@event4u/agent-config 5.10.1 → 6.1.0

package/docs/contracts/command-clusters.md

@@ -33,15 +33,15 @@ column 1 of this table.
 | `feature` | 1 | `explore` · `plan` · `refactor` · `roadmap` · `dev` | `feature-explore` · `feature-plan` · `feature-refactor` · `feature-roadmap` · `feature-dev` |
 | `chat-history` | 2 | `show` · `import` · `learn` | `chat-history` (legacy status) — `resume` / `clear` / `checkpoint` removed in `road-to-chat-history-hook-only` (auto-adopt + structural hooks); `import` (verbatim cross-session render) and `learn` (project-improving learning extraction) added in the v4 stateless schema |
 | `agents` | 2 | `init` · `optimize` · `audit` · `user` | AGENTS.md file family (high-frequency) — repurposed 2026-05-09: `init` (was `/copilot-agents init`) · `optimize` (merger of `/optimize agents-md` + `/copilot-agents optimize`) · `audit` (was `/optimize agents`, collapses old `audit` + `check` verbs); legacy folder ops (`prepare` / `cleanup` / folder-`audit`) moved to `/optimize agents-dir`; `user` sub-cluster added 2026-05-15 — manages the project-root `.agent-user.md` persona file (sub-sub-commands: `init` · `show` · `review` · `accept` · `update`) per [`agent-user-schema`](agent-user-schema.md) |
-| `memory` | 2 | `add` · `load` · `promote` · `propose` · `mine-session` · `learn-low-impact` | `memory-add` · `memory-full` · `memory-promote` · `propose-memory`; `mine-session` added 2026-05-10 — manual transcript-mining sub-command from `road-to-dream-skill-adoption.md`, opt-in via `--confirm-transcript-access` per invocation; `learn-low-impact` added 2026-05-15 — upstreams `## Validated` entries from `agents/decisions/low-impact-decisions.md` to the package seed via a DRAFT PR (re-runs the privacy-floor redactor as a second gate per `low-impact-corpus-privacy-floor`) |
+| `memory` | 2 | `add` · `load` · `promote` · `propose` · `mine-session` · `learn-low-impact` | `memory-add` · `memory-full` · `memory-promote` · `propose-memory`; `mine-session` added 2026-05-10 — manual transcript-mining sub-command from an internal roadmap (local-only), opt-in via `--confirm-transcript-access` per invocation; `learn-low-impact` added 2026-05-15 — upstreams `## Validated` entries from `agents/decisions/low-impact-decisions.md` to the package seed via a DRAFT PR (re-runs the privacy-floor redactor as a second gate per `low-impact-corpus-privacy-floor`) |
 | `roadmap` | 2 | `create` · `ai-council` · `process-step` · `process-phase` · `process-full` | `roadmap-create` · `roadmap-execute` (replaced — autonomous, no per-step gate; `process-phase` is the default execution scope); `ai-council` added 2026-05-07 — wraps `/council default` with `--input-mode roadmap --depth deep` |
 | `module` | 2 | `create` · `explore` | `module-create` · `module-explore` |
 | `tests` | 2 | `create` · `execute` | `tests-create` · `tests-execute` |
 | `context` | 2 | `create` · `refactor` | `context-create` · `context-refactor` |
 | `override` | 2 | `create` · `manage` | `override-create` · `override-manage` |
 | `judge` | 2 | `solo` · `on-diff` · `steps` | `judge` (legacy standalone) · `do-and-judge` · `do-in-steps` |
-| `commit` | 2 | `in-chunks` | `commit-in-chunks` |
-| `create-pr` | 2 | `description-only` | `create-pr-description` |
+| `git-commit` | 2 | `in-chunks` | `commit-in-chunks` · former cluster name `commit` — renamed 2026-06-09 to the path-derived pack-prefixed slug (`src/domains/git/commit/`, ADR-044 amendment; issue #380) |
+| `git-pr-create` | 2 | `description-only` | `create-pr-description` · former cluster `create-pr` — physically merged into the `pr` verb family at `src/domains/git/pr/create/` and renamed 2026-06-09 to the path-derived pack-prefixed slug (ADR-044 amendment; issue #380) |
 | `council` | 3 | `default` · `pr` · `design` · `optimize` · `analysis` | `council` (legacy default lens) · `council-pr` · `council-design` · `council-optimize`; `analysis` added 2026-05-14 — wrapper for local analysis outputs with a Top-N consensus tail block consumed by `/roadmap create` |
 | `challenge-me` | — | `vision` · `with-docs` | new — Pocock-inspired one-question-at-a-time interview; `vision` is the standard 95%-confidence variant, `with-docs` adds doc/glossary awareness with a session-scoped glossary and load-bearing claim-vs-code verification |
 | `research` | 2 | `deep` · `report` | preliminary-research scaffolder ported from `Weizhena/Deep-Research-skills` (cluster head emits `outline.yaml` + `fields.yaml` against the `research-schema` contract). `:deep` populates per-item JSON in batches with native web-search + JSON-Schema self-validation (no Python runtime); `:report` renders `report.md` directly + optionally emits a `jq` template for deterministic regeneration. `add-items` / `add-fields` intentionally **not** ported — re-run `/research <topic>` to extend the field framework. |
@@ -55,7 +55,7 @@ column 1 of this table.
 | `skill` | — | `preview` | new cluster 2026-05-30 (`road-to-leaner-core-and-discovery` Phase 5) — non-destructive skill/command preview: surfaces the declared steps + files/commands a skill would touch before it runs, per [`skill-dry-run`](skill-dry-run.md). Singular `skill` (one target) vs plural `skills` (the catalog) by design. |
 | `image` | — | `analyse` · `create` · `verify` | new cluster 2026-05-31 (`road-to-character-image-fidelity` Phase 4) — character-image fidelity surface mirroring `/video:*`. `:analyse` extracts a per-feature spec from an image and diffs it against a Canon Spec down to the smallest mole (OCR for lettered tattoos, per-section severity scores, canon-breaking hard gate); `:create` assembles a max-fidelity anchors-first generation prompt from the Canon Spec, governance- + provider-gated, `AIV_DRYRUN=true` default; `:verify` runs the analyser in loop mode against a candidate and reports the gate verdict + remaining diff with plateau/oscillation/budget stop conditions. Skills: [`image-analyser`](../../skills/image-analyser/SKILL.md) + [`image-creator`](../../skills/image-creator/SKILL.md); schema/rubric/loop in [`canon-spec.md`](../../skills/image-analyser/canon-spec.md). |
 
-| `profile` | — | `activate` · `deactivate` · `show` | new cluster 2026-06-02 (`road-to-session-profile-activation`) — session-profile activation: an ephemeral `runtime.active_packs` overlay that biases the surfaced command/skill set to the active pack closure, with no persistence and no execution-gating (recommendation-bias MVP). `:activate <name…>` resolves an alias (`config/discovery/session-profiles.yml`) or a raw pack id, fails fast on a not-installed pack, expands the `requires_hint` closure, and writes the overlay atomically to `agents/settings/.agent-settings.local.yml`; `:deactivate [name…]` clears it (or drops named packs, keeping deps a still-active pack needs); `:show` is the observability surface (active packs + surfaced/hidden counts). Overlay = runtime modulation of the existing `pack` axis, not a fifth axis (ADR-010 addendum). Library: `scripts/config/session_profiles.py`; schema in [`session-profile-overlay`](session-profile-overlay.md). |
+| `profile` | — | `activate` · `deactivate` · `show` | new cluster 2026-06-02 (`road-to-session-profile-activation`) — session-profile activation: an ephemeral `runtime.active_packs` overlay that biases the surfaced command/skill set to the active pack closure, with no persistence and no execution-gating (recommendation-bias MVP). `:activate <name…>` resolves an alias (`src/config/discovery/session-profiles.yml`) or a raw pack id, fails fast on a not-installed pack, expands the `requires_hint` closure, and writes the overlay atomically to `agents/settings/.agent-settings.local.yml`; `:deactivate [name…]` clears it (or drops named packs, keeping deps a still-active pack needs); `:show` is the observability surface (active packs + surfaced/hidden counts). Overlay = runtime modulation of the existing `pack` axis, not a fifth axis (ADR-010 addendum). Library: `scripts/config/session_profiles.py`; schema in [`session-profile-overlay`](session-profile-overlay.md). |
 
 **Net change:** Phase 1 collapsed 15 atomics → 3 clusters; Phase 2
 collapses 26 atomics → 11 sub-command clusters. Sub-commands use
@@ -107,6 +107,44 @@ every new sub-command added to an existing cluster.
    semantics: [`slash-command-routing-policy-mechanics.md`](../../.agent-src.uncondensed/contexts/communication/rules-auto/slash-command-routing-policy-mechanics.md)
    § Routing semantics.
 
+## Command justification — a command must earn a top-level slot
+
+```
+A NEW COMMAND ONLY EARNS A TOP-LEVEL SLOT IN THREE CASES.
+EVERYTHING ELSE IS A SKILL — THE AGENT TRIGGERS IT BY TASK.
+```
+
+Before adding a command, answer: which of these is it?
+
+1. **Flow-entry** — a daily starting point of a flow the user TYPES to begin
+   work (`work`, `git-commit`, `git-pr-create`, `ticket-implement`,
+   `feature-plan`, `review-changes`, `fix-ci`, `test-run`).
+2. **State-query** — a read-only check typed many times a day (`agent-status`,
+   `project-health`, `profile-show`).
+3. **Product-surface** — a FEATURE the user starts deliberately (not daily, but
+   consciously): `council`, `challenge-me`, `research`, `roadmap`,
+   `video-storyboard`. These are products, not implementation helpers — burying
+   them as skills destroys discoverability.
+
+If none of the three, it is a **skill**. Skills already trigger automatically by
+task, so a sub-action, a one-off/setup-once op, a pipeline stage, a destructive
+op (skill + mandatory confirmation gate — destructive ≠ command), or a system /
+admin op (the `agent-admin` platform surface, NOT a flow) does NOT need a
+top-level command. Sibling variants become a flag, never a second command
+(`commit`, not `commit-in-chunks`; `roadmap --step`, not a separate
+`roadmap-process-step` — and `roadmap` with no scope defaults to processing the
+WHOLE roadmap, because that is why you write one). A new verb still needs an ADR
+per [`ADR-041`](../decisions/ADR-041-controlled-command-verbs.md). A genuine
+skill is `code-review` / `git-workflow` / `testing` — never `council` /
+`challenge-me` / `research`.
+
+> The rule that ends "should X be a command?" — a proposed `jira-comment`: not
+> flow-entry, not state-query, not a product-surface feature → skill. Done. The
+> sweet spot is ~40–50 visible commands (workflow + status + product features),
+> not 125 (overwhelms) and not ~29 (buries features). Converged across the
+> 6.0.0-D council passes + feedback (2026-06-03); the dedicated ADR is authored
+> during the 6.0.0-D structural rollout.
+
 ## Frontmatter contract
 
 A new command file under `.agent-src.uncondensed/commands/` MUST
@@ -149,7 +187,7 @@ here so future lens additions follow the same shape.
   to the master (e.g. "cost gate from `/council default` Step 3",
   "render via Step 5/5a/5b of `/council default`"), not the wrapper.
 - **Single source of lens addendums:** lens-specific neutrality
-  addendums live in [`scripts/ai_council/prompts.py:_MODE_TABLE`](../../scripts/ai_council/prompts.py)
+  addendums live in [`scripts/ai_council/prompts.py:_MODE_TABLE`](../../src/scripts/ai_council/prompts.py)
   and are selected by `mode_override`. A new lens = a new `_MODE_TABLE`
   entry **plus** a new wrapper file mirroring the `pr.md` / `design.md` /
   `optimize.md` shape (~100–130 lines). No new master.

package/docs/contracts/config-presets.md

@@ -107,7 +107,7 @@ turn a session unrecoverably hostile mid-task.
   shell commands, MCP-static-resource fetches). The per-call ceiling
   targets paid token spend.
 - It does **not** override the Hard Floor in
-  [`non-destructive-by-default`](../../.agent-src/rules/non-destructive-by-default.md)
+  [`non-destructive-by-default`](../../dist/agent-src/rules/non-destructive-by-default.md)
   — a preset cannot lift the universal safety floor.
 
 ## Resolution chain

package/docs/contracts/cost-dashboard.md

@@ -32,7 +32,7 @@ agent-config cost reset --confirm       # truncate sessions.jsonl + budget.json
 All subcommands are **read-only by default**. `ingest` writes only to
 `agents/cost-tracking/sessions.jsonl`. `reset` is destructive and
 gated by `--confirm` (Hard-Floor per
-[`non-destructive-by-default`](../../.agent-src/rules/non-destructive-by-default.md)).
+[`non-destructive-by-default`](../../dist/agent-src/rules/non-destructive-by-default.md)).
 
 ## `cost status` — output contract
 

package/docs/contracts/cost-enforcement.md

@@ -128,7 +128,7 @@ suite is wired to `task test-cost-budget` per `step-11` Phase 2 Step 5.
 
 ## See also
 
-- `step-11-ruflo-parity` — Measurement & Governance Parity roadmap.
+- an internal parity roadmap (local-only) — Measurement & Governance Parity roadmap.
 - `docs/contracts/cost-dashboard.md` — companion dashboard contract.
 - `scripts/cost/budget.mjs` — evaluator implementation.
 - `internal/bench/pricing.yaml` — per-model USD pricing table.

package/docs/contracts/cost-profile-defaults.md

@@ -39,7 +39,7 @@ correct default while tier-1 was experimental, but four signals now point
 at `balanced`:
 
 1. **Documented intent already says so.** Both
-   `config/agent-settings.template.yml` (the source the installer projects
+   `src/config/agent-settings.template.yml` (the source the installer projects
    from) and `docs/customization.md` describe `balanced` as
    "default — current behaviour superset". The code default of `minimal`
    was a drift artifact, not a deliberate stance.
@@ -76,7 +76,7 @@ state-machine impact because the kernel carries the Iron-Law floor.
 CI must keep three surfaces in sync:
 
 - `scripts/install.py` — `DEFAULT_PROFILE` constant.
-- `config/agent-settings.template.yml` — comment block on the
+- `src/config/agent-settings.template.yml` — comment block on the
   `rule_loading_tier:` key.
 - `docs/customization.md` — cost-profile table default column.
 

package/docs/contracts/cost-summary-schema.md

@@ -6,10 +6,10 @@ keep-beta-until: 2026-08-15
 # cost-summary schema (`cost-summary/v1`)
 
 Stable JSON contract for inter-tool consumption of cost-tracking data
-emitted by [`scripts/cost_summary.py`](../../scripts/cost_summary.py).
+emitted by [`scripts/cost_summary.py`](../../src/scripts/cost_summary.py).
 Schema-versioned so downstream consumers can pin and migrate explicitly.
 
-Design reference: Ruflo `scripts/summary.mjs` (upstream cite). Our shape
+Design reference: the external runtime `scripts/summary.mjs` (upstream cite). Our shape
 diverges to align with the local `agents/cost-tracking/sessions.jsonl`
 fields and the telegraph-suspended-multiplier contract.
 
@@ -102,6 +102,6 @@ model-scoped.
 
 - [`telegraph-telemetry.md`](telegraph-telemetry.md) — defines the
   `telegraph_*` fields and the suspended-multiplier contract.
-- [`scripts/cost_summary.py`](../../scripts/cost_summary.py) — implementation.
-- [`scripts/cost_by_conversation.py`](../../scripts/cost_by_conversation.py) — narrower per-conversation lens with the same JSONL source.
-- [`scripts/telegraph_stats.py`](../../scripts/telegraph_stats.py) — telegraph-only delta lens with the same JSONL source.
+- [`scripts/cost_summary.py`](../../src/scripts/cost_summary.py) — implementation.
+- [`scripts/cost_by_conversation.py`](../../src/scripts/cost_by_conversation.py) — narrower per-conversation lens with the same JSONL source.
+- [`scripts/telegraph_stats.py`](../../src/scripts/telegraph_stats.py) — telegraph-only delta lens with the same JSONL source.

package/docs/contracts/creative-pack-boundary.md

@@ -0,0 +1,58 @@
+# Creative Pack boundary — video is an optional pack, not core identity
+
+The `ai-video` (Creative) pack is a **bounded, optional** capability: a first-class
+part of the **content creator** experience, never the package's core identity.
+This contract draws the boundary so omitting the pack degrades nothing in the
+engineering / strategy / finance experiences. (`ai-video` ships
+`trust_level_default: experimental`, 10 artefacts.)
+
+## (a) User-facing video artefacts
+
+Surfaced only when the pack is active (the `content_creator` profile, or an
+explicit enable):
+
+- **Commands:** `/video:from-script` · `/video:storyboard` · `/video:scene` ·
+  `/video:stitch` · `/video:from-song` · `/image:create` · `/image:analyse` · `/image:verify`.
+- **Skills:** `video-director` · `character-consistency` · `motion-choreographer` ·
+  `scene-expander` · `song-to-script` · `pixar-storyteller` · `image-creator` ·
+  `image-analyser` (+ `prediction-pool-optimizer`).
+
+## (b) Internal / provider-specific artefacts
+
+Not user-facing; they implement the pipeline and stay inside the pack boundary:
+
+- Provider adapters under `src/scripts/ai-video/adapters/` (openai-images,
+  gemini-veo, kling, higgsfield, sora) + the adapter contract.
+- `provider-lifecycle-discipline` rule + `agents/templates/.ai-video.xml.example`
+  (provider tiers, `<default-video-provider>`).
+- `AIV_DRYRUN=true` cost-safety default; the media-governance policy layer
+  (`agents/settings/policies/media/`) and the `media-sync-ground-truth` /
+  `media-governance-routing` rules.
+
+## (c) Compatibility matrix — what works without the Creative Pack
+
+| Profile | Creative Pack | Without it |
+|---|---|---|
+| `content_creator` | **active** | full video surface |
+| `developer` · `agency` · `ops` · `finance` · `founder` | not included | **no change** — video was never projected |
+
+| Flow | Depends on Creative Pack? |
+|---|---|
+| discovery · implementation · review · delivery | **No** — the four work-flows are engineering journeys; none reference a video command or skill |
+
+**What breaks without it:** nothing in the core surface. The `/video:*` and
+`/image:*` commands are simply absent (graceful — projection-time filtering never
+writes them); no rule, flow, or non-creator profile depends on an `ai-video`
+artefact. The media-governance policy layer is referenced by routing rules that
+stay inert unless a media surface fires, so it does not break either.
+
+**Conclusion:** the Creative Pack is cleanly severable. It enriches the
+`content_creator` experience and is invisible everywhere else — keeping video a
+bounded Creator capability, not the package's identity.
+
+## See also
+
+- [`src/domains/ai-video/pack.yaml`](../../src/domains/ai-video/pack.yaml) — the generated pack manifest (span + trust level).
+- [`profiles.md`](../profiles.md) · [`experiences/content_creator.md`](../experiences/content_creator.md) — where the pack surfaces.
+- [`provider-lifecycle-discipline`](../../src/rules/provider-lifecycle-discipline.md) — the provider-tier rule inside the boundary.
+- ADR-040 — projection-time filtering (the mechanism that makes a pack optional).

package/docs/contracts/daily-workspace.md

@@ -51,11 +51,16 @@ in [`gui-wizard`](gui-wizard.md) are untouched.
 |---|---|
 | `GET  /workspace` | HTML shell + initial state (role list, recent sessions). |
 | `GET  /api/v1/workspace/roles` | List available roles from `agents/roles/<role>/`. |
-| `GET  /api/v1/workspace/roles/:role/tasks` | Per-role task list from `skills.yml` + `prompts/`. |
-| `POST /api/v1/workspace/launch` | Body: `{ role, task, host? }`. Resolves host via ADR-023 tier; runs the launch; appends to JSONL log. |
+| `GET  /api/v1/workspace/roles/:role/tasks` | Per-role task list from `skills.yml` + `prompts/`. Each task inlines its prompt's `inputs` (`{name, required, shape}`) + `skill_hint` (ADR-075) so the GUI builds its input form without a second round-trip. |
+| `POST /api/v1/workspace/launch` | Body: `{ role, task, inputs?, host? }`. Writes a session header; resolves host tier (ADR-068). On a **tier-1** host whose task resolves to a prompt, renders (ADR-069) + drives one turn (ADR-070/071), appending `host.turn`/`host.error`. Tier-3 / drive failure degrades to the inbox hand-off (best-effort). Always 200 with `{driven, turn?\|reason?\|error_kind?, handoff?}`. |
 | `GET  /api/v1/workspace/sessions` | List of recent sessions (≤ 20, ordered by mtime). |
 | `GET  /api/v1/workspace/sessions/:id` | Streams the JSONL log for one session. |
+| `POST /api/v1/workspace/sessions/:id/continue` | Body: `{ prompt }`. Continues the conversation in the same host session (ADR-076) — records the prompt (`launcher.input` `followup:true`, ADR-083), resumes by the `session_id` on the latest `host.turn` (`--resume`), appends another `host.turn`. 409 if no host turn has run yet; **410** if the host session has expired (ADR-080); same kill-switch gate as launch. |
 | `GET  /api/v1/workspace/knowledge` | Snapshot of the current `knowledge:` memory namespace (read-only). |
+| `POST /api/v1/workspace/render` | Body: `{ role, prompt, inputs }`. Fills `{{name}}` placeholders in `prompts/<prompt>.md`; returns `{ rendered, skill_hint }`. Pure — skill body is **not** appended (ADR-069). Missing-required / undeclared-placeholder → 400. |
+| `GET  /api/v1/workspace/drive-health` | `?host=<id>` for one host, omitted for all. Read-only per-host kill-switch cache (ADR-073/074): `{ consecutive_failures, killed, kill_reason, killed_at, trip_count, total_success, total_failure, … }`. Auto-tripped hosts self-recover via a half-open probe after `AGENT_CONFIG_DRIVE_COOLDOWN_SEC` (default 600 s); manual kills are sticky. Fails open (missing cache → empty). |
+| `GET  /api/v1/workspace/hosts` | Tier-1 host availability for the picker (ADR-079): `{ hosts: [{ id, cli_present, effective_tier }] }` (claude-code / codex / gemini). Side-effect-free PATH probe. Fails open (`[]`). |
+| `POST /api/v1/workspace/drive-health/:host/reset` | Clears a host's kill-switch (ADR-081) → `{ host, state }`. Operator escape hatch (and the only path for a sticky manual kill). 400 on an invalid host id. |
 
 ## Session JSONL schema
 
@@ -70,7 +75,7 @@ Each line is one JSON record with the shared envelope:
 
 Event kinds:
 
-- `launcher.input` — `{ role, task, rendered_prompt, host_tier, host_id }`
+- `launcher.input` — `{ role, task, rendered_prompt, host_tier, host_id }` (opening); a follow-up turn appends `{ role, task, prompt, followup: true }` (ADR-083)
 - `host.turn` — `{ host_id, turn_id, model, input_tokens, output_tokens, latency_ms }`
 - `host.output` — `{ host_id, turn_id, role: "assistant", text }` *(verbatim host envelope text — Tier 1 only)*
 - `host.tool` — `{ host_id, turn_id, tool_name, input, output_excerpt }` *(when the host envelope surfaces it)*
@@ -134,6 +139,7 @@ counters only. No prompt bodies, no response bodies.
 
 ## Cross-references
 
+- **Boundary:** [`workspace-boundary`](workspace-boundary.md) — what the workspace owns vs. does **not** own ([`ADR-095`](../decisions/ADR-095-workspace-boundary-contract.md)), enforced by the import-edge linter.
 - ADRs: [`022`](../decisions/ADR-022-daily-workspace-decomposition.md) · [`023`](../decisions/ADR-023-host-agent-protocol.md) · [`024`](../decisions/ADR-024-workspace-v0-feature-floor.md) · [`025`](../decisions/ADR-025-workspace-chrome.md).
 - Host-agent protocol: [`host-agent-protocol`](host-agent-protocol.md).
 - GUI substrate: [`gui-wizard`](gui-wizard.md).

package/docs/contracts/discovery-manifest.md

@@ -14,7 +14,7 @@ keep-beta-until: 2026-08-19
 ## Source of truth
 
 The generator
-[`scripts/build_discovery_manifest.py`](../../scripts/build_discovery_manifest.py)
+[`scripts/build_discovery_manifest.py`](../../src/scripts/build_discovery_manifest.py)
 walks `.agent-src.uncondensed/` and emits the manifest to
 `dist/discovery/discovery-manifest.json` plus a sidecar
 `discovery-manifest.json.sha256` for tamper detection.
@@ -38,11 +38,11 @@ per-artefact checksum drift all fail CI (Phase-6 invariants).
   "generated_at": "2026-05-21T00:00:00Z",
   "scanner_version": "a1b2c3d4e5f6",
   "checksum": "sha256:<64 hex>",
-  "workspaces": [ /* one entry per workspace in config/discovery/workspaces.yml */ ],
-  "packs":      [ /* one entry per pack in config/discovery/packs.yml */ ],
+  "workspaces": [ /* one entry per workspace in src/config/discovery/workspaces.yml */ ],
+  "packs":      [ /* one entry per pack in src/config/discovery/packs.yml */ ],
   "artefacts":  [ /* sorted by path, ADR-013 frontmatter projected here */ ],
   "unassigned": [ /* artefacts that failed assignment; reason required */ ],
-  "documented_unassigned": [ /* explicit skips from config/discovery/unassigned-artefacts.yml */ ],
+  "documented_unassigned": [ /* explicit skips from src/config/discovery/unassigned-artefacts.yml */ ],
   "stats": { /* see below */ }
 }
 ```
@@ -98,7 +98,7 @@ per-artefact checksum drift all fail CI (Phase-6 invariants).
 ```
 
 `requires_hint` is a vocabulary-side hint (lives in
-`config/discovery/packs.yml`); the canonical dependency edges sit on
+`src/config/discovery/packs.yml`); the canonical dependency edges sit on
 the artefact-level `requires` field, which the installer aggregates.
 
 ## Stats block

package/docs/contracts/discovery-manifest.schema.json

@@ -48,7 +48,7 @@
     "documented_unassigned": {
       "type": "array",
       "items": { "$ref": "#/$defs/unassigned" },
-      "description": "Artefacts explicitly skipped via config/discovery/unassigned-artefacts.yml. Each entry MUST carry a reason."
+      "description": "Artefacts explicitly skipped via src/config/discovery/unassigned-artefacts.yml. Each entry MUST carry a reason."
     },
     "stats": { "$ref": "#/$defs/stats" }
   },
@@ -64,7 +64,8 @@
         "product-basic", "product-discovery",
         "finance-basic", "finance-advanced",
         "gtm-sales", "gtm-marketing",
-        "ops-people", "founder-strategy", "small-business", "construction", "ai-video", "fun", "meta"
+        "ops-people", "founder-strategy", "small-business", "construction", "ai-video", "fun", "meta", "git", "frontend-design",
+        "memory", "analytics", "product-reasoning"
       ]
     },
     "lifecycle": {
@@ -97,7 +98,12 @@
         "label": { "type": "string", "minLength": 1 },
         "description": { "type": "string", "minLength": 1 },
         "workspaces": { "type": "array", "items": { "$ref": "#/$defs/workspace_id" }, "minItems": 1 },
-        "requires_hint": { "type": "array", "items": { "$ref": "#/$defs/pack_id" } },
+        "requires": { "type": "array", "items": { "$ref": "#/$defs/pack_id" }, "description": "capability-packs.md — hard dependency graph (transitive, acyclic). Supersedes requires_hint." },
+        "requires_hint": { "type": "array", "items": { "$ref": "#/$defs/pack_id" }, "description": "Deprecated alias of `requires`, emitted during the deprecation window." },
+        "suggests": { "type": "array", "items": { "$ref": "#/$defs/pack_id" }, "description": "capability-packs.md — soft companion graph (one-hop, advisory)." },
+        "domain": { "type": "string", "minLength": 1, "description": "capability-packs.md — single primary vertical. Required for in-use packs." },
+        "size_class": { "enum": ["core", "small", "medium", "large", "platform"], "description": "capability-packs.md — per-pack visible-command budget input. Required for in-use packs." },
+        "always_on": { "type": "boolean", "description": "capability-packs.md — default pack the resolver includes in every projection regardless of profile/workspace." },
         "cluster": { "$ref": "#/$defs/pack_id" },
         "trust_level_default": { "$ref": "#/$defs/trust_level" },
         "artefact_count": { "type": "integer", "minimum": 0 },
@@ -128,6 +134,13 @@
         "path": { "type": "string", "minLength": 1, "description": "POSIX path relative to repo root." },
         "category": { "type": "string", "enum": ["skill", "rule", "command", "template"] },
         "name": { "type": "string" },
+        "pack": { "$ref": "#/$defs/pack_id", "description": "capability-packs.md — canonical OWNER pack (ownership/budget unit). Orthogonal to `packs` (discovery tags); the owner need not appear in `packs`." },
+        "tier": { "type": "integer", "enum": [0, 1, 2], "description": "6.0.0-C — command-surface tier surfaced on `category: command` artefacts so the CLI discovery surface reads the manifest, not a parallel catalog. Back-compat alias of `visibility` since ADR-090; dual-emitted during the deprecation window." },
+        "visibility": { "type": "string", "enum": ["visible", "advanced", "internal"], "description": "ADR-090 — named command-surface visibility (visible↔tier 0, advanced↔tier 1, internal↔tier 2); the classifier source of truth. Dual-emitted alongside `tier` on `category: command` artefacts during the deprecation window." },
+        "intent": { "type": "string", "description": "6.0.0-C — command routing metadata (one-line existence justification). Present on visible command artefacts." },
+        "routes_to": { "type": "array", "items": { "type": "string" }, "description": "6.0.0-C — command routing metadata (skill/cluster-sub/command slugs the intent routes to)." },
+        "replaces": { "type": "array", "items": { "type": "string" }, "description": "6.0.0-C — command routing metadata (prior names/aliases this command absorbs; may be empty)." },
+        "slug": { "type": "string", "description": "6.0.0-D — canonical path-derived invocation slug (ADR-044; pack-stripped subpath + opt-in slug_prefix). Distinct from `name` (display, may still be colon for renames deferred to 6.1). The identity `commands ls --profile` matches on." },
         "workspaces": { "type": "array", "items": { "$ref": "#/$defs/workspace_id" }, "minItems": 1 },
         "packs": { "type": "array", "items": { "$ref": "#/$defs/pack_id" }, "minItems": 1 },
         "requires": {

package/docs/contracts/evidence-based-pruning.md

@@ -0,0 +1,101 @@
+---
+stability: beta
+keep-beta-until: 2026-09-04
+---
+
+# Evidence-based pruning contract
+
+> 6.0.0-C Phase 3 Step 7. The **rule by which a later, data-bearing roadmap
+> cuts** personas, skills, and rules — replacing the part1 feedback's arbitrary
+> targets (4 personas, halve rules, 223→120 skills) with measured thresholds.
+> **No artefact is cut by this contract or by 6.0.0-C.** This phase ships the
+> thresholds; a future roadmap, holding ≥ 30 days of telemetry, applies them.
+
+## Why thresholds, not targets
+
+The external review demanded fixed reduction numbers. The council
+(claude-sonnet-4-5 + gpt-4o, 2026-06-02) rejected them as guesses:
+
+> "Both the plan ('223 is fine') and the reviewer ('223 is too many') argue
+> maintenance burden in the absence of data. Add telemetry; decide on usage."
+
+A target says "cut to N". A threshold says "an artefact below this measured bar
+is a *candidate*, surfaced for a human merge/deprecate decision." The cut is
+always defensible because it traces to a number, and the option-value artefacts
+(rarely-loaded but load-bearing when they fire) survive unless the data says
+otherwise.
+
+## The data source
+
+The thresholds read the local-analytics events added in Step 6
+([`local-analytics.md` § Event vocabulary](local-analytics.md)):
+`rule.tier2_loaded`, `persona.cited`, `skill.activated`, plus the existing
+git-history and citation signals. Local, anonymized, opt-out, 90-day retention —
+never POSTed. A pruning pass requires **≥ 30 days** of telemetry before any
+candidate list is trustworthy; a shorter window is surfaced as "insufficient
+data", never as "unused".
+
+## Thresholds
+
+### Personas — deprecation candidate
+
+A specialist persona is a **deprecation candidate** when **both** hold:
+
+- **< 5 skill citations** — counted by `lint_persona_governance.py`'s
+  `citations_for()` (the `personas: [<id>]` frontmatter references), and
+- **< 3 commits in the trailing 12 months** — from `git log --follow` on the
+  persona file.
+
+Both, not either: a persona cited by 4 skills but actively maintained is not
+dead; a persona with 6 stale citations is not dead either. Core personas
+(`developer`, `senior-engineer`, `product-owner`, `stakeholder`,
+`critical-challenger`, `ai-agent`) are **exempt** — they are always-loaded
+cross-cutting lenses, not domain specialists (per `persona-governance`).
+
+### Skills — merge candidate
+
+A pair of skills is a **merge candidate** when **both** hold:
+
+- **> 70% content overlap** — content similarity (not name-prefix), measured by
+  the Phase 4 overlap analysis (Step 8), and
+- **same domain** — both map to the same content domain.
+
+Merge candidate ≠ merge order: the pair is surfaced for a human merge decision
+that preserves the stronger skill's triggers, examples, and anti-patterns (per
+`preservation-guard`). Scope ladders, union dispatchers, and tier-gated
+specialists that *look* similar but are intentionally distinct are kept.
+
+### Rules — prune candidate
+
+A tier-2 (router-gated) rule is a **prune candidate** when:
+
+- **< 5% load rate over 30 days** — `rule.tier2_loaded` events for the rule
+  divided by sessions in the window, below 5%.
+
+Kernel (always-on) rules are **exempt** — they are not router-gated and carry no
+load signal. A tier-2 rule that fires rarely but is load-bearing when it does
+(a safety floor, a destructive-op gate) is surfaced with its load contexts so
+the human decision sees *why* it fired, not just *how often*.
+
+## The decision is always human
+
+Every threshold produces a **candidate list**, never an automatic deletion. The
+pruning roadmap that consumes this contract:
+
+1. Runs the measurement (telemetry window ≥ 30 days + overlap analysis).
+2. Produces the candidate lists under `agents/reports/`.
+3. Surfaces each candidate with its evidence (citation count, commit count, load
+   rate, overlap pair + similarity score).
+4. A maintainer decides merge / deprecate / keep per candidate, recording the
+   rationale (ADR for structural cuts, commit message for routine ones).
+
+No artefact is deleted by a number alone. The number qualifies it as a
+candidate; the human, seeing the evidence, makes the call.
+
+## See also
+
+- [`local-analytics.md`](local-analytics.md) — the measurement events + privacy floor.
+- [`capability-packs.md`](capability-packs.md) — sibling per-pack budget governance.
+- [`ADR-041`](../decisions/ADR-041-controlled-command-verbs.md) — sibling command-surface governance.
+- `lint_persona_governance.py` — persona citation counting.
+- `scripts/audit_skill_overlap.py` — skill-family overlap analysis (Step 8).

package/docs/contracts/explain-modes.md

@@ -142,9 +142,46 @@ one with a glossary override. ≥ 90 % branch on the renderer module.
 - `/why` finds no `mem://` markers → renders "This reply did not
   cite any stored memory entries." No error.
 
+## `profile-overlay` envelope (session-profile observability)
+
+A second `envelope_type` alongside `explain-v1`, answering **"why is the surface
+different / why these commands?"** over the session-profile overlay — not the
+memory/trust question. Built by `scripts/config/profile_explain.build_profile_envelope`
+from `session_profiles show|surface` state; rendered by
+`render_profile_overlay(envelope, mode)`.
+
+Fields:
+
+| field | meaning |
+|---|---|
+| `active` | the effective active pack set (the persisted overlay) |
+| `commands_shown` / `skills_shown` | surfaced counts |
+| `hidden_total` | items hidden behind inactive packs |
+| `delta.hidden_behind_inactive_packs` | the deterministic "what changed vs the full surface" |
+| `persists_across_sessions` | staleness as **persistence** (the overlay has no timestamp) |
+
+**Trust boundary (council amendment):** the renderer is a **pure template** over
+these fields — it **never calls an LLM** and **never reads beyond the overlay
+state** it is handed. `build_profile_envelope` is the only state read;
+`render_profile_overlay` is a pure function (golden-tested,
+`tests/test_profile_explain.py`). Missing fields render a placeholder; the
+renderer never throws.
+
+**Not fields** (not persisted, so deliberately absent — same honesty as the
+plain status surface): the seed-token-vs-closure split (the overlay stores the
+effective set, no request log) and a staleness **age-in-days** (no timestamp).
+An age render is a separate, overlay-semantics-touching change.
+
+**`/why profile` routing.** Same model as `/why` for memory: the agent
+recognises a "why is the surface different / why aren't these commands showing"
+intent and renders the `profile-overlay` plain view
+(`session_profiles explain --mode plain`; `--mode technical` for an engineering
+lead). One question per turn if the intent is ambiguous between memory-explain and
+profile-explain (`ask-when-uncertain`).
+
 ## Cross-references
 
 - ADR: [`ADR-026`](../decisions/ADR-026-explain-mode-translation.md).
-- Envelope contract: [`agent-memory-contract`](agent-memory-contract.md) (`explain-v1`).
+- Envelope contract: [`retrieval-v1.schema.json`](../../internal/schemas/retrieval-v1.schema.json) (`explain-v1`).
 - Workspace integration: [`daily-workspace`](daily-workspace.md) (right rail).
 - Roles: [`role-experience`](role-experience.md) (`explain_default` field).