@event4u/agent-config 2.26.0 → 3.0.0

package/.agent-src/rules/docker-commands.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "3"
-description: "Running PHP commands inside Docker containers — artisan, composer, phpstan, rector, ecs, phpunit, tests, migrations, and any CLI tool execution"
+description: "Running PHP inside Docker — artisan, composer, phpstan, rector, ecs, phpunit, tests, migrations, any CLI tool"
 source: package
 triggers:
   - keyword: "docker"
@@ -10,6 +10,18 @@ triggers:
   - phrase: "inside the container"
 routes_to:
   - "skill:docker"
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Docker Commands

package/.agent-src/rules/domain-adoption-policy.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2b"
 alwaysApply: false
-description: "Adopting a new domain track (mobile, ML, blockchain, IoT, gaming) — gates import on demand, ownership, CI fit, Sunset compatibility BEFORE harvest"
+description: "Adopting a new domain track (mobile, ML, blockchain, IoT) — gates import on demand, ownership, CI fit, Sunset compat BEFORE harvest"
 source: package
 triggers:
   - intent: "adopt new domain"
@@ -16,6 +16,18 @@ validator_ignore:
   - type: "substring"
     pattern: ".agent-src.uncompressed/"
     reason: "Rule names the authoring tree as the gated-entry location for new domain plates."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Domain Adoption Policy
@@ -47,16 +59,16 @@ decision but cannot replace the gate evidence.
 At least one of the following must be **true and citeable** in the roadmap:
 
 - **≥ 2 consumer projects** in the domain. Cite repository names or
-  `agents/contexts/` notes — not "I think there might be".
+  `agents/settings/contexts/` notes — not "I think there might be".
 - **Named user direction with target.** A specific user ask plus a target
   project / use case — e.g. "harvest the mobile skills for project X, due
   next quarter". Vague *"this might be useful"* does not count.
 - **Public-incident pull.** A reproducible incident on a consumer project
-  the domain would have prevented, captured in `agents/contexts/` with
+  the domain would have prevented, captured in `agents/settings/contexts/` with
   the missing surface area named.
 
 If none of the three is citeable, **defer**. Open a watch-only context note
-under `agents/contexts/domain-watch/<domain>.md` listing the missing signal
+under `agents/settings/contexts/domain-watch/<domain>.md` listing the missing signal
 so the next harvest can re-evaluate without re-relitigating the case.
 
 ## Gate 2 — Named maintenance owner
@@ -131,7 +143,7 @@ core artefact.
 
 1. Mark the domain plate `[-] gated — <gate name> not met` in the relevant
    roadmap. Do **not** silently shrink scope to dodge the gate.
-2. Open a watch-only context note under `agents/contexts/domain-watch/`
+2. Open a watch-only context note under `agents/settings/contexts/domain-watch/`
    capturing what's missing — citations, owner candidates, CI feasibility.
 3. Re-evaluate at the next harvest cycle. The note is the evidence trail
    so the same questions are not relitigated.

package/.agent-src/rules/domain-safety-disclaimer.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Drafting advisory-shaped content (legal, medical, financial, strategic-consulting) — require the matching 'not X advice' disclaimer; refuse diagnosis/dosage outright"
+description: "Advisory content (legal, medical, financial, consulting) — require matching 'not X advice' disclaimer; refuse diagnosis/dosage outright"
 source: package
 triggers:
   - keyword: "legal brief"
@@ -36,6 +36,18 @@ applies_to_user_types:
   - "founder"
   - "consultant"
   - "creator"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Domain Safety — Advisory Disclaimer

package/.agent-src/rules/domain-safety-pii.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Drafts, logs, and exports touching real customer/candidate/counterparty data — redact direct identifiers, use placeholders, flag re-identification on quasi-IDs"
+description: "Drafts, logs, exports touching real customer/candidate data — redact direct IDs, use placeholders, flag re-identification on quasi-IDs"
 source: package
 triggers:
   - keyword: "support macro"
@@ -41,6 +41,18 @@ routes_to:
   - "skill:secrets-management"
 applies_to_user_types:
   - "all"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Domain Safety — PII Redaction

package/.agent-src/rules/domain-safety-retention.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Data retention guidance (finance records, support/CRM data) — name the jurisdiction gap, default to longest applicable floor, honor DSR/audit holds, never delete under inquiry"
+description: "Data retention (finance, support/CRM) — name jurisdiction gap, default to longest floor, honor DSR/audit holds, never delete under inquiry"
 source: package
 triggers:
   - keyword: "retention policy"
@@ -26,6 +26,18 @@ applies_to_user_types:
   - "ops"
   - "support"
   - "gtm"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Domain Safety — Data Retention

package/.agent-src/rules/downstream-changes.md

@@ -2,13 +2,25 @@
 type: "auto"
 tier: "2b"
 alwaysApply: false
-description: "After EVERY code edit, find ALL downstream changes needed to existing files, including callers, tests, imports, types, and documentation"
+description: "After EVERY code edit, find ALL downstream changes — callers, tests, imports, types, documentation"
 source: package
 triggers:
   - intent: "after code edit"
   - keyword: "callers"
   - keyword: "imports"
   - keyword: "downstream"
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Downstream Changes

package/.agent-src/rules/external-reference-deep-dive.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2b"
-description: "User names an external repo, file, URL, or artifact as reference — fetch the actual tree and inspect, never summarize from README or metadata"
+description: "User names external repo/file/URL/artifact as reference — fetch the actual tree and inspect, never summarize from README or metadata"
 alwaysApply: false
 source: package
 triggers:
@@ -15,6 +15,18 @@ triggers:
   - keyword: "github.com/"
   - keyword: "source of truth"
   - phrase: "reference repo"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # external-reference-deep-dive

package/.agent-src/rules/fast-path-marker-visibility.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "1"
-description: "Low-impact council fast-path dispatch — host agent MUST surface the transparency marker verbatim in the reply opening; never swallow or paraphrase it."
+description: "Low-impact council fast-path dispatch — host MUST surface transparency marker verbatim in reply opening; never paraphrase"
 source: package
 triggers:
   - keyword: "low-impact council"
@@ -13,6 +13,18 @@ validator_ignore:
   - type: "substring"
     pattern: ".agent-src.uncompressed/"
     reason: "Compressor injects a back-pointer to the uncompressed source for full failure-modes detail."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Fast-Path Marker Visibility
@@ -33,6 +45,14 @@ Markers (from `scripts/ai_council/low_impact.py`):
 
 Verbatim = first non-whitespace line, English (no translation), no emoji prefix, no merged numbered-options. Marker is the only audit signal that distinguishes fast-path from local deliberation. See `.agent-src.uncompressed/rules/fast-path-marker-visibility.md` for full failure modes.
 
+## Failure modes
+
+- Opening with `Found it` / `Looks like` / `Here's the verdict` — drops the marker. **Violation.**
+- Translating the marker to non-English. **Violation.**
+- Adding emoji prefix (`✅ Resolved via …`) — alters the literal. **Violation.**
+- Indenting beyond the leading `> ` — breaks pattern match. **Violation.**
+- Merging marker into a numbered-options block. **Violation.**
+
 Scope: `low_impact` class only. `high_impact` and `user_required` never reach fast-path.
 
 See: [`ai-council-config § Low-impact council opt-in`](../docs/contracts/ai-council-config.md#low-impact-council-opt-in), [`direct-answers`](direct-answers.md) (invented-facts Iron Law kin).

package/.agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "When editing a generic skill/rule/command — block single-stack mandates; use language-agnostic procedures with carve-out pointers."
+description: "Editing a generic skill/rule/command — block single-stack mandates; use language-agnostic procedures with carve-out pointers"
 source: package
 triggers:
   - path_prefix: ".agent-src.uncompressed/skills/"
@@ -29,6 +29,18 @@ validator_ignore:
   - type: "substring"
     pattern: "scripts/lint_framework_leakage"
     reason: "Rule cites the enforcing linter script by name in body and enforcement section."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # framework-neutrality-in-generic-skills

package/.agent-src/rules/git-history-discipline.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
-description: "Git history operations — never rebase/squash/amend without explicit request; once pushed, rewrites must pair with immediate re-push in same turn"
+description: "Git history ops — never rebase/squash/amend without explicit request; once pushed, rewrites must pair with immediate re-push same turn"
 source: package
 triggers:
   - intent: "rebase the branch"
@@ -21,6 +21,18 @@ triggers:
   - phrase: "ahead and behind"
 routes_to:
   - "skill:git-workflow"
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Git History Discipline

package/.agent-src/rules/guidelines.md

@@ -10,6 +10,18 @@ triggers:
   - intent: "writing code"
   - intent: "reviewing code"
   - keyword: "convention"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Guidelines

package/.agent-src/rules/improve-before-implement.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2b"
-description: "Before implementing features or architectural changes — validate the request against existing code, challenge weak requirements, suggest improvements"
+description: "Before implementing features or architectural changes — validate request against existing code, challenge weak requirements, suggest improvements"
 alwaysApply: false
 source: package
 council_depth: deep
@@ -13,6 +13,18 @@ validator_ignore:
   - type: "substring"
     pattern: ".agent-src.uncompressed/"
     reason: "Rule cites the authoring tree when describing where examples live."
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Improve Before Implement

package/.agent-src/rules/invite-challenge.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2b"
-description: "Before executing a complex plan or non-trivial design — ask 'am I solving the right problem?' and pause for user confirmation, even when no ambiguity"
+description: "Before executing a complex plan or non-trivial design — ask 'am I solving the right problem?' and pause for user confirmation"
 alwaysApply: false
 source: package
 council_depth: deep
@@ -14,6 +14,18 @@ triggers:
   - keyword: "design"
   - keyword: "architecture"
   - keyword: "approach"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # invite-challenge

package/.agent-src/rules/language-and-tone.md

@@ -8,6 +8,18 @@ validator_ignore:
   - type: "substring"
     pattern: ".agent-src.uncompressed/"
     reason: "Rule scopes the .md-English mandate to the authoring tree."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Language and Tone

package/.agent-src/rules/laravel-routing.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "3"
-description: "When writing or reviewing Laravel code — controllers, Eloquent, Artisan, jobs, events, policies — route to the laravel skill"
+description: "Writing/reviewing Laravel code — controllers, Eloquent, Artisan, jobs, events, policies — route to laravel skill"
 source: package
 triggers:
   - keyword: "laravel"
@@ -10,6 +10,18 @@ triggers:
   - keyword: "FormRequest"
 routes_to:
   - "skill:laravel"
+workspaces:
+  - engineering
+packs:
+  - laravel
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # Laravel Routing

package/.agent-src/rules/laravel-translations.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Laravel language files, translations, i18n, lang/de, lang/en, __() helper, localization, multilingual text"
+description: "Laravel language files, translations, i18n, lang/de, lang/en, __() helper, localization"
 source: package
 triggers:
   - path_prefix: "lang/"
@@ -10,6 +10,18 @@ triggers:
   - keyword: "trans("
 routes_to:
   - "skill:laravel"
+workspaces:
+  - engineering
+packs:
+  - laravel
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # Laravel Translations

package/.agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -1,13 +1,25 @@
 ---
 type: "auto"
 tier: "1"
-description: "Writing, editing, or upstreaming entries in `agents/low-impact-decisions.md` — non-bypassable privacy floor for the learning corpus."
+description: "Writing/editing/upstreaming entries in agents/decisions/low-impact-decisions.md — non-bypassable privacy floor for the learning corpus"
 source: package
 triggers:
-  - path_prefix: "agents/low-impact-decisions"
+  - path_prefix: "agents/decisions/low-impact-decisions"
   - keyword: "low-impact-decisions"
   - keyword: "low-impact corpus"
   - keyword: "learn-low-impact"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Low-Impact Corpus — Privacy Floor
@@ -24,7 +36,7 @@ Redactor lives in `scripts/ai_council/redact_low_impact_entry.py`
 and runs at **both** gates:
 
 1. **Write gate** — every intake append to
-   `agents/low-impact-decisions.md` (Phase 12 § Step 2).
+   `agents/decisions/low-impact-decisions.md` (Phase 12 § Step 2).
 2. **Upstream gate** — every `/memory learn-low-impact` PR draft,
    before diff leaves repo (Phase 12 § Step 5).
 
@@ -47,7 +59,7 @@ rewriting is soft gate, this is hard.
 
 ## Locked target types
 
-- `agents/low-impact-decisions.md` — project-local corpus.
+- `agents/decisions/low-impact-decisions.md` — project-local corpus.
 - `data/low-impact-decisions-seed.md` (agent-config package) —
   upstream seed shipped with the package.
 
@@ -71,4 +83,4 @@ Then agent stops intake/upstream flow. No silent retry, no auto-rewrite.
 
 - `scripts/ai_council/redact_low_impact_entry.py` — the redactor.
 - `scripts/ai_council/low_impact_intake.py` — write-gate caller.
-- `agents/low-impact-decisions.md` — corpus + Anti-Examples list.
+- `agents/decisions/low-impact-decisions.md` — corpus + Anti-Examples list.

package/.agent-src/rules/markdown-safe-codeblocks.md

@@ -1,13 +1,25 @@
 ---
 type: "auto"
 tier: "2b"
-description: "Generating markdown output that contains code blocks — prevent broken nesting"
+description: "Generating markdown with code blocks — prevent broken nesting"
 alwaysApply: false
 source: package
 triggers:
   - intent: "markdown with code blocks"
   - keyword: "triple backticks"
   - file_pattern: "*.md"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Markdown Safe Codeblocks

package/.agent-src/rules/media-governance-routing.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "When generating AI video/image/voice — surface project-local media policies (likeness, style, public-figures, voice-cloning, disclosure)"
+description: "Generating AI video/image/voice — surface project-local media policies (likeness, style, public-figures, voice-cloning, disclosure)"
 source: package
 triggers:
   - keyword: "/video:"
@@ -23,10 +23,22 @@ applies_to_user_types:
 validator_ignore:
   - type: "substring"
     pattern: "../../agents/"
-    reason: "Routing rule whose subject matter is the project-local agents/policies/media/ tree; every body link points there by design."
+    reason: "Routing rule whose subject matter is the project-local agents/settings/policies/media/ tree; every body link points there by design."
   - type: "substring"
     pattern: ".agent-src.uncompressed/"
     reason: "Rule contrasts project-local placement with the .agent-src.uncompressed/rules/ alternative — mentioning the path is the argument."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Media Governance Routing
@@ -35,29 +47,29 @@ validator_ignore:
 
 ```
 WHEN AI VIDEO, IMAGE, OR VOICE GENERATION FIRES, CONSULT THE PROJECT-LOCAL
-MEDIA POLICIES IN agents/policies/media/ BEFORE EMITTING THE PROMPT TO
+MEDIA POLICIES IN agents/settings/policies/media/ BEFORE EMITTING THE PROMPT TO
 THE PROVIDER. REFUSE-AND-SURFACE OVER GUESS-AND-RENDER.
 ```
 
-Routes agent to project-local media governance policy layer at [`agents/policies/media/`](../../agents/policies/media/) when video / image / voice surface fires. Policies are LLM-readable decision frameworks consulted in-session, not Python-enforced gates — see [`agents/policies/media/README.md § Enforcement model`](../../agents/policies/media/README.md) for full agent-in-the-loop contract.
+Routes agent to project-local media governance policy layer at [`agents/settings/policies/media/`](../../agents/settings/policies/media/) when video / image / voice surface fires. Policies are LLM-readable decision frameworks consulted in-session, not Python-enforced gates — see [`agents/settings/policies/media/README.md § Enforcement model`](../../agents/settings/policies/media/README.md) for full agent-in-the-loop contract.
 
 ## What this rule surfaces
 
 Any trigger match → agent loads into context:
 
-- [`agents/policies/media/likeness.md`](../../agents/policies/media/likeness.md) — real person's visual likeness.
-- [`agents/policies/media/style.md`](../../agents/policies/media/style.md) — named living artist's distinctive style.
-- [`agents/policies/media/public-figures.md`](../../agents/policies/media/public-figures.md) — recognised public figures.
-- [`agents/policies/media/voice-cloning.md`](../../agents/policies/media/voice-cloning.md) — vocal likeness.
-- [`agents/policies/media/disclosure.md`](../../agents/policies/media/disclosure.md) — mandatory non-removable AI-generation disclosure.
-- [`agents/policies/media/brand-impersonation.md`](../../agents/policies/media/brand-impersonation.md) — brand / broadcaster identity imitation.
-- [`agents/policies/media/transparency.md`](../../agents/policies/media/transparency.md) — provenance metadata (C2PA, SynthID).
+- [`agents/settings/policies/media/likeness.md`](../../agents/settings/policies/media/likeness.md) — real person's visual likeness.
+- [`agents/settings/policies/media/style.md`](../../agents/settings/policies/media/style.md) — named living artist's distinctive style.
+- [`agents/settings/policies/media/public-figures.md`](../../agents/settings/policies/media/public-figures.md) — recognised public figures.
+- [`agents/settings/policies/media/voice-cloning.md`](../../agents/settings/policies/media/voice-cloning.md) — vocal likeness.
+- [`agents/settings/policies/media/disclosure.md`](../../agents/settings/policies/media/disclosure.md) — mandatory non-removable AI-generation disclosure.
+- [`agents/settings/policies/media/brand-impersonation.md`](../../agents/settings/policies/media/brand-impersonation.md) — brand / broadcaster identity imitation.
+- [`agents/settings/policies/media/transparency.md`](../../agents/settings/policies/media/transparency.md) — provenance metadata (C2PA, SynthID).
 
 Each policy carries own trigger block → within active context agent narrows from superset to policies whose specific patterns actually fired (e.g. prompt naming public figure → `public-figures.md` + `disclosure.md`; `--no-disclosure` → `disclosure.md` standalone).
 
 ## Why project-local, not `.agent-src.uncompressed/rules/`
 
-Seven media policies live under [`agents/policies/media/`](../../agents/policies/media/), not as `.agent-src.uncompressed/rules/domain-safety-media-*.md`, for three reasons:
+Seven media policies live under [`agents/settings/policies/media/`](../../agents/settings/policies/media/), not as `.agent-src.uncompressed/rules/domain-safety-media-*.md`, for three reasons:
 
 1. **Consumed by skills + adapters**, not surfaced as standalone always-loaded prose. Cost non-trivial (7 × ~80 lines = ~560 lines always-context if hoisted to rules), and most sessions never touch video / image / voice surface.
 2. **Enforcement model project-local** — working precedent (`/ghostwriter:*` mandatory footer in `write-engine.md`) + audit log (session transcripts) are project artifacts. Rules under `.agent-src.uncompressed/` are tool-portable governance; these policies are domain-specific bindings.
@@ -67,7 +79,7 @@ This routing rule is the bridge: sits in always-loaded rule set so trigger keywo
 
 ## CI reachability guarantee
 
-[`scripts/lint_media_policy_linkage.py`](../../scripts/lint_media_policy_linkage.py) fails build if any policy file under `agents/policies/media/` not linked from:
+[`scripts/lint_media_policy_linkage.py`](../../scripts/lint_media_policy_linkage.py) fails build if any policy file under `agents/settings/policies/media/` not linked from:
 
 - this routing rule, **or**
 - a skill's `## Policies` see-also block, **or**
@@ -77,6 +89,6 @@ Policy that no skill, rule, or sibling policy references → silent policy. CI c
 
 ## See also
 
-- [`agents/policies/media/README.md`](../../agents/policies/media/README.md) — full enforcement-model contract.
+- [`agents/settings/policies/media/README.md`](../../agents/settings/policies/media/README.md) — full enforcement-model contract.
 - [`.augment/rules/ask-when-uncertain.md`](../../.augment/rules/ask-when-uncertain.md) — single-question refusal-path discipline every policy depends on.
-- [`docs/contracts/write-engine.md`](../docs/contracts/write-engine.md) — prose-disclosure precedent extended to media by [`disclosure.md`](../../agents/policies/media/disclosure.md).
+- [`docs/contracts/write-engine.md`](../docs/contracts/write-engine.md) — prose-disclosure precedent extended to media by [`disclosure.md`](../../agents/settings/policies/media/disclosure.md).