@event4u/agent-config 6.1.0 → 7.0.0

package/docs/threat-model.md

@@ -0,0 +1,28 @@
+# Threat Model — agent-config
+
+`agent-config` (AC) is a file-first, **no-runtime** skill/rule/command suite.
+It ships artifacts (skills, rules, commands, MCP configs, hooks, installer) to
+11 host AI tools and is published as `@event4u/agent-config`. It runs no server
+and holds no user data. Threats are about **artifact integrity** and
+**supply-chain / distribution surface**, not app auth or billing.
+
+## Threat table
+
+| # | Surface | Attack vector | Current controls | Gap | Mitigation |
+|---|---|---|---|---|---|
+| a | **Malicious skill / rule via PR** — a contributed `.md` file smuggles prompt-injection or data-exfiltration payloads into the shipped artifact tree | Adversarial PR contributor embeds: (1) invisible Unicode (bidi / zero-width / Tag-block) to hide instructions, (2) role-takeover imperatives, (3) lethal-trifecta pattern in a new skill (private-data + untrusted-content + egress on one autonomous path) | `lint_hidden_unicode.py` — blocks Trojan-Source and invisible-char attacks; `lint_instruction_smuggling.py` — blocks disclosure-suppression and injection-tag prose; `lint_skill_frontmatter_safety.py` — blocks wildcard `allowed_tools`, `bypassPermissions`, unsafe `execution.type: automated`; PR review gate | No automated SARIF upload to GitHub Code Scanning; lethal-trifecta detection is architectural (rule) not linted structurally beyond the frontmatter check | Wire `lint_agent_security.py --sarif` output to GitHub Advanced Security on every PR (`lint_workflow_security.py` — P2); add structural trifecta check to frontmatter linter |
+| b | **Supply-chain compromise of AC's own deps** — a malicious version of an npm or Python dependency is pulled during CI / install and executes arbitrary code or modifies shipped artifacts | Dependency confusion / typosquatting attack on `package.json` or `requirements.txt` deps; compromised upstream package | `package-lock.json` + `requirements.txt` pin exact versions; CI installs from lockfile (`npm ci`) | No documented dep-audit policy; no Dependabot / Renovate automation; no integrity check (`npm audit` / `pip-audit`) in CI gate | Add `npm audit --audit-level=high` + `pip-audit` as a required CI step; document quarterly manual review cadence; pin Python deps in a lockfile (`pip-compile`) |
+| c | **Hostile consumer-repo environment** — AC's installer or hooks execute inside a repo whose `.git/hooks`, `.env`, or workspace files are attacker-controlled | Consumer repo pre-installs malicious Git hooks that intercept the AC installer or post-install hook; `.env` leaks tokens that AC hooks read; untrusted files are passed to AC linters | AC installer writes its own hooks under its namespace; AC hooks run as the user's shell — they do not read `.env` by design; `untrusted-input-defense` rule governs agent behaviour at runtime | No sandboxed execution for AC hooks; installer does not verify consumer hook integrity before writing | Document that AC hooks must not read repo-local env files; add installer pre-flight that warns if foreign hooks exist in `.git/hooks/`; scope AC hook writes to explicit namespaced filenames |
+| d | **Lethal-trifecta surface** — a skill combining private-data access + untrusted-content ingestion + external communication on one autonomous path enables confused-deputy / data-exfiltration attacks | Prompt-injected content inside a fetched doc instructs an agent to read a local secret and POST it to an attacker-controlled endpoint | `src/rules/lethal-trifecta-guard.md` (Iron Law: break one leg or gate egress behind human-in-the-loop); `src/rules/untrusted-input-defense.md` (untrusted content is data, never instructions; spotlighting); `lint_skill_frontmatter_safety.py` (flags over-broad tool grants) | These are authoring-time controls — no runtime enforcement layer exists | No additional mitigation planned (runtime layer out of scope for AC); `lethal-trifecta-guard.md` and `untrusted-input-defense.md` are the canonical reference — do not re-describe here |
+| e | **Malicious metadata / frontmatter injection** — a PR embeds hostile YAML in a skill's frontmatter (e.g. injecting a trigger keyword that causes a dangerous skill to fire in unintended contexts, or adding `permissionMode: bypassPermissions`) | PR contributor adds `permissionMode: bypassPermissions` or a wildcard `allowed_tools: ["*"]` entry to an existing skill's frontmatter; or crafts a trigger keyword to hijack routing | `lint_skill_frontmatter_safety.py` — HIGH-severity block on `bypassPermissions`, wildcard `allowed_tools`, unsafe `execution.type: automated` without safety floor; `lint_hidden_unicode.py` — catches invisible chars inside frontmatter YAML values; PR review gate; `scripts/validate_frontmatter.py` schema validation | Schema validation does not verify trigger-keyword semantic safety (a plausible keyword that causes over-broad firing is not caught) | Extend `validate_frontmatter.py` to flag trigger keywords that match security-sensitive path prefixes (e.g. a skill triggering on `"auth"` when it has `execution.type: automated`) |
+| f | **Skill self-update — safety-floor rewrite** — an agent is social-engineered (via chat or a PR) into weakening a kernel rule, safety floor, or MCP/tool allowlist | A PR removes the Iron Law block from `non-destructive-by-default.md`; or a chat prompt instructs the agent to edit `security-sensitive-stop.md` to narrow its self-modification clause; or a PR modifies `scope-control` to remove the Hard Floor | `src/rules/security-sensitive-stop.md` — "self-modification via chat" clause: requests to weaken safety floors / kernel rules / MCP allowlists must route through `scope-control` gates; `src/rules/scope-control.md` — kernel-rule edits require own PR + ≥ 24 h soak; `dist/agent-src/` is read-only (source-of-truth rule); `scripts/check_condensation.py` detects Iron-Law section deletion or downgrade | No automated per-rule diff check that fires specifically when a kernel rule's Iron Law section is removed; relies on PR reviewer recognising the file class | Add a CI check (`scripts/check_kernel_rule_integrity.py` — P3+) that asserts Iron Law fenced-code blocks survive unchanged in all files listed in `docs/contracts/kernel-membership.md` |
+
+## Review cadence
+
+This threat model is reviewed:
+
+- **On every security-pillar roadmap phase boundary** — update the table before marking the phase complete.
+- **Quarterly** — as part of the dep-audit cycle (surface b).
+- **When a new linter or kernel rule ships** — re-evaluate affected surfaces.
+
+Owner: the package maintainer. Last reviewed: 2026-06-15.

package/llms.txt

@@ -25,7 +25,14 @@ async-python-patterns: Use when writing Python asyncio code — picking between
 authz-review: Use when reviewing authorization end-to-end — route → gate → policy → query scope → response filter — before changes to permissions, tenants, ownership, or admin flows.
 aws-infrastructure: Use when working with AWS resources — ECS Fargate, ECR, EFS, Secrets Manager, gomplate templates, multi-env deployments — even when the user says 'deploy to staging' without naming AWS.
 blade-ui: Use when the project's frontend stack is Blade — dispatched by `directives/ui/{apply,review,polish}.py`. Covers views, components, partials, layouts, and view logic.
+blameless-post-mortem: Use after an incident or outage is resolved — blame-free facilitation, root cause, corrective actions, memory write-back — even for a near-miss. Consumes the incident-commander skeleton.
 blast-radius-analyzer: Use BEFORE editing shared code — enumerates every call site, event consumer, queue worker, API client, migration, and test that a planned change will touch, with a file:line citation per dependency.
+brand: Grounded brand decisions from a curated corpus — archetype, voice, naming, colour psychology, logo-style fit, messaging frameworks, archetype→type mapping. Use to ground brand strategy and identity.
+brand-asset-generation: Generate brand assets — banners, social cards, CIP elements — with brand-token injection + provider routing. Use when generating a banner / social image / branded asset.
+brand-audit: Audit how a brand is currently expressed across touchpoints and flag drift from its defined tokens, voice, and strategy. Use to inventory and critique an existing brand before changing it.
+brand-identity: Define a brand identity constraint set from a confirmed strategy — colour story, type story, logo direction, imagery direction. Defines the tokens that token emission and asset generation consume.
+brand-strategy: Ground a brand strategy from the corpus — archetype, opposable positioning, voice and tone, messaging framework. Use to decide who a brand is for, what it stands for, and how it sounds.
+brand-to-tokens: Derive a DTCG .tokens.json source of truth from confirmed brand decisions, emit CSS vars + Tailwind via design-tokens, and export locked brand deck templates. Use to turn a brand identity into tokens.
 bug-analyzer: Use when the user shares a Sentry error, Jira bug ticket, or error description and wants root cause analysis. Also for proactive bug hunting and code audits for hidden bugs.
 build-buy-partner: Use when deciding insource vs outsource vs acquire — integration-cost analysis, dependency-risk, optionality preservation. Triggers on 'should we build', 'buy vs partner'.
 canvas-design: Use when creating static visual art — posters, marketing visuals, brand assets, PDF/PNG design pieces — even if the user just says 'design a poster' or 'mach uns ein Visual'.
@@ -57,7 +64,8 @@ data-handling-judgment: Use when classifying data, setting retention, judging cr
 database: Use when working with database architecture, MariaDB/MySQL tuning, indexing strategies, slow queries, or multi-connection patterns — even when the user just says 'this query is slow'.
 dcf-modeling: Wing-4 valuation cognition for a CFO / finance-partner. Use when a deal, internal investment, or board ask names DCF, intrinsic value, WACC, terminal value, or 'what's it worth on a 5-year hold'.
 deal-qualification-meddic: Use when qualifying or disqualifying a single deal — MEDDIC slots with evidence, inversion test, disqualification heuristic. Triggers on 'is this deal real', 'should we walk away'.
-decision-record: Use when locking a trade-off, structuring an ADR draft, or wiring supersession chains — frames options · trade-offs · consequences before the file is written by `adr-create`.
+decision-record: Use when choosing between alternatives with trade-offs — X-or-Y decisions (pattern vs pattern, strategy vs strategy) — frames options · trade-offs · consequences; ADR draft via `adr-create`.
+decision-review: Use to audit a past architectural decision — did the chosen option hold up, what assumptions drifted, should the ADR be superseded? Backward review only; does not lock new choices.
 deep-reading-analyst: Deep analysis of articles/long-form via thinking frameworks (SCQA, mental models, inversion) — 'analyze article', 'deep dive', 'extract insights', URL/text wanting depth not summary.
 defense-in-depth: Use when validation needs entry, business-logic, environment, and instrumentation guards so a bad value cannot reach the failure point — turns a local bug fix into a structural one.
 dependency-upgrade: Use when upgrading dependencies — 'update framework X', 'bump runtime version', or 'upgrade packages'. Covers changelog review, breaking-change detection, and verification. Stack-agnostic.
@@ -72,6 +80,7 @@ doc-coauthoring: Use when co-authoring a PRD, design doc, RFC, decision doc, or
 docker: Use when working with Docker — Dockerfile edits, docker-compose services, containers, or the dual-container (fast + Xdebug) setup — even when the user just says 'my container won't start'.
 editorial-calendar: Use when shaping cadence — evergreen / campaign / reactive split, beat-mapping across channel stages, content-debt management. Triggers on 'plan our content cadence', 'what should we publish'.
 eloquent: Use when writing Eloquent models, relationships, scopes, or queries via Model:: — 'fetch users with their orders'. NOT for PHPStan output, non-Eloquent services, or raw SQL questions.
+emit-tickets: Use when materialising a roadmap into a ticket bundle — 'turn this roadmap into tickets', 'materialise tickets', 'mach Tickets aus der Roadmap', 'emit tickets for this plan'.
 error-handling-patterns: Use when picking a failure-reporting strategy — exceptions vs Result types, recoverable vs not, retry / circuit-breaker / graceful degradation — decision framework only, catalogues externalized.
 "estimate-ticket": Estimate a Jira/Linear ticket — 'estimate PROJ-123', 'wie groß ist das?', 'should we split this?' — size + risk + split + uncertainty, sibling of /refine-ticket, close-prompt.
 existing-ui-audit: Use BEFORE writing or editing any non-trivial UI — inventories components, design tokens, shadcn primitives, and reusable patterns into state.ui_audit. Hard gate for the ui directive set.
@@ -92,8 +101,12 @@ grafana: Use when working with Grafana — dashboards, Loki LogQL queries, alert
 gtm-launch: Use when sequencing a launch — alpha / beta / GA waves, audience-by-wave logic, narrative beats per wave, engineering-readiness gates. Triggers on 'plan the launch', 'sequence GA'.
 guideline-writing: Use when creating or editing a guideline in docs/guidelines/ — reference material cited by skills, no auto-triggers — even when the user just says 'write up our naming conventions'.
 hiring-loop-design: Use when shaping an engineering hiring loop — stages, take-home vs live, calibration, bar-raiser, signal-vs-noise audit. Triggers on 'design our interview loop', 'audit our hiring bar'.
+iconography: Resolve an icon request to a concrete Iconify name and emit the embedding for the project's stack. Use when adding icons, picking an icon set, or wiring Lucide/Heroicons/Phosphor/Tabler.
 image-analyser: Use to analyse a character image down to the smallest mole and diff against a canon — per-feature spec, OCR-reads tattoo text, flags drift. Triggers 'analyse this image', 'match the canon'.
 image-creator: Use to generate a character image to spec — max-fidelity reproducible prompt from a Canon Spec, anchors-first, provider/governance-gated. Triggers 'generate this character', 'render to spec'.
+image-editing: Edit an existing image — inpaint, background swap, variation — via providers that support it. Use when editing/modifying/inpainting an image or making variations.
+image-generation: Generate an image from a brief — provider-agnostic blueprint then provider-specific translation, with ref-image/seed reuse for consistency. Use when generating/creating an image.
+image-provider-routing: Select the right image-generation provider from job shape — text-in-image to Ideogram, photoreal to Flux, vector/logo to Recraft, general to Gemini/GPT.
 incident-commander: Use during or right after an incident — frames severity, sets comms cadence, drafts the post-mortem skeleton — even when the user just says 'production is down' or 'wir haben einen Vorfall'.
 jira-integration: Use when the user says \"check Jira\", \"create ticket\", \"update issue\", or needs JQL queries, ticket transitions, or branch-to-ticket linking.
 jobs-events: Use when creating Laravel jobs, queued workflows, events, or listeners. Covers clear responsibilities, safe serialization, and retry/failure handling.
@@ -121,6 +134,7 @@ lint-skills: Use when running the package's skill linter against all skills and
 livewire: Use when the project's frontend stack is Livewire — dispatched by `directives/ui/{apply,review,polish}.py`. Covers reactive state, events, lifecycle hooks, and component/view separation.
 livewire-architect: Use when shaping a Livewire component before code — full-page vs partial, parent/child split, event flow, state-vs-props boundary, hydration cost — even on 'add this Livewire component'.
 logging-monitoring: Use when working with logging or monitoring — Sentry error tracking, Grafana/Loki log aggregation, structured logging channels, or monitoring helpers.
+logo-generation: Generate a logo or brand mark — structured prompt + provider routing, with a true-vector path via a vector-native provider or LLM-authored SVG for simple marks. Use for logo or brand mark generation.
 market-entry-analysis: Use when sequencing market entry — geo / segment / vertical, beachhead selection, regulatory-delta. Triggers on 'should we enter market X', 'which segment first'.
 markitdown: Use when converting PDF, DOCX, XLSX, PPTX, EPUB, images, or audio to Markdown for LLM ingestion via the upstream markitdown-mcp server — 'extract this PDF', 'OCR this image', 'transcribe this audio'.
 mcp: Use when working with MCP (Model Context Protocol) servers — their tools, capabilities, and best practices for effective agent workflows.
@@ -158,6 +172,7 @@ playwright-testing: Use when writing Playwright E2E tests — browser automation
 po-discovery: Use when shaping a fuzzy product ask into a refined backlog item — problem framing, user-story rewrite, AC tightening — even if the user just says 'help me write this ticket'.
 positioning-strategy: Use when locking the market frame — category, segment, alternative, point-of-view — before messaging, launch, or pricing rides on it. Triggers on 'who are we for', 'opposable audit'.
 prediction-pool-optimizer: Optimize prediction-pool tips (kicktipp etc.): rules + multi-book consensus odds → expected-points-max answer for every question, scores AND bonus. Triggers 'optimize my pool tips', 'predict'.
+premortem: Use before committing to a heavy or irreversible plan — imagine it's 6 months later and this failed; enumerate why, score each mode, derive early-warning signals and preventive guardrails.
 privacy-review: Use when reviewing data flows, support macros, refund templates for GDPR/CCPA/HIPAA fit — regime, consent, PII redaction (email, order-id), breach triage. Triggers 'is this GDPR-safe', 'PII redact'.
 project-analysis-core: Raw discovery primitives — project discovery, version resolution, docs loading, architecture mapping, execution flow. Called by `universal-project-analysis`. Single-pass scan → `project-analyzer`.
 project-analysis-hypothesis-driven: Use when a bug has multiple plausible causes across layers — competing hypotheses, validation loops, evidence-based conclusions — even when the user just says 'why is this happening?'.
@@ -169,6 +184,7 @@ project-analysis-symfony: Use for deep Symfony project analysis: kernel/bootstra
 project-analysis-zend-laminas: Use for deep Zend Framework or Laminas project analysis: bootstrap, config merge order, service manager, MVC flow, data layer, and migration-specific risks.
 project-analyzer: ONLY when user asks for single-pass tech-stack detection or `agents/evidence/analysis/` write-up. Deep multi-pass audit → `universal-project-analysis`. Raw primitives → `project-analysis-core`.
 project-docs: Use when looking for project-specific documentation. Knows which docs exist in agents/reference/docs/ and agents/settings/contexts/ and maps work areas to relevant docs.
+prompt-engineering-image: Translate an image brief into provider-specific prompt grammar per model. Use when writing or refining an image-generation prompt for Ideogram, Flux, Gemini, GPT Image 2, or Recraft.
 prompt-engineering-patterns: Use when designing production-LLM prompts — few-shot, chain-of-thought, system prompts, templates, self-verification — distinct from prompt-optimizer and refine-prompt.
 prompt-optimizer: Use when the user wants a prompt optimized for ChatGPT, Claude, Gemini, or another AI — 'make this prompt better', 'optimize for ChatGPT', 'rewrite my prompt' — even without saying 'optimize'.
 prompt-validator: Pre-spend contradiction gate for AI-video runs: checks every prompt in the batch, blocks on style / character / physics mismatch. Triggers 'validate the prompts', 'check the storyboard'.
@@ -178,7 +194,7 @@ react-shadcn-ui: Use when building React UI on shadcn/ui primitives + Tailwind
 readme-reviewer: Use when reviewing a README for accuracy, usability, and alignment with the actual repository. Detects invented content, broken setup steps, and structural issues.
 readme-writing: Use when creating, rewriting, or significantly improving a README based on the actual repository structure, commands, and intended audience.
 readme-writing-package: Use when creating or rewriting a README for a reusable package or library. Focus on installability, minimal usage example, compatibility, and developer onboarding.
-reasoning-orchestrator: Use for complex / ambiguous / long-horizon work — coordinate the reasoning chain ground→intent→notes→gather→audit→verify; composes existing skills, never duplicates them.
+reasoning-orchestrator: Use for multi-step / ambiguous / end-to-end work — refactor a whole module, drive a vague ticket to a verified result, plan+build+verify a migration; coordinates the reasoning chain across skills.
 receiving-code-review: Use when processing code review feedback (bot or human) before changing anything — triages, verifies, and pushes back with technical reasoning — even when the user just says 'fix the comments'.
 "refine-prompt": Reconstruct a free-form prompt into actionable AC + assumptions + confidence band before the engine plans — '/work \"…\"', 'baue X', 'ist der Prompt klar genug für die Engine?'.
 "refine-ticket": Refine a Jira/Linear ticket before planning — 'refine ticket', 'tighten AC on PROJ-123', 'ist das Ticket klar?' — rewritten ticket, Top-5 risks, persona voices, sub-skills orchestrated, close-prompt.
@@ -191,6 +207,7 @@ rice-prioritization: Use when ranking competing initiatives for a roadmap, break
 risk-officer: Use when surfacing and prioritising risk before commit — blast-radius framing, mitigations, residual-risk verdict — even if the user just says 'what could go wrong here?'.
 roadmap-management: Use when the user says \"create roadmap\", \"show roadmap\", or \"execute roadmap\". Creates, reads, and manages roadmap files with phase tracking.
 roadmap-writing: Use when authoring or rewriting a roadmap in agents/roadmaps/ — phase prose, goal sentence, acceptance criteria, council notes — even when the user just says 'write a plan for X' or 'draft a roadmap'.
+root-cause-frameworks: Use when tracing the root cause of a resolved incident or recurring bug — 5-whys chain, fishbone categorisation, contributing-factors split — even if the user says 'why does this keep breaking?'.
 rtk-output-filtering: Use when running verbose CLI commands — wraps them with rtk (Rust Token Killer) for 60-90% token savings. Covers installation, configuration, and usage patterns.
 rule-refactor: Use when the rule set is over the Augment budget, when a new rule would breach it, or when asked to audit / merge / prune rules — runs the audit pipeline and proposes a verdict per rule.
 rule-writing: Use when creating or editing a rule in src/rules/ — trigger wording, always vs auto classification, size budget — even when the user just says 'add a rule for X'.
@@ -208,8 +225,10 @@ skill-management: Use when condensing, decondenseing, refactoring, or improving
 skill-reviewer: Use when reviewing, auditing, or optimizing skills — validates against the 7 Skill Killers checklist and produces fix recommendations.
 skill-writing: Use when deciding 'should this be a skill or a rule?', creating/improving/reviewing agent skills, SKILL.md frontmatter, or procedure sections — even without saying 'skill-writing'.
 song-to-script: Turn an audio track into a timed `## Scene N` script: song sections → per-scene durations, auto mode adds mood + lip-sync lines. Triggers 'music video', 'from the song', 'cut to the beat'.
+source-discovery: Use BEFORE planning/coding against a DB schema, API/GraphQL shape, DTO/Model/Entity, or vendor package — read the real source, emit an Evidence Report, stop inventing fields.
 sql-writing: Use when writing raw SQL — MariaDB/MySQL syntax, parameterization, raw migrations, seeders with `DB::statement` — even when the user just pastes a query and asks 'why is this slow' without naming SQL.
 stakeholder-tradeoff: Use when stakeholders pull a decision in different directions — frames each lens, builds a trade-off matrix, surfaces the cost of every choice — even if the user just says 'PO and ops disagree'.
+standards-from-config: Use when you need this project's coding standards (line length, quotes, import order, naming, commit format) — derive them from the REAL tooling config as a pointer + digest, never a guessed claim.
 subagent-orchestration: Use when orchestrating implementer/judge subagents — seven modes (do-and-judge ±two-stage, do-in-steps/parallel/worktrees, do-competitively, judge-with-debate) — models from .agent-settings.yml.
 symfony-workflow: Writes Symfony PHP — DI container, bundles, Doctrine, Messenger, Security voters, console commands. For Laravel / Eloquent / Artisan use `laravel`. For framework-free PHP use `php-coder`.
 systematic-debugging: Use when hitting a bug, test failure, crash, or unexpected behavior — enforces reproduce → isolate → hypothesize → verify before any fix — even when the user just says 'this is broken' or 'quick fix'.
@@ -225,6 +244,7 @@ threat-modeling: Use when adding auth, webhooks, uploads, queues, secrets, tenan
 throughput-vs-morale-tradeoff: Use when balancing eng-team velocity vs quality vs burnout — on-call load, focus fragmentation, reorg shock. Triggers on 'team is burning out', 'why is velocity dropping'.
 token-optimizer: Use BEFORE any verbose CLI run, large file read, doc conversion, or near-context handoff — single decision tree keyed by intent that cites the canonical token-saving asset. Consult before the action.
 traefik: Use when setting up Traefik as a local reverse proxy — real domains on 127.0.0.1, trusted HTTPS via mkcert, automatic service discovery, and multi-project routing.
+typography-system: Derive a type system from a style constraint — query curated font pairings, set scale/line-height/weights, emit DTCG tokens via design-tokens. Use when choosing fonts or building a typographic scale.
 ui-component-architect: Use when shaping a UI component tree — composition vs inheritance, slot patterns, prop API design, controlled vs uncontrolled, polymorphic — even on 'split this component'.
 unit-economics-modeling: Use when modeling CAC, LTV, payback, contribution margin, or burn-multiple per customer — SaaS, marketplace, or transactional. Triggers on 'are we unit-economic', 'what is our LTV/CAC'.
 universal-project-analysis: ONLY when user asks for deep multi-pass codebase audit — orchestrator routing to `project-analysis-core` + framework-specific `project-analysis-*`. Single-pass scan → `project-analyzer`.
@@ -232,6 +252,7 @@ upstream-contribute: Use when a learning, new skill, rule improvement, or bug fi
 using-git-worktrees: Use when starting parallel work in isolation from the current branch — spawn a git worktree with ignore-safety checks and a clean test baseline — even when the user says 'try this on the side'.
 "validate-feature-fit": Validate whether a feature request fits the existing codebase — check for duplicates, contradictions, scope creep, and architectural misfit
 verify-completion-evidence: Use when claiming 'done', suggesting a commit, push, or PR — runs the evidence gate so completion claims come from fresh output in this message, not memory or earlier runs.
+verify-repair-loop: Use to iterate a change until tests/quality checks pass — bounded run→revise→re-run gated by a numeric threshold, then a judge confirms. Triggers 'iterate to green', 'keep fixing until tests pass'.
 video-director: Use when turning a scene idea into the 11-block cinematic prompt for live-action AI video — lens, lighting, blocking, motion, negatives. Triggers 'cinematic prompt', 'film-grade scene'.
 vision-articulation: Use when articulating internal vision — where we're going / why now / why us, founder-mode anchor, distinct from fundraising pitch. Triggers on 'what's our vision', 'why are we doing this'.
 voc-extract: Use when extracting Voice-of-Customer themes from existing artefacts — GH issues, PR threads, Sentry patterns. Triggers on 'what are users saying', 'recurring complaints', 'top themes'.

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
-    "version": "6.1.0",
-    "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
+    "version": "7.0.0",
+    "description": "Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,
     "type": "module",
@@ -55,28 +55,21 @@
     },
     "scripts": {
         "build:cli": "tsc -p tsconfig.json && chmod +x dist/cli/agent-config.js",
+        "build:install-bundle": "esbuild src/scripts/install.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/install/install.mjs",
         "build:ui": "vite build",
-        "build:discovery": "python3 src/scripts/build_discovery_manifest.py --write --strict",
-        "build:mcp-manifest": "python3 src/scripts/build_mcp_registry_manifest.py --write --strict",
-        "build": "npm run build:cli && npm run build:ui",
-        "typecheck": "tsc -p tsconfig.json --noEmit",
+        "build:discovery": "./scripts-run src/scripts/build_discovery_manifest --write --strict",
+        "build:mcp-manifest": "./scripts-run src/scripts/build_mcp_registry_manifest --write --strict",
+        "build": "npm run build:cli && npm run build:install-bundle && npm run build:ui",
+        "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.scripts.json",
         "lint:ts": "eslint 'src/**/*.ts'",
         "test:ts": "vitest run",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",
-        "prepublishOnly": "python3 src/scripts/check_release_includes_discovery.py"
+        "prepublishOnly": "./scripts-run src/scripts/check_release_includes_discovery"
     },
     "publishConfig": {
         "access": "public",
         "provenance": true
     },
-    "peerDependencies": {
-        "@event4u/agent-memory": "^1.1.0"
-    },
-    "peerDependenciesMeta": {
-        "@event4u/agent-memory": {
-            "optional": true
-        }
-    },
     "devDependencies": {
         "@inquirer/prompts": "^7.10.1",
         "@playwright/test": "^1.60.0",
@@ -95,6 +88,7 @@
     },
     "dependencies": {
         "@fastify/static": "^9.1.0",
+        "@modelcontextprotocol/sdk": "^1.29.0",
         "@preact/signals": "^2.9.0",
         "commander": "^12.1.0",
         "execa": "^9.5.0",
@@ -102,6 +96,7 @@
         "js-yaml": "^4.1.0",
         "open": "^10.2.0",
         "preact": "^10.29.0",
+        "yaml": "^2.9.0",
         "zod": "^3.25.0",
         "zod-to-json-schema": "^3.25.0"
     }

package/src/config/agent-settings.template.yml

@@ -265,7 +265,9 @@ pipelines:
 # Transplants the *operating discipline* of a frontier reasoning model
 # (ground -> intent -> notes -> gather -> audit -> verify) onto any host model.
 # It transfers discipline, never capability. Cost-gated so it only engages where
-# it pays. Rationale: docs/guidelines/agent-infra/frontier-reasoning-operating-profile.md
+# it pays. User guide (what it does / when it fires / how to turn it off):
+# docs/contracts/reasoning-discipline-protocol.md
+# Rationale + sources: docs/guidelines/agent-infra/frontier-reasoning-operating-profile.md
 reasoning:
   # Master switch (true, false). false = the whole layer is inert (zero overhead).
   enabled: true
@@ -535,6 +537,67 @@ memory:
   # Example: ["api[_-]?key", "/Users/[a-z]+/Library"]
   redact_patterns: []
 
+# --- Knowledge cards: global cross-project sharing (ADR-100) ---
+#
+# Structure-grounding v2. Promote *expensive* (remote) knowledge cards from
+# project-local `agents/knowledge/` to a per-user, file-first global store at
+# `~/.event4u/agent-config/knowledge/`, reusable across projects as LEADS only.
+# This is a USER-GLOBAL setting — keep it in `~/.event4u/agent-config/agent-settings.yml`.
+#
+# File-first, NOT a runtime: lazy-read plain card files, no daemon, no DB, no
+# vector index, no background decay (preserves the 2026-06-14 Layer-2 sunset's
+# core — see ADR-100). The store is UNVERSIONED (not in git) — a cache, never a
+# source of truth; the per-card provenance footer is its audit trail.
+#
+# enabled: false fully no-ops the layer — the global store is never read or
+# written, no promotion is suggested, Evidence Reports revert to project-local,
+# and any existing global cards go inert. v1 (project-local discipline + cards)
+# is byte-for-byte unaffected. `agent-config knowledge:global:purge --confirm`
+# removes the store and strips provenance from project cards.
+knowledge:
+  global_sharing:
+    # Default OFF until cross-project reuse is measured (Evidence v2 Phase 0;
+    # ADR-101 amends ADR-100). ADR-098 set a measure-then-decide gate for the
+    # global layer; ADR-100 shipped it default-on without waiting out the
+    # measurement window. Until reuse is instrumented across >= 2 real projects
+    # and shown positive, the safe default for a tool others install is opt-in,
+    # not opt-out — cross-project data movement should never be the default.
+    # Flip to `true` only after the reuse signal exists.
+    #
+    # Turning sharing on does NOT make promotion automatic — promotion is always
+    # suggest-then-confirm (auto_promote_threshold gates the *suggestion*, never
+    # a silent write). v1 (project-local discipline + cards) is byte-for-byte
+    # unaffected by this default; only the cross-project store is gated off.
+    enabled: false
+
+    # Origin tiers eligible to cross a project boundary under default-on.
+    # `proprietary` (in-house DB / private API / client schemas) is EXCLUDED by
+    # design — it is manual-only regardless of `enabled`, so no client-A schema
+    # ever leaks into client-B's session. Adding it here does NOT enable
+    # auto-share; the tier gate hard-codes proprietary as manual-only.
+    allowed_tiers: [public, vendor]
+
+    # Write-time redaction before any card is eligible to go global. Runs the
+    # low-impact-corpus-privacy-floor + source-confidentiality pattern set
+    # (API keys, internal hostnames, emails, blocklisted field/table names).
+    redaction:
+      enabled: true
+      # halt-and-prompt on a trigger; never silent-share, never auto-rewrite.
+      halt_on_trigger: true
+
+    # A `public`/`vendor` card seen in >= this many distinct repos triggers a
+    # promotion SUGGESTION (one-tap confirm). It never auto-promotes.
+    auto_promote_threshold: 2
+
+    # Freshness flip thresholds (days) for the untracked global store. A global
+    # card whose newest observed_at is older than `hypothesis_after_days` is
+    # lead-only (positive structure must be re-confirmed); older than
+    # `stale_after_days` it is skipped until re-verified. Negative facts +
+    # pointers stay usable as leads regardless.
+    freshness:
+      hypothesis_after_days: 90
+      stale_after_days: 180
+
 # --- Hooks ---
 #
 # Configuration surface for the hook dispatcher (see

package/src/config/discovery/packs.yml

@@ -39,6 +39,15 @@
   domain: engineering
   size_class: small
 
+- id: analysis-workbench
+  label: Analysis Workbench
+  description: RCA, post-mortem, premortem, and decision-review as an integrated learning loop.
+  workspaces: [engineering]
+  requires: [engineering-base]
+  trust_level_default: professional
+  domain: engineering
+  size_class: medium
+
 - id: php
   label: PHP
   description: PHP-language patterns (framework-free).
@@ -114,6 +123,16 @@
   domain: engineering
   size_class: medium
 
+- id: brand
+  label: Brand
+  description: Brand as a first-class UX layer — archetype/voice/identity grounding corpus, brand→token derivation, and consistency governance that constrains UI.
+  workspaces: [engineering]
+  requires: [frontend-design]
+  suggests: [ai-image]
+  trust_level_default: professional
+  domain: engineering
+  size_class: medium
+
 - id: python
   label: Python
   description: Python-language patterns.
@@ -226,6 +245,7 @@
   description: AI video pipeline.
   workspaces: [small-business]
   trust_level_default: experimental
+  surface_tier: lab
   domain: media
   size_class: large
   onboarding:
@@ -233,11 +253,22 @@
     example_workflow: scene-expander
     time_to_first_value_minutes: 12
 
+- id: ai-image
+  label: AI Image
+  description: AI image generation — multi-provider, governed (image as a sibling of video).
+  workspaces: [small-business]
+  suggests: [ai-video]
+  trust_level_default: experimental
+  surface_tier: lab
+  domain: media
+  size_class: medium
+
 - id: fun
   label: Fun
   description: Non-essential social/fun workflows (prediction-pool tips, etc.).
   workspaces: [small-business]
   trust_level_default: experimental
+  surface_tier: lab
   domain: fun
   size_class: small
   onboarding:

package/src/config/discovery/unassigned-artefacts.yml

@@ -24,6 +24,8 @@
   reason: scaffold for project .agent-settings.yml
 - path: .agent-src.uncondensed/templates/command.md
   reason: scaffold for new slash-command authoring
+- path: src/agent-src/templates/tickets.md
+  reason: scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket
 - path: .agent-src.uncondensed/templates/contexts.md
   reason: scaffold index for project contexts/
 - path: .agent-src.uncondensed/templates/contexts/auth-model.md
@@ -32,6 +34,10 @@
   reason: scaffold for project data-sensitivity context
 - path: .agent-src.uncondensed/templates/contexts/deployment-order.md
   reason: scaffold for project deployment-order context
+- path: src/agent-src/templates/contexts/knowledge-card.md
+  reason: fill-in skeleton for committed knowledge cards (evidence-first structure discovery / ADR-098); frontmatter is the example shape a filled card carries, not a runtime artefact
+- path: src/agent-src/templates/contexts/lesson-card.md
+  reason: fill-in skeleton for Class-C learned lessons (Evidence v2 project-intelligence); frontmatter is the example shape a filled lesson carries, not a runtime artefact
 - path: .agent-src.uncondensed/templates/contexts/observability.md
   reason: scaffold for project observability context
 - path: .agent-src.uncondensed/templates/contexts/tenant-boundaries.md

package/src/config/discovery/workspaces.yml

@@ -13,7 +13,7 @@
   description: Code, tests, CI, reviews, architecture.
   example_roles: [Developer, CTO, Tech Lead]
   default_packs: [engineering-base, git]
-  optional_packs: [php, laravel, symfony, javascript, typescript, react, nextjs, python, frontend-design]
+  optional_packs: [php, laravel, symfony, javascript, typescript, react, nextjs, python, frontend-design, brand, analysis-workbench]
 
 - id: product
   label: Product
@@ -55,7 +55,7 @@
   description: Self-employed / SMB-shaped owner workflows.
   example_roles: [Owner, Freelancer]
   default_packs: [small-business]
-  optional_packs: [ai-video, fun]
+  optional_packs: [ai-video, ai-image, fun]
 
 - id: construction
   label: Construction

package/src/config/gitignore-block.txt

@@ -51,6 +51,13 @@
 # repo free of unbounded raw signals. See road-to-memory-pipeline-consolidation.
 /agents/memory/intake/
 
+# Agent config — Evidence v2 ephemeral project-intelligence tier. Auto-captured
+# trial-and-error / transient / task-local observations, retained N days, NEVER
+# promoted to committed context (distinct from intake, which holds promotion
+# candidates). Keeps the promotion queue free of per-session noise. See
+# contexts/execution/project-intelligence.md § Memory tiers.
+/agents/memory/ephemeral/
+
 # Agent config — ghostwriter profiles (real-person public-figure voices,
 # written by /ghostwriter:fetch). Local-only by default; commit explicitly
 # only via the deferred --shared opt-in. README.md stays tracked.