@event4u/agent-config 16.4.0 → 17.0.0

package/dist/scripts/ai_council/seat_policy.js

@@ -103,4 +103,31 @@ export function parseSeatFields(name, raw) {
         },
     };
 }
+/**
+ * Council roles, and the three a route this package does not pay for may never
+ * hold (ADR-257: an unpaid route may propose and score, never decide). Kept
+ * apart from `PolicyExclusion`: that union makes a seat ABSENT for the whole
+ * run, while a role refusal leaves the seat free to propose or judge.
+ */
+export const COUNCIL_ROLES = ['proposer', 'juror', 'chair', 'synthesis', 'verdict'];
+export const HEAD_ROLES = new Set(['chair', 'synthesis', 'verdict']);
+const _PAID_BILLING = new Set(['subscription', 'per-token']);
+/** The classes positively known to cost the package nothing per call. */
+export const UNPAID_BILLING_CLASSES = ['free-quota', 'self-hosted'];
+/**
+ * True unless the billing class is a paid one. Absent means a seat configured
+ * before billing classes existed, all of them paid; any other unrecognised
+ * value fails closed, so a typo cannot hand a free route the chair.
+ */
+export function isUnpaidBilling(billing) {
+    return billing !== undefined && billing !== null && !_PAID_BILLING.has(billing);
+}
+export function seatRoleRefusal(role, billing, seat = 'this seat') {
+    if (!HEAD_ROLES.has(role) || !isUnpaidBilling(billing))
+        return null;
+    return {
+        reason: 'unpaid_head_role',
+        message: `${seat} (billing ${String(billing)}) may not hold the ${role} role: an unpaid route proposes and scores, never decides (ADR-257)`,
+    };
+}
 //# sourceMappingURL=seat_policy.js.map

package/dist/scripts/ai_council/transport_resolver.js

@@ -40,7 +40,7 @@
  */
 import { classifyBilling, isCommunityCli, strongestAuth, PROVIDER_CLI_META, } from '../_lib/environment_detector.js';
 import { resolve_mode } from './modes.js';
-import { admitsContent, DEFAULT_SEAT_CEILING, } from './content_ceiling.js';
+import { admitsContent, DEFAULT_CONTENT_CLASS, DEFAULT_SEAT_CEILING, } from './content_ceiling.js';
 import { policyExclusionReason } from './seat_policy.js';
 /** The accepted values of the `mode` key, including the resolver-only `auto`. */
 export const VALID_TRANSPORT_MODES = new Set([
@@ -93,14 +93,12 @@ export function resolveTransport(opts) {
     if (exclusion !== null) {
         return unavailable(provider, billing, policyExclusionReason(exclusion, provider), exclusion);
     }
-    // Content ceiling (2.2). Only runs when the caller declared what it would
-    // send; an undeclared pass is unchanged, not silently refused.
-    const contentClass = opts.contentClass ?? null;
-    if (contentClass !== null) {
-        const verdict = admitsContent(opts.seatCeiling ?? DEFAULT_SEAT_CEILING, contentClass);
-        if (!verdict.admitted) {
-            return unavailable(provider, billing, `${provider}: ${verdict.reason ?? 'content ceiling refused the payload'}`, 'policy_content_ceiling');
-        }
+    // Content ceiling (2.2). An undeclared payload is project-content: a seat
+    // cleared only for public artefacts refuses it, and a default seat is unchanged.
+    const contentClass = opts.contentClass ?? DEFAULT_CONTENT_CLASS;
+    const verdict = admitsContent(opts.seatCeiling ?? DEFAULT_SEAT_CEILING, contentClass);
+    if (!verdict.admitted) {
+        return unavailable(provider, billing, `${provider}: ${verdict.reason ?? 'content ceiling refused the payload'}`, 'policy_content_ceiling');
     }
     if (mode === 'manual') {
         return {
@@ -311,7 +309,8 @@ export function classifyCliFailure(raw) {
     if (s === 'auth_expired' || s === 'auth_rejected' || s === 'unauthorized') {
         return 'auth_rejected';
     }
-    if (s === 'cli_unsupported' || s === 'unsupported' || s === 'parse_failed') {
+    // `parse_failed` is NOT here: answered-unreadably, so a replay pays twice.
+    if (s === 'cli_unsupported' || s === 'unsupported') {
         return 'cli_unsupported';
     }
     // Prefix match, not equality: the detail carries the operator-facing reason

package/dist/scripts/condense.js

@@ -43,6 +43,7 @@ import { build_thin } from './project_thin_rules.js';
 import { build_claude_hook_matrix } from './_lib/claude_settings_hooks.js';
 import { describeDroppedHosts, resolveLeanProjection, thinsHost, writesThinFiles } from './_lib/lean_projection_mode.js';
 import { is_claude_builtin_name } from './_lib/claude_builtin_names.js';
+import { nativeFieldLines } from './_lib/subagent_native_fields.js';
 import { project_settings_path, load_agent_settings } from './_lib/agent_settings.js';
 import { rule_is_compile_enabled } from './_lib/compile_time_toggles.js';
 import { resolve_rule_pack_scope } from './_lib/scoped_projection.js';
@@ -386,14 +387,12 @@ function _read_projection_scope_dedup() {
     return false;
 }
 function _lean_projection_settings() {
-    // Step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo`: this is
-    // now the shared resolver rather than one of three private readers. The
-    // INPUT is unchanged — `MODULE_STATE.SETTINGS_FILE` is still the file, so
-    // the projector's answer is the answer it always gave — and only the code
-    // that interprets it is shared. That is risk 2 of the roadmap's register
-    // ("making the hook agree with the projector could also move the
-    // projector") discharged by construction instead of by a test alone.
-    return resolveLeanProjection({ settingsPath: MODULE_STATE.SETTINGS_FILE });
+    // Step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo` made this
+    // the ONE shared resolver; ADR-293 changed what it reads — the settings key
+    // is gone, so the input is `PROJECT_ROOT`, where the form record lives.
+    // Projector and hook still share one reader, which is how risk 2 of that
+    // roadmap's register is discharged by construction.
+    return resolveLeanProjection({ packageRoot: MODULE_STATE.PROJECT_ROOT });
 }
 // --- hashing -----------------------------------------------------------------
 export function apply_path_rewriter(relative_path) {
@@ -828,10 +827,10 @@ export function _rewrite_paths(content, source_relative_path) {
 export { _HRR_BANNER_MARKER };
 // ── Consumer-scoped rule projection (road-to-request-scoped-rule-load P1) ──
 //
-// Opt-in via `projection.rule_workspaces: [<workspace-id>, …]` in
-// `.agent-settings.yml`. Absent / empty = legacy-all (every rule projects —
-// today's behaviour, non-breaking). When set, a non-kernel rule projects
-// only if its `workspaces:` frontmatter intersects the configured set.
+// Scope came from `projection.rule_workspaces` until ADR-293 step 4.6 removed
+// the key; `consumerRuleWorkspaces` derives the CONSUMER scope now and the
+// MAINTAINER projection below is unscoped by construction. A non-kernel rule
+// projects into a scoped tree only if its `workspaces:` frontmatter intersects.
 // Kernel rules (`type: always` / `alwaysApply: true`) ALWAYS project —
 // the kernel is unconditional and workspace-independent by definition
 // (rule-router contract § Schema v2). Untagged rules fail safe: they ship.
@@ -843,15 +842,16 @@ function _read_projection_raw(key) {
         ? proj[key]
         : null;
 }
-function _read_projection_list(key) {
-    const value = _read_projection_raw(key);
-    if (Array.isArray(value) && value.length > 0) {
-        return value.map((v) => String(v));
-    }
-    return null;
-}
+/**
+ * The MAINTAINER projection is never workspace-scoped — a constant since
+ * ADR-293 step 4.6, not a settings read. `consumerRuleWorkspaces` subtracts
+ * `agent-config-maintainer`, and this is the one tree where that subtraction
+ * would be wrong: the repository's own `.claude/rules` must carry exactly the
+ * rules it drops. So this stays the inactive axis, which is what an absent key
+ * always meant here.
+ */
 function _read_rule_workspaces() {
-    return _read_projection_list('rule_workspaces');
+    return null;
 }
 /** `runtime.active_packs` overlay, empty when unset (fresh-install default). */
 function _read_runtime_active_packs() {
@@ -1766,10 +1766,6 @@ export function generate_claude_subagents() {
         const tools = Array.isArray(toolsRaw) ? toolsRaw.map((t) => String(t)).join(', ') : String(toolsRaw ?? '');
         const tier = typeof fm['model_tier'] === 'string' ? fm['model_tier'] : 'inherit';
         const model = tier === 'inherit' ? 'inherit' : (_TIER_TO_CLAUDE_MODEL[tier] ?? 'inherit');
-        // Optional pinned reasoning effort (skill-quality-gates Phase 4, Source S):
-        // pass through to the native frontmatter only when the source declares it —
-        // hosts without an effort knob never see the key.
-        const effort = typeof fm['effort'] === 'string' ? fm['effort'] : null;
         const guardedBody = defense !== '' && !body.includes('prompt-defense-preamble')
             ? `\n${defense}\n${body}`
             : body;
@@ -1778,7 +1774,7 @@ export function generate_claude_subagents() {
             `description: ${description}\n` +
             `tools: ${tools}\n` +
             `model: ${model}\n` +
-            (effort !== null ? `effort: ${effort}\n` : '') +
+            nativeFieldLines(fm) + // effort, maxTurns, background, skills, omitClaudeMd — only when declared
             '---\n' +
             guardedBody;
         const target = path.join(MODULE_STATE.CLAUDE_AGENTS_DIR, `${name}.md`);
@@ -1943,10 +1939,10 @@ description: >-
 
 # Install agent-config
 
-This plugin is a **bootstrap shim**. It exists so the marketplace listing
-stays discoverable and existing plugin installs keep working hooks — the
-content surface (skills, rules, commands, personas) is distributed as a
-file projection, not through this plugin.
+This plugin is a **bootstrap shim** kept so the marketplace listing stays
+discoverable. Its hooks run only alongside a global npm install of the package (never a project-local one) —
+on a plugin-only install no hook runs, so the \`fail_closed\` guards (\`block-no-verify\`, \`block-kernel-rule-writes\`,
+\`block-plumbing-writes\`) are **off**; the session start says so once. Content ships as a file projection.
 
 ## Install (canonical, one command)
 

package/dist/scripts/lint_svg_asset.js

@@ -0,0 +1,324 @@
+#!/usr/bin/env node
+/**
+ * lint_svg_asset — the command-line surface over the SVG rule set.
+ *
+ * The rules live in `_lib/svg_rules.ts`, because the design pass imports them
+ * into the hook bundle and must not drag a CLI in with them (see that file's
+ * header for the measurement). Everything this module adds is the part only a
+ * command needs: argument parsing, the directory walk, the project config, the
+ * scanned-nothing refusal, and the step 1.2 preservation readout.
+ *
+ * Inline-ignore (same shape as `lint_design_quality`, works in XML comments):
+ *   svg-asset-disable <rule-id> [-- reason]            (file scope)
+ *   svg-asset-disable-next-line <rule-id> [-- reason]
+ *   svg-asset-disable-line <rule-id> [-- reason]
+ *
+ * Per-project config (`.svg-asset.json` in the project root):
+ *   { "ignoreRules": ["svg-a11y-generic-id"], "ignoreFiles": ["vendor/**"] }
+ *
+ * Usage:
+ *   lint_svg_asset --dir <path> [--delivery inline|img|css-bg|document]
+ *   lint_svg_asset --file <a.svg> [--file <b.svg>] [--delivery …]
+ *   lint_svg_asset --file <after.svg> --baseline <before.svg> --allow id,id
+ *
+ * Exit codes: 0 = clean, 2 = findings, 1 = internal error (including the
+ * scanned-nothing refusal — a gate that scanned no file is not a clean gate).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+import { DELIVERY_MODES, parseElements, scanHostHtml, scanSvg, } from './_lib/svg_rules.js';
+export * from './_lib/svg_rules.js';
+/**
+ * Canonicalised attribute map — number formatting, attribute order and
+ * whitespace normalised away, so a re-serialisation that changed nothing reads
+ * as nothing changed.
+ */
+export function canonicalAttrs(attrs) {
+    const out = {};
+    for (const key of Object.keys(attrs).sort()) {
+        const v = (attrs[key] ?? '')
+            .replace(/\s+/g, ' ')
+            .trim()
+            // Numbers only where a number is what it is. A hex color is a
+            // TOKEN, not a quantity: normalising inside `#00ff00` collapses it
+            // onto `#0ff0`, and the readout then reports no change for a color
+            // edit outside the allowed ids — a surgical-edit witness that
+            // cannot see a recolour.
+            .replace(/#[0-9a-fA-F]+|-?\d+\.?\d*(?:[eE][-+]?\d+)?/g, (tok) => {
+            if (tok.startsWith('#'))
+                return tok.toLowerCase();
+            const num = Number(tok);
+            return Number.isFinite(num) ? String(Number(num.toFixed(4))) : tok;
+        });
+        out[key] = v;
+    }
+    return out;
+}
+/**
+ * Every element outside the allowed set that changed between two revisions.
+ *
+ * NO PIXEL DIFF decides this. Anti-aliasing and font metrics would make a
+ * pixel comparison a per-machine verdict, and the discipline this witnesses —
+ * `design-fidelity-mechanics.md` § surgical edits — is about which elements
+ * the edit was allowed to touch, which is an attribute fact.
+ */
+export function preservationReadout(beforeContent, afterContent, allowedIds) {
+    const allow = new Set(allowedIds.map((s) => s.trim()).filter(Boolean));
+    /**
+     * A stable key per element, and the id chain above it.
+     *
+     * An element WITHOUT an id is keyed by its nearest id-bearing ancestor plus
+     * its tag and its ordinal INSIDE that ancestor — never by a document-wide
+     * index. A document-wide index shifts for every element after an allowed
+     * deletion, so removing one child of the allowed group reported every
+     * un-idded element after it as changed. Measured on the `grouped-transforms`
+     * triple: the correct edit reported `rect#7 (element)` and the readout could
+     * not tell a clean surgical edit from a dirty one.
+     */
+    const index = (content) => {
+        const map = new Map();
+        const stack = [];
+        const ordinals = new Map();
+        for (const el of parseElements(content)) {
+            if (el.closing) {
+                if (stack[stack.length - 1]?.name === el.name)
+                    stack.pop();
+                continue;
+            }
+            const chain = stack.map((f) => f.id).filter((x) => x !== null);
+            const ownerId = [...stack].reverse().find((f) => f.id !== null)?.id ?? '';
+            const own = el.attrs['id'] ?? null;
+            let key;
+            if (own) {
+                key = own;
+            }
+            else {
+                const bucket = `${ownerId}/${el.name}`;
+                const n = (ordinals.get(bucket) ?? 0) + 1;
+                ordinals.set(bucket, n);
+                key = `${bucket}#${n}`;
+            }
+            map.set(key, { el, chain: own ? [...chain, own] : chain });
+            if (!el.selfClosing)
+                stack.push({ name: el.name, id: own });
+        }
+        return map;
+    };
+    const before = index(beforeContent);
+    const after = index(afterContent);
+    const changes = [];
+    /** An element inside an allowed subtree is itself allowed. */
+    const permitted = (entry) => Boolean(entry && entry.chain.some((id) => allow.has(id)));
+    for (const [key, beforeEntry] of before) {
+        if (permitted(beforeEntry))
+            continue;
+        const afterEntry = after.get(key);
+        if (!afterEntry) {
+            changes.push({
+                id: key,
+                element: beforeEntry.el.name,
+                attribute: '(element)',
+                before: 'present',
+                after: 'removed',
+            });
+            continue;
+        }
+        const a = canonicalAttrs(beforeEntry.el.attrs);
+        const b = canonicalAttrs(afterEntry.el.attrs);
+        for (const attr of new Set([...Object.keys(a), ...Object.keys(b)])) {
+            if ((a[attr] ?? '') === (b[attr] ?? ''))
+                continue;
+            changes.push({
+                id: key,
+                element: beforeEntry.el.name,
+                attribute: attr,
+                before: a[attr] ?? '(absent)',
+                after: b[attr] ?? '(absent)',
+            });
+        }
+    }
+    for (const [key, afterEntry] of after) {
+        if (permitted(afterEntry) || before.has(key))
+            continue;
+        changes.push({
+            id: key,
+            element: afterEntry.el.name,
+            attribute: '(element)',
+            before: 'absent',
+            after: 'added',
+        });
+    }
+    return changes;
+}
+export function loadConfig(dir) {
+    const configPath = path.join(dir, '.svg-asset.json');
+    if (!fs.existsSync(configPath))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+function* walkDir(dir, ext) {
+    if (!fs.existsSync(dir))
+        return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        if (entry.name.startsWith('.') || entry.name === 'node_modules')
+            continue;
+        if (entry.isDirectory())
+            yield* walkDir(full, ext);
+        else if (ext.test(entry.name))
+            yield full;
+    }
+}
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+function readFlag(args, name) {
+    const i = args.indexOf(name);
+    return i >= 0 ? args[i + 1] : undefined;
+}
+function readAll(args, name) {
+    const out = [];
+    for (let i = 0; i < args.length; i++)
+        if (args[i] === name && args[i + 1])
+            out.push(args[i + 1]);
+    return out;
+}
+export function main(argv = process.argv.slice(2)) {
+    const args = [...argv];
+    const jsonMode = args.includes('--json');
+    const quiet = args.includes('--quiet');
+    const deliveryRaw = readFlag(args, '--delivery');
+    if (deliveryRaw && !DELIVERY_MODES.includes(deliveryRaw)) {
+        process.stderr.write(`[lint_svg_asset] unknown --delivery "${deliveryRaw}"; expected one of ${DELIVERY_MODES.join(', ')}\n`);
+        return 1;
+    }
+    const delivery = deliveryRaw;
+    // --- step 1.2: preservation readout -------------------------------------
+    const baseline = readFlag(args, '--baseline');
+    if (baseline) {
+        const files = readAll(args, '--file');
+        const after = files[0];
+        if (!after) {
+            process.stderr.write('[lint_svg_asset] --baseline needs a --file <after.svg> to compare against\n');
+            return 1;
+        }
+        if (!fs.existsSync(baseline) || !fs.existsSync(after)) {
+            process.stderr.write('[lint_svg_asset] --baseline or --file path not found\n');
+            return 1;
+        }
+        const allow = (readFlag(args, '--allow') ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+        const changes = preservationReadout(fs.readFileSync(baseline, 'utf-8'), fs.readFileSync(after, 'utf-8'), allow);
+        if (jsonMode) {
+            process.stdout.write(`${JSON.stringify(changes, null, 2)}\n`);
+            return changes.length ? 2 : 0;
+        }
+        if (!changes.length) {
+            if (!quiet) {
+                process.stdout.write(`✅  lint_svg_asset --baseline: nothing changed outside ${allow.length} allowed id(s).\n`);
+            }
+            return 0;
+        }
+        for (const c of changes) {
+            process.stdout.write(`❌ ${after} [svg-preserve-changed-outside-allowed] <${c.element} id="${c.id}"> ` +
+                `${c.attribute}: "${c.before}" → "${c.after}"\n`);
+        }
+        process.stdout.write(`\nlint_svg_asset: ${changes.length} element change(s) outside the allowed set. ` +
+            'A surgical edit touches only what it declared.\n');
+        return 2;
+    }
+    // --- scanning -----------------------------------------------------------
+    const explicit = readAll(args, '--file');
+    const dirArg = readFlag(args, '--dir');
+    const targets = [];
+    let roots = [];
+    if (explicit.length) {
+        targets.push(...explicit.map((f) => path.resolve(f)));
+        roots = targets;
+    }
+    else {
+        const scanDir = dirArg ? path.resolve(dirArg) : path.resolve(process.cwd(), 'src');
+        roots = [scanDir];
+        if (!fs.existsSync(scanDir)) {
+            // The two cases are NOT the same, and collapsing them into exit 0
+            // made a renamed or mistyped `--dir` report success in CI. An
+            // ABSENT DEFAULT root is the opt-in escape — a consumer with no
+            // `src/` has nothing to scan and must not red. An EXPLICIT `--dir`
+            // that does not resolve is a broken invocation, and this module's
+            // own header already says a gate that scanned no file is not a
+            // clean gate.
+            if (!quiet)
+                process.stderr.write(`[lint_svg_asset] scan directory not found: ${scanDir}\n`);
+            if (dirArg)
+                return 1;
+            process.stderr.write('This linter is opt-in. Run with --dir <path> or --file <a.svg> pointing at your assets.\n');
+            return 0;
+        }
+        for (const f of walkDir(scanDir, /\.(svg|html|htm)$/i))
+            targets.push(f);
+    }
+    const config = loadConfig(process.cwd());
+    const ignoreRules = new Set((config.ignoreRules ?? []).map((r) => r.toLowerCase()));
+    const ignoreGlobs = config.ignoreFiles ?? [];
+    const scanned = targets.filter((f) => !ignoreGlobs.some((g) => f.includes(g.replace('**', ''))));
+    try {
+        assertScanned({ gate: 'lint_svg_asset', scanned: scanned.length, units: 'SVG/HTML file(s)', roots });
+    }
+    catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
+    const all = [];
+    for (const abs of scanned) {
+        const rel = path.relative(process.cwd(), abs);
+        try {
+            const content = fs.readFileSync(abs, 'utf-8');
+            const findings = /\.svg$/i.test(abs)
+                ? scanSvg(content, rel, { delivery })
+                : scanHostHtml(content, rel, { delivery });
+            all.push(...findings.filter((f) => !ignoreRules.has(f.rule.toLowerCase())));
+        }
+        catch (err) {
+            if (!quiet)
+                process.stderr.write(`[lint_svg_asset] error: ${abs}: ${err}\n`);
+        }
+    }
+    if (jsonMode) {
+        process.stdout.write(`${JSON.stringify(all, null, 2)}\n`);
+        return all.length > 0 ? 2 : 0;
+    }
+    if (!all.length) {
+        if (!quiet) {
+            process.stdout.write(`✅  lint_svg_asset: clean — ${scanned.length} file(s) checked, no violations.\n`);
+        }
+        return 0;
+    }
+    const errors = all.filter((f) => f.severity === 'error');
+    const warnings = all.filter((f) => f.severity === 'warning');
+    const inert = all.filter((f) => f.severity === 'inert');
+    for (const f of all) {
+        const icon = f.severity === 'error' ? '❌' : f.severity === 'warning' ? '⚠️ ' : 'ℹ️ ';
+        process.stdout.write(`${icon} ${f.file}:${f.line} [${f.rule}] ${f.snippet}\n`);
+    }
+    process.stdout.write(`\nlint_svg_asset: ${errors.length} error(s), ${warnings.length} warning(s), ${inert.length} inert. ` +
+        'Use svg-asset-disable-next-line <rule> -- reason or .svg-asset.json to suppress; ' +
+        'svg-safety-* findings yield only to .svg-asset.json, never to a marker in the file. ' +
+        'Advisory: an "inert" row is not a clean row — the same file inlined tomorrow is an error.\n');
+    return 2;
+}
+/* c8 ignore start — entrypoint guard, exercised by the CLI not by the tests */
+const invokedDirectly = typeof process !== 'undefined' &&
+    Array.isArray(process.argv) &&
+    /lint_svg_asset\.(ts|js)$/.test(process.argv[1] ?? '');
+if (invokedDirectly)
+    process.exit(main());
+/* c8 ignore stop */
+//# sourceMappingURL=lint_svg_asset.js.map

package/dist/server/io/substituteTemplate.js

@@ -1,7 +1,7 @@
 /**
  * Render `src/config/agent-settings.template.yml` for the wizard's "Skip" path.
  *
- * Source of truth for placeholder semantics is `scripts/install.py`
+ * Source of truth for placeholder semantics is the retired Python installer
  * (`_render_template`, `_parse_profile_ini`). The wizard's Skip handler
  * cannot shell out to Python — npm/npx flows ship Node only — so this
  * helper mirrors the install-time substitution in TypeScript.
@@ -21,7 +21,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 const PLACEHOLDER_RE = /__[A-Z][A-Z0-9_]*__/g;
 /**
- * Parse a profile `.ini` file the same way `scripts/install.py` does:
+ * Parse a profile `.ini` file the same way the retired Python installer does:
  * `key=value` per line, `;` line comments, blank lines ignored. Whitespace
  * around `=` is stripped. Duplicate keys: last wins.
  */

package/dist/server/io/yamlIO.js

@@ -4,7 +4,7 @@
  * Important contract: the template ships with comments that explain
  * every key — we MUST NOT discard them when the wizard writes back.
  * `js-yaml.dump` cannot preserve comments, so we use a key-level
- * replace strategy that mirrors `scripts/install.py::_replace_template_value`:
+ * replace strategy that mirrors `_replace_template_value` in the retired Python installer:
  * scan the rendered template line-by-line, replace only the scalar
  * value at each dotted path, leave comments and indentation alone.
  *
@@ -555,7 +555,7 @@ function isPlainObject(value) {
 }
 /**
  * Recursive dict merge — overlay wins, nested dicts are merged, lists
- * are replaced (not concatenated). Mirrors `scripts/install.py::deep_merge`
+ * are replaced (not concatenated). Mirrors `deep_merge` in the retired Python installer
  * so the Python installer and the Fastify server produce the same
  * three-layer settings tree (`defaults < global < project`).
  */

package/dist/server/routes/install.js

@@ -5,7 +5,7 @@
  *   POST /api/v1/install/plan   — build an {@link InstallPlan} from a
  *                                 declarative {@link PlanSource}[] body.
  *
- * The real *apply* path is owned by `scripts/install.py --apply-payload`
+ * The real *apply* path is owned by `src/scripts/install.ts --apply-payload`
  * (single source of truth, D12 / ADR-020) and surfaced to the GUI via
  * `POST /api/v1/wizard/apply` (see `wizard.ts`). The legacy TypeScript
  * apply engine + its `POST /api/v1/install/apply` SSE route were removed in
@@ -91,6 +91,10 @@ const ConflictEntrySchema = z.object({
     ownership: z
         .enum(['recorded-unchanged', 'recorded-modified', 'unknown'])
         .default('unknown'),
+    // Additive for the same reason and on the same terms: an older client
+    // omits it, and `false` is the answer every tree gave before the
+    // ledger-migration branch existed.
+    migration: z.boolean().default(false),
 });
 /**
  * Wire-shape of {@link InstallPlan} — Sets serialise as arrays over JSON,

package/dist/server/routes/settings.js

@@ -96,7 +96,7 @@ async function readClassIndex(packageRoot) {
 const SHARED_WRITE_MESSAGE = 'This write lands through an agent-switch shared symlink and affects ALL profiles. ' +
     'Re-send with confirmSharedWrite:true to proceed, or run `agent-switch share off` for profile-local writes.';
 // Installer placeholders in `src/config/agent-settings.template.yml` that
-// `scripts/install.py` substitutes per-user. The TypeScript defaults layer
+// `src/scripts/install.ts` substitutes per-user. The TypeScript defaults layer
 // renders the same scalars so the wizard's first-run form is schema-valid.
 // Keep this map in lockstep with the template — any new `__*__` placeholder
 // added there must get its default here, or `settingsSchema.safeParse` on
@@ -205,7 +205,7 @@ async function readSingleLayer(root) {
  * If neither global nor project exists, returns `hasRealFile: false`
  * so the route can emit 404 (ADR-020 § "Installed" semantic).
  *
- * Mirrors `scripts/install.py::read_layered_settings`.
+ * Mirrors `read_layered_settings` in the retired Python installer.
  */
 async function readLayeredSettings(packageRoot, writeRoot, legacyReadRoot, userGlobalReadRoot) {
     const defaults = await loadDefaultSettings(packageRoot);

package/dist/server/routes/wizard.js

@@ -986,7 +986,7 @@ export function wizardRoute(opts) {
         });
         // road-to-single-install-source-of-truth § Phase 2 — Wizard Apply bridge.
         // Validates the WizardApplyPayload envelope and spills it to a temp file,
-        // then dispatches `scripts/install.py --apply-payload <tmp>` — the single
+        // then dispatches `src/scripts/install.ts --apply-payload <tmp>` — the single
         // installer (D12 / ADR-020). Two modes on the SAME endpoint:
         //   • dry_run:true  → buffered plan-summary preview (JSON), used by the
         //     Review step. Adds `--dry-run`.