@event4u/agent-config 6.1.0 → 7.0.0

package/dist/agent-src/skills/prompt-engineering-image/evals/triggers.json

@@ -0,0 +1,17 @@
+{
+  "skill": "prompt-engineering-image",
+  "last_eval": "2026-06-16",
+  "description": "5 should-trigger + 5 should-not-trigger. Should-trigger covers translating a brief into provider-specific prompt grammar. Should-not-trigger covers near-miss neighbors: provider selection (image-provider-routing), direct adapter invocation, media rights checks (media-governance-routing / image-likeness-and-rights), and general image editing.",
+  "queries": [
+    {"q": "write me an Ideogram prompt for a bakery logo with the name on it", "trigger": true},
+    {"q": "how do I structure a Flux prompt for a photoreal product shot?", "trigger": true},
+    {"q": "my Recraft prompt isn't generating SVG — what params am I missing?", "trigger": true},
+    {"q": "tune this prompt for Gemini image generation: artisan bread, rustic kitchen", "trigger": true},
+    {"q": "what's the right prompt grammar for GPT Image 2 when editing a background?", "trigger": true},
+    {"q": "which image provider should I use for a logo with text?", "trigger": false, "note": "provider selection question → image-provider-routing"},
+    {"q": "run the Ideogram adapter with my prompt", "trigger": false, "note": "direct adapter invocation — not prompt authoring"},
+    {"q": "can I put a celebrity's face in this image?", "trigger": false, "note": "likeness rights question → media-governance-routing / image-likeness-and-rights"},
+    {"q": "remove the background from this photo", "trigger": false, "note": "editing request, not prompt authoring for a provider"},
+    {"q": "what lifecycle tier is the Recraft adapter?", "trigger": false, "note": "lifecycle tier query → provider-lifecycle-discipline"}
+  ]
+}

package/dist/agent-src/skills/prompt-validator/evals/triggers.json

@@ -1,5 +1,6 @@
 {
   "skill": "prompt-validator",
+  "last_eval": "2026-06-16",
   "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers the pre-spend batch-contradiction gate (style / character / physics / lip-sync ownership). Should-not-trigger covers near-miss neighbors: single-prompt craft (video-director), LLM prompt tuning (prompt-optimizer / prompt-engineering-patterns), and vocal-map validation (validate-vocal-map.sh path).",
   "queries": [
     {"q": "validate the prompts before we render", "trigger": true},

package/dist/agent-src/skills/react-shadcn-ui/SKILL.md

@@ -203,11 +203,18 @@ not the initial apply — it also emits:
   envelope on apply passes; the engine's `_apply_a11y_gate` only fires
   when a baseline is present.
 - `state.ui_review.preview` — `{render_ok: bool, screenshot_path?,
-  dom_dump_path?, error?, skipped?}`. `render_ok: false` with `error`
-  populated triggers the `preview_render_failed` halt; `render_ok: true`
-  with `screenshot_path` threads the screenshot into the delivery
-  report's `artifacts` list. Browser tooling (Playwright/Cypress/…) is
-  a consumer-project dependency — this package does not ship one.
+  dom_dump_path?, error?, skipped?, skip_reason?}`. **Render evidence is
+  required, not optional** on a review/polish pass: you MUST drive the
+  headless browser (Playwright + axe-core) against the rendered output and
+  write `render_ok`. Omitting it now triggers the `preview_render_required`
+  halt — a render-capable stack can no longer claim success without
+  rendering. `render_ok: false` with `error` populated triggers the
+  `preview_render_failed` halt; `render_ok: true` with `screenshot_path`
+  threads the screenshot into the delivery report's `artifacts` list. The
+  only no-render path is an **explicit, reasoned skip**: set `skipped: true`
+  plus a `skip_reason` (e.g. no Playwright runner in this env). Browser
+  tooling (Playwright/Cypress/…) is a consumer-project dependency — this
+  package does not ship one.
 
 Polish dispatch: when the dispatcher skips `review` because a previous
 review pass already returned `SUCCESS`, this skill MUST itself

package/dist/agent-src/skills/react-shadcn-ui/scripts/shadcn_add.ts

@@ -0,0 +1,388 @@
+#!/usr/bin/env tsx
+// Modified from upstream (Apache-2.0, "claudekit" via
+// an external reference ui-styling sub-skill
+// @ b7e3af80f6e331f6fb456667b82b12cade7c9d35, last checked 2026-06-07).
+// License copy: src/skills/design-intelligence/LICENSE.apache-2.0.txt
+// (deployed: <skills-root>/design-intelligence/LICENSE.apache-2.0.txt).
+// Modifications: adopted into the agent-config skill tree; header added
+// per Apache-2.0 §4b; see design-intelligence/ATTRIBUTION.md.
+/**
+ * shadcn/ui Component Installer
+ *
+ * Add shadcn/ui components to project with automatic dependency handling.
+ * Wraps shadcn CLI for programmatic component installation.
+ *
+ * TypeScript twin of `src/skills/react-shadcn-ui/scripts/shadcn_add.py`
+ * (ADR-200). The CLI contract is mirrored EXACTLY — positional components,
+ * `--all`, `--overwrite`, `--dry-run`, `--list`, `--project-root`, exit codes
+ * (0 / 1), the stdout/stderr split, byte-identical messages, AND the exact
+ * `npx shadcn@latest …` command shape. No behaviour changes — latent Python
+ * quirks replicated.
+ */
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { pathToFileURL } from 'node:url';
+
+export class ShadcnInstaller {
+    projectRoot: string;
+    dryRun: boolean;
+    componentsJson: string;
+
+    constructor(projectRoot: string | null = null, dryRun = false) {
+        this.projectRoot = projectRoot ?? process.cwd();
+        this.dryRun = dryRun;
+        this.componentsJson = path.join(this.projectRoot, 'components.json');
+    }
+
+    /** Check if shadcn is initialized — components.json exists. */
+    checkShadcnConfig(): boolean {
+        return fs.existsSync(this.componentsJson);
+    }
+
+    /** Get list of already installed components (unsorted, mirrors .py). */
+    getInstalledComponents(): string[] {
+        if (!this.checkShadcnConfig()) {
+            return [];
+        }
+        try {
+            const config = JSON.parse(fs.readFileSync(this.componentsJson, 'utf-8')) as unknown;
+            const aliasesRaw =
+                config && typeof config === 'object' && 'aliases' in config
+                    ? (config as { aliases?: unknown }).aliases
+                    : undefined;
+            const aliases =
+                aliasesRaw && typeof aliasesRaw === 'object'
+                    ? (aliasesRaw as { components?: unknown })
+                    : {};
+            const componentsAlias =
+                typeof aliases.components === 'string' ? aliases.components : 'components';
+            const componentsDir = path.join(this.projectRoot, componentsAlias.replace('@/', ''));
+            const uiDir = path.join(componentsDir, 'ui');
+
+            if (!fs.existsSync(uiDir)) {
+                return [];
+            }
+
+            return _globTsxStems(uiDir);
+        } catch {
+            // json.JSONDecodeError | KeyError | OSError → []
+            return [];
+        }
+    }
+
+    /** Add shadcn/ui components → [success, message]. */
+    addComponents(components: string[], overwrite = false): [boolean, string] {
+        if (components.length === 0) {
+            return [false, 'No components specified'];
+        }
+
+        if (!this.checkShadcnConfig()) {
+            return [false, "shadcn not initialized. Run 'npx shadcn@latest init' first"];
+        }
+
+        // Check which components already exist
+        const installed = this.getInstalledComponents();
+        const alreadyInstalled = components.filter((c) => installed.includes(c));
+
+        if (alreadyInstalled.length > 0 && !overwrite) {
+            return [
+                false,
+                `Components already installed: ${alreadyInstalled.join(', ')}. ` +
+                    'Use --overwrite to reinstall',
+            ];
+        }
+
+        // Build command
+        const cmd = ['npx', 'shadcn@latest', 'add', ...components];
+
+        if (overwrite) {
+            cmd.push('--overwrite');
+        }
+
+        if (this.dryRun) {
+            return [true, `Would run: ${cmd.join(' ')}`];
+        }
+
+        // Execute command
+        return this._runAdd(cmd, `Successfully added components: ${components.join(', ')}`);
+    }
+
+    /** Add all available shadcn/ui components → [success, message]. */
+    addAllComponents(overwrite = false): [boolean, string] {
+        if (!this.checkShadcnConfig()) {
+            return [false, "shadcn not initialized. Run 'npx shadcn@latest init' first"];
+        }
+
+        const cmd = ['npx', 'shadcn@latest', 'add', '--all'];
+
+        if (overwrite) {
+            cmd.push('--overwrite');
+        }
+
+        if (this.dryRun) {
+            return [true, `Would run: ${cmd.join(' ')}`];
+        }
+
+        return this._runAdd(cmd, 'Successfully added all components', true);
+    }
+
+    /**
+     * Mirror the subprocess.run(..., check=True) try/except for both add paths.
+     * `failAll` toggles the "Failed to add all components" vs "Failed to add
+     * components" prefix.
+     */
+    private _runAdd(cmd: string[], successBase: string, failAll = false): [boolean, string] {
+        const result = spawnSync(cmd[0] as string, cmd.slice(1), {
+            cwd: this.projectRoot,
+            encoding: 'utf-8',
+        });
+
+        // FileNotFoundError — the executable itself is missing.
+        if (result.error && (result.error as NodeJS.ErrnoException).code === 'ENOENT') {
+            return [false, 'npx not found. Ensure Node.js is installed'];
+        }
+
+        const stdout = result.stdout ?? '';
+        const stderr = result.stderr ?? '';
+        const status = result.status;
+
+        if (status === 0) {
+            let successMsg = successBase;
+            if (stdout) {
+                successMsg += `\n\nOutput:\n${stdout}`;
+            }
+            return [true, successMsg];
+        }
+
+        // subprocess.CalledProcessError — e.stderr or e.stdout or str(e).
+        const detail = stderr || stdout || _calledProcessError(cmd, status, result.signal);
+        const prefix = failAll ? 'Failed to add all components' : 'Failed to add components';
+        return [false, `${prefix}: ${detail}`];
+    }
+
+    /** List installed components → [success, message]. */
+    listInstalled(): [boolean, string] {
+        if (!this.checkShadcnConfig()) {
+            return [false, 'shadcn not initialized'];
+        }
+
+        const installed = this.getInstalledComponents();
+
+        if (installed.length === 0) {
+            return [true, 'No components installed'];
+        }
+
+        const sorted = [...installed].sort(_pyStrCmp);
+        return [true, 'Installed components:\n' + sorted.map((c) => `  - ${c}`).join('\n')];
+    }
+}
+
+/** Mirror Python default str comparison (UTF-16 code-unit ordering matches for BMP). */
+function _pyStrCmp(a: string, b: string): number {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+
+/**
+ * Mirror `[f.stem for f in ui_dir.glob("*.tsx") if f.is_file()]`. Path.glob
+ * returns only direct children whose name ends in `.tsx`; `f.stem` drops the
+ * final `.tsx` suffix; order is the directory listing (later `sorted()` in
+ * list_installed handles display order). Symlinks to files count as files.
+ */
+function _globTsxStems(uiDir: string): string[] {
+    let entries: fs.Dirent[];
+    try {
+        entries = fs.readdirSync(uiDir, { withFileTypes: true });
+    } catch {
+        return [];
+    }
+    const out: string[] = [];
+    for (const e of entries) {
+        if (!e.name.endsWith('.tsx')) {
+            continue;
+        }
+        let isFile = e.isFile();
+        if (e.isSymbolicLink()) {
+            try {
+                isFile = fs.statSync(path.join(uiDir, e.name)).isFile();
+            } catch {
+                isFile = false;
+            }
+        }
+        if (isFile) {
+            out.push(e.name.slice(0, -'.tsx'.length));
+        }
+    }
+    return out;
+}
+
+/** Mirror `str(subprocess.CalledProcessError)` for the rare empty-output case. */
+function _calledProcessError(cmd: string[], status: number | null, signal: string | null): string {
+    const cmdRepr = '[' + cmd.map((c) => `'${c}'`).join(', ') + ']';
+    if (signal) {
+        return `Command ${cmdRepr} died with ${signal}.`;
+    }
+    return `Command ${cmdRepr} returned non-zero exit status ${status}.`;
+}
+
+const PROG = 'shadcn_add.py';
+
+const HELP =
+    `usage: ${PROG} [-h] [--all] [--overwrite] [--dry-run] [--list]\n` +
+    '                     [--project-root PROJECT_ROOT]\n' +
+    '                     [components ...]\n' +
+    '\n' +
+    'Add shadcn/ui components to your project\n' +
+    '\n' +
+    'positional arguments:\n' +
+    '  components            Component names to add (e.g., button, card, dialog)\n' +
+    '\n' +
+    'optional arguments:\n' +
+    '  -h, --help            show this help message and exit\n' +
+    '  --all                 Add all available components\n' +
+    '  --overwrite           Overwrite existing components\n' +
+    '  --dry-run             Show what would be done without executing\n' +
+    '  --list                List installed components\n' +
+    '  --project-root PROJECT_ROOT\n' +
+    '                        Project root directory (default: current directory)\n' +
+    '\n' +
+    'Examples:\n' +
+    '  # Add single component\n' +
+    '  python shadcn_add.py button\n' +
+    '\n' +
+    '  # Add multiple components\n' +
+    '  python shadcn_add.py button card dialog\n' +
+    '\n' +
+    '  # Add all components\n' +
+    '  python shadcn_add.py --all\n' +
+    '\n' +
+    '  # Overwrite existing components\n' +
+    '  python shadcn_add.py button --overwrite\n' +
+    '\n' +
+    '  # Dry run (show what would be done)\n' +
+    '  python shadcn_add.py button card --dry-run\n' +
+    '\n' +
+    '  # List installed components\n' +
+    '  python shadcn_add.py --list\n' +
+    '        \n';
+
+const USAGE =
+    `usage: ${PROG} [-h] [--all] [--overwrite] [--dry-run] [--list]\n` +
+    '                     [--project-root PROJECT_ROOT]\n' +
+    '                     [components ...]\n';
+
+class ArgExit extends Error {
+    constructor(public code: number) {
+        super('argexit');
+    }
+}
+
+interface Args {
+    components: string[];
+    all: boolean;
+    overwrite: boolean;
+    dry_run: boolean;
+    list: boolean;
+    project_root: string | null;
+}
+
+function argError(message: string): never {
+    process.stderr.write(USAGE);
+    process.stderr.write(`${PROG}: error: ${message}\n`);
+    throw new ArgExit(2);
+}
+
+/** Parse argv mirroring the argparse spec (positional `components` nargs="*"). */
+function parseArgs(argv: string[]): Args {
+    const args: Args = {
+        components: [],
+        all: false,
+        overwrite: false,
+        dry_run: false,
+        list: false,
+        project_root: null,
+    };
+
+    let i = 0;
+    while (i < argv.length) {
+        let a = argv[i] as string;
+        let inlineValue: string | null = null;
+        const eq = a.indexOf('=');
+        if (a.startsWith('--') && eq !== -1) {
+            inlineValue = a.slice(eq + 1);
+            a = a.slice(0, eq);
+        }
+
+        if (a === '-h' || a === '--help') {
+            process.stdout.write(HELP);
+            throw new ArgExit(0);
+        } else if (a === '--all') {
+            args.all = true;
+        } else if (a === '--overwrite') {
+            args.overwrite = true;
+        } else if (a === '--dry-run') {
+            args.dry_run = true;
+        } else if (a === '--list') {
+            args.list = true;
+        } else if (a === '--project-root') {
+            const v = inlineValue ?? (argv[++i] as string | undefined);
+            if (v === undefined) {
+                argError('argument --project-root: expected one argument');
+            }
+            args.project_root = v;
+        } else if (a.startsWith('-') && a !== '-') {
+            argError(`unrecognized arguments: ${argv[i]}`);
+        } else {
+            args.components.push(argv[i] as string);
+        }
+        i += 1;
+    }
+    return args;
+}
+
+export function main(argv: string[] = process.argv.slice(2)): number {
+    let args: Args;
+    try {
+        args = parseArgs(argv);
+    } catch (e) {
+        if (e instanceof ArgExit) {
+            return e.code;
+        }
+        throw e;
+    }
+
+    const installer = new ShadcnInstaller(args.project_root, args.dry_run);
+
+    // Handle list command
+    if (args.list) {
+        const [success, message] = installer.listInstalled();
+        process.stdout.write(`${message}\n`);
+        return success ? 0 : 1;
+    }
+
+    // Handle add all command
+    if (args.all) {
+        const [success, message] = installer.addAllComponents(args.overwrite);
+        process.stdout.write(`${message}\n`);
+        return success ? 0 : 1;
+    }
+
+    // Handle add specific components
+    if (args.components.length === 0) {
+        process.stdout.write(HELP);
+        return 1;
+    }
+
+    const [success, message] = installer.addComponents(args.components, args.overwrite);
+
+    process.stdout.write(`${message}\n`);
+    return success ? 0 : 1;
+}
+
+const _invokedDirectly =
+    process.argv[1] !== undefined &&
+    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+if (_invokedDirectly) {
+    process.exitCode = main();
+}

package/dist/agent-src/skills/reasoning-orchestrator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reasoning-orchestrator
-description: "Use for complex / ambiguous / long-horizon work — coordinate the reasoning chain ground→intent→notes→gather→audit→verify; composes existing skills, never duplicates them."
+description: "Use for multi-step / ambiguous / end-to-end work — refactor a whole module, drive a vague ticket to a verified result, plan+build+verify a migration; coordinates the reasoning chain across skills."
 source: package
 domain: engineering
 status: active

package/dist/agent-src/skills/reasoning-orchestrator/evals/triggers.json

@@ -1,5 +1,6 @@
 {
   "skill": "reasoning-orchestrator",
+  "last_eval": "2026-06-16",
   "description": "5 should-trigger + 5 should-not-trigger. Should-trigger covers complex / ambiguous / long-horizon work on a standard host where the reasoning steps are interdependent; should-not covers trivial / linear tasks, strong-host self-coordination, and single-discipline neighbors.",
   "queries": [
     {"q": "refactor the entire billing module to be cleaner and safer", "trigger": true},

package/dist/agent-src/skills/refine-ticket/evals/triggers.json

@@ -1,5 +1,6 @@
 {
   "skill": "refine-ticket",
+  "last_eval": "2026-06-16",
   "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings and the four input paths (key, branch, paste, URL). Should-not-trigger covers the four near-miss neighbors (plan / estimate / duplicate / threat-model / bug-investigate) whose vocabulary overlaps with ticket refinement.",
   "queries": [
     {"q": "refine this ticket before I plan it", "trigger": true},

package/dist/agent-src/skills/roadmap-management/SKILL.md

@@ -212,13 +212,16 @@ When picking up a roadmap in a new session:
 
 ### Completing, archiving & skipping a roadmap
 
-Every roadmap ends in exactly one of three states:
+Every roadmap ends in exactly one of four states:
 
 | State | Folder | Trigger |
 |---|---|---|
-| **Active** | `agents/roadmaps/` | Work in progress or planned |
+| **Active** | `agents/roadmaps/` | Work in progress or planned **and workable now** |
 | **Archived** | `agents/roadmaps/archive/` | Work was done (fully or partially) and no more work is planned |
 | **Skipped** | `agents/roadmaps/skipped/` | Decision against pursuit — superseded, scope rejected, wrong direction. Typically **0 items `[x]`** |
+| **Later** | `agents/roadmaps/later/` | Open work remains but is **blocked-for-later** — gated on an external trigger or a decision, **will resume** when unblocked. Set frontmatter `status: later` + a `Blocked until` / `Trigger` resume line. Excluded from the dashboard and `/roadmap:process-*` (parked, not abandoned). |
+
+**Active vs. Later — the test:** can the agent make progress on this roadmap *now*, autonomously? If every open item is gated on something outside this roadmap (a real consumer repo, a benchmark re-open, host-model access, a kernel soak, a pruning track, a human decision), it is **not** active — move it to `later/` with its resume condition. A blocked roadmap left in the active tree silently lies to the dashboard and to `/roadmap:process-*`, which will keep trying to execute it. The `lint_roadmap_later_disposition` guard enforces the placement↔`status: later` contract.
 
 After the last step of a roadmap is done, check completion status:
 
@@ -248,6 +251,7 @@ After the last step of a roadmap is done, check completion status:
 
    - Archive: `✅  Roadmap archived → agents/roadmaps/archive/{filename}`
    - Skip:    `⏭️  Roadmap skipped → agents/roadmaps/skipped/{filename}`
+   - Later:   `🕒  Roadmap parked for later → agents/roadmaps/later/{filename}`
 
    `[-]` cancelled items remain searchable in archived file — they were
    explicit drops. `[~]` deferred items, by contrast, may not silently
@@ -268,6 +272,7 @@ After the last step of a roadmap is done, check completion status:
    > 2. Keep active — I want to finish the open items
    > 3. Mark open items as deferred [~] and archive (triggers Iron Law 3 flow)
    > 4. Skip — move to skipped/ (no meaningful work done, not pursuing)
+   > 5. Later — park in later/ (open work is blocked on an external trigger / decision but will resume)
    ```
 
    Option 4 only appropriate when `count_x == 0` or completed items were
@@ -276,6 +281,14 @@ After the last step of a roadmap is done, check completion status:
    NOT archive immediately — converts open → deferred, re-enters the
    `count_deferred > 0` branch, which runs step 4b.
 
+   **Option 5 (Later) — right when open items are real but cannot proceed
+   now** (gated on an external trigger or a decision). Set frontmatter
+   `status: later`, ensure a `Blocked until` / `Trigger` resume line, `git mv`
+   to `agents/roadmaps/later/`, migrate inbound refs to the new path, regen.
+   Open `[ ]` items stay open (not cancelled/deferred) — parked whole, ready to
+   resume when the trigger fires. **Roadmaps with open tasks deferred for later
+   are always moved to `later/`**, never left to rot in the active tree.
+
 4b. **Deferred items present (`count_deferred ≥ 1`, `count_open == 0`)** — Iron Law 3 flow.
    Archive **blocked** until user resolves deferrals. Surface plan and ask:
 
@@ -401,7 +414,7 @@ no meaningful work was invested and the scope itself was rejected.
 
 A generated dashboard aggregates progress across every open roadmap. It sits at
 `agents/roadmaps-progress.md` (outside `roadmaps/` to keep the folder clean) and
-is rewritten by `.augment/scripts/update_roadmap_progress.py`.
+is rewritten by `.augment/scripts/update_roadmap_progress.ts`.
 
 **Always regenerate in the SAME response** after any of the following
 (enforced by [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md)):

package/dist/agent-src/skills/roadmap-writing/SKILL.md

@@ -154,6 +154,60 @@ Follow-up is **not** authored from scratch — deferred steps copied
 verbatim (with phase context). Preserves plan exactly as author
 originally wrote it.
 
+### 8. Source-derived & capability-adoption roadmaps (conditional)
+
+Fires **only** when roadmap originates from external input or adopts
+capabilities into the suite:
+
+- competitive / capability harvest, external suggestion, or external
+  LLM ideation thread, **or**
+- decision to integrate/adopt new skills, commands, or a pack, **or**
+- plan whose design has genuinely contested, unresolved trade-offs.
+
+Ordinary internally-originated roadmap → **skip this section**; §§ 0–7
+are the whole job. Don't bolt a Provenance block or gap-table onto a
+plan needing neither (template rule 18).
+
+When it fires, add four moves to §§ 0–7:
+
+**A. Gap-table before drafting (don't adopt — integrate).** Audit each
+proposed item against the *existing* skill / command / rule surface;
+classify `KEEP` (verified gap), `FOLD` (into a named existing artefact),
+`CUT` (already covered). Only `KEEP` items become scope; `FOLD`/`CUT`
+recorded so the cut is auditable. Negative grep ≠ proof — open the
+nearest existing artefacts (per
+[`think-before-action`](../../rules/think-before-action.md); for an
+external source,
+[`external-reference-deep-dive`](../../rules/external-reference-deep-dive.md)).
+
+**B. Resolve contested design in council *first*, then author.** Default
+council flow (`/roadmap:ai-council`) *challenges a finished roadmap*. For
+a contested/source-derived plan, run council **up front** on the design
+questions (`/council:design`, or the
+[`ai-council`](../ai-council/SKILL.md) skill), converge, **then** write
+the roadmap encoding the verdicts — ships already-decided, not as open
+questions in prose. One run, converge; don't relitigate.
+
+**C. Encode the decision so it survives.**
+- Inline council convergence under `## Council notes (<date>, <depth>)`
+  — members + date, **never** a session filepath
+  ([`no-roadmap-references`](../../rules/no-roadmap-references.md)).
+- Add `## Provenance` — source by **neutral descriptor** (never the raw
+  competitor/tool name,
+  [`source-confidentiality`](../../rules/source-confidentiality.md));
+  retain the real link as an `ENC1:` token via
+  `src/scripts/_lib/link_crypto.ts encrypt --value <url>`.
+- Save the locked decision to memory (project type, "don't relitigate")
+  so a future session does not re-derive it.
+
+**D. Make "integration, not dump" a testable acceptance criterion.** AC
+encodes the anti-dump litmus, decidably: visible commands within the
+pack's `size_class` budget; each new visible command reuses ≥ 2 existing
+skills; no new artefact duplicates an existing one; governance preflight
+recorded — `domain-adoption-policy` (new domain?), `persona-governance`
+(new personas?), `framework-neutrality`, `size-enforcement` —
+disposition stated in the roadmap.
+
 ## Output format
 
 A single Markdown file at `agents/roadmaps/{name}.md`:
@@ -192,6 +246,10 @@ to every roadmap you author.
 3. Are checkboxes present in every non-intro phase?
 4. Are exit criteria decidable, or vibe-based ("looks good")?
 5. Is content duplicated from another roadmap (supersession instead)?
+6. *Source-derived/adoption only (§ 8):* gap-table (`KEEP`/`FOLD`/`CUT`)
+   behind the scope? `## Provenance` block with `ENC1:` link? inlined
+   council convergence? anti-dump acceptance criterion? (Internally
+   originated → these must be **absent**, not empty.)
 
 ## Do NOT
 
@@ -219,6 +277,15 @@ to every roadmap you author.
 * Use ALL-CAPS Iron-Law fenced blocks — those belong in
   [`kernel-membership`](../../../docs/contracts/kernel-membership.md)-listed
   rules, not roadmaps.
+* Adopt items from an external source / harvest **without a
+  `KEEP`/`FOLD`/`CUT` gap-table** against the existing surface (§ 8) —
+  skill dump, not integration.
+* Add a `## Provenance` block (or gap-table) to an **internally
+  originated** roadmap — § 8 is conditional; an empty Provenance section
+  is noise (template rule 18).
+* Name the raw competitor / tool in a tracked roadmap, or paste a raw
+  source link — anonymize + `ENC1:`-encrypt
+  ([`source-confidentiality`](../../rules/source-confidentiality.md)).
 
 ## Gotchas
 
@@ -238,6 +305,15 @@ to every roadmap you author.
   "merge PR #X" or "commit phase Y" couple roadmap closure to git
   operations the user has not authorized. Roadmap completion is
   decoupled from delivery; ship-the-PR is its own decision.
+- **Adopting an external suggestion verbatim** — a harvest/suggestion
+  roadmap copying the source's item list without the § 8
+  `KEEP`/`FOLD`/`CUT` audit becomes a skill dump: existing items get
+  rebuilt, fold-candidates spawn duplicates. The gap-table is the
+  integration discipline.
+- **Council-as-afterthought** — running council only *after* a contested
+  roadmap is written wastes the convergence: the plan still reads as
+  open questions. Source-derived/contested → council *first* (§ 8.B),
+  then author the verdicts.
 
 ## Examples