@event4u/agent-config 6.1.0 → 7.0.1

package/docs/contracts/ticket-bundle-format.md

@@ -0,0 +1,228 @@
+# Ticket-bundle format
+
+> The contract every downstream artifact reads from: the `emit-tickets` skill,
+> the buildability/manifest linters, and the `implement-ticket` bundle
+> input path. Authoritative for the frontmatter
+> schema, the body doctrine, the tracker mapping, and the self-containedness
+> floor. Locked by [ADR-101](../decisions/ADR-101-ticket-bundle-emission.md).
+
+## 1. Why this exists
+
+A roadmap step is a one-line checkbox; the full build spec is spread across the
+roadmap (what), ADRs (why), and the code (how). A `high`-tier agent holds that
+together; a `lite`-tier agent (Haiku) cannot. A **ticket bundle** is the closed,
+durable, importable artifact that lets an expensive planning agent hand a cheap
+building agent a complete unit of work. Markdown is the source of truth; a
+tracker issue (Linear/Jira) is a copy you make by paste or via MCP — not a
+generated export (§8).
+
+## 2. Layout
+
+A bundle is a directory, one per roadmap, under `agents/tickets/`:
+
+```
+agents/tickets/{roadmap-slug}/
+  manifest.yml                 # machine index: dependency graph
+  T-001-{slug}.md              # one ticket = one Markdown build contract
+  T-001-{slug}.assets/         # durable design context for that ticket
+    before.png  wireframe.png  example-io.md
+  T-002-{slug}.md
+  ...
+agents/tickets/_registry.yml   # machine-generated index of all bundles
+```
+
+- **Separate tree, not co-located** under the roadmap — the flat-file dashboard
+  and archival machinery (`update_roadmap_progress.py`,
+  `archive_completed_roadmaps.py`) assume `agents/roadmaps/*.md` are flat files;
+  a separate tree keeps that untouched (ADR-101 R1).
+- **Discovery** is via the generated `agents/tickets/_registry.yml` — one scan,
+  no recursive glob, no roadmap↔manifest circular dependency.
+- **Lifecycle**: a bundle is durable (unlike transient `agents/roadmap-assets/`);
+  when its roadmap archives, the bundle moves with it to
+  `agents/tickets/archive/{slug}/`.
+
+## 3. Ticket frontmatter (schema: `src/scripts/schemas/ticket.schema.json`)
+
+```yaml
+---
+id: T-001                      # bundle-local id; stable handle for the ticket
+roadmap: road-to-xyz           # back-link (traceability spine)
+phase: 2                       # roadmap phase number
+title: "…"                     # → Linear Title
+status: ready                  # ready | draft | done
+model_tier: lite               # lite | medium | high — WHO may build it (ADR-035)
+estimate: 3                    # story points (from estimate-ticket)
+priority: 2                    # 0–4, Linear-compatible
+labels: [backend, mcp]
+parent: T-000                  # → Linear "Parent issue"; null at phase root
+blocked_by: [T-000]            # dependency edges (must be acyclic)
+adr_refs:                      # the "why", SHA-pinned (drift here HARD-blocks)
+  - { path: docs/decisions/ADR-101-ticket-bundle-emission.md, sha: <git-blob-sha> }
+source_refs:                   # files the build reads/changes, SHA-pinned (drift WARNS)
+  - { path: src/scripts/build_linear_digest.py, sha: <git-blob-sha> }
+assets: [T-001.assets/wireframe.png]   # relative to the bundle dir
+acceptance:                    # runnable AND isolation-testable; no prose-only
+  - "python3 src/scripts/lint_ticket_buildable.py exits 0"
+boundaries:                    # ENFORCED by the work_engine boundary guard
+  must_touch:    [src/scripts/lint_ticket_buildable.py]
+  may_touch:     [Taskfile.yml]
+  must_not_touch: [src/scripts/work_engine/**, ".github/**"]
+---
+```
+
+`status` is `done` only after the work landed + verification passed.
+
+## 4. Ticket body doctrine (the build contract)
+
+A lite ticket is autonomous only with this fixed section order:
+
+| Section | Purpose |
+|---|---|
+| `## Why` | 1–3 lines; the outcome, not backstory |
+| `## Context spine` | exact paths (`file.py:142`), the sibling-to-mirror, the producer of any shape it consumes — so the builder never searches |
+| `## Do` | ordered, mechanical steps |
+| `## Do NOT touch` | hard boundaries (mirrors frontmatter `boundaries`) |
+| `## Acceptance` | points at frontmatter `acceptance` (runnable, isolation-testable) |
+| `## Quality gates` | the concrete commands (not "run CI") |
+| `## Assets` | relative links into `T-NNN.assets/` (UI tickets) |
+
+**Self-containedness rule:** if the builder must read a file that is not in the
+context spine or `source_refs`, the ticket is incomplete.
+
+## 5. Self-containedness floor (per `model_tier`)
+
+Enforced by `lint_ticket_buildable.py`. A ticket FAILS the gate if its tier's
+row is not satisfied:
+
+| tier | acceptance | ≥1 concrete path | non-empty boundaries | resolvable assets | size floor |
+|---|---|---|---|---|---|
+| `lite` | required, runnable + isolation-testable | required | required | required (or `assets: none`) | ≤ 5 files AND ≤ 200 lines, else split or escalate to `medium` |
+| `medium` | required | required | recommended | recommended | — |
+| `high` | required | recommended | — | — | — |
+
+A failing `lite` ticket is rejected or auto-escalated to `medium`.
+
+## 6. Manifest (schema: `src/scripts/schemas/ticket-manifest.schema.json`)
+
+```yaml
+status: ready
+planner_tier: high
+builder_tier: lite
+import_targets: { linear: true, jira: false }
+dependency_graph:              # acyclic (no topological layering in v1)
+  T-001: { status: ready, blocks: [T-002] }
+  T-002: { status: ready, blocks: [] }
+```
+
+The manifest carries no tracker state — there is no API export to keep
+idempotent (§8). The bundle is the source of truth; a tracker issue is created
+by paste or by the agent via MCP, never synced back into the manifest.
+
+## 7. Registry (`agents/tickets/_registry.yml`, machine-generated)
+
+```yaml
+bundles:
+  road-to-ticket-bundles:
+    manifest_path: agents/tickets/road-to-ticket-bundles/manifest.yml
+    source_roadmap: agents/roadmaps/archive/road-to-ticket-bundles.md
+    status: in_progress        # derived from manifest
+```
+
+`update_roadmap_progress.py` reads this one file; never recursive-globs bundles.
+
+## 8. Tracker handoff — paste-ready, or via MCP (no API export)
+
+A ticket goes into Linear/Jira **by copy/paste** or, when programmatic, by the
+**agent using a tracker MCP server**. There is **no bundled API client and no
+automatic export** — the ticket Markdown *is* the handoff artifact.
+
+| Ticket field | Tracker issue |
+|---|---|
+| frontmatter `title` | issue title |
+| the Markdown **body** (everything after the frontmatter) | issue description — paste it; Markdown renders in Linear/Jira |
+| `priority` / `estimate` / `labels` | the matching issue fields (set during paste / by MCP) |
+| `parent` (phase root) | parent issue, when the tracker supports sub-issues |
+
+- **Copy/paste (default):** the ticket body is clean, render-ready Markdown.
+  Paste it into a new Linear/Jira issue; set title from `title`. Asset images
+  are relative repo paths — attach them in the tracker, or (public repo) paste a
+  `raw.githubusercontent.com` URL.
+- **MCP (programmatic):** to create issues without pasting, the agent calls the
+  Linear/Jira **MCP server** with the ticket as input. The package ships **no**
+  API wiring of its own — MCP is the integration surface.
+- **One direction only:** the bundle is the source of truth; a tracker issue is
+  a copy, never read back into the bundle (no sync, no `linear_state`).
+
+## 9. Traceability spine (bidirectional)
+
+`roadmap ↔ ticket ↔ ADR ↔ PR`. Each ticket frontmatter names its `roadmap` +
+`adr_refs`; each materialized roadmap step carries an inline
+`<!-- ticket: T-NNN -->` marker. The `work_engine` ticket envelope
+(`{id, title, body, acceptance_criteria}`) is a strict subset of this
+frontmatter, so `/implement-ticket` consumes a bundle with no schema fork.
+
+## 10. Staleness — split severity
+
+`lint_ticket_stale` recomputes the pinned SHAs:
+
+- **`adr_refs` drift → HARD block** (`not build-ready`); ADRs are semantic
+  decisions, rarely change → resolution = re-emit the bundle.
+- **`source_refs` drift → WARN only**; source files churn constantly, so a hard
+  block would keep most tickets perma-stale and multiply bundles. The builder
+  proceeds on a warning.
+
+## 11. Assets — durable, size-capped (LFS deferred)
+
+Git LFS is **not** configured in this repo today, and wiring it (install +
+remote LFS store) is heavier than v1 needs. v1 decision: assets are git-tracked
+binaries under a **size cap** — ≤ 500 KB per asset — and authors prefer vector /
+text context (Mermaid, ASCII, SVG, example-I/O Markdown) over raster where it
+carries the same information. `lint_ticket_buildable.py` warns on any asset over
+the cap. LFS is revisited only if `agents/tickets/**` binary weight is proven a
+real problem (same "defer until observed" discipline as the mutable-tickets
+mode). Non-binary design context lives as plain Markdown in the `.assets/` folder.
+
+## 12. Kill-switch & rollback
+
+Two reversal surfaces, since a bundle is git-tracked and the tracker is a
+projection:
+
+- **Per-ticket.** A ticket is reverted by `git`-restoring its `T-NNN-*.md`
+  (and `.assets/`) to a prior commit. A `lite` build gone wrong is bounded by
+  the ticket's `boundaries` (the work_engine boundary guard halts out-of-scope
+  edits before commit) — so the blast radius is the ticket's `must_touch` set.
+- **Per-bundle.** To abandon a bundle entirely, `git mv` it to
+  `agents/tickets/archive/{slug}/` (it moves with its roadmap on archival,
+  §2) — never delete in place, so the audit trail survives.
+
+A tracker issue created by paste/MCP from a ticket is a one-way copy (§8); the
+bundle is the source of truth, so reverting the bundle needs no tracker
+coordination — fix the issue in the tracker by hand if it was already created.
+
+## 13. Status projection — one direction only
+
+Three surfaces show a ticket's progress; exactly one is the truth and the other
+two are derived. The writeback is **single-directional** so they never become
+rival truths:
+
+```
+ticket `status` (MD)  ──►  roadmap checkbox  ──►  agents/roadmaps-progress.md (dashboard)
+```
+
+- The ticket file's `status` (`ready` / `draft` / `done`) is the **truth**.
+- When a ticket flips to `done`, its roadmap step's `<!-- ticket: T-NNN -->`
+  checkbox flips `[x]` in the **same edit**, and the dashboard regenerates
+  (`./agent-config roadmap:progress`) — the existing `roadmap-progress-sync`
+  cadence, unchanged.
+- A tracker issue (created by paste/MCP, §8) is a point-in-time copy; its state
+  is **not** read back into the ticket. If you keep a tracker issue in sync, do
+  it from the ticket outward (re-paste / MCP update), never the reverse.
+
+Never wire the reverse (tracker → ticket): that recreates the two-drifting-truths
+failure the whole format avoids.
+
+## See also
+
+- [ADR-101](../decisions/ADR-101-ticket-bundle-emission.md) — the format commitment + council convergence.
+- [`roadmaps.md`](../../src/agent-src/templates/roadmaps.md) — the sibling planning artifact.
+- [ADR-035](../decisions/ADR-035-model-capability-tiers.md) — the `model_tier` bands.

package/docs/cookbook.md

@@ -0,0 +1,152 @@
+# Cookbook — things you can do in a minute
+
+> **Generated** by `scripts/generate_cookbook.py` from `src/flows/cookbook.yaml` + `src/flows/<flow>.yaml` — do NOT hand-edit.
+> Every command and skill below is validated to exist at generation time; a recipe naming a missing command fails the build.
+
+Each recipe is a short command sequence. Run the commands in order; the listed skills are the capabilities they compose.
+
+## Named recipes
+
+### Review a change before it ships
+
+*You have a diff and want a real review, not a rubber-stamp.*
+
+- **Commands:** `/review-changes` → `/judge` → `/quality-fix`
+- **Skills:** `code-review`, `adversarial-review`
+
+### Fix a red CI run
+
+*CI is failing and you want the failure pinpointed and fixed.*
+
+- **Commands:** `/fix:ci`
+- **Skills:** `systematic-debugging`
+
+### Build a feature from a ticket
+
+*You have a ticket and want it refined, estimated, and implemented.*
+
+- **Commands:** `/refine-ticket` → `/estimate-ticket` → `/implement-ticket`
+- **Skills:** `feature-planning`, `test-driven-development`
+
+### Plan a feature before writing code
+
+*The ask is fuzzy and you want a bounded plan first.*
+
+- **Commands:** `/feature:explore` → `/feature:plan`
+- **Skills:** `feature-planning`, `complexity-first-planning`
+
+### Security-audit a surface
+
+*You touched auth / billing / tenancy and want abuse cases first.*
+
+- **Commands:** `/threat-model` → `/judge:solo`
+- **Skills:** `threat-modeling`, `security-audit`
+
+### Open a pull request
+
+*The work is done and you want a clean PR ready for review.*
+
+- **Commands:** `/prepare-for-review` → `/pr:create`
+- **Skills:** `requesting-code-review`, `conventional-commits-writing`
+
+### Research a topic deeply
+
+*You need a multi-source, fact-checked report, not a guess.*
+
+- **Commands:** `/research:deep` → `/research:report`
+- **Skills:** `deep-reading-analyst`
+
+### Investigate and fix a bug
+
+*Something is broken and you want root cause before the patch.*
+
+- **Commands:** `/bug-investigate` → `/bug-fix`
+- **Skills:** `systematic-debugging`, `bug-analyzer`
+
+### Get a second opinion from the AI council
+
+*A design call is genuinely contested and you want independent models.*
+
+- **Commands:** `/council:design` → `/council:debate`
+- **Skills:** `ai-council`
+
+### Process a roadmap autonomously
+
+*You have a roadmap and want it worked end-to-end.*
+
+- **Commands:** `/roadmap:create` → `/roadmap:process-full`
+- **Skills:** `roadmap-management`
+
+### Refactor with a safety net
+
+*You want to restructure code without changing behaviour.*
+
+- **Commands:** `/feature:refactor` → `/review-changes` → `/judge`
+- **Skills:** `code-refactoring`, `test-driven-development`
+
+### Commit in logical chunks
+
+*You have a messy working tree and want clean, scoped commits.*
+
+- **Commands:** `/commit:in-chunks`
+- **Skills:** `conventional-commits-writing`
+
+### Analyze an unfamiliar project
+
+*You just opened a repo and want a fast structural read.*
+
+- **Commands:** `/project-analyze` → `/project-health`
+- **Skills:** `project-analyzer`
+
+### Estimate a ticket
+
+*You need a defensible estimate with the reasoning shown.*
+
+- **Commands:** `/estimate-ticket`
+- **Skills:** `estimate-ticket`
+
+### Run a blame-free post-mortem that teaches the next change
+
+*An incident, near-miss, or risky plan needs analysis that closes the learning loop.*
+
+- **Commands:** `/analyze`
+- **Skills:** `blameless-post-mortem`, `root-cause-frameworks`
+
+### Upgrade a Laravel app one major version
+
+*You want a gated, catalog-driven Laravel major-version upgrade (10→11) on a provisional branch — never auto-PR.*
+
+- **Commands:** `/mission:upgrade`
+- **Skills:** `dependency-upgrade`
+
+## The four work flows
+
+Broader than a single recipe — the end-to-end shapes most work follows.
+
+### Discovery flow
+
+Explore, plan, estimate, refine, and investigate before building. The "what should we build and how" front of the developer journey.
+
+- **Path:** `/feature:explore` → `/feature:plan` → `/estimate-ticket` → `/refine-ticket`
+- **Skills:** `feature-planning`, `estimate-ticket`, `refine-ticket`, `project-analysis-core`, `validate-feature-fit`
+
+### Implementation flow
+
+Build it. The core "make the change" front — drive a prompt, ticket, or feature end-to-end through plan → implement → verify.
+
+- **Path:** `/work` → `/review-changes` → `/quality-fix` → `/commit`
+- **Skills:** `test-driven-development`, `code-review`, `systematic-debugging`, `git-workflow`
+
+### Review flow
+
+Check it. Self-review, judge, quality-fix, and threat-model a change before it ships.
+
+- **Path:** `/review-changes` → `/judge` → `/quality-fix` → `/threat-model`
+- **Skills:** `code-review`, `adversarial-review`, `quality-tools`, `threat-modeling`, `receiving-code-review`
+
+### Delivery flow
+
+Ship it. Commit in logical chunks, open the PR, answer review comments, and prepare the branch for review.
+
+- **Path:** `/commit` → `/pr:create` → `/fix:pr-comments`
+- **Skills:** `conventional-commits-writing`, `git-workflow`, `requesting-code-review`

package/docs/customization.md

@@ -190,6 +190,9 @@ is recovered on the next server boot.
 | `ai_council.cost_budget.max_total_usd` | `0.0` | Per-invocation USD ceiling. `0` disables (token caps still apply). |
 | `ai_council.cost_budget.daily_limit_usd` | `0.0` | Rolling 24h USD ceiling across all `/council` calls. `0` disables. Ledger lives at `~/.event4u/agent-config/council-spend.jsonl` (mode 0600). |
 | `ai_council.session_retention_days` | `14` | Auto-prune for `agents/runtime/council/sessions/` audit folders. Older session directories are removed on the next `save()`. `0` disables (keep forever). |
+| `reasoning.enabled` | `true` | Master switch for the Reasoning Discipline Protocol (RDP). `false` = the whole layer is inert (zero overhead). See [`docs/contracts/reasoning-discipline-protocol.md`](contracts/reasoning-discipline-protocol.md). |
+| `reasoning.auto_gate` | `true` | Benefit-gates RDP on table-free signals (task signal + host self-assessment) so it engages only where it pays. `false` = gate on task-signal + toggles only (skip the host self-assessment). |
+| `reasoning.components.<name>` | `true` | Per-component switches — `orchestrator`, `notes_first`, `grounding`, `intent`, `complexity_first`, `verifier_default`, `prediction_tracking`, `decision_ledger`, `uncertainty_budget`. Each fires only when `reasoning.enabled` **and** the `auto_gate` test passes. |
 
 > **Experimental.** AI Council is not yet validated by external users. API costs apply per consultation.
 
@@ -200,6 +203,14 @@ vars. Pre-2.4 installs at `~/.config/agent-config/<provider>.key` are still
 honoured by the loaders as a fallback. The `/council` command refuses to run
 if the key file's permissions drift.
 
+The `reasoning.*` group controls the **Reasoning Discipline Protocol (RDP)** —
+a cost-gated layer that transplants the *operating discipline* of a frontier
+reasoning model onto any host model (it transfers discipline, never capability).
+For what it does, when it engages, and how to switch it off, see the user-facing
+contract [`docs/contracts/reasoning-discipline-protocol.md`](contracts/reasoning-discipline-protocol.md);
+the sourced rationale lives in the design dossier
+[`docs/guidelines/agent-infra/frontier-reasoning-operating-profile.md`](guidelines/agent-infra/frontier-reasoning-operating-profile.md).
+
 ### Cost profiles
 
 > **Four "cost" concepts — don't confuse them.** Several settings sound like
@@ -554,7 +565,7 @@ Run the probe to confirm:
 
 ```bash
 task probe:skills
-# or directly: python3 scripts/probe_skill_registration.py
+# or directly: ./scripts-run src/scripts/probe_skill_registration
 ```
 
 The probe lists every registration across all six tools and flags

package/docs/decisions/ADR-013-discovery-frontmatter-contract.md

@@ -125,6 +125,8 @@ Amendments to the workspace list require an ADR-013 amendment.
 | `meta` | Artefacts that maintain *this* package (`agent-config` itself). |
 | `git` | Git workflow — commit, pull requests, branch sync. Carries `slug_prefix: git` (ADR-044 §A3); `requires: engineering-base`. Added 2026-06-04 for 6.0.0-D Step 12 Class B1 (`commit`→`git-commit`, `create-pr`→`git-pr-create`). |
 | `frontend-design` | Grounded design intelligence — design-knowledge corpus + BM25 grounding engine, design tokens, stack best-practice and chart/typography knowledge. `requires: engineering-base`; `suggests: react, nextjs`. Added 2026-06-07 (ADR-061). |
+| `analysis-workbench` | RCA, post-mortem, premortem, decision-review as an integrated learning loop. `requires: engineering-base`; opt-in under the `engineering` workspace. Added 2026-06-15 (ADR-096). |
+| `brand` | Brand as a first-class UX layer — archetype/voice/identity grounding corpus, brand→token derivation, and consistency governance that constrains UI. `requires: frontend-design`; `suggests: ai-image`; opt-in under the `engineering` workspace. Added 2026-06-16 (road-to-image-brand-typography Phase B). |
 
 Amendments to the pack list require an ADR-013 amendment and the
 matching `src/config/discovery/packs.yml` row in the same PR.
@@ -279,6 +281,20 @@ openai/gpt-4o, converged A2: opt-in pack over inflating `engineering-base`
 with ~1 MB of design data). Additive, no rename; non-overlap with
 cost-profile and `profile.id` reservations holds.
 
+### 2026-06-16 — New `brand` pack
+
+Added pack id `brand` to the closed vocabulary (brand as a first-class UX layer
+— archetype/voice/identity grounding corpus, brand→token derivation, and
+consistency governance that constrains UI). Mirrored in
+[`src/config/discovery/packs.yml`](../../src/config/discovery/packs.yml) and the
+`ADR_PACKS` frozenset in
+[`scripts/lint_discovery_vocabulary.py`](../../src/scripts/lint_discovery_vocabulary.py).
+`workspaces: [engineering]`, `requires: [frontend-design]`, `suggests:
+[ai-image]` (pack-brand exports tokens, pack-ai-image consumes them — B → A),
+`trust_level_default: professional`, `size_class: medium`. Council-resolved
+2026-06-13 (road-to-image-brand-typography Phase B). Additive, no rename;
+non-overlap with cost-profile and `profile.id` reservations holds.
+
 ## Cross-references
 
 - [ADR-007 — Agent Discovery Scopes](ADR-007-agent-discovery-scopes.md):

package/docs/decisions/ADR-056-unvalidated-video-adapters-disposition.md

@@ -119,6 +119,6 @@ No adapter is removed without explicit maintainer sign-off in this ADR
 ## References
 
 - `road-to-video-foundation-validation.md` (Phase 4) — the step this ADR closes.
-- `src/scripts/ai-video/lib/adapter-contract.md` (v2) — the trust-boundary helpers a validated adapter must use.
+- `src/scripts/media/lib/adapter-contract.md` (v2) — the trust-boundary helpers a validated adapter must use.
 - `provider-lifecycle-discipline` rule — the `experimental → stable` promotion gate.
 - AI council convergence (claude-sonnet-4-5 + gpt-4o, 2026-06-06): validation-first; multiplexer pivot supersedes per-model adapters.

package/docs/decisions/ADR-059-render-resume-filesystem-as-state.md

@@ -154,7 +154,7 @@ the "skill suite, not a runtime framework" answer.
 - Council artefact: two-round debate 2026-06-07 (members above), design
   mode, peer review on — convergence summarized in this ADR per
   `no-roadmap-references` (no session-file links).
-- `src/scripts/ai-video/lib/adapter-contract.md` — v2 trust boundary +
+- `src/scripts/media/lib/adapter-contract.md` — v2 trust boundary +
   error contract this design builds on.
 - Roadmap: road-to-video-deferred-design, Phase 1 (transient layer —
   not path-linked per `no-roadmap-references`).

package/docs/decisions/ADR-060-comfyui-sandbox-model.md

@@ -148,7 +148,7 @@ internet" out of the execution path.
   mode, peer review on — convergence summarized inline per
   `no-roadmap-references`.
 - ADR-059 — sibling design (resume) from the same roadmap phase.
-- `src/scripts/ai-video/lib/adapter-contract.md` — v2 contract the
+- `src/scripts/media/lib/adapter-contract.md` — v2 contract the
   adapter implements; local-source rule lands there as an additive note.
 - Roadmap: road-to-video-deferred-design, Phase 2 (transient layer —
   not path-linked per `no-roadmap-references`).

package/docs/decisions/ADR-061-corpus-grounding-layer.md

@@ -119,7 +119,7 @@ Recorded in `src/skills/design-intelligence/ATTRIBUTION.md`.
 | Fork | Resolution |
 |---|---|
 | Pack placement | **New `frontend-design` pack** (ADR-013 amendment, same PR). `requires: [engineering-base]`, `suggests: [react, nextjs]` — corpus is stack-agnostic data, React never required. Keeps ~1 MB of design data out of `engineering-base`. |
-| `google-fonts.csv` (745 KB, 1923 rows) | **Skip.** Redundant with the public Google Fonts API; `typography.csv` (73 curated pairings) carries the pairing decision. Document the API fallback for fonts outside the curated set. |
+| `google-fonts.csv` (745 KB, 1923 rows) | **Skip.** Redundant with the public Google Fonts API; `font-pairings-reference.csv` (73 curated pairings) carries the pairing decision. Document the API fallback for fonts outside the curated set. |
 | Stack-corpus surfacing | **`--stack <name>` search domain** on the one grounding engine — single mechanism, no 16-way prose-staleness vector. |
 | Brand→token pipeline | **Defer** with a watch note pinning the upstream commit SHA; adopt on first consumer demand. |
 
@@ -168,3 +168,50 @@ Recorded in `src/skills/design-intelligence/ATTRIBUTION.md`.
   Gemini-suite watch note.
 - Upstream: `nextlevelbuilder/ui-ux-pro-max-skill` @
   `b7e3af80f6e331f6fb456667b82b12cade7c9d35` (last checked 2026-06-07).
+
+## Amendment — 2026-06-16 (§8/§9 superseded in part)
+
+The image/brand/typography work re-examined the gated and deferred items of
+§8/§9 on the merits for the product vision. A two-round merits council
+(anthropic/claude-sonnet-4-5 + openai/gpt-4o, 2026-06-13, design lens,
+web-research-grounded) overturned three of them. The four-operation routing
+(§1) and the no-forked-engine principle (§2) are unchanged — the brand corpus
+is a second instance of the same grounding engine.
+
+- **§8 brand→token defer — resolved, no longer deferred.** This work was the
+  "first consumer demand" §8 named. `brand-to-tokens` ships: brand decisions →
+  a DTCG `.tokens.json` source of truth → `design-tokens/scripts/tokens.py`
+  (no Node). The same `.tokens.json` is the export pack-ai-image's brand-asset
+  generation and the greenfield-scaffold seed consume.
+- **§8 font fork — superseded.** "Skip `google-fonts.csv`, rely on the live
+  Google Fonts API" is replaced by **adopt-lite pinned metadata**: pin the MIT
+  `google-font-metadata` mirror (or a slim top-N slice) as a deterministic
+  offline **Reference**; the live API needs a key, is nondeterministic, and
+  carries no pairing metadata. `font-pairings-reference.csv` stays the curated
+  pairing Reference with a freshness contract.
+- **§9 brand-asset generation — superseded, ADOPTED.** The Gemini generative
+  brand-asset suite (logo/CIP/banner/social) was gated as a possible second
+  image-gen stack. The merits pass established it never was one: generation is
+  structured prompting + brand-token injection + provider routing on the
+  **existing** adapters (now the neutral `scripts/media/` substrate), with a
+  `recraft`/LLM-SVG vector path for marks raster models can't emit. Generation
+  lives in **pack-ai-image**; brand governance/tokens stay in **pack-brand**,
+  which exports tokens pack-ai-image consumes (dependency B → A, never
+  inverted). The `domain-watch/generative-brand-assets.md` gate is cleared.
+- **§9 slide/presentation engine — confirmed out of scope, but reasoned.**
+  Document assembly ≠ brand UX; owning a render engine (reveal.js / Presenton /
+  Gamma) is scope creep. pack-brand instead **exports validated brand
+  templates** (Marp/reveal YAML with locked brand variables) for the user's own
+  deck tools — enforcement via the template, not engine ownership. Re-open only
+  on evidenced demand.
+
+The brand corpus deviates from the §8-implied "adopt the SHA-pinned claudekit
+brand sub-skills" framing: it is **original-authored** from public brand
+frameworks (Jung / Mark-Pearson archetypes, public messaging frameworks),
+`upstream: null` — honest provenance, no third-party SHA to pin, no §4b file
+marking. The shared grounding engine is still attributed via
+`design-intelligence/ATTRIBUTION.md`.
+
+Implementing roadmap: `road-to-image-brand-typography` (Phase A–D),
+archived 2026-06-16; live-validation + command-surface follow-on tracked in
+its sibling follow-up roadmap.

package/docs/decisions/ADR-096-analysis-workbench.md

@@ -0,0 +1,110 @@
+---
+adr: 096
+status: accepted
+date: 2026-06-15
+decision: analysis-workbench
+supersedes: —
+superseded_by: —
+phase: road-to-analysis-workbench · Phase 0
+type: structural
+---
+
+# ADR-096 — Analysis Workbench design decisions
+
+## Status
+
+**Accepted** · 2026-06-15. Lands Phase 0 of
+[`road-to-analysis-workbench`](../../agents/roadmaps/archive/road-to-analysis-workbench.md).
+Routed through AI council (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
+two rounds, 2026-06-15).
+
+## Context
+
+A new `analysis-workbench` pack was proposed to close the post-incident
+learning loop: structured post-mortem → root-cause analysis → corrective-action
+design → memory candidates → human-gated promote. Several design questions
+required council input before authoring any skill.
+
+## Decision
+
+### D1 — Collapse the skill set
+
+Council converged on four skills for v1:
+
+| Skill | Purpose |
+|---|---|
+| `blameless-post-mortem` | Structured post-incident review |
+| `root-cause-frameworks` | RCA engine (5-whys, fishbone, fault-tree, STAMP) |
+| `premortem` | Pre-launch risk elicitation |
+| `decision-review` | Retrospective decision quality |
+
+`incident-pattern-analysis` is **deferred** — it needs cross-project data the
+memory layer does not yet support reliably.
+
+### D2 — Internal-skill-heavy, not command-heavy
+
+The pack surfaces ≤ 5 visible commands (all opt-in). Complex orchestration
+lives inside skill bodies, not in a command DSL or state-machine orchestrator
+(deferred).
+
+### D3 — `/analyze` as confidence-weighted suggester, not auto-triage
+
+`/analyze` proposes candidate flows with confidence weights. The user picks.
+It does NOT auto-triage or auto-route. Selection choices are logged to the
+provisional intake stream so future iterations can tune weights from real usage.
+
+### D4 — Memory loop is manual; promote gate is inviolable
+
+The hardest pushback in both council rounds was against any auto-promote path.
+Decision: the loop produces and proposes; `scripts/check_memory_proposal.py`
+is the sole admission gate (≥2 distinct paths OR ≥3 future decisions);
+the human runs `/memory promote`. No skill, hook, or roadmap step may
+bypass this gate. See [`analysis-memory-loop.md`](../contracts/analysis-memory-loop.md).
+
+### D5 — AI-specific RCA deferred
+
+AI-specific failure modes (prompt injection, model hallucination root-cause,
+latency regression attribution) require `road-to-security-hardening` primitives
+that do not yet exist. Deferred explicitly; `root-cause-frameworks` ships
+without them.
+
+### N1 — Time-decay is a Phase 1 hardening item (adopted)
+
+Council named time-decay, supersession, and dedup pre-check as Phase 1 work
+(not blockers for Phase 0 contract authoring). The contract captures the
+schema now so Phase 1 has a stable target:
+
+- `last_validated` + `review_after_days` + `applicable_scope` on every candidate.
+- `retrieve()` returns `{results, skipped}` — stale entries are in `skipped`,
+  never silently included in `results`.
+- Dedup: `retrieve()` before draft; on match, propose `frequency`/`supersedes`
+  update, not a new entry.
+
+## Consequences
+
+- Phase 0 ships two authoring artifacts: `docs/contracts/analysis-memory-loop.md`
+  and this ADR. No skills, no code.
+- Phase 1 (memory-loop hardening) implements the schema fields and `retrieve()`
+  contract documented in `analysis-memory-loop.md` § 1 and § 4.
+- The pack uses pack identifier `analysis-workbench`, `size_class: medium`,
+  `cross_workspace: true`.
+- Domain adoption gates do not fire: the analysis domain is already open
+  (`incident-commander`, `risk-officer`, `decision-record`,
+  `systematic-debugging` exist in the suite).
+
+## Alternatives
+
+- **Auto-promote on ≥ 2 occurrences** — rejected both rounds. Silent learning
+  loop is a trust and auditability risk; human gate is non-negotiable.
+- **State-machine orchestrator** — deferred. Premature before skills ship and
+  real usage patterns emerge.
+- **`incident-pattern-analysis` in v1** — rejected. Needs cross-project memory
+  access not available in v1; deferred to a follow-up roadmap.
+- **Flat command surface (>5 commands)** — rejected per command-surface-tiers
+  contract; opt-in pack stays lean.
+
+## References
+
+- [`docs/contracts/analysis-memory-loop.md`](../contracts/analysis-memory-loop.md) — the loop contract.
+- [`docs/contracts/low-impact-corpus-format.md`](../contracts/low-impact-corpus-format.md) — curated memory schema.
+- [`ADR-094`](ADR-094-agent-memory-layer-removal.md) — agent memory layer decision this pack operates within.