@event4u/agent-config 6.1.0 → 7.0.0

package/docs/cookbook.md

@@ -0,0 +1,152 @@
+# Cookbook — things you can do in a minute
+
+> **Generated** by `scripts/generate_cookbook.py` from `src/flows/cookbook.yaml` + `src/flows/<flow>.yaml` — do NOT hand-edit.
+> Every command and skill below is validated to exist at generation time; a recipe naming a missing command fails the build.
+
+Each recipe is a short command sequence. Run the commands in order; the listed skills are the capabilities they compose.
+
+## Named recipes
+
+### Review a change before it ships
+
+*You have a diff and want a real review, not a rubber-stamp.*
+
+- **Commands:** `/review-changes` → `/judge` → `/quality-fix`
+- **Skills:** `code-review`, `adversarial-review`
+
+### Fix a red CI run
+
+*CI is failing and you want the failure pinpointed and fixed.*
+
+- **Commands:** `/fix:ci`
+- **Skills:** `systematic-debugging`
+
+### Build a feature from a ticket
+
+*You have a ticket and want it refined, estimated, and implemented.*
+
+- **Commands:** `/refine-ticket` → `/estimate-ticket` → `/implement-ticket`
+- **Skills:** `feature-planning`, `test-driven-development`
+
+### Plan a feature before writing code
+
+*The ask is fuzzy and you want a bounded plan first.*
+
+- **Commands:** `/feature:explore` → `/feature:plan`
+- **Skills:** `feature-planning`, `complexity-first-planning`
+
+### Security-audit a surface
+
+*You touched auth / billing / tenancy and want abuse cases first.*
+
+- **Commands:** `/threat-model` → `/judge:solo`
+- **Skills:** `threat-modeling`, `security-audit`
+
+### Open a pull request
+
+*The work is done and you want a clean PR ready for review.*
+
+- **Commands:** `/prepare-for-review` → `/pr:create`
+- **Skills:** `requesting-code-review`, `conventional-commits-writing`
+
+### Research a topic deeply
+
+*You need a multi-source, fact-checked report, not a guess.*
+
+- **Commands:** `/research:deep` → `/research:report`
+- **Skills:** `deep-reading-analyst`
+
+### Investigate and fix a bug
+
+*Something is broken and you want root cause before the patch.*
+
+- **Commands:** `/bug-investigate` → `/bug-fix`
+- **Skills:** `systematic-debugging`, `bug-analyzer`
+
+### Get a second opinion from the AI council
+
+*A design call is genuinely contested and you want independent models.*
+
+- **Commands:** `/council:design` → `/council:debate`
+- **Skills:** `ai-council`
+
+### Process a roadmap autonomously
+
+*You have a roadmap and want it worked end-to-end.*
+
+- **Commands:** `/roadmap:create` → `/roadmap:process-full`
+- **Skills:** `roadmap-management`
+
+### Refactor with a safety net
+
+*You want to restructure code without changing behaviour.*
+
+- **Commands:** `/feature:refactor` → `/review-changes` → `/judge`
+- **Skills:** `code-refactoring`, `test-driven-development`
+
+### Commit in logical chunks
+
+*You have a messy working tree and want clean, scoped commits.*
+
+- **Commands:** `/commit:in-chunks`
+- **Skills:** `conventional-commits-writing`
+
+### Analyze an unfamiliar project
+
+*You just opened a repo and want a fast structural read.*
+
+- **Commands:** `/project-analyze` → `/project-health`
+- **Skills:** `project-analyzer`
+
+### Estimate a ticket
+
+*You need a defensible estimate with the reasoning shown.*
+
+- **Commands:** `/estimate-ticket`
+- **Skills:** `estimate-ticket`
+
+### Run a blame-free post-mortem that teaches the next change
+
+*An incident, near-miss, or risky plan needs analysis that closes the learning loop.*
+
+- **Commands:** `/analyze`
+- **Skills:** `blameless-post-mortem`, `root-cause-frameworks`
+
+### Upgrade a Laravel app one major version
+
+*You want a gated, catalog-driven Laravel major-version upgrade (10→11) on a provisional branch — never auto-PR.*
+
+- **Commands:** `/mission:upgrade`
+- **Skills:** `dependency-upgrade`
+
+## The four work flows
+
+Broader than a single recipe — the end-to-end shapes most work follows.
+
+### Discovery flow
+
+Explore, plan, estimate, refine, and investigate before building. The "what should we build and how" front of the developer journey.
+
+- **Path:** `/feature:explore` → `/feature:plan` → `/estimate-ticket` → `/refine-ticket`
+- **Skills:** `feature-planning`, `estimate-ticket`, `refine-ticket`, `project-analysis-core`, `validate-feature-fit`
+
+### Implementation flow
+
+Build it. The core "make the change" front — drive a prompt, ticket, or feature end-to-end through plan → implement → verify.
+
+- **Path:** `/work` → `/review-changes` → `/quality-fix` → `/commit`
+- **Skills:** `test-driven-development`, `code-review`, `systematic-debugging`, `git-workflow`
+
+### Review flow
+
+Check it. Self-review, judge, quality-fix, and threat-model a change before it ships.
+
+- **Path:** `/review-changes` → `/judge` → `/quality-fix` → `/threat-model`
+- **Skills:** `code-review`, `adversarial-review`, `quality-tools`, `threat-modeling`, `receiving-code-review`
+
+### Delivery flow
+
+Ship it. Commit in logical chunks, open the PR, answer review comments, and prepare the branch for review.
+
+- **Path:** `/commit` → `/pr:create` → `/fix:pr-comments`
+- **Skills:** `conventional-commits-writing`, `git-workflow`, `requesting-code-review`

package/docs/customization.md

@@ -190,6 +190,9 @@ is recovered on the next server boot.
 | `ai_council.cost_budget.max_total_usd` | `0.0` | Per-invocation USD ceiling. `0` disables (token caps still apply). |
 | `ai_council.cost_budget.daily_limit_usd` | `0.0` | Rolling 24h USD ceiling across all `/council` calls. `0` disables. Ledger lives at `~/.event4u/agent-config/council-spend.jsonl` (mode 0600). |
 | `ai_council.session_retention_days` | `14` | Auto-prune for `agents/runtime/council/sessions/` audit folders. Older session directories are removed on the next `save()`. `0` disables (keep forever). |
+| `reasoning.enabled` | `true` | Master switch for the Reasoning Discipline Protocol (RDP). `false` = the whole layer is inert (zero overhead). See [`docs/contracts/reasoning-discipline-protocol.md`](contracts/reasoning-discipline-protocol.md). |
+| `reasoning.auto_gate` | `true` | Benefit-gates RDP on table-free signals (task signal + host self-assessment) so it engages only where it pays. `false` = gate on task-signal + toggles only (skip the host self-assessment). |
+| `reasoning.components.<name>` | `true` | Per-component switches — `orchestrator`, `notes_first`, `grounding`, `intent`, `complexity_first`, `verifier_default`, `prediction_tracking`, `decision_ledger`, `uncertainty_budget`. Each fires only when `reasoning.enabled` **and** the `auto_gate` test passes. |
 
 > **Experimental.** AI Council is not yet validated by external users. API costs apply per consultation.
 
@@ -200,6 +203,14 @@ vars. Pre-2.4 installs at `~/.config/agent-config/<provider>.key` are still
 honoured by the loaders as a fallback. The `/council` command refuses to run
 if the key file's permissions drift.
 
+The `reasoning.*` group controls the **Reasoning Discipline Protocol (RDP)** —
+a cost-gated layer that transplants the *operating discipline* of a frontier
+reasoning model onto any host model (it transfers discipline, never capability).
+For what it does, when it engages, and how to switch it off, see the user-facing
+contract [`docs/contracts/reasoning-discipline-protocol.md`](contracts/reasoning-discipline-protocol.md);
+the sourced rationale lives in the design dossier
+[`docs/guidelines/agent-infra/frontier-reasoning-operating-profile.md`](guidelines/agent-infra/frontier-reasoning-operating-profile.md).
+
 ### Cost profiles
 
 > **Four "cost" concepts — don't confuse them.** Several settings sound like
@@ -554,7 +565,7 @@ Run the probe to confirm:
 
 ```bash
 task probe:skills
-# or directly: python3 scripts/probe_skill_registration.py
+# or directly: ./scripts-run src/scripts/probe_skill_registration
 ```
 
 The probe lists every registration across all six tools and flags

package/docs/decisions/ADR-013-discovery-frontmatter-contract.md

@@ -125,6 +125,8 @@ Amendments to the workspace list require an ADR-013 amendment.
 | `meta` | Artefacts that maintain *this* package (`agent-config` itself). |
 | `git` | Git workflow — commit, pull requests, branch sync. Carries `slug_prefix: git` (ADR-044 §A3); `requires: engineering-base`. Added 2026-06-04 for 6.0.0-D Step 12 Class B1 (`commit`→`git-commit`, `create-pr`→`git-pr-create`). |
 | `frontend-design` | Grounded design intelligence — design-knowledge corpus + BM25 grounding engine, design tokens, stack best-practice and chart/typography knowledge. `requires: engineering-base`; `suggests: react, nextjs`. Added 2026-06-07 (ADR-061). |
+| `analysis-workbench` | RCA, post-mortem, premortem, decision-review as an integrated learning loop. `requires: engineering-base`; opt-in under the `engineering` workspace. Added 2026-06-15 (ADR-096). |
+| `brand` | Brand as a first-class UX layer — archetype/voice/identity grounding corpus, brand→token derivation, and consistency governance that constrains UI. `requires: frontend-design`; `suggests: ai-image`; opt-in under the `engineering` workspace. Added 2026-06-16 (road-to-image-brand-typography Phase B). |
 
 Amendments to the pack list require an ADR-013 amendment and the
 matching `src/config/discovery/packs.yml` row in the same PR.
@@ -279,6 +281,20 @@ openai/gpt-4o, converged A2: opt-in pack over inflating `engineering-base`
 with ~1 MB of design data). Additive, no rename; non-overlap with
 cost-profile and `profile.id` reservations holds.
 
+### 2026-06-16 — New `brand` pack
+
+Added pack id `brand` to the closed vocabulary (brand as a first-class UX layer
+— archetype/voice/identity grounding corpus, brand→token derivation, and
+consistency governance that constrains UI). Mirrored in
+[`src/config/discovery/packs.yml`](../../src/config/discovery/packs.yml) and the
+`ADR_PACKS` frozenset in
+[`scripts/lint_discovery_vocabulary.py`](../../src/scripts/lint_discovery_vocabulary.py).
+`workspaces: [engineering]`, `requires: [frontend-design]`, `suggests:
+[ai-image]` (pack-brand exports tokens, pack-ai-image consumes them — B → A),
+`trust_level_default: professional`, `size_class: medium`. Council-resolved
+2026-06-13 (road-to-image-brand-typography Phase B). Additive, no rename;
+non-overlap with cost-profile and `profile.id` reservations holds.
+
 ## Cross-references
 
 - [ADR-007 — Agent Discovery Scopes](ADR-007-agent-discovery-scopes.md):

package/docs/decisions/ADR-056-unvalidated-video-adapters-disposition.md

@@ -119,6 +119,6 @@ No adapter is removed without explicit maintainer sign-off in this ADR
 ## References
 
 - `road-to-video-foundation-validation.md` (Phase 4) — the step this ADR closes.
-- `src/scripts/ai-video/lib/adapter-contract.md` (v2) — the trust-boundary helpers a validated adapter must use.
+- `src/scripts/media/lib/adapter-contract.md` (v2) — the trust-boundary helpers a validated adapter must use.
 - `provider-lifecycle-discipline` rule — the `experimental → stable` promotion gate.
 - AI council convergence (claude-sonnet-4-5 + gpt-4o, 2026-06-06): validation-first; multiplexer pivot supersedes per-model adapters.

package/docs/decisions/ADR-059-render-resume-filesystem-as-state.md

@@ -154,7 +154,7 @@ the "skill suite, not a runtime framework" answer.
 - Council artefact: two-round debate 2026-06-07 (members above), design
   mode, peer review on — convergence summarized in this ADR per
   `no-roadmap-references` (no session-file links).
-- `src/scripts/ai-video/lib/adapter-contract.md` — v2 trust boundary +
+- `src/scripts/media/lib/adapter-contract.md` — v2 trust boundary +
   error contract this design builds on.
 - Roadmap: road-to-video-deferred-design, Phase 1 (transient layer —
   not path-linked per `no-roadmap-references`).

package/docs/decisions/ADR-060-comfyui-sandbox-model.md

@@ -148,7 +148,7 @@ internet" out of the execution path.
   mode, peer review on — convergence summarized inline per
   `no-roadmap-references`.
 - ADR-059 — sibling design (resume) from the same roadmap phase.
-- `src/scripts/ai-video/lib/adapter-contract.md` — v2 contract the
+- `src/scripts/media/lib/adapter-contract.md` — v2 contract the
   adapter implements; local-source rule lands there as an additive note.
 - Roadmap: road-to-video-deferred-design, Phase 2 (transient layer —
   not path-linked per `no-roadmap-references`).

package/docs/decisions/ADR-061-corpus-grounding-layer.md

@@ -119,7 +119,7 @@ Recorded in `src/skills/design-intelligence/ATTRIBUTION.md`.
 | Fork | Resolution |
 |---|---|
 | Pack placement | **New `frontend-design` pack** (ADR-013 amendment, same PR). `requires: [engineering-base]`, `suggests: [react, nextjs]` — corpus is stack-agnostic data, React never required. Keeps ~1 MB of design data out of `engineering-base`. |
-| `google-fonts.csv` (745 KB, 1923 rows) | **Skip.** Redundant with the public Google Fonts API; `typography.csv` (73 curated pairings) carries the pairing decision. Document the API fallback for fonts outside the curated set. |
+| `google-fonts.csv` (745 KB, 1923 rows) | **Skip.** Redundant with the public Google Fonts API; `font-pairings-reference.csv` (73 curated pairings) carries the pairing decision. Document the API fallback for fonts outside the curated set. |
 | Stack-corpus surfacing | **`--stack <name>` search domain** on the one grounding engine — single mechanism, no 16-way prose-staleness vector. |
 | Brand→token pipeline | **Defer** with a watch note pinning the upstream commit SHA; adopt on first consumer demand. |
 
@@ -168,3 +168,50 @@ Recorded in `src/skills/design-intelligence/ATTRIBUTION.md`.
   Gemini-suite watch note.
 - Upstream: `nextlevelbuilder/ui-ux-pro-max-skill` @
   `b7e3af80f6e331f6fb456667b82b12cade7c9d35` (last checked 2026-06-07).
+
+## Amendment — 2026-06-16 (§8/§9 superseded in part)
+
+The image/brand/typography work re-examined the gated and deferred items of
+§8/§9 on the merits for the product vision. A two-round merits council
+(anthropic/claude-sonnet-4-5 + openai/gpt-4o, 2026-06-13, design lens,
+web-research-grounded) overturned three of them. The four-operation routing
+(§1) and the no-forked-engine principle (§2) are unchanged — the brand corpus
+is a second instance of the same grounding engine.
+
+- **§8 brand→token defer — resolved, no longer deferred.** This work was the
+  "first consumer demand" §8 named. `brand-to-tokens` ships: brand decisions →
+  a DTCG `.tokens.json` source of truth → `design-tokens/scripts/tokens.py`
+  (no Node). The same `.tokens.json` is the export pack-ai-image's brand-asset
+  generation and the greenfield-scaffold seed consume.
+- **§8 font fork — superseded.** "Skip `google-fonts.csv`, rely on the live
+  Google Fonts API" is replaced by **adopt-lite pinned metadata**: pin the MIT
+  `google-font-metadata` mirror (or a slim top-N slice) as a deterministic
+  offline **Reference**; the live API needs a key, is nondeterministic, and
+  carries no pairing metadata. `font-pairings-reference.csv` stays the curated
+  pairing Reference with a freshness contract.
+- **§9 brand-asset generation — superseded, ADOPTED.** The Gemini generative
+  brand-asset suite (logo/CIP/banner/social) was gated as a possible second
+  image-gen stack. The merits pass established it never was one: generation is
+  structured prompting + brand-token injection + provider routing on the
+  **existing** adapters (now the neutral `scripts/media/` substrate), with a
+  `recraft`/LLM-SVG vector path for marks raster models can't emit. Generation
+  lives in **pack-ai-image**; brand governance/tokens stay in **pack-brand**,
+  which exports tokens pack-ai-image consumes (dependency B → A, never
+  inverted). The `domain-watch/generative-brand-assets.md` gate is cleared.
+- **§9 slide/presentation engine — confirmed out of scope, but reasoned.**
+  Document assembly ≠ brand UX; owning a render engine (reveal.js / Presenton /
+  Gamma) is scope creep. pack-brand instead **exports validated brand
+  templates** (Marp/reveal YAML with locked brand variables) for the user's own
+  deck tools — enforcement via the template, not engine ownership. Re-open only
+  on evidenced demand.
+
+The brand corpus deviates from the §8-implied "adopt the SHA-pinned claudekit
+brand sub-skills" framing: it is **original-authored** from public brand
+frameworks (Jung / Mark-Pearson archetypes, public messaging frameworks),
+`upstream: null` — honest provenance, no third-party SHA to pin, no §4b file
+marking. The shared grounding engine is still attributed via
+`design-intelligence/ATTRIBUTION.md`.
+
+Implementing roadmap: `road-to-image-brand-typography` (Phase A–D),
+archived 2026-06-16; live-validation + command-surface follow-on tracked in
+its sibling follow-up roadmap.

package/docs/decisions/ADR-096-analysis-workbench.md

@@ -0,0 +1,110 @@
+---
+adr: 096
+status: accepted
+date: 2026-06-15
+decision: analysis-workbench
+supersedes: —
+superseded_by: —
+phase: road-to-analysis-workbench · Phase 0
+type: structural
+---
+
+# ADR-096 — Analysis Workbench design decisions
+
+## Status
+
+**Accepted** · 2026-06-15. Lands Phase 0 of
+[`road-to-analysis-workbench`](../../agents/roadmaps/archive/road-to-analysis-workbench.md).
+Routed through AI council (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
+two rounds, 2026-06-15).
+
+## Context
+
+A new `analysis-workbench` pack was proposed to close the post-incident
+learning loop: structured post-mortem → root-cause analysis → corrective-action
+design → memory candidates → human-gated promote. Several design questions
+required council input before authoring any skill.
+
+## Decision
+
+### D1 — Collapse the skill set
+
+Council converged on four skills for v1:
+
+| Skill | Purpose |
+|---|---|
+| `blameless-post-mortem` | Structured post-incident review |
+| `root-cause-frameworks` | RCA engine (5-whys, fishbone, fault-tree, STAMP) |
+| `premortem` | Pre-launch risk elicitation |
+| `decision-review` | Retrospective decision quality |
+
+`incident-pattern-analysis` is **deferred** — it needs cross-project data the
+memory layer does not yet support reliably.
+
+### D2 — Internal-skill-heavy, not command-heavy
+
+The pack surfaces ≤ 5 visible commands (all opt-in). Complex orchestration
+lives inside skill bodies, not in a command DSL or state-machine orchestrator
+(deferred).
+
+### D3 — `/analyze` as confidence-weighted suggester, not auto-triage
+
+`/analyze` proposes candidate flows with confidence weights. The user picks.
+It does NOT auto-triage or auto-route. Selection choices are logged to the
+provisional intake stream so future iterations can tune weights from real usage.
+
+### D4 — Memory loop is manual; promote gate is inviolable
+
+The hardest pushback in both council rounds was against any auto-promote path.
+Decision: the loop produces and proposes; `scripts/check_memory_proposal.py`
+is the sole admission gate (≥2 distinct paths OR ≥3 future decisions);
+the human runs `/memory promote`. No skill, hook, or roadmap step may
+bypass this gate. See [`analysis-memory-loop.md`](../contracts/analysis-memory-loop.md).
+
+### D5 — AI-specific RCA deferred
+
+AI-specific failure modes (prompt injection, model hallucination root-cause,
+latency regression attribution) require `road-to-security-hardening` primitives
+that do not yet exist. Deferred explicitly; `root-cause-frameworks` ships
+without them.
+
+### N1 — Time-decay is a Phase 1 hardening item (adopted)
+
+Council named time-decay, supersession, and dedup pre-check as Phase 1 work
+(not blockers for Phase 0 contract authoring). The contract captures the
+schema now so Phase 1 has a stable target:
+
+- `last_validated` + `review_after_days` + `applicable_scope` on every candidate.
+- `retrieve()` returns `{results, skipped}` — stale entries are in `skipped`,
+  never silently included in `results`.
+- Dedup: `retrieve()` before draft; on match, propose `frequency`/`supersedes`
+  update, not a new entry.
+
+## Consequences
+
+- Phase 0 ships two authoring artifacts: `docs/contracts/analysis-memory-loop.md`
+  and this ADR. No skills, no code.
+- Phase 1 (memory-loop hardening) implements the schema fields and `retrieve()`
+  contract documented in `analysis-memory-loop.md` § 1 and § 4.
+- The pack uses pack identifier `analysis-workbench`, `size_class: medium`,
+  `cross_workspace: true`.
+- Domain adoption gates do not fire: the analysis domain is already open
+  (`incident-commander`, `risk-officer`, `decision-record`,
+  `systematic-debugging` exist in the suite).
+
+## Alternatives
+
+- **Auto-promote on ≥ 2 occurrences** — rejected both rounds. Silent learning
+  loop is a trust and auditability risk; human gate is non-negotiable.
+- **State-machine orchestrator** — deferred. Premature before skills ship and
+  real usage patterns emerge.
+- **`incident-pattern-analysis` in v1** — rejected. Needs cross-project memory
+  access not available in v1; deferred to a follow-up roadmap.
+- **Flat command surface (>5 commands)** — rejected per command-surface-tiers
+  contract; opt-in pack stays lean.
+
+## References
+
+- [`docs/contracts/analysis-memory-loop.md`](../contracts/analysis-memory-loop.md) — the loop contract.
+- [`docs/contracts/low-impact-corpus-format.md`](../contracts/low-impact-corpus-format.md) — curated memory schema.
+- [`ADR-094`](ADR-094-agent-memory-layer-removal.md) — agent memory layer decision this pack operates within.

package/docs/decisions/ADR-097-mission-recipe-privilege-boundary.md

@@ -0,0 +1,121 @@
+---
+adr: 097
+status: accepted
+date: 2026-06-15
+decision: mission-recipe-privilege-boundary
+supersedes: —
+superseded_by: —
+phase: road-to-mission-mode · Phase 0
+type: security
+---
+
+# ADR-097 — Mission recipes vs user recipes — privilege boundary
+
+## Status
+
+**Accepted** · 2026-06-15. Lands Phase 0 of `road-to-mission-mode`.
+Council-flagged risk: a user recipe smuggling a file-edit skill into a
+trusted mission's gated sequence.
+
+## Context
+
+Mission-Mode introduces two artifact classes that compose AC skills:
+
+1. **Mission recipes** — shipped in `src/missions/*`, version-controlled,
+   reviewed, and released as part of the AC package.
+2. **User / cookbook recipes** — authored by consumers in their own
+   `agents/missions/` or via the cookbook pattern; not package-controlled.
+
+Both can invoke `/work` directives and, in principle, reference AC skills
+by name. Without a privilege boundary, a user recipe could inject an
+arbitrary skill (e.g. a file-write or secrets skill) between the gated
+steps of a trusted mission, bypassing the human-gate sequence the mission
+was designed around. This is a privilege-escalation vector analogous to
+a confused-deputy attack.
+
+The `lethal-trifecta-guard` rule (private-data + untrusted-content +
+external-comms) identifies this shape as the canonical high-risk agent
+pattern. A user recipe that can call any skill is a potential trifecta
+assembler.
+
+## Decision
+
+### Trusted missions (`src/missions/*`) — TRUSTED tier
+
+- May invoke any AC skill directly by name in their phase sequence.
+- May read `inputs`, `catalog`, and `verification` fields from their manifest.
+- Shipped, reviewed, and signed off as part of AC's release process.
+- The manifest schema (`src/scripts/schemas/mission.schema.json`) governs
+  their structure; the linter enforces it.
+
+### User / cookbook recipes — SANDBOXED tier
+
+- **May** invoke trusted missions by name (e.g. `/mission:upgrade`).
+- **May** invoke other user recipes.
+- **May NOT** inject arbitrary AC skills between a trusted mission's steps.
+- **May NOT** reference a skill unless that skill's frontmatter declares
+  `user_invokable: true`.
+- The `user_invokable` frontmatter key does not exist yet; it is reserved
+  for the Phase 2 skill-annotation pass. Until Phase 2 ships, user recipes
+  may invoke missions only — no direct skill invocation at all.
+
+### Enforcement surface
+
+| Layer | Mechanism |
+|---|---|
+| **Linter** | `scripts/lint_mission_recipes.py` (Phase 2) checks that recipe files under `agents/missions/` do not reference skills lacking `user_invokable: true` |
+| **Schema** | `mission.schema.json` covers trusted missions; a separate `recipe.schema.json` (Phase 2) will cover user recipes |
+| **Rule** | `lethal-trifecta-guard` remains the runtime defense; the privilege boundary is a pre-execution authoring gate |
+| **Code review** | PRs adding `user_invokable: true` to any skill require the security-sensitive-stop review flow |
+
+## Rationale
+
+A user recipe that can call arbitrary skills can assemble the lethal
+trifecta (read secrets → pass through untrusted web content → write to
+filesystem) without the human-gate sequence a trusted mission provides.
+Sandboxing user recipes to missions-only until `user_invokable` is
+annotated keeps the threat surface minimal during Phase 0 and Phase 1,
+when the execution model is still a validation PoC.
+
+The `user_invokable` annotation approach (rather than a blanket allow/deny
+at the recipe layer) lets the suite grow the safe surface incrementally as
+each skill is audited — consistent with how `allowed_tools` works in skill
+execution blocks.
+
+## Consequences
+
+### Accepted
+
+- User recipes in Phase 0 and Phase 1 are limited to mission invocation
+  only. This is intentional — Phase 1 is a PoC, not a product.
+- Skill authors who want their skill callable from user recipes must
+  explicitly opt in via `user_invokable: true` after security review.
+- The linter gate ships in Phase 2, not Phase 0. Phase 0 is authoring-only;
+  no executable recipes exist yet.
+
+### Trade-offs
+
+- More friction for power users who want to compose skills in recipes.
+  Mitigation: the `user_invokable` path provides an explicit, auditable
+  escape hatch rather than a blanket block.
+- `user_invokable` key adds one more frontmatter field to the skill schema.
+  Cost is low (one boolean); benefit is a machine-checkable privilege
+  boundary.
+
+## Alternatives considered
+
+- **Allow user recipes to invoke any skill.** Rejected — directly creates
+  the privilege-escalation vector this ADR is designed to prevent.
+- **Block user recipes entirely.** Rejected — removes a legitimate power-user
+  use case and makes the sandbox permanent rather than an interim gate.
+- **Runtime enforcement only (lethal-trifecta-guard).** Rejected as
+  insufficient — runtime detection is a safety net, not a substitute for
+  authoring-time prevention, which is AC's stated differentiator.
+
+## References
+
+- `docs/contracts/no-runtime-boundary.md` — the boundary contract missions operate within
+- `src/scripts/schemas/mission.schema.json` — trusted mission manifest schema
+- `.agent-src.uncondensed/rules/lethal-trifecta-guard.md` — runtime defense layer
+- `.agent-src.uncondensed/rules/security-sensitive-stop.md` — review gate for `user_invokable` additions
+- `agents/roadmaps/archive/road-to-mission-mode.md` § Phase 0 — authoring context