@event4u/agent-config 16.5.0 → 17.0.0

package/dist/agent-src/contexts/execution/subagent-spawn-contract.md

@@ -14,10 +14,22 @@ task without re-inventing any taxonomy.
   "profile": "<active profile id or null>",
   "personas": ["<persona id>", "..."],
   "knowledge_refs": ["<id-or-path>", "..."],
-  "max_tokens_per_worker": 15000
+  "max_tokens_per_worker": 15000,
+  "omit_project_instructions": false,
+  "safety_floor": null,
+  "user_constraints": ["<the user's constraint, verbatim>", "..."]
 }
 ```
 
+**A worker that skips project instructions carries its floor in the brief.**
+On Claude Code 2.1.306 the host's skip flag drops the user-level rule layer as
+well as every `CLAUDE.md`
+(`agents/evidence/investigations/host-continuation-observations-2026-10.md`).
+So for such a worker the brief is the only path to the floor. A skip with no
+non-empty `safety_floor` is refused, and the worker loads its instructions
+instead, with a warning. `user_constraints` ride verbatim for every worker, with
+no trimming, no deduplication and no cap — rule (a) below.
+
 ## Selection — reuse existing seams, no new taxonomy
 
 | Element | Source |
@@ -135,7 +147,7 @@ with RESULTS.md is test-enforced (`tests/scripts/_lib_rtk_allowlist.test.ts`)
 ## Prefix stability — deterministic payload ordering
 
 Spawn payloads serialize **static prefix first** (role contract, profile,
-personas, budget — byte-identical across dispatches of the same
+personas, budget, and the safety floor of a skipping worker — byte-identical across dispatches of the same
 configuration), **variable task part last**; no timestamps, no random IDs
 (`serializeSpawnPayload` / `spawnPayloadHash`). Provider prompt-caching keys
 on the stable prefix; the `payload_hash` + `cache_hit` audit fields

package/dist/agent-src/contexts/execution/subagent-steering.md

@@ -31,14 +31,71 @@ dispatch → monitor → status → escalate / kill
 - `subagents.max_parallel` caps concurrent dispatch. No speculative fan-out:
   a subagent is spawned only for a classified-delegable target, never on spec.
 
-## Transient-failure retry — tier downshift
-
-On a transient subagent failure (HTTP 429, 5xx, or timeout), retry **once** at
-the next-lower model tier (haiku → if already haiku, escalate to the `spawn_failure`
-counter) before counting a failed attempt. Maximum one downshift per subagent
-call. If the downshifted retry also fails, increment the `spawn_failure_rate`
-counter normally. Never downshift twice on the same slot — deterministic cap
-prevents silent drift to the cheapest model on every failure.
+## Transient-failure retry — split by error class
+
+**Only a retry-safe slice is retried.** A slice is re-dispatched after a
+transient failure only when it is declared read-only or idempotent: a subagent's
+first run may have acted before it failed, and discarding its late result does
+not stop it. Any other slice escalates to the orchestrator unretried, whatever
+the class, so the orchestrator can inspect what the first run did. The
+declaration comes from the dispatcher's own record made before the dispatch —
+the slice spec it wrote, or a definition whose tool grant holds no write tool —
+never from the subagent's output, status envelope or self-description. A slot
+whose N=3 budget is already spent is refused, never decided again. Counters and
+the time left are the dispatcher's own state, read once as own data; a
+malformed input (a missing slot or field, a field that is inherited or behind
+an accessor, an unknown error class, a `retry_safe` that is not a boolean, a
+tier off the ladder, a non-integer count, a negative or infinite time left)
+escalates unretried, moves no counter and carries no next state — the
+dispatcher's own slot stays the only record. A malformed raw failure is not
+transient.
+
+**Classify first, in this order.** Once any byte of the model's response
+arrived, nothing is transient — whatever the status or error type, an error
+event mid-stream included: the request may have been acted on. An error status
+line and its error body are not response bytes. Otherwise HTTP 429, or a
+provider error typed `rate_limit_error`, is `rate_limit`. HTTP 529, or a
+provider error typed `overloaded_error`, is `overloaded`. Any other 5xx is
+`server_error`. A client-side deadline is `timeout`, and a connection observed
+never to open (DNS failure, connection refused) is `server_error`. Anything else — no status and no bytes with no
+observed connect failure, a 4xx, a malformed response, a `BLOCKED` envelope —
+is not transient and escalates as below.
+
+**Counters belong to the slot.** One downshift and one park per slot, across
+every class and every attempt of it.
+
+**A valid `Retry-After` is binding, whatever the class.** No re-dispatch of the
+slot happens before it elapses — not on a quota notice, not on a new user turn.
+A wait the run cannot be shown to cover — longer than the time left, or the time
+left unknown — parks the slot instead of re-dispatching it in the same turn.
+
+**Rate limit — park, never re-dispatch in the same turn, never downshift.** On
+the measured host a same-turn retry is a fresh cold start sent into a limiter
+that is already saturated, and the limiter's scope (model, account or
+organisation) is not known, so a smaller model is no way around it on any
+billing class. The slice parks until a recovery signal: `Retry-After` elapsing
+when the response carried one; otherwise the host's quota-resume notice;
+otherwise the next user turn. Then the warm-worker reuse decision runs again (a
+wait past the cache TTL retires the worker and briefs a successor from its
+capsule) and the slice dispatches **at the same tier, as the same attempt**: a
+park is not a failed attempt. A second park on a slot, of any cause, is not
+taken; it consumes an attempt. If the run ends before a recovery signal
+arrives, the slice is returned as parked — neither failed nor verified.
+
+**Overloaded, 5xx or timeout — one downshift.** Retry **once** at the
+next-lower model tier before consuming an attempt. A slot that already
+downshifted, or sits at the lowest tier, consumes an attempt instead. A timed-out
+call may still complete: its late result is discarded unread, and the retry owns
+the slot — which is why only a retry-safe slice gets one.
+
+A consumed attempt increments `spawn_failure_rate` and spends one of the N=3
+budget; the next attempt dispatches at the slot's **original** tier, with no
+downshift left once one was taken. None is a verification failure — no output
+was accepted — so the verify-fail cascade below never starts from one.
+`classifyTransientFailure()` and `transientFailureAction()` in
+`_lib/subagent_steering.ts` are the tested reference: each failure maps to one
+transition and the slot's next counters. Neither dispatches anything; this text
+is what an orchestrating model reads.
 
 This is the only automatic response to a transient failure; structural or
 semantic errors (e.g. `BLOCKED` status envelope) do not trigger a tier

package/dist/agent-src/contexts/model-recommendations.md

@@ -18,9 +18,9 @@ is the Claude generator's (`frontier→fable`, `high→opus`, `medium→sonnet`,
 | `inherit` | — | (session model) | Genuinely model-agnostic / meta work |
 
 Long context is **orthogonal** to the tier (ADR-035): a skill that must read a
-very large input declares the optional `context: large` modifier *in addition*
-to its tier (e.g. `high` + `context: large` for large-codebase analysis). The
-tier is the reasoning band; `context: large` is the context-window need.
+very large input declares the optional `context_window: large` modifier *in addition*
+to its tier (e.g. `high` + `context_window: large` for large-codebase analysis). The
+tier is the reasoning band; `context_window: large` is the context-window need.
 
 ## Task → Tier Mapping
 
@@ -31,7 +31,7 @@ tier is the reasoning band; `context: large` is the context-window need.
 | **Complex debugging** (unknown root cause, cross-layer) | `high` | Follows chains across files and systems |
 | **Design decisions** | `high` | Weighs trade-offs, considers long-term |
 | **Multi-file feature** (cross-domain / architecture relevant) | `high` | Maintains coherence across layers |
-| **Large codebase analysis / research / planning** | `high` (+ `context: large`) | Strong reasoning over a long input |
+| **Large codebase analysis / research / planning** | `high` (+ `context_window: large`) | Strong reasoning over a long input |
 | **Debugging** (known issue, reproducible) | `medium` | Fast, efficient fixes |
 | **Write tests** | `medium` | Pattern-based, no deep reasoning required |
 | **Single-layer feature** (CRUD, same layer) | `medium` | Straightforward implementation |
@@ -76,7 +76,7 @@ for the session.
 | "bug" with unclear cause or spanning multiple layers | Complex debugging | `high` |
 | "should I", "which approach", "what pattern" | Design decision | `high` |
 | Feature touching multiple domains/layers | Multi-file feature | `high` |
-| "analyze project", "scan codebase", research / roadmap creation | Large analysis / planning | `high` + `context: large` |
+| "analyze project", "scan codebase", research / roadmap creation | Large analysis / planning | `high` + `context_window: large` |
 | "bug" with clear error and reproducible case | Debugging (known) | `medium` |
 | Feature within same layer (controller/service CRUD) | Single-layer feature | `medium` |
 | linters / type-checks / formatters | Quality checks | `medium` |

package/dist/agent-src/contexts/subagent-configuration.md

@@ -10,7 +10,7 @@ Loaded by the `subagent-orchestration` skill and the `/do-and-judge`,
 |---|---|---|
 | `subagents.implementer_model` | _(empty → session model)_ | Model alias used for implementer subagents |
 | `subagents.judge_model` | _(empty → one tier up)_ | Model alias used for judge subagents |
-| `subagents.max_parallel` | `3` | Limit on concurrent subagent invocations the model reads from settings — no code counts spawns against it |
+| `subagents.max_parallel` | `3` | Limit on concurrent subagent invocations. On Claude Code the installer writes it into `CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS`, the host cap on concurrent new spawns. That cap does **not** bound a resumed worker — on Claude Code 2.1.306 a resume was admitted past a cap of 1 (`agents/evidence/investigations/host-continuation-observations-2026-10.md`) — so a resume is neither bounded by the host nor counted by any package code yet, and is never claimed as enforced |
 
 ## Model tier ladder
 

package/dist/agent-src/guidelines/agent-infra/api-cost-levers.md

@@ -127,9 +127,10 @@ version 2.1.220 (2026-07-30), re-check on drift:**
 - A **fork** inherits the parent's system prompt, tools, and conversation
   history exactly, so its first request **reads the parent's cache** instead
   of writing a fresh one — the only documented mechanism that shares a cache
-  across a dispatch boundary. Forking forces background mode, which changes
-  the tool set and therefore invalidates the very prefix that motivated the
-  fork; weigh that cost before reaching for it — see the fork-vs-subagent
+  across a dispatch boundary. Forking forces background mode; on a host
+  whose row says `fork_shares_cache: true` (Claude Code 2.1.302, observed) the
+  fork still reads the parent's prefix and keeps its tool pool, elsewhere that
+  is unobserved; weigh the tool-fit cost before reaching for it — see the fork-vs-subagent
   ordering rule in See also.
 - Either way, the **cold-start preamble is re-written on every spawn** — the
   always-loaded rule set, the tool definitions, and the dispatch prompt are

package/dist/agent-src/guidelines/agent-infra/model-recommendation.md

@@ -12,13 +12,19 @@ double-ask, never front-load the question.
 
 ## Source of truth — the capability tier
 
-Each skill/command declares `model_tier: lite | medium | high | inherit`
-(ADR-035) — a band, not a model. `inherit` = "no opinion, keep the session
-model". The task→tier heuristics live in
+Each skill/command declares `model_tier: lite | medium | high | frontier |
+inherit` (ADR-035) — a band, not a model. `inherit` = "no opinion, keep the
+session model". The task→tier heuristics live in
 `contexts/model-recommendations.md` — cite them, don't restate. The **only**
 tier→model mapping the package maintains is the Claude generator's
-(`high→opus`, `medium→sonnet`, `lite→haiku`); every other agent resolves the
-band to its own line-up.
+(`frontier→fable`, `high→opus`, `medium→sonnet`, `lite→haiku`); every other
+agent resolves the band to its own line-up.
+
+`frontier` is named in both halves of that sentence because
+`TIER_TO_CLAUDE_MODEL` in `src/scripts/_lib/model_tier.ts` has mapped it since
+the fourth family landed. While this page listed three bands, a skill author
+reading the declarable set here could not declare a band the resolver already
+answered — the page was the narrower of the two, and it was the one being read.
 
 ## Surface-aware behaviour
 

package/dist/agent-src/guidelines/agent-infra/rule-body-migration-inventory.md

@@ -57,7 +57,7 @@ always-loaded rules.
 | ask-when-uncertain.md | stay | 66 | Y | — | kernel Iron Law + ask-policy floor |
 | augment-edit-discipline.md | thin | 29 | | `guideline:augment-portability-patterns` + `skill:agent-docs-writing` (both existing) | two explicit "body migrated to" sentences |
 | autonomous-execution.md | thin | 81 | | `contexts/execution/autonomy-mechanics.md` + siblings (existing) | hybrid: several short Iron-Law-style blocks retained (Hard Floor pointer, N=3 budget headline), full mechanics already migrated |
-| brand-consistency.md | stay | 75 | | — | gate definition is the enforcement surface itself; already routes deeper mechanics to `brand-identity`/`brand-to-tokens`/`design-intelligence` |
+| brand-consistency.md | stay | 75 | | — | checklist definition is the rule itself; already routes deeper mechanics to `brand-identity`/`brand-to-tokens`/`design-intelligence` |
 | brand-source-of-truth.md | stay | 65 | | — | explicitly "light by design"; precedence order is the whole rule |
 | broken-access-control.md | thin | 68 | | `skill:authz-review` (existing) | hybrid: 2 short Iron-Law blocks (3 negative tests) retained, deep controls/matrix/backstop-grep content already migrated |
 | cli-output-handling.md | thin | 40 | | `skill:rtk-output-filtering` (existing) | pure P4 stub |

package/dist/agent-src/guidelines/agent-infra/self-improvement-pipeline.md

@@ -2,10 +2,13 @@
 
 Five-stage flow that turns real project experience into reviewed
 rule / skill / command / guideline changes. Self-modification is a goal
-(ADR-281): for a proposal scoped to the package the approval is the AI
-council's ratification record, and the user is its last rung; a change a
-user asked for keeps that user's approval as now. A passing record makes a
-change ready, not landed — every upstream change still ships via a PR.
+(ADR-281, as amended 2026-10-07): for a proposal scoped to the package a
+digest-bound AI council record is **required and is a review, not the
+approval** — a council refusal fails closed, and a favourable verdict
+recommends passage and stays advisory until the owner's authenticated
+authorization is bound to the same digest. A change a user asked for keeps
+that user's approval as now. A reviewed record makes a change ready, not
+landed — every upstream change still ships via a PR.
 
 Referenced by `road-to-curated-self-improvement.md`. Consumed by the live
 artifacts — the `skill-improvement-trigger` rule and the existing skills
@@ -33,15 +36,19 @@ blocks — it does not hand a half-filled doc to the next stage.
   finding recurs, a successful pattern is worth codifying.
   The existing `skill-improvement-trigger` rule signals the event.
 - **Input:** raw observation (PR link, log line, review comment).
-- **Output:** learning note at `agents/learnings/<date>-<slug>.md`
-  with frontmatter `source`, `evidence[]` (≥1 link), `stage: captured`.
-- **Guardrails:** nothing is written into `dist/agent-src/` at this stage.
-  Learnings live in the consumer repo until promoted.
+- **Output:** a signal appended to the intake stream
+  `agents/memory/intake/signals-<YYYY-MM>.jsonl` by `memory_signal`, carrying
+  its source, its evidence reference and its polarity. `learning_sidecar`
+  verdicts that stream — decay, corroboration at two distinct origins, dead
+  ends — into a gitignored overlay.
+- **Guardrails:** nothing is written into `dist/agent-src/` at this stage, and
+  the overlay is never auto-promoted. A single session can never mint a lesson;
+  the stream lives in the consumer repo until a human curates it onward.
 
 ### Stage 2 — Classify
 
 - **Trigger:** explicit invocation or pipeline progression.
-- **Input:** learning note from Stage 1.
+- **Input:** the signal, and the sidecar's verdict over it, from Stage 1.
 - **Output:** same file, frontmatter extended with:
   - `scope: project | package`
   - `type: rule | skill | command | guideline`
@@ -66,14 +73,15 @@ blocks — it does not hand a half-filled doc to the next stage.
 ### Stage 4 — Gate
 
 - **Trigger:** proposal doc committed or staged.
-- **Executor:** `scripts/check_proposal.ts`.
+- **Executor:** `./agent-config proposal:check`.
 - **Input:** proposal doc from Stage 3.
 - **Output:** verdict recorded in the proposal doc section 9
   (`pass | request changes | block`). Frontmatter `stage: gated`
   only after a `pass`.
 - **Gate checks (all must pass):**
   1. At least **2 independent evidence** entries (distinct PRs,
-     issues, or incidents).
+     issues, or incidents) — the local row of the evidence threshold
+     in `docs/contracts/retro-v1.md` § Evidence threshold.
   2. `skill_linter` zero errors on the draft body.
   3. `check_portability` zero violations (no project identifiers
      on `package`-scoped proposals).
@@ -81,6 +89,8 @@ blocks — it does not hand a half-filled doc to the next stage.
   5. `size-enforcement` within the budget for the artefact type.
   6. `preservation-guard` justifies any replacement (section 6 of
      the proposal doc).
+  7. For `scope: package` at `stage: gated`: the review and the owner's
+     authorization are bound to the declared change (see Stage 5).
 - **Guardrails:** the gate is not a rubber stamp. A `block` verdict
   stays in the proposal as history; the pipeline restarts at
   Stage 3 if the author wants to revise.
@@ -88,19 +98,30 @@ blocks — it does not hand a half-filled doc to the next stage.
 ### Stage 5 — Upstream
 
 - **Trigger:** gate passed AND, for a proposal scoped to the package, a
-  council ratification record whose `subject` matches the proposal's change
-  passed it (ADR-281); where the council cannot conclude, the user decides by
-  the route ADR-281 § 5 names. A proposal scoped to a consumer's own project
-  needs that user's approval, as before.
-- **Executor:** `upstream-contribute` skill. Refuses invocation if
-  the proposal frontmatter is not `stage: gated`.
+  council ratification record reviewed it favourably AND the owner's
+  authorization is on record (ADR-281 as amended 2026-10-07 — the council
+  record is the review, the owner's authorization is the approval); where the
+  council cannot conclude, the user decides by the route ADR-281 § 5 names. A
+  proposal scoped to a consumer's own project needs that user's approval, as
+  before.
+  `proposal:check` performs the binding (gate check 7): a `scope: package`
+  proposal at `stage: gated` declares `changed_files:` and names a
+  `ratification_record:` that passes the reader against the committed provider
+  policy and an `owner_authorization:`, both bound to one digest over those
+  files read at one commit. It cannot prove the owner wrote the authorization;
+  it proves the review and the approval name the same content.
+- **Executor:** the `upstream-contribute` skill decides *whether*, and
+  `self-repair:release` — the one gated outward step — decides *what leaves*.
+  The skill refuses invocation if the proposal frontmatter is not
+  `stage: gated`.
 - **Input:** gated proposal doc.
-- **Output:** PR against `event4u/agent-config` carrying the
-  proposal doc as the PR body. Standard package CI runs.
+- **Output:** a pull request or an issue against `event4u-app/agent-config`
+  carrying the proposal doc as the body. Standard package CI runs.
   Frontmatter `stage: upstream` and `upstream_pr_url` set.
-- **Guardrails:** no `upstream-contribute` invocation ever edits
-  `.agent-src.uncondensed/` in the consumer repo. Writes happen
-  in the fork / PR branch of the package repo only.
+- **Guardrails:** the skill never pushes and never opens a pull request
+  itself, so there is one privacy floor and not two. No invocation edits any
+  installed tree in the consumer repo; writes happen in the package checkout's
+  branch only, and a consumer install reaches the issue step.
 
 ## Stage ownership
 
@@ -129,8 +150,10 @@ unreviewed upstream changes is not.
   need the evidence in one place.
 - **Do NOT** promote a learning with one piece of evidence. Two
   independent sources is the minimum; the gate enforces it.
-- **Do NOT** edit `.agent-src.uncondensed/` directly in a consumer
-  project "just to try it out". Drafts live in `agents/proposals/`.
+- **Do NOT** edit the installed tree directly in a consumer project
+  "just to try it out" — `.augment/` today, `.agent-src.uncondensed/`
+  in a legacy install. Both are managed; drafts live in
+  `agents/proposals/` and local changes in `agents/overrides/`.
 - **Do NOT** treat a `block` verdict as a personal rejection. The
   gate checks structural shape, not author intent.
 

package/dist/agent-src/guidelines/design-antipatterns.md

@@ -135,6 +135,8 @@ Within-project invariants + repetition caps. Override = declare the value in
 | T8 | Single typeface for everything | Missed typographic contrast opportunity; in the **brand** register an unexamined single family reads as "I did not think about fonts" | **Register-scoped like T7.** Intentional mono-typeface aesthetic (e.g., terminal-inspired), stated in the brief — *or* the **product** register, where one reliable family is the sanctioned strategy ([`design-modes`](design-modes.md) § The two registers) and contrast is carried by weight and scale rather than by a second family. | reference-constraint | retune | judgment |
 | T9 | All-caps body paragraphs or field labels | Reduces legibility below WCAG AA for sustained reading; reads as flair over function | Short UI labels (e.g., button text in a brutalist layout); never for body paragraphs | floor | delete → retune | static |
 | T10 | Wide letter-spacing on body text (`letter-spacing` > 0.05em) | Reduces readability for sustained reading; reserved for display use | Display text (headlines, pull quotes) where intentional tracking is a brand element | craft-presumption | retune | static |
+| T11 | Faux bold or italic: a weight or style requested of a family that does not carry that face, so the renderer emboldens or slants the face it has | Synthesised strokes thicken unevenly and slant without the true italic's letterforms; reads as a missing font, not a style choice | Load the face that carries the weight or style, or set `font-synthesis: none` on purpose where the regular face is the intended look | floor | replace → retune | render |
+| T12 | Self-hosted webfont with `font-display: swap` and no metric-matched fallback `@font-face` (`size-adjust`, `ascent-override`, `descent-override`) | The fallback paints first at different metrics, so every line reflows when the webfont swaps in — measurable layout shift | `font-display: optional` or `block` on purpose, or a fallback face whose overrides are derived from the webfont's vertical metrics ([`design-asset-discipline`](design-asset-discipline.md)) | craft-presumption | retune | static |
 
 ---
 
@@ -241,6 +243,7 @@ are listed in § Quality floors.
 | `judgment-only` | needs structural or aesthetic judgment a text pass cannot make; `design-review` decides it |
 | `deferred` | pattern-detectable but a design-system opinion rather than a floor; deliberately not shipped |
 | `candidate` | a numeric threshold stated in the entry, not yet detected — a status that must resolve to `backed` or `judgment-only`, never persist |
+| `witness` | read from the rendered asset by `ui:render --profile asset`, not from text; the note names the witness rule, which must exist in the witness source |
 
 | Entry | Status | Note |
 |---|---|---|
@@ -270,6 +273,8 @@ are listed in § Quality floors.
 | T8 | deferred | typeface count is a design-system opinion, not a floor |
 | T9 | backed | |
 | T10 | backed | |
+| T11 | witness | `ui:render --profile asset` reports `geometry/font-synthesised`; fixture `missing-weight-reads-synthesised` |
+| T12 | backed | |
 | L1 | judgment-only | composite structural template |
 | L2 | judgment-only | three-identical-card grid; DOM-structure analysis |
 | L3 | deferred | spacing-multiple uniformity is a design-system opinion |

package/dist/agent-src/guidelines/design-asset-discipline.md

@@ -25,6 +25,23 @@ brand evidence**. The design-surface instance of the no-invented-facts floor.
   emitters (`typography-system`, UI-apply directives, brand-asset paths) are
   consumers and point here rather than restating it. (fixture:
   `daf-webfont-delivery`.)
+- **Self-hosted font files are subset and the one above-the-fold face is
+  preloaded.** Split a self-hosted family into files by script and declare each
+  with `unicode-range` on its `@font-face`, so a page downloads only the ranges
+  its text uses. Add `<link rel="preload" as="font" type="font/woff2"
+  crossorigin>` for the single face that paints above the fold, and for no
+  other: every preload competes with the first render for bandwidth. These are
+  mechanics, not tells — nothing here is detected.
+- **A swapped face gets a metric-matched fallback, derived from the font.**
+  With `font-display: swap`, declare a second `@font-face` over a `local()`
+  system face and set its overrides from the webfont's own tables (own analysis
+  of the CSS Fonts 5 descriptors): `size-adjust` = the webfont's average advance
+  over the fallback's for the same sample text; `ascent-override` =
+  ascender ÷ (unitsPerEm × size-adjust), `descent-override` =
+  |descender| ÷ (unitsPerEm × size-adjust), `line-gap-override` = lineGap ÷
+  (unitsPerEm × size-adjust). Read the `OS/2` typo values when the font sets
+  `USE_TYPO_METRICS`, the `hhea` values otherwise. The missing fallback is
+  catalogue tell T12 in [`design-antipatterns`](design-antipatterns.md).
 - **Real imagery where inspection matters.** On visual pages/decks, use actual
   product / place / object / state imagery where the image IS the proof (a
   product screenshot, a real dashboard state). Decorative atmosphere is not proof

package/dist/agent-src/guidelines/design-fidelity-routing.md

@@ -77,6 +77,7 @@ contract rather than a courtesy:
 | `phrase: claude.site/artifacts` | `near-claude-ai-chat-link` | a bare `claude.ai` chat link is a conversation reference, not a spec |
 | `path_prefix: .claude/design-system/` | `near-generic-design-system-dir` | a bare `design-system/` is a normal source folder in a large fraction of frontend repos |
 | `file_pattern: *.dc.html` | `near-plain-html-open-file`, `near-dc-in-a-filename` | an ordinary `.html` file in the tree; a filename that merely contains the letters |
+| `path_prefix: .design-sync/` | `near-plain-sync-dir` | a bare `sync/` or `design-sync/` folder is ordinary source, only the host's dot-folder is a handover |
 | the withdrawn builder URL | `near-bare-host-mention` | left behind on purpose, so the broad form stays pinned silent |
 
 ### Write the near-miss row first — and test the right direction

package/dist/agent-src/guidelines/php/api-design.md

@@ -81,7 +81,16 @@ RateLimiter::for('api', function (Request $request) {
 });
 
 RateLimiter::for('auth', function (Request $request) {
-    return Limit::perMinute(5)->by($request->ip());
+    // Two limits, not one: the account and the source. An IP-only key fails
+    // in BOTH directions — one attacker rotating addresses gets five attempts
+    // per address against the same account, and one office NAT locks every
+    // colleague out after five attempts between them.
+    $account = Str::lower(trim((string) $request->input('email')));
+
+    return [
+        Limit::perMinute(5)->by('auth:acct:' . sha1($account)),
+        Limit::perMinute(5)->by('auth:ip:' . $request->ip()),
+    ];
 });
 ```
 

package/dist/agent-src/rules/brand-source-of-truth.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Consumer brand tokens + voice profile are the run's source of truth — the corpus fills gaps, never overrides; emitted values that trace to no token are flagged off-brand"
+description: "Consumer brand tokens + voice are the run's source of truth — the corpus fills gaps, never overrides; values tracing to no token are off-brand"
 triggers:
   - keyword: "brand"
   - keyword: "on-brand"
@@ -20,20 +20,21 @@ applies_to_user_types:
 self_contained: true
 workspaces: [engineering]
 packs: [brand]
+enforced_by:
+  - "instruction-only: check_voice_lexicon runs if invoked"
 obligation_frequency: "per-edit"
 ---
 
 # Brand Source of Truth
 
-A precedence rule plus its validation gate (merged from the former
-`brand-consistency` rule, 2026-08-04 — the pair shared triggers and one
-subject). When a consumer already has a brand — registered tokens
+A precedence rule plus its checklist (merged from
+`brand-consistency`, 2026-08-04). When a consumer already has a brand — registered tokens
 (`tokens.json`), a voice profile, a brand guide — that brand is authoritative
 for the run. The curated `brand` corpus (archetypes, colour psychology, type
 principles) is a **gap-filler**, never an override.
 
 Brand is the layer that *constrains* UI, copy, and assets — not a coat of paint
-applied after. The gate half is a concrete Validation gate: emitted artifacts
+applied after. The checklist half: emitted artifacts
 are checked against the **active brand tokens and voice profile**, and anything
 that cannot be traced back to one is flagged off-brand. It mirrors the
 design-intelligence principle that **audit findings outrank corpus
@@ -68,7 +69,7 @@ THE FILE IS `tokens.json`, NEVER `.tokens.json` — A DOT-PREFIXED FILE IS READ
 ```
 
 The resolver searches exactly four paths under the project root, in this order,
-first hit wins (`BRAND_TOKEN_PATHS`, the UI scaffold directive):
+first hit wins (`BRAND_TOKEN_PATHS` in `brandTokenPaths.ts`):
 
 1. `tokens.json`
 2. `assets/tokens.json`

package/dist/agent-src/rules/code-provenance.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
-description: "Porting external code, or asserting an externally-sourced claim — close the source, re-derive; borrows need a ledger entry + license check, harvested claims an id or an own-analysis label"
+description: "Porting external code or citing an outside claim — re-derive; borrows need ledger + license check, claims a harvest id or an own-analysis label"
 triggers:
   - keyword: "port this"
   - keyword: "adapt this"

package/dist/agent-src/rules/context-hygiene.md

@@ -130,5 +130,4 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 
 ## See also
 
-- [`guideline:agent-infra/context-hygiene-mechanics`](../guidelines/agent-infra/context-hygiene-mechanics.md) — templates + per-host procedures.
 - [`systematic-debugging § Debug micro-loop`](../skills/systematic-debugging/SKILL.md) — the read-loop debug procedure.

package/dist/agent-src/rules/design-fidelity.md

@@ -29,6 +29,7 @@ triggers:
   - file_pattern: "*design.html"
   - file_pattern: "*.dc.html"
   - path_prefix: ".claude/design-system/"
+  - path_prefix: ".design-sync/"
 applies_to_user_types:
   - "creator"
   - "developer"
@@ -147,14 +148,13 @@ porting, or modifying UI to match it.
 
 ## Routing — an attached artifact is a trigger, an attached HTML file is not
 
-Matching is lower-cased substring containment on the prompt plus fnmatch over
-the open files. Five classes reach this rule without a keyword being typed: the
-filename patterns `*design.html` and `*.dc.html`, the published-artifact path
-`claude.site/artifacts`, the directory prefix `.claude/design-system/`, and the
-English and German handover phrasings. A handover under any other filename, and
-a third-party builder's share link, need one word in the prompt — the
-builder-URL trigger was tried and **withdrawn** as over-broad, and stays pinned
-silent rather than merely absent.
+Five classes reach this rule without a keyword being typed: the filename
+patterns `*design.html` and `*.dc.html`, the published-artifact path
+`claude.site/artifacts`, the prefixes `.claude/design-system/` and
+`.design-sync/`, and the English and German handover phrasings. A handover under
+any other filename, and a third-party builder's share link, need one word in the
+prompt — the builder-URL trigger was tried and **withdrawn** as over-broad, and
+stays pinned silent.
 
 Each class carries a near-miss row in the routing matrix, and a new trigger's
 row must test the direction that trigger opens. The matrix, the reasons behind
@@ -166,11 +166,10 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 
 ## Honest enforcement — `instruction-only`
 
-Nothing records a fidelity comparison, so the proof clause in the Iron Law is
-model-carried and the committed matrix is the control. Which two linters exist,
-what each measures and why neither can tell a proven 1:1 from an asserted one:
-`design-fidelity-enforcement`,
-named in `load_context` above.
+The proof clause is model-carried and the committed matrix is the control —
+except a canvas-synced system, whose mechanical leg is the `sync-ledger` plus
+`/design-system:sync verify`. The two linters and their limits:
+`design-fidelity-enforcement` (`load_context`).
 
 ## See also
 

package/dist/agent-src/rules/external-reference-deep-dive.md

@@ -28,7 +28,7 @@ Triggered when the user points to an external artifact (repo URL, `owner/repo`,
 
 ## Mandatory before drawing any conclusion
 
-1. **Use `/analyze-repo`** (the canonical flow) when the artifact is a repo. Its Steps 2–5 are not optional shortcuts — they are the deep-dive contract: fetch listings (not just README), inspect key directories (`skills/`, `rules/`, `commands/`, `scripts/`, `.github/workflows/`, install configs, frontmatter samples), classify each axis adopt/adapt/reject/already.
+1. **Use `/analyze:reference`** when the artifact is a repo. Steps 2–5 are not optional shortcuts but the deep-dive contract: fetch listings (not just README), inspect key directories (`skills/`, `rules/`, `commands/`, `scripts/`, `.github/workflows/`, install configs, frontmatter samples), classify each axis adopt/adapt/reject/already.
 2. **For single files / websites** — fetch the actual content, not a summary. PDFs/DOCX/XLSX → `markitdown` first.
 3. **Cite verbatim** — every finding lands with a file path, line range, or URL fragment. "The README says X" is **not** a finding about implementation; it's a finding about marketing copy.
 4. **Surface what was inspected** — list the files / directories actually fetched, so the user can audit coverage.
@@ -59,7 +59,7 @@ User explicitly fences the scope (*"quick scan only"*, *"just glance at the READ
 
 ## See also
 
-- Command [`/analyze-repo`](../commands/analyze/repo.md) — canonical deep-dive flow.
+- Command [`/analyze:reference`](../commands/analyze/reference.md) — canonical deep-dive flow.
 - Rule [`think-before-action`](think-before-action.md) — sibling Iron Law for code paths in **this** repo; this rule is its mirror for **external** artifacts.
 - Rule [`ask-when-uncertain`](ask-when-uncertain.md) — when a fetch budget caps, ask which subtree to expand instead of guessing.
 - Skill [`markitdown`](../skills/markitdown/SKILL.md) — convert binary office formats before analysis.

package/dist/agent-src/rules/fix-what-you-see.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
-description: "Saw a red check or a real defect — fix it, whoever wrote it; if you cannot, ship a tracked follow-up roadmap in the same change. Ownership is never a disposition"
+description: "Saw a red check or a real defect — fix it, whoever wrote it, or ship a tracked follow-up roadmap in the same change. Ownership is never a disposition"
 # Due when a defect is OBSERVED, not on a clock: a turn that sees nothing owes
 # nothing; a turn that sees a red check owes a disposition.
 obligation_frequency: "per-event"

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -25,13 +25,12 @@ NO SECRETS. NO EMAILS. NO PROJECT PATHS. NO CUSTOMER NAMES.
 NO INTERNAL HOSTNAMES. NO MONEY. NO BUSINESS SQL. NO LONG CODE.
 ```
 
-The redactor lives in `scripts/ai_council/redact_low_impact_entry.ts`
-and runs at **both** gates:
+The redactor — named under *See also* — runs at **both** gates:
 
 1. **Write gate** — every intake append to
-   `agents/decisions/low-impact-decisions.md` (Phase 12 § Step 2).
-2. **Upstream gate** — every `/memory learn-low-impact` PR draft,
-   before the diff leaves the repo (Phase 12 § Step 5).
+   `agents/decisions/low-impact-decisions.md`.
+2. **Review gate** — every `/memory learn-low-impact` preview; a refused
+   entry is named, never promoted.
 
 A failure at either gate refuses the operation, surfaces the
 offending pattern, and asks the user to rephrase. The redactor never
@@ -41,7 +40,7 @@ auto-rewrites — silent rewriting is a soft gate, this is hard.
 
 | # | Class | Pattern source |
 |---|---|---|
-| 1 | Secrets | raw-key prefixes from `scripts/ai_council/config._RAW_KEY_PREFIXES` + inline `api_key:` shape |
+| 1 | Secrets | raw-key prefixes from `_RAW_KEY_PREFIXES` in `src/scripts/ai_council/config.ts` + inline `api_key:` shape |
 | 2 | Emails | RFC-5322-ish |
 | 3 | Project-rooted paths | `/Users/`, `/home/`, `/opt/`, `/private/`, drive letters, configured `repo_root` |
 | 4 | Customer / tenant names | caller-supplied list; generic placeholders (`<customer>`, `<tenant>`, `<account>`, `<user>`) survive |
@@ -52,16 +51,16 @@ auto-rewrites — silent rewriting is a soft gate, this is hard.
 
 ## Locked target types
 
-- `agents/decisions/low-impact-decisions.md` — project-local corpus.
-- `data/low-impact-decisions-seed.md` (agent-config package) —
-  upstream seed shipped with the package.
+- `agents/decisions/low-impact-decisions.md` — the project-local corpus.
+- `data/low-impact-decisions-seed.md` — the package seed, **not in the
+  tree**. Locked anyway, so a reappearing seed arrives under the floor.
 
 ## When to invoke
 
-- The host agent has just received a user intake trigger (see
-  `scripts/ai_council/low_impact_intake.TRIGGER_PHRASES`).
-- The host agent is about to write an entry to the corpus or to
-  open a `/memory learn-low-impact` PR.
+- A user intake trigger arrived (`TRIGGER_PHRASES` in
+  `src/scripts/ai_council/low_impact_intake.ts`).
+- An entry is about to reach the corpus, or a
+  `/memory learn-low-impact` preview to render.
 
 ## What to surface on refusal
 
@@ -76,6 +75,6 @@ auto-rewrite.
 
 ## See also
 
-- `scripts/ai_council/redact_low_impact_entry.ts` — the redactor.
-- `scripts/ai_council/low_impact_intake.ts` — write-gate caller.
+- `src/scripts/ai_council/redact_low_impact_entry.ts` — the redactor.
+- `src/scripts/ai_council/low_impact_intake.ts` — write-gate caller.
 - `agents/decisions/low-impact-decisions.md` — corpus + Anti-Examples list.