@event4u/agent-config 3.3.0 → 4.2.0

package/.agent-src/templates/hooks/pre-commit-frontmatter

@@ -2,7 +2,7 @@
 # Pre-commit hook: artefact frontmatter lint (event4u/agent-config, ADR-013)
 #
 # Aborts the commit when any staged .md file under
-# `.agent-src.uncompressed/` violates the per-artefact frontmatter
+# `.agent-src.uncondensed/` violates the per-artefact frontmatter
 # contract (workspaces / packs / lifecycle / trust / install). Exits
 # silently when no such files are staged — zero overhead on unrelated
 # commits.
@@ -19,7 +19,7 @@ set -e
 # (or the linter / vocabulary that govern it).
 staged="$(git diff --cached --name-only --diff-filter=ACMR 2>/dev/null || true)"
 case "$staged" in
-  *.agent-src.uncompressed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
+  *.agent-src.uncondensed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
     : ;;
   *)
     exit 0 ;;

package/.agent-src/templates/hooks/pre-commit-roadmap-progress

@@ -5,7 +5,7 @@
 # Two opt-in checks run on relevant staged paths and short-circuit
 # otherwise:
 #   1. agents/roadmaps-progress.md sync (against agents/roadmaps/*.md)
-#   2. ADR-013 per-artefact frontmatter contract (.agent-src.uncompressed/*.md)
+#   2. ADR-013 per-artefact frontmatter contract (.agent-src.uncondensed/*.md)
 #
 # To run manually:
 #   ./agent-config roadmap:progress-check
@@ -24,7 +24,7 @@ case "$staged" in
     roadmap_relevant=true ;;
 esac
 case "$staged" in
-  *.agent-src.uncompressed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
+  *.agent-src.uncondensed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
     frontmatter_relevant=true ;;
 esac
 
@@ -48,7 +48,7 @@ if $roadmap_relevant; then
   rp_script="$(resolve \
     ".augment/scripts/update_roadmap_progress.py" \
     ".agent-src/scripts/update_roadmap_progress.py" \
-    ".agent-src.uncompressed/scripts/update_roadmap_progress.py" || true)"
+    ".agent-src.uncondensed/scripts/update_roadmap_progress.py" || true)"
 
   if [ -z "$rp_script" ]; then
     echo "⚠️  pre-commit: update_roadmap_progress.py not found — skipping roadmap check." >&2

package/.agent-src/templates/persona.md

@@ -1,14 +1,14 @@
 # Persona Template
 
 > Template for creating a new persona in
-> `.agent-src.uncompressed/personas/{persona-id}.md`. Personas declare
+> `.agent-src.uncondensed/personas/{persona-id}.md`. Personas declare
 > a *voice* — focus, mindset, unique questions, output expectations.
 > Skills cite personas in a `personas:` frontmatter key. Users invoke
 > them via `--personas=<id>`.
 
 ## Instructions
 
-1. Create the file: `.agent-src.uncompressed/personas/{persona-id}.md`.
+1. Create the file: `.agent-src.uncondensed/personas/{persona-id}.md`.
 2. Copy the template below.
 3. Replace all `{placeholders}` with real content.
 4. Pass the Unique-Questions heuristic — ≥ 3 questions that no other

package/.agent-src/templates/roadmaps.md

@@ -1,6 +1,6 @@
 # Roadmap Template
 
-Templates for roadmap files stored in `agents/roadmaps/` or `app/Modules/{Module}/agents/roadmaps/`.
+Templates for roadmap files stored in `agents/roadmaps/` or `{module_root}/{Module}/{agent_folder}/roadmaps/` (resolved via `modules.root_paths` + `modules.agent_folder` in `.agent-project-settings.yml`; Laravel example: `app/Modules/{Module}/agents/roadmaps/`).
 
 ---
 

package/.agent-src/templates/rule.md

@@ -1,16 +1,16 @@
 # Rule Template
 
-> Template for creating new rules in `.agent-src.uncompressed/rules/{rule-name}.md`.
-> Rules ship to `.agent-src/rules/` (compressed) and `.augment/rules/` (projected).
+> Template for creating new rules in `.agent-src.uncondensed/rules/{rule-name}.md`.
+> Rules ship to `.agent-src/rules/` (condensed) and `.augment/rules/` (projected).
 > Schema: `scripts/schemas/rule.schema.json`.
 
 ## Instructions
 
 1. Pick a kebab-case `{rule-name}` matching the file stem.
-2. Copy the template below into `.agent-src.uncompressed/rules/{rule-name}.md`.
+2. Copy the template below into `.agent-src.uncondensed/rules/{rule-name}.md`.
 3. Replace placeholders, drop sections that don't apply.
 4. Run `task lint-skills` and `python3 scripts/lint_load_context.py`.
-5. Compress: `bash scripts/compress.sh --changed` then follow the agent flow.
+5. Condense: `bash scripts/condense.sh --changed` then follow the agent flow.
 
 ## Path conventions — load-bearing
 
@@ -21,31 +21,31 @@ consumer's `.augment/`.
 ### `load_context:` / `load_context_eager:` — logical names
 
 Use **logical names** rooted at the source — never the
-`.agent-src.uncompressed/` prefix. The compress-time rewriter
-(`scripts/compress.py::_rewrite_paths`) resolves logical names to
+`.agent-src.uncondensed/` prefix. The condense-time rewriter
+(`scripts/condense.py::_rewrite_paths`) resolves logical names to
 deployment-correct relative paths; the schema regex
 (`scripts/schemas/rule.schema.json`) and `scripts/lint_load_context.py`
 both reject the legacy prefix.
 
 | Write this (logical) | Forbidden (legacy) |
 |---|---|
-| `contexts/execution/verification-mechanics.md` | `.agent-src.uncompressed/contexts/execution/verification-mechanics.md` |
-| `contexts/authority/commit-mechanics.md` | `.agent-src.uncompressed/contexts/authority/commit-mechanics.md` |
-| `agents/settings/contexts/local.md` (project-local) | `.agent-src.uncompressed/contexts/...` for project-only material |
+| `contexts/execution/verification-mechanics.md` | `.agent-src.uncondensed/contexts/execution/verification-mechanics.md` |
+| `contexts/authority/commit-mechanics.md` | `.agent-src.uncondensed/contexts/authority/commit-mechanics.md` |
+| `agents/settings/contexts/local.md` (project-local) | `.agent-src.uncondensed/contexts/...` for project-only material |
 
 ### `triggers[].path_prefix:` — literal match pattern, not a file path
 
 `path_prefix:` is a **literal match pattern** the host evaluates against
 the file the agent is editing — it is **not** a file reference and is
 **not rewritten**. Rules that fire when the agent edits source-of-truth
-files legitimately keep the `.agent-src.uncompressed/` prefix (see
+files legitimately keep the `.agent-src.uncondensed/` prefix (see
 `skill-quality`, `rule-type-governance`,
 `augment-edit-discipline`). Rules that fire on consumer-project paths use
 `agents/`, `lang/`, `.augment/`, etc.
 
 | Use case | Example `path_prefix:` |
 |---|---|
-| Fires when editing source-of-truth artifacts | `.agent-src.uncompressed/skills/` |
+| Fires when editing source-of-truth artifacts | `.agent-src.uncondensed/skills/` |
 | Fires when editing consumer project files | `agents/`, `lang/`, `app/`, `src/` |
 | Fires when editing the projected layer | `.augment/` |
 
@@ -53,13 +53,13 @@ files legitimately keep the `.agent-src.uncompressed/` prefix (see
 
 Source files keep verbatim `../../docs/guidelines/...` and
 `../../docs/contracts/...` links so they work in any markdown viewer.
-The rewriter rewrites them to depth-aware single-up form at compress
+The rewriter rewrites them to depth-aware single-up form at condense
 time and is idempotent. Do not pre-rewrite in source.
 
 ### Why "logical, depth-aware, idempotent"
 
 A rule at `rules/{name}.md` resolves `contexts/{area}/{file}.md` to
-`../contexts/{area}/{file}.md` in the compressed output; a nested
+`../contexts/{area}/{file}.md` in the condensed output; a nested
 file at `commands/{cluster}/{sub}.md` resolves to
 `../../contexts/{area}/{file}.md`. Re-running the rewriter does not
 double-prefix. The full decision history lives in the archived

package/.agent-src/templates/scripts/memory_lookup.py

@@ -439,7 +439,7 @@ def retrieve_v1(
 
     Wraps :func:`retrieve` and projects the internal ``Hit`` shape into
     the shape defined by
-    ``schemas/retrieval-v1.schema.json``. Unknown types are reported as
+    ``internal/schemas/retrieval-v1.schema.json``. Unknown types are reported as
     ``status: unknown_type`` for that slice only, rather than failing
     the whole call.
     """

package/.agent-src/templates/scripts/memory_status.py

@@ -41,7 +41,7 @@ _CACHE_ENV = "AGENT_MEMORY_STATUS"
 _CACHE_FILE = Path(".agent-memory") / "status.cache"
 
 # Retrieval contract version served by the file-backed fallback.
-# Source of truth: schemas/retrieval-v1.schema.json.
+# Source of truth: internal/schemas/retrieval-v1.schema.json.
 CONTRACT_VERSION = 1
 _FILE_BACKEND_VERSION = "0.0.0-file"
 _FILE_BACKEND_FEATURES = ("file-fallback",)
@@ -200,7 +200,7 @@ def status(refresh: bool = False) -> Result:
 def health(refresh: bool = False) -> dict:
     """Return a v1 retrieval-contract health envelope.
 
-    Schema: ``schemas/retrieval-v1.schema.json`` (HealthResponse).
+    Schema: ``internal/schemas/retrieval-v1.schema.json`` (HealthResponse).
     Maps the three-state :func:`status` result onto the contract's
     ``ok | degraded | error`` so consumers can read
     ``contract_version`` without caring about the file-vs-package split.

package/.agent-src/templates/scripts/work_engine/_lib/agent_settings.py

@@ -50,6 +50,7 @@ Contract — pure, read-only, tolerant:
 """
 from __future__ import annotations
 
+import copy
 import logging
 import os
 from pathlib import Path
@@ -60,6 +61,7 @@ from . import user_global_paths
 logger = logging.getLogger(__name__)
 
 DEFAULT_PROJECT_FILE = ".agent-settings.yml"
+DEFAULT_TEAM_FILE = ".agent-project-settings.yml"
 USER_GLOBAL_FILENAME = "agent-settings.yml"
 
 #: Canonical write target under the new ``~/.event4u/agent-config/``
@@ -86,11 +88,25 @@ MERGEABLE_KEYS: tuple[str, ...] = (
     "cost_profile",
     "personal.bot_icon",
     "personal.autonomy",
-    "caveman.speak_scope",
+    "telegraph.speak_scope",
 )
 
 _DEFAULTS: dict[str, Any] = {}
 
+#: Defaults applied by :func:`get_modules_config` when a key is absent
+#: from both the team file and the developer cascade. The values mirror
+#: the ``modules:`` block shipped in
+#: ``templates/agents/agent-project-settings.example.yml``. Lists are
+#: returned as fresh copies — callers may mutate the result safely.
+MODULES_DEFAULTS: dict[str, Any] = {
+    "enabled": False,
+    "root_paths": [],
+    "namespace_template": "",
+    "agent_folder": "agents",
+    "skip_dirs": [".module-template", ".example"],
+    "detection_acknowledged": False,
+}
+
 
 #: Anchor identifier returned by :func:`find_project_root_with_anchor`.
 ANCHOR_AGENT_SETTINGS = "agent-settings"
@@ -470,6 +486,184 @@ def load_agent_settings(
     return merged
 
 
+def get_modules_config(
+    project_root: Path | str | None = None,
+    team_path: Path | str | None = None,
+    project_path: Path | str | None = None,
+    cwd: Path | None = None,
+) -> dict[str, Any]:
+    """Return the merged ``modules:`` configuration with defaults applied.
+
+    Three-tier precedence (deepest wins) per the layered-settings model
+    documented in ``docs/guidelines/agent-infra/layered-settings.md``:
+
+    1. :data:`MODULES_DEFAULTS` — package-shipped defaults.
+    2. Team file — ``<project_root>/.agent-project-settings.yml``
+       (committed, all developers see the same values).
+    3. Developer cascade — every ``.agent-settings.yml`` walked by
+       :func:`_resolve_cascade_paths` (git-ignored local overrides).
+
+    The team layer may pin keys via a top-level ``locked_keys`` list of
+    dotted paths (e.g. ``[modules.root_paths]``). Locked keys discard any
+    matching override from the developer cascade and emit a ``logging``
+    INFO record. Locks are advisory — the team file always wins anyway —
+    but the explicit list makes the intent reviewable and gives the loader
+    a hook for the warning.
+
+    ``project_root`` defaults to ``find_project_root(cwd or Path.cwd())``.
+    ``team_path`` overrides the resolved team-file location for tests.
+    ``project_path`` + ``cwd`` flow through to :func:`load_agent_settings`
+    unchanged.
+
+    Pure, read-only — no file is ever written. Missing files / malformed
+    YAML / absent ``modules:`` block all return the defaults.
+    """
+    cwd_resolved = cwd if cwd is not None else Path.cwd()
+
+    if team_path is not None:
+        team_file = Path(team_path)
+    else:
+        if project_root is not None:
+            root = Path(project_root)
+        else:
+            root = find_project_root(cwd_resolved) or cwd_resolved
+        team_file = root / DEFAULT_TEAM_FILE
+
+    team_raw = _read_yaml(team_file) or {}
+    team_modules = team_raw.get("modules") if isinstance(team_raw.get("modules"), dict) else {}
+    locked_keys_raw = team_raw.get("locked_keys")
+    locked_keys: tuple[str, ...] = tuple(
+        k for k in (locked_keys_raw or []) if isinstance(k, str)
+    )
+
+    dev_merged = load_agent_settings(
+        project_path=project_path,
+        cwd=cwd,
+    )
+    dev_modules = dev_merged.get("modules") if isinstance(dev_merged.get("modules"), dict) else {}
+
+    merged: dict[str, Any] = copy.deepcopy(MODULES_DEFAULTS)
+    if team_modules:
+        _deep_merge(merged, team_modules)
+
+    if dev_modules:
+        for key, value in dev_modules.items():
+            dotted = f"modules.{key}"
+            if dotted in locked_keys and key in (team_modules or {}):
+                logger.info(
+                    "agent_settings: ignoring developer override of locked key %s",
+                    dotted,
+                )
+                continue
+            if isinstance(value, dict) and isinstance(merged.get(key), dict):
+                _deep_merge(merged[key], value)
+            else:
+                merged[key] = value
+
+    return merged
+
+
+def enumerate_modules(
+    project_root: Path | str | None = None,
+    cwd: Path | None = None,
+    modules_config: dict[str, Any] | None = None,
+) -> list[dict[str, Any]]:
+    """Enumerate every module under ``modules.root_paths``.
+
+    Phase D Step 1 of road-to-configurable-modules. For each path in
+    ``modules.root_paths`` (resolved relative to ``project_root``), lists
+    immediate subdirectories that survive the ``modules.skip_dirs`` filter
+    and reports whether each module ships a per-module agent folder
+    (``modules.agent_folder``, default ``agents``).
+
+    Returns a list of dicts \u2014 one per discovered module \u2014 sorted by
+    ``(root_path, name)`` for deterministic output:
+
+    * ``name``               \u2014 directory name of the module
+    * ``root_path``          \u2014 repo-relative root containing the module
+    * ``module_path``        \u2014 repo-relative path to the module itself
+    * ``has_agent_folder``   \u2014 ``True`` iff a directory matching
+      ``modules.agent_folder`` lives directly under the module
+    * ``agent_folder_path``  \u2014 repo-relative path to that folder
+      (``None`` when ``has_agent_folder`` is ``False``)
+
+    Contract:
+
+    * ``modules.enabled`` is **not** consulted \u2014 callers decide whether
+      to skip the call. Disabled projects normally yield ``[]`` because
+      ``root_paths`` is empty by default.
+    * Missing roots are skipped silently (logged at INFO).
+    * Hidden directories (leading ``.``) and entries in
+      ``modules.skip_dirs`` are filtered out.
+    * Symlinks are followed only when they resolve inside the project
+      root \u2014 same boundary as ``find_project_root``.
+    * Pure, read-only \u2014 no file or directory is ever written.
+
+    ``modules_config`` lets tests inject a pre-built dict; when ``None``
+    the function calls :func:`get_modules_config` with the same
+    ``project_root`` / ``cwd`` so the precedence chain matches.
+    """
+    cwd_resolved = cwd if cwd is not None else Path.cwd()
+    if project_root is not None:
+        root = Path(project_root)
+    else:
+        root = find_project_root(cwd_resolved) or cwd_resolved
+    root = root.resolve()
+
+    if modules_config is None:
+        modules_config = get_modules_config(project_root=root, cwd=cwd)
+
+    root_paths_raw = modules_config.get("root_paths") or []
+    skip_dirs_raw = modules_config.get("skip_dirs") or MODULES_DEFAULTS["skip_dirs"]
+    agent_folder = str(modules_config.get("agent_folder") or MODULES_DEFAULTS["agent_folder"])
+
+    skip_dirs: set[str] = {str(s) for s in skip_dirs_raw if isinstance(s, str)}
+
+    discovered: list[dict[str, Any]] = []
+    for raw in root_paths_raw:
+        if not isinstance(raw, str) or not raw.strip():
+            continue
+        root_rel = raw.strip().strip("/")
+        root_abs = (root / root_rel).resolve()
+        try:
+            if not root_abs.is_dir() or not str(root_abs).startswith(str(root)):
+                logger.info("enumerate_modules: skipping missing/out-of-tree root %s", root_rel)
+                continue
+        except OSError:
+            logger.info("enumerate_modules: unreadable root %s", root_rel)
+            continue
+
+        try:
+            children = sorted(root_abs.iterdir(), key=lambda p: p.name)
+        except OSError:
+            logger.info("enumerate_modules: cannot list %s", root_rel)
+            continue
+
+        for child in children:
+            name = child.name
+            if name.startswith(".") or name in skip_dirs:
+                continue
+            if not child.is_dir():
+                continue
+            agent_dir = child / agent_folder
+            has_agent = agent_dir.is_dir()
+            try:
+                module_rel = child.resolve().relative_to(root)
+            except ValueError:
+                continue
+            entry: dict[str, Any] = {
+                "name": name,
+                "root_path": root_rel,
+                "module_path": str(module_rel),
+                "has_agent_folder": has_agent,
+                "agent_folder_path": str(module_rel / agent_folder) if has_agent else None,
+            }
+            discovered.append(entry)
+
+    discovered.sort(key=lambda m: (m["root_path"], m["name"]))
+    return discovered
+
+
 def iter_setting_overrides(
     project_path: Path | str | None = None,
     user_global_path: Path | str | None = None,

package/.agent-src/templates/scripts/work_engine/orchestration.py

@@ -61,7 +61,7 @@ def _load_pipeline(path: Path) -> dict[str, Any]:
     loader is reachable both when this module runs from the consumer
     projection (``.agent-src/templates/scripts/work_engine/``) and
     from the source-of-truth tree
-    (``packages/<pack>/.agent-src.uncompressed/templates/scripts/work_engine/``).
+    (``packages/<pack>/.agent-src.uncondensed/templates/scripts/work_engine/``).
     Loaded via ``importlib.util`` by file path to avoid namespace
     collisions with test packages named ``hooks``.
     """

package/.agent-src/templates/skill-archive-note.md

@@ -3,7 +3,7 @@
 > Template for `agents/evidence/archived-skills/<slug>.md`. Created during
 > `step-2-skill-inventory-rationalization.md`
 > Phase 4 execution. Every skill removed from
-> `.agent-src.uncompressed/skills/` MUST have a matching archive note
+> `.agent-src.uncondensed/skills/` MUST have a matching archive note
 > here — enforced by `scripts/lint_archived_skills.py`.
 
 ## Instructions
@@ -78,7 +78,7 @@ references the removed slug without pointing at this note.}
     relationship documented in the successor's frontmatter).
   - `deprecated` — capability retired; no successor needed.
 - **`replacement`** — successor slug (must exist under
-  `.agent-src.uncompressed/skills/`) or literal `none`. The linter
+  `.agent-src.uncondensed/skills/`) or literal `none`. The linter
   validates the successor's existence.
 - **`last_known_callers`** — references found by
   `scripts/check_references.py` at archival time. Empty list is valid
@@ -92,10 +92,10 @@ references the removed slug without pointing at this note.}
    has a frontmatter block with the six required fields.
 2. `reason` is one of the four allowed values.
 3. When `reason ∈ {merged, superseded}`, the `replacement` slug exists
-   under `.agent-src.uncompressed/skills/`.
+   under `.agent-src.uncondensed/skills/`.
 4. Every slug under `agents/evidence/archived-skills/` is *absent* from
-   `.agent-src.uncompressed/skills/` (no zombies).
-5. No SKILL.md present under `.agent-src.uncompressed/skills/`
+   `.agent-src.uncondensed/skills/` (no zombies).
+5. No SKILL.md present under `.agent-src.uncondensed/skills/`
    references an archived slug as a router target.
 
 Run via `task lint-archived-skills`. Included in `task ci`.

package/.agent-src/templates/skill.md

@@ -170,7 +170,7 @@ Do NOT use when:
 
 <!-- SENIOR-TIER STUB BLOCKS (delete entire section if not `tier: senior`):
   Senior-tier skills (frontmatter `tier: senior`) require four extra
-  blocks per `.agent-src.uncompressed/rules/skill-quality.md` §
+  blocks per `.agent-src.uncondensed/rules/skill-quality.md` §
   Senior-Tier Required Structure. Mid-tier and untiered skills MUST
   remove this section entirely. The four blocks are enforced by
   `scripts/skill_linter.py` for `tier: senior` skills only.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Shared agent configuration \u2014 skills for AI coding tools (Claude Code, Augment, Cursor, Cline, Windsurf, Gemini CLI).",
-    "version": "3.3.0",
+    "version": "4.2.0",
     "keywords": [
       "agent-config",
       "skills",
@@ -102,8 +102,8 @@
         "./.claude/skills/competitive-moat-analysis",
         "./.claude/skills/competitive-positioning",
         "./.claude/skills/composer-packages",
-        "./.claude/skills/compress",
-        "./.claude/skills/compress-memory",
+        "./.claude/skills/condense",
+        "./.claude/skills/condense-memory",
         "./.claude/skills/content-funnel-design",
         "./.claude/skills/context",
         "./.claude/skills/context-authoring",
@@ -189,7 +189,6 @@
         "./.claude/skills/hiring-loop-design",
         "./.claude/skills/implement-ticket",
         "./.claude/skills/incident-commander",
-        "./.claude/skills/install-via-agent",
         "./.claude/skills/jira-integration",
         "./.claude/skills/jira-ticket",
         "./.claude/skills/jobs-events",
@@ -245,6 +244,7 @@
         "./.claude/skills/mode",
         "./.claude/skills/module",
         "./.claude/skills/module-create",
+        "./.claude/skills/module-detect-on-the-fly",
         "./.claude/skills/module-explore",
         "./.claude/skills/module-management",
         "./.claude/skills/motion-choreographer",

package/AGENTS.md

@@ -1,10 +1,10 @@
 # event4u/agent-config
 
-> Shared skill / rule / command suite for AI coding tools. No application runtime. AGENTS.md of the **package itself**.
+> Shared skill / rule / command suite for AI coding tools. No app runtime. AGENTS.md of the **package itself**.
 
 ## Source of truth
 
-Edit `packages/<pack>/.agent-src.uncompressed/` only. Generated trees regenerate from `task sync` + `task generate-tools`; never hand-edit.
+Edit `packages/<pack>/.agent-src.uncondensed/` only. Generated trees regenerate from `task sync` + `task generate-tools`; never hand-edit.
 
 ## Working on this repo
 
@@ -17,22 +17,21 @@ task ci                # full pipeline — green before PR
 
 ## Pointers
 
-- **Package self-orientation** — identity, cognition map, layout, stack, key rules, telemetry: [`package-self-orientation`](docs/contracts/package-self-orientation.md).
-- **Kernel + Router** — 9 Iron-Law rules, tier-1/2 routing, cost profiles, per-rule caps: [`kernel-membership`](docs/contracts/kernel-membership.md) + [`rule-router`](docs/contracts/rule-router.md).
-- **Trust & Safety** — trust-level enum, HRR banner, safety floors, installer confirm: [`trust-and-safety`](docs/contracts/trust-and-safety.md) + [`ADR-018`](docs/decisions/ADR-018-trust-and-safety-layer.md).
-- **Content pipelines** — A→D source / Augment / multi-tool / Claude.ai-bundle projections indexed at [`docs/architecture.md`](docs/architecture.md).
-- **Editing this repo** — Iron-Law rules + Thin-Root contract govern every edit: [`augment-source-of-truth`](.agent-src/rules/augment-source-of-truth.md) + [`agents-md-thin-root`](.agent-src/skills/agents-md-thin-root/SKILL.md).
-- **Consumer story** — `npx` + `scripts/install.sh` opt-in flags, sandbox / offline install paths, verified-offline manifest: [`README.md`](README.md).
-- **Personas** — 11 review-lens cast (6 core · 5 specialist), `personas:` vs `/mode`: [`docs/personas.md`](docs/personas.md).
-- **Discovery** — workspaces / packs / dist manifest: [`ADR-013`](docs/decisions/ADR-013-discovery-frontmatter-contract.md) + [`customization`](docs/customization.md#workspaces--packs-discovery).
-- **Root layout** — maintainer-only dirs (`bench`, `evals`, `workers`) live under [`internal/`](internal/README.md) per [`ADR-028`](docs/decisions/ADR-028-root-layout.md).
+- **Self-orientation** — identity / map / stack: [`package-self-orientation`](docs/contracts/package-self-orientation.md).
+- **Kernel + Router** — 9 Iron-Law rules + tier-1/2 routing: [`kernel-membership`](docs/contracts/kernel-membership.md) + [`rule-router`](docs/contracts/rule-router.md).
+- **Trust & Safety** — trust-level enum, HRR banner, safety floors: [`trust-and-safety`](docs/contracts/trust-and-safety.md) + [`ADR-018`](docs/decisions/ADR-018-trust-and-safety-layer.md).
+- **Content pipelines** — A→D source / Augment / multi-tool / Claude.ai-bundle: [`docs/architecture.md`](docs/architecture.md).
+- **Editing this repo** — Iron-Law rules + Thin-Root contract: [`augment-source-of-truth`](.agent-src/rules/augment-source-of-truth.md) + [`agents-md-thin-root`](.agent-src/skills/agents-md-thin-root/SKILL.md).
+- **Consumer story** — `npx` + `scripts/install.sh`, sandbox / offline paths: [`README.md`](README.md).
+- **Personas** — 11 review lenses (6 + 5): [`docs/personas.md`](docs/personas.md).
+- **Discovery** — workspaces / packs manifest: [`ADR-013`](docs/decisions/ADR-013-discovery-frontmatter-contract.md) + [`customization`](docs/customization.md#workspaces--packs-discovery).
+- **Root layout** — maintainer items in [`internal/`](internal/README.md) per [`ADR-028`](docs/decisions/ADR-028-root-layout.md); per-tool toggle: `agents/.agent-tools.yml`.
 
 ## Emergency triage — read this when nothing else is reachable
 
-1. **What is this repo?** — `event4u/agent-config`, a governed skill / rule / command suite for AI coding tools (no application runtime).
-2. **What language?** — All `.md` content is English; agents mirror the user's language at runtime.
-3. **Where do I edit?** — `packages/<pack>/.agent-src.uncompressed/` only. Never the generated trees.
+1. **What is this repo?** — `event4u/agent-config`, a governed skill / rule / command suite for AI coding tools (no app runtime).
+2. **What language?** — All `.md` is English; agents mirror the user's language at runtime.
+3. **Where do I edit?** — `packages/<pack>/.agent-src.uncondensed/` only. Never the generated trees.
 4. **Lint / test / sync entry point?** — `task ci` (full pipeline). Subsets: `task sync`, `task generate-tools`, `task lint-skills`, `task test`.
-5. **Where do the always-active rules live?** — `.agent-src/rules/` (kernel = 9 Iron-Law rules; tier-1 / tier-2 routed via `dist/router.json`).
-
-
+5. **Where do the always-active rules live?** — `.agent-src/rules/` (kernel = 9 Iron-Law rules; tier-1 / 2 via `dist/router.json`).
+6. **CI checks?** — `task ci:required-checks` previews per [`branch-protection-policy.md`](docs/contracts/branch-protection-policy.md); merge floor [`ci-green-floor.md`](docs/contracts/ci-green-floor.md); release [`release-pr-gating.md`](docs/contracts/release-pr-gating.md).