@event4u/agent-config 16.4.0 → 17.0.0

package/llms.txt

@@ -34,10 +34,10 @@ brand-asset-generation: Generate brand assets — banners, social cards, CIP ele
 brand-audit: Audit how a brand is currently expressed across touchpoints and flag drift from its defined tokens, voice, and strategy. Use to inventory and critique an existing brand before changing it.
 brand-identity: Define a brand identity constraint set from a confirmed strategy — colour story, type story, logo direction, imagery direction. Defines the tokens that token emission and asset generation consume.
 brand-strategy: Ground a brand strategy from the corpus — archetype, opposable positioning, voice and tone, messaging framework. Use to decide who a brand is for, what it stands for, and how it sounds.
-brand-to-tokens: Turn a confirmed brand identity into a DTCG .tokens.json source of truth — emit CSS vars + Tailwind via design-tokens, export locked brand deck templates.
+brand-to-tokens: Turn a confirmed brand identity into a DTCG tokens.json source of truth — emit CSS vars + Tailwind via design-tokens, export locked brand deck templates.
 bug-analyzer: Use when the user shares a Sentry error, Jira bug ticket, or error description and wants root cause analysis. Also for proactive bug hunting and code audits for hidden bugs.
 build-buy-partner: Use when deciding insource vs outsource vs acquire — integration-cost analysis, dependency-risk, optionality preservation. Triggers on 'should we build', 'buy vs partner'.
-canvas-design: Creating static visual art — posters, marketing visuals, brand assets, PDF/PNG design pieces — on 'design a poster' or 'mach uns ein Visual'. Grounded by design-intelligence.
+canvas-design: Static visual art — posters, marketing visuals, brand assets, PDF/PNG pieces — on 'design a poster' or 'mach uns ein Visual'.
 character-consistency: Use when a character must stay visually identical across AI video scenes — locks identity tokens (silhouette, palette, wardrobe, prop) in JSON. Triggers 'character lock', 'same character'.
 check-refs: Use when verifying cross-references between skills, rules, commands, guidelines, and context documents are not broken after edits, renames, or deletions.
 churn-prevention: Use when designing churn defence — health-score signals, churn-cause split (involuntary / value / relationship / fit), early-warning loop. Triggers on 'why are accounts leaving'.
@@ -90,7 +90,7 @@ editorial-calendar: When shaping cadence — evergreen / campaign / reactive spl
 eloquent: Use when writing Eloquent models, relationships, scopes, or queries via Model:: — 'fetch users with their orders'. NOT for PHPStan output, non-Eloquent services, or raw SQL questions.
 emit-tickets: Use when materialising a roadmap into a ticket bundle — 'turn this roadmap into tickets', 'materialise tickets', 'mach Tickets aus der Roadmap', 'emit tickets for this plan'.
 error-handling-patterns: Use when picking a failure-reporting strategy — exceptions vs Result types, recoverable vs not, retry / circuit-breaker / graceful degradation — decision framework only, catalogues externalized.
-"estimate-ticket": Estimate a Jira/Linear ticket — 'estimate PROJ-123', 'wie groß ist das?', 'should we split this?' — size + risk + split + uncertainty, sibling of /refine-ticket, close-prompt.
+estimate-ticket: Estimate a Jira/Linear ticket — 'estimate PROJ-123', 'wie groß ist das?', 'should we split this?' — size + risk + split + uncertainty, sibling of /refine-ticket, close-prompt.
 evaluate-llm-feature: Black-box evaluation of a shipped LLM feature — adversarial probes for hallucination, prompt-injection, and cost-runaway vs stated expectations. Not RAG/embedding. Triggers 'review my chatbot'.
 existing-ui-audit: Use BEFORE writing or editing any non-trivial UI — inventories components, design tokens, shadcn primitives, and reusable patterns into state.ui_audit. Hard gate for fe-design.
 expansion-playbook: Use when designing account-expansion mechanics — upsell vs cross-sell, expansion-trigger signals, NRR cognition. Triggers on 'lift NRR', 'when do we upsell vs cross-sell'.
@@ -117,12 +117,12 @@ hiring-loop-design: Use when shaping an engineering hiring loop — stages, take
 history-design: Use when choosing HOW to record change history / audit trails — walks the tier matrix (columns → audit log → temporal → event sourcing). Triggers on 'wer hat was wann', 'audit log'.
 html-deck: Build a slide presentation as one HTML file — fixed 1920×1080 canvas letterboxed to any viewport, layout-system-first, type floors. Use for deck, slides, presentation, or pitch requests.
 humanizer: Use when removing AI-writing tells from deliverable prose — posts, articles, drafts. Triggers on 'make this sound less like AI', 'humanize this draft', 'this reads like ChatGPT wrote it'.
-iconography: Resolve an icon request to a concrete Iconify name and emit the embedding for the project's stack. Use when adding icons, picking an icon set, or wiring Lucide/Heroicons/Phosphor/Tabler.
+iconography: Resolve an icon request to an Iconify name and emit the stack's embedding. Use when adding icons, picking an icon set, or wiring Lucide/Heroicons/Phosphor/Tabler.
 image-analyser: Use to analyse a character image down to the smallest mole and diff against a canon — per-feature spec, OCR-reads tattoo text, flags drift. Triggers 'analyse this image', 'match the canon'.
 image-creator: Use to generate a character image to spec — max-fidelity reproducible prompt from a Canon Spec, anchors-first, provider/governance-gated. Triggers 'generate this character', 'render to spec'.
 image-editing: Edit an existing image — inpaint, background swap, variation — via providers that support it. Use when editing/modifying/inpainting an image or making variations.
 image-generation: Generate an image from a brief — provider-agnostic blueprint then provider-specific translation, with ref-image/seed reuse for consistency. Use when generating/creating an image.
-image-provider-routing: Select the right image-generation provider from job shape — text-in-image to Ideogram, photoreal to Flux, vector/logo to Recraft, general to Gemini/GPT.
+image-provider-routing: Pick the image provider from job shape — text-in-image to Ideogram, photoreal to Flux, illustrative vector to Recraft, general to Gemini/GPT.
 incident-commander: Use during or right after an incident — frames severity, sets comms cadence, drafts the post-mortem skeleton — even when the user just says 'production is down' or 'wir haben einen Vorfall'.
 jira-integration: Use when the user says \"check Jira\", \"create ticket\", \"update issue\", or needs JQL queries, ticket transitions, or branch-to-ticket linking.
 jobs-events: Use when creating Laravel jobs, queued workflows, events, or listeners. Covers clear responsibilities, safe serialization, and retry/failure handling.
@@ -162,7 +162,7 @@ livewire: Use when the project's frontend stack is Livewire — dispatched by `d
 livewire-architect: Use when shaping a Livewire component before code — full-page vs partial, parent/child split, event flow, state-vs-props boundary, hydration cost — even on 'add this Livewire component'.
 llm-provider-knowledge: Before stating any specific fact about an LLM provider's product — models, pricing, limits, context windows, SDK/API — for OpenAI, Gemini, Claude & others, verify against official docs, not memory.
 logging-monitoring: Use when establishing what observability a project actually has — the four Golden Signals, required signal to detected implementation to evidence, and SLI/SLO provenance.
-logo-generation: Generate a logo or brand mark — structured prompt + provider routing, with a true-vector path (vector-native provider or LLM-authored SVG). Use for logo or brand mark generation.
+logo-generation: Generate a logo or brand mark — structured prompt, provider routing, and a true-vector path. Use for logo or brand mark generation.
 market-entry-analysis: Use when sequencing market entry — geo / segment / vertical, beachhead selection, regulatory-delta. Triggers on 'should we enter market X', 'which segment first'.
 markitdown: Convert PDF, DOCX, XLSX, PPTX, EPUB, images, or audio to Markdown via the markitdown-mcp server — 'extract this PDF', 'OCR this image', 'transcribe this audio'.
 mcp: Use when working with MCP (Model Context Protocol) servers — their tools, capabilities, and best practices for effective agent workflows.
@@ -232,8 +232,8 @@ readme-writing-package: Use when creating or rewriting a README for a reusable p
 reasoning-orchestrator: Use for multi-step / ambiguous / end-to-end work — refactor a whole module, drive a vague ticket to a verified result, plan+build+verify a migration; coordinates the reasoning chain across skills.
 receiving-code-review: When processing code review feedback (bot or human) before changing anything — triages, verifies and pushes back with technical reasoning — even when the user just says 'fix the comments'.
 recursive-verification: Use to run a depth-bounded self-correction loop (attempt → critic verdict → re-attempt) as a tunable test-time compute knob — a do-and-judge specialisation, default off, capability-gated.
-"refine-prompt": Reconstruct a free-form prompt into actionable AC + assumptions + confidence band before the engine plans — '/work \"…\"', 'baue X', 'ist der Prompt klar genug für die Engine?'.
-"refine-ticket": Refine a Jira/Linear ticket before planning — 'refine ticket', 'tighten AC on PROJ-123', 'ist das Ticket klar?'; rewritten ticket, risks, persona voices, close-prompt.
+refine-prompt: Reconstruct a free-form prompt into actionable AC + assumptions + confidence band before the engine plans — '/work \"…\"', 'baue X', 'ist der Prompt klar genug für die Engine?'.
+refine-ticket: Refine a Jira/Linear ticket before planning — 'refine ticket', 'tighten AC on PROJ-123', 'ist das Ticket klar?'; rewritten ticket, risks, persona voices, close-prompt.
 release-comms: Turn a shipped changelog into a release narrative — value-not-feature framing, audience-segmented surfaces. Triggers on 'announce the release', 'write changelog post'.
 repomix-packer: Use when packaging a codebase to a single AI-friendly file for LLM analysis — local or remote, XML/Markdown/JSON, token counting, gitignore filtering, peer-side `repomix` CLI.
 requesting-code-review: Use when asking for a review or creating a PR — self-review first, frame the right context, test plan included — even when the user just says 'open a PR' or 'ready to merge'.
@@ -273,6 +273,7 @@ standards-from-config: Use when you need this project's coding standards (line l
 storybook-workshop: Use when a component library needs a workshop — one story per concept, JSDoc summaries the manifest can carry, stories run as tests, and an opt-in MCP channel that replaces guessing with querying.
 subagent-orchestration: Use when orchestrating implementer/judge subagents — form gate + nine modes (do-and-judge ±two-stage, steps/parallel/worktrees, competitively, debate, live-app-judge, adversarial-council).
 supply-chain-intake: Before adding/installing any dependency the agent named — verify the package exists (slopsquatting: ~1 in 5 AI suggestions are hallucinated), isn't typo-adjacent, is pinned + locked, and CVE-scanned
+svg-authoring: Hand-author or edit an SVG — icon, mark, illustration, diagram, animation, raster-to-vector — checked and rendered.
 symfony-workflow: Writes Symfony PHP — DI container, bundles, Doctrine, Messenger, Security voters, console commands. For Laravel / Eloquent / Artisan use `laravel`. For framework-free PHP use `php-coder`.
 systematic-debugging: Use on a bug, test failure, crash, or unexpected behavior — enforce reproduce → isolate → hypothesize → verify before any fix; fires even on 'this is broken' / 'quick fix'.
 tailwind-engineer: Writing or reviewing Tailwind CSS — utility-first, design tokens, no inline-style drift, responsive variants, dark mode — 'style this' or 'mach das hübsch'. Pairs with react-shadcn-ui.
@@ -288,6 +289,7 @@ threat-modeling: Use when adding auth, webhooks, uploads, queues, secrets, tenan
 throughput-vs-morale-tradeoff: Use when balancing eng-team velocity vs quality vs burnout — on-call load, focus fragmentation, reorg shock. Triggers on 'team is burning out', 'why is velocity dropping'.
 token-optimizer: Use BEFORE any verbose CLI run, large file read, doc conversion, or near-context handoff — decision tree keyed by intent citing the canonical token-saving asset.
 traefik: Use when setting up Traefik as a local reverse proxy — real domains on 127.0.0.1, trusted HTTPS via mkcert, automatic service discovery, and multi-project routing.
+type-design: Build an original font from lettering or a brief — measured spec, code-built outlines, gated build, rendered proof. Use to turn a wordmark into a font.
 typography-system: Derive a type system from a style constraint — font pairings, scale/line-height/weights, DTCG tokens via design-tokens. Use to choose fonts or build a typographic scale.
 ui-apply-generic: Use when implementing a UI brief on a stack with no framework executor — Svelte, Astro, Angular, plain HTML. Stack-independent sibling of react-shadcn-ui; idiom from the stack corpus.
 ui-component-architect: Shaping a UI component tree — composition vs inheritance, slot patterns, prop API design, controlled vs uncontrolled, polymorphic — on 'split this component'. Feeds react-shadcn-ui.
@@ -295,13 +297,13 @@ unit-economics-modeling: Use when modeling CAC, LTV, payback, contribution margi
 universal-project-analysis: Deep multi-pass codebase audit — orchestrates project-analysis-core plus the framework-specific project-analysis-*; explicit request only. Single-pass scan → project-analyzer.
 upstream-contribute: Use when a learning, new skill, rule improvement, or bug fix from a consumer project should be contributed back to the shared agent-config package.
 using-git-worktrees: When starting parallel work in isolation from the current branch — spawn a git worktree with ignore-safety checks and a clean test baseline — even when the user says 'try this on the side'.
-"validate-feature-fit": Validate whether a feature request fits the existing codebase — check for duplicates, contradictions, scope creep, and architectural misfit
+validate-feature-fit: Validate whether a feature request fits the existing codebase — check for duplicates, contradictions, scope creep, and architectural misfit
 verify-completion-evidence: Use when claiming 'done', suggesting a commit, push, or PR — runs the evidence gate so completion claims come from fresh output in this message, not memory or earlier runs.
 verify-repair-loop: Use to iterate a change until tests/quality checks pass — bounded run→revise→re-run gated by a numeric threshold, then a judge confirms. Triggers 'iterate to green', 'keep fixing until tests pass'.
 video-director: Use when a live-action beat becomes the 11-block cinematic prompt — lens, lighting, negatives. Triggers 'cinematic prompt', 'film-grade scene'. Animated → pixar-storyteller; 12-block → scene-expander.
 vision-articulation: Use when articulating internal vision — where we're going / why now / why us, founder-mode anchor, distinct from fundraising pitch. Triggers on 'what's our vision', 'why are we doing this'.
 voc-extract: Use when extracting Voice-of-Customer themes from existing artefacts — GH issues, PR threads, Sentry patterns. Triggers on 'what are users saying', 'recurring complaints', 'top themes'.
 voice-and-tone-design: Use when shaping brand voice — voice attributes, tone-by-context matrix, consistency review. Triggers on 'define our voice', 'why does our copy sound different on every surface'.
-wireframe: Explore a flow or layout with 3+ disposable lo-fi greyscale wireframes on a named axis, before any hi-fi work. Use when the user wants to sketch directions or explore structure.
+wireframe: Explore a flow or layout with 3+ disposable lo-fi greyscale wireframes on a named axis. Use when the user wants to sketch directions or explore structure.
 workspace-link: Use when a cross-workspace import will not resolve — cannot find module @org/*, TS2307 — to link the packages properly with the workspace: protocol instead of patching tsconfig paths.
 worktree-lifecycle: Use when governing a worktree across its whole life — scope-lock declaration, merge-readiness status, scoped verification, and safe cleanup that refuses while unique unmerged commits exist.

package/package.json

@@ -1,8 +1,8 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "16.4.0",
-    "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
+    "version": "17.0.0",
+    "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the artifact counts in these badges.",
     "license": "MIT",
     "private": false,
     "type": "module",
@@ -75,12 +75,12 @@
         "agent-config": "dist/cli/agent-config.js"
     },
     "engines": {
-        "node": ">=20.11.0"
+        "node": ">=22.6.0"
     },
     "scripts": {
         "build:cli": "tsc -p tsconfig.json && chmod +x dist/cli/agent-config.js",
         "build:install-bundle": "esbuild src/scripts/install.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/install/install.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
-        "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\" && node src/scripts/write_bundle_digest.mjs",
+        "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\" && node src/scripts/write_bundle_digest.mjs && npm run build:hook-chunks",
         "build:mcp-bundle": "esbuild src/scripts/mcp_server/__main__.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/mcp/server.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_MCP_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\"",
         "clean:cli-delegate": "rm -rf dist/cli-delegate",
         "build:delegates": "npm run clean:cli-delegate && npm run build:cli-delegate && npm run build:agent-src-delegate && npm run build:delegate-aux",
@@ -100,7 +100,9 @@
         "lint:publint": "publint",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",
         "prepublishOnly": "./scripts-run src/scripts/check_release_includes_discovery",
-        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true"
+        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true",
+        "build:skill-scripts": "esbuild src/skills/corpus-grounding/scripts/ground.ts src/skills/design-tokens/scripts/tokens.ts src/skills/js-library-packaging/scripts/check_package_surface.ts src/skills/react-shadcn-ui/scripts/shadcn_add.ts src/skills/storybook-workshop/scripts/story_contrast_floor.ts src/skills/tailwind-engineer/scripts/tailwind_config_gen.ts --bundle --platform=node --format=esm --target=node20 --outbase=src/skills --outdir=src/skills --out-extension:.js=.mjs",
+        "build:hook-chunks": "node src/scripts/hook_chunks.mjs"
     },
     "publishConfig": {
         "access": "public",
@@ -115,6 +117,7 @@
         "@types/node": "^26.1.2",
         "@typescript-eslint/eslint-plugin": "^8.65.0",
         "@typescript-eslint/parser": "^8.59.4",
+        "esbuild": "^0.28.1",
         "eslint": "^9.39.4",
         "happy-dom": "^20.11.1",
         "js-tiktoken": "^1.0.21",
@@ -142,5 +145,12 @@
     },
     "overrides": {
         "@hono/node-server": "^2.0.5"
+    },
+    "agentConfig": {
+        "impact": {
+            "17.0.0": {
+                "impact": "notice"
+            }
+        }
     }
 }

package/src/agent-src/scripts/dashboard_mode.ts

@@ -136,13 +136,16 @@ export function evaluateDashboardOnDisk(opts: {
     rel: string;
     regen?: string;
     noun?: string;
+    /** Applied to both sides before comparing — drops text that changes with the clock. */
+    normalize?: (text: string) => string;
 }): DashboardStateVerdict {
     const present = fs.existsSync(opts.target);
+    const norm = opts.normalize ?? ((t: string): string => t);
     return evaluateDashboardState({
         mode: opts.mode,
         present,
         trackedInGit: opts.mode === 'untracked' && isTrackedInGit(opts.target, opts.repo_root),
-        current: present && fs.readFileSync(opts.target, { encoding: 'utf-8' }) === opts.rendered,
+        current: present && norm(fs.readFileSync(opts.target, { encoding: 'utf-8' })) === norm(opts.rendered),
         rel: opts.rel,
         ...(opts.regen === undefined ? {} : { regen: opts.regen }),
         ...(opts.noun === undefined ? {} : { noun: opts.noun }),

package/src/agent-src/scripts/roadmap_age.ts

@@ -0,0 +1,175 @@
+/**
+ * How long each active roadmap has gone without a ticked step, read from git.
+ *
+ * The dashboard printed percentages and nothing about time, so a file that
+ * landed weeks ago with every box open looked the same as one that landed
+ * this morning. Two ages per file, both from `git log` and never from a field
+ * an author writes: days since the file landed at its current path, and days
+ * since the last commit that ticked a step in it — a commit that adds more
+ * `[x]` lines than it removes.
+ *
+ * A file with no ticked step 21 days after landing is listed as a PARK
+ * PROPOSAL. It is text: nothing here moves, archives or deletes a file, because
+ * parking is a disposition a person makes (`roadmap-progress-sync`). One
+ * frontmatter line `renewed: <YYYY-MM-DD> — <reason>` clears the proposal for
+ * 21 days from that date.
+ *
+ * No git, a shallow clone, or a path git does not know → the ages read `—` and
+ * no proposal is made; an unknown age is never reported as a stall.
+ */
+
+import { spawnSync } from 'node:child_process';
+import * as path from 'node:path';
+
+export const STALL_DAYS = 21;
+
+export interface RoadmapAge {
+    /** Date the file was added at its current path, `YYYY-MM-DD`, or null. */
+    readonly landed: string | null;
+    /** Date of the newest commit that ticked a step, or null. */
+    readonly last_tick: string | null;
+}
+
+const DONE_LINE_RE = /^[ \t]*[-*][ \t]+\[[xX]\][ \t]/;
+
+/**
+ * Parse `git log -U0 -p --no-renames --format='@@C %as'` output into ages per
+ * repo-relative path. Pure, so the parser is testable without a repository.
+ */
+export function parse_age_log(log: string): Map<string, RoadmapAge> {
+    const landed = new Map<string, string>();
+    const ticked = new Map<string, string>();
+    let date: string | null = null;
+    let file: string | null = null;
+    let net = 0;
+    const flush = (): void => {
+        if (date !== null && file !== null && net > 0 && !ticked.has(file)) {
+            ticked.set(file, date);
+        }
+        net = 0;
+    };
+    for (const line of log.split('\n')) {
+        if (line.startsWith('@@C ')) {
+            flush();
+            date = line.slice(4).trim();
+            file = null;
+        } else if (line.startsWith('diff --git ')) {
+            flush();
+            const m = / b\/(.+)$/.exec(line);
+            file = m ? m[1]! : null;
+        } else if (line.startsWith('new file mode') && file !== null && date !== null) {
+            // newest first: the first add seen is the most recent landing
+            if (!landed.has(file)) landed.set(file, date);
+        } else if (line.startsWith('+') && !line.startsWith('+++')) {
+            if (DONE_LINE_RE.test(line.slice(1))) net++;
+        } else if (line.startsWith('-') && !line.startsWith('---')) {
+            if (DONE_LINE_RE.test(line.slice(1))) net--;
+        }
+    }
+    flush();
+    const out = new Map<string, RoadmapAge>();
+    for (const f of new Set([...landed.keys(), ...ticked.keys()])) {
+        out.set(f, { landed: landed.get(f) ?? null, last_tick: ticked.get(f) ?? null });
+    }
+    return out;
+}
+
+/** Ages for the given absolute roadmap paths, one `git log` call for all of them. */
+export function collect_ages(repo_root: string, roadmap_paths: readonly string[]): Map<string, RoadmapAge> {
+    if (roadmap_paths.length === 0) return new Map();
+    // A shallow clone reports every file as added in its boundary commit, so its ages are invented.
+    const shallow = spawnSync('git', ['rev-parse', '--is-shallow-repository'], { cwd: repo_root, encoding: 'utf-8' });
+    if (shallow.status !== 0 || String(shallow.stdout).trim() !== 'false') return new Map();
+    const rels = roadmap_paths.map((p) => path.relative(repo_root, p).split(path.sep).join('/'));
+    const r = spawnSync('git', ['log', '-U0', '-p', '--no-renames', '--format=@@C %as', '--', ...rels], {
+        cwd: repo_root,
+        encoding: 'utf-8',
+        maxBuffer: 256 * 1024 * 1024,
+    });
+    if (r.status !== 0 || typeof r.stdout !== 'string') return new Map();
+    return parse_age_log(r.stdout);
+}
+
+export function days_between(from: string, to: Date): number {
+    const t = Date.parse(`${from}T00:00:00Z`);
+    if (Number.isNaN(t)) return NaN;
+    const today = Date.UTC(to.getUTCFullYear(), to.getUTCMonth(), to.getUTCDate());
+    return Math.floor((today - t) / 86_400_000);
+}
+
+const RENEWED_RE = /^renewed:[ \t]*['"]?(\d{4}-\d{2}-\d{2})[ \t]*(?:—|–|-{1,2})[ \t]*(\S[^\n]*?)['"]?[ \t]*$/m;
+
+/** The renewal date in a frontmatter block, when it carries a reason. */
+export function renewal_date(frontmatter: string): string | null {
+    const m = RENEWED_RE.exec(frontmatter);
+    return m ? m[1]! : null;
+}
+
+/** Is this file a park proposal today? Unknown ages never are. */
+export function is_park_proposal(age: RoadmapAge | undefined, frontmatter: string, now: Date): boolean {
+    if (!age || age.landed === null) return false;
+    const since_landing = days_between(age.landed, now);
+    if (!(since_landing >= STALL_DAYS)) return false;
+    if (age.last_tick !== null && age.last_tick >= age.landed) return false;
+    const renewed = renewal_date(frontmatter);
+    const since_renewal = renewed === null ? NaN : days_between(renewed, now);
+    // A renewal dated in the future would clear the proposal forever, so it renews nothing.
+    if (since_renewal >= 0 && since_renewal < STALL_DAYS) return false;
+    return true;
+}
+
+export interface AgeRow {
+    readonly rel: string;
+    readonly frontmatter: string;
+    readonly age: RoadmapAge | undefined;
+}
+
+/** The dashboard section: two ages per file, then the park proposals. */
+export function render_age_section(rows: readonly AgeRow[], now: Date): string {
+    if (rows.length === 0) return '';
+    const cell = (d: string | null): string => (d === null ? '—' : String(days_between(d, now)));
+    const lines: string[] = [];
+    lines.push('## Age\n');
+    lines.push(
+        'Days since each active roadmap landed at its path and since its last ticked step, ' +
+            'read from `git log` (`—` = unknown, or never ticked).\n',
+    );
+    lines.push('| Roadmap | Days since landing | Days since last tick |');
+    lines.push('|---|---:|---:|');
+    for (const r of rows) {
+        lines.push(`| [${r.rel}](roadmaps/${r.rel}) | ${cell(r.age?.landed ?? null)} | ${cell(r.age?.last_tick ?? null)} |`);
+    }
+    lines.push('');
+    const proposals = rows.filter((r) => is_park_proposal(r.age, r.frontmatter, now));
+    if (proposals.length > 0) {
+        lines.push('## Park proposals\n');
+        lines.push(
+            `No ticked step ${String(STALL_DAYS)}+ days after landing. A proposal, never an action: ` +
+                'park it, or keep it and add `renewed: <YYYY-MM-DD> — <reason>` to its frontmatter, ' +
+                `which clears the proposal for ${String(STALL_DAYS)} days.\n`,
+        );
+        for (const r of proposals) {
+            lines.push(`- [${r.rel}](roadmaps/${r.rel}) — landed ${r.age?.landed ?? '?'}`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n') + '\n';
+}
+
+/**
+ * The dashboard without its `## Age` and `## Park proposals` blocks. Ages are
+ * relative to today, so `--check` compares this view: a committed dashboard
+ * must not go stale at midnight with no commit.
+ */
+export function strip_age_section(text: string): string {
+    // Only lines render_age_section writes are skipped, so anything else beside the block still counts.
+    const AGE_LINE = /^(## Age|## Park proposals|Days since each |No ticked step |\| Roadmap \||\|---\||\| \[|- \[|$)/;
+    const out: string[] = [];
+    let skipping = false;
+    for (const line of text.split('\n')) {
+        if (line === '## Age' || line === '## Park proposals') skipping = true;
+        else if (skipping && !AGE_LINE.test(line)) skipping = false;
+        if (!skipping) out.push(line);
+    }
+    return out.join('\n');
+}

package/src/agent-src/scripts/update_roadmap_progress.ts

@@ -75,6 +75,7 @@ import { headerFragment as stubHeaderFragment } from './stubs_due.js';
 
 import { isCliEntry } from './_cli_entry.js';
 import { reportGuardedBaselines } from './guarded_baseline.js'; // third step state; contract lives there
+import { collect_ages, render_age_section, strip_age_section } from './roadmap_age.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 const _require = createRequire(import.meta.url);
@@ -1374,7 +1375,14 @@ function main(argv?: readonly string[]): number {
         }
     }
     const roadmaps = collect(roadmap_root), guarded = reportGuardedBaselines(roadmaps, repo_root);
-    const new_text = render(roadmaps, collect_bundles(repo_root), roadmap_root) + guarded.section;
+    const ages = collect_ages(repo_root, roadmaps.map((r) => r.path));
+    const age_rows = roadmaps.map((r) => ({
+        rel: r.rel,
+        frontmatter: FRONTMATTER_RE.exec(fs.readFileSync(r.path, 'utf-8'))?.[1] ?? '',
+        age: ages.get(_relPosix(repo_root, r.path)),
+    }));
+    const new_text =
+        render(roadmaps, collect_bundles(repo_root), roadmap_root) + render_age_section(age_rows, new Date()) + guarded.section;
     const complete = unarchived_complete(roadmaps);
     const pending = pending_iron_law_3(roadmaps);
     const gated = merge_gated_pending(roadmaps);
@@ -1397,7 +1405,7 @@ function main(argv?: readonly string[]): number {
     if (args.check) {
         const rel = _relPosix(repo_root, target);
         const r = reportCheckVerdict({
-            verdict: evaluateDashboardOnDisk({ mode: args.mode, target, repo_root, rendered: new_text, rel }),
+            verdict: evaluateDashboardOnDisk({ mode: args.mode, target, repo_root, rendered: new_text, rel, normalize: strip_age_section }),
             complete,
             pending,
             dashboardOnly: args.dashboard_only,

package/src/agent-src/templates/AGENTS.md

@@ -14,7 +14,7 @@
 ## Pointers
 
 - **Filling out this AGENTS.md** — section templates, capability bullets, multi-agent entry flow, monorepo layout: [`consumer-agents-md-guide`](.augment/contexts/contracts/consumer-agents-md-guide.md).
-- **Behavior rules** (9 always-on; rest routed) — [`.augment/rules/`](.augment/rules/). Kernel rules change only by a ratified edit; overrides may tighten.
+- **Behavior rules** (9 always-on; rest routed) — [`.augment/rules/`](.augment/rules/). Kernel rules change upstream only, by ratified edit; overrides tighten.
 - **Skills (on-demand expertise)** — domain skills surfaced by description, invoked on trigger match: [`.augment/skills/`](.augment/skills/).
 - **Commands (workflows)** — slash-commands the agent runs end-to-end (`/work`, `/create-pr`, …): [`.augment/commands/`](.augment/commands/).
 - **Project-specific docs** — your own architecture notes, roadmaps, sessions, contexts: [`agents/`](agents/).

package/src/agent-src/templates/scripts/check_memory.ts

@@ -132,7 +132,7 @@ const _TYPE_COUNTS: Record<string, number> = {};
 // Redaction heuristics — plain-regex, deliberately conservative.
 // False positives are fixed by quoting the line differently; false
 // negatives are a curator responsibility.
-const REDACTION_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
+export const REDACTION_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
     // Key=value secret with a clear credential-word prefix. The value must
     // be a single token (no spaces, no "/" — skips filepaths and URLs).
     [
@@ -897,7 +897,7 @@ function _isCliEntry(): boolean {
 const _isMain =
     _isCliEntry();
 if (_isMain) {
-    process.exit(main());
+    process.exitCode = main();
 }
 
 export { main };

package/src/agent-src/templates/scripts/historical-bug-patterns.example.yml

@@ -9,7 +9,7 @@
 # `paths` globs. Routing severity is the max of matched pattern severities.
 
 version: 1
-updated: 2026-04-21
+updated: 2026-10-13
 
 patterns:
   - id: n-plus-one-tenant-listing
@@ -76,6 +76,18 @@ patterns:
       - "app/api/**webhook**"
     required_test: "negative test: unsigned payload returns 401"
 
+  - id: auth-response-discloses-account-existence
+    label: "Auth response answers differently for a known and an unknown account"
+    severity: high
+    paths:
+      - "app/Http/Controllers/Auth/**"
+      - "app/Http/Controllers/**Login*.php"
+      - "app/Http/Controllers/**Password*.php"
+      - "app/Http/Controllers/**Registration*.php"
+      - "routes/auth.php"
+      - "src/Controller/Security/**"
+    required_test: "equivalence case: a known and an unknown address produce the same status, body category, redirect and cookies"
+
   - id: migration-no-rollback
     label: "Migration with destructive up() and empty down()"
     severity: medium

package/src/agent-src/templates/scripts/work_engine/cli.ts

@@ -65,6 +65,7 @@ import {
     _to_delivery,
     _to_v0_dict,
 } from './state_io.js';
+import { run_procedure } from './procedure/run.js';
 import type { WorkState } from './state.js';
 
 /**
@@ -90,6 +91,22 @@ export function main(argv: string[] | null = null): number {
     }
     const state_file: string = args.state_file;
 
+    if (args.procedure !== undefined) {
+        const r = run_procedure({
+            skill: args.procedure,
+            projectRoot: process.cwd(),
+            stateFile: state_file,
+            confirm: args.procedure_confirm ?? null,
+            restart: args.procedure_restart === true,
+        });
+        (r.code === 2 ? process.stderr : process.stdout).write(`${r.output}\n`);
+        return r.code;
+    }
+    if (args.procedure_confirm !== undefined || args.procedure_restart === true) {
+        process.stderr.write('error: --procedure-confirm and --procedure-restart need --procedure <skill>\n');
+        return 2;
+    }
+
     const runner = new HookRunner(_build_hook_registry(args));
 
     let halt = runner.emit(

package/src/agent-src/templates/scripts/work_engine/cli_args.ts

@@ -61,6 +61,13 @@ export interface ParsedArgs {
     persona: string | null;
     no_hooks: boolean;
     hooks_config: string | null;
+    /**
+     * The procedure cursor (road-to-steps-the-skill-cannot-skip 5.5). Set only
+     * when passed, so every existing invocation parses to the namespace it did.
+     */
+    procedure?: string;
+    procedure_confirm?: string;
+    procedure_restart?: boolean;
 }
 
 /** Thrown internally to mirror argparse's exit-2 error path. */
@@ -93,6 +100,9 @@ const OPTIONS: OptionSpec[] = [
     { flag: '--persona', dest: 'persona', takesValue: true },
     { flag: '--no-hooks', dest: 'no_hooks', takesValue: false },
     { flag: '--hooks-config', dest: 'hooks_config', takesValue: true },
+    { flag: '--procedure', dest: 'procedure', takesValue: true },
+    { flag: '--procedure-confirm', dest: 'procedure_confirm', takesValue: true },
+    { flag: '--procedure-restart', dest: 'procedure_restart', takesValue: false },
 ];
 
 // `-h` / `--help` is an implicit argparse optional; included as a prefix

package/src/agent-src/templates/scripts/work_engine/directives/ui/scaffold.ts

@@ -52,13 +52,16 @@ import { GRANULARITY_CONVENTION } from '../../state.js';
  * anti-generic moat that makes a generated multi-page app coherent rather than
  * default-shadcn. Absent → sane defaults. The dependency is acyclic and
  * degrades gracefully: scaffold never *requires* `pack-brand`.
+ *
+ * Re-exported, not declared: the list has three readers across two trees and
+ * `shared/brandTokenPaths.ts` is the one home both reach at runtime. The
+ * specifier below resolves to `src/shared/` under tsx and to `dist/shared/` in
+ * the projected copy, which is why it is six hops and not an alias.
  */
-export const BRAND_TOKEN_PATHS: ReadonlyArray<string> = [
-    'tokens.json',
-    'assets/tokens.json',
-    'resources/tokens.json',
-    'agents/settings/brand/tokens.json',
-];
+import { BRAND_TOKEN_PATHS } from '../../../../../../shared/brandTokenPaths.js';
+import { tokenDocumentError } from '../../../../../../shared/brandTokenDocument.js';
+
+export { BRAND_TOKEN_PATHS };
 
 /**
  * Conventional location of the project's `Playbook` contexts (ADR-244).
@@ -404,20 +407,26 @@ function _resolve_build_directive(state: DeliveryState): string {
 }
 
 /**
- * Return the relative path to a present `tokens.json`, or `null`.
+ * Return the relative path to a VALID `tokens.json`, or `null`.
  *
  * Checks {@link BRAND_TOKEN_PATHS} under `root` (default: the current working
  * directory, which is the consumer project root when the engine runs). The
- * first existing file wins. Absent → `null` so the caller degrades to default
- * tokens — the acyclic, graceful-degradation contract.
+ * first file that parses as a DTCG document wins — the same predicate
+ * `brand:status` reports with, so the plan and the resolver cannot name
+ * different files as the brand. A file that merely exists is not a brand: a
+ * malformed `tokens.json` at the first path used to beat a valid
+ * `assets/tokens.json` at the second and seed the plan from a document nothing
+ * can read. Absent or unreadable → `null` so the caller degrades to default
+ * tokens — the acyclic, graceful-degradation contract is unchanged.
  */
-function _brand_token_source(root: string | null = null): string | null {
+export function _brand_token_source(root: string | null = null): string | null {
     const base = root !== null ? root : process.cwd();
     for (const rel of BRAND_TOKEN_PATHS) {
         try {
-            if (fs.statSync(path.join(base, rel)).isFile()) {
-                return rel;
-            }
+            const abs = path.join(base, rel);
+            if (!fs.statSync(abs).isFile()) continue;
+            if (tokenDocumentError(fs.readFileSync(abs, 'utf-8')) !== null) continue;
+            return rel;
         } catch {
             continue;
         }

package/src/agent-src/templates/scripts/work_engine/dispatcher.ts

@@ -65,6 +65,9 @@ const _NOOP_RUNNER: HookRunner = new HookRunner();
  *
  * Changing this order is a roadmap-level decision — not a PR rider — per the
  * surface-growth guardrails in `agents/roadmaps/road-to-implement-ticket.md`.
+ * `dispatch` may be handed another order for another input kind
+ * (road-to-steps-the-skill-cannot-skip 5.1); this default stays the order every
+ * existing directive set runs.
  */
 export const STEP_ORDER: ReadonlyArray<string> = [
     'refine',
@@ -115,6 +118,9 @@ const _DIRECTIVE_SET_MODULES: Record<string, DirectiveSetModule> = {
  * rather than silently skipping, so incomplete wiring surfaces as a hard
  * failure.
  *
+ * `order` defaults to {@link STEP_ORDER}; a caller that runs another input kind
+ * passes its own linear order, which must be non-empty and free of repeats.
+ *
  * `hooks` is an optional {@link HookRunner}. `null` preserves every existing
  * call site verbatim — internally `dispatch` falls back to a shared
  * empty-registry runner so hook bookkeeping stays uniform without a per-emit
@@ -127,8 +133,10 @@ export function dispatch(
     state: DeliveryState,
     steps: Map<string, Step>,
     hooks: HookRunner | null = null,
+    order: ReadonlyArray<string> = STEP_ORDER,
 ): [Outcome, string | null] {
-    _assert_all_steps_present(steps);
+    _assert_order_valid(order);
+    _assert_all_steps_present(steps, order);
 
     // Clear stale questions from a previous halt before we resume so the caller
     // never mistakes old options for fresh ones.
@@ -136,7 +144,7 @@ export function dispatch(
 
     const runner = hooks !== null ? hooks : _NOOP_RUNNER;
 
-    for (const name of STEP_ORDER) {
+    for (const name of order) {
         if (_get(state.outcomes, name) === Outcome.SUCCESS) {
             // Already completed on an earlier invocation — skip per the resume
             // contract. The caller is responsible for keeping `state.outcomes`
@@ -245,8 +253,14 @@ function _emit_on_halt(
  * inside the dispatch loop after partial state mutation, which makes debugging
  * the wiring harder than it needs to be.
  */
-function _assert_all_steps_present(steps: Map<string, Step>): void {
-    const missing = STEP_ORDER.filter((name) => !steps.has(name));
+function _assert_order_valid(order: ReadonlyArray<string>): void {
+    if (order.length === 0 || new Set(order).size !== order.length) {
+        throw new ValueError('Step order must be non-empty and name each step once: ' + order.join(', '));
+    }
+}
+
+function _assert_all_steps_present(steps: Map<string, Step>, order: ReadonlyArray<string>): void {
+    const missing = order.filter((name) => !steps.has(name));
     if (missing.length > 0) {
         throw new KeyError('Step mapping is missing handlers for: ' + missing.join(', '));
     }