@event4u/agent-config 17.2.0 → 17.2.1

package/.augment-plugin/marketplace.json

@@ -1,20 +1,20 @@
 {
   "name": "event4u-agent-config",
   "description": "Governed agent system — skills, rules, commands, and guidelines for AI-assisted development.",
-  "version": "17.2.0",
+  "version": "17.2.1",
   "owner": {
     "name": "event4u",
     "email": "dev@event4u.app"
   },
   "metadata": {
     "description": "A policy-driven execution system that enforces quality, consistency, and developer-like behavior for AI agents.",
-    "version": "17.2.0"
+    "version": "17.2.1"
   },
   "plugins": [
     {
       "name": "agent-config",
       "description": "Full governed agent system — rules, skills, commands, guidelines, and runtime tooling.",
-      "version": "17.2.0",
+      "version": "17.2.1",
       "source": ".",
       "category": "governance",
       "tags": [

package/.augment-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-config",
   "description": "A governed skill framework for AI agents — runtime execution, tooling, observability, feedback, and lifecycle management with policy-driven quality enforcement.",
-  "version": "17.2.0",
+  "version": "17.2.1",
   "author": {
     "name": "event4u",
     "email": "dev@event4u.app"

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable. Its hooks run only alongside a global npm install of the package (`npx -y @event4u/agent-config init` or `npm i -g`); a project-local install is never used. On a plugin-only install no dispatcher is reachable, no hook runs, and the fail_closed guards (block-no-verify, block-kernel-rule-writes, block-plumbing-writes) are OFF — only the session start says so.",
-    "version": "17.2.0",
+    "version": "17.2.1",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -403,6 +403,28 @@ An entry belongs under a dated release section, not here — see
 > that forces a new era split (`# Era: 17.2.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [17.2.1](https://github.com/event4u-app/agent-config/compare/17.2.0...17.2.1) (2026-10-23)
+
+### Release highlights
+
+- **Behaviour changes:** _none_
+- **Default changes + migration:** Breaking, pending in `BREAKING_CHANGES.md` and shipped by this release: **Three `fail_closed` hook guards run where they were silent.** The installed claude hook command now reaches a dispatcher staged under `~/.event4u/agent-config/runtime/` after a project-local install and before `PATH` ([`3f8c98e`](https://github.com/event4u-app/agent-config/commit/3f8c98e74), #2455). On machines installed through `npx`, or hosts launched with a bare `PATH`, every hook command used to end in a silent `exit 0`; there `block-no-verify` (refuses `git … --no-verify` and `core.hooksPath` overrides), `block-kernel-rule-writes` and `block-plumbing-writes` (refuse agent writes to this package's kernel rules and hook plumbing) now run and may refuse a tool call for the first time. Classed breaking by the AI council, 2026-10-19 (`agents/evidence/council/hook-carrier-release-note-class-20261019.md`). **`uninstall --global --purge` stops being a recursive delete of the host anchor.** Old scope: `fs.rmSync(anchor, { recursive: true })` on whole host configuration roots — `~/.claude/`, `~/.codex/`, `~/.config/zed/` — so everything under them went, whoever wrote it. New scope: only the anchor-relative paths this package's own deploy inventory recorded writing; the anchor itself is never removed, directories are pruned only when left empty, a recorded symlink is unlinked rather than followed, and a purge with no readable inventory for that anchor exits 1 having deleted nothing. A second change in the same area: a plain `uninstall --global` now keeps the lockfile while recorded content is still on disk, where it used to delete it.
+- **Security and correctness:** _none_
+- **Honest nulls:** _none_
+- **Known limitations:** _none_
+
+> **Governance mix:** governance-only 1 vs consumer-only 0 (mixed 0, maintenance 1; taxonomy 1.1.0; range 4e79c57090c8..36c8616ea2f4).
+
+### Documentation
+
+* **ci:** record the shipped cloud-release rate-limit fix ([b3d4b2f](https://github.com/event4u-app/agent-config/commit/b3d4b2f6d7334d8c78ee48bdb098efb30808703f))
+
+### CI
+
+* **cloud-release:** pace the asset upload and skip what is already attached ([91d4b73](https://github.com/event4u-app/agent-config/commit/91d4b73ebab6b68a53581092354803014dbf0c0c))
+
+Tests: 32297 (+0 since 17.2.0)
+
 ## [17.2.0](https://github.com/event4u-app/agent-config/compare/17.1.0...17.2.0) (2026-10-23)
 
 ### Release highlights

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "17.2.0"
+agent_config_version: "17.2.1"
 
 # --- Project identity ---
 project:

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-10-23T12:27:49Z`
+- Generated: `2026-10-23T14:16:10Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -15269,7 +15269,7 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-10-23T12:27:49Z",
+  "generated_at": "2026-10-23T14:16:10Z",
   "packs": [
     {
       "artefact_count": 130,

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-c56c0f01af2a7e392bfe7a3bade14cd27e0969aaa2d70c14310f202ded7c8627  discovery-manifest.json
+ae24bd45782c87fa0948de3cc5148ae565fc362b8b1e0997fbd6f155be39e922  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,6 +1,6 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-10-23T12:27:49Z`
+- Generated: `2026-10-23T14:16:10Z`
 - Scanner: `de0a22b4ac4c`
 - Artefacts: **637**
 - Unassigned: **0**

package/dist/discovery/dormancy-report.md

@@ -1,6 +1,6 @@
 # Discovery — Dormancy Report
 
-- Generated: `2026-10-23T12:27:49Z`
+- Generated: `2026-10-23T14:16:10Z`
 - Window: **6 months** without a commit
 
 > Dormancy triggers **review, never auto-deprecation**

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-10-23T12:27:49Z`
+- Generated: `2026-10-23T14:16:10Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
   "checksum": "sha256:78594c2e14f67a1cb0b14a85d62c2ccdc967977ab6bf4bf0f1a869d1a91d4e35",
-  "generated_at": "2026-10-23T12:27:49Z",
+  "generated_at": "2026-10-23T14:16:10Z",
   "packs": [
     {
       "always_on": false,

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-10-23T12:27:49Z`
+- Generated: `2026-10-23T14:16:10Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 

package/dist/discovery/workspaces.json

@@ -1,6 +1,6 @@
 {
   "checksum": "sha256:78594c2e14f67a1cb0b14a85d62c2ccdc967977ab6bf4bf0f1a869d1a91d4e35",
-  "generated_at": "2026-10-23T12:27:49Z",
+  "generated_at": "2026-10-23T14:16:10Z",
   "scanner_version": "de0a22b4ac4c",
   "workspaces": [
     {

package/dist/mcp/registry-manifest.json

@@ -9,7 +9,7 @@
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "17.2.0"
+    "version": "17.2.1"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "17.2.0"
+      "version": "17.2.1"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "17.2.0"
+  "version": "17.2.1"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "17.2.0",
+    "version": "17.2.1",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the artifact counts in these badges.",
     "license": "MIT",
     "private": false,