@event4u/agent-config 5.1.0 → 5.3.0

package/.agent-src/skills/test-performance/SKILL.md

@@ -1,21 +1,12 @@
 ---
 name: test-performance
 description: "Use when optimizing test suite performance — database setup, seeder optimization, parallel testing, CI pipeline efficiency, or RefreshDatabase alternatives."
-source: package
 domain: quality
 framework: laravel
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # test-performance

package/.agent-src/skills/testing-anti-patterns/SKILL.md

@@ -1,20 +1,11 @@
 ---
 name: testing-anti-patterns
 description: "Use BEFORE writing or changing tests, adding mocks, or putting test-only methods on production classes — five Iron Laws and gates against mocking-the-mock, production pollution, silent partial mocks."
-source: package
 domain: quality
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # testing-anti-patterns

package/.agent-src/skills/threat-modeling/SKILL.md

@@ -3,21 +3,12 @@ name: threat-modeling
 description: "Use when adding auth, webhooks, uploads, queues, secrets, tenant boundaries, or public endpoints — produces trust boundaries + abuse cases mapped to files, BEFORE implementation."
 personas:
   - security-engineer
-source: package
 domain: quality
 council_depth: deep
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # threat-modeling

package/.agent-src/skills/throughput-vs-morale-tradeoff/SKILL.md

@@ -3,20 +3,15 @@ name: throughput-vs-morale-tradeoff
 description: "Use when balancing eng-team velocity vs quality vs burnout — on-call load, focus fragmentation, reorg shock. Triggers on 'team is burning out', 'why is velocity dropping'."
 status: active
 tier: senior
-source: package
 domain: process
 context_spine: [org-stage, product, customer-segment]
 workspaces:
   - ops
 packs:
   - ops-people
-lifecycle: active
 trust:
   level: professional
-  confidence: high
-  human_review_required: false
 install:
-  default: true
   removable: true
 ---
 

package/.agent-src/skills/token-optimizer/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: token-optimizer
 description: "Use BEFORE any verbose CLI run, large file read, doc conversion, or near-context handoff — single decision tree keyed by intent that cites the canonical token-saving asset. Consult before the action."
-source: package
 domain: process
 execution:
   type: assisted
@@ -11,14 +10,6 @@ workspaces:
   - agent-config-maintainer
 packs:
   - meta
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # Token Optimizer — decision tree + catalog

package/.agent-src/skills/traefik/SKILL.md

@@ -1,20 +1,11 @@
 ---
 name: traefik
 description: "Use when setting up Traefik as a local reverse proxy — real domains on 127.0.0.1, trusted HTTPS via mkcert, automatic service discovery, and multi-project routing."
-source: package
 domain: devops
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # Traefik Skill

package/.agent-src/skills/ui-component-architect/SKILL.md

@@ -3,20 +3,11 @@ name: ui-component-architect
 description: "Use when shaping a UI component tree — composition vs inheritance, slot patterns, prop API design, controlled vs uncontrolled, polymorphic — even on 'split this component'."
 personas:
   - frontend-engineer
-source: package
 domain: engineering
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # ui-component-architect

package/.agent-src/skills/unit-economics-modeling/SKILL.md

@@ -3,7 +3,6 @@ name: unit-economics-modeling
 description: "Use when modeling CAC, LTV, payback, contribution margin, or burn-multiple per customer — SaaS, marketplace, or transactional. Triggers on 'are we unit-economic', 'what is our LTV/CAC'."
 status: active
 tier: senior
-source: package
 domain: product
 context_spine: [product, fiscal-period]
 recommended_for_user_types: [founder, finance]
@@ -11,13 +10,9 @@ workspaces:
   - finance
 packs:
   - finance-basic
-lifecycle: active
 trust:
   level: professional
-  confidence: high
-  human_review_required: false
 install:
-  default: true
   removable: true
 ---
 

package/.agent-src/skills/universal-project-analysis/SKILL.md

@@ -1,20 +1,11 @@
 ---
 name: universal-project-analysis
 description: "ONLY when user asks for deep multi-pass codebase audit — orchestrator routing to `project-analysis-core` + framework-specific `project-analysis-*`. Single-pass scan → `project-analyzer`."
-source: package
 domain: discovery
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # universal-project-analysis

package/.agent-src/skills/upstream-contribute/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: upstream-contribute
 description: "Use when a learning, new skill, rule improvement, or bug fix from a consumer project should be contributed back to the shared agent-config package."
-source: package
 domain: process
 execution:
   type: assisted
@@ -11,14 +10,6 @@ workspaces:
   - agent-config-maintainer
 packs:
   - meta
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # upstream-contribute

package/.agent-src/skills/using-git-worktrees/SKILL.md

@@ -1,20 +1,11 @@
 ---
 name: using-git-worktrees
 description: "Use when starting parallel work in isolation from the current branch — spawn a git worktree with ignore-safety checks and a clean test baseline — even when the user says 'try this on the side'."
-source: package
 domain: process
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # using-git-worktrees

package/.agent-src/skills/validate-feature-fit/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: "validate-feature-fit"
 description: "Validate whether a feature request fits the existing codebase — check for duplicates, contradictions, scope creep, and architectural misfit"
-source: package
 domain: quality
 execution:
   type: assisted
@@ -11,14 +10,6 @@ workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # Validate Feature Fit

package/.agent-src/skills/verify-completion-evidence/SKILL.md

@@ -1,20 +1,11 @@
 ---
 name: verify-completion-evidence
 description: "Use when claiming 'done', suggesting a commit, push, or PR — runs the evidence gate so completion claims come from fresh output in this message, not memory or earlier runs."
-source: package
 domain: quality
 workspaces:
   - engineering
 packs:
   - engineering-base
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
-install:
-  default: true
-  removable: false
 ---
 
 # verify-completion-evidence

package/.agent-src/skills/video-director/SKILL.md

@@ -3,7 +3,6 @@ name: video-director
 description: "Use when turning a scene idea into the 11-block cinematic prompt for live-action AI video — lens, lighting, blocking, motion, negatives. Triggers 'cinematic prompt', 'film-grade scene'."
 personas:
   - hollywood-director
-source: package
 domain: product
 workspaces:
   - small-business
@@ -12,8 +11,6 @@ packs:
 lifecycle: experimental
 trust:
   level: experimental
-  confidence: high
-  human_review_required: false
 install:
   default: false
   removable: true

package/.agent-src/skills/vision-articulation/SKILL.md

@@ -3,20 +3,13 @@ name: vision-articulation
 description: "Use when articulating internal vision — where we're going / why now / why us, founder-mode anchor, distinct from fundraising pitch. Triggers on 'what's our vision', 'why are we doing this'."
 status: active
 tier: senior
-source: package
 domain: process
 context_spine: [org-stage, product, customer-segment]
 workspaces:
   - founder
 packs:
   - founder-strategy
-lifecycle: active
-trust:
-  level: core
-  confidence: high
-  human_review_required: false
 install:
-  default: true
   removable: true
 ---
 

package/.agent-src/skills/voc-extract/SKILL.md

@@ -3,7 +3,6 @@ name: voc-extract
 description: "Use when extracting Voice-of-Customer themes from existing artefacts — GH issues, PR threads, Sentry patterns. Triggers on 'what are users saying', 'recurring complaints', 'top themes'."
 status: active
 tier: senior
-source: package
 domain: product
 context_spine: [product]
 recommended_for_user_types: [gtm, creator]
@@ -11,11 +10,8 @@ workspaces:
   - product
 packs:
   - product-discovery
-lifecycle: active
 trust:
   level: professional
-  confidence: high
-  human_review_required: false
 install:
   default: false
   removable: true

package/.agent-src/skills/voice-and-tone-design/SKILL.md

@@ -3,7 +3,6 @@ name: voice-and-tone-design
 description: "Use when shaping brand voice — voice attributes, tone-by-context matrix, consistency review. Triggers on 'define our voice', 'why does our copy sound different on every surface'."
 status: active
 tier: senior
-source: package
 domain: product
 context_spine: [product, customer-segment]
 recommended_for_user_types: [creator, consultant, gtm]
@@ -11,13 +10,9 @@ workspaces:
   - gtm
 packs:
   - gtm-marketing
-lifecycle: active
 trust:
   level: professional
-  confidence: high
-  human_review_required: false
 install:
-  default: true
   removable: true
 ---
 

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Shared agent configuration \u2014 skills for AI coding tools (Claude Code, Augment, Cursor, Cline, Windsurf, Gemini CLI).",
-    "version": "5.1.0",
+    "version": "5.3.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -802,6 +802,54 @@ our recommendation order, not its support status.
 > that forces a new era split (`# Era: 4.6.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [5.3.0](https://github.com/event4u-app/agent-config/compare/5.2.0...5.3.0) (2026-05-30)
+
+### Features
+
+* **ci:** lint frontmatter fields equal to their schema default ([3f56ed7](https://github.com/event4u-app/agent-config/commit/3f56ed74fae3fe20346130c790db2929093ae095))
+* **frontmatter:** add idempotent migrate_frontmatter_defaults script ([8c2d56d](https://github.com/event4u-app/agent-config/commit/8c2d56ddb17585540fef83589f5e3207e6583d4a))
+* **frontmatter:** inject schema defaults in discovery, checksum + condense consumers ([a69e51e](https://github.com/event4u-app/agent-config/commit/a69e51ef7b58d0f5e0eda2a600ce090ab203bef2))
+* **frontmatter:** declare schema defaults + inject them in the loader ([6de22ce](https://github.com/event4u-app/agent-config/commit/6de22ce9d89dc648b42b312e0694c621207ccad3))
+
+### Bug Fixes
+
+* **smoke:** inject schema defaults in skills smoke validation ([fc6524b](https://github.com/event4u-app/agent-config/commit/fc6524bc51f595de5a9173309fad17f321a7c892))
+* **lint:** re-anchor framework-leakage allowlist after frontmatter line shift ([13f5e5e](https://github.com/event4u-app/agent-config/commit/13f5e5ea7f933d5cb66550c4e90cd714c7683b87))
+* **frontmatter:** inject schema defaults in skill_linter; update frontmatter tests ([fff4b12](https://github.com/event4u-app/agent-config/commit/fff4b121fa318b0985a51287095b200b3d008642))
+
+### Documentation
+
+* **roadmap:** close + archive abstraction-reduction roadmap with evidence ([fcb8a33](https://github.com/event4u-app/agent-config/commit/fcb8a3322dcb2dc5f89c85c4132bab9286b2164a))
+* **roadmaps:** land Phase 0 preflight for frontmatter-defaults reduction ([70bd300](https://github.com/event4u-app/agent-config/commit/70bd300ef70f55344a22685545a21e2dc795d98b))
+
+### Refactoring
+
+* **frontmatter:** omit fields equal to their schema default across all artefacts ([bd8bc57](https://github.com/event4u-app/agent-config/commit/bd8bc57e104cc82a713f523f5f510e033688771f))
+
+### Chores
+
+* **frontmatter:** drop defaulted fields from the condensed .agent-src tree ([58e2c2a](https://github.com/event4u-app/agent-config/commit/58e2c2a6fc7cf7011e6c9b00801c9f8ff1412684))
+* **roadmaps:** archive road-to-distribution-identity — CI green on PR #290 ([2ffeb62](https://github.com/event4u-app/agent-config/commit/2ffeb6239697228541334c7e234554f77c6935aa))
+* **roadmaps:** flip Phase 0 checkboxes + regen dashboard ([070e33e](https://github.com/event4u-app/agent-config/commit/070e33e4fd704ec0257f4c5cf6a72052c97796d3))
+
+Tests: 5236 (+50 since 5.2.0)
+
+## [5.2.0](https://github.com/event4u-app/agent-config/compare/5.1.0...5.2.0) (2026-05-29)
+
+### Features
+
+* **ci:** reject sloppy commit subjects before they leak into the changelog ([26a94e9](https://github.com/event4u-app/agent-config/commit/26a94e9e0f07e862a135cfc96b742a999e7131ec))
+
+### Documentation
+
+* **adr:** land ADR-033 distribution-identity npm-primary ([63d38cf](https://github.com/event4u-app/agent-config/commit/63d38cf75df6506218cfc6bc17f0b5ba0c90fe9d))
+
+### Chores
+
+* **roadmaps:** flip distribution-identity Phase 1-3 + regen dashboard ([0885b9d](https://github.com/event4u-app/agent-config/commit/0885b9d4dda67a2439fc5292367249fa99766a02))
+
+Tests: 5186 (+26 since 5.1.0)
+
 ## [5.1.0](https://github.com/event4u-app/agent-config/compare/5.0.0...5.1.0) (2026-05-29)
 
 ### Features

package/README.md

@@ -37,10 +37,15 @@ Beyond software: [`user-types/`](packages/core/.agent-src.uncondensed/user-types
 
 <p align="center">
   <a href="CHANGELOG.md">CHANGELOG</a> ·
+  <a href="CHANGELOG.md#breaking--v400-unified-setup-road-to-unified-setup">Breaking changes</a> ·
   <a href="https://github.com/event4u-app/agent-config/releases/latest">Latest release</a> ·
   <a href="https://github.com/event4u-app/agent-config/discussions">Discussions</a>
 </p>
 
+<p align="center">
+  <sub>Distribution: <code>npm install @event4u/agent-config</code> · npm-primary per <a href="docs/decisions/ADR-033-distribution-identity-npm-primary.md">ADR-033</a>. Major bumps follow <a href="CONTRIBUTING.md#versioning-policy">semver</a>; each ships a <a href="CHANGELOG.md#breaking--v400-unified-setup-road-to-unified-setup"><code>### Breaking</code></a> entry.</sub>
+</p>
+
 ---
 
 ## Use it in your project

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-05-29T12:00:12Z`
+- Generated: `2026-05-30T00:59:09Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -9452,7 +9452,7 @@
       ]
     }
   ],
-  "checksum": "sha256:653636e679543062954910f794e458eb8424d7f2618b889a29969d21c74fcf0e",
+  "checksum": "sha256:d8c983ca423afbd1d33c0dedcd540c3d13f2ae9399a6d8f2754c3a44dbc2cabf",
   "documented_unassigned": [
     {
       "category": "template",
@@ -9565,7 +9565,7 @@
       "reason": "scaffold for new SKILL.md authoring"
     }
   ],
-  "generated_at": "2026-05-29T12:00:12Z",
+  "generated_at": "2026-05-30T00:59:09Z",
   "packs": [
     {
       "artefact_count": 85,
@@ -9988,7 +9988,7 @@
       ]
     }
   ],
-  "scanner_version": "d75eba636abb",
+  "scanner_version": "ca7acd2ec7af",
   "stats": {
     "by_category": {
       "command": 135,

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-6e36d1bdab54a687328a853b8cbeee77060ad359c006180c0109daa959eba603  discovery-manifest.json
+0e6f98f480590a02c00ae69b1276d91e390bd62bd3a6652ee7bd53afcc49c225  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,7 +1,7 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-05-29T12:00:12Z`
-- Scanner: `d75eba636abb`
+- Generated: `2026-05-30T00:59:09Z`
+- Scanner: `ca7acd2ec7af`
 - Artefacts: **433**
 - Unassigned: **0**
 

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-05-29T12:00:12Z`
+- Generated: `2026-05-30T00:59:09Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:653636e679543062954910f794e458eb8424d7f2618b889a29969d21c74fcf0e",
-  "generated_at": "2026-05-29T12:00:12Z",
+  "checksum": "sha256:d8c983ca423afbd1d33c0dedcd540c3d13f2ae9399a6d8f2754c3a44dbc2cabf",
+  "generated_at": "2026-05-30T00:59:09Z",
   "packs": [
     {
       "artefact_count": 85,
@@ -1029,5 +1029,5 @@
       ]
     }
   ],
-  "scanner_version": "d75eba636abb"
+  "scanner_version": "ca7acd2ec7af"
 }

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-05-29T12:00:12Z`
+- Generated: `2026-05-30T00:59:09Z`
 - Workspaces tracked: **8**
 - Human-review-required artefacts: **2**
 

package/dist/discovery/workspaces.json

@@ -1,7 +1,7 @@
 {
-  "checksum": "sha256:653636e679543062954910f794e458eb8424d7f2618b889a29969d21c74fcf0e",
-  "generated_at": "2026-05-29T12:00:12Z",
-  "scanner_version": "d75eba636abb",
+  "checksum": "sha256:d8c983ca423afbd1d33c0dedcd540c3d13f2ae9399a6d8f2754c3a44dbc2cabf",
+  "generated_at": "2026-05-30T00:59:09Z",
+  "scanner_version": "ca7acd2ec7af",
   "workspaces": [
     {
       "artefact_count": 126,

package/dist/mcp/registry-manifest.json

@@ -1,15 +1,15 @@
 {
   "discovery": {
     "artefact_count": 433,
-    "scanner_version": "d75eba636abb"
+    "scanner_version": "ca7acd2ec7af"
   },
-  "generated_at": "2026-05-29",
+  "generated_at": "2026-05-30",
   "package": {
     "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "homepage": "https://github.com/event4u-app/agent-config#readme",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "5.1.0"
+    "version": "5.3.0"
   },
   "registries": [
     {

package/docs/decisions/ADR-033-distribution-identity-npm-primary.md

@@ -0,0 +1,81 @@
+---
+adr: 033
+status: accepted
+date: 2026-05-29
+decision: distribution-identity-npm-primary
+supersedes: —
+superseded_by: —
+phase: distribution-identity
+type: structural
+review_date: 2026-08-29
+---
+
+# ADR-033 — Distribution identity: npm-primary, Packagist deprecated-in-place
+
+## Status
+
+**Accepted** · 2026-05-29. AI Council (claude-sonnet-4-5 + gpt-4o, analysis lens, 2026-05-29) converged on **npm-primary with Packagist deprecated-in-place**. No maintainer veto surfaced; the de-facto evidence and the operational-honesty argument both point to a single answer. Review date 2026-08-29.
+
+## Context
+
+External feedback rounds 10 / 12 / 13 returned to two recurring symptoms — *"Packagist still shows 1.0.4"* and *"two major bumps in six days with no breaking-change signal"*. A council deliberation (lens: analysis) re-framed both as **one distribution-identity question** the repo has answered in practice but never recorded:
+
+- **`package.json` at `5.1.0`** — the package is past the unified-setup 4.0.0 major and a subsequent 5.0.0 line; semver discipline (per `CONTRIBUTING.md § Versioning policy`) treats installer-layout changes as major, so the cadence is policy-correct.
+- **`scripts/release.py` invokes `npm publish` exclusively** — the only publish surface that ships from a release run.
+- **No `composer.json` exists in this repo** — the file was removed during the npm pivot (pre-3.x era). The Packagist `event4u/agent-config` 1.0.4 listing is a zombie pointing at a repository state that no longer exists.
+- **No automation syncs the Composer surface** — none has existed since the pivot. Pretending the channel is supported is a maintenance lie.
+- **ADR-027** already locks the changelog-machine path (`scripts/release.py` derives `CHANGELOG.md § Breaking` from Conventional Commits). The "no breaking-change signal" symptom is stale against that surface — what is missing is a one-click pointer for consumers.
+
+Council framing — two perspectives surfaced:
+
+**Lens A — Strategic / consumer-positioning.** A consumer who lands on Packagist sees 1.0.4 and installs an artefact the repo cannot support. The honest signal is deprecation; dual-track without resources is worse than a single declared channel.
+
+**Lens B — Technical / operational-honesty.** A channel is "supported" only if a release pipeline publishes to it. Composer/Packagist has had no such pipeline since the npm pivot. The simpler invariant — *one channel, one truth* — wins on every measurable axis: maintenance load, consumer trust, audit clarity.
+
+Both lenses converged.
+
+## Decision
+
+1. **The package is npm-primary.** The canonical install path is `npm install @event4u/agent-config` (and the consumer-facing `npx @event4u/agent-config install` wizard). All release tooling (`scripts/release.py`, `package.json`, `CONTRIBUTING.md § Versioning policy`) already aligns with this surface — this ADR records the policy, no code changes follow from the declaration itself.
+
+2. **Composer / Packagist is deprecated-in-place.** No `composer.json` ships from this repo; no PHP autoload surface is supported; the Packagist `event4u/agent-config` 1.0.4 listing is treated as legacy and gets a deprecation pointer through the only mechanism available to a deleted-composer-json repo: a registry-side claim/archive action by the maintainer. The corresponding human-owner item is surfaced in `docs/distribution/registries.md` (see Phase 2 of the [`road-to-distribution-identity.md`](../../agents/roadmaps/road-to-distribution-identity.md) roadmap).
+
+3. **Breaking-change communication uses `CHANGELOG.md § Breaking`.** ADR-027 locked the auto-generated changelog from Conventional Commits. This ADR adds one consumer-facing affordance — a README / distribution-doc pointer linking that section — so a consumer who sees a major-version bump has a one-click path to *what broke, what to do*. No new `BREAKING_CHANGES.md` file unless the maintainer prefers one.
+
+4. **Commit-subject hygiene is enforced in CI.** Because the changelog generator reads commit subjects verbatim, sloppy subjects (`leftover`, `wip`, `temp`, `fixup`, or sub-10-character one-word entries) leak directly into the public changelog. A CI lint (`task lint-commit-subjects` or sibling) rejects those subjects on PR. This is wired in Phase 3 of the same roadmap and is the one hygiene item that ties directly to distribution identity.
+
+## Consequences
+
+**Positive:**
+
+- The distribution story is **single-channel, single-truth**. Anyone scanning the package — consumer, contributor, auditor, package-registry crawler — gets one consistent answer.
+- The zombie Packagist listing no longer misdirects PHP-shop consumers (once the maintainer files the registry-side archive action).
+- Breaking-change discoverability is two clicks from the README: "release notes" → `CHANGELOG.md § Breaking`. No bespoke `BREAKING_CHANGES.md` to maintain.
+- CI catches sloppy commit subjects before they become public changelog lines — the changelog is as clean as the gate that feeds it.
+
+**Negative / accepted costs:**
+
+- A PHP-shop consumer who depends on the 1.0.4 Packagist release is left behind. Mitigation: clear deprecation notice + npm install pointer in the registry-side archive.
+- The maintainer must perform a one-time login at `packagist.org/packages/event4u/agent-config` to claim or archive the listing — autonomous tooling cannot do that.
+- Future re-entry into the Composer ecosystem would require a new ADR superseding this one. That cost is acceptable: a re-entry would be a strategic redirect, not a quiet re-add.
+
+**Operationally neutral:**
+
+- `scripts/release.py` already does the right thing; no script change follows from this ADR.
+- `CONTRIBUTING.md § Versioning policy` already does the right thing; no policy change follows from this ADR. The major bumps that prompted the feedback (4.0.0 unified-setup, 5.0.0 follow-up) were policy-correct under the existing rule.
+
+## Alternatives considered
+
+- **Dual-track with auto-sync.** Rejected. The repo carries no Composer surface to sync; restoring one would mean re-introducing a `composer.json` + a sync pipeline + a PHP-side autoload story, all to support a consumer base nobody has named. The carrying cost outweighs the demand signal.
+- **Dual-track without auto-sync (status quo).** Rejected. This is the failure mode that produced the external feedback in the first place — a stale 1.0.4 listing pretends a channel is supported when it is not. Operational-honesty argument carries.
+- **Re-introduce composer.json as a stub linking to npm.** Rejected. A stub on Packagist is still a Packagist artifact; consumers may still try to `composer require` it and hit a non-functional package. Registry-side archive is the cleaner signal.
+- **A bespoke `BREAKING_CHANGES.md` file.** Rejected by default; ADR-027 already locks the machine-generated changelog as the breaking-change surface. Maintainer may revisit if the changelog format proves insufficient for end-of-life or migration-guide-shape communication.
+
+## References
+
+- [`agents/roadmaps/road-to-distribution-identity.md`](../../agents/roadmaps/road-to-distribution-identity.md) — the work-item plan this ADR underwrites.
+- [`ADR-027-changelog-machine-vs-manual.md`](ADR-027-changelog-machine-vs-manual.md) — the prior decision locking the auto-generated changelog.
+- [`CONTRIBUTING.md § Versioning policy`](../../CONTRIBUTING.md) — the semver discipline this ADR confirms.
+- [`docs/distribution/registries.md`](../distribution/registries.md) — external-registry submission posture; this ADR adds a distribution-channel-identity section to that file.
+- `scripts/release.py` — the `npm publish` release pipeline.
+- External feedback rounds 10 / 12 / 13 (private session transcripts; convergence summary inlined above to keep this ADR self-contained).