@event4u/agent-config 16.5.0 → 17.0.0

package/dist/agent-src/skills/brand-asset-generation/SKILL.md

@@ -51,10 +51,17 @@ adapters — not a second image-gen stack.
    written here, because these change without notice. If the spec cannot be
    established, say so and ask rather than emitting an asset that will be
    cropped.
-2. **Inject brand tokens when present** — if `pack-brand` is installed, load `.tokens.json`
-   (colors, typography, voice). Feed hex values, font names, and tone keywords directly
-   into the prompt. Without tokens, derive palette and type from the brief itself;
-   raw generation works — output is brief-driven, not token-driven.
+2. **Ask the resolver, then inject what it reports** — run
+   `./agent-config brand:status --json` before any colour, type or voice
+   decision. Take hex values and font names from the `tokens.json` entry it
+   reports as valid, and tone keywords from the `brand-voice` slot
+   (`agents/context-spine/brand-voice.md`) when that is valid too; feed those <!-- ref-ignore -->
+   into the prompt. Never load a token file by path on your own — a file the
+   resolver marks `invalid` or `shadowed` is not the brand, and a dotted
+   near-miss is not the brand either. When the resolver reports `bare`, or
+   nothing valid for the axis in hand, derive palette and type from the brief;
+   raw generation works, and every such value is **labelled `corpus-sourced`
+   in the output** so brief-driven is never reported as token-driven.
 3. **Route and prompt** — delegate provider selection to
    [`image-provider-routing`](../image-provider-routing/SKILL.md) (text-in-image →
    Ideogram, photoreal product shot → Flux, etc.). Author the provider-specific prompt
@@ -83,14 +90,14 @@ adapters — not a second image-gen stack.
   (Phase B of the brand pipeline) eliminate this gap; until that pack ships, rely on
   brief-supplied values.
 - **Brand tokens come from `pack-brand` (Phase B)** — this skill consumes tokens; it does
-  not author them. If `.tokens.json` is absent, proceed brief-driven and note the gap.
+  not author them. If `tokens.json` is absent, proceed brief-driven and note the gap.
 - **Adapters are scaffold-tier (dry-run only)** — all pack-ai-image adapters are `experimental`.
   This skill produces a blueprint and dry-run confirmation; actual renders require a
   maintainer to capture a smoke trace and promote the adapter to `stable`.
 
 ## Do NOT
 
-- Do NOT invent brand colors or voice — use tokens from `.tokens.json` or explicit values
+- Do NOT invent brand colors or voice — use tokens from `tokens.json` or explicit values
   from the brief. Guessing palette values produces off-brand output.
 - Do NOT omit the AI-generation disclosure — every delivered asset requires the disclosure
   footer per `media-governance-routing`, regardless of how generic the output appears.

package/dist/agent-src/skills/brand-audit/SKILL.md

@@ -3,6 +3,7 @@ model_tier: inherit
 name: brand-audit
 description: "Audit how a brand is currently expressed across touchpoints and flag drift from its defined tokens, voice, and strategy. Use to inventory and critique an existing brand before changing it."
 domain: engineering
+context_spine: [brand-voice]
 personas:
   - brand-strategist
 workspaces:
@@ -33,7 +34,7 @@ Method skill. Inventories current brand expression across touchpoints and flags
 
 ## Procedure
 
-1. **Gather the source of truth.** Collect the consumer brand's defined tokens (palette, type scale, logo rules), voice profile, and strategy doc if they exist. Consumer brand definition is authoritative; corpus defaults are gap-fill only.
+1. **Gather the source of truth.** Run `brand:status --json` and take the sources it reports: the registered `tokens.json` and the **`brand-voice`** slot (`agents/context-spine/brand-voice.md`) — three `{is, is_not, proof}` attributes, the tone matrix, `avoid[]`, `claims[]`; only a schema-valid slot counts. Add logo rules and the strategy doc if they exist. Consumer brand definition is authoritative; corpus defaults are gap-fill only. **No valid slot makes every voice observation `undefined`, never `drift`** — there is nothing to diverge from. <!-- ref-ignore -->
 2. **Inventory current expression per touchpoint.** Cover logo usage, colour palette, typography, voice/copy tone, imagery style, and iconography across the relevant surfaces (site, app, decks, marketing, docs).
 
    **Personal and company profile surfaces, including LinkedIn, X, and GitHub

package/dist/agent-src/skills/brand-identity/SKILL.md

@@ -38,7 +38,7 @@ Grounding + Method skill. Turns a confirmed brand strategy into an identity cons
 2. **Ground the colour story** via the brand corpus:
 
 ```bash
-./scripts-run <skills-root>/corpus-grounding/scripts/ground search \
+node <skills-root>/corpus-grounding/scripts/ground.mjs search \
   --manifest <skills-root>/brand/data/manifest.json \
   "<archetype + sector>" --domain color --json
 ```
@@ -48,7 +48,7 @@ Grounding + Method skill. Turns a confirmed brand strategy into an identity cons
 3. **Ground the type story** via:
 
 ```bash
-./scripts-run <skills-root>/corpus-grounding/scripts/ground search \
+node <skills-root>/corpus-grounding/scripts/ground.mjs search \
   --manifest <skills-root>/brand/data/manifest.json \
   "<archetype + sector>" --domain typography --json
 ```
@@ -58,7 +58,7 @@ Grounding + Method skill. Turns a confirmed brand strategy into an identity cons
 4. **Ground the logo direction** via:
 
 ```bash
-./scripts-run <skills-root>/corpus-grounding/scripts/ground search \
+node <skills-root>/corpus-grounding/scripts/ground.mjs search \
   --manifest <skills-root>/brand/data/manifest.json \
   "<archetype + sector>" --domain logo --json
 ```
@@ -71,7 +71,7 @@ Grounding + Method skill. Turns a confirmed brand strategy into an identity cons
 
 7. **Human confirms** the constraint set before any downstream step runs.
 
-8. **Export** — hand off: `brand-to-tokens` receives the colour + type constraints and emits `.tokens.json` (DTCG); `logo-generation` and `brand-asset-generation` receive the logo direction and imagery direction. Direction of flow: B (pack-brand) -> A (pack-ai-image).
+8. **Export** — hand off: `brand-to-tokens` receives the colour + type constraints and emits `tokens.json` (DTCG); `logo-generation` and `brand-asset-generation` receive the logo direction and imagery direction. Direction of flow: B (pack-brand) -> A (pack-ai-image).
 
 ## Output format
 
@@ -101,4 +101,5 @@ Grounding + Method skill. Turns a confirmed brand strategy into an identity cons
 - [`brand-to-tokens`](../brand-to-tokens/SKILL.md) — emits the DTCG token source of truth.
 - [`typography-system`](../typography-system/SKILL.md) — turns the type story into type tokens.
 - [`logo-generation`](../logo-generation/SKILL.md) — generates marks from this identity (pack-ai-image).
+- `type-design` — when the type story is a custom family: the wordmark's lettering or a brief built into an original font (pack-frontend-design).
 - [`brand`](../brand/SKILL.md) — the corpus grounded against.

package/dist/agent-src/skills/brand-strategy/SKILL.md

@@ -38,7 +38,7 @@ Grounding skill. Consults the brand corpus to surface archetype, positioning, vo
 2. **Ground via the corpus.** Run the corpus engine for each required domain. Start with archetype, then voice, then messaging:
 
 ```bash
-./scripts-run <skills-root>/corpus-grounding/scripts/ground search \
+node <skills-root>/corpus-grounding/scripts/ground.mjs search \
   --manifest <skills-root>/brand/data/manifest.json \
   "<sector + audience + intent>" --domain archetype --json
 ```
@@ -49,7 +49,7 @@ Grounding skill. Consults the brand corpus to surface archetype, positioning, vo
 
 4. **Draft the constraint set.** Produce:
    - An **opposable positioning statement** naming the audience AND a difference a competitor could legitimately claim the opposite of.
-   - A **voice profile**: 3-5 traits, each with a do and a don't.
+   - A **voice direction** — the register the archetype implies, as input only. The voice itself is three `"X, not Y"` attributes owned by `voice-and-tone-design` and recorded in the `brand-voice` slot (`agents/context-spine/brand-voice.md`); author no competing trait list here, and never write the slot from this skill. <!-- ref-ignore -->
    - A **chosen messaging framework** (problem-solution, jobs-to-be-done, category creation, etc.) with a rationale sentence.
 
 5. **Surface gaps and low-confidence calls.** Name every evidence gap and every row below the confidence threshold. Flag where the corpus was thin.
@@ -62,7 +62,7 @@ Grounding skill. Consults the brand corpus to surface archetype, positioning, vo
 
 1. Named archetype cited to the corpus row (domain, row id, confidence).
 2. One-line opposable positioning statement (audience + difference).
-3. Voice profile: 3-5 traits, each with a do/don't pair, plus chosen messaging framework with rationale.
+3. Voice direction handed to `voice-and-tone-design`, which owns the three attributes and the `brand-voice` slot, plus chosen messaging framework with rationale.
 4. Confidence label (High / Medium / Low) and every `evidence_gap` from the corpus verbatim.
 
 ## Do NOT
@@ -74,7 +74,7 @@ Grounding skill. Consults the brand corpus to surface archetype, positioning, vo
 
 ## Gotcha
 
-- The corpus grounds pre-action selection, not validation. Post-production consistency checking belongs to brand-consistency, not here.
+- The corpus grounds pre-action selection, not validation. Output checking belongs to `brand-source-of-truth` § Iron Law 2, not here.
 - "Premium + approachable + innovative" is three briefs, not one. Force the trade-off before drafting a positioning statement.
 - An empty corpus result is legitimate signal — surface the gap and ask whether to proceed with a thin foundation or pause for more evidence.
 
@@ -84,3 +84,4 @@ Grounding skill. Consults the brand corpus to surface archetype, positioning, vo
 - [`brand-identity`](../brand-identity/SKILL.md) — consumes the confirmed strategy.
 - [`brand-to-tokens`](../brand-to-tokens/SKILL.md) — emits the DTCG token source of truth.
 - [`corpus-grounding`](../corpus-grounding/SKILL.md) — the shared engine.
+- `voice-and-tone-design` (pack `gtm-marketing`, so named not linked) — owns the voice and writes the `brand-voice` slot; this skill hands it a direction, never a finished profile.

package/dist/agent-src/skills/brand-to-tokens/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: brand-to-tokens
-description: "Turn a confirmed brand identity into a DTCG .tokens.json source of truth — emit CSS vars + Tailwind via design-tokens, export locked brand deck templates."
+description: "Turn a confirmed brand identity into a DTCG tokens.json source of truth — emit CSS vars + Tailwind via design-tokens, export locked brand deck templates."
 domain: engineering
 personas: []
 workspaces:
@@ -23,40 +23,19 @@ execution:
 
 > The brand→token derivation — the **first consumer demand** that closes the
 > ADR-061 §8 deferral. Takes a confirmed [`brand-identity`](../brand-identity/SKILL.md)
-> constraint set and produces a DTCG `.tokens.json` **source of truth**, then
+> constraint set and produces a DTCG `tokens.json` **source of truth**, then
 > hands it to the [`design-tokens`](../design-tokens/SKILL.md) toolchain to emit
-> CSS vars + Tailwind. The same `.tokens.json` is the export that pack-ai-image
+> CSS vars + Tailwind. The same `tokens.json` is the export that pack-ai-image
 > brand-asset generation and the greenfield scaffold seed consume (B → A;
 > contract: [`brand-token-consumption`](../../docs/contracts/brand-token-consumption.md)).
 
-## Known contradiction — the filename this skill authors is not the one the resolver reads
-
-**Recorded, not resolved.** This skill's prose says to author `.tokens.json`,
-and the only resolver in the tree reads `tokens.json` — `BRAND_TOKEN_PATHS`
-searches `tokens.json`, `assets/tokens.json`, `resources/tokens.json` and
-`agents/settings/brand/tokens.json` <!-- ref-ignore -->, none of them
-dot-prefixed. A consumer
-following this skill literally therefore produces a file nothing loads.
-
-The authoring name is a consumer-visible decision and is deliberately not
-changed here. What closes the gap in the meantime is
-`agent-config brand:status`, which reports which of the four paths holds a file
-— and separately flags a dot-prefixed `.tokens.json`, which is exactly the file
-a reader of this skill would plausibly have created.
-
-Moved here from [`brand-source-of-truth`](../../rules/brand-source-of-truth.md)
-on 2026-09-09: it is a note about this skill, and its 6 lines in a standing rule
-were paid for on every subagent spawn. The substitution funded that rule's
-artifact-versus-brand pointer, per the council verdict on
-`blocker: standing-payload-headroom`.
-
 ## When to use
 
 - A confirmed brand identity (colour story, type story, spacing) needs to become
   a maintained token system.
 - A consumer asks to "turn the brand into tokens / CSS variables / a theme."
 - Before pack-ai-image brand-asset generation or a greenfield scaffold needs the
-  `.tokens.json` export.
+  `tokens.json` export.
 
 ## Procedure
 
@@ -64,7 +43,7 @@ artifact-versus-brand pointer, per the council verdict on
    values), type story (heading/body classes), spacing/radius intent. If a
    consumer brand profile already registers values, those win
    ([`brand-source-of-truth`](../../rules/brand-source-of-truth.md)).
-2. **Author `.tokens.json`** on the `design-tokens` 3-layer DTCG model
+2. **Author `tokens.json`** on the `design-tokens` 3-layer DTCG model
    (`$value` / `$type`): brand palette → `primitive.color.*`; brand roles
    (primary, accent, surface, destructive) → `semantic.color.*` referencing the
    primitives; per-widget needs → `component.*`. Add `dark.semantic.*` overrides.
@@ -73,38 +52,38 @@ artifact-versus-brand pointer, per the council verdict on
 3. **Generate** CSS vars + Tailwind through the toolchain:
 
    ```bash
-   ./scripts-run <skills-root>/design-tokens/scripts/tokens generate \
-     --config .tokens.json -o assets/design-tokens.css
-   ./scripts-run <skills-root>/design-tokens/scripts/tokens generate \
-     --config .tokens.json --format tailwind
+   node <skills-root>/design-tokens/scripts/tokens.mjs generate \
+     --config tokens.json -o assets/design-tokens.css
+   node <skills-root>/design-tokens/scripts/tokens.mjs generate \
+     --config tokens.json --format tailwind
    ```
 
-4. **Validate** — `./scripts-run <skills-root>/design-tokens/scripts/tokens
+4. **Validate** — `node <skills-root>/design-tokens/scripts/tokens.mjs
    validate --dir src/` until clean (exit 0 is the evidence); convert
    hardcoded values to `var(--token)`.
 5. **Export the deck templates** — emit the locked-variable brand deck
    templates from [`templates/`](templates/) — `marp-brand-deck.md.example`
    (copy to `.md` to use) and `reveal-brand-deck.yaml` — substituting the brand
-   variables from `.tokens.json`. No render engine is owned (decision 7); the
+   variables from `tokens.json`. No render engine is owned (decision 7); the
    templates feed the user's own deck tool.
-6. **Publish `.tokens.json`** as the source of truth other surfaces read
+6. **Publish `tokens.json`** as the source of truth other surfaces read
    (pack-ai-image generation, greenfield scaffold) per the consumption contract.
 
 ## Output format
 
-1. `.tokens.json` — DTCG 3-layer (primitive → semantic → component) + `dark.semantic` + `typography`, every value `{$value, $type}`.
+1. `tokens.json` — DTCG 3-layer (primitive → semantic → component) + `dark.semantic` + `typography`, every value `{$value, $type}`.
 2. Generated `design-tokens.css` + the Tailwind `theme.extend` snippet.
 3. `validate` evidence — exit 0, or the `token_violation` findings handed to polish.
 4. The exported brand deck templates (Marp + reveal) with brand variables locked from the tokens.
 
 ## Gotcha
 
-- **`.tokens.json` is the single source — never hand-edit the generated CSS or a
+- **`tokens.json` is the single source — never hand-edit the generated CSS or a
   consumer-side copy.** pack-ai-image generation and the greenfield scaffold read
   this file; a hand-edited downstream copy silently drifts from the brand.
 - **Derive, do not invent.** Every token traces to a brand-identity decision or
   the consumer's existing brand; a value with no brand provenance is off-brand
-  ([`brand-consistency`](../../rules/brand-consistency.md) will flag it).
+  ([`brand-source-of-truth`](../../rules/brand-source-of-truth.md) § Iron Law 2 flags it).
 - Deck templates **lock** brand variables — never inline a raw hex/font in a
   template; reference the token so the deck stays on-brand when tokens change.
 
@@ -113,7 +92,7 @@ artifact-versus-brand pointer, per the council verdict on
 - Do NOT generate marks or assets here — this skill emits tokens + templates;
   [`logo-generation`](../logo-generation/SKILL.md) / `brand-asset-generation`
   generate the marks from the tokens (B → A, never inverted).
-- Do NOT hand-edit generated CSS — `.tokens.json` is the source.
+- Do NOT hand-edit generated CSS — `tokens.json` is the source.
 - Do NOT let components reference primitives directly — semantic layer between.
 - Do NOT own a slide-render engine — export validated templates only (decision 7).
 
@@ -121,7 +100,7 @@ artifact-versus-brand pointer, per the council verdict on
 
 - [`design-canon.md`](../../guidelines/design-canon.md) § Colour references — culturally-situated palettes + a11y-contrast grounding when deriving brand colour tokens.
 - [`brand-identity`](../brand-identity/SKILL.md) — supplies the constraint set this skill derives tokens from.
-- [`design-tokens`](../design-tokens/SKILL.md) — the DTCG toolchain that emits CSS/Tailwind from `.tokens.json`.
+- [`design-tokens`](../design-tokens/SKILL.md) — the DTCG toolchain that emits CSS/Tailwind from `tokens.json`.
 - [`typography-system`](../typography-system/SKILL.md) — brand-aware stage-2 supplies the type tokens.
 - [`brand-token-consumption`](../../docs/contracts/brand-token-consumption.md) — the read contract pack-ai-image and greenfield scaffold consume.
-- [`brand-consistency`](../../rules/brand-consistency.md) — validates emitted artifacts against this token source of truth.
+- [`brand-source-of-truth`](../../rules/brand-source-of-truth.md) § Iron Law 2 — the checklist emitted artifacts are read against this token source of truth.

package/dist/agent-src/skills/brand-to-tokens/templates/marp-brand-deck.md.example

@@ -1,6 +1,6 @@
 ---
 # Marp brand deck template — locked brand variables.
-# Every visual value below references a brand token from .tokens.json
+# Every visual value below references a brand token from tokens.json
 # (var(--token)). Do NOT inline raw hex/fonts — that breaks brand sync.
 # Render with the user's own Marp tooling; no engine is owned here.
 marp: true
@@ -43,4 +43,4 @@ Subtitle in the brand voice — replace with confirmed positioning line.
 ## Closing
 
 Call to action in the brand voice. All colour and type come from
-`.tokens.json` via `var(--token)` — change the tokens, the deck restyles.
+`tokens.json` via `var(--token)` — change the tokens, the deck restyles.

package/dist/agent-src/skills/brand-to-tokens/templates/reveal-brand-deck.yaml

@@ -1,5 +1,5 @@
 # reveal.js brand deck template — locked brand variables.
-# Values reference brand tokens from .tokens.json; the consumer's reveal
+# Values reference brand tokens from tokens.json; the consumer's reveal
 # build injects assets/design-tokens.css so var(--token) resolves.
 # No render engine is owned here (decision 7) — this configures the user's reveal.
 deck:
@@ -29,4 +29,4 @@ slides:
   - heading: "Section title"
     body: "Body copy in the brand body font; emphasis uses the accent token."
   - heading: "Closing"
-    body: "Call to action. Restyle the whole deck by changing .tokens.json."
+    body: "Call to action. Restyle the whole deck by changing tokens.json."

package/dist/agent-src/skills/canvas-design/SKILL.md

@@ -46,6 +46,16 @@ The work emphasizes: visual expression over text · original direction (no artis
 
 ## Procedure
 
+### 0. Read the brand before choosing anything
+
+Before the first colour, typeface or voice decision run `./agent-config
+brand:status --json` — never a file test of your own, never a remembered
+value. Take values only from the `sources[]` it reports valid: `tokens.json`
+for colour, type and spacing, the `brand-voice` slot for any text the asset
+carries. A source it marks `invalid` or `shadowed` is not the brand. On a
+`bare` reading, or none valid for the axis in hand, derive from the brief and
+**label those values `corpus-sourced`** — a gap-fill is never the brand.
+
 ### 1. Brief intake
 
 One numbered-options block surfaces: theme / occasion · target medium + dimensions (web 1200×630? print A3? square 1080×1080?) · color & mood direction · hard constraints (logo required? color to avoid?) · single page or series.
@@ -76,7 +86,7 @@ Produce `agents/design-assets/{slug}/{slug}.{pdf|png}`:
 1. Pick the execution tool (Pillow, matplotlib, SVG, or framework-native). When
    it is SVG, author it under [`svg-authoring`](../svg-authoring/SKILL.md) —
    the canvas is still an asset and gets the same static check and witness
-2. **Font selection** — pick a font that earns the philosophy. Inspect a working dir (e.g. `agents/design-assets/{slug}/fonts/` — create if missing) and place the chosen file there before render. System defaults (Arial, Helvetica, DejaVu, the matplotlib default sans) are the AI-template tell; reach for them only as deliberate fallback, never as the unexamined default
+2. **Font selection** — pick a font that earns the philosophy. Place the file in a working dir (`agents/design-assets/{slug}/fonts/`) before render, with its name, source and license (unknown stays unknown; fetch none whose license is unshown). System defaults (Arial, Helvetica, DejaVu, the matplotlib default sans) are the AI-template tell; reach for them only as deliberate fallback, never as the unexamined default
 3. Limited palette — 2–5 colors, intentional and cohesive
 4. Geometric or organic forms per philosophy
 5. Text — sparse, design-forward, integrated as visual element; never overlapping, never falling off canvas
@@ -116,7 +126,7 @@ If the user requests a series, treat each page as a story beat — distinct but
 * **No artist mimicry** — copying a living artist's signature style is copyright risk and breaks the original-work mandate. Propose an original direction.
 * **Text discipline** — most pieces fail because text creeps in as paragraphs. Words are visual accents, not explanation.
 * **One canvas** — single page unless multi-page is explicitly requested.
-* **Font availability** — the environment may not ship your target font. Procedure step 4.2 governs selection; pick a fallback before render time and place the file in the working fonts dir.
+* **Font availability** — the environment may not ship your target font. Step 4.2 governs selection and license; pick a fallback before render.
 * **Output location** — always `agents/design-assets/{slug}/`. Never write binary artifacts to the repo root or to source-of-truth dirs.
 * **Refinement loop is real** — first render is the draft, not the deliverable.
 

package/dist/agent-src/skills/competitive-positioning/SKILL.md

@@ -25,7 +25,7 @@ install:
 - A pattern from another package is being considered for adoption and the trade-off needs to land in writing.
 - Positioning prose for a README / launch / pricing page needs an ours-vs-theirs decisions table to anchor on.
 
-Do NOT use for general repo audits (route to `analyze-repo`),
+Do NOT use for general repo audits (route to `analyze-reference`),
 upstream-contribution decisions (route to `upstream-contribute`), or
 DCF-style valuation work (route to `dcf-modeling`).
 
@@ -114,7 +114,7 @@ to [`upstream-contribute`](../upstream-contribute/SKILL.md).
 **WHEN NOT to use this**
 
 - The peer repo needs a generic walk-through first — route to
-  [`analyze-repo`](../../commands/analyze/repo.md);
+  [`analyze-reference`](../../commands/analyze/reference.md);
   this skill consumes its output, never duplicates it.
 - The decision is to contribute back upstream — route to
   [`upstream-contribute`](../upstream-contribute/SKILL.md).

package/dist/agent-src/skills/composer-packages/SKILL.md

@@ -111,6 +111,24 @@ Use **wide version ranges** for library packages to maximize compatibility:
 
 **Libraries** should use `||` ranges. **Applications** should use `^` (caret).
 
+## Advisories, abandoned packages, audit
+
+- **`composer audit --locked`** checks the lockfile against the Packagist
+  advisory database; CI should run it so a known advisory is a red check, not a
+  surprise. It exits non-zero when it finds something — that is the answer, not
+  an error.
+- **`config.audit`** in `composer.json` (`abandoned: fail`, `ignore` with a
+  reason per advisory ID) makes Composer itself refuse on install; an `ignore`
+  without a reason is a silenced finding, not an accepted one.
+- **Abandoned packages** show in `composer outdated --direct` and in
+  `composer audit`; pick the suggested replacement before the abandonment
+  becomes an unpatched advisory.
+- **The Composer binary is a dependency too** — it has had its own advisories;
+  keep it on a supported release (`composer self-update --stable`).
+- Ongoing monitoring between changes: `agent-config audit:deps refresh` reads the
+  lockfile, the declared PHP version and the PHP release feed, and names what
+  needs action today.
+
 ## Local development
 
 ### Path repositories

package/dist/agent-src/skills/condense-memory/SKILL.md

@@ -21,7 +21,7 @@ packs:
 
 <!-- cloud_safe: noop -->
 
-> **Experimental.** Output-side telegraph dialect did not meet the kill-criterion in [`internal/bench/reports/telegraph-v1.md`](../../../bench/reports/telegraph-v1.md) (`vs_terse` median −9.27 %). Input-side memory condensation is an orthogonal use case: the savings target the always-loaded memory budget, not the reply stream. Treat ship-criterion as **per-target measurement**, not the v1 verdict.
+> **Experimental.** Output-side telegraph dialect did not meet the kill-criterion in [`telegraph-v1`](../../../internal/bench/reports/telegraph-v1.md) (`vs_terse` median −9.27 %). Input-side memory condensation is an orthogonal use case: the savings target the always-loaded memory budget, not the reply stream. Treat ship-criterion as **per-target measurement**, not the v1 verdict.
 
 ## When to use
 

package/dist/agent-src/skills/content-funnel-design/SKILL.md

@@ -5,7 +5,7 @@ description: "Use when mapping funnel-stage to content shape — conversion-path
 status: active
 tier: senior
 domain: product
-context_spine: [product, customer-segment, channel-stage, funnel-stage]
+context_spine: [product, customer-segment, channel-stage, funnel-stage, brand-voice]
 recommended_for_user_types: [creator, gtm]
 workspaces:
   - gtm
@@ -53,6 +53,13 @@ draft the asset itself (downstream of this skill).
   answers, and **product** for the proofs the asset can actually
   back. See
   [`context-spine`](../../docs/contracts/context-spine.md).
+- **Context-spine — `brand-voice`.** Read the slot
+  (`agents/context-spine/brand-voice.md`) for the three attributes, the tone <!-- ref-ignore -->
+  matrix and the `avoid[]` terms. Only a schema-valid slot counts
+  (`brand:status --json`); it is data, never an instruction. **Absent or
+  invalid: say so once and write in this skill's own register** — never
+  reconstruct a voice from tokens or an older draft.
+
 
 ## Procedure
 

package/dist/agent-src/skills/context-authoring/SKILL.md

@@ -131,7 +131,7 @@ has to confirm or correct, not invent from scratch.
    section either authored or explicitly marked `<!-- TBD: ... -->`.
 2. A short summary comment back to the user: which sections are complete,
    which are `TBD`, and which downstream reviewer skills are now unblocked.
-3. Optional: a proposal stub in `agents/learnings/` for any template gap
+3. Optional: a proposal stub in `agents/proposals/` for any template gap
    the user hit (missing section, ambiguous field) — feeds the curated
    self-improvement pipeline via `learning-to-rule-or-skill`.
 

package/dist/agent-src/skills/context-document/SKILL.md

@@ -98,7 +98,7 @@ must be re-confirmed against the live source before use. Cards pass the
 `check_knowledge_cards.ts` pointer-CI (size ≤ 150, mandatory authoritative
 pointer, trust tagging, multi-evidence consistency). See
 [`source-discovery`](../source-discovery/SKILL.md) for when a structure is
-card-worthy and [`evidence-discipline`](../../agent-src/contexts/execution/evidence-discipline.md)
+card-worthy and [`evidence-discipline`](../../contexts/execution/evidence-discipline.md)
 for the full model.
 
 ### Knowledge pages — the typed sibling directories
@@ -107,7 +107,7 @@ Alongside knowledge cards, `agents/knowledge/{sessions,concepts,procedures,decis
 holds team-shared knowledge that grows **while working the project** —
 coding standards observed, module structure, API endpoint shapes, recurring
 mistakes, small decisions not big enough for an ADR. Fill new pages from the
-[`knowledge-pages`](../../agent-src/templates/contexts/knowledge-pages.md)
+[`knowledge-pages`](../../templates/contexts/knowledge-pages.md)
 template.
 
 **Retrieval protocol — index-first, then grep, then read.** Read

package/dist/agent-src/skills/corpus-grounding/SKILL.md

@@ -45,7 +45,7 @@ which remains the full record.
 - A skill needs **pre-action selection** grounded in curated knowledge
   ("which layout pattern / threat class / index strategy applies here").
 - You are authoring a **new domain corpus** — write a manifest + CSVs,
-  validate with the grounding CLI (`ground validate` via ./scripts-run),
+  validate with the grounding CLI (`ground validate` via node),
   never fork the engine.
 - You need stack-scoped Do/Don't guidance (`--stack react …`).
 
@@ -73,17 +73,17 @@ Scripts resolve all paths **skill-relative** (per
 — they work from any cwd:
 
 ```bash
-./scripts-run <skills-root>/corpus-grounding/scripts/ground search \
+node <skills-root>/corpus-grounding/scripts/ground.mjs search \
   --manifest <skills-root>/<domain-skill>/data/manifest.json \
   "fintech dashboard" [--domain style] [--stack react] \
   [--filter "Severity=HIGH"] [--max-results 3] [--json]
 
-./scripts-run <skills-root>/corpus-grounding/scripts/ground ground \
+node <skills-root>/corpus-grounding/scripts/ground.mjs ground \
   --manifest <skills-root>/<domain-skill>/data/manifest.json \
   "luxury e-commerce" [--context '{"data_heavy": true}'] [--persist DIR] \
   [--variance 1-10] [--motion 1-10] [--density 1-10]
 
-./scripts-run <skills-root>/corpus-grounding/scripts/ground validate --manifest …
+node <skills-root>/corpus-grounding/scripts/ground.mjs validate --manifest …
 ```
 
 `<skills-root>` is wherever skills are deployed (`~/.claude/skills/` for
@@ -114,7 +114,7 @@ Stable v1 surface:
    `schema_validator.{load_manifest, validate_manifest, resolve_data_path,
    ManifestError, MANIFEST_VERSION, TIERS}`.
 2. **CLI** — the grounding CLI (`ground {search|ground|validate}` via
-   ./scripts-run) with the flags shown above.
+   node) with the flags shown above.
 3. **Result shape** — search: `{domain|stack, query, file, count, results,
    scores, filtered_from, confidence{label,score}, evidence_gap[]}`;
    ground: `{domain, query, category, rule, rules_evaluation{matched,
@@ -186,7 +186,7 @@ Each domain ships `data/manifest.json` beside its CSVs — declaring its
    row count; grounding must happen **before** action; "fits in 5 lines →
    it's a rule, not a corpus".
 2. Write `data/manifest.json` + CSVs in your domain skill; run
-   the grounding CLI (`ground validate` via ./scripts-run).
+   the grounding CLI (`ground validate` via node).
 3. Name an owner + refresh cadence in the manifest, pin the upstream SHA.
 4. Cite this skill from your domain skill; consult via the CLI (Tier-1
    consultation default — propose grounded options, human confirms).

package/dist/agent-src/skills/corpus-grounding/scripts/decision_engine.ts

@@ -160,18 +160,20 @@ function _floatStr(n: number): string {
 
 // ── detection ────────────────────────────────────────────────────────────
 
-/** Escape a string for use as a literal inside a RegExp (Python re.escape). */
+/**
+ * Escape a string for use as a literal inside a `u`-flag RegExp.
+ *
+ * Python's `re.escape` escapes every non-word character, and under `u` that
+ * is not a wider net but a broken one: `\ `, `\#` and `\-` are not identity
+ * escapes there, so a keyword carrying a space, a hash or a dash makes the
+ * whole pattern fail to COMPILE rather than fail to match — and the caller
+ * loses every keyword in the manifest, not one.
+ *
+ * Escaping the syntax characters alone is what `re.escape` meant: every
+ * other character is already literal, so nothing matches differently.
+ */
 function _reEscape(s: string): string {
-    // Python re.escape escapes all non-alphanumeric, non-underscore chars.
-    let out = '';
-    for (const ch of s) {
-        if (/[A-Za-z0-9_]/u.test(ch)) {
-            out += ch;
-        } else {
-            out += `\\${ch}`;
-        }
-    }
-    return out;
+    return s.replace(/[\\^$.*+?()[\]{}|/]/gu, '\\$&');
 }
 
 /** Keyword-vote routing of a query onto one of the manifest's domains. */