@event4u/agent-config 7.0.1 → 7.1.0

package/dist/agent-src/skills/recursive-verification/SKILL.md

@@ -0,0 +1,186 @@
+---
+model_tier: inherit
+name: recursive-verification
+description: "Use to run a depth-bounded self-correction loop (attempt → critic verdict → re-attempt) as a tunable test-time compute knob — a do-and-judge specialisation, default off, capability-gated."
+domain: process
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+---
+
+# recursive-verification
+
+## When to use
+
+* A first attempt at a bounded task may be improvable by feeding the
+  attempt plus an explicit critic verdict back into a corrective
+  re-attempt — and the extra compute is justified by the task's value.
+* You want **depth** (number of correction rounds) to be an explicit
+  compute knob, not an open-ended loop.
+* The shipped default (`verification.recursive`) is not `off` for the
+  active host, or the user asks for an extra self-correction pass.
+
+Do NOT use when:
+
+* The task is trivial — a one-liner, a rename, a format fix. The loop's
+  cost dwarfs any gain (the package's A/B bench measured ~11× tokens for
+  a single wrapper pass; recursion multiplies that per depth level).
+* The host already one-shots the task. On a strong host with no headroom
+  a second pass only adds cost (see `docs/benchmark.md`: strong-host
+  discipline lift is null).
+* You are chasing **model intelligence**. This transfers a test-time
+  *compute* pattern, not capability — it cannot make a model smarter than
+  its weights, and it implies **no** comparison to any frontier model.
+* Budget is the constraint, or `verification.recursive: off` for this host.
+
+## Goal
+
+Land a verified result by running a depth-bounded
+`attempt → critic verdict → conditional re-attempt` loop, with depth as
+the only compute knob, every level budgeted, and the loop default-off
+until a benchmark gate authorises it per host.
+
+## The Iron Law
+
+```
+A CROSS-MODEL CRITIC NEVER RUNS ON THE SAME MODEL + CONTEXT AS THE ATTEMPT.
+SAME-MODEL SELF-CRITIQUE IS A DISCIPLINE PASS ONLY — NEVER A CAPABILITY CLAIM.
+```
+
+Inherited from [`subagent-orchestration`](../subagent-orchestration/SKILL.md):
+same model + same context = same blind spots. A same-model self-critique
+at depth 1 is allowed **only** when explicitly flagged as a *discipline*
+(not capability) pass — it can catch a skipped step or a scope-creep, but
+it shares the attempt's blind spots and must never be sold as a capability
+lift. Cross-model recursion (a different vendor as critic) is the
+cross-vendor variant and obeys the Iron Law by construction
+(critic model ≠ attempt model).
+
+## The loop
+
+```
+attempt₀
+  → critic verdict (accept | revise: <reason>)
+    → accept            → done
+    → revise            → attempt₁ (reads attempt₀ + the verdict as context)
+      → critic verdict
+        → … → depthₙ
+```
+
+Each level reads **only** the prior attempt plus the critic's verdict —
+never the full history — mirroring the read-your-own-output-and-decide
+pattern. Depth `n` is the tunable compute knob, hard-capped by
+`verification.max_depth`.
+
+## Deterministic stop conditions
+
+The loop stops at the first of:
+
+1. **`accept`** — the critic accepts the attempt.
+2. **`max_depth` reached** — `verification.max_depth` (default `1`).
+3. **`verify-budget` exhausted** — each re-attempt is one budgeted unit
+   per [`verify-budget`](../../contexts/execution/verify-budget.md); a
+   required-but-unrun verification is a surfaced safety gap, never a
+   silent pass.
+4. **No-progress floor** — two consecutive attempts score identical on
+   the deterministic scorer; further depth cannot help, so stop.
+
+Stop conditions are deterministic so the loop can never run unbounded —
+there is no open-ended "keep trying" branch.
+
+## Settings
+
+Configured in `.agent-settings.yml`; documented in
+[`agent-settings`](../../templates/agent-settings.md):
+
+| Key | Default | Effect |
+|---|---|---|
+| `verification.recursive` | `off` | `off` = inert; `ask` = ask once before looping; `on` = loop silently up to `max_depth`. |
+| `verification.max_depth` | `1` | Hard cap on correction rounds. `1` = a single critic pass (effectively inert beyond one review) until a benchmark gate authorises more. |
+
+Ships `off`. The per-host shipped default flips only on a passing
+capability-axis benchmark cell (see Procedure step 4); an honest-null
+keeps it `off`.
+
+## Procedure
+
+### 1. Gate on settings + task shape
+
+Resolve `verification.recursive` for the active host. `off` → no-op.
+Confirm the task is non-trivial (above the `verify-budget` change-size
+floor) and that the host plausibly has headroom — skip otherwise.
+
+### 2. Resolve the critic
+
+Read `.agent-settings.yml` (`subagents.judge_model`). A cross-model
+critic must satisfy the Iron Law. A same-model depth-1 pass is allowed
+only when explicitly flagged as a discipline pass; surface that framing.
+
+### 3. Run the loop
+
+Run `attempt → verdict → conditional re-attempt`, counting each
+re-attempt against `verify-budget`, until a deterministic stop condition
+fires. Under `verification.recursive: on` surface depth + spend in one
+line; under `ask`, ask once before the first re-attempt.
+
+### 4. Honour the benchmark gate
+
+The shipped default is set by the `bench:ab` gate
+([`orchestration-benchmark-gate`](../../contexts/execution/orchestration-benchmark-gate.md),
+`gateVerdict` / `resolveShippedDefault`): `on`/`ask` only on a host whose
+**capability-axis** cell passed; `off` otherwise. A discipline-only lift
+does not authorise a flip — that question is already answered by the
+existing rules. Never flip a default without its own passing cell.
+
+### 5. Report
+
+Follow the output format. Never present a recursion result as a
+capability gain or a frontier-model comparison.
+
+## Gotcha
+
+* **Recursion as discipline duplicate** — if the only lift is on the
+  discipline axis, recursion duplicates rules the package already ships,
+  at multiplied cost. Surface it; do not ship a redundant expensive loop.
+* **Unbounded loop** — there is no open-ended branch; the four stop
+  conditions are deterministic and the depth cap is hard.
+* **Same-model self-praise** — a same-model critic shares the attempt's
+  blind spots and tends to accept; treat depth-1 same-model passes as a
+  discipline check only, never as independent verification.
+* **Cost surprise** — depth multiplies the per-pass token cost; confirm
+  budget before raising `max_depth` above 1.
+* **Strong-host no-op** — on a host that one-shots the task, every extra
+  depth level is pure cost; the benchmark gate keeps the default `off`
+  there.
+
+## Output format
+
+1. **Depth reached** — the number of correction rounds run, and which
+   stop condition fired (`accept` / `max_depth` / `budget` / `no-progress`).
+2. **Critic pairing** — attempt model / critic model (resolved), and
+   whether it was a cross-model or same-model discipline pass.
+3. **Verdict** — accepted attempt vs. handed back, with the budget spent.
+4. **Evidence** — per-depth scorer/verdict trail, never framed as a
+   capability or frontier-model comparison.
+
+## Do NOT
+
+* NEVER claim recursion makes the host model more capable or "closer to"
+  any frontier model — it is a test-time compute pattern, not intelligence.
+* NEVER run an open-ended loop — `max_depth` and the stop conditions are
+  hard caps.
+* NEVER treat a same-model self-critique as independent verification.
+* NEVER flip the shipped default without a passing capability-axis gate
+  cell for that host.
+* NEVER skip a required verification silently — surface it as a safety gap.
+
+## Handover
+
+| Task | Skill / context |
+|---|---|
+| Mode selection, the judge Iron Law | [`subagent-orchestration`](../subagent-orchestration/SKILL.md) |
+| Per-pass cost budgeting | [`verify-budget`](../../contexts/execution/verify-budget.md) |
+| Shipped-default gate mechanism | [`orchestration-benchmark-gate`](../../contexts/execution/orchestration-benchmark-gate.md) |
+| Cross-vendor critic (different vendor) | [`ai-council`](../ai-council/SKILL.md) |
+| Completion evidence | [`verify-completion-evidence`](../verify-completion-evidence/SKILL.md) |

package/dist/agent-src/skills/roadmap-management/SKILL.md

@@ -43,6 +43,23 @@ rule. Batching multiple edits in one response is fine — one final
 regeneration before replying is enough. But the response must not end
 without it.
 
+### Archival — preferred sweep, untracked-safe manual fallback
+
+Robust path: `archive_completed_roadmaps --all` — detects complete
+(`count_open == 0`, `count_deferred == 0`), moves to `agents/roadmaps/archive/`
+(`git mv` tracked, plain `mv` untracked / no-commit), rewrites inbound refs,
+regens dashboard. PR-independent.
+
+**Manual fallback (script not vendored)** — same response, never leave a
+100 %-complete roadmap active because `git mv` failed:
+
+1. `mkdir -p agents/roadmaps/archive`.
+2. `git mv agents/roadmaps/<x>.md agents/roadmaps/archive/<x>.md` (tracked); plain
+   `mv` if untracked / no commits.
+3. Rewrite inbound `agents/roadmaps/<x>.md` → `agents/roadmaps/archive/<x>.md`
+   across the tree (working tree, not just index, when untracked).
+4. Regenerate `agents/roadmaps-progress.md`.
+
 ## Procedure: Manage a roadmap
 
 1. **Identify need** — Is this a multi-step change that spans sessions or agents?

package/dist/agent-src/skills/subagent-orchestration/SKILL.md

@@ -56,6 +56,20 @@ parallel subagents **by default** and keep working while they run (async), rathe
 than blocking on each return — intervene only if one goes off track. Engage per
 [`rdp-gate`](../../contexts/execution/rdp-gate.md).
 
+### Settings-gated auto-dispatch
+
+"By default" is governed by `.agent-settings.yml`, not unconditional. Before
+auto-dispatch, run the activation gate
+([`auto-orchestration-activation`](../../contexts/execution/auto-orchestration-activation.md)):
+dispatch only when `subagents.enabled` **and** `subagents.auto != off` **and**
+the [`host-capability-manifest`](../../contexts/execution/host-capability-manifest.md)
+reports `subagent_spawn: true` **and** the task is classified delegable
+([`auto-dispatch-classification`](../../contexts/execution/auto-dispatch-classification.md)).
+`auto: ask` → ask once (per [`user-interaction`](../../rules/user-interaction.md));
+`auto: on` → surface chosen mode + per-subtask tiers in one line. Any gate fails
+→ in-session. Auto-dispatch is the default where host + settings allow, a clean
+no-op elsewhere — never lifts a safety floor.
+
 ## The seven modes
 
 Each mode has a decision row: when to use, when not, and the expected

package/dist/agent-src/templates/agent-settings.md

@@ -59,6 +59,20 @@ made by the user directly or by the agent on request, following the
 # custom   = ignore profile — every matrix value must be set explicitly.
 rule_loading_tier: balanced
 
+# --- Per-skill model auto-switch (ADR-035) ---
+# Skills declare a vendor-neutral `model_tier` (lite|medium|high); the generator
+# maps it to a native Claude model (high→opus, medium→sonnet, lite→haiku).
+#   suggest = (default) never emit a native Claude `model:` key; the
+#             model-recommendation rule names the tier as a one-question
+#             suggestion on every surface. Your explicit /model choice is
+#             never silently overridden.
+#   auto    = render a native Claude `model:` into lite/medium/high-tier skills
+#             so Claude Code switches automatically for that turn (reverts on
+#             the next prompt); suggest on surfaces without a native override.
+#   off     = inert — no native key, no suggestion.
+model:
+  auto_switch: suggest
+
 # --- Personal preferences ---
 personal:
   # IDE to use for opening files (code, phpstorm, cursor)
@@ -209,14 +223,20 @@ pipelines:
 # response — that cadence is governed by `roadmap-progress-sync` and
 # is non-negotiable. This setting only governs *quality tool runs*.
 roadmap:
-  # Skip the /roadmap:process-* pre-run confirmation gate (true, false).
-  #   true  = default. Command name names the scope; a discoverable single
-  #           active roadmap (or a named one) starts the loop immediately,
-  #           resolved config surfaced inline so a wrong pick can still be
-  #           aborted mid-stream.
-  #   false = legacy. Shows the pre-run summary with numbered options and
-  #           waits. Gate is still shown regardless when the roadmap is
-  #           ambiguous or a scope / cadence conflict has no default.
+  # Skip the pre-run confirmation gate when /roadmap:process-step|phase|full
+  # is invoked (true, false).
+  #   true  = default. The command name itself names the scope; if a
+  #           single active roadmap is discoverable (or the user named
+  #           one), the loop starts immediately. The resolved roadmap /
+  #           cadence / council setting are surfaced inline as a one-shot
+  #           note so an unwanted pick can still be aborted mid-stream.
+  #   false = legacy. The loop shows the pre-run summary with numbered
+  #           options (Go / Different roadmap / Different scope / Toggle
+  #           council / Abort) and waits for input.
+  # The gate is still shown — regardless of this flag — when the roadmap
+  # is ambiguous (multiple active, none named) or a scope / cadence
+  # conflict has no sensible default. The flag suppresses the
+  # confirmation, never a genuine "which roadmap?" question.
   skip_pre_run_gate: true
 
   # When to run quality tools during /roadmap:process-step|phase|full.
@@ -257,6 +277,23 @@ subagents:
   # Set to 1 to serialize. Hard cap enforced by runtime.
   max_parallel: 3
 
+# --- Recursive self-verification (see skills/recursive-verification) ---
+verification:
+  # off | ask | on  (default: off)
+  # Depth-bounded self-correction loop (attempt -> critic verdict ->
+  # conditional re-attempt) as a tunable test-time compute knob.
+  # off = inert; ask = ask once before looping; on = loop up to max_depth.
+  # The shipped per-host default flips off -> on/ask ONLY on a passing
+  # capability-axis bench:ab gate cell (orchestration-benchmark-gate);
+  # a discipline-only or honest-null result keeps it off.
+  recursive: off
+
+  # Hard cap on correction rounds (integer, default 1).
+  # 1 = a single critic pass (effectively inert beyond one review) until
+  # a benchmark gate authorises deeper recursion. Each level is one
+  # verify-budget unit; the loop also stops on accept / no-progress.
+  max_depth: 1
+
 # --- Git worktrees ---
 worktrees:
   # off | on | ask  (default: ask)
@@ -432,18 +469,26 @@ telemetry:
       path: .agent-engagement.jsonl
 
 # --- Linked projects (cross-repo awareness, local-only) ---
-# IDE-attached sibling repos in scope for proactive cross-repo awareness.
-# BELONGS IN `.agent-settings.local.yml` (in agents/settings/) (per-machine, gitignored) — sibling
-# paths differ per developer, never commit them. Each entry: path (absolute,
-# auto-filled by detection) + include (true = in scope, false = declined,
-# never re-prompted). Detection skips bloat dirs; a sibling over max_files is
-# flagged `large` (awareness only), never excluded. See ADR-032 +
-# docs/guides/cross-repo-linked-projects.md. Agent never bulk-includes sibling
-# files — passive awareness only.
+#
+# Sibling repositories the IDE has attached to this project (PhpStorm
+# .idea/modules.xml + vcs.xml, VS Code *.code-workspace). When a sibling is
+# opted in, the agent proactively considers cross-repo impact (API contract /
+# shared-type changes) and warns — it does NOT bulk-include the sibling's
+# files. See docs/guides/cross-repo-linked-projects.md and ADR-032.
+#
+# THIS KEY BELONGS IN `.agent-settings.local.yml` (in agents/settings/) (the per-machine, gitignored
+# override layer), NOT in the committed `.agent-settings.yml`: sibling paths
+# differ per developer and must never be committed. Each entry:
+#   - path:    absolute path to the sibling repo root (auto-filled by detection)
+#   - include: true = in scope (proactive awareness); false = declined, never
+#              re-prompted.
+# Detection auto-skips bloat dirs (node_modules/.git/dist/build/.venv/target);
+# a sibling over `max_files` is flagged `large` (awareness only), never excluded.
 linked_projects: []
   # - path: /abs/path/to/sibling-repo
   #   include: true
-linked_projects_max_files: 20000   # ceiling for the `large` flag; never excludes
+# Optional ceiling for the `large` flag (does not exclude). Default 20000.
+linked_projects_max_files: 20000
 ```
 
 ## Settings Reference
@@ -468,7 +513,7 @@ the canonical narrative lives in
 | `personal.minimal_output` | `true`, `false` | `true` | When `true`: short bullet points during work, concise summary at end. When `false`: verbose explanations. |
 | `personal.play_by_play` | `true`, `false` | `false` | When `true`: share intermediate findings during investigation. When `false`: work silently, report only the conclusion. |
 | `personal.pr_comment_bot_icon` | `true`, `false` | `false` | Prefix PR comment replies with 🤖 to indicate bot-authored replies. Personal preference — each developer decides. |
-| `personal.autonomy` | `on`, `off`, `auto` | `auto` | Suppress trivial workflow questions and act on the obvious next step. `auto` defaults to `off` but flips to `on` after a prose opt-in like "arbeite selbstständig". `on` suppresses trivial questions unconditionally. Blocking decisions (security, scope expansion, push/merge/branch/PR/tag) are never suppressed. See `rules/autonomous-execution.md`. |
+| `personal.autonomy` | `on`, `off`, `auto` | `auto` | Suppress trivial workflow questions and act on the obvious next step. `auto` (default) defaults to `off` but flips to `on` after a prose opt-in like "arbeite selbstständig". `on` suppresses trivial questions unconditionally. `off` is the legacy ask-everything mode. Blocking decisions (security, scope expansion, push/merge/branch/PR/tag) are never suppressed. See `rules/autonomous-execution.md`. |
 | `project.pr_template` | file path | `.github/pull_request_template.md` | Path to PR template file. Read this instead of searching for it. |
 | `project.upstream_repo` | `org/repo` | _(empty)_ | Target repository for universal improvement PRs (e.g., `org/agent-config`). |
 | `project.improvement_pr_branch_prefix` | string | `improve/agent-` | Branch prefix for agent improvement PRs. |
@@ -487,7 +532,7 @@ the canonical narrative lives in
 | `hooks.chat_history.enabled` | `true`, `false` | `true` | Register the chat-history hooks (`append` on `after_step`, `halt_append` on `on_halt`). Gated by **both** this flag AND `chat_history.enabled`; either off → no chat-history hook registers. Schema v4: every entry self-identifies via a 16-char session fingerprint, no ownership/sidecar layer. |
 | `hooks.chat_history.script` | path | `scripts/chat_history.py` | Override path to the chat-history CLI. Set only when the script lives outside the standard location. |
 | `pipelines.skill_improvement` | `true`, `false` | `true` | When `true`: propose learning capture after meaningful tasks. When `false`: silent. Included in every profile except `custom`. |
-| `roadmap.skip_pre_run_gate` | `true`, `false` | `true` | When `true` (default): `/roadmap:process-step\|phase\|full` skips the interactive pre-run summary and starts immediately — resolved roadmap / cadence / council surfaced inline so an unwanted pick can still be aborted. When `false`: shows the pre-run summary with numbered options and waits. Gate is always shown — regardless of this flag — when the roadmap is ambiguous (multiple active, none named) or a scope / cadence conflict has no default. |
+| `roadmap.skip_pre_run_gate` | `true`, `false` | `true` | When `true` (default): `/roadmap:process-step\|phase\|full` skips the interactive pre-run summary and starts the loop immediately — the resolved roadmap, cadence, and council are surfaced inline so an unwanted pick can still be aborted. When `false`: the loop shows the pre-run summary with numbered options (Go / Different roadmap / Different scope / Toggle council / Abort) and waits. The gate is always shown — regardless of this flag — when the roadmap is ambiguous (multiple active, none named) or a scope / cadence conflict has no sensible default. |
 | `roadmap.quality_cadence` | `end_of_roadmap`, `per_phase`, `per_step` | `end_of_roadmap` | When `/roadmap:process-step|phase|full` runs the project's quality pipeline. Default skips per-step / per-phase runs and gates only the final archival. `per_phase` runs once after every phase; `per_step` is the legacy verbose mode. Step checkboxes and the dashboard are always updated regardless. `verify-before-complete` still requires fresh output before any "roadmap complete" claim. |
 | `quality.local_auto_run` | `true`, `false` | `true` | When `true`: agent runs the project's quality pipeline (`task ci`, `make test`, `npm run check`, PHPStan, ECS, Rector, test suites) autonomously when work is ready for verification. When `false`: agent asks before running locally. **Carve-out**: NEW CI gates / smoke tests / test files MUST run locally regardless of this flag — without execution the new gate is unverified evidence. Iron Law `verify-before-complete` still applies; suppressed runs require the agent to surface the gap before claiming completion. |
 | `quality.wait_for_remote_ci` | `true`, `false` | `false` | When `true`: after `git push`, the agent polls GitHub check-runs / pipeline status on the PR and reports green / red before handing back. When `false`: agent pushes and hands back immediately; the user inspects CI themselves (default — saves agent runtime and tokens). |

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-06-21T23:17:03Z`
+- Generated: `2026-06-24T13:42:39Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._