@event4u/agent-config 6.0.0 → 7.0.0

package/dist/agent-src/skills/adr-create/SKILL.md

@@ -145,17 +145,17 @@ the area's contract from the README in
 
 ### 5. Regenerate the index
 
-- **Flat surface** — `python3 scripts/adr/regenerate_index.py
+- **Flat surface** — `./scripts-run src/scripts/adr/regenerate_index
   --dir docs/decisions/` writes `INDEX.md` from `ADR-*.md`.
-- **Per-area surface** — `python3 scripts/audit_adr_coverage.py
+- **Per-area surface** — `./scripts-run src/scripts/audit_adr_coverage
   --regen-area-readme <area>` rewrites `docs/adrs/<area>/README.md`.
-  Coverage gate: run `python3 scripts/audit_adr_coverage.py` (no
+  Coverage gate: run `./scripts-run src/scripts/audit_adr_coverage` (no
   args) — exit 0 only when every canonical area has ≥ 1 ADR.
 
 ### 6. Validate
 
-- Flat: `python3 scripts/adr/regenerate_index.py --check` exits 0.
-- Per-area: `python3 scripts/audit_adr_coverage.py --check` exits 0.
+- Flat: `./scripts-run src/scripts/adr/regenerate_index --check` exits 0.
+- Per-area: `./scripts-run src/scripts/audit_adr_coverage --check` exits 0.
 - Project's CI / quality pipeline passes locally.
 
 ## Output format

package/dist/agent-src/skills/adversarial-review/SKILL.md

@@ -29,6 +29,11 @@ Do NOT use when:
 
 ## Procedure: Adversarial review
 
+1. **Inspect the artifact** — Read the plan, diff, or draft you are about to critique; note its scope, assumptions, and the explicit asks before attacking.
+2. **Attack** — Run Step 1 below as the grumpy senior engineer.
+3. **Defend** — Run Step 2 as the balanced engineer; classify each criticism as must-fix / defer / reject.
+4. **Revise** — Run Step 3 to fold valid fixes back in and surface only the trade-offs the user needs to decide.
+
 ### Step 1: Attack (Grumpy Senior Engineer)
 
 Assume your plan/fix is flawed. Ask yourself:
@@ -112,6 +117,15 @@ Only surface trade-offs or concerns that need the user's input.
 - **api-design** — review API design for consistency and breaking changes.
 - **security** — review security-sensitive changes for attack surface.
 
+## RDP: fresh-context verifier as the default gate (structural)
+
+Within the Reasoning Discipline Protocol the fresh-context verifier subagent is
+the **default** final gate — but, because it is a full extra inference pass, it
+fires only on the **structural-complexity** signal: ≥ 2 of {branching/conditional
+logic, ≥ 3 explicit must/must-not constraints, stateful operations,
+irreversibility} **and** estimated work ≥ ~1k tokens. Token length alone never
+triggers it. See [`rdp-gate`](../../contexts/execution/rdp-gate.md) (L12).
+
 ## Auto-trigger keywords
 
 - adversarial review

package/dist/agent-src/skills/agent-security-review/SKILL.md

@@ -0,0 +1,113 @@
+---
+model_tier: high
+name: agent-security-review
+description: "Use for an adversarial red-team / blue-team / auditor review of an AI agent's CONFIG + behaviour (rules, skills, MCP, hooks, permissions) — attack-chain → defensive-gap list, not a code audit."
+personas:
+  - security-engineer
+domain: quality
+council_depth: deep
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# agent-security-review
+
+Adversarial review of an **agent's configuration + behaviour** — the trust
+anchor, not the app code. Where [`threat-modeling`](../threat-modeling/SKILL.md)
+models a code change and [`security-audit`](../security-audit/SKILL.md) hunts
+code vulns, this asks: given this assembled config (rules, skills, MCP, hooks,
+permissions, memory), how would an attacker turn it against its owner, and what
+gap lets them?
+
+Pairs the static signal from `/security-audit-config` with a three-lens
+adversarial pass. Output is **decision support** — surface the trade-off, name
+the gap; the human decides.
+
+## When to use
+
+- "Is my agent setup safe / could this be weaponised".
+- Before trusting a third-party skill pack, MCP server, or rules file.
+- Periodic posture review of a fleet's agent config.
+- Any `D`/`F` category from `/security-audit-config` needing depth.
+
+## Procedure
+
+### 1. Inventory + inspect the attack surface
+
+Inspect the config the agent loads and check each surface: instruction files
+(CLAUDE.md / AGENTS.md / .cursor/rules / copilot-instructions), installed skills
++ their `allowed-tools`, MCP servers + tool descriptions, hooks + lifecycle
+scripts, permission/auto-approve settings, persistent memory. Static pass first:
+
+```bash
+python3 src/scripts/security_audit_config.py --root <repo> --json
+```
+
+### 2. Red team (attacker lens)
+
+Per surface, construct concrete **attack chains** grounded in known classes:
+
+- Rules-file backdoor — hidden-Unicode / suppression instruction in a loaded file.
+- MCP tool-poisoning / rug-pull — malicious or mutated tool description.
+- Lethal trifecta — a path reading private data, ingesting untrusted content,
+  AND able to communicate externally.
+- Consent bypass — `bypassPermissions`, `Bash(*)`, auto-approve, `npx -y`.
+- Memory / context poisoning — a planted instruction firing later.
+
+Name the chain: *entry → mechanism → impact*. Be specific (which file, tool).
+
+### 3. Blue team (defender lens)
+
+Per chain, evaluate existing defences: are the always-on rules
+([`untrusted-input-defense`](../../rules/untrusted-input-defense.md),
+[`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md),
+[`non-destructive-by-default`](../../rules/non-destructive-by-default.md)) in
+force? Egress gated? Untrusted leg quarantined? Note present vs **absent**.
+
+### 4. Auditor (synthesis)
+
+Pair each chain with its gap, prioritise (likelihood × impact). For the hardest
+calls run [`ai-council`](../ai-council/SKILL.md) (`council_depth: deep`) +
+[`judge-security-auditor`](../judge-security-auditor/SKILL.md) over flagged
+files. Produce a ranked **attack-chain → gap → recommended control** table.
+
+## Output
+
+A prioritised table — `attack chain | defensive gap | OWASP ASI | recommended control | confidence` —
+prefixed with the trust-and-safety banner (advisory security output):
+
+```
+> HUMAN REVIEW REQUIRED — adversarial agent-config review. Findings are
+> decision support, not a guarantee; detection is probabilistic. Validate
+> each chain before acting.
+```
+
+Recommend controls; never auto-apply config changes (per
+[`scope-control`](../../rules/scope-control.md)).
+
+## Gotcha
+
+- **Clean static score ≠ safe.** The worst chains (rug-pull MCP tool whose
+  description mutates post-approval, a lethal-trifecta path across three
+  individually-fine skills) leave no single linter hit — only the red-team lens
+  (step 2) **inspects** how surfaces compose. Always run the adversarial pass.
+- **Tool descriptions are part of the surface.** Reading only config files and
+  skipping each MCP server's live tool descriptions misses tool-poisoning.
+- **The reviewer is not the fixer.** Emitting a config patch turns advisory
+  review into an unreviewed change — recommend, hand back.
+
+## Do NOT
+
+- Do NOT treat a clean static score as proof of safety — the red-team lens finds
+  chains the linters cannot see.
+- Do NOT block or "fix" the consumer's config autonomously — surface + recommend.
+- Do NOT re-audit application code here — that is `security-audit` / `threat-modeling`.
+- Do NOT omit the HUMAN REVIEW REQUIRED banner.
+
+## See also
+
+- `/security-audit-config` — the static A–F counterpart.
+- [`untrusted-input-defense`](../../rules/untrusted-input-defense.md), [`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md) — the prevention rules.
+- [`threat-modeling`](../threat-modeling/SKILL.md), [`judge-security-auditor`](../judge-security-auditor/SKILL.md), [`ai-council`](../ai-council/SKILL.md).

package/dist/agent-src/skills/agent-security-review/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "agent-security-review",
+    "last_eval": "2026-06-16",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for adversarial review of an agent's CONFIG/behaviour (rules, skills, MCP, hooks, permissions). Should-not-trigger covers the near-miss neighbours (code threat-model, code security-audit, the static config-audit command, privacy review, dependency CVE scan) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "red-team my agent setup — could someone weaponise my CLAUDE.md or MCP servers?",
+            "trigger": true
+        },
+        {
+            "q": "do an adversarial security review of this agent config and its skills",
+            "trigger": true
+        },
+        {
+            "q": "is this third-party skill pack safe to install, attacker's view?",
+            "trigger": true
+        },
+        {
+            "q": "prüfe meine Agent-Konfiguration adversarial auf Angriffsketten",
+            "trigger": true
+        },
+        {
+            "q": "what could an attacker do with my rules files, hooks and tool permissions?",
+            "trigger": true
+        },
+        {
+            "q": "threat-model this new payments endpoint before I build it",
+            "trigger": false,
+            "note": "code change threat model → threat-modeling"
+        },
+        {
+            "q": "find vulnerabilities in my application code",
+            "trigger": false,
+            "note": "code vulnerability hunt → security-audit"
+        },
+        {
+            "q": "give me an A-F score for my agent config",
+            "trigger": false,
+            "note": "static scored audit → /security-audit-config command, not the adversarial skill"
+        },
+        {
+            "q": "are we GDPR compliant with this data flow?",
+            "trigger": false,
+            "note": "regulatory-regime read → privacy-review"
+        },
+        {
+            "q": "scan my dependencies for known CVEs",
+            "trigger": false,
+            "note": "dependency CVE audit → security-audit dependency pass"
+        }
+    ]
+}

package/dist/agent-src/skills/agents-md-thin-root/SKILL.md

@@ -97,7 +97,7 @@ Each answer must fit on one line. The block exists so the root never silently de
 
 ## Procedure — apply Thin-Root to AGENTS.md
 
-1. **Measure baseline.** `wc -c AGENTS.md` and `python3 scripts/measure_augment_budget.py`. Record current char-count and the gap to 2,200 / 2,500.
+1. **Measure baseline.** `wc -c AGENTS.md` and `./scripts-run src/scripts/measure_augment_budget`. Record current char-count and the gap to 2,200 / 2,500.
 2. **Inventory sections.** List every `## ` heading and its char-count. Mark each as `keep-inline` (Iron-Law-adjacent, ≤ 200 chars, no good outboard target) or `outboard-candidate` (longer-form prose, table-only sections, narrative).
 3. **Identify outboard targets.** For each `outboard-candidate`, name the destination — `packages/core/.agent-src.uncondensed/contexts/`, `docs/contracts/`, an existing rule body, an existing skill body. Never invent a new top-level directory.
 4. **Move content; insert pointer.** Cut the section into the target file. Replace it in AGENTS.md with a single substantive pointer per anatomy above. Verify the *why*-clause length.

package/dist/agent-src/skills/ai-council/SKILL.md

@@ -577,7 +577,7 @@ usually lower).
 If `pricing.is_stale(table)` returns true, ask before proceeding:
 
 > Price table is stale (last_updated: YYYY-MM-DD)
-> 1. Refresh now (`python3 scripts/update_prices.py`)
+> 1. Refresh now (`./scripts-run src/scripts/update_prices`)
 > 2. Continue with the stale table
 > 3. Cancel
 
@@ -616,7 +616,7 @@ member can refine, agree, or push back on the previous critique
 without seeing which provider produced which point.
 
 The default round count comes from `defaults.min_rounds` in
-`agents/settings/.ai-council.yml` (default `2` so members critique each other
+`~/.event4u/agent-config/settings/.ai-council.yml` (default `2` so members critique each other
 at least once before convergence). The host agent does **not** ask
 "how many rounds?" when the requested count is `<= min_rounds` —
 the settings owner already made that decision. Ask only when a
@@ -738,7 +738,7 @@ Activation — two equivalent paths:
 
 * CLI: `--peer-review` on `council:estimate` or `council:run`.
 * Config: `ai_council.peer_review.enabled: true` in
-  `agents/settings/.ai-council.yml`. Default is `false`.
+  `~/.event4u/agent-config/settings/.ai-council.yml`. Default is `false`.
 
 Mechanics:
 
@@ -782,7 +782,7 @@ swaps.
 | **Outsider** | `openai` | naive-but-sharp questions, beginner's-mind probes |
 | **Executor** | `anthropic` | what ships this quarter, what blocks delivery |
 
-Activation — edit `agents/settings/.ai-council.yml` and flip the advisor's
+Activation — edit `~/.event4u/agent-config/settings/.ai-council.yml` and flip the advisor's
 `enabled: true`. Optional `model: <name>` overrides the bound
 member's default model. An advisor referencing a disabled member
 fails closed at config load — never silently skipped.

package/dist/agent-src/skills/analysis-autonomous-mode/SKILL.md

@@ -85,7 +85,7 @@ Route to the primary skill. Monitor findings for signals to chain additional ski
 
 Merge all specialist findings into ONE prioritized output:
 
-1. Confirmed root → (with evidence)
+1. Confirmed root causes (with evidence)
 2. Contributing factors
 3. Risks not yet proven but worth checking
 4. Concrete fixes (ordered by priority)
@@ -95,19 +95,11 @@ Never dump isolated observations without synthesis.
 
 ## Procedure: Autonomous investigation loop
 
-When running a broad investigation, repeat until confident:
+Constraint: **attack the biggest unknown first** (not breadth-first). Repeat until confident:
 
-```
-1. Assess current understanding
-2. Identify biggest unknown
-3. Choose specialist skill to fill that gap
-4. Execute analysis
-5. Evaluate result — did it answer the question?
-6. Update mental model
-7. Decide: narrow down or broaden scope?
-8. If confident → synthesize and present
-   If not → loop back to step 2
-```
+1. Route the right specialist skill at the largest gap in your understanding.
+2. Inspect the result against the question; narrow or broaden scope.
+3. Once confident, synthesize and present — otherwise return to step 1.
 
 ## Adaptation rules
 
@@ -162,6 +154,10 @@ When specialist findings conflict:
 
 ## Output format
 
+1. Produce one report covering the five subsections below; no narration outside the report.
+2. Every finding must cite file paths or stack/version evidence; mark unverified items as *Contributing Risks*, not *Confirmed Findings*.
+3. Close with a *Recommended Fix Order*; prioritize by production impact → exploitability → user-facing breakage → effort vs value.
+
 ### Investigation Summary
 - What was analyzed, which skills were used, why
 

package/dist/agent-src/skills/async-python-patterns/SKILL.md

@@ -146,7 +146,7 @@ A single blocking call (sync I/O, time.sleep, CPU-heavy parse, large JSON load)
 
 ## Provenance
 
-- Adopted from: `Microck/ordinary-claude-skills@8f5c83174f7aa683b4ddc7433150471983b93131:skills_all/async-python-patterns/SKILL.md` (MIT, © 2025 Microck) — **Sunset Policy applied**: 694-line cookbook source reduced to a ~140-line decision framework; pattern catalogues externalized to upstream docs below.
+- Adopted from: an external reference (MIT, © 2025 an external reference) — **Sunset Policy applied**: 694-line cookbook source reduced to a ~140-line decision framework; pattern catalogues externalized to upstream docs below.
 - Externalized cookbook:
   - asyncio core: https://docs.python.org/3/library/asyncio.html · https://docs.python.org/3/library/asyncio-task.html
   - TaskGroup (3.11+): https://docs.python.org/3/library/asyncio-task.html#task-groups

package/dist/agent-src/skills/blade-ui/SKILL.md

@@ -102,11 +102,18 @@ not the initial apply — it also emits:
   pre-existing entries on replay. Omit the envelope on apply passes; the
   engine's `_apply_a11y_gate` only fires when a baseline is present.
 - `state.ui_review.preview` — `{render_ok: bool, screenshot_path?,
-  dom_dump_path?, error?, skipped?}`. `render_ok: false` with `error`
-  populated triggers the `preview_render_failed` halt; `render_ok: true`
-  with `screenshot_path` threads the screenshot into the delivery
-  report's `artifacts` list. Browser tooling (Playwright/Cypress/…) is
-  a consumer-project dependency — this package does not ship one.
+  dom_dump_path?, error?, skipped?, skip_reason?}`. **Render evidence is
+  required, not optional** on a review/polish pass: you MUST drive the
+  headless browser (Playwright + axe-core) against the rendered output and
+  write `render_ok`. Omitting it now triggers the `preview_render_required`
+  halt — a render-capable stack can no longer claim success without
+  rendering. `render_ok: false` with `error` populated triggers the
+  `preview_render_failed` halt; `render_ok: true` with `screenshot_path`
+  threads the screenshot into the delivery report's `artifacts` list. The
+  only no-render path is an **explicit, reasoned skip**: set `skipped: true`
+  plus a `skip_reason` (e.g. no Playwright runner in this env). Browser
+  tooling (Playwright/Cypress/…) is a consumer-project dependency — this
+  package does not ship one.
 
 Polish dispatch: when the dispatcher skips `review` because a previous
 review pass already returned `SUCCESS`, this skill MUST itself

package/dist/agent-src/skills/blameless-post-mortem/SKILL.md

@@ -0,0 +1,199 @@
+---
+model_tier: high
+name: blameless-post-mortem
+description: "Use after an incident or outage is resolved — blame-free facilitation, root cause, corrective actions, memory write-back — even for a near-miss. Consumes the incident-commander skeleton."
+source: package
+domain: quality
+personas:
+  - senior-engineer
+  - critical-challenger
+workspaces:
+  - engineering
+packs:
+  - analysis-workbench
+lifecycle: active
+trust:
+  level: professional
+  confidence: medium
+  human_review_required: false
+install:
+  default: false
+  removable: true
+requires_skills:
+  - root-cause-frameworks
+---
+
+# blameless-post-mortem
+
+> Facilitate a blame-free post-mortem after an incident or near-miss.
+> Consumes the `incident-commander` skeleton, derives or fills the root
+> cause, writes the corrective-action plan, and drafts an
+> `incident-learnings` memory candidate. Systems and processes are
+> examined — never individuals.
+
+## When to use
+
+- An incident or outage is resolved and the team needs a structured
+  write-up.
+- A near-miss happened and a post-mortem is being drafted (near-miss
+  mode — same flow, different severity framing).
+- The `incident-commander` hands off a post-mortem skeleton (empty
+  root cause is accepted — do not block on it).
+- German triggers: "Post-mortem", "Nachbesprechung", "was ist
+  schiefgelaufen?", "Vorfallsanalyse".
+
+Do NOT use when:
+
+- The incident is still active — route to
+  [`incident-commander`](../incident-commander/SKILL.md) first.
+- The goal is root-cause analysis only, no write-up needed — route
+  to [`root-cause-frameworks`](../root-cause-frameworks/SKILL.md).
+- The concern is a future risk, not a past event — route to
+  [`risk-officer`](../risk-officer/SKILL.md).
+
+## Procedure
+
+### 1. Consume the incident-commander skeleton
+
+Read the incoming skeleton. Per
+[`docs/contracts/analysis-memory-loop.md § 5`](../../docs/contracts/analysis-memory-loop.md):
+
+- Accept any skeleton, complete or not.
+- Extract: `SEV`, `State`, `Started`, `Timeline`, `Mitigation`,
+  `Root cause` (may be `unknown` or TBD).
+- Do NOT stall or reject on an empty root cause.
+
+If no skeleton is provided, reconstruct from the user's description:
+severity, timeline, impact, mitigation state.
+
+### 2. Derive the root cause (if unresolved)
+
+If root cause is `unknown` or TBD, invoke
+[`root-cause-frameworks`](../root-cause-frameworks/SKILL.md). That
+skill returns ranked candidates with confidence levels — do NOT force
+a verdict. If root cause remains unresolved after the analysis pass,
+mark the post-mortem `status: draft` and continue. A draft post-mortem
+can still produce memory candidates (note the open question in the
+candidate summary).
+
+### 3. Write the blame-free report
+
+Sections in order — no individuals named, systems and processes only:
+
+1. **Summary** — one paragraph, blame-free, what happened and the
+   business impact.
+2. **Timeline** — reference the skeleton timeline; do NOT rebuild it.
+3. **Impact** — users affected, duration, data, revenue, SLA.
+4. **Detection** — how the incident was discovered (monitoring, user
+   report, alert, manual).
+5. **Root cause** — the confirmed or highest-confidence candidate;
+   state confidence level if draft.
+6. **Contributing factors** — conditions that made the root cause
+   possible (tooling gaps, process gaps, system state).
+7. **What went well** — at least one item; omitting this is a smell.
+8. **What went wrong** — process, tooling, signals, communication
+   gaps. No individual blame.
+
+**Near-miss mode:** same sections; set `SEV: near-miss`. Add two
+extra questions after "what went wrong":
+
+- *"What would have made this worse?"*
+- *"Which control caught it — luck or a designed control?"*
+
+### 4. Corrective actions (folded-in phase)
+
+For each identified gap, propose a corrective action. Reuse
+`risk-officer` mitigation framing: owner role, size, residual-risk
+note. Four action types:
+
+| Type | Purpose |
+|---|---|
+| **Immediate** | Stop recurrence now (config fix, kill switch, revert) |
+| **Preventive** | Remove the root cause (architectural or process change) |
+| **Detection** | Catch it sooner next time (alert, dashboard, runbook) |
+| **Process** | Address human/coordination gaps (oncall rotation, docs) |
+
+Each action MUST have:
+
+- **Owner role** (eng, ops, PO, support — never "the team")
+- **Closure criterion** — specific, testable condition marking the
+  action done
+- **Regression signal** — a test, monitor, or alert that proves the
+  fix held
+
+An action without a closure criterion is a wish, not a plan.
+
+### 5. Memory write-back
+
+Per [`docs/contracts/analysis-memory-loop.md § 2`](../../docs/contracts/analysis-memory-loop.md):
+
+1. Run the dedup pre-check — call `find_duplicate(...)` from
+   `scripts.memory_lookup` over the same key-space (incident type,
+   affected paths, decision area).
+2. **Match found** — propose a `frequency` / `supersedes` update to
+   the existing entry; do NOT create a new candidate.
+3. **No match** — draft a REDACTED `incident-learnings` candidate to
+   `/memory propose`:
+   - `type: incident-learnings`
+   - `summary`: one-line pattern (no customer names, no secrets, no
+     project-rooted paths)
+   - `evidence_paths`: ≥ 2 file paths (for admission gate)
+   - `decision_surface`: ≥ 3 decisions this pattern changes (if
+     possible)
+   - `last_validated`: today
+   - `review_after_days`: 90
+   - `applicable_scope`: `project`
+
+4. NEVER auto-promote. The human drives promotion via `/memory
+   promote`. If the candidate fails the admission gate
+   (`check_memory_proposal.py`), surface the gap to the user.
+
+If `retrieve()` returns stale entries in `skipped`, surface them
+explicitly — never silently use stale data.
+
+## Output
+
+The post-mortem produces, in order:
+
+1. **Post-mortem document** — sections 1–8 from step 3; status
+   `final` or `draft` if root cause is unresolved.
+2. **Corrective-action table** — each action with type, owner,
+   closure criterion, regression signal.
+3. **Memory candidate** — the drafted `incident-learnings` JSONL
+   snippet for `/memory propose` (or the frequency-update proposal if
+   a duplicate was found).
+
+## Do NOT
+
+- Do NOT blame individuals — name systems, processes, signals, tooling.
+- Do NOT auto-promote to curated memory — the gate is human-driven.
+- Do NOT skip the dedup pre-check before drafting a memory candidate.
+- Do NOT ship raw PII, customer names, secrets, or project-rooted
+  paths in the memory candidate (redact per the contract).
+- Do NOT reject or stall on an incomplete skeleton — mark `draft` and
+  continue.
+- Do NOT rebuild the timeline from scratch — reference the skeleton's
+  timeline.
+
+## Gotchas
+
+- **Incomplete skeleton** → `status: draft`, not a rejection. Draft
+  post-mortems still produce memory candidates with the open question
+  noted.
+- **Near-miss** → a mode within this skill, not a separate flow.
+  Severity is `near-miss`; the extra two questions apply.
+- **Corrective actions without closure criteria** are non-actionable.
+  Always require a specific, testable done condition.
+- **Stale memory entries** surface in `skipped`, not `results`. Never
+  silently reuse stale data.
+
+## See also
+
+- [`incident-commander`](../incident-commander/SKILL.md) — produces the
+  skeleton this skill consumes; run first during live incidents.
+- [`root-cause-frameworks`](../root-cause-frameworks/SKILL.md) — RCA
+  engine invoked in step 2 when root cause is unresolved.
+- [`risk-officer`](../risk-officer/SKILL.md) — mitigation framing
+  reused for corrective actions (owner, size, residual-risk).
+- [`docs/contracts/analysis-memory-loop.md`](../../docs/contracts/analysis-memory-loop.md)
+  — produce → propose → promote → retrieve contract this skill binds to.

package/dist/agent-src/skills/blast-radius-analyzer/SKILL.md

@@ -63,7 +63,7 @@ Run grep/search for the exact symbol, column, or event name. Enumerate:
 | DB references | Foreign keys, indexes, views, triggers on the column |
 | Config / docs | YAML, JSON, Markdown that name the symbol |
 
-### 3. Inspect indirect deps
+### 3. Inspect indirect dependencies
 
 For each direct dependency, identify second-order fan-out:
 
@@ -89,16 +89,17 @@ For every dependency, mark:
 ### 5. Consult engineering memory
 
 Via [`memory-access`](../../../docs/guidelines/agent-infra/memory-access.md) call
-`retrieve(types=["architecture-decisions", "ownership"],
+`retrieve(types=["ownership"],
 keys=<changed paths + changed symbol>, limit=5)`. Surface:
 
-- **Architecture decisions** that constrain the planned change — cite
-  `id` and the decision verbatim so the report is self-auditing.
+- **Architecture decisions** that constrain the planned change — check the
+  ADR index [`docs/decisions/INDEX.md`](../../../docs/decisions/INDEX.md) and
+  cite the ADR number + the decision verbatim so the report is self-auditing.
 - **Ownership** matches — add these as `owner hint` candidates when
   the direct grep had no result.
 
 Memory entries are supplementary, never authoritative: a grep miss is
-still a grep miss. Do not infer deps from memory alone.
+still a grep miss. Do not infer dependencies from memory alone.
 
 ## Validation
 
@@ -109,8 +110,8 @@ Before finalizing the report, confirm:
 3. Second-order fan-out is bounded — any runaway chain is flagged, not expanded
 4. Every `external` reach has at least one named owner hint or an explicit
    "owner unknown — ask"
-5. You have NOT invented deps that grep did not find
-6. You have NOT merged direct and indirect deps — they are listed separately
+5. You have NOT invented dependencies that grep did not find
+6. You have NOT merged direct and indirect dependencies — they are listed separately
 
 ## Output format
 
@@ -150,10 +151,10 @@ Open questions:
 Required fields (ordered):
 
 1. **Skill** and **Change** — one-line edit summary
-2. **Direct deps** — grouped by class, each with file:line citations and exact counts
-3. **Indirect deps** — 2nd-order only, bounded
+2. **Direct dependencies** — grouped by class, each with file:line citations and exact counts
+3. **Indirect dependencies** — 2nd-order only, bounded
 4. **Reach summary** — counts per reach level
-5. **Risk surfaces** — deps grouped by risk type
+5. **Risk surfaces** — dependencies grouped by risk type
 6. **Open questions** — unresolved items with grep evidence
 
 Runtime confirmation (e.g. *"actually run the test suite to see what breaks"*,
@@ -179,7 +180,7 @@ does not execute code, run tests, or touch the network**.
 * NEVER return `safe` out of politeness when external reach exists — mark it clearly
 * NEVER silently fall back to "module-level impact" when grep shows cross-module callers
 * NEVER claim a dependency without a file:line citation from grep output
-* NEVER chase deps past 2nd order without explicit scope approval — flag and stop
+* NEVER chase dependencies past 2nd order without explicit scope approval — flag and stop
 
 ## References
 

package/dist/agent-src/skills/brand/ATTRIBUTION.md

@@ -0,0 +1,38 @@
+# Attribution — brand corpus + grounding engine
+
+This skill is a second instance of the ADR-061 corpus-grounding layer.
+
+## Grounding engine
+
+The retrieval/decision engine is the shared
+[`corpus-grounding`](../corpus-grounding/SKILL.md) skill — it is **not** forked
+or vendored here. Its provenance and license obligations are recorded once in
+[`design-intelligence/ATTRIBUTION.md`](../design-intelligence/ATTRIBUTION.md)
+(MIT engine port). This skill ships only a manifest + CSVs that plug into it.
+
+## Corpus (`data/*.csv`)
+
+The brand corpus is **original-authored** from public, non-proprietary brand
+frameworks and conventions:
+
+- the 12 brand archetypes (Jung; Mark & Pearson, *The Hero and the Outlaw*) —
+  a public framework, not a vendored dataset;
+- conventional colour-psychology-by-industry associations;
+- well-known messaging frameworks (positioning statement, value-proposition
+  canvas, message house, golden circle, StoryBrand, jobs-to-be-done, etc.) —
+  named methods in the public domain, described in our own words;
+- voice/tone, naming-pattern, logo-style, and archetype→typography rows
+  authored for this package.
+
+No third-party CSV or skill content was copied into these files, so no
+third-party license obligation attaches to the corpus. The framework *names*
+above are referenced as public concepts, not as a source we adapted file
+content from.
+
+## Provenance discipline
+
+The manifest carries `owner: package-maintainer`, `refresh_cadence: quarterly`,
+and `upstream: null` (no upstream repo — original-authored). Refresh re-reviews
+the archetype↔type rows whenever the font-pairings Reference
+(`font-pairings-reference.csv`) refreshes, and revisits colour/cultural caveats
+on the quarterly cadence.