@event4u/agent-config 5.10.1 → 6.1.0

package/dist/agent-src/skills/accessibility-auditor/data/aria-patterns.csv

@@ -0,0 +1,13 @@
+Component,Keywords,Pattern,Implementation,WCAG Refs,Anti-Patterns,Docs URL
+Modal dialog,modal dialog overlay popup confirm,dialog role + aria-modal,"role=dialog aria-modal=true aria-labelledby; focus moves in on open, trapped while open, returns to trigger on close; Esc closes","WCAG 2.4.3, 2.1.2; APG dialog pattern",Focus left behind the overlay; close only via pointer,https://www.w3.org/WAI/ARIA/apg/patterns/dialog-modal/
+Combobox / autocomplete,combobox autocomplete select search suggest dropdown,combobox + listbox popup,"role=combobox aria-expanded aria-controls aria-activedescendant; Down opens list, Enter selects, Esc closes; results announced via live region count","WCAG 4.1.2, 1.3.1",Re-implementing as div+onclick without keyboard model,https://www.w3.org/WAI/ARIA/apg/patterns/combobox/
+Tabs,tabs tabpanel tablist switch view,tablist/tab/tabpanel triad,"role=tablist/tab/tabpanel, aria-selected, tab order: one tabstop into list then Arrow keys; panel labelled by its tab","WCAG 2.1.1, 4.1.2",Each tab a separate Tab stop; panels not labelled,https://www.w3.org/WAI/ARIA/apg/patterns/tabs/
+Accordion / disclosure,accordion disclosure expand collapse faq section,button + aria-expanded,Header is a real button with aria-expanded + aria-controls; content region labelled; Enter/Space toggle,"WCAG 4.1.2, 1.3.1",Heading-with-onclick; hiding content with display:none while aria-expanded=true,https://www.w3.org/WAI/ARIA/apg/patterns/accordion/
+Menu / dropdown actions,menu dropdown actions kebab context,menu button + menu/menuitem,"menubutton with aria-haspopup=menu aria-expanded; Arrow navigation, Esc closes and returns focus; menuitem (not links styled as menu)",WCAG 2.1.1,Using role=menu for site navigation (use nav+links),https://www.w3.org/WAI/ARIA/apg/patterns/menubutton/
+Toast / status message,toast notification snackbar status alert,status / alert live regions,"role=status (polite) for confirmations, role=alert (assertive) sparingly for errors; never move focus to a toast; pause on hover/focus; allow dismissal","WCAG 4.1.3, 2.2.1",Focus-stealing toasts; auto-dismiss with no persistence option for critical info,https://www.w3.org/WAI/ARIA/apg/patterns/alert/
+Data table,table grid sortable data rows columns,table semantics + aria-sort,Native table elements with th scope; sortable headers are buttons inside th with aria-sort on the th; caption or aria-label names the table,WCAG 1.3.1,Div-grid for tabular data; sort state only as an icon,https://www.w3.org/WAI/ARIA/apg/patterns/table/
+Form validation feedback,form error validation invalid message field,described-by + alert summary,aria-invalid + aria-describedby on the field; on submit failure move focus to first invalid field or an error-summary with anchor links; errors persist until fixed,"WCAG 3.3.1, 3.3.3, 2.4.3",Placeholder-only labels; toast-only errors,https://www.w3.org/WAI/tutorials/forms/notifications/
+Skip link & landmarks,skip link landmark main nav banner region,landmarks + skip to main,"First focusable element is a skip-to-main link (visible on focus); one main, labelled nav/aside regions",WCAG 2.4.1,Multiple unlabelled navs; skip link that never becomes visible,https://www.w3.org/WAI/ARIA/apg/patterns/landmarks/
+Drag and drop / reorder,drag drop reorder sortable kanban move,keyboard-equivalent commands,Every drag operation has a keyboard path (move-up/move-down buttons or grab mode with arrows + announcements); aria-live announces position changes,"WCAG 2.1.1, 2.5.7",Pointer-only reordering,https://www.w3.org/WAI/ARIA/apg/patterns/listbox/
+Loading / busy state,loading spinner skeleton busy progress,aria-busy + progressbar/status,Region marked aria-busy during load OR role=progressbar with valuenow; announce completion via status region; skeletons are aria-hidden,WCAG 4.1.3,Spinner gif with no text alternative; focus lost on content swap,https://www.w3.org/WAI/ARIA/apg/patterns/meter/
+Icon-only button,icon button close edit delete aria-label svg,accessible name on control,aria-label (or visually-hidden text) on the button; svg aria-hidden=true focusable=false; hit area ≥44px,"WCAG 4.1.2, 2.5.8",title attribute as the only name; emoji as icon,https://www.w3.org/WAI/ARIA/apg/patterns/button/

package/dist/agent-src/skills/accessibility-auditor/data/manifest.json

@@ -0,0 +1,34 @@
+{
+  "manifest_version": 1,
+  "domain": "a11y-patterns",
+  "tier": "lookup-only",
+  "retriever": "bm25",
+  "default_domain": "patterns",
+  "domains": {
+    "patterns": {
+      "file": "aria-patterns.csv",
+      "search_cols": [
+        "Component",
+        "Keywords",
+        "Pattern",
+        "Implementation"
+      ],
+      "output_cols": [
+        "Component",
+        "Pattern",
+        "Implementation",
+        "WCAG Refs",
+        "Anti-Patterns",
+        "Docs URL"
+      ],
+      "max_results": 3
+    }
+  },
+  "owner": "package-maintainer",
+  "refresh_cadence": "quarterly",
+  "upstream": {
+    "repo": "derived: W3C ARIA Authoring Practices Guide + WCAG 2.2",
+    "sha": "APG 2026 / WCAG 2.2",
+    "last_checked": "2026-06-07"
+  }
+}

package/dist/agent-src/skills/adversarial-review/SKILL.md

@@ -0,0 +1,170 @@
+---
+model_tier: high
+name: adversarial-review
+description: "ONLY when user requests adversarial review, devil's advocate, stress-test, OR honest critique of finished work ('poke holes', 'be brutal', 'was hältst du davon') — NOT for routine code/design review."
+personas:
+  - critical-challenger
+domain: quality
+council_depth: deep
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# Adversarial Review
+
+## When to use
+
+Use this skill when:
+- You've completed a plan, design, or proposed fix and are about to present it.
+- The change is non-trivial (affects multiple files, changes behavior, touches critical paths).
+- You're about to recommend an architecture or design decision.
+- The user submits **finished work** (draft, post, naming decision, design proposal) and asks for an honest critical take — "what do you actually think?", "be brutal", "was hältst du wirklich davon". The flow is the same Attack-Defend-Revise loop, but on the user's artifact rather than the agent's plan.
+
+Do NOT use when:
+- The task is trivial (renaming, formatting, simple config change).
+- The user explicitly asked for a quick/rough draft.
+- You're exploring options, not committing to one yet.
+
+## Procedure: Adversarial review
+
+1. **Inspect the artifact** — Read the plan, diff, or draft you are about to critique; note its scope, assumptions, and the explicit asks before attacking.
+2. **Attack** — Run Step 1 below as the grumpy senior engineer.
+3. **Defend** — Run Step 2 as the balanced engineer; classify each criticism as must-fix / defer / reject.
+4. **Revise** — Run Step 3 to fold valid fixes back in and surface only the trade-offs the user needs to decide.
+
+### Step 1: Attack (Grumpy Senior Engineer)
+
+Assume your plan/fix is flawed. Ask yourself:
+
+- What's the weakest assumption?
+- Where will this break under load, at scale, or with edge cases?
+- What did I ignore or hand-wave?
+- Is this over-engineered for the actual problem?
+- Would a simpler approach work just as well?
+- What will the next developer curse me for?
+
+### Step 2: Defend (Balanced Engineer)
+
+Counter the criticism fairly:
+
+- Which criticisms are valid and must be addressed now?
+- Which are theoretical and can be deferred?
+- What's the pragmatic middle ground?
+
+### Step 3: Revise
+
+- Fix the valid issues in your plan/fix.
+- Move deferred concerns to "Open Questions" or "Known Limitations".
+- Present the improved version to the user.
+
+**Do this internally** — the user sees the improved result, not the raw debate.
+Only surface trade-offs or concerns that need the user's input.
+
+## Context-specific attack questions
+
+### Feature plans / Architecture
+
+- Is this the simplest solution that works?
+- What happens when requirements change (and they will)?
+- Are there hidden dependencies or coupling?
+- Does this respect existing patterns or introduce a new one unnecessarily?
+- What's the migration/rollback story?
+
+### Bug fixes
+
+- Is this the root cause or just a symptom?
+- Will this fix break something else?
+- Does the fix handle the edge case that caused the bug?
+- Is there a regression test that proves the fix works?
+- Are there other places with the same bug pattern?
+
+### Code changes / Refactoring
+
+- Would I understand this code in 6 months without context?
+- Did I check all callers and downstream effects?
+- Are the tests actually testing the right behavior?
+- Did I introduce a new pattern where an existing one would work?
+
+### Database migrations
+
+- Can this destroy or corrupt data?
+- Is rollback possible?
+- What happens to running queries during migration?
+- Did I check the table size (large table ALTER can lock)?
+
+### API design
+
+- Is this a breaking change?
+- Is it consistent with existing endpoints?
+- Are error responses clear and actionable?
+- Did I consider pagination, filtering, versioning?
+
+### Security-sensitive changes
+
+- Where is the attack surface I'm not seeing?
+- Am I trusting user input anywhere?
+- Are there authorization gaps?
+- Would this pass a security review?
+
+## Integration with other skills
+
+- **feature-planning** — adversarial review after Understanding Lock, before presenting the plan.
+- **bug-analyzer** — review the proposed fix before implementing.
+- **code-review** — self-review before creating a PR.
+- **laravel-migration** (or framework-native equivalent) — review migration for data safety.
+- **api-design** — review API design for consistency and breaking changes.
+- **security** — review security-sensitive changes for attack surface.
+
+## RDP: fresh-context verifier as the default gate (structural)
+
+Within the Reasoning Discipline Protocol the fresh-context verifier subagent is
+the **default** final gate — but, because it is a full extra inference pass, it
+fires only on the **structural-complexity** signal: ≥ 2 of {branching/conditional
+logic, ≥ 3 explicit must/must-not constraints, stateful operations,
+irreversibility} **and** estimated work ≥ ~1k tokens. Token length alone never
+triggers it. See [`rdp-gate`](../../contexts/execution/rdp-gate.md) (L12).
+
+## Auto-trigger keywords
+
+- adversarial review
+- self-review
+- challenge plan
+- review my approach
+- sanity check
+
+### Validate
+
+- Confirm each identified risk has a concrete mitigation or explicit acceptance.
+- Verify the review produced at least one actionable finding (or explicit "no issues found").
+- Check that the review did not just restate the plan — it must challenge assumptions.
+
+## Output format
+
+1. Improved plan/code incorporating adversarial findings
+2. Risk summary — top concerns discovered and how they were addressed
+3. Remaining open risks (if any) with severity rating
+
+## Gotcha
+
+- Don't use this on trivial changes — it adds overhead without value on simple renames or config tweaks.
+- The model tends to invent risks that don't exist. Ground every concern in actual code, not hypotheticals.
+- Don't challenge the user's explicit requirements — challenge the implementation, not the goal.
+
+## Do NOT
+
+- Do NOT present the raw adversarial debate to the user — only the improved result.
+- Do NOT use this as an excuse to delay work — the review should take seconds, not minutes.
+- Do NOT apply this to trivial changes — it adds overhead without value.
+- Do NOT let the "grumpy engineer" kill good ideas — the balanced engineer must counter.
+- Do NOT skip Step 3 (Revise) — attacking without improving is just complaining.
+
+## References
+
+- **Tree-of-Thoughts (ToT)** — [arxiv.org/abs/2305.10601](https://arxiv.org/abs/2305.10601)
+  Deliberate problem-solving by exploring multiple reasoning branches.
+  This skill adapts ToT by pitting a grumpy engineer against a
+  balanced engineer — the branching happens between roles, not
+  between thought-tree nodes.
+

package/dist/agent-src/skills/agent-security-review/SKILL.md

@@ -0,0 +1,113 @@
+---
+model_tier: high
+name: agent-security-review
+description: "Use for an adversarial red-team / blue-team / auditor review of an AI agent's CONFIG + behaviour (rules, skills, MCP, hooks, permissions) — attack-chain → defensive-gap list, not a code audit."
+personas:
+  - security-engineer
+domain: quality
+council_depth: deep
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# agent-security-review
+
+Adversarial review of an **agent's configuration + behaviour** — the trust
+anchor, not the app code. Where [`threat-modeling`](../threat-modeling/SKILL.md)
+models a code change and [`security-audit`](../security-audit/SKILL.md) hunts
+code vulns, this asks: given this assembled config (rules, skills, MCP, hooks,
+permissions, memory), how would an attacker turn it against its owner, and what
+gap lets them?
+
+Pairs the static signal from `/security-audit-config` with a three-lens
+adversarial pass. Output is **decision support** — surface the trade-off, name
+the gap; the human decides.
+
+## When to use
+
+- "Is my agent setup safe / could this be weaponised".
+- Before trusting a third-party skill pack, MCP server, or rules file.
+- Periodic posture review of a fleet's agent config.
+- Any `D`/`F` category from `/security-audit-config` needing depth.
+
+## Procedure
+
+### 1. Inventory + inspect the attack surface
+
+Inspect the config the agent loads and check each surface: instruction files
+(CLAUDE.md / AGENTS.md / .cursor/rules / copilot-instructions), installed skills
++ their `allowed-tools`, MCP servers + tool descriptions, hooks + lifecycle
+scripts, permission/auto-approve settings, persistent memory. Static pass first:
+
+```bash
+python3 src/scripts/security_audit_config.py --root <repo> --json
+```
+
+### 2. Red team (attacker lens)
+
+Per surface, construct concrete **attack chains** grounded in known classes:
+
+- Rules-file backdoor — hidden-Unicode / suppression instruction in a loaded file.
+- MCP tool-poisoning / rug-pull — malicious or mutated tool description.
+- Lethal trifecta — a path reading private data, ingesting untrusted content,
+  AND able to communicate externally.
+- Consent bypass — `bypassPermissions`, `Bash(*)`, auto-approve, `npx -y`.
+- Memory / context poisoning — a planted instruction firing later.
+
+Name the chain: *entry → mechanism → impact*. Be specific (which file, tool).
+
+### 3. Blue team (defender lens)
+
+Per chain, evaluate existing defences: are the always-on rules
+([`untrusted-input-defense`](../../rules/untrusted-input-defense.md),
+[`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md),
+[`non-destructive-by-default`](../../rules/non-destructive-by-default.md)) in
+force? Egress gated? Untrusted leg quarantined? Note present vs **absent**.
+
+### 4. Auditor (synthesis)
+
+Pair each chain with its gap, prioritise (likelihood × impact). For the hardest
+calls run [`ai-council`](../ai-council/SKILL.md) (`council_depth: deep`) +
+[`judge-security-auditor`](../judge-security-auditor/SKILL.md) over flagged
+files. Produce a ranked **attack-chain → gap → recommended control** table.
+
+## Output
+
+A prioritised table — `attack chain | defensive gap | OWASP ASI | recommended control | confidence` —
+prefixed with the trust-and-safety banner (advisory security output):
+
+```
+> HUMAN REVIEW REQUIRED — adversarial agent-config review. Findings are
+> decision support, not a guarantee; detection is probabilistic. Validate
+> each chain before acting.
+```
+
+Recommend controls; never auto-apply config changes (per
+[`scope-control`](../../rules/scope-control.md)).
+
+## Gotcha
+
+- **Clean static score ≠ safe.** The worst chains (rug-pull MCP tool whose
+  description mutates post-approval, a lethal-trifecta path across three
+  individually-fine skills) leave no single linter hit — only the red-team lens
+  (step 2) **inspects** how surfaces compose. Always run the adversarial pass.
+- **Tool descriptions are part of the surface.** Reading only config files and
+  skipping each MCP server's live tool descriptions misses tool-poisoning.
+- **The reviewer is not the fixer.** Emitting a config patch turns advisory
+  review into an unreviewed change — recommend, hand back.
+
+## Do NOT
+
+- Do NOT treat a clean static score as proof of safety — the red-team lens finds
+  chains the linters cannot see.
+- Do NOT block or "fix" the consumer's config autonomously — surface + recommend.
+- Do NOT re-audit application code here — that is `security-audit` / `threat-modeling`.
+- Do NOT omit the HUMAN REVIEW REQUIRED banner.
+
+## See also
+
+- `/security-audit-config` — the static A–F counterpart.
+- [`untrusted-input-defense`](../../rules/untrusted-input-defense.md), [`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md) — the prevention rules.
+- [`threat-modeling`](../threat-modeling/SKILL.md), [`judge-security-auditor`](../judge-security-auditor/SKILL.md), [`ai-council`](../ai-council/SKILL.md).

package/dist/agent-src/skills/agent-security-review/evals/triggers.json

@@ -0,0 +1,51 @@
+{
+    "skill": "agent-security-review",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for adversarial review of an agent's CONFIG/behaviour (rules, skills, MCP, hooks, permissions). Should-not-trigger covers the near-miss neighbours (code threat-model, code security-audit, the static config-audit command, privacy review, dependency CVE scan) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "red-team my agent setup — could someone weaponise my CLAUDE.md or MCP servers?",
+            "trigger": true
+        },
+        {
+            "q": "do an adversarial security review of this agent config and its skills",
+            "trigger": true
+        },
+        {
+            "q": "is this third-party skill pack safe to install, attacker's view?",
+            "trigger": true
+        },
+        {
+            "q": "prüfe meine Agent-Konfiguration adversarial auf Angriffsketten",
+            "trigger": true
+        },
+        {
+            "q": "what could an attacker do with my rules files, hooks and tool permissions?",
+            "trigger": true
+        },
+        {
+            "q": "threat-model this new payments endpoint before I build it",
+            "trigger": false,
+            "note": "code change threat model → threat-modeling"
+        },
+        {
+            "q": "find vulnerabilities in my application code",
+            "trigger": false,
+            "note": "code vulnerability hunt → security-audit"
+        },
+        {
+            "q": "give me an A-F score for my agent config",
+            "trigger": false,
+            "note": "static scored audit → /security-audit-config command, not the adversarial skill"
+        },
+        {
+            "q": "are we GDPR compliant with this data flow?",
+            "trigger": false,
+            "note": "regulatory-regime read → privacy-review"
+        },
+        {
+            "q": "scan my dependencies for known CVEs",
+            "trigger": false,
+            "note": "dependency CVE audit → security-audit dependency pass"
+        }
+    ]
+}

package/dist/agent-src/skills/agents-md-thin-root/SKILL.md

@@ -0,0 +1,143 @@
+---
+model_tier: inherit
+name: agents-md-thin-root
+description: "Use when editing AGENTS.md (package root) or templates/AGENTS.md (consumer) — enforces Thin-Root contract: hard char ceilings, ≥40% pointer ratio, mandatory emergency-triage block."
+domain: process
+execution:
+  type: assisted
+  handler: internal
+  allowed_tools: []
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+---
+
+<!-- cloud_safe: noop -->
+
+# agents-md-thin-root
+
+## When to use
+
+Use when:
+- Editing `AGENTS.md` at the package root.
+- Editing `packages/core/.agent-src.uncondensed/templates/AGENTS.md` (consumer-shipped template).
+- Reviewing a PR that changes either file.
+- Running `/optimize/agents`.
+- A budget meter (`scripts/measure_augment_budget.py`) flags the package-root AGENTS.md as the dominant cost.
+
+## Do NOT
+
+- Edit `.github/copilot-instructions.md` with this skill (use `copilot-agents-optimization` instead).
+- Edit other `.md` files under `.augment/`, `packages/*/.agent-src.uncondensed/`, or `agents/` with this skill.
+- Add a section to AGENTS.md without first checking whether an outboard target already exists in `agents/settings/contexts/` or `docs/contracts/`.
+- Replace prose with a bare link `[label](path)` — every pointer needs a *why*-clause ≥ 60 chars or it does not count toward the 40 % ratio.
+- Reuse the package-root anatomy in the consumer template — caps and target paths differ.
+
+## Why Thin-Root
+
+Augment Code injects `AGENTS.md` verbatim into every workspace prompt. Each kilobyte spent here permanently consumes the 49,512-char workspace-guidelines budget shared with always-rules and auto-rule registry stubs. The Thin-Root pattern keeps the entry point a navigation surface (pointers + intent) and pushes deep detail into files Augment loads on demand via `load_context` or that other tools fetch only when their search retrieves them. Strategic council R2 (2026-05-08, Sonnet 4.5 / Opus 4.1 / gpt-4o / o1) converged on the contract codified below as the minimum guard against AGENTS.md re-bloat.
+
+## Iron Law — Capabilities over Structure
+
+Every entry describes **what** the project does or **where** to learn more — never **where** individual files live. Path lists rot every refactor and poison context; capability pointers survive structural churn. Full anatomy with rewrite recipes, monorepo guidance, and multi-tool symlink strategy: [`agents-md-anatomy`](../../contexts/contracts/agents-md-anatomy.md).
+
+## The contract — hard caps
+
+| File | FAIL above | WARN above | Target |
+|---|---|---|---|
+| `AGENTS.md` (package root) | 3,000 chars | 2,800 chars | ≤ 2,800 |
+| `packages/core/.agent-src.uncondensed/templates/AGENTS.md` (consumer) | 2,500 chars | 2,300 chars | ≤ 2,300 |
+
+Char-count is raw file size (`wc -c`), frontmatter included. Enforcement: `scripts/lint_agents_md.py` (Phase 7), wired into the package's CI pipeline via the `lint-agents-md` task. WARN is a soft signal in CI; FAIL blocks merge.
+
+The R2 council originally proposed 2,500 / 2,000 caps. Phase 6.4 empirical refactor demonstrated that the mandatory emergency-triage block (≈ 700 chars) plus operational must-haves (source-of-truth disclaimer, `task` quickstart, six substantive pointers) raise the achievable floor by ≈ 500 chars. The caps above are the post-refactor baseline; the previous numbers stayed unattainable without dropping mandatory content.
+
+## The contract — pointer ratio
+
+≥ 40 % of non-blank lines must be **substantive pointers**. A substantive pointer is a Markdown link `[label](path[#anchor])` whose surrounding sentence carries a *why* clause ≥ 60 chars explaining what the reader will learn there. Decorative links (table-of-contents, badges, repeated cross-refs) do not count. Lint formula:
+
+```
+pointer_ratio = (substantive_pointer_lines / non_blank_lines) >= 0.40
+```
+
+## The contract — pointer anatomy
+
+Every substantive pointer specifies, on the same line or the immediately following line:
+
+1. **Target file path** — repo-relative, no leading `./`.
+2. **Optional anchor** — `#section-slug` when the linked file's content is large enough that landing in the middle saves the reader. Skip only when the linked file is itself short.
+3. ***Why* clause** — ≥ 60 chars, present-tense, names the concrete decision the pointer unblocks. Not "see also", not "more info", not the file's title repeated.
+
+### Wrong vs. right
+
+❌ **Wrong** — bare link, no *why*, no anchor:
+> See [`commit-policy`](dist/agent-src/rules/commit-policy.md).
+
+❌ **Wrong** — *why* present but < 60 chars:
+> Commit rules: [`commit-policy`](dist/agent-src/rules/commit-policy.md).
+
+✅ **Right** — full anatomy, anchor, *why* ≥ 60 chars:
+> Commit policy — never auto-commit, four named exceptions, Hard Floor list of bulk-deletion / infra triggers: [`commit-policy § Iron Law`](dist/agent-src/rules/commit-policy.md#the-iron-law).
+
+✅ **Right** — anchor optional when target is short:
+> Mirror the user's language every reply, single Iron Law that overrides any momentum: [`language-and-tone`](dist/agent-src/rules/language-and-tone.md).
+
+## The contract — emergency-triage block
+
+Every Thin-Root AGENTS.md MUST contain an **Emergency Triage** section verbatim from `packages/core/.agent-src.uncondensed/contexts/contracts/emergency-triage-block.md` (Phase 6.4 will create that file as the canonical source). The block lists the five questions a host agent answers from the root file alone when network / tool access is degraded:
+
+1. What is this repository?
+2. What language(s) does this repository accept?
+3. Where do I edit (source-of-truth path)?
+4. What is the lint / test / sync entry point?
+5. Where do the always-active behavior rules live?
+
+Each answer must fit on one line. The block exists so the root never silently degrades to "useful only when every linked file is reachable".
+
+## Procedure — apply Thin-Root to AGENTS.md
+
+1. **Measure baseline.** `wc -c AGENTS.md` and `python3 scripts/measure_augment_budget.py`. Record current char-count and the gap to 2,200 / 2,500.
+2. **Inventory sections.** List every `## ` heading and its char-count. Mark each as `keep-inline` (Iron-Law-adjacent, ≤ 200 chars, no good outboard target) or `outboard-candidate` (longer-form prose, table-only sections, narrative).
+3. **Identify outboard targets.** For each `outboard-candidate`, name the destination — `packages/core/.agent-src.uncondensed/contexts/`, `docs/contracts/`, an existing rule body, an existing skill body. Never invent a new top-level directory.
+4. **Move content; insert pointer.** Cut the section into the target file. Replace it in AGENTS.md with a single substantive pointer per anatomy above. Verify the *why*-clause length.
+5. **Re-measure.** `wc -c AGENTS.md` again. If above 2,200, repeat steps 2–4 on the next-largest section. Above 2,500 = must outboard further before commit.
+6. **Validate pointer ratio.** Count non-blank lines and substantive-pointer lines. Ratio < 0.40 = collapse decorative or boilerplate lines into a single pointer or remove.
+7. **Verify emergency-triage block.** Diff the in-file block against `packages/core/.agent-src.uncondensed/contexts/contracts/emergency-triage-block.md`. Drift = revert to canonical.
+8. **Run lints.** `task lint-agents-md && task check-refs && task lint-skills`. All green before commit.
+
+## Procedure — apply Thin-Root to consumer template
+
+Same procedure, applied to `packages/core/.agent-src.uncondensed/templates/AGENTS.md`. Hard cap shifts to 2,000 / 1,700. The consumer template intentionally lacks the package-self-references — its pointers target files that exist in the **consumer's** repo (`.augment/skills/`, `agents/settings/contexts/`, ...), not this package's authoring tree.
+
+## Gotchas
+
+- **Outboarding to a new top-level dir.** Inventing `agents/explainers/` or `docs/notes/` for the moved content silently widens the contract surface. Outboard only into `packages/core/.agent-src.uncondensed/contexts/`, `docs/contracts/`, an existing rule body, or an existing skill body.
+- **Pointer-ratio inflation by decoration.** Adding boilerplate "Browse all skills" / "See also" links to lift the ratio above 40 % defeats the purpose. The lint counts only substantive pointers (with a *why*-clause ≥ 60 chars); decorative links get filtered out and the ratio drops back below threshold.
+- **Emergency-triage drift.** Editing the in-file emergency-triage block instead of the canonical `packages/core/.agent-src.uncondensed/contexts/contracts/emergency-triage-block.md` causes the package-root and consumer-template versions to diverge silently. Always edit the canonical file and let the lint diff pull both back in sync.
+- **Cap inversion under WARN.** A 2,250-char AGENTS.md (above 2,200 WARN, below 2,500 FAIL) is a yellow signal not a green one — every additional sentence raises the probability of the next FAIL. Treat WARN as the spend boundary, not a buffer.
+- **Char-count includes frontmatter.** `wc -c` counts every byte including the YAML preamble, blank lines, and the trailing newline. Stripping a section to "look smaller" without re-running `wc -c` understates the true budget impact.
+- **Path enumeration.** A run of three or more bare `` `path/to/dir/` `` bullets without *why*-clauses is the classic re-bloat pattern. The lint emits a WARN at ≥ 3 such lines. Collapse them into one capability-style pointer — see the recipe in [`agents-md-anatomy § Iron Law`](../../contexts/contracts/agents-md-anatomy.md#iron-law--capabilities-over-structure).
+- **Tool-specific duplicates.** Copy-pasting AGENTS.md into `CLAUDE.md` / `GEMINI.md` / `.cursorrules` doubles the budget cost across tools. Use the symlink-or-stub pattern in [`agents-md-anatomy § Multi-tool symlink strategy`](../../contexts/contracts/agents-md-anatomy.md#multi-tool-symlink-strategy) instead.
+
+## Output format
+
+When invoked as a planning step, produce:
+
+1. Current size + gap to target (one line per file).
+2. Inventory table (section, chars, keep-inline / outboard-candidate, target).
+3. Pointer ratio before / after (predicted).
+4. Specific outboarding edits as a numbered diff plan.
+5. The four lint commands the agent must run before claiming completion.
+
+## Cloud Behavior
+
+Inert on cloud surfaces. The skill governs the package-root `AGENTS.md` and the consumer-shipped template — both authoring artifacts inside this repository. Cloud agents working on consumer projects never edit those files directly; their copy is delivered by the package install pipeline and refreshed by the package sync pipeline. The Thin-Root contract therefore has no cloud-side procedure to execute, which is why this skill is marked `cloud_safe: noop`.
+
+## See also
+
+- [`agents-md-anatomy`](../../contexts/contracts/agents-md-anatomy.md) — Capabilities-over-Structure Iron Law, multi-tool symlink strategy, monorepo per-package layout, refactor recipe, full gotcha catalog.
+- [`copilot-agents-optimization`](../copilot-agents-optimization/SKILL.md) — sibling skill for `.github/copilot-instructions.md`; runs alongside Thin-Root in `/agents optimize`.
+- [`agent-docs-writing`](../agent-docs-writing/SKILL.md) — broader documentation-structure context for navigating outboard targets.
+- [`size-enforcement`](../../rules/size-enforcement.md) — covers per-skill / per-rule / per-command size budgets; AGENTS.md caps live in this skill instead.
+- [`ADR-004-rule-governance-pruning`](../../../docs/decisions/ADR-004-rule-governance-pruning.md) — captures the rule-governance pruning that freed the workspace-guidelines budget; the Thin-Root caps build on that headroom.