@event4u/agent-config 16.4.0 → 17.0.0

package/dist/agent-src/commands/analyze/roadmap-repos.md

@@ -9,7 +9,7 @@ cluster: analyze
 type: orchestrator
 replaces: []
 skills: [subagent-orchestration]
-description: Walk the roadmap estate's encrypted reference tokens and feed each unique repository through analyze-repo, one subagent at a time, without producing one roadmap per repository.
+description: Walk the roadmap estate's encrypted reference tokens and feed each unique repository through analyze-reference, one subagent at a time, without producing one roadmap per repository.
 argument-hint: "[--limit=N] [--resume] [--refresh] [--mode=plan|execute]"
 suggestion:
   eligible: false
@@ -22,13 +22,13 @@ packs:
 
 # analyze-roadmap-repos
 
-The thin harvester in front of [`analyze-repo`](repo.md). It walks the roadmap
+The thin harvester in front of [`analyze-reference`](reference.md). It walks the roadmap
 estate's encrypted reference tokens, resolves each to a repository identity, and
 feeds the unique ones through the analysis command one at a time.
 
 **This command contains no analysis instruction and never will.** It resolves,
 dispatches, and folds. Every judgement about a reference — what to fetch, what
-to compare, what to adopt, how to converge — belongs to `analyze-repo`, which
+to compare, what to adopt, how to converge — belongs to `analyze-reference`, which
 owns the loop contract and its limits. A second copy of that reasoning here
 would be a second implementation to keep in step with the first, which is the
 condition step 1.1 of its roadmap removed.
@@ -58,10 +58,10 @@ Read the manifest. Do not re-derive any of it here.
 For each manifest entry with status `pending`, in manifest order, up to the
 batch limit:
 
-- Spawn **one subagent** and have it run `/analyze:repo` for that entry.
+- Spawn **one subagent** and have it run `/analyze:reference` for that entry.
 - Pass the subagent **the opaque id only** — never a resolved URL. The subagent
   reads the URL from `agents/.harvest-local/manifest.jsonl` itself. One
-  indirection, taken on precaution (`analyze-repo` § 7).
+  indirection, taken on precaution (`analyze-reference` § 7).
 - **Sequential, never a fan-out.** Over a hundred identities at four passes each
   cannot share one session, and every external fetch is spent deliberately. The
   manifest is the only shared state between subagents.
@@ -75,7 +75,7 @@ took.
 ### 3. Ownership fold — one gap, one roadmap
 
 After the batch, and never during it, run the fold pass of
-[`analyze-repo`](repo.md) § 7 across the batch's findings as a set. Consult
+[`analyze-reference`](reference.md) § 7 across the batch's findings as a set. Consult
 `src/scripts/roadmap_context.ts` and the run's own candidate registry, then pick
 exactly one disposition per repository:
 
@@ -90,7 +90,16 @@ exactly one disposition per repository:
 
 **Three repositories showing the same gap strengthen the evidence on one owning
 roadmap. They never create three.** That is the whole reason this command exists
-rather than a loop that invokes `analyze-repo` and keeps whatever it returns.
+rather than a loop that invokes `analyze-reference` and keeps whatever it returns.
+
+**An owned gap lands on its owner as a step and an `Arrivals:` line.** "Already
+planned" and "extend" both mean the owning roadmap — active, `later/` or
+`stubs/` — gains a new step for the gap and one `Arrivals:` line under its
+`Source:` header (the format of [`/analyze:inbox`](inbox.md) § Phase 5). "Create
+new" is legal only when the owner search comes back empty, and the new file's
+`estate_offset_exempt` quotes that search in one clause — command, query, the
+whole roadmap tree as scope and an empty result — which `check_estate_count`
+reports on an added file that lacks it.
 
 ### 4. Landing — local-only
 
@@ -108,7 +117,7 @@ any other.
 
 ## Safety
 
-- Read-only on every reference. The no-execute invariant of `analyze-repo`
+- Read-only on every reference. The no-execute invariant of `analyze-reference`
   § Safety binds every subagent this command spawns.
 - No plaintext repository URL is ever passed as a dispatch argument.
 - Nothing tracked is written by this command itself.
@@ -117,14 +126,14 @@ any other.
 
 ## When **not** to use
 
-- One known reference → [`analyze-repo`](repo.md) directly. The harvester's only
+- One known reference → [`analyze-reference`](reference.md) directly. The harvester's only
   job is the estate walk.
 - Analyzing this repository → `/project-analyze`.
 - A dropped local artifact → [`/analyze:inbox`](inbox.md).
 
 ## Related
 
-- Command: [`analyze-repo`](repo.md) — the analysis engine this dispatches to.
+- Command: [`analyze-reference`](reference.md) — the analysis engine this dispatches to.
 - Script: `src/scripts/harvest_reference_tokens.ts` — discovery, the only one.
 - Rule: [`source-confidentiality`](../../../../rules/source-confidentiality.md)
   — why the identities stay in the gitignored area.

package/dist/agent-src/commands/analyze.md

@@ -2,13 +2,13 @@
 model_tier: medium
 name: analyze
 disable-model-invocation: true
-argument-hint: "[postmortem|premortem|decision|near-miss|incident|repo|roadmap-repos|inbox] [subject]"
+argument-hint: "[postmortem|premortem|decision|near-miss|incident|reference|roadmap-repos|inbox|conformance|and-optimize|pr] [subject]"
 pack: analysis-workbench
 intent: "Analysis dispatcher — classify input by keywords, propose a weighted framework path, let the user pick"
-routes_to: [analyze-postmortem, analyze-premortem, analyze-decision, analyze-near-miss, analyze-incident, analyze-repo, analyze-roadmap-repos, analyze-inbox, analyze-conformance]
+routes_to: [analyze-postmortem, analyze-premortem, analyze-decision, analyze-near-miss, analyze-incident, analyze-reference, analyze-roadmap-repos, analyze-inbox, analyze-conformance, analyze-and-optimize, analyze-pr]
 replaces: []
 visibility: advanced
-description: Analysis orchestrator — confidence-weighted suggester that routes to postmortem, premortem, decision-review, near-miss, incident, repo, or inbox-artifact analysis.
+description: Analysis orchestrator — confidence-weighted suggester routing to postmortem, premortem, decision, near-miss, incident, reference repo, roadmap repos, inbox, conformance, this project or a PR.
 cluster: analyze
 type: orchestrator
 suggestion:
@@ -37,10 +37,12 @@ to the chosen sub-command. Never auto-selects silently.
 | `/analyze:decision` | `analyze/decision/command.md` | Audit a past architectural decision (did it hold?) |
 | `/analyze:near-miss` | `analyze/near-miss/command.md` | Post-mortem for a near-miss (same flow, lighter severity framing) |
 | `/analyze:incident` | `analyze/incident/command.md` | Full incident flow: commander → RCA → post-mortem → memory candidate |
-| `/analyze:repo` | `analyze/repo/command.md` | Deep-dive an external reference repo (competitor, inspiration, peer) → structured comparison + adoption plan |
-| `/analyze:roadmap-repos` | `analyze/roadmap-repos/command.md` | Walk the estate's encrypted reference tokens and feed each unique repo through `repo`, one subagent at a time |
+| `/analyze:reference` | `analyze/reference/command.md` | Deep-dive an external reference repo (competitor, inspiration, peer) → structured comparison + adoption plan |
+| `/analyze:roadmap-repos` | `analyze/roadmap-repos/command.md` | Walk the estate's encrypted reference tokens and feed each unique repo through `reference`, one subagent at a time |
 | `/analyze:inbox` | `analyze/inbox/command.md` | Deep-dive a LOCAL artifact dropped in `agents/tmp/` (review, prompt, spec, transcript) → claim verification + step reproduction against the current tree + artefact mapping + roadmap |
 | `/analyze:conformance` | `analyze/conformance/command.md` | Audit recent local sessions for rule violations → deterministic scan + subagent passes, root-caused per class, and a roadmap for what is mechanisable |
+| `/analyze:and-optimize` | `analyze/and-optimize/command.md` | Analyse this project, repository or module and improve it → analysts, exchange, council, ready roadmaps, PR (alias: `/optimize:deep`) |
+| `/analyze:pr` | `analyze/pr/command.md` | Run the loops and councils on an existing pull request → a read-only verdict by default, `--optimize` to push tested fixes |
 
 ## Dispatch
 
@@ -64,7 +66,12 @@ match:
 | "pre-mortem", "what could go wrong", "imagine failure", "vor dem Start" | `premortem` |
 | "decision review", "ADR", "did this hold up", "rückblick Architektur" | `decision` |
 | "production is down", "active incident", "Vorfall", "Prod ist down" | `incident` |
-| external repo URL / `owner/repo`, "how does X do this", "compare with that repo", "competitor" | `repo` |
+| external repo URL / `owner/repo`, "how does X do this", "compare with that repo", "competitor", "learn from that project" | `reference` |
+| "every reference repo in the roadmaps", "harvest the encrypted reference tokens", "all referenced repos" | `roadmap-repos` |
+| "agents/tmp", "the inbox", "dropped file", "transcript", "review someone dropped" | `inbox` |
+| "rule violations", "did the sessions follow the rules", "conformance", "Regelverstöße" | `conformance` |
+| "optimize this project", "deep optimization pass", "improve this module", "analysiere und verbessere" | `and-optimize` |
+| PR URL / `#<number>`, "this pull request", "review the PR in depth", "PR analysieren" | `pr` |
 
 Assign a confidence level (high / medium / low) per framework based on
 signal count. A framework with zero signals gets `low`.
@@ -82,8 +89,13 @@ escape:
 > 3. [low] Pre-mortem (`/analyze:premortem`) — imagined-failure analysis before committing
 > 4. [low] Decision review (`/analyze:decision`) — did a past architectural decision hold up?
 > 5. [low] Incident (`/analyze:incident`) — full live-incident coordination + RCA + post-mortem
-> 6. [low] Reference repo (`/analyze:repo`) — deep-dive an external repo → comparison + adoption plan
-> 7. Describe in your own words — I'll re-classify
+> 6. [low] Reference repo (`/analyze:reference`) — deep-dive an external repo → comparison + adoption plan
+> 7. [low] Reference repos of the estate (`/analyze:roadmap-repos`) — every repo the roadmaps reference, one at a time
+> 8. [low] Inbox (`/analyze:inbox`) — a dropped file in `agents/tmp/` → verified claims + roadmaps
+> 9. [low] Conformance (`/analyze:conformance`) — recent sessions against the rules
+> 10. [low] This project (`/analyze:and-optimize`) — analyse and improve the current project, repository or module
+> 11. [low] Pull request (`/analyze:pr`) — loops and councils on an existing PR, feedback by default
+> 12. Describe in your own words — I'll re-classify
 
 **Empfehlung:** 1
 
@@ -97,8 +109,9 @@ Ask one question (per `ask-when-uncertain`):
 > What happened or what are you trying to analyse?
 
 Re-run Step 2 with the answer. Present the menu again. Do not loop
-more than twice — on the third attempt, show all six options unranked
-and let the user pick.
+more than twice — on the third attempt, show every `routes_to` entry of
+this file's frontmatter unranked (the list is read from `routes_to`, never
+counted by hand) and let the user pick.
 
 ### 5. Unknown sub-command
 
@@ -115,10 +128,13 @@ and ask which one was intended. One question, no guessing.
 - **Do NOT commit, push, or open a PR** unless a sub-command
   explicitly authorizes it.
 - **Do NOT chain sub-commands.** One `/analyze <sub>` per turn. **Exactly one
-  exception:** `roadmap-repos` invokes `repo` once per repository, each in its
+  exception:** `roadmap-repos` invokes `reference` once per repository, each in its
   own subagent, sequentially — never in the orchestrator's own turn and never as
   a fan-out. It is the only sub-command permitted to invoke another, and it may
-  invoke only `repo`.
+  invoke only `reference`. **Second exception (ADR-288):** an analysis door
+  (`reference`, `and-optimize`, `pr`, `inbox`) invokes the engine's *stages* —
+  scope, analysts, exchange, gate, emit, validate, publish — never another
+  door.
 - **Memory loop applies** — every sub-command that produces an
   analysis output MUST draft a memory candidate via
   `/memory propose` per

package/dist/agent-src/commands/audit.md

@@ -0,0 +1,115 @@
+---
+model_tier: medium
+name: audit
+pack: engineering-base
+intent: "Check what this project uses for security advisories and carry a finding to a fix"
+routes_to: [dependency-upgrade]
+replaces: []
+visibility: advanced
+cluster: audit
+skills: [dependency-upgrade, finishing-a-development-branch, using-git-worktrees]
+description: Security advisories for this project
+argument-hint: "deps [refresh|show|gaps|fix <id>|accept <id>]"
+suggestion:
+  eligible: true
+  trigger_description: "is anything we use vulnerable, check for security updates, which advisories affect this project, fix that CVE"
+  trigger_context: "the user asks about security advisories, end-of-life runtimes or a security release for something the project uses"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+---
+
+# /audit
+## Instructions
+
+`/audit deps` is the one audit today: advisories, malware, end-of-support and
+pre-announced security releases for what the project **uses** — distinct from
+`/security-audit-config`, which audits the agent configuration itself.
+
+## Examples
+
+```text
+/audit deps                       # refresh if stale, then the findings by tier
+/audit deps fix CVE-2026-59948    # carry one finding to a verified PR
+/audit deps gaps                  # what the project's own bots and CI could already cover
+```
+
+**Why it works:** (`self-check-loop`) only `refresh` touches the network, and every finding names the
+file and line it came from, so each line is checkable before anything changes.
+
+## Flags
+
+| Flag | Mode | Meaning |
+|---|---|---|
+| `--force` | `refresh` | refresh although the cache is younger than 20 hours |
+| `--reason` | `accept` | why the vulnerable path is unreachable here — a sentence, never "grep found nothing" |
+| `--expires` | `accept` | the day the acceptance lapses (YYYY-MM-DD) |
+
+### 1. Know where the data comes from
+
+```bash
+agent-config audit:deps refresh   # the ONLY step that touches the network
+agent-config audit:deps show      # findings by tier, each with file:line and IDs
+```
+
+`refresh` reads the lockfiles, declared runtimes, Dockerfiles, compose files and
+CI workflows; sends **public** package names and versions to `api.osv.dev`;
+reads runtime lifecycle data from `endoflife.date` and the PHP and Node release
+feeds; downloads the whole CISA known-exploited catalog from `www.cisa.gov` and
+matches it locally (`advisories.kev: off` skips it); and runs `npm audit` /
+`composer audit` (each sends the lockfile's package list to its configured
+registry) only for a lockfile that names no private package. Names under
+the project's own npm scope, Composer vendor or GitHub owner count as private.
+A third-party private scope, an internal unscoped name or a package resolved
+from a private registry host is NOT recognised as private; with any of those
+in a lockfile, set `advisories.egress: none`.
+`advisories.egress: none` sends nothing. A cache younger than
+20 hours is reused; `--force` refreshes anyway.
+
+Read the result as the tool states it:
+
+- **A source that did not answer** appears as `unknown`, never as "clear". Say
+  which source and why, and never report "no vulnerabilities".
+- **`pre-announced`** means a vendor announced a security release whose fixed
+  versions are not named yet. Name the runtime, the date, and the files that pin
+  it; do not invent a version.
+- **No findings** is "no known findings at the last check", with its timestamp.
+
+### 2. Tiers decide the tone
+
+`T0` — act today (malware, a critical runtime pre-announcement, a critical fix
+available for a direct runtime dependency, or a high one that is known-exploited
+— KEV raises a finding one tier). `T1` — today. `T2` — the
+digest. `T3` — the ledger. Lead with T0, then T1; mention the T2 count; leave T3
+unless asked.
+
+### 3. `gaps` — what the project's own tooling could already cover
+
+```bash
+agent-config audit:deps gaps
+```
+
+Each line is an offer (an update bot, ungrouped security updates, a cooldown,
+`composer config.audit`, a CI audit step, `npm ci`). **Never write the config
+unasked**; show the change and let the user take it.
+
+### 4. `fix <id>` — carry one finding to a PR
+
+Follow the "Security fix" section of [`dependency-upgrade`](../../../skills/dependency-upgrade/SKILL.md)
+end to end. In short: the smallest fixing change, the route the routing table
+picks (this branch, or a separate worktree, branch and PR), proof by the same
+source that reported it, the project's tests, a PR that carries the evidence,
+and — for a library — a patch-release draft. Merge, tag, publish and deploy are
+the owner's.
+
+### 5. `accept <id>` — only with a reason and an expiry
+
+```bash
+agent-config audit:deps accept <id> --reason="<why the vulnerable path is unreachable here>" --expires=YYYY-MM-DD
+```
+
+The tool refuses an acceptance without an expiry, and refuses a reason that is
+only the absence of a search hit — "grep found nothing" is not unreachability.
+That refusal is a phrase check: a reworded non-argument passes it, so an
+acceptance is the owner's to review, never cleared by the tool.

package/dist/agent-src/commands/brand/review.md

@@ -21,6 +21,17 @@ packs:
 
 Run the [`brand-audit`](../../skills/brand-audit/SKILL.md) skill — audit
 emitted UI / copy / assets against the active brand tokens (from
-`state.ui_design` / the consumer's `.tokens.json`) and the voice profile, per
-the `brand-consistency` gate. A value not traceable to a brand token or voice
+`state.ui_design` / the consumer's `tokens.json`) and the voice profile, per
+the `brand-source-of-truth` § Iron Law 2 checklist. A value not traceable to a brand token or voice
 rule is flagged off-brand. Args: `"<artifact path or description>"`.
+
+**Deterministic checks first, before any model judgement.** For copy,
+pipe the text on stdin to
+`npx tsx node_modules/@event4u/agent-config/src/scripts/check_voice_lexicon.ts --draft - --slot agents/context-spine/brand-voice.md` <!-- ref-ignore -->
+(drop `--slot` when `agent-config brand:status --json` does not report the
+slot valid). For CSS or markup, run the design-tokens palette reading,
+`node <skills-root>/design-tokens/scripts/tokens.mjs validate --dir <path> --json --tokens <registered tokens.json>`. Report every located
+finding — `avoid` term with its note, `unbacked-claim` with "needs proof",
+`off-palette` with its nearest token — and flag, never block. Exit 2 from
+the checker is a broken invocation: say so, never report the copy as clean. The audit's
+judgement comes after and never overrides a located finding.

package/dist/agent-src/commands/brand/tokens.md

@@ -6,7 +6,7 @@ visibility: internal
 cluster: brand
 sub: tokens
 skills: [brand-to-tokens]
-description: Derive a DTCG .tokens.json source of truth from brand decisions, then emit CSS vars + Tailwind via the no-Node token generator.
+description: Derive a DTCG tokens.json source of truth from brand decisions, then emit CSS vars + Tailwind via the no-Node token generator.
 argument-hint: "<identity-ref>"
 suggestion:
   eligible: false
@@ -20,8 +20,8 @@ packs:
 # /brand:tokens
 
 Run the [`brand-to-tokens`](../../skills/brand-to-tokens/SKILL.md) skill —
-brand decisions → a DTCG `.tokens.json` source of truth → `design-tokens`
-emits CSS vars + Tailwind (no Node). The same `.tokens.json` is the export that
+brand decisions → a DTCG `tokens.json` source of truth → `design-tokens`
+emits CSS vars + Tailwind (no Node). The same `tokens.json` is the export that
 `pack-ai-image`'s brand-asset generation and the greenfield scaffold seed
 consume; stays on `$value`/`$type` so Tokens Studio / Style Dictionary
 round-trip. Args: `"<identity ref>"`.

package/dist/agent-src/commands/brand/voice.md

@@ -6,7 +6,7 @@ visibility: internal
 cluster: brand
 sub: voice
 skills: [voice-and-tone-design]
-description: Define the brand voice-and-tone profile — register, do/don't lexicon, and tone shifts by context — the profile the brand-consistency gate checks copy against.
+description: Define the brand voice-and-tone profile — three attributes, a tone matrix by context, a do/don't lexicon, and a consistency review — the profile `/brand:review` reads copy against.
 argument-hint: "<brand-ref | strategy-ref>"
 suggestion:
   eligible: false
@@ -20,7 +20,10 @@ packs:
 # /brand:voice
 
 Run the [`voice-and-tone-design`](../../skills/voice-and-tone-design/SKILL.md)
-skill — register, do/don't lexicon, and per-context tone shifts. The resulting
-voice profile is what `/brand:review` and the `brand-consistency` gate check
-emitted copy against. Args: `"<brand/strategy ref>"`. Run `/brand:strategy`
-first when the archetype/positioning is not yet set.
+skill — three attributes, a tone matrix by context, a do/don't lexicon, and a
+consistency review. The skill writes all four to the `brand-voice` context-spine
+slot (`agents/context-spine/brand-voice.md`); the lexicon is the slot's `avoid[]` <!-- ref-ignore -->
+list, literal terms that `check_voice_lexicon` reads on a finished draft. The
+resulting voice profile is what `/brand:review` and the `brand-source-of-truth`
+§ Iron Law 2 checklist read emitted copy against. Args: `"<brand/strategy ref>"`.
+Run `/brand:strategy` first when the archetype/positioning is not yet set.

package/dist/agent-src/commands/brand.md

@@ -33,7 +33,7 @@ scaffold seed consume (B → A dependency).
 |---|---|---|
 | `/brand:strategy "<brief>"` | `commands/brand/strategy.md` | Positioning, archetype, voice, tone, messaging over the brand corpus |
 | `/brand:identity "<strategy ref>"` | `commands/brand/identity.md` | Logo/colour/type/imagery direction; defines the token constraints |
-| `/brand:tokens "<identity ref>"` | `commands/brand/tokens.md` | Derive a DTCG `.tokens.json` source of truth → CSS vars + Tailwind |
+| `/brand:tokens "<identity ref>"` | `commands/brand/tokens.md` | Derive a DTCG `tokens.json` source of truth → CSS vars + Tailwind |
 | `/brand:review "<artifact>"` | `commands/brand/review.md` | Audit emitted UI/copy/assets against active brand tokens + voice |
 | `/brand:voice "<brand ref>"` | `commands/brand/voice.md` | Define the voice-and-tone profile the consistency gate checks copy against |
 
@@ -50,7 +50,7 @@ scaffold seed consume (B → A dependency).
 - **Do NOT chain subcommands.** One `/brand <sub>` per turn.
 - **Consumer brand tokens are the source of truth.** The brand corpus only
   fills gaps; a value not traceable to a brand token or voice rule is off-brand
-  (per [`brand-consistency`](../rules/brand-consistency.md)).
+  (per [`brand-source-of-truth`](../rules/brand-source-of-truth.md) § Iron Law 2).
 - **Edit `src/` only.** Generated mirrors regenerate.
 
 ## See also

package/dist/agent-src/commands/challenge-me/closure.md

@@ -80,6 +80,31 @@ For each detected decision, in order, and never skipping a rung upward:
    `destructive-owned`. A technical decision never reaches here, however hard
    it is.
 
+```
+AN OWNER CLASS THE AGENT ASSIGNED ITSELF IS A GUESS, NOT A ROUTE.
+BEFORE THE FIRST OWNER QUESTION OF A RUN, EVERY OWNER-LABELLED ITEM GOES TO
+THE COUNCIL IN ONE BATCHED QUESTION. ONLY WHAT THE COUNCIL CALLS
+OWNER-RESERVED — OR SPLITS ON, OR CANNOT REACH QUORUM ON — REACHES THE OWNER.
+```
+
+The batched question asks per item: (1) is it owner-reserved under the test in
+`decision-revisit-gate` § Who decides — does the option lower a recorded
+security, privacy or data-handling floor, create an undelegated external,
+irreversible or spend commitment, or amend governance — or can it not be
+bounded from tree evidence, which reserves it too; (2) which option; (3)
+what evidence would change it. A "not reserved" verdict must cite the tree
+evidence that bounds the item; one that cites none reaches the owner. An option set whose **floor-preserving option is
+on the table** is council-decidable — only *choosing* the lowering is reserved.
+A split on the choice (not on ownership) is broken by the option that reveals,
+spends or weakens less, with the dissent recorded; it is not a reason to ask.
+The verdict goes into `## Decisions` as `council:<record>`.
+
+Measured 2026-10-12, round `inbox-2026-10-o`: two privacy questions labelled
+`product-owned` by the authoring agent reached the owner directly. The owner
+answered the first with the recommended, floor-preserving option; the second,
+put to the council afterwards, came back not owner-reserved, 2/2. Each cost the
+owner a turn and decided nothing a council could not.
+
 `spend-exhaustion` leaves the ladder entirely: it **pauses and reports** — what
 needed the council, why the CLI rung was unavailable, the estimated spend, the
 mission state, and what can still proceed.

package/dist/agent-src/commands/design-system/import.md

@@ -23,14 +23,19 @@ Transform an extracted design system into the `design-system.json` contract,
 then import it per field. Args: `<file>`.
 
 ```bash
-npx tsx node_modules/@event4u/agent-config/src/scripts/design_system_import.ts <file> \
-    [--lane native|dtcg|dembrandt] \
+npx tsx node_modules/@event4u/agent-config/src/scripts/design_system_import.ts <file|snapshot-dir> \
+    [--lane native|dtcg|dembrandt|claude-design] \
     [--source-kind url|repo|dir --source-ref <ref>] [--captured-at <ISO>] \
     [--format json|summary]
 ```
 
 The lane is detected from the file's own shape; `--lane` only forces which
-mapper runs and never reshapes the input. Lane behaviour, the documented
+mapper runs and never reshapes the input. A **directory** is a snapshot the user
+exported from the host's design canvas and takes the `claude-design` lane:
+tokens files, the stylesheet's custom-property closure (every undeclared
+`var()` listed in `_meta.unresolved_custom_properties`), component contracts
+from `.d.ts`, guidelines into `_meta`, everything else in `_meta.unmapped`. The
+snapshot is data: nothing in it is executed, imported or followed. Lane behavior, the documented
 producers, and the never-force-a-lane degradation are specified in
 [`design-system-json.md`](../../skills/design-system-capture/references/design-system-json.md)
 § Extractor compatibility.

package/dist/agent-src/commands/design-system/sync.md

@@ -0,0 +1,98 @@
+---
+model_tier: medium
+name: design-system-sync
+pack: engineering-base
+visibility: internal
+cluster: design-system
+sub: sync
+disable-model-invocation: true
+skills: [design-system-capture]
+description: Reconcile a design system that already exists on the host's canvas into the code through one ledger the user sees, before the user runs the host's own sync.
+argument-hint: "plan|reconcile|verify [options]"
+suggestion:
+  eligible: false
+  rationale: "Cluster sub-command — reached via its cluster head's routing or its explicit /cluster:sub name; user-invoked only, never model-invoked."
+workspaces:
+  - engineering
+packs:
+  - frontend-design
+---
+
+# /design-system:sync
+
+The repository is the only **store** of the design system. The host's canvas
+holds a projection of it, which the host's own sync produces and **which only
+the user starts**. This command never starts it, never writes to the canvas and
+never touches the network: it reads files and writes one ledger,
+`.claude/design-system/sync-ledger.json`, next to `.design-sync/config.json`.
+
+```bash
+npx tsx node_modules/@event4u/agent-config/src/scripts/design_sync.ts <verb> [options]
+#   plan      --code design-system.json [--remote <snapshot-dir>] [--base-commit <sha>]
+#   reconcile [--set <key>=<disposition>]... [--maturity <m>] [--intent preserve|extend|redesign]
+#   verify    [--render-check <file>] [--baseline <path>]... [--accept-render <field>=<reason>]...
+```
+
+`--code` is this repo's inventory from [`/design-system:capture`](../capture/command.md);
+`--remote` is a snapshot directory the user exported from the canvas, read by the
+`claude-design` lane of [`/design-system:import`](../import/command.md).
+
+## plan — what a sync would do, before it does it
+
+Every token path and component export becomes one row, classified across the
+**base** (the code file at the projection commit, read with `git show`), the
+**code** and the **remote**: `in-sync`, `code-only`, `remote-generated`,
+`remote-only:collides`, `remote-only:twin`, `conflict`, `orphan`, `unknown`.
+Without a projection commit the comparison is two-way and a differing value is
+`unknown`, never a guessed class.
+
+`plan` prints two counts first: **overwrite** (`remote-only:collides` +
+`conflict` — what the host sync would overwrite) and **twin**
+(`remote-only:twin` — what stays on the canvas as a second system). An
+unreachable remote prints `unknown` rows and no recommendation; a
+`config.json` with no `projectId` blocks the handover. A second `plan` over
+unchanged inputs writes a byte-identical ledger and no other file.
+
+## reconcile — the user disposes every row
+
+`ui_authority`'s resolver runs once: the snapshot is the `reference`, the code is
+the `incumbent`, a `Colour Lock` / `Type Lock` in `DESIGN.md` is a hard
+constraint, `--intent` is the user. Each `conflict` row is **pre-filled** from
+that posture and carries it as provenance — a proposal, never a decision. Then
+the user sets each row: `keep-code`, `take-remote`, `import-as-brief` or
+`keep-as-exploration` (the last two for a remote-only component, which has no
+default). A row left `pending` keeps the run open.
+
+`import-as-brief` writes **no component**. It emits a brief — the remote contract
+as the spec — for the run's UI owner (`fe-design` ad hoc, `directives/ui/*` in the
+engine), whose coverage records each mechanic as honoured, translated or flagged.
+The brief carries the tier names the project's taxonomy detector recorded, and no
+tier when it recorded none. Imported values go to
+[`design-system-capture`](../../skills/design-system-capture/SKILL.md)'s
+per-field import; `DESIGN.md` is not written from here. `reconcile` also prints
+one [`design-review`](../../skills/design-review/SKILL.md) fidelity-matrix row
+per reconciled component, its evidence kind named: an element screenshot when
+the ledger lists a baseline for it, `not-implemented` with the reason otherwise.
+
+## Then the user runs the host sync
+
+When `plan` reports the handover ready, **the user** runs the host's own sync.
+The agent does not, on any host, and does not offer to.
+
+## verify — the gates that read the projection
+
+`verify` reads the host's `.render-check.json`: any non-zero failure count,
+`variantsIdentical` included, with no `--accept-render` disposition fails the
+run. `--baseline <path>` stamps the visual baselines a run touched with the
+projection commit; a baseline made against an older projection is reported
+`stale`. A check that could not run reports `unverified` or `degraded` with a
+reason, never a pass.
+
+## Rules
+
+- **Never invoke the host sync**, never write to a canvas project, never create
+  or re-adopt a remote project, never run unattended or in CI.
+- **The ledger is the only file written.** The snapshot is written by the user
+  under `.claude/design-system/remote-snapshot/<date>/` and never committed by
+  this command; nothing in it is executed.
+- **Do NOT commit, push, or open a PR.**

package/dist/agent-src/commands/design-system.md

@@ -6,7 +6,7 @@ visibility: internal
 cluster: design-system
 type: orchestrator
 description: Design-system onramp — generate one from the corpus, import an extractor's output, or capture the current repo's. Three doors onto machinery that already ships.
-argument-hint: "[generate|import|capture] [args]"
+argument-hint: "[generate|import|capture|sync] [args]"
 suggestion:
   eligible: true
   trigger_description: "generate a design system, import extracted design tokens, capture this repo's design system, seed DESIGN.md from a site"
@@ -25,6 +25,10 @@ import contract, and the current-repo inventory all existed before this cluster;
 what was missing was a way in. So every sub-command below is an entry point, not
 a new subsystem.
 
+**`.design-sync/` present?** Offer `/design-system:sync plan` before anything
+else: the host's own sync overwrites colliding canvas work, and `plan` prints
+that count first.
+
 **Optional means invoked or not invoked.** This cluster adds no settings key, no
 always-on rule, and no auto-trigger. It is suggestion-eligible only when a
 design-system question is explicit, and otherwise silent.
@@ -36,6 +40,7 @@ design-system question is explicit, and otherwise silent.
 | `/design-system:generate "<product / industry / keywords>"` | `commands/design-system/generate.md` | Ground a design system in the curated corpus; optionally persist `MASTER.md` + page overrides, or seed `DESIGN.md` |
 | `/design-system:import <file>` | `commands/design-system/import.md` | Run an extractor's output through the three-lane adapter, then the per-field confirmation import |
 | `/design-system:capture` | `commands/design-system/capture.md` | Inventory *this* repo's components and tokens and emit the same `design-system.json` shape |
+| `/design-system:sync plan\|reconcile\|verify` | `commands/design-system/sync.md` | Reconcile a design system already on the host's canvas into the code through one ledger, before the user runs the host's own sync; user-invoked only |
 
 ## Dispatch
 

package/dist/agent-src/commands/evals/analyze.json

@@ -25,6 +25,50 @@
     {
       "prompt": "walk me through a structured incident analysis for the API downtime",
       "expected": "analyze"
+    },
+    {
+      "prompt": "run a post-mortem on last night's outage, it is resolved now",
+      "expected": "analyze-postmortem"
+    },
+    {
+      "prompt": "do a pre-mortem: imagine the billing migration failed — why?",
+      "expected": "analyze-premortem"
+    },
+    {
+      "prompt": "did the decision in ADR-12 to use a queue hold up?",
+      "expected": "analyze-decision"
+    },
+    {
+      "prompt": "that deploy almost wiped the cache — analyse the near miss",
+      "expected": "analyze-near-miss"
+    },
+    {
+      "prompt": "production is down right now, coordinate the incident",
+      "expected": "analyze-incident"
+    },
+    {
+      "prompt": "compare our installer with github.com/acme/tool and tell me what to adopt",
+      "expected": "analyze-reference"
+    },
+    {
+      "prompt": "analyse every reference repo the roadmaps point at, one by one",
+      "expected": "analyze-roadmap-repos"
+    },
+    {
+      "prompt": "work through the file someone dropped in agents/tmp",
+      "expected": "analyze-inbox"
+    },
+    {
+      "prompt": "did the last sessions follow the rules? audit them for violations",
+      "expected": "analyze-conformance"
+    },
+    {
+      "prompt": "run a deep optimization pass over this module and open the PR",
+      "expected": "analyze-and-optimize"
+    },
+    {
+      "prompt": "analyse PR #42 in depth and report findings with file:line",
+      "expected": "analyze-pr"
     }
   ]
 }

package/dist/agent-src/commands/evals/audit.json

@@ -0,0 +1,12 @@
+{
+  "command": "audit",
+  "intent": "Check what this project uses for security advisories and carry a finding to a fix",
+  "cases": [
+    { "prompt": "is anything we use vulnerable right now?", "expected": "audit" },
+    { "prompt": "check our dependencies and runtimes for security advisories", "expected": "audit" },
+    { "prompt": "fix CVE-2026-0001 in this project", "expected": "audit" },
+    { "prompt": "is our PHP version still getting security updates?", "expected": "audit" },
+    { "prompt": "the CI run on my PR is red, fix it", "expected": "fix" },
+    { "prompt": "review my changes before I push", "expected": "review" }
+  ]
+}

package/dist/agent-src/commands/evals/retro.json

@@ -0,0 +1,12 @@
+{
+  "command": "retro",
+  "intent": "Examine finished work — a merged PR or a session — and draw at most one durable learning, routed to exactly one target",
+  "cases": [
+    { "prompt": "run a retro on PR 2537", "expected": "retro" },
+    { "prompt": "what did we learn from yesterday's sessions?", "expected": "retro" },
+    { "prompt": "a retro-queue line came in — work through it", "expected": "retro" },
+    { "prompt": "show me what the retro queue holds and what the last sweep skipped", "expected": "retro" },
+    { "prompt": "remember this finding as a signal for later", "expected": "memory-propose" },
+    { "prompt": "write a blameless post-mortem for last night's outage", "expected": "analyze-postmortem" }
+  ]
+}