@event4u/agent-config 2.25.0 → 3.0.0

package/.agent-src/contexts/authority/scope-mechanics.md

@@ -91,6 +91,17 @@ User decides. Default: **3** when the current branch's name and scope match the
 
 **Failure mode — diverging stacked PRs.** Skipping the inventory and committing to the wrong base creates two PRs that should have been one stack: merge conflicts when the parent lands, rebase / force-push churn, duplicate review effort. The 30-second inventory cost up front beats hours of rebase reconciliation later.
 
+**Failure mode — opening a PR on a stale long-lived branch.** A pre-existing feature branch (e.g. `feat/X` last touched days ago) is still "the current branch" but its base — `main` — has moved on. Auto-generated artifacts (`agents/roadmaps-progress.md`, ownership matrices, compressed mirrors, hash files) are the canonical collision surface: any merged PR on `main` touched them, and the stale branch's copy is now a content conflict by construction. Opening a PR without fetching `main` first surfaces conflicts only after `gh pr create` has already published the broken PR.
+
+**Pre-PR freshness check — MANDATORY** (mirrored in [`/create-pr` Step 1b](../../commands/create-pr.md)). Before `gh pr create`:
+
+1. `git fetch origin {target-base} --quiet`.
+2. `git rev-list --count HEAD..origin/{target-base}` — commits behind base.
+3. Count > 0 AND another open PR targets the same base → STOP and ask: stack on top / wait for parent to land / merge-main-into-branch / proceed-anyway-and-accept-conflicts / cancel.
+4. Count > 0 AND no overlap → ask: merge-main / rebase / proceed-anyway / cancel.
+
+User decides. Never silently `gh pr create` on a branch that is behind its base.
+
 ## Decline = silence — context
 
 The right moment to ask is **before** the work starts (writing the

package/.agent-src/contexts/communication/rules-auto/guidelines-mechanics.md

@@ -33,7 +33,7 @@ before writing or reviewing code); this file is the catalog.
 | `performance.md` | Performance conventions — caching, Redis, eager loading, response time targets |
 | `security.md` | Security conventions — auth, authorization, SQL injection, XSS, CSRF, headers |
 | `sql.md` | Raw SQL conventions — parameterization, MariaDB syntax, common mistakes |
-| `websocket.md` | WebSocket conventions — Broadcasting, channel types, connection management |
+| `laravel-websocket.md` | Laravel Broadcasting conventions — channel types, connection management, Echo client |
 | `patterns.md` | Design patterns index (links to `patterns/` subdirectory) |
 
 ## PHP Patterns (`docs/guidelines/php/patterns/`)

package/.agent-src/contexts/contracts/agents-md-anatomy.md

@@ -101,7 +101,7 @@ package edit touches the same hot file.
    inside backticks with no *why*-clause; collapse runs of three or
    more into a single capability pointer.
 4. **Outboard.** Move each `outboard-candidate` into
-   `agents/contexts/`, `docs/contracts/`, an existing rule body, or
+   `agents/settings/contexts/`, `docs/contracts/`, an existing rule body, or
    an existing skill body. Replace in-file with a substantive
    pointer. Never invent a new top-level dir.
 5. **Verify.** Run `python3 scripts/lint_agents_md.py` until green;

package/.agent-src/contexts/contracts/research-schema.md

@@ -103,7 +103,7 @@ properties:
 Upstream (`Weizhena/Deep-Research-skills`) shipped a `validate_json.py`
 Pydantic-based validator that assumed `~/.claude/` paths and a Python
 runtime in the consumer environment. Both are
-`augment-portability` violations for this package (zero-runtime-Python
+`augment-edit-discipline` violations for this package (zero-runtime-Python
 goal, host-agnostic distribution). The schema reference above lets the
 agent validate by reading; consumers needing programmatic validation
 can pipe the YAML through any JSON-Schema validator they prefer

package/.agent-src/contexts/documentation-hierarchy.md

@@ -124,8 +124,8 @@ agents/overrides/skills/eloquent.md        ← Override (Layer 4)
 | Context location | Scope | Example |
 |---|---|---|
 | `.augment/contexts/` | Shared (about the agent system) | `augment-infrastructure.md` |
-| `agents/contexts/` | Project-wide | `import-pipeline.md` |
-| `app/Modules/*/agents/contexts/` | Module-specific | `client-api.md` |
+| `agents/settings/contexts/` | Project-wide | `import-pipeline.md` |
+| `app/Modules/*/agents/settings/contexts/` | Module-specific | `client-api.md` |
 
 ### Template Usage (Layer 1 → Layer 5/6)
 

package/.agent-src/contexts/execution/interrupt-examples.md

@@ -0,0 +1,34 @@
+# Interrupt Examples — Non-Interrupts, Failure Modes
+
+Loaded by the [`user-interrupt-priority`](../../rules/user-interrupt-priority.md)
+rule when concrete examples sharpen a classification call. The Iron
+Law, classification table, and stop-ask-resume protocol live in the
+rule itself.
+
+## What does NOT count as an interrupt
+
+- **Clarifying question about the current task** — answer in place,
+  keep going.
+- **Quoted text / code / log content** containing imperative verbs
+  ("stop", "abort") — content, not instruction. Speech-act check, same
+  as [`autonomous-execution § opt-in detection`](../../rules/autonomous-execution.md#opt-in-detection--match-by-intent-not-exact-string).
+- **User pasting an error or screenshot** without a redirect —
+  diagnostic input for the current task.
+- **"Why are you doing X?"** as a question — answer it, then continue
+  (unless the answer reveals the current task is wrong, in which case
+  STOP and confirm).
+
+## Failure modes
+
+- **Silent-resume** — treated the interrupt as a pause, returned to the
+  old task without asking. Iron Law violation.
+- **Partial-execution-then-resume** — answered the new ask in two
+  sentences, then went back to the old task without completing the new
+  one. Treat meta-tasks (process audits, council consultations, rule
+  changes) as full tasks, not as quick acknowledgments.
+- **Greedy-bundling** — appended the new task to the old task's plan
+  and continued the old plan first. New task runs **first**, alone, in
+  full.
+- **Autonomy-as-cover** — "user said autonomy on, so I just continued"
+  — autonomy never overrides a fresh instruction. See
+  [`autonomous-execution § Task-scope`](../../rules/autonomous-execution.md).

package/.agent-src/contexts/execution/roadmap-process-loop.md

@@ -138,6 +138,25 @@ For each open step in the working set (scope-bound — see wrapper):
    [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md).
    A loop iteration that lands work without flipping its box is a
    rule violation. Do not save flips for the archive commit.
+
+### 5b. Flip-guard — deterministic
+
+   Before advancing to step 6, run:
+
+   ```bash
+   git diff --name-only -- agents/roadmaps/<file>.md
+   ```
+
+   Empty output → Iron Law 2 was violated this iteration: the step
+   landed work but no checkbox flipped. **Halt loudly**, surface
+   "step <N> landed without checkbox flip — flip then resume", and
+   stop the run. Do not auto-fix; the user resumes on the next turn.
+
+   Deterministic counterpart to the rule's pre-send self-check —
+   catches a forgotten flip per step, not only at run end. Runs in
+   every scope (`process-step`, `process-phase`, `process-full`);
+   cost is one `git diff` per step.
+
 6. **Dashboard regen — cadence-gated.** Run
    `./agent-config roadmap:progress` when due per
    `roadmap.dashboard_regen_cadence` (resolved in § 4):

package/.agent-src/contexts/skills-and-commands.md

@@ -95,13 +95,13 @@ Commands often chain together. Here are the main workflows:
 | Area | Skills |
 |---|---|
 | API endpoints | `api-endpoint`, `api-design`, `api-versioning`, `api-testing`, `openapi`, `laravel-validation` |
-| Database | `eloquent`, `database`, `migration-creator`, `multi-tenancy`, `sql-writing` |
+| Database | `eloquent`, `database`, `laravel-migration`, `multi-tenancy`, `sql-writing` |
 | Background jobs | `jobs-events`, `laravel-horizon`, `laravel-scheduling`, `performance` |
 | Email/Notifications | `laravel-mail`, `laravel-notifications` |
 | Middleware/Auth | `laravel-middleware`, `security` |
 | Feature flags | `laravel-pennant` |
 | Monitoring | `laravel-pulse`, `logging-monitoring`, `grafana`, `sentry-integration` |
-| Real-time | `laravel-reverb`, `websocket` |
+| Real-time | `laravel-reverb`, `laravel-websocket` |
 | Testing | `pest-testing`, `test-generator`, `playwright-testing` |
 | Frontend | `livewire`, `flux`, `blade-ui`, `tailwind`, `vue`, `react`, `fe-design` |
 | Infrastructure | `docker`, `aws-infrastructure`, `terraform`, `terragrunt`, `cloudflare-workers`, `traefik` |

package/.agent-src/ghostwriter/README.md

@@ -10,7 +10,7 @@
 - `fictional-fixture-v1.md` — single allowlisted fictional fixture
   demonstrating the schema. **No real-person profiles ever ship here.**
 
-That's it. Real-person profiles live in **`agents/ghostwriter/`** in the
+That's it. Real-person profiles live in **`agents/reference/ghostwriter/`** in the
 consumer project and are gitignored by default
 (see [`config/gitignore-block.txt`](../../config/gitignore-block.txt)).
 
@@ -42,7 +42,7 @@ Two-step process — **both required**:
 
 - Any file in this directory whose stem is not on the allowlist.
 - Any allowlisted file missing `fictional: true`.
-- Any consumer-side file under `agents/ghostwriter/` with `fictional: true`
+- Any consumer-side file under `agents/reference/ghostwriter/` with `fictional: true`
   (fictional profiles belong here, not in consumer trees).
 
 New fixtures require reviewer sign-off on the allowlist change.

package/.agent-src/ghostwriter/fictional-fixture-v1.md

@@ -85,7 +85,7 @@ to load.
 
 Do not use this fixture as a template for adding a real person to
 `.agent-src.uncompressed/ghostwriter/`. Real-person profiles never
-ship with the package — they belong in `agents/ghostwriter/` on the
+ship with the package — they belong in `agents/reference/ghostwriter/` on the
 consumer side, where they are gitignored by default.
 
 If you need a second fictional fixture (for a different

package/.agent-src/personas/README.md

@@ -111,4 +111,4 @@ Personas are one of three voice primitives. Same shape (Markdown +
 frontmatter), distinct purpose — **no folding, no shared schema**:
 
 - [`../../docs/contracts/agent-user-schema.md`](../../docs/contracts/agent-user-schema.md) — `.agent-user.md`, the maintainer's own voice (`/post-as:me`, no disclosure footer).
-- [`../../docs/contracts/ghostwriter-schema.md`](../../docs/contracts/ghostwriter-schema.md) — `agents/ghostwriter/<slug>.md`, captured public-figure voice (`/ghostwriter:write` / `/post-as:ghostwriter`, mandatory disclosure footer).
+- [`../../docs/contracts/ghostwriter-schema.md`](../../docs/contracts/ghostwriter-schema.md) — `agents/reference/ghostwriter/<slug>.md`, captured public-figure voice (`/ghostwriter:write` / `/post-as:ghostwriter`, mandatory disclosure footer).

package/.agent-src/personas/advisors/contrarian.md

@@ -90,6 +90,6 @@ straw man.
 ---
 
 *This persona is consumed by the AI Council advisor system
-(replace-mode). When activated via `agents/.ai-council.yml`'s
+(replace-mode). When activated via `agents/settings/.ai-council.yml`'s
 `advisors:` block, the entire file body below the frontmatter becomes
 the system prompt for the targeted member.*

package/.agent-src/personas/advisors/executor.md

@@ -94,6 +94,6 @@ can start on.
 ---
 
 *This persona is consumed by the AI Council advisor system
-(replace-mode). When activated via `agents/.ai-council.yml`'s
+(replace-mode). When activated via `agents/settings/.ai-council.yml`'s
 `advisors:` block, the entire file body below the frontmatter becomes
 the system prompt for the targeted member.*

package/.agent-src/personas/advisors/expansionist.md

@@ -93,6 +93,6 @@ the proposal as written can survive its own success.
 ---
 
 *This persona is consumed by the AI Council advisor system
-(replace-mode). When activated via `agents/.ai-council.yml`'s
+(replace-mode). When activated via `agents/settings/.ai-council.yml`'s
 `advisors:` block, the entire file body below the frontmatter becomes
 the system prompt for the targeted member.*

package/.agent-src/personas/advisors/first-principles.md

@@ -93,6 +93,6 @@ inherit an accidental complexity from convention.
 ---
 
 *This persona is consumed by the AI Council advisor system
-(replace-mode). When activated via `agents/.ai-council.yml`'s
+(replace-mode). When activated via `agents/settings/.ai-council.yml`'s
 `advisors:` block, the entire file body below the frontmatter becomes
 the system prompt for the targeted member.*

package/.agent-src/personas/advisors/outsider.md

@@ -97,6 +97,6 @@ synthesis stage can use to see the proposal from outside.
 ---
 
 *This persona is consumed by the AI Council advisor system
-(replace-mode). When activated via `agents/.ai-council.yml`'s
+(replace-mode). When activated via `agents/settings/.ai-council.yml`'s
 `advisors:` block, the entire file body below the frontmatter becomes
 the system prompt for the targeted member.*

package/.agent-src/rules/agent-authority.md

@@ -4,6 +4,18 @@ tier: "3"
 description: "Priority Index for the four authority rules — Hard Floor → Permission Gate → Commit Default → Trivial-vs-Blocking; read first, route to canonical rule"
 alwaysApply: true
 source: package
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Agent Authority — Priority Index

package/.agent-src/rules/analysis-skill-routing.md

@@ -9,6 +9,18 @@ triggers:
   - phrase: "dig into the codebase"
 routes_to:
   - "skill:analysis-skill-router"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Analysis Skill Routing

package/.agent-src/rules/architecture.md

@@ -2,37 +2,63 @@
 type: "auto"
 tier: "3"
 alwaysApply: false
-description: "Architecture rules for creating new files, classes, controllers, modules, or making structural decisions about project organization"
+description: "Architecture rules for new files, classes, controllers, modules, or structural decisions about project organization"
 source: package
 triggers:
   - keyword: "controller"
   - keyword: "service"
   - keyword: "module"
   - intent: "structural decision"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Architecture Rules
 
+```
+HTTP HANDLERS STAY THIN. BUSINESS LOGIC LIVES IN SERVICES OR USE-CASES.
+ALWAYS VALIDATE AT THE REQUEST BOUNDARY. NEVER INLINE-VALIDATE INSIDE THE HANDLER.
+ALWAYS READ AGENTS.MD AND PROJECT-LOCAL DOCS BEFORE STRUCTURAL DECISIONS.
+```
+
 ## General Principles
 
-- **Controllers are thin** — no business logic, delegate to services.
-- **Only Single Action Controllers** — every new controller MUST use `__invoke()`. No multi-action / resource controllers. See `../docs/guidelines/php/controllers.md` for naming conventions.
-- **Every controller needs a FormRequest** — never validate inline with `$request->validate()`. Use a dedicated `FormRequest` subclass.
-- **Services contain business logic** — calculations, orchestration, validation.
-- **Models have no business logic** — only relationships, scopes, accessors/mutators.
+- **HTTP handlers stay thin** — no business logic; delegate to a service / use-case / domain layer.
+- **Validate at the request boundary** — never inline-validate user input inside the handler. Use the framework's request-validation primitive (Laravel `FormRequest`, Symfony validator, Zod / class-validator in TS, Pydantic in Python).
+- **One handler, one responsibility** — prefer single-purpose handlers over multi-action controllers when the framework supports it (Laravel `__invoke`, Next.js route handlers, Express handler-per-route).
+- **Business logic lives in services / use-cases** — calculations, orchestration, cross-aggregate validation.
+- **Domain models stay behavior-rich but I/O-free** — no HTTP, no DB transactions in the model; only domain rules, relationships, derived properties.
 - Always check the existing directory structure before creating new files.
 - Respect existing patterns — apply modern standards to **new** code only.
 
+→ Laravel-specific patterns (FormRequest, single-action `__invoke`, Eloquent scopes): see [`laravel`](../skills/laravel/SKILL.md), [`laravel-validation`](../skills/laravel-validation/SKILL.md).
+→ Symfony: see [`symfony-workflow`](../skills/symfony-workflow/SKILL.md).
+→ Next.js / TypeScript backends: see [`nextjs-patterns`](../skills/nextjs-patterns/SKILL.md).
+
 ## Project Detection
 
 Detect the current project type from the **Git remote URL**, **directory name**, or **project files**:
 
-- Check `composer.json` for framework (Laravel, Symfony, standalone).
-- Check if `artisan` exists → Laravel project.
-- Check `package.json` for frontend framework (React, Vue, Next.js, etc.).
+- **PHP** — `composer.json` (framework slot: Laravel via `artisan`, Symfony via `bin/console`, standalone otherwise).
+- **JS / TS** — `package.json` (framework slot: Next.js via `next` dep, Nuxt via `nuxt`, Express / Fastify / NestJS via deps; plain Node otherwise).
+- **Python** — `pyproject.toml` / `requirements.txt` (framework slot: Django via `django`, FastAPI via `fastapi`, Flask via `flask`).
+- **Go** — `go.mod` (framework slot: `gin`, `echo`, `fiber`, stdlib `net/http`).
+- **Ruby** — `Gemfile` (framework slot: Rails via `rails` gem, Sinatra otherwise).
+- **Rust** — `Cargo.toml` (framework slot: `axum`, `actix-web`, `rocket`).
 - Check `AGENTS.md` or `agents/` for project-specific documentation.
 
-For tooling detection (artisan vs composer), check if `artisan` exists in the project root.
+Tooling lives in a runner file at the project root — detect once and reuse the result:
+`Taskfile.yml` → `task`, `Makefile` → `make`, `package.json` `scripts:` → `npm` / `pnpm` / `yarn`, `pyproject.toml` `[tool.poetry.scripts]` or `[project.scripts]` → `poetry` / `uv`, framework CLIs (`artisan`, `bin/console`, `manage.py`, `bin/rails`) when the matching manifest is present.
 
 ## Project-Specific Architecture
 
@@ -51,7 +77,7 @@ projects use `docs/decisions/`. Reversible refactors and minor cleanups do **not
 
 ## Module-Level Documentation
 
-Some projects use a module system (e.g. `app/Modules/` in Laravel projects).
+Some projects use a module system (e.g. `app/Modules/` in Laravel, `apps/`/`packages/` in a Turborepo, `src/modules/` in NestJS, `internal/` in Go).
 Modules may have their own agent docs in `app/Modules/*/agents/` with:
 
 - Module descriptions and feature docs

package/.agent-src/rules/artifact-drafting-protocol.md

@@ -2,17 +2,35 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
-description: "Creating a new skill, rule, command, or guideline, or significantly rewriting one — runs mandatory Understand → Research → Draft before drafting"
+description: "Creating a new skill/rule/command/guideline or significantly rewriting one — runs mandatory Understand → Research → Draft first"
 source: package
 triggers:
   - intent: "create new skill"
   - intent: "create new rule"
   - intent: "create new command"
   - intent: "create new guideline"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Artifact Drafting Protocol
 
+```
+NEVER START WRITING WITHOUT THE UNDERSTAND → RESEARCH → DRAFT PHASES.
+EVERY PHASE ENDS WITH A NUMBERED-OPTIONS PROMPT. NO SILENT PROGRESSION.
+ZERO AUTOPILOT. AGENT PROPOSES, HUMAN DECIDES. COMMIT ONLY ON APPROVAL.
+```
+
 When the user asks to build or significantly rewrite a **skill, rule,
 command, or guideline**, the agent does **not** start writing. It runs
 three phases: **Understand → Research → Draft**. Each phase ends with a

package/.agent-src/rules/artifact-engagement-recording.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "mechanical-already"
 alwaysApply: false
-description: "After a /implement-ticket or /work phase-step (refine/memory/analyze/plan/implement/test/verify/report) or full task — emit one telemetry:record call"
+description: "After a /implement-ticket or /work phase-step or full task — emit one telemetry:record call"
 source: package
 triggers:
   - phrase: "/implement-ticket"
@@ -12,6 +12,18 @@ routes_to:
   - "contract:artifact-engagement-flow"
 load_context:
   - "../contexts/contracts/artifact-engagement-flow.md"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 <!-- cloud_safe: noop -->

package/.agent-src/rules/ask-when-uncertain.md

@@ -4,6 +4,18 @@ tier: "3"
 description: "Ask when uncertain — don't guess, assume, or improvise"
 alwaysApply: true
 source: package
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Ask When Uncertain

package/.agent-src/rules/augment-edit-discipline.md

@@ -0,0 +1,40 @@
+---
+type: "auto"
+tier: "2a"
+description: "Editing .augment/ or .agent-src.uncompressed/ — keep files project-agnostic; sync counts and cross-refs on add/rename/delete"
+source: package
+triggers:
+  - path_prefix: ".augment/"
+  - path_prefix: ".agent-src.uncompressed/"
+  - keyword: "portable"
+  - keyword: "rename"
+  - keyword: "delete"
+routes_to:
+  - "guideline:augment-portability-patterns"
+  - "skill:agent-docs-writing"
+validator_ignore:
+  - type: "substring"
+    pattern: ".agent-src.uncompressed/"
+    reason: "Rule scopes the portability gate to the uncompressed authoring tree."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
+---
+
+# Augment Edit Discipline
+
+**Iron Law (portability).** Files inside `.augment/` and `.agent-src.uncompressed/` MUST stay project-agnostic — no project names, domains, stacks.
+
+**Iron Law (sync).** On any add / rename / delete of skill / rule / command / guideline, update counts and cross-references in the same edit.
+
+Portability body migrated to `guideline:augment-portability-patterns`. Sync body migrated to `skill:agent-docs-writing` (per P4 of `road-to-kernel-and-router.md`).
+Trigger-set above activates both routes under the `balanced` and `full` profiles.

package/.agent-src/rules/augment-source-of-truth.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "1"
-description: "Creating, editing, or modifying files in .agent-src/ or .augment/ — source of truth is .agent-src.uncompressed/, never edit generated dirs directly"
+description: "Editing files in .agent-src/ or .augment/ — source of truth is .agent-src.uncompressed/; never edit generated dirs directly"
 source: package
 load_context:
   - ../contexts/communication/rules-auto/augment-source-of-truth-mechanics.md
@@ -14,6 +14,18 @@ validator_ignore:
   - type: "substring"
     pattern: ".agent-src.uncompressed/"
     reason: "Rule documents the source-of-truth boundary; mentioning the path is its purpose."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Source of Truth
@@ -33,8 +45,8 @@ Never edit any of these generated layers directly:
 ## The Iron Rule
 
 ```
-NEVER create or edit files in .agent-src/ or .augment/ directly — not even "just a small fix".
-ALWAYS work in .agent-src.uncompressed/ — then compress via /compress command.
+NEVER CREATE OR EDIT FILES IN .agent-src/ OR .augment/ DIRECTLY — NOT EVEN "JUST A SMALL FIX".
+ALWAYS WORK IN .agent-src.uncompressed/ — THEN COMPRESS VIA THE /compress COMMAND.
 ```
 
 **There are ZERO exceptions to this rule.** Even if:

package/.agent-src/rules/autonomous-execution.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "3"
-description: "Whether to ask or act on a workflow step — trivial-vs-blocking, autonomy opt-in, commit default; Hard Floor in non-destructive-by-default"
+description: "Whether to ask or act on a workflow step — trivial-vs-blocking, autonomy opt-in, commit default; Hard Floor non-destructive-by-default"
 alwaysApply: false
 source: package
 load_context:
@@ -12,6 +12,18 @@ triggers:
   - intent: "trivial workflow question"
   - intent: "autonomy mode"
   - keyword: "personal.autonomy"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Autonomous Execution
@@ -57,8 +69,39 @@ When the user later issues a **new** request — different ticket, different roa
 
 In doubt whether the new request inherits or needs fresh confirmation → fresh confirmation. The Hard Floor and [`scope-control`](scope-control.md) gates apply to every task regardless.
 
+## User interrupts override the current task
+
+A new instruction from the user mid-flight is **not** a continuation — see [`user-interrupt-priority`](user-interrupt-priority.md) for the mandatory STOP → run new task → ASK before resume protocol. Autonomy never authorizes silent-resume of the prior task.
+
+## Validation-loop budget — hard cap N=3 per target
+
+Autonomous flows must not iterate indefinitely on the same validation target. **Validation target** = a single identifiable artefact: a file path, a lint rule ID, a test name, a CI sub-task name. Natural-language clustering ("the linter stuff") does **not** count as a target — agents will rename their way out of the budget.
+
+```
+3 CONSECUTIVE FAILED ATTEMPTS ON THE SAME VALIDATION TARGET → STOP.
+SURFACE THE 3 ATTEMPTS + BLOCKING ISSUE. ASK USER FOR GUIDANCE.
+DO NOT ITERATE BEYOND N=3 WITHOUT EXPLICIT USER APPROVAL.
+COUNTER RESETS ONLY ON A DIFFERENT TARGET OR USER-APPROVED CONTINUATION.
+```
+
+A "failed attempt" is an iteration that did not move the target from red to green. Tuning the tool around the target (e.g. growing an allowlist, loosening a threshold, suppressing a check) counts as an attempt — and is usually a sign the **tool**, not the content, is wrong.
+
+### Antipattern — allowlist-growth as silent budget bypass
+
+```
+ALLOWLIST > 20 ENTRIES IN ONE SESSION = THE LINTER IS WRONG.
+STOP. PROPOSE LINTER REDESIGN OR REMOVAL. DO NOT EXPAND THE ALLOWLIST FURTHER.
+```
+
+Crossing the 20-entry threshold counts as the 3rd validation-target failure for the linter in question, regardless of prior attempt count. The fix is a tool-shape change (heuristic tightening, scope narrowing, deletion), not more entries. Same logic for: warning-suppression lists growing past ~20, `// noqa` / `# type: ignore` sweeps over many files in one session, test `skip` / `xfail` bulk-adds to chase green.
+
+### Probe efficiency — direct over orchestration
+
+When validating a single target, run the **specific** check, not a meta-task that fans out to dozens of sub-tasks. Use the failing tool's direct entry point (the specific script invocation, the specific runner target, the single-test filter for the project's test runner) rather than the full CI meta-pipeline. Full-pipeline runs are appropriate at phase boundaries, not as a per-iteration probe.
+
 ## See also
 
+- [`user-interrupt-priority`](user-interrupt-priority.md) — STOP-ASK-RESUME on new tasks; overrides autonomy
 - [`non-destructive-by-default`](non-destructive-by-default.md) — universal safety floor; never overridden by autonomy
 - [`scope-control`](scope-control.md) — git-ops permission gate
 - [`ask-when-uncertain`](ask-when-uncertain.md) — vague-request triggers that always require asking

package/.agent-src/rules/caveman-speak.md

@@ -1,10 +1,22 @@
 ---
 type: "auto"
 tier: "1"
-description: "When caveman.speak_scope != off — compress reply prose to caveman grammar with carve-outs for numbered options, Iron-Law, code, paths, error markers"
+description: "When caveman.speak_scope != off — compress prose to caveman grammar with carve-outs for numbered options, Iron-Law, code, paths, error markers"
 source: package
 triggers:
   - intent: "any reply"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Caveman Speak

package/.agent-src/rules/cli-output-handling.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Running CLI commands that produce verbose output — git, tests, linters, docker, build tools, artisan, npm, composer. Wrap with rtk; tail/grep fallback"
+description: "Running verbose CLI output — git, tests, linters, docker, build tools, artisan, npm, composer. Wrap with rtk; tail/grep fallback"
 source: package
 triggers:
   - keyword: "git"
@@ -11,6 +11,18 @@ triggers:
   - keyword: "composer"
 routes_to:
   - "skill:rtk-output-filtering"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Cli Output Handling