@event4u/agent-config 7.0.1 → 7.1.0

package/docs/decisions/ADR-107-legal-domain-pack-adoption.md

@@ -0,0 +1,51 @@
+---
+adr: 107
+status: accepted
+date: 2026-06-24
+decision: legal-domain-pack-adoption
+supersedes: —
+superseded_by: —
+phase: road-to-legal-pack
+type: prospective
+---
+
+# ADR-107 — Legal domain-pack adoption (EU/DE-scoped, procedure-only, evaluated honestly)
+
+## Status
+
+**Accepted** · 2026-06-24 · three AI-council rounds (anthropic/claude-sonnet-4-5 + openai/gpt-4o; the curl-timeout fix landed mid-series so rounds 2–3 ran two-voice). Implementing roadmap: road-to-legal-pack (archived on completion).
+
+## Context
+
+`event4u/agent-config` had legal-adjacent anchors (`contracts-cognition`, `privacy-review`, `data-handling-judgment`, `data-flow-mapper`, `domain-safety-disclaimer` legal sector) but no legal **domain pack**. Opening one is a `domain-adoption-policy` decision (three gates: demand signal, named maintenance owner, CI-tooling). External legal-plugin references (a first-party suite + community packs) showed reusable patterns but enforce everything via prompt instructions only (empty hooks).
+
+## Decision
+
+Open a single, narrow `legal` pack — **not** a multi-plugin / multi-agent parity clone.
+
+1. **Scope: EU/DE-only, hard refusal.** Every selectable jurisdiction is an implicit currency promise; for a single maintainer the smallest correct cut is EU/DE with "consult local counsel" for everything else. Encoded in the `legal-safety-floor` rule + the pack description; surfaced via a machine-checkable `Jurisdiction:` tag.
+2. **Safety-floor first.** `rule:legal-safety-floor` + its deterministic linters land before any drafting skill (a drafting skill before its floor is the exact liability the floor prevents).
+3. **Skills ship procedure + output template only — no default legal positions.** Positions live in a practice profile (`legal-practice-profile`).
+4. **Deterministic hardening is the differentiator.** Disclaimer-presence, jurisdiction-tag, and freshness linters; privilege markers extend `domain-safety-pii` + `lethal-trifecta-guard` (no new hook unless the extension demonstrably fails).
+5. **Eval = regression/consistency harness, not a correctness oracle.** Self-labeled fixtures narrowed to the maintainer's genuine-competence domain (EU DPA / GDPR Art. 28) with spot-validation; a multi-attorney gold set (inter-annotator ≥0.7) is a **demand+funding-gated** track, NOT parity-gated (legal matching is classification, not the finding-count distributions the cross-model-parity keystone calibrates). The eval achieves *measurement* objectivity (reliable regression detection), never *ground-truth* objectivity — correctness stays attorney review.
+6. **No personas** — procedure-not-personality; role focus lives in skill tags + the practice profile.
+7. **Conditional product-liability gate** — commercial (Pro-tier) ship would require licensed-attorney review of the pack itself. **Resolved N/A 2026-06-24:** the suite is open-source forever, no commercial tier (ADR-108) — the gate never fires; the non-removable disclaimer + per-output attorney-review line cover end-user reliance.
+
+## Rejections (recorded)
+
+matter-workspace (too heavy), scheduled watchers, community-skill installer hub, US-state employment tests, full litigation depth, bar-prep, Swiss cantonal depth, non-EU/DE jurisdictions, the cross-model-parity dependency for the eval (a false blocker, corrected in the full critique round).
+
+## Consequences
+
+- The pack ships `trust_level_default: experimental` / `surface_tier: lab` as the **conservative default for a high-risk legal domain**. Gate 2 was **resolved 2026-06-24 by maintainer decision: no named-owner / external-qualification gate** — the protection is the always-present, **test-enforced** not-legal-advice notice (every skill · chat output · README · dedicated legal-pack notice; `tests/scripts/legal-disclaimer-presence.test.ts`) plus the RDG individual-case guardrail. Tier promotion is a separate future decision.
+- A reusable domain-pack sequence (Safety-Floor → Enforcement → Evals → Skills → Practice-Profile) is **documented retrospectively**, validated against a second domain before promotion to a rule (per `domain-pack-extraction-when-triggered`, N=2) — it does not drive legal's design.
+
+## Alternatives considered
+
+Jurisdiction-neutral-with-EU-default (rejected — maximizes the maintenance surface the binding constraint exists to cut); objective eval pack at N=1 (rejected — manufactures false objectivity without a funded attorney gold set); ≤2 legal personas (rejected — decoration with maintenance cost, no incremental safety).
+
+## References
+
+- road-to-legal-pack — the implementing roadmap (archived on completion)
+- [ADR-013 — Discovery Frontmatter Contract](ADR-013-discovery-frontmatter-contract.md) (vocabulary amendment, same series)
+- `rule:legal-safety-floor`, `rule:domain-adoption-policy`, `rule:domain-safety-disclaimer`

package/docs/decisions/ADR-108-open-source-forever-no-commercial-tier.md

@@ -0,0 +1,46 @@
+---
+adr: 108
+status: accepted
+date: 2026-06-24
+decision: open-source-forever-no-commercial-tier
+supersedes: —
+superseded_by: —
+phase: road-to-legal-pack
+type: standing
+---
+
+# ADR-108 — The suite is open-source forever; no commercial / Pro tier
+
+## Status
+
+**Accepted** · 2026-06-24 · maintainer decision. Standing commitment for the whole `event4u/agent-config` suite, surfaced while resolving the legal pack's conditional product-liability gate (ADR-107 § 0.6).
+
+## Context
+
+The legal pack (ADR-107) carried a *conditional* product-liability gate: "if shipped commercially (Pro tier), a licensed attorney must review the pack itself before ship." That conditional only matters if a commercial/Pro tier is on the table. The maintainer's standing position is that it is not — and should be made durable so the question is not relitigated and so no future change silently introduces provider liability.
+
+## Decision
+
+**The entire `event4u/agent-config` suite is and remains open-source. There is no commercial tier, no Pro tier, no paid distribution — now or in the future.**
+
+Consequences for governance:
+
+1. **The legal pack's conditional product-liability gate (ADR-107 § 0.6) never fires.** There is no provider selling the pack; the only liability surface is end-user reliance, which is addressed by the non-removable disclaimer and the per-output attorney-review line in `legal-safety-floor`.
+2. **Liability disclaimer is permanent.** Every legal-pack output is a research-and-drafting aid, not legal advice, not a substitute for a licensed attorney, and not something anyone may rely on as definitive. This holds independent of distribution model.
+3. **Reopening requires a superseding ADR.** Introducing any paid/commercial tier would be a new, explicit decision that supersedes this ADR — and would re-activate the ADR-107 § 0.6 attorney-review-of-the-pack gate before any paid distribution.
+
+## Consequences
+
+- `legal-safety-floor` § Distribution states the open-source-forever stance and that the conditional gate is closed by decision.
+- ADR-107 § 0.6 is resolved as **N/A** (not applicable under this standing decision).
+
+## Alternatives considered
+
+- **Keep 0.6 purely conditional, no standing decision** (rejected — leaves the door open to silently introducing provider liability; the maintainer wanted it hardened for the future).
+- **A CI lint enforcing "no commercial tier"** (rejected — over-engineering; an ADR + the floor statement are the right durable surface, and there is no machine signal of "commercial intent" to lint).
+
+## References
+
+- [ADR-107 — Legal domain-pack adoption](ADR-107-legal-domain-pack-adoption.md) (§ 0.6 conditional gate, now resolved N/A)
+- `rule:legal-safety-floor` § Distribution + § What this pack is — and is not
+- road-to-legal-pack § 0.6 (archived on completion)

package/docs/decisions/INDEX.md

@@ -107,6 +107,11 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | [ADR-101](ADR-101-ticket-bundle-emission.md) | Ticket Bundle Emission | proposed | 2026-06-15 | — |
 | [ADR-102](ADR-102-ticket-handoff-paste-and-mcp.md) | Ticket Handoff Paste And Mcp | accepted | 2026-06-16 | — |
 | [ADR-103](ADR-103-global-knowledge-default-off-until-measured.md) | Global Knowledge Default Off Until Measured | accepted | 2026-06-16 | — |
+| [ADR-104](ADR-104-ai-council-config-global-only.md) | Ai Council Config Global Only | accepted | 2026-06-22 | 093 |
+| [ADR-105](ADR-105-automatic-subagent-orchestration.md) | Automatic Subagent Orchestration | accepted | 2026-06-23 | — |
+| [ADR-106](ADR-106-recursive-verification-benchmark-gate.md) | Recursive Verification Benchmark Gate | accepted | 2026-06-23 | — |
+| [ADR-107](ADR-107-legal-domain-pack-adoption.md) | Legal Domain Pack Adoption | accepted | 2026-06-24 | — |
+| [ADR-108](ADR-108-open-source-forever-no-commercial-tier.md) | Open Source Forever No Commercial Tier | accepted | 2026-06-24 | — |
 | [ADR-200](ADR-200-python-to-typescript-migration.md) | Python To Typescript Migration | accepted | 2026-06-11 | — |
 
 ## Unnumbered (legacy)

package/docs/getting-started.md

@@ -129,7 +129,7 @@ Your agent is now:
 - **Respecting your codebase** — no conflicting patterns
 - **Following standards** — consistent code quality
 
-This is enforced automatically by 88 rules. No configuration needed.
+This is enforced automatically by 91 rules. No configuration needed.
 
 ---
 
@@ -169,7 +169,7 @@ Your agent now understands slash commands:
 | `/quality-fix` | Run and fix all quality checks |
 | `/chat-history import` | Pull a prior session into the current chat (resume) |
 
-→ [Browse all 161 active commands](../dist/agent-src/commands/)
+→ [Browse all 162 active commands](../dist/agent-src/commands/)
 
 ---
 

package/docs/guidelines/agent-infra/domain-eval-anti-pattern.md

@@ -0,0 +1,53 @@
+# Domain-eval anti-pattern — manufactured false objectivity at N=1
+
+> A retrospective from the legal pack (council round 3). It exists so the next
+> domain does not repeat the mistake. The short version: **do not call a
+> self-labeled regression harness an "objective" correctness gate.**
+
+## The anti-pattern
+
+Gating skill ship on *"≥X% match to expert ground-truth"* and calling it "the
+objective replacement for reviewer sign-off" — when:
+
+1. **The ground-truth is unsourced or self-generated.** If the maintainer guesses
+   what an expert would flag, the eval measures "does the skill match the
+   maintainer's guess," i.e. reviewer subjectivity wearing a quantitative costume.
+2. **Expert agreement is not truth.** Even an attorney-validated gold set at
+   inter-annotator agreement ≥0.7 is *inter-subjective expert consensus*, not
+   ground truth — `0.7 ≠ 1.0` admits the domain is contested ~30% of the time.
+   The honest goal is **measurement objectivity** (reliably detect change), not
+   **ground-truth objectivity** (the labels are correct).
+3. **Model capability caps below the threshold.** Clause-extraction caps at
+   ~F1 0.62; any passable threshold therefore measures "not worse than a mediocre
+   baseline," i.e. regression detection — never correctness.
+4. **The statistical language is borrowed from infra that does not exist.**
+   Calibrating a threshold "from cross-model distributions" requires a built
+   cross-model-parity layer. Borrowing the vocabulary before the layer exists is
+   false precision.
+
+## The honest alternative
+
+- **Ship a regression / consistency harness.** Self-labeled fixtures, explicitly
+  marked "regression-only, not correctness, not objective." It catches "did a
+  change make a skill worse than its own baseline."
+- **Keep correctness with the human.** Licensed-expert review on material use,
+  baked into the skill's output, not a footnote.
+- **Make the objective eval a separate, gated track.** Attorney/expert-validated
+  gold set + inter-annotator ≥0.7 is real but expensive; gate it on **validated
+  demand + funding**, not on a phase timeline — and note it is classification, so
+  it does **not** depend on a cross-model-parity keystone.
+
+## The false-blocker corollary
+
+When you scope an eval, check what it *actually* depends on. The legal eval was
+briefly gated on the cross-model-parity keystone; the full critique round showed
+that was wrong — legal fixture matching is **classification** (clause
+present/absent/ambiguous), not the finding-count distributions that keystone
+calibrates. The real dependency was labeled-gold-set tooling, buildable in-pack.
+A false structural blocker is as much an error as false objectivity.
+
+## See also
+
+- [ADR-107 — Legal domain-pack adoption](../../decisions/ADR-107-legal-domain-pack-adoption.md)
+- `domain-pack-architecture.md` — the retrospective sequence this is part of.
+- `src/domains/legal/evals/README.md` — the regression harness in practice.

package/docs/guidelines/agent-infra/domain-pack-architecture.md

@@ -0,0 +1,55 @@
+# Domain-pack architecture — a retrospective observation (NOT a design driver)
+
+> **Status: retrospective hypothesis, N=1.** This documents the sequence the
+> **legal** pack happened to follow. It is **not** a rule and **not** a template
+> that future packs must fit. Validate it against a *second* domain before
+> promoting any of it to a rule or building scaffolding tooling — per
+> `domain-adoption-policy` and the `domain-pack-extraction-when-triggered` (N=2)
+> roadmap. Designing a new pack to fit this speculative pattern would invert the
+> lever: build the domain correctly on its own legs, then observe whether the
+> pattern recurred.
+
+## The sequence legal followed
+
+1. **Safety floor first** — a domain `*-safety-floor` rule (Iron-Law-shaped,
+   ~100 lines) before any drafting skill. A drafting skill shipped before its
+   floor is the exact liability the floor prevents.
+2. **Enforcement teeth** — the floor's machine-checkable elements become a
+   deterministic linter (`lint_legal_pack`) wired into CI. Prompt rules are not
+   governance; lint rules are. This is the differentiator vs prompt-only suites.
+3. **Eval = regression harness, not a correctness oracle** — self-labeled
+   fixtures in the maintainer's genuine-competence sub-domain; the *objective*
+   eval (attorney-validated gold set, inter-annotator ≥0.7) is a separate,
+   demand-and-funding-gated track. See `domain-eval-anti-pattern.md`.
+4. **Skills = procedure + output template only** — no default domain positions;
+   positions live in a practice profile, so one skill set behaves
+   team-specifically and the pack stays portable.
+5. **Practice profile (the keystone)** — a cold-start interview writing a
+   plain-prose profile into `.agent-settings.yml` / the setup wizard; skills read
+   it and halt on unresolved placeholders.
+6. **Deferred by default** — personas, scheduled watchers, installer hubs, and
+   broader scope are recorded as rejected/gated, not built, until evidence pulls
+   them in.
+
+## Why it is NOT yet a rule
+
+- **N=1.** Finance might need real-time-data evals; security might need red-team
+  evals; neither looks like "clause extraction + self-labeled fixtures." The
+  shape that fit legal may not fit them.
+- **Premature tooling is the maintainer's enemy.** No `domain-pack:new`
+  scaffolding ships from this observation. Extraction waits for N=2, where a
+  second domain either confirms the sequence (promote to a rule) or diverges
+  (document the delta, keep both bespoke).
+
+## What to do at N=2
+
+Build the second domain on its own merits. *Then* compare: which steps generalised,
+which broke. If the sequence held twice, promote it to a rule and consider
+scaffolding. If it diverged, this note records why a one-size pattern was wrong —
+itself a useful result.
+
+## See also
+
+- [ADR-107 — Legal domain-pack adoption](../../decisions/ADR-107-legal-domain-pack-adoption.md)
+- `domain-adoption-policy` (rule) — the three gates before opening any domain.
+- `domain-eval-anti-pattern.md` — why the legal eval is a regression harness, not an objective gate.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@event4u/agent-config",
-    "version": "7.0.1",
+    "version": "7.1.0",
     "description": "Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,

package/src/config/agent-settings.template.yml

@@ -393,12 +393,81 @@ quality:
   #         themselves (default — saves agent runtime and tokens)
   wait_for_remote_ci: false
 
+# --- Design fidelity ---
+#
+# Controls how strictly the agent must follow a user-provided, finished
+# design — a prototype, mockup, screenshot, or design-system file. Consumed
+# by the `design-fidelity` rule. The provided design is the spec, not a
+# starting point for the agent's own taste.
+design:
+  # strict | structural | hard-floor  (default: strict)
+  #
+  # strict     = build it 1:1. EVERY visible deviation (font, control type,
+  #              component, layout, spacing, colour, an omitted/added element)
+  #              needs explicit confirmation. A "better" idea is surfaced as a
+  #              numbered option, never executed.
+  # structural = structure is locked (fonts, control types, component set,
+  #              layout, no omissions still need confirmation). Where the spec
+  #              is genuinely silent (hover / empty / error states), the agent
+  #              may fill the gap in the spec's style and MUST state the
+  #              assumption.
+  # hard-floor = any deviation is a Hard-Floor action (never autonomous; no
+  #              autonomy setting, roadmap, or standing instruction lifts it).
+  fidelity_mode: strict
+
 # --- Subagent orchestration ---
 #
-# Controls model selection and parallelism for subagent-based workflows
-# (/do-and-judge, /do-in-steps, /judge). Empty values fall back to the
-# runtime defaults described in .augment/contexts/subagent-configuration.md.
+# Controls model selection, parallelism, and AUTOMATIC orchestration for
+# subagent-based workflows (/do-and-judge, /do-in-steps, /judge, and the
+# auto-dispatch layer). Empty values fall back to the runtime defaults
+# described in .augment/contexts/subagent-configuration.md and
+# .augment/contexts/execution/auto-orchestration-activation.md.
 subagents:
+  # Global master switch for the whole subagent layer.
+  # true (default) = the layer is available; false = fully disabled, the
+  # canonical kill-switch (no auto-dispatch, no model routing, in-session only).
+  enabled: true
+
+  # Automatic-dispatch mode:  off | ask | on
+  #
+  # off = never auto-dispatch; subagents only via an explicit command.
+  # ask = classify the task; when delegable, ask once before dispatching.
+  # on  = auto-dispatch delegable tasks without asking (surface the choice
+  #       in one line).
+  #
+  # Initial SHIPPED default is `ask` on hosts whose capability manifest reports
+  # `subagent_spawn: true`, and `off` on hosts without a subagent primitive.
+  # The shipped default flips toward `on` (host-gated) only behind the Phase-6
+  # benchmark gate of road-to-auto-subagent-orchestration.md — never on an
+  # unmeasured claim. Auto-dispatch is also a no-op wherever the host manifest
+  # reports `subagent_spawn: false`, regardless of this value.
+  auto: ask
+
+  # Route delegable sub-tasks to the lowest-capable model tier (cost + speed
+  # via model downshift). true (default) = downshift per declared model_tier;
+  # false = every subagent runs on the session tier.
+  downshift: true
+
+  # Prefer a separate-quota-pool model for delegable sub-tasks WHERE the host
+  # manifest reports `separate_quota_pool: true` (e.g. a subscription whose
+  # Sonnet allowance is distinct from Opus). Optional bonus only — behaviour is
+  # identical (minus the quota win) where unsupported. Never load-bearing.
+  quota_arbitrage: true
+
+  # Optional per-tier model map for downshift routing. Empty value = use the
+  # tier's runtime default (see model-recommendations.md). Keys are the
+  # vendor-neutral capability bands.
+  model_map:
+    lite: ""
+    medium: ""
+    high: ""
+
+  # Optional host-capability override (see
+  # .augment/contexts/execution/host-capability-manifest.md). Any field set
+  # here wins; any field omitted falls back to the all-false safe default.
+  # Leave empty to let the agent resolve the manifest from host knowledge.
+  host_capabilities: {}
+
   # Model for implementer subagents (empty = same tier as the session model)
   implementer_model: ""
 

package/src/config/discovery/packs.yml

@@ -240,6 +240,19 @@
   workspaces: [construction]
   trust_level_default: professional
 
+- id: legal
+  label: Legal
+  description: "NOT LEGAL ADVICE — a research/drafting aid, not a substitute for a lawyer. In-house legal — EU/DE-scoped contract/NDA/DPA review and triage, procedure-only (no default legal positions); general information + templates only, never individual-case examination; every output a draft for attorney review. See LEGAL_NOTICE.md."
+  workspaces: [legal]
+  trust_level_default: experimental   # gated: ships lab-tier until the Gate-2 maintenance owner + qualification is confirmed (road-to-legal-pack Phase 0.2)
+  surface_tier: lab
+  domain: legal
+  size_class: medium
+  onboarding:
+    first_win_doc: FIRST_WIN.md
+    example_workflow: dpa-review
+    time_to_first_value_minutes: 8
+
 - id: ai-video
   label: AI Video
   description: AI video pipeline.

package/src/config/discovery/workspaces.yml

@@ -64,6 +64,13 @@
   default_packs: [construction]
   optional_packs: []
 
+- id: legal
+  label: Legal
+  description: In-house legal — contract/NDA/DPA review, privacy, legal triage (EU/DE scope).
+  example_roles: [In-house Counsel, DPO, Legal Ops]
+  default_packs: [legal]
+  optional_packs: []
+
 - id: agent-config-maintainer
   label: Maintainer
   description: Skills/rules/commands that maintain this package.

package/src/scripts/_lib/auto_dispatch.ts

@@ -0,0 +1,95 @@
+/**
+ * Auto-dispatch classification (v1 — deterministic).
+ *
+ * Pure, no-I/O encoding of the rule-based classifier described in
+ * `src/agent-src/contexts/execution/auto-dispatch-classification.md`.
+ *
+ * Decides whether a task is delegable to subagents and which
+ * `subagent-orchestration` mode fits — with NO per-turn LLM meta-call.
+ *
+ * Contract highlights:
+ * - A task is delegable only on an enumerated structural signal.
+ * - Trivial tasks below the size floor never delegate.
+ * - Ambiguity → `ask` (when `auto == 'ask'`) or in-session, never speculative
+ *   spawn.
+ * - The activation gate (`enabled`, `auto != off`, `subagent_spawn`) runs
+ *   first; any failure short-circuits to in-session.
+ */
+
+/** Minimum task-size estimate (exclusive) below which a task never delegates. */
+export const SIZE_FLOOR = 1;
+
+export type AutoMode = 'off' | 'ask' | 'on';
+export type DispatchMode = 'do-in-steps' | 'do-in-parallel';
+export type DispatchAction = 'dispatch' | 'ask' | 'in-session';
+
+/** Task descriptor — structural signals only, no task body. */
+export interface TaskSignals {
+    /** Frontmatter `parallelizable:` value of the skill/command in play, if any. */
+    parallelizable?: 'steps' | 'files' | 'independent' | null;
+    /** Task is an explicit ordered plan (numbered steps / phase / checklist). */
+    ordered_plan?: boolean;
+    /** Count of independent same-shape targets (e.g. 5 files to review). */
+    independent_slices?: number;
+    /** Orchestrator's pre-dispatch size estimate (abstract units). */
+    size_estimate: number;
+}
+
+/** Activation inputs resolved from settings + the host-capability manifest. */
+export interface ActivationInputs {
+    enabled: boolean;
+    auto: AutoMode;
+    subagent_spawn: boolean;
+}
+
+export interface Classification {
+    delegable: boolean;
+    action: DispatchAction;
+    mode: DispatchMode | null;
+    reason: string;
+}
+
+function inSession(reason: string): Classification {
+    return { delegable: false, action: 'in-session', mode: null, reason };
+}
+
+/**
+ * Classify a task for auto-dispatch. Activation gate first, then the
+ * deterministic delegable-signal rules.
+ */
+export function classifyTask(signals: TaskSignals, activation: ActivationInputs): Classification {
+    // ── Activation gate — any failure short-circuits to in-session ──
+    if (!activation.enabled) return inSession('subagents.enabled is false');
+    if (activation.auto === 'off') return inSession('subagents.auto is off');
+    if (!activation.subagent_spawn) return inSession('host has no subagent_spawn primitive');
+
+    // ── Size floor — trivial tasks never delegate ──
+    if (!(signals.size_estimate > SIZE_FLOOR)) {
+        return inSession(`task below size floor (${signals.size_estimate} <= ${SIZE_FLOOR})`);
+    }
+
+    // ── Delegable-signal rules (enumerated; ambiguity never spawns) ──
+    const slices = signals.independent_slices ?? 0;
+    let mode: DispatchMode | null = null;
+    let reason = '';
+
+    if (signals.parallelizable === 'steps' || signals.ordered_plan === true) {
+        mode = 'do-in-steps';
+        reason = signals.parallelizable === 'steps' ? 'declared parallelizable: steps' : 'ordered-plan structure';
+    } else if (signals.parallelizable === 'files' || signals.parallelizable === 'independent' || slices >= 2) {
+        mode = 'do-in-parallel';
+        reason = signals.parallelizable ? `declared parallelizable: ${signals.parallelizable}` : `independent slices (${slices})`;
+    }
+
+    if (mode === null) {
+        // No enumerated signal matched → ambiguous. Ask under `ask`, else in-session.
+        if (activation.auto === 'ask') {
+            return { delegable: false, action: 'ask', mode: null, reason: 'no delegable signal — borderline, ask' };
+        }
+        return inSession('no enumerated delegable signal matched');
+    }
+
+    // Matched a signal. Dispatch under `on`, ask under `ask`.
+    const action: DispatchAction = activation.auto === 'on' ? 'dispatch' : 'ask';
+    return { delegable: true, action, mode, reason };
+}

package/src/scripts/_lib/host_capability.ts

@@ -0,0 +1,59 @@
+/**
+ * Host-capability manifest normalizer.
+ *
+ * Pure, no-I/O helper that takes a partial / unknown object (typically the
+ * `subagents.host_capabilities` override from `.agent-settings.yml`, or the
+ * agent's own host-knowledge object) and returns a fully-populated manifest.
+ *
+ * Contract — see `src/agent-src/contexts/execution/host-capability-manifest.md`:
+ *
+ * - Safe default is ALL boolean fields `false` — an unknown host is assumed to
+ *   have no subagent primitive.
+ * - A missing or non-boolean field resolves to `false`, never `true`.
+ * - `schema_version` is always forced to `1`.
+ */
+
+/** Resolved host-capability manifest. All booleans, `schema_version` fixed at 1. */
+export interface HostCapabilityManifest {
+    schema_version: 1;
+    subagent_spawn: boolean;
+    parallel_spawn: boolean;
+    status_polling: boolean;
+    separate_quota_pool: boolean;
+}
+
+/** Safe default — unknown host assumes no subagent primitive. */
+const SAFE_DEFAULT: HostCapabilityManifest = {
+    schema_version: 1,
+    subagent_spawn: false,
+    parallel_spawn: false,
+    status_polling: false,
+    separate_quota_pool: false,
+};
+
+/** Coerce one field: only a strict boolean `true` survives; everything else is `false`. */
+function asBool(value: unknown): boolean {
+    return value === true;
+}
+
+/**
+ * Normalize a partial / unknown object into a full {@link HostCapabilityManifest}.
+ *
+ * Any missing or invalidly-typed field falls back to the all-`false` safe
+ * default; `schema_version` is always forced to `1`.
+ */
+export function normalizeHostManifest(input: unknown): HostCapabilityManifest {
+    if (input === null || typeof input !== 'object') {
+        return { ...SAFE_DEFAULT };
+    }
+
+    const src = input as Record<string, unknown>;
+
+    return {
+        schema_version: 1,
+        subagent_spawn: asBool(src.subagent_spawn),
+        parallel_spawn: asBool(src.parallel_spawn),
+        status_polling: asBool(src.status_polling),
+        separate_quota_pool: asBool(src.separate_quota_pool),
+    };
+}

package/src/scripts/_lib/orchestration_gate.ts

@@ -0,0 +1,98 @@
+/**
+ * Default-flip decision gate (Phase 6).
+ *
+ * Pure, no-I/O. Encodes the Phase-6 falsification gate: the SHIPPED default for
+ * `subagents.auto` flips toward `on` ONLY when a real benchmark shows a net
+ * token-or-time win at held quality, and only on hosts with a subagent
+ * primitive. Honest-null exit (no win, or quality regressed) keeps the
+ * conservative default. Contract:
+ * `src/agent-src/contexts/execution/orchestration-benchmark-gate.md`.
+ *
+ * This helper decides; it never runs the benchmark. The measurement is the
+ * empirical bench:ab step, authorised + run out of band.
+ */
+
+export interface BenchmarkResult {
+    /** Net token OR wall-clock win on the delegable-task subset. */
+    net_win: boolean;
+    /** Output quality held at or above the single-agent baseline. */
+    quality_held: boolean;
+}
+
+export type GateVerdict = 'pass' | 'fail';
+export type ShippedDefault = 'on' | 'ask' | 'off';
+
+/** Gate verdict: pass requires BOTH a net win AND held quality. */
+export function gateVerdict(r: BenchmarkResult): GateVerdict {
+    return r.net_win && r.quality_held ? 'pass' : 'fail';
+}
+
+/**
+ * Resolve the shipped default for `subagents.auto` after a benchmark.
+ *
+ * - Gate fail (no win or quality regressed) → keep conservative: `ask` on a
+ *   subagent-capable host, `off` elsewhere (honest-null exit).
+ * - Gate pass → `on` on a subagent-capable host, `off` elsewhere.
+ *
+ * `host_subagent_spawn` gates the result so the default is never `on`/`ask`
+ * where the host cannot spawn at all.
+ */
+export function resolveShippedDefault(r: BenchmarkResult, host_subagent_spawn: boolean): ShippedDefault {
+    if (!host_subagent_spawn) return 'off';
+    return gateVerdict(r) === 'pass' ? 'on' : 'ask';
+}
+
+/**
+ * Recursive-verification gate (ADR-106).
+ *
+ * Decides whether `verification.recursive` ships on for a (host, family) cell.
+ * Pure, no-I/O — the measurement is the empirical bench:ab step. Encodes the
+ * council-locked two-branch rule: capability-only is NOT the gate, because it
+ * assumes (without measuring) that recursion's discipline lift is redundant
+ * with the always-on rules. The `D₂ − D₁` (recursion over rules-only) baseline
+ * makes redundancy a measured fact, gated behind a concrete cost ceiling and a
+ * human-preference pre-test. Contract:
+ * `docs/decisions/ADR-106-recursive-verification-benchmark-gate.md`.
+ */
+export interface RecursiveBenchmarkResult {
+    /** Capability-axis lift is significant (McNemar/scorer p<0.05, effect≥0.5). */
+    capability_lift_significant: boolean;
+    /** Novel discipline lift `D₂ − D₁` (recursion over rules-only) exceeds ε_disc. */
+    novel_discipline_lift_significant: boolean;
+    /** Per-task cost is within the concrete ceiling (token-multiplier / $). */
+    cost_within_ceiling: boolean;
+    /** Phase 3a-pre human-preference rate (fraction preferring the recursion output). */
+    human_preference_rate: number;
+}
+
+/** Human-preference floor from ADR-106: below this the discipline branch cannot pass. */
+export const RECURSIVE_HUMAN_PREFERENCE_FLOOR = 0.6;
+
+/**
+ * Gate verdict for recursive verification (ADR-106 two-branch rule):
+ *   pass iff  capability_lift_significant
+ *             OR (novel_discipline_lift_significant AND cost_within_ceiling
+ *                 AND human_preference_rate > floor)
+ * The human-preference test gates the discipline branch only — a capability
+ * lift passes on its own.
+ */
+export function recursiveGateVerdict(r: RecursiveBenchmarkResult): GateVerdict {
+    if (r.capability_lift_significant) return 'pass';
+    const disciplineBranch =
+        r.novel_discipline_lift_significant &&
+        r.cost_within_ceiling &&
+        r.human_preference_rate > RECURSIVE_HUMAN_PREFERENCE_FLOOR;
+    return disciplineBranch ? 'pass' : 'fail';
+}
+
+/**
+ * Resolve the shipped default for `verification.recursive`.
+ *
+ * Default stays `off` until a cell passes (ADR-106) — an honest-null keeps it
+ * `off`, never `ask`. `host_supported` gates the result so a host where
+ * recursion is not viable always resolves `off`.
+ */
+export function resolveRecursiveDefault(r: RecursiveBenchmarkResult, host_supported: boolean): ShippedDefault {
+    if (!host_supported) return 'off';
+    return recursiveGateVerdict(r) === 'pass' ? 'on' : 'off';
+}