@event4u/agent-config 3.0.0 → 3.1.1

package/scripts/install.sh

@@ -248,7 +248,7 @@ create_symlink() {
     local link_dir
     link_dir="$(dirname "$link_abs")"
 
-    mkdir -p "$link_dir"
+    $DRY_RUN || mkdir -p "$link_dir"
 
     # Remove existing file/symlink
     if [[ -L "$link_abs" ]] || [[ -f "$link_abs" ]]; then
@@ -336,7 +336,7 @@ sync_hybrid() {
         local target_dir
         target_dir="$(dirname "$target_file")"
 
-        mkdir -p "$target_dir"
+        $DRY_RUN || mkdir -p "$target_dir"
 
         if should_copy "$rel_path"; then
             # Remove existing symlink before copying
@@ -446,7 +446,7 @@ create_tool_symlinks() {
     local project_root="$1"
     local rules_dir="$project_root/.augment/rules"
 
-    [[ -d "$rules_dir" ]] || return
+    [[ -d "$rules_dir" ]] || return 0
 
     local -a tool_ids=()
     local -a tool_dirs=()
@@ -466,7 +466,7 @@ create_tool_symlinks() {
         local rel_prefix="${rel_prefixes[$i]}"
         local target_dir="$project_root/$dir"
 
-        mkdir -p "$target_dir"
+        $DRY_RUN || mkdir -p "$target_dir"
 
         for rule_file in "$rules_dir"/*.md; do
             [[ -f "$rule_file" ]] || continue
@@ -516,11 +516,11 @@ create_skill_symlinks() {
     local project_root="$1"
     local skills_dir="$project_root/.augment/skills"
 
-    [[ -d "$skills_dir" ]] || return
+    [[ -d "$skills_dir" ]] || return 0
     is_tool_enabled "claude-code" || { log_verbose "skip .claude/skills/ (claude-code not selected)"; return 0; }
 
     local target_dir="$project_root/.claude/skills"
-    mkdir -p "$target_dir"
+    $DRY_RUN || mkdir -p "$target_dir"
 
     local count=0
     for skill_dir in "$skills_dir"/*/; do
@@ -569,7 +569,7 @@ generate_windsurfrules() {
     local project_root="$1"
     local rules_dir="$project_root/.augment/rules"
 
-    [[ -d "$rules_dir" ]] || return
+    [[ -d "$rules_dir" ]] || return 0
     is_tool_enabled "windsurf" || { log_verbose "skip .windsurfrules (windsurf not selected)"; return 0; }
 
     local output="$project_root/.windsurfrules"
@@ -629,8 +629,8 @@ copy_if_missing() {
     local source="$1"
     local target="$2"
 
-    [[ -f "$source" ]] || return
-    [[ -f "$target" ]] && return
+    [[ -f "$source" ]] || return 0
+    [[ -f "$target" ]] && return 0
 
     if $DRY_RUN; then
         log_verbose "copy $(basename "$target") (missing)"
@@ -834,8 +834,26 @@ install_cli_wrapper() {
 }
 
 # --- Main ---
+# Phase 6 of monorepo-phase-3-typescript-installer (ADR-016 § Distribution):
+# direct `bash install.sh` invocations are deprecated in favor of the
+# TypeScript installer (`npx @event4u/agent-config init`). The banner only
+# fires when this script is invoked directly — the orchestrator
+# (scripts/install) and the consumer `./agent-config` wrapper set
+# AGENT_CONFIG_FROM_ORCHESTRATOR=1 to suppress the noise. Removal target:
+# the cutover release that flips the npx entry point to the TS installer.
+emit_deprecation_banner() {
+    $QUIET && return 0
+    [[ "${AGENT_CONFIG_FROM_ORCHESTRATOR:-0}" == "1" ]] && return 0
+    [[ "${AGENT_CONFIG_SUPPRESS_DEPRECATION:-0}" == "1" ]] && return 0
+    echo "  ⚠️  Direct \`bash install.sh\` is deprecated (ADR-016 § Distribution)." >&2
+    echo "      Prefer:  npx @event4u/agent-config init" >&2
+    echo "      Or:      bash scripts/install   (orchestrator, suppresses this banner)" >&2
+    echo "" >&2
+}
+
 main() {
     parse_args "$@"
+    emit_deprecation_banner
 
     # Minimal-init short-circuit (Step 7 Phase 2): skip every payload-sync
     # stage and only install the project-local `./agent-config` wrapper.

package/scripts/lint_agents_layout.py

@@ -7,19 +7,28 @@ runtime artefacts, settings, audits, and policies. Flat files at the
 everything else lives in a typed subdirectory (`runtime/`, `settings/`,
 `audits/`, `roadmaps/`, `policies/`, `contexts/`, etc.).
 
-Categories:
+Two layout tiers:
 
-  ALLOWED  — Whitelisted flat files. Linter is silent.
-  UNKNOWN  — Anything else. Linter fails.
+  MAINTAINER (this source repo, identified by ``.agent-src.uncompressed/``)
+      Full `agents/` tree allowed — only the flat-file whitelist is
+      enforced. Phase 4 of road-to-global-only-install keeps the
+      maintainer surface unchanged.
+
+  CONSUMER (any repo without ``.agent-src.uncompressed/``)
+      Global-only target shape: `agents/overrides/` + the bridge
+      marker `agents/.event4u-bridge.yml` are the **only** expected
+      artefacts. Anything else surfaces as a WARNING with a pointer
+      to ``agent-config settings migrate`` (exit code 0). Hard
+      violations (unknown flat files at the root) still fail.
 
 Exit codes:
-  0 — layout is clean.
-  1 — at least one UNKNOWN file.
+  0 — layout is clean (warnings ok in consumer mode).
+  1 — at least one UNKNOWN flat-file violation.
 
 Invocation (from project root):
   python3 scripts/lint_agents_layout.py
-  python3 scripts/lint_agents_layout.py --strict
   python3 scripts/lint_agents_layout.py --quiet
+  python3 scripts/lint_agents_layout.py --strict   # warnings → errors
 """
 
 from __future__ import annotations
@@ -40,15 +49,51 @@ ALLOWED_FLAT_FILES: frozenset[str] = frozenset(
         # D1 anchor / progress dashboard — kept at root by the
         # roadmap-progress-sync rule so consumers see it first.
         "roadmaps-progress.md",
-        # Worked example for the ai-video pipeline. Stays adjacent to
-        # the agents/reference/ai-video/ dir as a reference template.
-        ".ai-video.xml.example",
         # Empty-tree sentinel so agents/ survives a fresh checkout
         # before any runtime artefact lands.
         ".gitkeep",
+        # Consumer bridge marker (Phase 4 of road-to-global-only-install).
+        # Spec: docs/contracts/consumer-bridge.md (event4u-bridge/v1).
+        ".event4u-bridge.yml",
     }
 )
 
+# Consumer-target layout: only these top-level entries are expected in
+# the global-only world. Anything else is a WARNING in consumer mode.
+CONSUMER_EXPECTED_ENTRIES: frozenset[str] = frozenset(
+    {"overrides", ".event4u-bridge.yml", ".gitkeep"},
+)
+
+MIGRATE_HINT = (
+    "Run `agent-config settings migrate` (or `npx @event4u/agent-config "
+    "migrate-to-global`) to move legacy project-scope artefacts under "
+    "`~/.event4u/agent-config/` and leave `agents/overrides/` + "
+    "`agents/.event4u-bridge.yml` as the only consumer-side files."
+)
+
+
+def is_source_repo(project_root: Path) -> bool:
+    """True when running inside the agent-config source repo.
+
+    The maintainer surface is identified by **any** of:
+      - ``.agent-src.uncompressed/`` at the workspace root (legacy / single-pack layout),
+      - ``packages/<pack>/.agent-src.uncompressed/`` (current monorepo layout — see ``AGENTS.md``),
+      - ``.agent-src/`` at the workspace root (compressed authoring tree).
+
+    Consumer repos ship none of these — they only carry the deployed
+    `.augment/`, `.claude/`, etc. plus `agents/overrides/`.
+    """
+    if (project_root / ".agent-src.uncompressed").is_dir():
+        return True
+    if (project_root / ".agent-src").is_dir():
+        return True
+    packages = project_root / "packages"
+    if packages.is_dir():
+        for sub in packages.iterdir():
+            if (sub / ".agent-src.uncompressed").is_dir():
+                return True
+    return False
+
 
 def find_violations(root: Path) -> list[str]:
     """Return UNKNOWN flat-file violations at the agents/ root."""
@@ -73,14 +118,40 @@ def find_violations(root: Path) -> list[str]:
     return unknown
 
 
+def find_consumer_warnings(root: Path) -> list[str]:
+    """Return WARNINGs for consumer repos that hold legacy artefacts.
+
+    Consumer-target shape (Phase 4 of road-to-global-only-install):
+    `agents/overrides/` + `agents/.event4u-bridge.yml` are the only
+    expected entries. Anything else is a soft warning — the linter
+    still exits 0, but the message points the user at the migration
+    subcommand so the legacy directory can be reclaimed.
+    """
+    warnings: list[str] = []
+    if not root.is_dir():
+        return warnings
+
+    for path in sorted(root.iterdir()):
+        if path.name in CONSUMER_EXPECTED_ENTRIES:
+            continue
+        # Flat-file UNKNOWNs are already an error — don't double-count.
+        if path.is_file() and path.name not in ALLOWED_FLAT_FILES:
+            continue
+        kind = "dir" if path.is_dir() else "file"
+        warnings.append(f"{path} ({kind}): legacy artefact outside the consumer-target shape.")
+
+    return warnings
+
+
 def main() -> int:
     args = sys.argv[1:]
-    # --strict kept for backward-compat; no longer affects exit code now
-    # that the LEGACY tier is gone.
-    _ = "--strict" in args
+    strict = "--strict" in args
     quiet = "--quiet" in args
 
+    project_root = Path.cwd()
     unknown = find_violations(AGENTS_ROOT)
+    consumer_mode = not is_source_repo(project_root)
+    warnings = find_consumer_warnings(AGENTS_ROOT) if consumer_mode else []
 
     if unknown:
         print("❌  agents/ layout violations (unknown flat files):\n")
@@ -94,7 +165,16 @@ def main() -> int:
         )
         return 1
 
-    if not quiet:
+    if warnings:
+        if not quiet:
+            print("⚠️  agents/ consumer-shape warnings:\n")
+            for w in warnings:
+                print(f"  - {w}")
+            print(f"\n{MIGRATE_HINT}")
+        if strict:
+            return 1
+
+    if not unknown and not warnings and not quiet:
         print("✅  agents/ layout clean.")
     return 0
 

package/scripts/lint_agents_md.py

@@ -65,7 +65,7 @@ class Target:
 TARGETS = [
     Target(ROOT / "AGENTS.md", "package-root", 3000, 2800, template=False),
     Target(
-        ROOT / ".agent-src.uncompressed" / "templates" / "AGENTS.md",
+        ROOT / "packages" / "core" / ".agent-src.uncompressed" / "templates" / "AGENTS.md",
         "consumer-template", 2500, 2300, template=True,
     ),
 ]

package/scripts/lint_archived_skills.py

@@ -29,8 +29,16 @@ from pathlib import Path
 QUIET = "--quiet" in sys.argv
 
 REPO = Path(__file__).resolve().parents[1]
-ARCHIVE_DIR = REPO / "agents" / "archived-skills"
-SKILLS_DIR = REPO / ".agent-src.uncompressed" / "skills"
+# Archive notes moved under agents/evidence/ in the privilege-first
+# taxonomy refactor (commit d2ce6748).
+ARCHIVE_DIR = REPO / "agents" / "evidence" / "archived-skills"
+
+# Live skill directories live under every artefact root post-monorepo
+# Phase 4 (legacy + packages/*/.agent-src.uncompressed/skills/).
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from _lib.agent_src import artefact_roots  # noqa: E402
+
+SKILLS_DIRS = [root / "skills" for root in artefact_roots() if (root / "skills").is_dir()]
 
 REQUIRED_FIELDS = ("slug", "archived_on", "last_seen_count", "reason", "replacement", "last_known_callers")
 VALID_REASONS = frozenset({"unused", "merged", "superseded", "deprecated"})
@@ -57,7 +65,13 @@ def archived_slugs() -> list[Path]:
 
 
 def live_skill_slugs() -> set[str]:
-    return {p.name for p in SKILLS_DIR.iterdir() if p.is_dir() and (p / "SKILL.md").exists()}
+    slugs: set[str] = set()
+    for skills_dir in SKILLS_DIRS:
+        slugs.update(
+            p.name for p in skills_dir.iterdir()
+            if p.is_dir() and (p / "SKILL.md").exists()
+        )
+    return slugs
 
 
 def main() -> int:
@@ -100,15 +114,16 @@ def main() -> int:
 
         replacement = fm["replacement"]
         reason = fm["reason"]
+        skills_label = ", ".join(str(d) for d in SKILLS_DIRS) or "<no skills root>"
         if reason in {"merged", "superseded"}:
             if replacement == "none" or not replacement:
                 errors.append(f"{note.name}: reason={reason} requires a replacement slug, got 'none'")
             elif replacement not in live:
-                errors.append(f"{note.name}: replacement '{replacement}' not found under {SKILLS_DIR}")
+                errors.append(f"{note.name}: replacement '{replacement}' not found under {skills_label}")
         elif reason in {"unused", "deprecated"}:
             if replacement not in {"none", ""}:
                 if replacement not in live:
-                    errors.append(f"{note.name}: replacement '{replacement}' not found under {SKILLS_DIR}")
+                    errors.append(f"{note.name}: replacement '{replacement}' not found under {skills_label}")
 
         if fm["slug"] in live:
             errors.append(f"{note.name}: slug '{fm['slug']}' still has a live SKILL.md (zombie)")
@@ -116,17 +131,18 @@ def main() -> int:
         archived_keys.add(fm["slug"])
 
     # Cross-check: live skills must not list an archived slug as replaced_by.
-    for skill_dir in sorted(SKILLS_DIR.iterdir()):
-        skill_md = skill_dir / "SKILL.md"
-        if not skill_md.exists():
-            continue
-        text = skill_md.read_text(encoding="utf-8")
-        fm = parse_frontmatter(text)
-        if fm is None:
-            continue
-        rb = fm.get("replaced_by", "").strip()
-        if rb and rb in archived_keys:
-            errors.append(f"{skill_dir.name}/SKILL.md: replaced_by '{rb}' points at an archived slug")
+    for skills_dir in SKILLS_DIRS:
+        for skill_dir in sorted(skills_dir.iterdir()):
+            skill_md = skill_dir / "SKILL.md"
+            if not skill_md.exists():
+                continue
+            text = skill_md.read_text(encoding="utf-8")
+            fm = parse_frontmatter(text)
+            if fm is None:
+                continue
+            rb = fm.get("replaced_by", "").strip()
+            if rb and rb in archived_keys:
+                errors.append(f"{skill_dir.name}/SKILL.md: replaced_by '{rb}' points at an archived slug")
 
     if errors:
         print(f"❌  lint_archived_skills: {len(errors)} violation(s) across {len(notes)} note(s)", file=sys.stderr)

package/scripts/lint_bench_corpus.py

@@ -38,7 +38,13 @@ REQUIRE_FULL = "--require-full" in sys.argv
 
 REPO = Path(__file__).resolve().parents[1]
 CORPUS_DIR = REPO / "tests" / "eval"
-SKILLS_DIR = REPO / ".agent-src.uncompressed" / "skills"
+
+# Live skill directories live under every artefact root post-monorepo
+# Phase 4 (legacy + packages/*/.agent-src.uncompressed/skills/).
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from _lib.agent_src import artefact_roots  # noqa: E402
+
+SKILLS_DIRS = [root / "skills" for root in artefact_roots() if (root / "skills").is_dir()]
 
 VALID_CATEGORIES = frozenset({"canonical", "ambiguous", "destructive", "long-context"})
 # Non-dev corpus (pre-spec) uses legacy categories — accept them so the
@@ -51,7 +57,13 @@ FULL_COUNTS = {"canonical": 10, "ambiguous": 8, "destructive": 5, "long-context"
 
 
 def live_skills() -> set[str]:
-    return {p.name for p in SKILLS_DIR.iterdir() if p.is_dir() and (p / "SKILL.md").exists()}
+    slugs: set[str] = set()
+    for skills_dir in SKILLS_DIRS:
+        slugs.update(
+            p.name for p in skills_dir.iterdir()
+            if p.is_dir() and (p / "SKILL.md").exists()
+        )
+    return slugs
 
 
 def lint_corpus(path: Path, skills: set[str]) -> list[str]:

package/scripts/lint_command_tiers.py

@@ -19,7 +19,12 @@ from pathlib import Path
 QUIET = "--quiet" in sys.argv
 
 REPO = Path(__file__).resolve().parents[1]
-COMMANDS_DIR = REPO / ".agent-src.uncompressed" / "commands"
+
+# Commands live under every artefact root post-monorepo Phase 4.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from _lib.agent_src import artefact_roots  # noqa: E402
+
+COMMANDS_DIRS = [root / "commands" for root in artefact_roots() if (root / "commands").is_dir()]
 # Consumer-facing projection — must also carry tier so .augment/commands/
 # (which symlinks to .agent-src/commands/) renders the tier filter.
 COMMANDS_DIR_COMPRESSED = REPO / ".agent-src" / "commands"
@@ -102,7 +107,15 @@ def lint(commands_dir: Path, *, quiet: bool = False) -> int:
 
 
 def main() -> int:
-    rc = lint(COMMANDS_DIR, quiet=QUIET)
+    if not COMMANDS_DIRS:
+        print(
+            "lint_command_tiers: no commands dir found under any artefact root",
+            file=sys.stderr,
+        )
+        return 1
+    rc = 0
+    for commands_dir in COMMANDS_DIRS:
+        rc |= lint(commands_dir, quiet=QUIET)
     # The compressed projection is the consumer-facing tree (via the
     # .augment/commands → .agent-src/commands symlink). It must also
     # carry tier so the surface stays uniform.

package/scripts/lint_featured_skills.py

@@ -0,0 +1,139 @@
+#!/usr/bin/env python3
+"""CI guard for docs/featured-skills.md entry validity.
+
+Every artefact referenced from the three Featured tables (Founders &
+Consultants, Content Creators, Engineering Leads) MUST resolve in
+`dist/discovery/discovery-manifest.json`. Stale entries (renamed or
+removed skills / commands) fail the build.
+
+Detection:
+
+  - Scan `docs/featured-skills.md` for inline links of shape
+    `[`<token>`](../.agent-src/{skills|commands}/<path>.md)` inside the
+    Featured tables. Strip the `/` prefix on commands and the leading
+    slash on skill names.
+  - Cross-check each token against the manifest's `artefacts` array
+    (`category` in {`skill`, `command`} + `name` match, namespaced
+    commands like `video/from-script` → `video:from-script`).
+  - Verify `--pack <slug>` install hints reference packs that exist in
+    `manifest.packs[].id`.
+
+Exit codes:
+  0 — every entry resolves; install-pack hints are valid.
+  1 — at least one stale entry or unknown pack.
+
+Invocation:
+  python3 scripts/lint_featured_skills.py
+  python3 scripts/lint_featured_skills.py --quiet
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+
+DOC = Path("docs/featured-skills.md")
+MANIFEST = Path("dist/discovery/discovery-manifest.json")
+
+# Matches `[`token`](../.agent-src/skills/<slug>/SKILL.md)` or
+# `[`/token`](../.agent-src/commands/<path>.md)`. Captures (category, slug-path).
+LINK_RE = re.compile(
+    r"\[`/?[^`]+`\]\(\.\./\.agent-src/(skills|commands)/([^)]+?)\.md\)"
+)
+PACK_HINT_RE = re.compile(r"--pack\s+([a-z][a-z0-9-]*)")
+
+
+def load_manifest() -> dict:
+    if not MANIFEST.exists():
+        print(f"error: manifest not found at {MANIFEST}", file=sys.stderr)
+        sys.exit(1)
+    return json.loads(MANIFEST.read_text(encoding="utf-8"))
+
+
+def manifest_names(manifest: dict) -> tuple[set[str], set[str], set[str]]:
+    """Return (skill-names, command-names, pack-ids)."""
+    skills: set[str] = set()
+    commands: set[str] = set()
+    for art in manifest.get("artefacts", []):
+        cat = art.get("category")
+        name = art.get("name")
+        if not name:
+            continue
+        if cat == "skill":
+            skills.add(name)
+        elif cat == "command":
+            commands.add(name)
+    packs = {p.get("id") for p in manifest.get("packs", []) if p.get("id")}
+    return skills, commands, packs
+
+
+def slug_from_path(category: str, raw: str) -> str:
+    """Convert a doc-link path to the manifest `name` form.
+
+    skills/<slug>/SKILL  → <slug>
+    commands/<group>/<leaf>  → <group>:<leaf>
+    commands/<leaf>     → <leaf>
+    """
+    if category == "skills":
+        # raw looks like "<slug>/SKILL"; strip trailing /SKILL if present.
+        return raw.split("/", 1)[0]
+    # commands
+    parts = raw.split("/")
+    return ":".join(parts) if len(parts) > 1 else parts[0]
+
+
+def main() -> int:
+    quiet = "--quiet" in sys.argv
+    if not DOC.exists():
+        print(f"error: {DOC} not found", file=sys.stderr)
+        return 1
+
+    manifest = load_manifest()
+    skills, commands, packs = manifest_names(manifest)
+    body = DOC.read_text(encoding="utf-8")
+
+    missing: list[str] = []
+    seen: set[tuple[str, str]] = set()
+    for cat, raw in LINK_RE.findall(body):
+        slug = slug_from_path(cat, raw)
+        key = (cat, slug)
+        if key in seen:
+            continue
+        seen.add(key)
+        pool = skills if cat == "skills" else commands
+        if slug not in pool:
+            missing.append(f"  - {cat}/{slug} (linked path: ../.agent-src/{cat}/{raw}.md)")
+
+    unknown_packs: list[str] = []
+    for pack in PACK_HINT_RE.findall(body):
+        if pack not in packs:
+            unknown_packs.append(f"  - --pack {pack}")
+
+    if missing or unknown_packs:
+        print(f"FAIL  {DOC}: stale Featured Skills entries detected.")
+        if missing:
+            print("\nMissing artefacts (not in discovery-manifest.json):")
+            for line in missing:
+                print(line)
+        if unknown_packs:
+            print("\nUnknown pack ids referenced in install hints:")
+            for line in unknown_packs:
+                print(line)
+        print(
+            "\nFix: either restore the artefact, update the doc entry to a "
+            "current name, or substitute with the nearest existing artefact."
+        )
+        return 1
+
+    if not quiet:
+        print(
+            f"OK    {DOC}: {len(seen)} artefact entries + "
+            f"{len(set(PACK_HINT_RE.findall(body)))} pack hints validated."
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/lint_framework_leakage.py

@@ -33,11 +33,30 @@ from pathlib import Path
 from typing import Iterable
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
-DEFAULT_PATHS = (
-    ".agent-src.uncompressed/skills",
-    ".agent-src.uncompressed/rules",
-    ".agent-src.uncompressed/commands",
-)
+sys.path.insert(0, str(REPO_ROOT / "scripts"))
+from _lib.agent_src import artefact_roots  # noqa: E402
+
+# Post-ADR-017 source artefacts live under every packages/*/.agent-src.uncompressed/;
+# pre-move the flat .agent-src.uncompressed/ root still wins. The lint walks
+# the three artefact subtrees (skills/, rules/, commands/) under each active root.
+_SUBDIRS = ("skills", "rules", "commands")
+
+
+def _default_paths() -> tuple[str, ...]:
+    out: list[str] = []
+    for root in artefact_roots():
+        try:
+            rel = root.relative_to(REPO_ROOT)
+        except ValueError:
+            continue
+        for sub in _SUBDIRS:
+            target = root / sub
+            if target.is_dir():
+                out.append((rel / sub).as_posix())
+    return tuple(out)
+
+
+DEFAULT_PATHS = _default_paths()
 ALLOWLIST_FILE = REPO_ROOT / "scripts/lint_framework_leakage_allowlist.json"
 
 CARVE_OUT_PATTERNS = [
@@ -185,8 +204,16 @@ def _load_allowlist() -> dict:
 
 
 def _allowlisted(rel_path: str, line_no: int, allowlist: dict) -> bool:
+    # Allowlist entries cite paths under the legacy .agent-src.uncompressed/
+    # prefix; post-ADR-017 files live under packages/*/.agent-src.uncompressed/.
+    # Match either the literal repo-relative path or its logical id.
+    from _lib.agent_src import strip_source_prefix  # noqa: E402
+
+    logical = strip_source_prefix(rel_path)
     for entry in allowlist.get("entries", []):
-        if entry.get("file") != rel_path:
+        entry_file = entry.get("file")
+        entry_logical = strip_source_prefix(entry_file) if isinstance(entry_file, str) else None
+        if entry_file != rel_path and (logical is None or entry_logical != logical):
             continue
         lines = entry.get("lines")
         if lines == "*":