@event4u/agent-config 5.10.1 → 6.1.0

package/docs/decisions/ADR-091-split-meta-capability-packs.md

@@ -0,0 +1,113 @@
+---
+adr: 091
+status: accepted
+date: 2026-06-13
+decision: split-meta-capability-packs
+supersedes: —
+superseded_by: —
+phase: command-surface-refactor-residuals
+type: structural
+---
+
+# ADR-091 — Split the `meta` pack into capability-scoped packs (logical re-tag)
+
+## Status
+
+**Accepted** · 2026-06-13. Decided by AI council (anthropic/claude-sonnet-4-5
++ openai/gpt-4o, peer-review, deep) — converged on **logical re-tag, phased,
+memory-first**, and flagged the `council`/`challenge-me`/`grill-me`
+surface-map↔pack ontology mismatch as the real defect to fix.
+
+## Context
+
+`meta` was one capability pack owning the artefacts that maintain the package
+itself: **68 commands** (`pack: meta`) + **58 skills** (`packs: [meta]`),
+`artefact_count: 263`, `size_class: core`, `always_on: true`, `domain: meta`.
+A reviewer and the 6.1.0 roadmap (line 103) repeatedly asked to split it into
+capability-scoped packs; it was punted twice.
+
+Verified mechanism facts that shaped the decision:
+
+- Pack-manifest membership is the frontmatter `packs:` axis
+  (`generate_pack_manifests.py::_collect_flat` → `pid in fm['packs']`); the
+  per-pack visible-command budget groups by the canonical `pack:` owner.
+- Command **slugs are derived from the physical `src/domains/<pack>/<subpath>`
+  path**, independent of the `pack:`/`packs:` tags. A frontmatter re-tag
+  therefore changes ownership **without** changing any slug → no deprecation
+  aliases needed.
+- The discovery resolver's `always_on` seeding is vocabulary-driven
+  (`config/packs.always_on_packs`), not hard-coded to the string `meta`.
+- A **physical** re-parent hits real friction: an orchestrator-root command
+  (`/memory`, `/council`) lives at `src/domains/<pack>/<cluster>/command.md`
+  and cannot sit at a pack root (the activation gate rejects a bare
+  `src/domains/<pack>/command.md`), and `slug_prefix` only resolves for packs
+  homed under `src/domains/`. This is the hidden cost that stalled the split
+  twice.
+- The council's stated "budget violation (8.5×)" premise is **false**: the
+  68 are mostly tier-2 *internal* commands (uncapped); meta's *visible* count
+  is within its budget of 8 (`audit_command_surface.py --budget` → 0 over
+  budget). There is no CI-forcing function; the driver is capability clarity.
+
+## Decision
+
+**Logical re-tag.** Carve three cohesive capabilities out of `meta` by
+re-tagging command frontmatter (`pack:` + `packs:`) and adding the new pack
+ids to `src/config/discovery/packs.yml`. Command files stay physically under
+`src/domains/meta/<cluster>/` (no moves → no slug churn → no aliases); the new
+packs are homed under `src/packs/<id>/` like the other capability packs.
+
+New packs (all `workspaces: [agent-config-maintainer]`, `trust_level_default:
+core`, `always_on: false` — opt-in capabilities surfaced to the maintainer
+workspace):
+
+| Pack | Clusters carved out | size_class |
+|---|---|---|
+| `memory` | `memory`, `chat-history` | small |
+| `analytics` | `analytics`, `cost-report` | small |
+| `product-reasoning` | `council`, `challenge-me`, `grill-me` | medium |
+
+`meta` **stays** the `always_on` platform / agent-admin core pack (agents,
+mode, profile, override, sync-*, optimize, skill(s), condense, context,
+orchestrate, package-reset, set-cost-profile, upstream-contribute,
+review-routing, rule-compliance-audit, agent-handoff, agent-status,
+check-current-md) plus all 58 skills. `review-routing` +
+`rule-compliance-audit` (governance, 2 commands) stay folded into `meta`
+rather than a 2-command pack of their own.
+
+The `knowledge` cluster is intentionally **not** part of `memory`: it is
+already owned by `pack: product-discovery` (`src/domains/product-discovery/
+knowledge/`), not `meta`, so it is out of this split's scope.
+
+`product-reasoning` resolves the ontology bug: `council`/`challenge-me`/
+`grill-me` are classified `product` in `src/flows/surface-map.yaml` but were
+owned by `pack: meta`. They now have an owning capability pack.
+
+### Rejected / deferred
+
+- **Physical re-parent** (moving command dirs under `src/domains/<newpack>/`):
+  deferred — the orchestrator-root + `slug_prefix` friction above makes it a
+  separate, careful change with deprecation-alias cost, and the logical re-tag
+  already satisfies the acceptance criterion. Recorded as a follow-up.
+- **`governance` as its own pack**: rejected — 2 commands do not warrant a
+  budget unit; folded into `meta`.
+- **Big-bang full split** in one pass: rejected per the council's phased
+  guidance; executed memory-first as the proof, then analytics +
+  product-reasoning in the same change once the pipeline was proven green.
+
+## Consequences
+
+- The carved commands move from the `always_on` meta surface to opt-in
+  capability packs scoped to the `agent-config-maintainer` workspace; the
+  maintainer still resolves them via that workspace.
+- `meta`'s `artefact_count` drops; three new `pack.yaml` manifests are
+  generated; the discovery manifest gains the new pack tags.
+- Pack-dependency, budget, and marketplace lints stay green (verified).
+- Physical co-location of the carved commands under their new pack homes
+  remains a future, alias-bearing change.
+
+## References
+
+- `agents/roadmaps/archive/road-to-command-surface-refactor-residuals.md` — Phase 2.
+- `docs/contracts/capability-packs.md` — pack ownership + budget model.
+- `src/flows/surface-map.yaml` — the `product` classification reconciled here.
+- ADR-057 — consolidation-evidence-gate outcomes (physical folding out of scope).

package/docs/decisions/ADR-092-defer-command-tier-alias-removal.md

@@ -0,0 +1,93 @@
+---
+adr: 092
+status: accepted
+date: 2026-06-13
+decision: defer-command-tier-alias-removal
+supersedes: —
+superseded_by: —
+phase: metadata-and-command-surface-leanness
+type: structural
+---
+
+# ADR-092 — Defer the command `tier:` alias removal (close ADR-090 Option B as deferred-with-forcing-function)
+
+## Status
+
+**Accepted** · 2026-06-13. Decided by AI council (anthropic/claude-sonnet-4-5
++ openai/gpt-4o, peer-review, deep) — converged on **defer**, with a
+forcing-function refinement: a defer without a re-open mechanism is
+abandonment in disguise.
+
+## Context
+
+[ADR-090](ADR-090-visibility-command-frontmatter-field.md) made `visibility:`
+the command-classifier source of truth and kept the integer `tier:` (`0/1/2`)
+as a back-compat alias, **deferring** the alias removal ("Option B") "once
+readers and the manifest have fully migrated". This ADR closes that deferred
+question with the Phase-3 investigation evidence.
+
+Investigation findings (`road-to-metadata-and-command-surface-leanness`, Phase 3):
+
+- **Integer-`tier` readers are internal:** `src/cli/commands/commands.ts`
+  (fallback after `visibility`), `src/scripts/audit_command_surface.py`
+  (report column + budget fallback), `src/scripts/build_discovery_manifest.py`
+  (**dual-emits `tier`** into the manifest). `src/cli/python/workspace_hosts.py`
+  uses a semantically unrelated host-inventory tier.
+- **The discovery manifest is a published npm artifact** — `package.json`
+  `files` + `build:discovery` in `prepack` + `prepublishOnly:
+  check_release_includes_discovery.py`. It dual-emits the integer `tier`.
+  **External npm consumers that read the integer key are unknown.**
+- The defer rests on a **Runtime Risk that cannot be ruled out** (a consumer
+  may register/branch on the integer `tier`), not on evidence that such a
+  consumer exists. Maximal caution by default.
+
+## Decision
+
+**Defer Option B.** Keep the `tier:` alias + the manifest dual-emit. Do not
+remove `tier:` now: the published manifest's external consumers are unknown,
+so the "unknown external consumers = hard stop" rule applies.
+
+The defer is a **waypoint, not an end state** — it ships with a re-open
+forcing function so it cannot calcify into permanent debt:
+
+1. **Re-open mechanism (one of):**
+   - **Versioned manifest** — publish `discovery-manifest` v2 *without* `tier`
+     alongside v1; v1 header carries `deprecated: true` + a `sunset` date;
+     after the soak window with no breakage reported, drop `tier`.
+   - **Evidence of zero external integer-`tier` reads** (manifest-fetch
+     telemetry / a documented "tier key deprecated" notice + soak).
+2. **Time-boxed review** — re-evaluate at the next minor-release planning (or
+   within 12 months, whichever is first), escalating to the maintainer with
+   pre-committed options (build the v2 mechanism · proceed · keep deferred).
+3. Execution of the removal itself is carried to
+   `road-to-tier-removal.md` (blocked on the mechanism above), not this ADR.
+
+### Rejected alternatives
+
+- **Accept now — drop `tier:` immediately.** Breaks the published-manifest
+  contract for unknown consumers with no migration window. Hard stop.
+- **Record the defer in the evidence note only, no ADR.** The re-open trigger
+  + escalation is *decision-level* content (who authorised the timeout, under
+  what gate it proceeds), not evidence — it belongs in a decision record. The
+  investigation evidence stays in
+  `agents/settings/contexts/tier-visibility-and-merge-evidence.md`.
+
+## Consequences
+
+- The `tier:` ⇄ `visibility:` dual-field persists during the deferral;
+  drift is mitigated by the `lint_command_tiers.py` consistency check (when
+  both present, they must agree).
+- The removal is **cheaply reversible** if ever executed: restoring the `tier`
+  field is a manifest schema patch (< 1h to publish), far below the rollback
+  cost of a runtime or DB change — but reversibility does not lift the
+  unknown-consumer hard stop.
+- `road-to-tier-removal.md` institutionalises the trigger so the defer stays
+  visible in planning rather than becoming folklore.
+
+## References
+
+- [ADR-090](ADR-090-visibility-command-frontmatter-field.md) — the deferred
+  Option B this ADR closes.
+- `docs/contracts/command-surface-tiers.md` — tier/visibility contract.
+- `agents/settings/contexts/tier-visibility-and-merge-evidence.md` —
+  consumer-investigation evidence.

package/docs/decisions/ADR-093-ai-council-config-user-global.md

@@ -0,0 +1,111 @@
+---
+adr: 093
+status: accepted
+date: 2026-06-13
+decision: ai-council-config-user-global
+supersedes: —
+superseded_by: —
+phase: ai-council-config-relocation
+type: structural
+---
+
+# ADR-093 — Relocate the AI-council config to the user-global namespace
+
+## Status
+
+**Accepted** · 2026-06-13. Maintainer directive (standing, restated): the
+council is a per-developer facility and must be configured once, globally,
+not re-declared per project.
+
+## Context
+
+The council config (`.ai-council.yml`) was a **project-tracked** file at
+`agents/settings/.ai-council.yml`, checked into this repository (it held the
+maintainer's enabled members + `file:`/`env:` key references). Resolution was
+anchored on the project root (`council_cli.py:AI_COUNCIL_FILE = REPO_ROOT /
+"agents" / "settings" / ".ai-council.yml"`; `cmd_doctor.py` recomputed the
+same path).
+
+Three defects followed from the project-tracked layout:
+
+1. **Per-project, not per-developer.** A single developer who wants the
+   council everywhere had to drop the file into every project — exactly the
+   opposite of "configure once".
+2. **Commit / leak risk.** The config sat in the tracked tree of a public
+   package; only the `file:`/`env:` indirection (raw keys are refused by
+   `_validate_api_key_ref`) kept secrets out.
+3. **Silent unavailability.** On any surface without a project copy — cloud /
+   headless / a fresh checkout / a different worktree — resolution found
+   nothing and the council refused with "ai_council.enabled is false", even
+   when the developer had set it up. The raw API keys already lived in the
+   user-global namespace (`~/.event4u/agent-config/<provider>.key`, resolved
+   by `resolve_api_key`); only the config that points at them did not.
+
+The user-global namespace helper (`scripts/_lib/user_global_paths.py`,
+`event4u_root()` → `~/.event4u/agent-config/`, with the legacy
+`~/.config/agent-config/` read-fallback) already underpinned key resolution,
+so the config had a natural home there.
+
+## Decision
+
+**The council config is user-global by default.** A single
+`resolve_config_path(project_root)` in `scripts/ai_council/config.py` is the
+one place that decides which file is read, with this precedence
+(first match wins):
+
+1. `$AI_COUNCIL_CONFIG` — explicit absolute path (tests / power users);
+   honoured even when absent, so typos surface as "create it here".
+2. Project-local `<project_root>/agents/settings/.ai-council.yml` — a
+   consumer project that deliberately checks in its own config; overrides
+   the user-global file for that project only.
+3. User-global `~/.event4u/agent-config/settings/.ai-council.yml` (legacy
+   `~/.config/agent-config/` read-fallback) — the canonical default.
+
+When none exists, the resolver returns the user-global write target so
+callers' `.exists()` gate and "create it at …" messaging both point at the
+global location.
+
+`council_cli.py` and `cmd_doctor.py` both route through this resolver. The
+tracked `agents/settings/.ai-council.yml` is removed from the repository; the
+documented shape ships as `agents/templates/.ai-council.yml.example` to copy
+from. The maintainer's live config now lives at
+`~/.event4u/agent-config/settings/.ai-council.yml`.
+
+Project-local override is **kept** (not removed) so a consumer team can still
+pin a shared council config in their own repo — but it is no longer the
+default, and this package no longer ships one in its tracked tree.
+
+## Consequences
+
+- The council now resolves from the user-global file in every project,
+  worktree, and CWD — verified: a worktree with no project copy resolves
+  `~/.event4u/agent-config/settings/.ai-council.yml` and reports `members=2`.
+- No council config can be silently committed to this (or any consumer)
+  public repo by default.
+- `doctor council-cli` now names the user-global path in its
+  "no council config" / "config invalid" messaging.
+- The test suite is made hermetic via `EVENT4U_CONFIG_HOME` sandboxing so
+  it never reads the developer's real global config (it otherwise would,
+  now that "no project file" falls through to global).
+- **Not done here (follow-up):** auto-scaffolding the global file from the
+  example template during `agent-config` install/setup. Resolution +
+  manual/templated placement satisfy "the package always uses it"; an
+  installer step that writes the example to the global path when absent is
+  a nice-to-have tracked separately to keep `install.py` out of this diff.
+
+## Alternatives
+
+- **Global always wins, ignore project files.** Rejected — it would break a
+  consumer team's legitimately checked-in shared council config. Removing
+  this package's tracked copy already gives the maintainer global-everywhere
+  behaviour without taking the override away.
+- **Keep the file project-tracked, just gitignore it.** Rejected — still
+  per-project, still absent on fresh/cloud surfaces; does not deliver
+  "configure once per user".
+
+## References
+
+- Contract: [`docs/contracts/ai-council-config.md`](../contracts/ai-council-config.md) § File location.
+- `scripts/ai_council/config.py:resolve_config_path` — the resolver.
+- `scripts/_lib/user_global_paths.py` — user-global namespace + legacy fallback.
+- `agents/templates/.ai-council.yml.example` — the documented shape to copy.

package/docs/decisions/ADR-094-agent-memory-layer-removal.md

@@ -0,0 +1,94 @@
+---
+adr: 094
+status: accepted
+date: 2026-06-14
+decision: agent-memory-layer-removal
+supersedes: —
+superseded_by: —
+phase: memory-layer-cleanup
+type: structural
+---
+
+# ADR-094 — Remove the heavyweight agent-memory layer; keep file-first memory
+
+## Status
+
+**Accepted** · 2026-06-14. Resolved by three AI-council rounds
+(claude-sonnet-4-5 + gpt-4o) on 2026-06-14; maintainer-directed package
+optimization.
+
+## Context
+
+Engineering memory in this suite had **two layers**:
+
+- **Layer 1 — file-first (in this repo).** Curated YAML under
+  `agents/memory/<type>/` + agent-written `agents/memory/intake/*.jsonl`,
+  read through `scripts/memory_lookup.retrieve()`. Git-tracked, lintable,
+  redactable, vendor-neutral. No external infrastructure.
+- **Layer 2 — the `@event4u/agent-memory` companion package (separate repo).**
+  PostgreSQL + pgvector, an MCP server, Ebbinghaus decay, trust scoring, and
+  cross-project learning. Consumed optionally via a versioned cross-repo
+  contract; `scripts/memory_lookup.py` exposed an `operational_provider` seam,
+  `scripts/memory_status.py` probed for the package CLI, and the MCP tools
+  routed through it when "present".
+
+The package was unused, its integration roadmaps were already archived, and
+its external repository is being deleted. Native agent memory (Claude, Cursor)
+is improving on the exact axis — semantic cross-session recall — where the
+package competed, and its PostgreSQL + MCP runtime contradicted the suite's
+"no app runtime" positioning.
+
+## Decision
+
+1. **Remove Layer 2 entirely** from `agent-config` — the package binding and
+   the now-dead generic operational machinery it alone served:
+   `package_operational_provider` / `_cli_operational_provider`, the
+   `operational_provider` parameter, the `OperationalProvider` type, the
+   repo-vs-operational conflict rule, `Shadow` / `with_shadows` /
+   `shadowed_by`, the package-detection in `memory_status.py`, the MCP
+   `with_package` routing, and the `agent-memory-contract.md` contract doc.
+2. **Keep Layer 1** — file-first `retrieve()`, the `check_memory.py` redaction
+   gate, and the typed curated/intake store. This is *governance* (auditable,
+   portable, reviewable), a different job from native memory.
+3. **Simplify contract artefacts in-place, do not loudly break.** The internal
+   `retrieval-v1` schema + conformance suite were reduced to repo-only
+   (`source: "repo"`; no `operational` / `trust` / `shadowed_by`) rather than
+   version-bumped, because the only consumer (the package) is deleted.
+4. **Adopt MemSkill's write-time curation discipline** (Apache-2.0,
+   github.com/ViktorAxelsen/MemSkill) into the `memory-consolidation` skill —
+   dedupe before insert, split distinct facts, merge-and-preserve on update,
+   delete only on explicit contradiction, prefer no-op under uncertainty, skip
+   trivial/fleeting/speculative. The ML training/eval pipeline is **not**
+   adopted; MemSkill's own thesis (quality comes from write-time skills, not a
+   heavy storage substrate) reinforces the removal.
+
+## Consequences
+
+- One memory layer, file-backed, smaller surface, no infra prerequisite.
+- `memory_status.status()` is now a constant file-backend report; `health()`
+  still emits the v1 envelope shape so the MCP `memory_status` tool is stable.
+- No decay engine → committed memory is bounded manually (intake gitignored,
+  type narrowing, entry caps, archived-entry deletion — see
+  `road-to-memory-pipeline-consolidation.md`).
+- The memory ADR area (`docs/adrs/memory/`) is retired from
+  `audit_adr_coverage.py`; ADR 0001 there is marked superseded by this ADR.
+
+## Alternatives considered
+
+- **Freeze Layer 2 (leave inert).** Rejected — a dormant integration surface
+  advertising a capability the suite no longer has is misleading residue.
+- **Markdown-only (drop the YML layer too).** Rejected — the working
+  `retrieve()` machinery + the `check_memory.py` redaction gate are real
+  governance a schema-less markdown parser cannot cheaply replace; an 8-consumer
+  migration is untested risk for no gain (council, Option B).
+- **Revive Layer 2 later.** Gated: requires ≥2 funded consumer projects with a
+  named maintainer each + explicit PostgreSQL adoption.
+
+## References
+
+- `agents/roadmaps/archive/road-to-agent-memory-removal.md` — the executing roadmap (archived).
+- `agents/roadmaps/archive/road-to-memory-pipeline-consolidation.md` — follow-on
+  mining consolidation + size bounding.
+- `docs/adrs/memory/0001-consumer-side-snapshot.md` — superseded by this ADR.
+- `docs/guidelines/agent-infra/memory-access.md` — the surviving file-backed
+  retrieval contract.

package/docs/decisions/ADR-095-workspace-boundary-contract.md

@@ -0,0 +1,108 @@
+---
+adr: 095
+status: accepted
+date: 2026-06-14
+decision: workspace-boundary-contract
+supersedes: —
+superseded_by: —
+phase: v6.0.0 · final-readiness · Phase 4
+type: structural
+---
+
+# ADR-095 — Workspace boundary contract + import-edge drift check
+
+## Status
+
+**Accepted** · 2026-06-14. Lands Phase 4 of
+[`road-to-6.0.0-final-readiness`](../../agents/roadmaps/archive/road-to-6.0.0-final-readiness.md).
+Routed through the AI council (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
+design mode, 2026-06-14; converged 2-round on "import-boundary linter as MVP
+with explicit semantic-drift disclaimer + escape-hatch").
+
+## Context
+
+The PR #489 / 6.0.0 review flagged that **"workspace" risks becoming the new
+"meta"** — a catch-all that absorbs every nearby concern until it owns
+everything and means nothing. The workspace is real and load-bearing (13
+`src/cli/python/workspace_*.py` modules behind `/work` and the host-drive
+loop), so the risk is concrete: a future change quietly teaches a workspace
+module to design skills, decide profile semantics, or pick video providers,
+and the boundary erodes one import at a time.
+
+The prior council finding (#3 on the parent roadmap) accepted a boundary
+contract **with modification**: this repo has no dependency-cruiser /
+TS-import-boundary tooling, so any drift mechanism must *fit the real surface*
+or *explicitly justify doc-governance-only*.
+
+## Decision
+
+1. **Author a boundary contract** at
+   [`docs/contracts/workspace-boundary.md`](../contracts/workspace-boundary.md)
+   enumerating what the workspace **owns** and **does not own**.
+2. **Drift mechanism = an import-edge linter** (`scripts/lint_workspace_boundary.py`),
+   AST-static, over `src/cli/python/workspace_*.py`. It fails if a workspace
+   module imports an owner-module of a *not-owned* domain. It is wired into CI.
+3. **Explicit scope disclaimer.** The linter enforces **import edges only**.
+   Semantic drift — a workspace module encoding profile semantics or analytics
+   *product strategy* without importing anything forbidden — is **not**
+   catchable by an import check and stays **doc-governance**, enforced in
+   review against the contract. The contract states this limit plainly so the
+   green check is never mistaken for "the boundary is fully enforced" (the
+   council's named false-confidence risk).
+4. **Escape hatch.** A `# boundary-exception: <reason>` pragma on the import
+   line lets a justified, reviewed exception through; the contract records that
+   such pragmas are reviewed like any boundary change.
+
+### Owns / does-not-own (locked by the parent roadmap's council)
+
+| Workspace **owns** | Workspace **does NOT own** |
+|---|---|
+| task orchestration | skill design |
+| host-session lifecycle | profile semantics |
+| continuation (multi-turn) | video-provider logic |
+| drive health | MCP-registry policy |
+| | analytics **product strategy** |
+
+## Consequences
+
+- The boundary becomes a CI gate, not a wish-list. Day-one state: **zero
+  violations** (survey below), so the check locks the current-correct boundary
+  rather than papering over drift.
+- The import check is cheap and precise here because workspace modules live in
+  `src/cli/python/` and the not-owned owner-modules live in `src/scripts/` —
+  separate namespaces, no false-positive surface (workspace modules import only
+  stdlib, third-party `keyring`/`cryptography`/`yaml`, and intra-workspace
+  `workspace_*`).
+- Semantic drift remains a review responsibility; the contract names it so
+  reviewers know the linter is a supplement, not a substitute.
+
+## Survey — existing violations
+
+AST import survey of all 13 `workspace_*.py` modules (2026-06-14):
+
+- The only cross-module import is `workspace_inbox → workspace_skills`
+  (intra-workspace; allowed).
+- **Zero** imports of any skill-design / profile / pack / video / MCP /
+  condense / router / persona owner-module.
+- `workspace_skills.py` *resolves* skill bodies for host hand-off (consumes,
+  does not design) → within bounds.
+- `workspace_analytics.py` records task completion/abandonment telemetry
+  (drive-health domain, not analytics product strategy) → within bounds.
+
+**Result: zero boundary violations recorded.**
+
+## Alternatives
+
+- **Doc-governance-only (no check).** Rejected as the sole mechanism: the
+  surface is concrete Python with clean namespaces, so the cheapest lock (an
+  import check) earns its keep against the most common drift vector. Kept as
+  the mechanism for *semantic* drift, which an import check cannot see.
+- **dependency-cruiser / TS import-boundary tooling.** N/A — the workspace
+  surface is Python, not TS; importing JS tooling for it is wrong-stack.
+
+## References
+
+- [`docs/contracts/workspace-boundary.md`](../contracts/workspace-boundary.md) — the contract.
+- [`scripts/lint_workspace_boundary.py`](../../src/scripts/lint_workspace_boundary.py) — the drift check.
+- [`ADR-050`](ADR-050-workspace-vs-package-root-boundary.md) — the workspace-vs-package-root trust boundary this refines at the module level.
+- [`docs/contracts/daily-workspace.md`](../contracts/daily-workspace.md) — cross-links this contract.

package/docs/decisions/INDEX.md

@@ -44,6 +44,61 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | [ADR-038](ADR-038-canonical-settings-path.md) | Canonical Settings Path | — | — | — |
 | [ADR-039](ADR-039-claude-skills-untracked.md) | Claude Skills Untracked | accepted | 2026-06-01 | — |
 | [ADR-040](ADR-040-execution-model-projection-time-filtering.md) | Execution Model Projection Time Filtering | accepted | 2026-06-02 | — |
+| [ADR-041](ADR-041-controlled-command-verbs.md) | Controlled Command Verbs | accepted | 2026-06-03 | — |
+| [ADR-042](ADR-042-runtime-resolver-decision-gate.md) | Runtime Resolver Decision Gate | accepted | 2026-06-03 | — |
+| [ADR-043](ADR-043-monorepo-collapse-to-src-domains.md) | Monorepo Collapse To Src Domains | accepted | 2026-06-03 | ADR-017 |
+| [ADR-044](ADR-044-command-naming-scheme-hyphenated.md) | Command Naming Scheme Hyphenated | accepted | 2026-06-03 | — |
+| [ADR-045](ADR-045-src-source-layout-and-profiles-as-views.md) | Src Source Layout And Profiles As Views | accepted | 2026-06-03 | ADR-028 |
+| [ADR-046](ADR-046-thin-command-principle.md) | Thin Command Principle | accepted | 2026-06-03 | — |
+| [ADR-047](ADR-047-framework-neutral-stack-adaptive-commands.md) | Framework Neutral Stack Adaptive Commands | accepted | 2026-06-03 | — |
+| [ADR-048](ADR-048-command-justification-rule.md) | Command Justification Rule | accepted | 2026-06-03 | — |
+| [ADR-049](ADR-049-configuration-trust-boundary.md) | Configuration Trust Boundary | accepted | 2026-06-03 | — |
+| [ADR-050](ADR-050-workspace-vs-package-root-boundary.md) | Workspace Vs Package Root Boundary | accepted | 2026-06-05 | — |
+| [ADR-051](ADR-051-uncondensed-source-container-relocation.md) | Uncondensed Source Container Relocation | accepted | 2026-06-05 | — |
+| [ADR-052](ADR-052-packages-removal-and-pack-home-migration.md) | Packages Removal And Pack Home Migration | accepted | 2026-06-05 | — |
+| [ADR-053](ADR-053-agents-namespace-dual-role-resolution.md) | Agents Namespace Dual Role Resolution | accepted | 2026-06-05 | — |
+| [ADR-054](ADR-054-rule-adherence-decay-triggered-restate.md) | Rule Adherence Decay Triggered Restate | proposed | 2026-06-05 | — |
+| [ADR-055](ADR-055-flow-layer-data-model.md) | Flow Layer Data Model | proposed | 2026-06-06 | — |
+| [ADR-056](ADR-056-unvalidated-video-adapters-disposition.md) | Unvalidated Video Adapters Disposition | accepted | 2026-06-06 | — |
+| [ADR-057](ADR-057-consolidation-evidence-gate-outcomes.md) | Consolidation Evidence Gate Outcomes | proposed | 2026-06-06 | — |
+| [ADR-058](ADR-058-condensed-output-relocation-to-dist.md) | Condensed Output Relocation To Dist | accepted | 2026-06-06 | — |
+| [ADR-059](ADR-059-render-resume-filesystem-as-state.md) | Render Resume Filesystem As State | accepted | 2026-06-07 | — |
+| [ADR-060](ADR-060-comfyui-sandbox-model.md) | Comfyui Sandbox Model | accepted | 2026-06-07 | — |
+| [ADR-061](ADR-061-corpus-grounding-layer.md) | Corpus Grounding Layer | accepted | 2026-06-07 | — |
+| [ADR-062](ADR-062-encrypt-at-rest-store-architecture.md) | Encrypt At Rest Store Architecture | accepted | 2026-06-08 | — |
+| [ADR-063](ADR-063-append-jsonl-encryption-deferred.md) | Append Jsonl Encryption Deferred | accepted | 2026-06-08 | — |
+| [ADR-064](ADR-064-append-jsonl-per-record-encryption.md) | Append Jsonl Per Record Encryption | accepted | 2026-06-08 | — |
+| [ADR-065](ADR-065-tier3-inbox-handoff-v0.md) | Tier3 Inbox Handoff V0 | accepted | 2026-06-08 | — |
+| [ADR-066](ADR-066-skill-body-prerendering.md) | Skill Body Prerendering | accepted | 2026-06-08 | — |
+| [ADR-067](ADR-067-glama-registry-listing.md) | Glama Registry Listing | proposed | 2026-06-08 | — |
+| [ADR-068](ADR-068-host-tier-detection.md) | Host Tier Detection | accepted | 2026-06-08 | — |
+| [ADR-069](ADR-069-prompt-renderer.md) | Prompt Renderer | accepted | 2026-06-08 | — |
+| [ADR-070](ADR-070-tier1-drive-loop.md) | Tier1 Drive Loop | accepted | 2026-06-08 | — |
+| [ADR-071](ADR-071-launch-drive-integration.md) | Launch Drive Integration | accepted | 2026-06-08 | — |
+| [ADR-072](ADR-072-codex-gemini-drive-configs.md) | Codex Gemini Drive Configs | accepted | 2026-06-08 | — |
+| [ADR-073](ADR-073-drive-health-kill-switch.md) | Drive Health Kill Switch | accepted | 2026-06-08 | — |
+| [ADR-074](ADR-074-drive-kill-switch-auto-recovery.md) | Drive Kill Switch Auto Recovery | accepted | 2026-06-08 | — |
+| [ADR-075](ADR-075-workspace-gui-drive.md) | Workspace Gui Drive | accepted | 2026-06-08 | — |
+| [ADR-076](ADR-076-workspace-multi-turn.md) | Workspace Multi Turn | accepted | 2026-06-09 | — |
+| [ADR-077](ADR-077-workspace-followup-gui.md) | Workspace Followup Gui | accepted | 2026-06-09 | — |
+| [ADR-078](ADR-078-drive-health-panel.md) | Drive Health Panel | accepted | 2026-06-09 | — |
+| [ADR-079](ADR-079-workspace-host-picker.md) | Workspace Host Picker | accepted | 2026-06-09 | — |
+| [ADR-080](ADR-080-host-session-expired-410.md) | Host Session Expired 410 | accepted | 2026-06-09 | — |
+| [ADR-081](ADR-081-drive-health-reset-and-410-affordance.md) | Drive Health Reset And 410 Affordance | accepted | 2026-06-09 | — |
+| [ADR-082](ADR-082-410-one-click-relaunch.md) | 410 One Click Relaunch | accepted | 2026-06-09 | — |
+| [ADR-083](ADR-083-session-thread-and-arbitrary-continuation.md) | Session Thread And Arbitrary Continuation | accepted | 2026-06-09 | — |
+| [ADR-084](ADR-084-drive-health-refresh-on-drive.md) | Drive Health Refresh On Drive | accepted | 2026-06-09 | — |
+| [ADR-085](ADR-085-mcp-stdio-end-user-distribution-shape.md) | Mcp Stdio End User Distribution Shape | accepted | 2026-06-10 | — |
+| [ADR-086](ADR-086-read-only-cross-agent-mcp-discovery-helper.md) | Read Only Cross Agent Mcp Discovery Helper | rejected | 2026-06-11 | — |
+| [ADR-087](ADR-087-installer-e2e-test-strategy.md) | Installer E2E Test Strategy | accepted | 2026-06-11 | — |
+| [ADR-088](ADR-088-no-external-runtime-federation.md) | No External Runtime Federation | accepted | 2026-06-11 | — |
+| [ADR-089](ADR-089-lean-local-plugin-install.md) | Lean Local Plugin Install | accepted | 2026-06-12 | — |
+| [ADR-090](ADR-090-visibility-command-frontmatter-field.md) | Visibility Command Frontmatter Field | accepted | 2026-06-13 | — |
+| [ADR-091](ADR-091-split-meta-capability-packs.md) | Split Meta Capability Packs | accepted | 2026-06-13 | — |
+| [ADR-092](ADR-092-defer-command-tier-alias-removal.md) | Defer Command Tier Alias Removal | accepted | 2026-06-13 | — |
+| [ADR-093](ADR-093-ai-council-config-user-global.md) | Ai Council Config User Global | accepted | 2026-06-13 | — |
+| [ADR-094](ADR-094-agent-memory-layer-removal.md) | Agent Memory Layer Removal | accepted | 2026-06-14 | — |
+| [ADR-095](ADR-095-workspace-boundary-contract.md) | Workspace Boundary Contract | accepted | 2026-06-14 | — |
 
 ## Unnumbered (legacy)
 

package/docs/deploy/small-team-recipe.md

@@ -1,7 +1,7 @@
 # Small-Team Recipe — 3–10 people, no code change
 
 > **Status** · v0 · 2026-05-24. Phase 9 of
-> [`road-to-employee-product-and-external-proof.md`](../../agents/roadmaps/road-to-employee-product-and-external-proof.md).
+> [`road-to-employee-product-and-external-proof.md`](../../agents/roadmaps/archive/road-to-employee-product-and-external-proof.md).
 > The recipe relies entirely on **existing primitives**. No new
 > code, no new server, no shared backend. Each user runs the
 > workspace locally; the team shares the inputs.

package/docs/deploy/team-deployment-posture.md

@@ -1,7 +1,7 @@
 # Team Deployment Posture
 
 > **Status** · v0 · 2026-05-24. Phase 9 of
-> [`road-to-employee-product-and-external-proof.md`](../../agents/roadmaps/road-to-employee-product-and-external-proof.md).
+> [`road-to-employee-product-and-external-proof.md`](../../agents/roadmaps/archive/road-to-employee-product-and-external-proof.md).
 > Codifies what is shipped today, what stays cancelled-with-reason,
 > and what is reachable via existing primitives — so feedback rounds
 > 9+ asking "team SSO when?" land on a written answer.

package/docs/development.md

@@ -8,7 +8,7 @@
 
 ## Editing content
 
-1. **Always edit in `.agent-src.uncondensed/`** — never in `.agent-src/` or `.augment/` directly
+1. **Always edit in `src/`** — never in `dist/agent-src/` or `.augment/` directly
 2. Run `task sync` to copy non-`.md` files
 3. Use the `/condense` command to condense changed `.md` files
 4. Run `task ci` to verify everything passes before pushing
@@ -33,9 +33,9 @@ task consistency-fix           # Regenerate all derived outputs from source
 ### Sync & Condensation
 
 ```bash
-task sync                      # .agent-src.uncondensed/ → .agent-src/, then project → .augment/
+task sync                      # src/ → dist/agent-src/, then project → .augment/
 task sync-changed              # List .md files changed since last condensation
-task sync-check                # Check if .agent-src/ is in sync (for CI)
+task sync-check                # Check if dist/agent-src/ is in sync (for CI)
 task sync-check-hashes         # Verify condensed .md hashes match source
 task sync-mark-done <file>     # Mark a single file as condensed
 task sync-mark-all-done        # Mark ALL files as condensed
@@ -200,22 +200,20 @@ tests/
 .github/workflows/
 ├── skill-lint.yml             ← Lint + PR comment workflow
 └── consistency.yml            ← Sync + hash + tool verification
-templates/consumer-settings/   ← Settings templates for consumer projects
+src/templates/consumer-settings/   ← Settings templates for consumer projects
 
-.agent-src.uncondensed/         ← Source of truth (human-readable, verbose)
+src/                            ← Source of truth (human-readable, verbose)
 ├── rules/                     ← Behavior rules
 ├── skills/                    ← Skill definitions (SKILL.md per skill)
-├── commands/                  ← Slash command definitions
-├── guidelines/                ← Coding guidelines by language
-├── templates/                 ← Document scaffolds
-└── contexts/                  ← System knowledge documents
+├── domains/                   ← Slash command definitions (per pack)
+└── agent-src/                 ← Contexts, templates, profiles, personas, …
 
-.agent-src/                    ← Condensed output (token-efficient, shipped)
+dist/agent-src/                    ← Condensed output (token-efficient, shipped)
 ├── (same structure)           ← Condensed .md + copied non-.md files
 
 .augment/                      ← Local projection for Augment Code (gitignored)
 ├── rules/                     ← Real file copies (Augment cannot load symlinked rules)
-└── skills/, commands/, ...    ← Symlinks → ../.agent-src/<sub>
+└── skills/, commands/, ...    ← Symlinks → ../dist/agent-src/<sub>
 ```
 
 ---