@event4u/agent-config 2.26.0 → 3.1.0

package/.agent-src/rules/security-sensitive-stop.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
-description: "Security-sensitive paths — auth, billing, tenant boundaries, secrets, uploads, integrations, webhooks, public endpoints — threat-model BEFORE editing"
+description: "Security-sensitive paths — auth, billing, tenants, secrets, uploads, webhooks, public endpoints — threat-model BEFORE editing"
 source: package
 triggers:
   - keyword: "auth"
@@ -10,6 +10,18 @@ triggers:
   - keyword: "tenant"
   - keyword: "secret"
   - keyword: "webhook"
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Security-Sensitive Stop Rule

package/.agent-src/rules/size-enforcement.md

@@ -9,6 +9,18 @@ triggers:
   - intent: "create skill"
   - intent: "create command"
   - intent: "create guideline"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # size-enforcement

package/.agent-src/rules/skill-improvement-trigger.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "After completing a meaningful task — trigger post-task learning capture if pipelines.skill_improvement is enabled"
+description: "After a meaningful task — trigger post-task learning capture if pipelines.skill_improvement is enabled"
 source: package
 triggers:
   - phrase: "after completing"
@@ -9,6 +9,18 @@ triggers:
   - keyword: "pipeline"
 routes_to:
   - "skill:skill-improvement-pipeline"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Skill Improvement Trigger

package/.agent-src/rules/skill-quality.md

@@ -1,12 +1,24 @@
 ---
 type: "auto"
 tier: "mechanical-already"
-description: "Creating, editing, or reviewing skills — minimum quality standard, every skill must be executable, validated, and self-contained"
+description: "Creating/editing/reviewing skills — minimum quality standard; every skill executable, validated, self-contained"
 source: package
 triggers:
   - path_prefix: ".agent-src.uncompressed/skills/"
 routes_to:
   - "guideline:agent-infra/skill-quality-checklist"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Skill Quality

package/.agent-src/rules/slash-command-routing-policy.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "1"
-description: "When user types a slash command like /create-pr, /commit, or pastes command file content"
+description: "User types a slash command like /create-pr, /commit, or pastes command file content"
 source: package
 triggers:
   - keyword: "/create-pr"
@@ -10,6 +10,18 @@ triggers:
   - phrase: "slash command"
 routes_to:
   - "skill:command-routing"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Slash Command Routing Policy

package/.agent-src/rules/strategy-safety-floor.md

@@ -0,0 +1,114 @@
+---
+type: "auto"
+tier: "2a"
+description: "Founder-strategy output (vision, positioning, competitive moats, market entry, OKR trees, build-vs-buy) — never issue final strategic call; surface trade-offs; human owns the decision"
+source: package
+triggers:
+  - keyword: "vision"
+  - keyword: "positioning"
+  - keyword: "moat"
+  - keyword: "competitive"
+  - keyword: "market entry"
+  - keyword: "OKR"
+  - keyword: "build vs buy"
+  - keyword: "buy vs partner"
+  - keyword: "beachhead"
+  - keyword: "GTM"
+  - keyword: "category"
+  - keyword: "where to play"
+  - keyword: "where not to play"
+  - phrase: "what's our strategy"
+  - phrase: "should we enter"
+  - phrase: "what's our moat"
+  - phrase: "where should we focus"
+  - phrase: "should we reorg"
+routes_to:
+  - "skill:vision-articulation"
+  - "skill:positioning-strategy"
+  - "skill:competitive-moat-analysis"
+  - "skill:market-entry-analysis"
+  - "skill:build-buy-partner"
+  - "skill:okr-tree-modeling"
+workspaces:
+  - founder
+packs:
+  - founder-strategy
+lifecycle: active
+trust:
+  level: advisory
+  confidence: high
+  human_review_required: true
+install:
+  default: true
+  removable: false
+---
+<!-- agent-config:human-review-banner -->
+> HUMAN REVIEW REQUIRED · trust: advisory · owner: founder
+
+# Strategy Safety Floor
+
+Domain safety floor for founder-strategy artefacts (vision, positioning, competitive moats, market entry, OKR trees, build-vs-buy). Auto-activates when `pack-founder-strategy` is installed.
+
+## Iron Law — strategy is a frame, not a verdict
+
+```
+THE AGENT NEVER ISSUES A FINAL "ENTER MARKET X" / "BUILD" / "BUY" / "REORG" CALL.
+FRAME THE TRADE-OFF. SURFACE THE COST OF EACH PATH. THE FOUNDER DECIDES.
+```
+
+Strategy output is a structured argument — it sharpens the question, surfaces the trade-offs, names the bet being made. It does **not** make the bet. Holds for every founder-strategy skill (`vision-articulation`, `positioning-strategy`, `competitive-moat-analysis`, `market-entry-analysis`, `build-buy-partner`, `okr-tree-modeling`, `org-design`, `fundraising-narrative`).
+
+## Mandatory disclosure footer
+
+Every strategy deliverable (positioning brief, market-entry memo, build-vs-buy analysis, OKR tree, moat map) ends with:
+
+```
+> **Not a strategic decision.** This is a framing of the trade-off, not the
+> verdict. The named bet, residual risk, and counter-case are surfaced
+> above. Founder review required before commitment to a path.
+```
+
+The footer is non-optional. Drop it → safety violation.
+
+## Required structural elements
+
+Each strategy deliverable surfaces, in this order:
+
+1. **The bet** — one sentence naming what is being chosen and what is being given up.
+2. **Why now / why us** — the timing and capability claim, with at least one piece of evidence per claim.
+3. **Counter-case** — one paragraph on the strongest argument against this path (not a strawman).
+4. **Residual risk** — what stays unresolved after this decision; what would invalidate it.
+5. **Decision owner** — named human who owns the call (default: founder / CEO / leadership team).
+
+## Human review escalation
+
+| Trigger | Action |
+|---|---|
+| Board-bound positioning or strategy memo | Surface `HUMAN REVIEW REQUIRED` banner; do not commit without explicit user confirmation. |
+| Reorg, layoff, or org-design recommendation | Refuse to finalize; output `DRAFT` watermark and route to the user for the people-impact review. |
+| Market entry into a regulated domain (legal, medical, financial) | Refuse; route to `domain-safety-disclaimer` and defer to domain counsel. |
+| Public-facing positioning (PR, fundraise narrative) | Mandatory counter-case + named decision owner. |
+
+## Forbidden moves
+
+- "You should enter market X" without surfacing the cost of not entering Y
+- Positioning verdict without an opposable axis (per `positioning-strategy`)
+- Build-vs-buy recommendation without integration-cost and optionality analysis
+- OKR tree without measurability + laddering check
+- Moat claim without a competitor delta (named, with evidence)
+- Strategic call that fails the inversion test (per `competitive-moat-analysis`)
+- Vision statement without a stated counter-case
+
+## When this rule applies
+
+Active whenever any of these are in the request, the open file, or the loaded skill set:
+- A founder-strategy skill name (`vision-articulation`, `positioning-strategy`, `competitive-moat-analysis`, `market-entry-analysis`, `build-buy-partner`, `okr-tree-modeling`, `org-design`, `fundraising-narrative`)
+- Keywords: vision, positioning, moat, competitive, market entry, OKR, build vs buy, beachhead, GTM, category, where to play
+- Phrases: "what's our strategy", "should we enter", "what's our moat", "where should we focus", "should we reorg"
+
+## See also
+
+- `domain-safety-disclaimer` — generic advisory-content floor (core pack)
+- `finance-safety-floor` — finance-pack floor, often paired with strategy work (pack-finance-basic)
+- [`positioning-strategy`](../skills/positioning-strategy/SKILL.md) — opposable-axis discipline
+- [`competitive-moat-analysis`](../skills/competitive-moat-analysis/SKILL.md) — inversion test

package/.agent-src/rules/symfony-routing.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "3"
-description: "Writing or reviewing Symfony code — DI, bundles, Doctrine, Messenger, Security voters, console commands — route to the symfony-workflow skill"
+description: "Writing/reviewing Symfony — DI, bundles, Doctrine, Messenger, Security voters, console commands — route to symfony-workflow"
 source: package
 triggers:
   - keyword: "symfony"
@@ -10,6 +10,18 @@ triggers:
   - keyword: "messenger"
 routes_to:
   - "skill:symfony-workflow"
+workspaces:
+  - engineering
+packs:
+  - symfony
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # Symfony Routing

package/.agent-src/rules/think-before-action.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2b"
-description: "Before coding, modifying, or debugging — analyze first, verify with real tools, never guess or trial-and-error"
+description: "Before coding/modifying/debugging — analyze first, verify with real tools, never guess or trial-and-error"
 alwaysApply: false
 source: package
 load_context:
@@ -10,6 +10,18 @@ triggers:
   - intent: "before coding"
   - intent: "before debugging"
   - intent: "before modifying"
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # think-before-action

package/.agent-src/rules/token-efficiency.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "When running CLI tools, fetching logs, or producing replies — redirect verbose output, minimize tool calls, keep replies concise"
+description: "Running CLI tools, fetching logs, or producing replies — redirect verbose output, minimize tool calls, keep replies concise"
 alwaysApply: false
 source: package
 load_context:
@@ -10,6 +10,18 @@ triggers:
   - intent: "verbose CLI output"
   - intent: "fetching logs"
   - keyword: "minimize tool calls"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Token Efficiency

package/.agent-src/rules/token-optimizer-maintenance.md

@@ -16,6 +16,18 @@ validator_ignore:
   - type: "substring"
     pattern: ".agent-src.uncompressed/"
     reason: "Rule lists the authoring-tree paths that must stay in sync with the catalog."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Token Optimizer Maintenance

package/.agent-src/rules/tool-safety.md

@@ -2,11 +2,23 @@
 type: auto
 tier: "2b"
 source: package
-description: "When a skill uses external tools — enforce allowlist, deny-by-default, and no hidden credential patterns"
+description: "Skill uses external tools — enforce allowlist, deny-by-default, no hidden credential patterns"
 triggers:
   - keyword: "allowed_tools"
   - keyword: "tool registry"
   - intent: "external API"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Tool Safety

package/.agent-src/rules/ui-audit-gate.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2b"
 alwaysApply: false
-description: "Writing or editing UI — components, screens, partials, layouts, design tokens — require existing-ui-audit findings before non-trivial UI change"
+description: "Writing/editing UI — components, screens, layouts, design tokens — require existing-ui-audit findings first"
 source: package
 triggers:
   - path_prefix: "resources/views/"
@@ -11,6 +11,18 @@ triggers:
   - keyword: "design token"
 routes_to:
   - "skill:existing-ui-audit"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # UI Audit Gate

package/.agent-src/rules/upstream-proposal.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "After creating or significantly improving a skill, rule, guideline, or command — ask if it should be contributed upstream to the shared package"
+description: "After creating or improving a skill/rule/guideline/command — ask if it should be contributed upstream to the shared package"
 source: package
 triggers:
   - phrase: "after creating"
@@ -9,6 +9,18 @@ triggers:
   - keyword: "upstream"
 routes_to:
   - "skill:upstream-contribute"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Upstream Proposal

package/.agent-src/rules/user-interaction.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "3"
-description: "Asking the user a question, presenting options, or summarizing progress — numbered-options Iron Law, single-recommendation rule, progress indicators"
+description: "Asking a question, presenting options, summarizing progress — numbered-options Iron Law, single-recommendation rule, progress indicators"
 alwaysApply: false
 source: package
 load_context:
@@ -10,6 +10,18 @@ triggers:
   - intent: "ask user a question"
   - intent: "numbered options"
   - intent: "summarizing progress"
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # User Interaction

package/.agent-src/rules/user-interrupt-priority.md

@@ -6,6 +6,18 @@ alwaysApply: true
 source: package
 load_context:
   - ../contexts/execution/interrupt-examples.md
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # User-Interrupt Priority

package/.agent-src/rules/verify-before-complete.md

@@ -6,6 +6,18 @@ alwaysApply: true
 source: package
 load_context:
   - ../contexts/execution/verification-mechanics.md
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Verify Before Completion

package/.agent-src/skills/accessibility-auditor/SKILL.md

@@ -5,6 +5,18 @@ personas:
   - frontend-engineer
 source: package
 domain: quality
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # accessibility-auditor

package/.agent-src/skills/activation-design/SKILL.md

@@ -6,6 +6,18 @@ tier: senior
 source: package
 domain: product
 context_spine: [product, customer-segment, funnel-stage]
+workspaces:
+  - product
+packs:
+  - product-discovery
+lifecycle: active
+trust:
+  level: professional
+  confidence: high
+  human_review_required: false
+install:
+  default: false
+  removable: true
 ---
 
 # activation-design

package/.agent-src/skills/adr-create/SKILL.md

@@ -11,6 +11,18 @@ execution:
   command:
     - python3
     - scripts/adr/regenerate_index.py
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # adr-create

package/.agent-src/skills/adversarial-review/SKILL.md

@@ -6,6 +6,18 @@ personas:
 source: package
 domain: quality
 council_depth: deep
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # Adversarial Review

package/.agent-src/skills/agent-docs-writing/SKILL.md

@@ -3,6 +3,18 @@ name: agent-docs-writing
 description: "Use when reading, creating, or updating agent documentation, module docs, roadmaps, or AGENTS.md. Understands the full .augment/, agents/, and copilot-instructions structure."
 source: package
 domain: process
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+lifecycle: active
+trust:
+  level: core
+  confidence: high
+  human_review_required: false
+install:
+  default: true
+  removable: false
 ---
 
 # agent-docs
@@ -168,7 +180,7 @@ When starting work, read documentation in this order:
 | New module created | Create `app/Modules/{Module}/agents/` with module description |
 | Significant multi-step change | Ask user about creating a roadmap in `agents/roadmaps/` |
 | New convention introduced | Update relevant doc in `./agents/` or `.augment/guidelines/` |
-| Database schema changed | Update `agents/docs/database-setup.md` |
+| Database schema changed | Update `agents/reference/docs/database-setup.md` |
 | Architectural decision made | Use the [`adr-create`](../adr-create/SKILL.md) skill — writes a numbered ADR under `docs/adr/` (or `docs/decisions/`) and regenerates the index |
 
 ## When to update documentation
@@ -185,12 +197,12 @@ After completing a significant code change, run this mental checklist:
 
 | What changed | Doc to check |
 |---|---|
-| Database schema (migration) | `agents/docs/database-setup.md` |
+| Database schema (migration) | `agents/reference/docs/database-setup.md` |
 | New API endpoint | OpenAPI annotations, `AGENTS.md` API section |
 | New module created | Create `app/Modules/{Module}/agents/` |
-| Service/repository signature changed | Check if referenced in `agents/docs/services-and-repos.md` |
+| Service/repository signature changed | Check if referenced in `agents/reference/docs/services-and-repos.md` |
 | New environment variable | `.env.example`, `AGENTS.md` environment section |
-| Docker/compose change | `agents/docs/docker.md`, `Makefile` documentation |
+| Docker/compose change | `agents/reference/docs/docker.md`, `Makefile` documentation |
 | New Artisan command | `AGENTS.md` commands section |
 | New pattern/convention introduced | Relevant guideline in `.augment/guidelines/` |