * would delete the signal this change exists to recover.
+ *
+ * Six German words are left out because their English homograph is a routing
+ * term: `mit` (the licence), `bin` and `dir` (paths), `man` (pages), `war` and
+ * `des` (formats). A German prompt pays a little denominator for them.
+ *
+ * Words of three code points or fewer never reach this set — `tokenize` drops
+ * them first — so `in`, `am`, `zu`, `es` are listed nowhere and need not be.
+ */
+export const GERMAN_STOPWORDS: ReadonlySet<string> = new Set([
+    'der', 'die', 'das', 'den', 'dem', 'ein', 'eine', 'einen', 'einem',
+    'einer', 'eines', 'und', 'oder', 'aber', 'sondern', 'denn', 'also',
+    'für', 'von', 'vom', 'zum', 'zur', 'auf', 'aus', 'bei', 'beim',
+    'nach', 'über', 'unter', 'durch', 'ohne', 'gegen', 'zwischen', 'vor',
+    'ist', 'sind', 'waren', 'bist', 'sein', 'seine', 'seiner',
+    'wird', 'werden', 'wurde', 'wurden', 'worden',
+    'hat', 'habe', 'haben', 'hatte', 'hatten',
+    'kann', 'kannst', 'können', 'könnte', 'soll', 'sollte', 'sollen',
+    'muss', 'müssen', 'darf', 'dürfen', 'will', 'wollen', 'möchte',
+    'wie', 'was', 'wer', 'wen', 'wem', 'wann', 'warum', 'wieso', 'weshalb',
+    'wenn', 'dass', 'weil', 'damit', 'ob',
+    'dies', 'diese', 'dieser', 'dieses', 'diesem', 'diesen',
+    'nicht', 'kein', 'keine', 'keinen', 'keiner', 'nichts',
+    'alle', 'allen', 'alles', 'auch', 'noch', 'nur', 'schon', 'sehr', 'mehr',
+    'hier', 'dort', 'jetzt', 'dann', 'immer', 'wieder',
+    'ich', 'mir', 'mich', 'dich', 'sie', 'ihr', 'ihre', 'ihren',
+    'wir', 'uns', 'euch', 'ihm', 'ihn', 'mein', 'meine', 'dein',
+    'bitte', 'mal', 'etwas', 'eigentlich', 'einfach',
+    // The counterparts of the English block's generic verbs. `mach` survives
+    // the three-code-point floor, so it is listed; `tu` does not and is not.
+    'mach', 'machen', 'macht', 'nutze', 'nutzen', 'verwende', 'verwenden',
+    'bekomme', 'bekommen', 'setze', 'setzen',
+]);
+
+/** The union both blocks are read through. One membership test, two sources. */
+export const STOPWORDS: ReadonlySet<string> = new Set([
+    ...ENGLISH_STOPWORDS,
+    ...GERMAN_STOPWORDS,
+]);
+
 /** Mirror Python `len(str)` — count Unicode code points, not UTF-16 units. */
 function pyLen(s: string): number {
     let n = 0;
@@ -66,7 +144,7 @@ export function roundHalfToEven(x: number): number {
     return floor % 2 === 0 ? floor : floor + 1;
 }
 
-/** Lowercase, extract `[a-z][a-z0-9]+`, drop stopwords and tokens of ≤2 code points. */
+/** Lowercase, extract `[\p{L}][\p{L}\p{N}]+`, drop stopwords and tokens of ≤2 code points. */
 export function tokenize(text: string): Set<string> {
     const out = new Set<string>();
     const matches = text.toLowerCase().match(TOKEN_RE) ?? [];
@@ -111,6 +189,29 @@ export function triggerTextFromFlatLines(lines: readonly string[]): string[] {
     return out;
 }
 
+/**
+ * How many ranked rows `suggest_skill_for_task` returns when the caller names
+ * no limit — on BOTH servers, which is why it lives in the module both import.
+ *
+ * It was 5. The number is now pre-registered rather than chosen: the bar, fixed
+ * before the measurement was read, was "the smallest depth whose recall gain
+ * over 5 exceeds 5 points on the train slice of the trigger corpus", with 5
+ * staying and the step closing as an honest null if no depth cleared it.
+ *
+ * The committed run selects 8. Before the tokenizer widening, over 487
+ * positives, recall@5 was 0.620 and recall@8 0.686 — a gain of 6.6 points, the
+ * only candidate depth whose gain clears the bar at the smallest depth (10 adds
+ * 2.7 more, 20 another 6.5, neither of them the SMALLEST qualifying depth).
+ * With the widened tokenizer that ships, recall@5 is 0.622 and recall@8 0.684
+ * (+6.2 points), so the same bar still selects 8.
+ *
+ * Three more rows per call is the cost; each carries a description capped at
+ * 200 characters, so the ceiling it buys is bounded and paid only when the
+ * tool is actually called. Re-derive the figures with
+ * `measure_skill_ranker_baseline --corpus triggers-train`.
+ */
+export const DEFAULT_SUGGEST_LIMIT = 8;
+
 /** A skill as the ranker sees it. Deliberately not the body — see `rankSkills`. */
 export interface RankableSkill {
     name: string;

package/src/shared/userMd/formAdapter.ts

@@ -17,7 +17,7 @@
  * save via `userIdentitySchema`.
  */
 
-import type { UserIdentity } from './schema.js';
+import { userStyleAvoidEntrySchema, type UserIdentity } from './schema.js';
 
 /**
  * Defaults for a fresh form. Matches `src/templates/agent-user.yml`:
@@ -55,6 +55,18 @@ function pickRoles(value: unknown): string[] {
     return value.filter((v): v is string => typeof v === 'string' && v.trim() !== '');
 }
 
+// Filtered per entry because a whole-list parse erased every entry on the next
+// save when one was invalid. The cap is not applied here: an over-cap list
+// survives so the server-side save rejects it with an error instead.
+function pickAvoid(value: unknown): UserIdentity['style']['avoid'] {
+    if (!Array.isArray(value)) return undefined;
+    const kept = value.flatMap((entry) => {
+        const parsed = userStyleAvoidEntrySchema.safeParse(entry);
+        return parsed.success ? [parsed.data] : [];
+    });
+    return kept.length === 0 ? undefined : kept;
+}
+
 function pickNotes(value: unknown): string | undefined {
     if (typeof value !== 'string') return undefined;
     return value === '' ? undefined : value;
@@ -81,6 +93,8 @@ export function mergeIdentity(parsed: Record<string, unknown>): UserIdentity {
         voice_sample: pickString(parsed.voice_sample, def.voice_sample),
         last_updated: pickString(parsed.last_updated, def.last_updated),
     };
+    const avoid = pickAvoid(styleRaw.avoid);
+    if (avoid !== undefined) out.style.avoid = avoid;
     if (notes !== undefined) out.notes = notes;
     return out;
 }

package/src/shared/userMd/schema.ts

@@ -19,6 +19,20 @@ export const USER_IDENTITY_NOTES_MAX_CHARS = 8_000;
 /** Hard cap on the `voice_sample` block — one to three sentences in practice. */
 export const USER_IDENTITY_VOICE_SAMPLE_MAX_CHARS = 2_000;
 
+/** Cap on `style.avoid` entries (brand-checkability E16). */
+export const USER_IDENTITY_STYLE_AVOID_MAX_ENTRIES = 32;
+
+/** One "never say X" term, matched as an escaped literal — never a regex (NG-6). */
+export const userStyleAvoidEntrySchema = z.object({
+    pattern: z.string().trim().min(1, 'style.avoid pattern is required').max(64, 'style.avoid pattern exceeds 64 chars'),
+    match: z.enum(['word', 'substring']),
+    note: z.string().trim().min(1).optional(),
+});
+
+export const userStyleAvoidSchema = z
+    .array(userStyleAvoidEntrySchema)
+    .max(USER_IDENTITY_STYLE_AVOID_MAX_ENTRIES, `style.avoid exceeds ${USER_IDENTITY_STYLE_AVOID_MAX_ENTRIES} entries`);
+
 /** ISO-8601 date (`YYYY-MM-DD`) — `last_updated` is a date, not a timestamp. */
 const isoDate = z
     .string()
@@ -40,6 +54,9 @@ export const userIdentitySchema = z.object({
         // Formality is not configurable — the agent always addresses the user
         // informally ("Du"). Only `pace` remains tunable.
         pace: z.enum(['rapid', 'pragmatic', 'thorough']),
+        // Optional rather than `.default([])` so a file without it round-trips
+        // unchanged; read it through `userStyleAvoid`, whose default is `[]`.
+        avoid: userStyleAvoidSchema.optional(),
     }),
     // Optional — a writing sample sharpens tone mirroring but is not
     // required to save an identity (the setup wizard must not block on it).
@@ -57,3 +74,8 @@ export const userIdentitySchema = z.object({
 });
 
 export type UserIdentity = z.infer<typeof userIdentitySchema>;
+export type UserStyleAvoidEntry = z.infer<typeof userStyleAvoidEntrySchema>;
+
+export function userStyleAvoid(identity: Pick<UserIdentity, 'style'>): UserStyleAvoidEntry[] {
+    return identity.style.avoid ?? [];
+}

package/src/templates/agent-user.md

@@ -8,6 +8,10 @@ role:
 style:
     formality: "informal"
     pace: "pragmatic"
+    # avoid:                        # optional — your own "never say X" list, max 32
+    #     - pattern: "circle back"  # 1-64 chars, a literal, never a regex
+    #       match: word             # word | substring
+    #       note: "say when"        # optional
 voice_sample: |
     Replace this block with one to three sentences in your own
     writing style. The agent uses it as a tone anchor — paste the

package/src/templates/agent-user.yml

@@ -7,6 +7,10 @@ role:
 style:
     formality: "informal"
     pace: "pragmatic"
+    # avoid:                        # optional — your own "never say X" list, max 32
+    #     - pattern: "circle back"  # 1-64 chars, a literal, never a regex
+    #       match: word             # word | substring
+    #       note: "say when"        # optional
 voice_sample: |
     Replace this block with one to three sentences in your own
     writing style. The agent uses it as a tone anchor — paste the

package/dist/cli-delegate/chunk-523HCFYO.js

@@ -1,90 +0,0 @@
-import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
-
-// src/install/plan.ts
-import { createHash } from "node:crypto";
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { join, relative, resolve } from "node:path";
-function sha256File(path) {
-  try {
-    const data = readFileSync(path);
-    return createHash("sha256").update(data).digest("hex");
-  } catch {
-    return null;
-  }
-}
-function fileEntry(path, kind, options) {
-  return {
-    path,
-    kind,
-    sha256: options.hashContent ? sha256File(path) : null
-  };
-}
-function walkSourceTree(dir) {
-  const out = [];
-  walkInto(dir, out);
-  return out;
-}
-function walkInto(dir, out) {
-  let entries;
-  try {
-    entries = readdirSync(dir).sort();
-  } catch {
-    return;
-  }
-  for (const name of entries) {
-    const full = join(dir, name);
-    let isDir;
-    try {
-      isDir = statSync(full).isDirectory();
-    } catch {
-      continue;
-    }
-    if (isDir) {
-      walkInto(full, out);
-    } else {
-      out.push(full);
-    }
-  }
-}
-function buildInstallPlan(inputs) {
-  const filesByTool = {};
-  for (const source of inputs.sources) {
-    const bucket = filesByTool[source.toolId] ?? [];
-    let files = walkSourceTree(source.srcDir);
-    if (source.fileFilter !== void 0) {
-      files = files.filter(source.fileFilter);
-    }
-    for (const srcFile of files) {
-      const rel = relative(source.srcDir, srcFile);
-      const destPath = resolve(source.destDir, rel);
-      bucket.push(
-        fileEntry(srcFile, source.kind, {
-          hashContent: source.kind !== "bridge"
-        })
-      );
-      bucket[bucket.length - 1] = {
-        ...bucket[bucket.length - 1],
-        path: destPath
-      };
-    }
-    filesByTool[source.toolId] = bucket;
-  }
-  for (const source of inputs.sources) {
-    if (!(source.toolId in filesByTool)) {
-      filesByTool[source.toolId] = [];
-    }
-  }
-  return {
-    version: 2,
-    target: inputs.target,
-    root: inputs.root,
-    filesByTool,
-    mergedKeysByTool: {},
-    policy: inputs.policy
-  };
-}
-
-export {
-  sha256File,
-  buildInstallPlan
-};