@event4u/agent-config 16.5.0 → 17.0.0

package/src/config/agent-settings.template.yml

@@ -1,5 +1,5 @@
 # Agent Settings
-# This file is generated by scripts/install.py from
+# This file is generated by src/scripts/install.ts from
 # config/agent-settings.template.yml. It holds personal and project-wide
 # preferences. Run /onboard for first-run setup; for later edits, change
 # values here directly or ask the agent (it follows the merge rules in
@@ -59,30 +59,16 @@ profile:
 # project the full set.
 projection:
   mode: scoped
-  # --- Consumer-scoped RULE projection (road-to-request-scoped-rule-load P1,
-  #     opt-in) ---
-  # Workspace scope for the RULE layer only (independent of `mode` above,
-  # which covers skills/commands). Absent or empty = legacy-all: every rule
-  # projects, exactly as today. Non-empty = only rules whose `workspaces:`
-  # frontmatter intersects this list project into .claude/rules,
-  # .cursor/rules, .windsurf/rules, .clinerules and .windsurfrules. Kernel
-  # rules ALWAYS project (unconditional by definition); untagged rules fail
-  # safe and ship. Example consumer scope:
-  #   rule_workspaces: [engineering]
-  # DEFAULT FLIPPED 2026-07-13 (the Phase-1 human gate, maintainer-approved,
-  # evidence-gated): the default below lists EVERY consumer workspace, so
-  # exactly the exclusively-maintainer specification rules drop from consumer
-  # installs (the audited 16-rule lever — see
-  # agents/settings/contexts/consumer-scoping-audit-2026-07-07.md) while all
-  # domain safety floors and domain rules keep shipping. Narrowing further
-  # (e.g. [engineering] only) stays a per-install user choice.
-  # An EMPTY list is inactive (= legacy-all); only a non-empty list scopes.
-  rule_workspaces: [engineering, product, finance, founder, gtm, ops, small-business, construction, legal-review-prep]
+  # Rule scope is DERIVED, not configured, since ADR-293 step 4.6: a consumer
+  # install scopes rules to every workspace `src/config/discovery/packs.yml`
+  # declares except `agent-config-maintainer`, so maintainer-only rules never
+  # project to a consumer and a new pack reaches consumers the day it lands.
+  # The `projection.rule_workspaces` key that carried this list is removed.
   #
   # Optional second axis, same semantics per pack ids (packs.yml). When set,
   # a non-kernel rule also needs a `packs:` intersection to project — e.g.
   # deselecting `frontend-design` removes ui-audit-gate + design-fidelity.
-  # Empty = inactive, same as rule_workspaces.
+  # Empty = inactive.
   #
   # `rule_packs: auto` derives the id list from the ACTIVE-PACK set — the same
   # set the skill/command prune uses — instead of hand-typing ids that would
@@ -180,40 +166,6 @@ discipline_profile: __DISCIPLINE_PROFILE__
 # custom   = ignore profile — every matrix value must be set explicitly.
 rule_loading_tier: __RULE_LOADING_TIER__
 
-# --- Lean projection ---
-#
-# How the per-tool projector emits the rule layer. See
-# docs/contracts/rule-router.md § Kill-switch.
-#
-# eager-all = every rule body inlined into every projection. Safe — bodies
-#             are always in context. What every host outside `hosts` below
-#             receives, regardless of `mode`.
-# thin      = kernel rules full-bodied + non-kernel rules as
-#             router-resolved pointers (the agent loads the body on
-#             trigger-match). Measured ~45k GPT-tok lighter per session
-#             (77% of the rule layer). EXPERIMENTAL: a thin projection
-#             only holds behaviour if the pointer is resolved on match —
-#             validate with `task bench:ab:live` before flipping, and
-#             keep `task trigger-coverage` at 100%. One-flip revert:
-#             set eager-all + `task generate-tools`.
-# delivery  = the `thin` projection PLUS the `rule-inject` hook concern, which
-#             delivers a rule body back on trigger match. SHIPPED DEFAULT for
-#             Claude Code since ADR-267. Measured over the frozen routing-matrix
-#             corpus: 616/616 byte-equal deliveries, 101/101 labelled rules
-#             reachable, 0 of 212 near-misses fired. Rollback is this one
-#             setting: `mode: eager-all` + `task generate-tools`.
-#
-# `hosts` scopes WHICH hosts are thinned. Every host outside the list receives
-# exactly what `eager-all` writes, asserted byte-for-byte in CI by
-# `check_host_tree_parity`. The default has one member because Claude Code is
-# the only host that both binds the concern's slots and acts on its verdict
-# (docs/enforcement-by-host.md); thinning a host with no bound slot would remove
-# a body and put nothing in its place. Only `claude-code`, `cursor` and `cline`
-# are thinnable at all - any other id is dropped with a warning.
-lean_projection:
-  mode: delivery
-  hosts: [claude-code]
-
 # --- Cost tracking + budget enforcement ---
 #
 # USD budgets evaluated against `agents/cost-tracking/sessions.jsonl` by
@@ -931,8 +883,11 @@ subagents:
   model_ceiling: ""
 
   # Maximum number of parallel subagent invocations
-  # Integer, default 3. Set to 1 to serialize. A limit the model reads
-  # from settings — no code counts spawns against it.
+  # Integer, default 3. Set to 1 to serialize. On Claude Code the installer
+  # writes it into CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS, the host cap on
+  # concurrent new spawns. It does NOT bound a resumed worker: on Claude Code
+  # 2.1.306 a resume was admitted past a cap of 1, so a resume is neither
+  # bounded by the host nor counted by any package code yet.
   max_parallel: 3
 
   # Opt-in adversarial-verification-council (subagent-orchestration Mode 9,
@@ -966,6 +921,27 @@ subagents:
 #
 # The Iron-Law gates on creation (ignore-safety check, clean baseline) are
 # unchanged and still run on every explicitly-requested worktree.
+#
+# Removal is a different question, and it has a setting. What the agent may do
+# about a worktree whose work is provably on the trunk — merged (merge commit,
+# rebase or squash), clean, holding no ignored file a rebuild would not restore,
+# and with no live session in it:
+#
+#   notify  say once a day how many such worktrees exist; remove nothing
+#           (the default, and what an absent key resolves to)
+#   auto    remove them: right after `/pr:merge`, and once a day on the first
+#           session start (classification within three seconds, then at
+#           most three removals, each re-checked within three seconds and
+#           given up to 30 s; `git worktree remove` without force, local
+#           branches always kept, one journal line per removal)
+#   off     say nothing, remove nothing
+#
+# The daily pass asks GitHub, through your own gh login, which pull requests
+# merged (branch name and head commit only) — that is how a squash merge is
+# recognised. `auto` deletes directories; that is why it is yours to turn on
+# (ADR-295).
+worktrees:
+  cleanup: notify
 
 # --- AI Council (external second-opinion network) ---
 #
@@ -1169,6 +1145,19 @@ continuity:
   #   off = no checkpoint; every other session-end handler is unaffected.
   run_checkpoints: "on"
 
+# Automatic retro after merged work (ADR-292, docs/contracts/retro-v1.md).
+retro:
+  # On by default by the owner's directive of 2026-10-12. A merged pull request
+  # and the first session of a new local day enqueue finished work; a
+  # deterministic triage picks what is worth one learning, and nothing that
+  # changes behavior is applied without a person. The one network read is the
+  # daily probe asking GitHub, through your own gh login, whether a pushed PR
+  # merged (repository and PR number only, three-second budget).
+  #   true  = (default) the automatic paths run.
+  #   false = no automatic path runs; an explicit /retro still runs on request.
+  # Set false in the user-global settings file to switch it off in every project that does not set its own value.
+  enabled: true
+
 # --- Memory ---
 #
 # Engineering memory consolidation behaviour. Memory is entirely
@@ -1257,6 +1246,24 @@ knowledge:
     # global card older than 90 days is lead-only and older than 180 days is
     # skipped until re-verified.
 
+# --- Egress placeholders ---
+#
+# The dispatcher's egress stage (docs/contracts/egress-placeholders-v1.md).
+# Project layers only — a user-global value is not merged.
+#   off      (default) — the stage does nothing.
+#   observe  detects and counts listed values in prompts and tool bodies into
+#            agents/runtime/state/egress-observations.jsonl (types and counts,
+#            never a value) and changes nothing any hook concern sees.
+#   protect  also hands every recording and advisory concern a copy with each
+#            value replaced by a placeholder token, so local stores such as
+#            chat history keep tokens. Guards still see the original.
+#   strict   behaves as protect until the host rewrite exists.
+# No mode yet changes what reaches the model. The rule table holds credential
+# rules only. AGENT_CONFIG_NO_EGRESS_STAGE=1 turns the stage off regardless.
+egress:
+  placeholders:
+    mode: "off"
+
 # --- Hooks ---
 #
 # Configuration surface for the hook dispatcher (see
@@ -1511,6 +1518,62 @@ decision_engine:
 update_check:
   enabled: true
 
+# --- Security advisories ---
+#
+# Advisories, malware reports, end-of-support dates and pre-announced security
+# releases for what THIS project runs (lockfiles, runtimes, images, CI actions).
+#
+# mode:
+#   notify  (default) the first session start of a day prints one line per
+#           finding that needs action today, read from the local cache only —
+#           a session start never touches the network
+#   off     print nothing; `agent-config audit:deps show` still works
+#
+# egress — what leaves the machine when `agent-config audit:deps refresh` runs:
+#   query   (default) names and versions of PUBLIC packages go to api.osv.dev;
+#           runtime lifecycle data comes from endoflife.date; the PHP and Node
+#           release feeds are read. A private package name is never sent, and a
+#           native `npm audit` / `composer audit` — which sends the lockfile's
+#           package list to the registry that tool is configured for — runs only
+#           for a lockfile with no private package in it
+#   none    nothing is sent; findings read `unknown`, never "clear"
+#
+# kev — the CISA catalog of known-exploited vulnerabilities, downloaded whole on
+# a refresh and matched locally, so nothing about this project is sent:
+#   on      (default) a finding in the catalog is "known exploited" and is
+#           raised one tier in a runtime scope (a high one to T0)
+#   off     the catalog is not read; tiers come from the other sources alone
+advisories:
+  mode: notify
+  egress: query
+  kev: on
+
+# --- Update install mode ---
+#
+# What the agent may DO about a newer release, as opposed to whether it
+# notices one (that is `update_check.enabled` above).
+#
+#   notify  tell me; never install        (the default, and what an absent
+#                                          key resolves to)
+#   ask     tell me and offer to install  (behaves as `notify` until the
+#                                          ring-0 exit of
+#                                          road-to-an-update-that-installs-itself-only-when-it-is-safe
+#                                          step 4.2; no prompt ships yet)
+#   auto    install a staged release at a session start, when every gate
+#           passes and no other session is live on this machine
+#   off     say nothing at all
+#
+# `auto` never moves a project's `agent_config_version` pin, never writes into
+# a repository, and never swaps the install while a session is running: a
+# candidate is staged on one session start and installed at a LATER one. A
+# release that needs consumer action is never installed unattended whatever
+# this says.
+#
+# Read from the USER-GLOBAL layer only. A repository cannot set it — the thing
+# being updated is your global install, not that project's.
+update:
+  mode: notify
+
 # ─── legal-review-prep consent gate ──────────────────────────────────────────
 # The legal-review-prep pack is high-risk (EU/DE legal review-prep, NOT legal
 # advice). It stays inactive until you acknowledge it is not legal advice — set

package/src/config/agents-paths.yml

@@ -21,7 +21,7 @@
 - path: .agent-settings.yml
   scope: both
   policy: ignored
-  writer: installer (scripts/install.py)
+  writer: installer (src/scripts/install.ts)
   rationale: Per-user active settings; contains local-path secrets
 
 - path: .agent-settings
@@ -133,27 +133,33 @@
 # Ghostwriter profiles
 # ---------------------------------------------------------------------------
 
-- path: /agents/ghostwriter/*.md
+- path: /agents/reference/ghostwriter/**
   scope: both
   policy: ignored
   writer: /ghostwriter:fetch skill
-  rationale: Real-person voice profiles; local-only by default; shared opt-in deferred
+  rationale: Real-person voice profiles at the path every ghostwriter command writes; nested files and .md.bak copies included; local-only by default; shared opt-in deferred
   comment: |
     # Agent config — ghostwriter profiles (real-person public-figure voices).
     # Local-only by default; commit explicitly only via the deferred --shared opt-in.
     # See docs/contracts/ghostwriter-schema.md.
 
-- path: "!/agents/ghostwriter/README.md"
+- path: "!/agents/reference/ghostwriter/README.md"
   scope: both
   policy: carve-out
   writer: maintainer
   rationale: README is tracked and ships with the package
 
-- path: /agents/ghostwriter/*.md.bak
+- path: /agents/ghostwriter/**
   scope: both
   policy: ignored
-  writer: /ghostwriter:fetch skill (backup)
-  rationale: Safety backup during profile updates
+  writer: /ghostwriter:fetch skill (legacy path)
+  rationale: Legacy profile path; kept ignored so profiles written before the move stay local-only
+
+- path: "!/agents/ghostwriter/README.md"
+  scope: both
+  policy: carve-out
+  writer: maintainer
+  rationale: README is tracked and ships with the package
 
 # ---------------------------------------------------------------------------
 # Chat history (legacy path; current installs use agents/runtime/)

package/src/config/ci-local-parity.yml

@@ -135,6 +135,19 @@ ci_only:
   # state cannot decide the answer.
   #
   # Reachable on demand: `./scripts-run src/scripts/check_static_parity`.
+  # road-to-macos-where-the-platform-is-the-point 1.3. Decides which OSes the
+  # macOS-sensitive tests.yml legs run on from the PR's diff against its base;
+  # outside a pull request there is no base and no decision to make. Unit-tested
+  # (tests/scripts/ci_platform_scope.test.ts) and reachable on demand:
+  # `./scripts-run src/scripts/ci_platform_scope --base origin/main`.
+  - id: ci_platform_scope
+    class: matrix
+    reason: "chooses the tests.yml OS matrix for a pull request from its diff; it has no verdict to give a working tree and nothing to gate locally"
+  # road-to-ci-time-that-counts-the-queue 3.1. Reads a week of the Actions API;
+  # reachable on demand: `./scripts-run src/scripts/ci_time_to_green --days 7`.
+  - id: ci_time_to_green
+    class: network
+    reason: "reads the GitHub Actions runs and jobs API for a time window; offline it has nothing to measure, and it reports rather than gates"
   - id: check_static_parity
     class: benchmark
     reason: "two full runs of the dispatcher-reaching suite, compared per-test verdict by verdict, ~1 minute; a per-change local gate cannot afford it and its answer is a property of a clean checkout rather than of a working tree"
@@ -292,9 +305,40 @@ ci_only:
       comparison logic itself is covered hermetically by
       `tests/scripts/host_docs_digest.test.ts`.
 
+  # road-to-local-gates-wired-while-they-are-green step 2.3. Until this change
+  # `check_council_pin_staleness` appeared in NO task and NO workflow, while
+  # `src/config/gate-coverage.yml` marked it `enforced` — a gate nothing ran,
+  # recorded as enforced. Giving it the scheduled caller it needed is what made
+  # it visible to this checker from the CI side for the first time, which is
+  # the same way `check_roadmap_pre_commit` surfaced above.
+  #
+  # Declared rather than wired into `task ci`, and the reason is the one the
+  # 2026-08-13 decision asks for — structural, not convenience. Its verdict is a
+  # function of the DATE: it reads three dated council pins against a 100-day
+  # cadence, so on a calendar boundary it turns red with no diff at all. In
+  # `task ci` that is a local run going red for something no contributor
+  # caused, which trains people to ignore the aggregate. The same reasoning put
+  # the thirteen `calendar`-class gates on a schedule instead of a required job.
+  #
+  # This declaration does NOT move the local-only count: `ci_only:` is the
+  # other direction. The constraint against "growing the declaration list to
+  # move a number" is about `local_only:` below, and nothing here touches it.
+  #
+  # Reachable on demand: `./scripts-run src/scripts/check_council_pin_staleness`.
+  - id: check_council_pin_staleness
+    class: calendar-scoped
+    reason: >
+      Its verdict is a function of the date — three dated council pins against a
+      100-day cadence — so wiring it into `task ci` would turn a local run red on a
+      calendar boundary with no diff, the failure mode that trains contributors to
+      ignore the aggregate. It runs in the scheduled, non-required workflow instead,
+      where an age-based red is the signal rather than a blocker, and it stays
+      reachable on demand.
+
 # Gates a local chain runs that no workflow does — each needs a reason it is not
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer
 # adding it: a local-only gate is the direction that let real defects merge.
+
 local_only:
   - id: check_platform_anchor
     class: token-scope-unavailable

package/src/config/continuity-surface.json

@@ -127,6 +127,34 @@
             "locus": "src/scripts/_cli/cmd_analyze_session.ts:15",
             "reason": "Tool-call count and freshness milestones for the context-hygiene carrier; never read by a successor."
         },
+        {
+            "id": "free-hand-shadow.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/ai_council/free_hand_shadow.ts:37",
+            "reason": "One row per shadowed hand call: routes, verify verdicts and token counts, never a prompt or an answer. Measurement data for the free-hands claims; nothing resumes from it."
+        },
+        {
+            "id": "hand-kind-flips.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/ai_council/kind_flip.ts:36",
+            "reason": "Which hand kinds the shadow bars moved to a free route, and every flip and reversion with the line a claim row cites. Routing state read on each ask; no session resumes from it."
+        },
+        {
+            "id": "hand-exposure.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/ai_council/exposure_ledger.ts:21",
+            "reason": "Digests of the project files and symbols each hand route has been sent. Provider exposure accounting; no session resumes from it."
+        },
+        {
+            "id": "canary-liveness.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/canary_status.ts:14",
+            "reason": "The cross-model canary's red streak and status line, refolded from the workflow's scheduled runs on every refresh. CI state; nothing resumes from it."
+        },
         {
             "id": "council-probes.json",
             "axis": "persistent_continuity_artefacts",
@@ -134,6 +162,20 @@
             "locus": "src/scripts/ai_council/probe_store.ts:52",
             "reason": "Council seat availability probe cache. Provider state."
         },
+        {
+            "id": "council-route-liveness.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/ai_council/route_liveness.ts:39",
+            "reason": "Per route and model, the streak of unservable answers and when a model was retired from the roster. Provider state; nothing resumes from it."
+        },
+        {
+            "id": "council-route-models.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/ai_council/free_route_catalog.ts:80",
+            "reason": "Model ids a base_url route served at its last discovery. Provider state, cleared on a failed probe; nothing resumes from it."
+        },
         {
             "id": "decisions",
             "axis": "persistent_continuity_artefacts",
@@ -327,8 +369,8 @@
             "id": "run-continuation.jsonl",
             "axis": "persistent_continuity_artefacts",
             "disposition": "excluded",
-            "locus": "src/scripts/hooks/run_continuation_hook.ts:41",
-            "reason": "An append-only event ledger for the stop-slot continuation gate. It records what the gate decided, and nothing reads it to restore a session."
+            "locus": "src/scripts/interruption_report.ts:233",
+            "reason": "An append-only event ledger of a stop-slot continuation gate that NO LONGER EXISTS. The concern was withdrawn on its own pre-registered kill date (road-to-what-was-built-and-never-ran Phase 4), so nothing writes this file any more; the kill criterion kept the observation record, and `interruption_report` still reads it for the autonomy axis. The row stays because a source still names the leaf, which is what this inventory is keyed on."
         },
         {
             "id": "session-eol",
@@ -407,6 +449,13 @@
             "locus": "src/scripts/_lib/test_red_state.ts:2",
             "reason": "Last test-run red state. No production code currently writes or reads it — only this module's own unit test exercises the store; the registry row for this instrument (assurance-capability-registry.json, test-red-evidence) was corrected to degraded on 2026-10-06 for the same reason."
         },
+        {
+            "id": "egress-observations.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/egress_stage.ts",
+            "reason": "Egress-stage counts by field, class and type, one fixed-field line per scanned dispatch. Measurement output, written only while `egress.placeholders.mode` is not `off`; it holds no value and is read by no successor session."
+        },
         {
             "id": "tool-result-census.jsonl",
             "axis": "persistent_continuity_artefacts",

package/src/config/depth-audit-samples.json

@@ -0,0 +1,5 @@
+{
+    "_comment": "Full-depth audits of steps that ran at a lowered depth (road-to-a-step-that-costs-what-it-changes 4.3). Append one row per audited step: `step` is `<roadmap file>#<step id>`, `escaped` is true when the full round-1 review found a high or critical row the lowered depth skipped, `critical` when one of them was critical. Which steps are audited is decided by `sampledForAudit` in src/scripts/_lib/depth_flip.ts. `rolledBackClasses` reads the latest `requires.min_steps` rows per class against the depth table's `flip.requires`; a class past the threshold returns to full depth in `step_receipt`. These agent-run audits do not feed a human-labelled corpus.",
+    "schema_version": 1,
+    "samples": []
+}

package/src/config/discovery/command-verbs.yml

@@ -44,6 +44,7 @@ approved_verbs:
   - mode
   - optimize
   - roadmap
+  - retro      # /retro — examine finished work (ADR-292, addendum to ADR-041 § 5)
 
 # Leading tokens banned for NEW visible commands regardless of the allowlist.
 banned_prefixes:

package/src/config/dispatch-economy-metrics.json

@@ -42,6 +42,7 @@
         "ask_economy": {
             "definition": "Rung-0.5 substitution and adoption (roadmap Phase 4.4): substitution = ask-routed lines / (ask-routed + rung-1 spawn lines); adoption = ask lines with dispatch_outcome DONE / all ask lines; escalation = the caller's follow-up SPAWN lines carrying route_taken=subagent + escalated=true + origin=dispatch-economy-2026 (the ask line itself cannot know it was insufficient).",
             "source": "Audit-log orchestration lines with route_taken='ask' (written by src/scripts/ask_transport.ts, origin tag dispatch-economy-2026).",
+            "billing_axis": "Added 2026-10-22 (road-to-free-hands-a-paid-head-checks 6.1): every count is also split by the line's route_billing class (a line without one reads as undeclared). paid_tokens_avoided = dispatch_tokens of ask lines served by an unpaid class (free-quota, self-hosted); head_verify_tokens = the verify_tokens those lines carry; net_paid_tokens_avoided = the difference, null when no unpaid route served an ask. Read by claims free-hands-limit-relief and free-hands-quality-held in docs/CLAIMS.md; the escalation_kill below is unchanged.",
             "thresholds": {
                 "escalation_kill": 0.3,
                 "_kill": "if more than 30% of asks over the review window are re-asked or escalated to spawns, the rung's signals tighten or the rung dies — by evidence, in a PR (roadmap 4.4)"

package/src/config/egress-mutations/class-precedence-swapped.json

@@ -0,0 +1,7 @@
+{
+    "mutation": "class-precedence-swapped",
+    "module": "src/scripts/_lib/egress_rules.ts",
+    "find": "const CLASS_RANK: Readonly<Record<EgressClass, number>> = {\n    credential: 1,\n    identifier: 0,\n};",
+    "replace": "const CLASS_RANK: Readonly<Record<EgressClass, number>> = {\n    credential: 0,\n    identifier: 1,\n};",
+    "killed_by": "credential-outranks-identifier"
+}

package/src/config/egress-mutations/credential-token-restores.json

@@ -0,0 +1,7 @@
+{
+    "mutation": "credential-token-restores",
+    "module": "src/scripts/_lib/egress_token.ts",
+    "find": "this.byToken.set(token, { entry, value: cls === 'identifier' ? spelling : null });",
+    "replace": "this.byToken.set(token, { entry, value: spelling });",
+    "killed_by": "credential-token-never-restores"
+}

package/src/config/egress-mutations/iban-checksum-disabled.json

@@ -0,0 +1,7 @@
+{
+    "mutation": "iban-checksum-disabled",
+    "module": "src/scripts/_lib/egress_rules.ts",
+    "find": "    return rest === 1;\n}",
+    "replace": "    return true;\n}",
+    "killed_by": "iban-checksum-refuses-a-wrong-check-digit"
+}

package/src/config/egress-mutations/raw-value-in-the-count-record.json

@@ -0,0 +1,7 @@
+{
+    "mutation": "raw-value-in-the-count-record",
+    "module": "src/scripts/_lib/egress_text.ts",
+    "find": "found.push({ class: span.class, type: span.type });",
+    "replace": "found.push({ class: span.class, type: span.type, value: text.slice(span.start, span.end) } as never);",
+    "killed_by": "tally-carries-no-value"
+}

package/src/config/evaluator-budgets.json

@@ -65,14 +65,14 @@
       "deterministic": false
     },
     "cli_help_command_count": {
-      "max": 111,
-      "last_measured": 111,
-      "last_measured_at": "2026-10-07",
+      "max": 114,
+      "last_measured": 114,
+      "last_measured_at": "2026-10-21",
       "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
       "inputs": [
         "src/cli/registry.ts"
       ],
-      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109. 109 → 110 on 2026-09-03: the `hooks:effect` verb (road-to-wired-instruments Phase 1.1 — the CLI entry for `hook_effect_doctor`) registers in the same PR that adds the surface, per this record's own contract. It exists because the probe and its five-state vocabulary were built, tested and reachable from nothing: `grep -rn 'hook_effect_doctor|hook_effect_probe' src Taskfile.yml .github` returned only the two modules themselves, and a closed roadmap recorded the wiring as landed at `src/scripts/hooks_doctor.ts:88`, a line that is the closing brace of a filesystem helper in a file with zero references to the probe. Deliberately NOT merged into `hooks:doctor`: that verb reads the MANIFEST (what is declared) and this one reads what happened (what took effect), and the probe's own header names merging them as the thing to avoid — a declaration report and an execution report are different instruments, and merging them makes the cheap one expensive. Read-only apart from a scratch root it removes in a `finally`. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 110. 110 → 111 on 2026-10-07: the `git:convention` verb (road-to-a-git-convention-that-reaches-every-checkout step 1.2) registers in the same PR that adds the surface, per this record's own contract. It exists because a consumer project has neither `scripts-run` nor `node_modules`, so the `agent-config` binary is the only code an installed command reaches, and `settings:get` reports a settings file that does not parse as \"not set\" — the reading that turned a declared `rebase` into a merge. The verb reports each git.* key with its value, source file and one of five states, exits 1 when a key cannot be read, and takes its subcommands from one table so later git surfaces are rows under this verb rather than new verbs. Read-only. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 111."
+      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109. 109 → 110 on 2026-09-03: the `hooks:effect` verb (road-to-wired-instruments Phase 1.1 — the CLI entry for `hook_effect_doctor`) registers in the same PR that adds the surface, per this record's own contract. It exists because the probe and its five-state vocabulary were built, tested and reachable from nothing: `grep -rn 'hook_effect_doctor|hook_effect_probe' src Taskfile.yml .github` returned only the two modules themselves, and a closed roadmap recorded the wiring as landed at `src/scripts/hooks_doctor.ts:88`, a line that is the closing brace of a filesystem helper in a file with zero references to the probe. Deliberately NOT merged into `hooks:doctor`: that verb reads the MANIFEST (what is declared) and this one reads what happened (what took effect), and the probe's own header names merging them as the thing to avoid — a declaration report and an execution report are different instruments, and merging them makes the cheap one expensive. Read-only apart from a scratch root it removes in a `finally`. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 110. 110 → 111 on 2026-10-07: the `git:convention` verb (road-to-a-git-convention-that-reaches-every-checkout step 1.2) registers in the same PR that adds the surface, per this record's own contract. It exists because a consumer project has neither `scripts-run` nor `node_modules`, so the `agent-config` binary is the only code an installed command reaches, and `settings:get` reports a settings file that does not parse as \"not set\" — the reading that turned a declared `rebase` into a merge. The verb reports each git.* key with its value, source file and one of five states, exits 1 when a key cannot be read, and takes its subcommands from one table so later git surfaces are rows under this verb rather than new verbs. Read-only. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 111. 111 → 112 on 2026-10-15: the +1 is `ci:settle`, registered in the SAME PR that adds it (fix/bytes-council-findings, the council-review follow-up to #2363). Why a verb rather than the script path: the 2026-10-15 council review (2/2) found that `/fix ci` and `/create-pr` invoked `npx tsx node_modules/@event4u/agent-config/src/scripts/ci_settle.ts`, which fails on a global or ephemeral install and pulls tsx from the registry; the packaged executable is the only invocation that works in every install shape. Verified from a packed tarball installed with --omit=dev, with neither tsx nor npx on PATH. Re-measured via the pinned method: 112. 112 → 114 on 2026-10-21: `worktree:cleanup` and `audit:deps` register in the SAME PR that adds them (road-to-worktrees-that-leave-after-the-merge 4.1, road-to-advisories-heard-the-same-day 5.1). Why verbs rather than script paths: both are reached by a consumer with a global install, where `node_modules/@event4u/agent-config/…` does not exist — the same reason `ci:settle` became a verb. Re-measured via the pinned method: 114. Headroom stays zero by design."
     },
     "mcp_public_tool_count": {
       "max": 26,