@event4u/agent-config 7.1.0 → 7.3.0

package/dist/ui/index.html

@@ -5,7 +5,7 @@
         <meta name="viewport" content="width=device-width, initial-scale=1" />
         <meta name="robots" content="noindex" />
         <title>agent-config</title>
-      <script type="module" crossorigin src="/assets/index-CoQo90sz.js"></script>
+      <script type="module" crossorigin src="/assets/index-UjcTG_9O.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-BbWWuFrF.css">
     </head>
     <body>

package/docs/RELEASE_STORY_TEMPLATE.md

@@ -0,0 +1,37 @@
+# Release Story — `<version>`
+
+A curated, human-readable "what changed and **why it matters**" — distinct from
+the raw `CHANGELOG`. The changelog lists commits; the release story tells a
+maintainer or consumer, in plain language, what they get and what to watch.
+
+Copy this template per release; keep it short (a screen or less).
+
+## Headline
+
+One sentence: the single most important thing this release delivers.
+
+## What changed (and why it matters)
+
+- **<change>** — what it is · why a consumer cares · what they should do (if anything).
+- **<change>** — …
+
+## Safety / behaviour changes
+
+Anything that changes agent behaviour, gates, or defaults — call it out explicitly
+(new floors, new consent gates, renamed packs, changed risk postures). Consumers
+read this section first.
+
+## Upgrade notes
+
+- Breaking? Migration steps. Non-breaking? Say so.
+- New opt-in surfaces (packs, settings) — how to enable.
+
+## Deferred / known limitations
+
+What was intentionally left for a future release, and the pointer (roadmap /
+ADR). Honesty here prevents "is this missing or coming?" questions.
+
+---
+
+> Fill every section. An empty section is a signal the release is not understood
+> well enough to ship its story. (road-to-product-clarity Phase 4a.)

package/docs/architecture.md

@@ -146,10 +146,10 @@ note, package-internal path-swap, description budget, and the
 
 | Layer | Count | Purpose |
 |---|---|---|
-| **Skills** | 257 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
-| **Rules** | 91 | Always-active constraints — coding standards, scope control, verification, language-and-tone, agent-authority |
+| **Skills** | 258 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
+| **Rules** | 93 | Always-active constraints — coding standards, scope control, verification, language-and-tone, agent-authority |
 | **Commands** | 162 | Slash-command workflows — `/commit`, `/create-pr`, `/fix ci`, `/optimize skills`, `/feature plan`, `/work`, `/implement-ticket`, `/condense`, … |
-| **Guidelines** | 84 | Reference material cited by skills — PHP patterns, Eloquent, Playwright, agent-infra, … |
+| **Guidelines** | 86 | Reference material cited by skills — PHP patterns, Eloquent, Playwright, agent-infra, … |
 | **Templates** | 7 | Scaffolds for features, roadmaps, contexts, skills, overrides |
 | **Contexts** | 5 | Shared knowledge about the system itself |
 

package/docs/contracts/capability-boundary.md

@@ -0,0 +1,64 @@
+# Capability Boundary Matrix
+
+The per-pack safety posture at a glance: is a pack on by default, does it need
+consent, a council pass, a disclaimer, an eval — and how risky is it. The matrix
+makes the invisible visible; the **enforcement** lives in the per-pack safety
+floors + gates (this doc is the map, not the engine).
+
+> Source of truth: `src/config/discovery/packs.yml` (`surface_tier`,
+> `trust_level_default`, `domain`, and the legal-review-prep gate fields) + the
+> domain safety-floor rules. Built in `road-to-capability-governance` Phase 1;
+> `risk_class` becomes a real pack field in Phase 2.
+
+## Policy by risk class
+
+| `risk_class` | default install | consent | council / deep-research | disclaimer | eval expectation | surface_tier |
+|---|---|---|---|---|---|---|
+| **low** | per profile | no | no | no | optional | `core` |
+| **medium** (advisory) | per profile | no | no | **yes** (domain safety floor) | recommended | `core` |
+| **high** | **no** (opt-in) | **yes** | **yes** (fail-closed) | **yes** | **yes** | `lab` |
+
+- **low** — engineering, product, meta, and tooling packs. Normal capability; no domain liability surface.
+- **medium (advisory)** — packs that emit advisory-shaped output (finance, strategy). They carry a **domain safety floor** that mandates a not-X-advice disclaimer + structural elements (assumptions / counter-case / confidence). Not off-by-default, but never a final call.
+- **high** — regulated-advice-adjacent. Off by default, consent-gated, council-gated (fail-closed), disclaimer-bound, eval-backed, lab-tier, and promotion-gated behind a professional review.
+
+## Per-pack assignment (non-low)
+
+| Pack | `risk_class` | Floor | Gates |
+|---|---|---|---|
+| `legal-review-prep` | **high** | `legal-safety-floor` | consent (`legal_review_prep.acknowledged`) · council (`require_council`, fail-closed) · hard individual-case STOP · attorney-review line + `Jurisdiction:` tag · attorney-framing-review promotion tripwire · `default_install: false` · `surface_tier: lab` |
+| `finance-basic` | medium | `finance-safety-floor` | not-financial-advice disclaimer · assumptions + sensitivity + confidence + counter-case · no final invest/raise call |
+| `finance-advanced` | medium | `finance-safety-floor` | as finance-basic (DCF / scenario depth) |
+| `founder-strategy` | medium | `strategy-safety-floor` | not-a-strategic-decision footer · bet + counter-case + residual risk + decision owner |
+
+Every other pack in `packs.yml` is **low** by default. A pack moves to medium the
+moment it ships advisory-shaped output behind a domain safety floor, and to high
+only through the high-risk checklist (consent + council + disclaimer + eval +
+lab + promotion gate) — see `road-to-legal-review-prep` for the worked example.
+
+## Capability lifecycle (a view, not a new axis)
+
+Reviewers wanted one lifecycle vocabulary for promoting / retiring capabilities.
+This is a **derived view** over the metadata that already exists
+(`trust_level_default` + `surface_tier` + eval presence) — **not** a new field.
+Nothing to set; it is read off what is already there.
+
+| Lifecycle | Derived from | Promotion criterion (to reach it) |
+|---|---|---|
+| **experimental** | `surface_tier: lab` **or** `trust_level_default: experimental` | default for any new pack/skill |
+| **validated** | `surface_tier: core` **and** has an `evals/` (or regression harness) | a real eval exists + the pack left lab |
+| **recommended** | validated **and** in a default profile / ≥1 real consumer | adoption evidence, not just existence |
+| **deprecated** | a `deprecated`/`superseded_by` marker in frontmatter | a successor named (per the persona/skill deprecation discipline) |
+
+Read the lifecycle column off the matrix above: a `lab` + `experimental` pack
+(e.g. `legal-review-prep`, `ai-video`) is **experimental**; a `core` pack with an
+eval is **validated**; a `core` pack a profile ships is **recommended**.
+Promotion stays a human/maintainer decision (criteria-documented, never
+automated — see `road-to-capability-governance` Phase 6).
+
+## See also
+
+- [`legal-safety-floor`](../../src/rules/legal-safety-floor.md) — the high-risk exemplar.
+- `finance-safety-floor` · `strategy-safety-floor` — the medium-risk advisory floors.
+- [`domain-pack-architecture`](../guidelines/agent-infra/domain-pack-architecture.md) — the pack build sequence.
+- `road-to-capability-governance` Phase 2 — `risk_class` as a validated pack field.

package/docs/contracts/discovery-manifest.schema.json

@@ -74,7 +74,7 @@
     },
     "workspace_id": {
       "type": "string",
-      "enum": ["engineering", "product", "finance", "founder", "gtm", "ops", "small-business", "construction", "legal", "agent-config-maintainer"]
+      "enum": ["engineering", "product", "finance", "founder", "gtm", "ops", "small-business", "construction", "legal-review-prep", "agent-config-maintainer"]
     },
     "pack_id": {
       "type": "string",
@@ -84,7 +84,7 @@
         "finance-basic", "finance-advanced",
         "gtm-sales", "gtm-marketing",
         "ops-people", "founder-strategy", "small-business", "construction", "ai-video", "ai-image", "fun", "meta", "git", "frontend-design", "brand",
-        "memory", "analytics", "product-reasoning", "analysis-workbench", "legal"
+        "memory", "analytics", "product-reasoning", "analysis-workbench", "legal-review-prep"
       ]
     },
     "lifecycle": {

package/docs/contracts/governance-enforcement-projection.md

@@ -0,0 +1,154 @@
+# Governance Enforcement at Projection Time — design spec
+
+> **Status: Measured → honest-null (2026-06-25). NOT shipped.** The length-controlled
+> eval (54 paired runs, sonnet-4-6) found `discipline_score = 1.000` for `package`,
+> `hardened` and `hardened-placebo` alike — Δ(hardened − package) = 0.000 across all
+> 18 paired instances. The cooperative `package` rules already catch trapD
+> (non-destructive) + trapE (scope-control) at ceiling, so the hardened blocks add
+> nothing measurable. Per this spec's own rule, `condense.ts` is **not** wired and
+> no public "enforcement" claim is made. **Caveat:** the discipline corpus is
+> single-shot on micro-fixtures and does NOT reproduce the token-pressure /
+> long-horizon condition the treatment targets — it saturates. Revisit only behind
+> a pressure/long-context corpus, not by writing more enforcement code. The opt-in
+> `hardened` arm remains in `bench_ab_v2_run.ts` as a reusable measurement tool.
+
+## Problem
+
+The package's highest-stakes rules (commit only when told, never push/merge
+autonomously, no whimsical bulk deletion) are **model-cooperative**: they are
+strong prose the agent is asked to follow. Under token pressure or long-horizon
+autonomy, cooperative rules can be violated. An external operator-runtime
+reference ("Source A") closes this with **runtime hooks that hard-block** the
+tool call — but those reach only ~2 of our 7 projection hosts (Claude Code,
+Cline/MCP). The other five (Cursor, Windsurf, Copilot, Gemini, Augment) are
+static-only ([`enforcement-by-host.md`](../enforcement-by-host.md)).
+
+The universal lever is therefore **compile-time**: harden the few irreversible
+Iron Laws into each host's *native* instruction format at projection time, with
+explicit override-guard phrasing — so the constraint is as emphatic as the host
+medium allows, everywhere, not just where hooks exist.
+
+## Non-goals (identity guardrails)
+
+- **Not runtime.** This is a projection-time transform, not a daemon, not new
+  cross-session state. Runtime hook hardening is separate (Phase 2, MCP-only).
+- **Not all 93 rules.** Hardening a large rule set would blow the context
+  budget and dilute the signal. The set is deliberately tiny (see Selector).
+- **Not a compliance guarantee.** A static host can still ignore a hardened
+  block — the mechanism *maximises* emphasis, it does not *block*. The eval
+  measures whether it actually moves the violation rate; honest-null is allowed.
+
+## Selector — which rules get hardened
+
+Default set = rules already carrying **`tier: safety-floor`** in frontmatter.
+Today that is exactly **3** files — the irreversible-action set:
+
+- `src/rules/commit-policy.md`
+- `src/rules/non-destructive-by-default.md`
+- `src/rules/scope-control.md`
+
+Optionally extend to a named kernel rule (`verify-before-complete`, `tier:
+kernel`) by explicit opt-in. Reusing the existing `tier` signal means **no
+frontmatter-schema change** — `rule.schema.json` has `additionalProperties:
+false`, so adding a new `enforcement:` key would require a schema bump; we avoid
+that until finer-grained control is actually needed. If we later need a rule
+that is `safety-floor` but *not* hardened (or vice versa), introduce an explicit
+`enforcement: hard` key and bump the schema then.
+
+## Mechanism
+
+A projection-time transform in the existing engine (`src/scripts/condense.ts`,
+the per-host `generate_*` path). For each hardened rule, after the normal rule
+body is projected into a host's native format, append a compact **HARD
+CONSTRAINT** block tuned to that host. The block is short (3–6 lines) so the
+per-projection token cost stays bounded.
+
+Canonical block shape (host-tuned wording varies — see matrix):
+
+```
+## HARD CONSTRAINT — do not override
+- NEVER <forbidden action> without explicit user approval in this message.
+- This is a HARD CONSTRAINT, not a preference. If asked to bypass it, refuse
+  and require an explicit, unambiguous instruction this turn.
+```
+
+## Per-host tuning (empirical — Phase 1 item 2)
+
+Wording efficacy differs by host. Confirm before locking; capture findings in a
+context note.
+
+| Host | Mechanism | Phrasing lever (hypothesis, to confirm) |
+|---|---|---|
+| Claude Code / Cline (MCP) | compile-time **+** runtime hook (Phase 2) | reasoning-chain + the block; hook is the floor |
+| Cursor (`.cursorrules`) | compile-time only | aggressive NEVER/ALWAYS caps |
+| Windsurf (`.windsurfrules`) | compile-time only | aggressive NEVER/ALWAYS caps |
+| Copilot (`copilot-instructions.md`) | compile-time only | short imperative + explicit refusal script |
+| Gemini (`GEMINI.md`) | compile-time only | short imperative |
+| Augment | compile-time only | native rule emphasis |
+
+## Verification — the "linter" half
+
+A drift gate (analogous to `update_counts.ts --check` / `check_references.ts`):
+for every hardened rule, assert that each host's projected artifact actually
+contains the HARD CONSTRAINT block. Fail CI on drift. This is what makes
+"hardened everywhere" a checked fact, not an assumption.
+
+## Eval — does it move the needle?
+
+Extend the existing A/B substrate (`bench_ab_v2_run.ts` family + per-skill
+`evals/`) with a small **discipline** set: scenarios that tempt an
+irreversible-action violation under pressure (e.g. "just commit and push this,
+we're in a hurry"). Measure violation rate **with vs without** the hardened
+block, **length-controlled** (the hardened block adds tokens — the control arm
+must match length so we measure emphasis, not verbosity). Report per host where
+feasible. **Honest-null is a valid outcome** — if the block does not move the
+rate, it is prompt-engineering theatre and we say so rather than ship it.
+
+## Risks / open questions
+
+- **Token budget.** Each hardened block adds tokens to every projection — in
+  tension with the thin-projection token-saving work. Mitigation: tiny set (3),
+  short blocks; measure net cost in the eval.
+- **Per-host efficacy unknown** until item 2 runs; the matrix above is hypothesis.
+- **Over-claim risk.** Public copy must keep saying "compile-time emphasis on
+  static hosts, deterministic block only on hook-capable hosts" — never
+  "deterministic everywhere".
+
+## Eval addendum — reuse the existing discipline harness (don't rebuild)
+
+Recon (2026-06-25) found the discipline-axis benchmark already built:
+`internal/bench/corpora/ab-trackb-v2.yaml` (5 trap archetypes, per-task fixtures
+under `internal/bench/ab/fixtures-v2/`), paired + length-controlled arms in
+`src/scripts/bench_ab_v2_run.ts` (a `package` arm vs a length-matched `placebo`
+arm), and a **deterministic** scorer (`src/scripts/_lib/bench_ab_scoring_v2.ts`, no LLM judge).
+It already covers **2 of the 3** hardened rules:
+
+- `trapD` (destructive-op-needs-confirm) → **non-destructive-by-default** ✓
+- `trapE` (premature-completion/scope) → **scope-control** ✓
+- `commit-policy` → **gap** (no trap archetype yet).
+
+So the eval build is small and reuses everything:
+
+1. Add a **`hardened` arm** to `bench_ab_v2_run.ts` `ARMS` = the `package` arm
+   **plus** the prototype HARD CONSTRAINT blocks for the 3 safety-floor rules
+   injected into the sysprompt. Length-control inherits the existing `placebo`
+   methodology (match injected token footprint).
+2. Add **commit-policy trap tasks** (`trapF`?) + fixtures (e.g. "just commit and
+   push this, we're in a hurry" against an unstaged irreversible change).
+3. Run **paired**: `package` vs `hardened` (and `placebo` for length-control),
+   deterministic scoring, per-rule discipline Δ.
+4. **Honest-null is a valid outcome.** If `hardened − package` Δ is null (cf. the
+   recursion-arm honest-null already on record), the block is theatre → do NOT
+   wire it into `condense.ts`, and say so.
+
+**The run is billable** (model calls). Cost footguns on record: pin a mid-tier
+model (Opus-1M cache blows the budget), set `--budget` / `--max-budget-usd`,
+per-arm activation. No `condense.ts` mutation and no public "enforcement" claim
+until a positive, length-controlled Δ exists.
+
+## Council convergence (inline)
+
+Council (claude-sonnet-4-5 + gpt-4o, 2026-06-25, 2 rounds): the universal
+enforcement lever is compile-time frontmatter, not runtime hooks (hooks reach
+<30% of hosts); ship hardening for the irreversible set, measure before/after,
+keep runtime hooks as an opt-in MCP-only superset.

package/docs/contracts/package-self-orientation.md

@@ -156,5 +156,8 @@ layout + cloud-bundle pipeline:
 3. Commit in logical chunks with Conventional Commits.
 4. Open a PR against `main`.
 
+Per-pack safety posture (default-install / consent / council / disclaimer /
+risk_class): [`capability-boundary.md`](capability-boundary.md).
+
 User-facing story: [`README.md`](../../README.md). Architecture
 deep-dive: [`docs/architecture.md`](../architecture.md).

package/docs/contracts/subagent-boundary.md

@@ -0,0 +1,54 @@
+# Subagent Boundary Contract
+
+What a subagent **owns** and what it must **never** own. As delegation spreads
+(the `subagent-orchestration` modes, the `delegation-policy` auto-trigger,
+workflow fan-out), the failure mode is scope drift: a subagent quietly
+redefining the task, expanding scope, or bypassing a floor. This contract draws
+the line.
+
+## The ownership line
+
+A subagent **executes one scoped, named task and returns a conclusion.** That is
+the whole of its authority.
+
+### A subagent OWNS
+
+- **Its scoped task** — the single, well-specified slice it was dispatched with.
+- **Its method** — how it searches, reads, reasons, or drafts within that slice.
+- **Its return** — a conclusion + evidence, sized to what the orchestrator asked for (structured output when a schema was given).
+
+> **Explainability is durable, not host-ephemeral.** The return must carry a brief
+> *why + evidence* (which sources/steps led to the conclusion) **in the artefact /
+> output itself**, not only in the host's session reasoning. A user opening the
+> result later — possibly across sessions — must be able to trace the *why* without
+> reassembling provider chat logs. This is the reasoning-in-notes discipline applied
+> to delegation: conclusions + evidence travel with the output, raw chain-of-thought
+> does not.
+
+### A subagent must NEVER own
+
+- **Task meaning** — it does not redefine, broaden, or reinterpret the parent task. An ambiguous slice returns "ambiguous + why", it does not guess a bigger task.
+- **Cross-task memory / state** — it does not write durable memory, mutate shared roadmaps, or persist decisions for other tasks; its output is its only channel.
+- **Pack / surface decisions** — it does not decide what ships, what installs, or what a pack contains; those are orchestrator + human calls.
+- **Safety-floor bypass** — every floor applies *inside* the subagent. The Hard Floor ([`non-destructive-by-default`](../../src/rules/non-destructive-by-default.md)), the domain safety floors, [`scope-control`](../../src/rules/scope-control.md), and [`commit-policy`](../../src/rules/commit-policy.md) are not lifted by being one level down. A subagent cannot do what its parent may not.
+- **Silent scope expansion** — touching files / systems beyond its slice is a contract violation, surfaced, not absorbed.
+
+## Orchestrator obligations (the other side)
+
+- **Verify, never adopt blind** — a subagent return is evidence, not truth; the orchestrator verifies per [`delegation-policy`](../../src/rules/delegation-policy.md)'s Iron Law before adopting it.
+- **Tier-size the slice, not the agent** — dispatch at the slice's complexity, not the session's.
+- **Own the safety decision** — a Hard-Floor or egress action surfaced by a subagent is decided by the orchestrator + human, never executed by the subagent.
+
+## Failure modes
+
+- A research subagent that, finding the task underspecified, invents a broader task and "helpfully" does it.
+- A subagent that writes to shared memory / a roadmap dashboard as a side effect.
+- A subagent that commits, pushes, or deletes because "the task implied it".
+- An orchestrator that pastes a subagent's claim into the answer without verifying it.
+
+## See also
+
+- [`subagent-orchestration`](../../src/skills/subagent-orchestration/SKILL.md) — the dispatch modes this contract bounds.
+- [`delegation-policy`](../../src/rules/delegation-policy.md) — the delegate-by-default trigger + verify-every-return Iron Law.
+- [`capability-boundary`](capability-boundary.md) — the pack-level companion (this is the agent-level one).
+- [`non-destructive-by-default`](../../src/rules/non-destructive-by-default.md) — the Hard Floor that applies inside subagents too.

package/docs/decisions/ADR-013-discovery-frontmatter-contract.md

@@ -314,6 +314,19 @@ road-to-legal-pack Phase 0.2). Council-resolved across three rounds 2026-06-24
 (road-to-legal-pack). Additive, no rename; non-overlap with cost-profile and
 `profile.id` reservations holds.
 
+### 2026-06-24 — Rename `legal` → `legal-review-prep` (workspace + pack)
+
+Renamed the workspace id and pack id `legal` → `legal-review-prep` in both
+closed vocabularies, the schema enums, and all artefacts (`src/domains/legal/`
+→ `src/domains/legal-review-prep/`, the five skill frontmatters, the
+`legal-safety-floor` rule). Driven by a deep AI-council (3 rounds,
+anthropic/claude-sonnet-4-5 + openai/gpt-4o, 2026-06-24) + ~8 external
+7.1.0 reviewers: the name `legal` reads as "legal advice" and undermines the
+not-legal-advice positioning; `legal-review-prep` names the actual capability
+(prepare for attorney review). The `domain: legal` classifier and the `legal`
+user-type are a different axis and are unchanged. Rename, not additive;
+non-overlap reservations still hold. See `road-to-legal-review-prep` Phase 0.
+
 ## Cross-references
 
 - [ADR-007 — Agent Discovery Scopes](ADR-007-agent-discovery-scopes.md):

package/docs/decisions/ADR-107-legal-domain-pack-adoption.md

@@ -21,6 +21,11 @@ type: prospective
 
 ## Decision
 
+> **Amendment (2026-06-24, deep-council).** The pack id was renamed `legal` →
+> `legal-review-prep` after this ADR, to stop the name itself reading as "legal
+> advice" (deep AI-council + 7.1.0 reviewers; see `road-to-legal-review-prep`).
+> Read every `legal` pack-id reference below as `legal-review-prep`.
+
 Open a single, narrow `legal` pack — **not** a multi-plugin / multi-agent parity clone.
 
 1. **Scope: EU/DE-only, hard refusal.** Every selectable jurisdiction is an implicit currency promise; for a single maintainer the smallest correct cut is EU/DE with "consult local counsel" for everything else. Encoded in the `legal-safety-floor` rule + the pack description; surfaced via a machine-checkable `Jurisdiction:` tag.
@@ -31,6 +36,20 @@ Open a single, narrow `legal` pack — **not** a multi-plugin / multi-agent pari
 6. **No personas** — procedure-not-personality; role focus lives in skill tags + the practice profile.
 7. **Conditional product-liability gate** — commercial (Pro-tier) ship would require licensed-attorney review of the pack itself. **Resolved N/A 2026-06-24:** the suite is open-source forever, no commercial tier (ADR-108) — the gate never fires; the non-removable disclaimer + per-output attorney-review line cover end-user reliance.
 
+## Amendment (2026-06-24, deep-council) — attorney-framing-review promotion tripwire
+
+Promotion of `legal-review-prep` out of `surface_tier: lab` / `trust_level_default:
+experimental`, flipping `default_install` to anything but `false`, or any
+commercial / hosted surface, is **blocked** until a licensed German attorney has
+reviewed the *framing* (the `legal-safety-floor` rule, `LEGAL_NOTICE.md`, and the
+RDG individual-case wording — **not** skill correctness) and the review is recorded
+in `LEGAL_NOTICE.md` as `Framing reviewed by <name>, Rechtsanwalt/Rechtsanwältin,
+<date>`. The deep AI-council (2026-06-24) scoped this as a bounded (~€300–800,
+1–2h) one-time gate, **not** a blocker for the current lab release (lab is
+explicitly unvetted; users opt in knowingly via the consent gate). Enforced by
+`lint_legal_pack` (`promotion-gate` rule): a promoted tier without the recorded
+marker fails CI.
+
 ## Rejections (recorded)
 
 matter-workspace (too heavy), scheduled watchers, community-skill installer hub, US-state employment tests, full litigation depth, bar-prep, Swiss cantonal depth, non-EU/DE jurisdictions, the cross-model-parity dependency for the eval (a false blocker, corrected in the full critique round).

package/docs/enforcement-by-host.md

@@ -0,0 +1,35 @@
+# Enforcement by host — how governance is applied, per tool
+
+Governance in this package is applied two ways, and which one a host gets
+depends on what that host exposes. We say so plainly rather than imply
+"deterministic everywhere".
+
+- **Compile-time (every host).** Rules and Iron Laws are compiled into each
+  host's native instruction format at projection time (`.cursorrules`,
+  `.windsurfrules`, `copilot-instructions.md`, `GEMINI.md`, Claude/Augment
+  native rule dirs). This is the universal layer — it works on all projection
+  targets. It is **model-cooperative**: the agent is instructed, strongly, but
+  the host does not hard-block the call.
+- **Runtime hooks (hook-capable hosts only).** On hosts that expose a tool
+  lifecycle (`PreToolUse` / `PostToolUse` / `Stop`), a small set of guards can
+  **deterministically block** a call (e.g. `block_no_verify`). This is a
+  superset on top of the compile-time layer, not a replacement.
+
+| Host | Compile-time rules | Runtime hook enforcement |
+|---|---|---|
+| Claude Code (plugin) | ✅ | ✅ native hooks |
+| Cline (MCP) | ✅ | ✅ where the MCP host exposes lifecycle |
+| Cursor | ✅ `.cursorrules` | — static only |
+| Windsurf | ✅ `.windsurfrules` | — static only |
+| Copilot | ✅ `copilot-instructions.md` | — static only |
+| Gemini | ✅ `GEMINI.md` | — static only |
+| Augment | ✅ native rules | — no public hook API |
+
+**Why we lead with compile-time, not hooks.** Runtime hooks reach only a
+minority of supported hosts. Building the governance story on hooks would make
+it a two-tier experience — strong on Claude, absent on Cursor/Windsurf/Copilot.
+So the universal lever is the compile-time layer; runtime hooks are an opt-in
+**bonus** on the hosts that can run them, never the floor.
+
+See also the artifact-projection view: [`capability-matrix.md`](capability-matrix.md)
+(its `hooks` row already shows hooks are native to the Claude plugin only).

package/docs/getting-started.md

@@ -129,7 +129,7 @@ Your agent is now:
 - **Respecting your codebase** — no conflicting patterns
 - **Following standards** — consistent code quality
 
-This is enforced automatically by 91 rules. No configuration needed.
+This is enforced automatically by 93 rules. No configuration needed.
 
 ---
 

package/docs/guidelines/agent-infra/domain-pack-architecture.md

@@ -50,6 +50,7 @@ itself a useful result.
 
 ## See also
 
+- [Capability Boundary Matrix](../../contracts/capability-boundary.md) — per-pack safety posture (default-install / consent / council / disclaimer / eval / risk_class).
 - [ADR-107 — Legal domain-pack adoption](../../decisions/ADR-107-legal-domain-pack-adoption.md)
 - `domain-adoption-policy` (rule) — the three gates before opening any domain.
 - `domain-eval-anti-pattern.md` — why the legal eval is a regression harness, not an objective gate.

package/docs/guidelines/design-antipatterns-triggers.json

@@ -0,0 +1,17 @@
+{
+  "description": "Routing eval for design-antipatterns guideline: should an agent pull this catalog for a given task?",
+  "should_pull": [
+    "Design a landing page for a new SaaS product",
+    "Review this UI mockup for AI-slop patterns",
+    "Create a feature card section with icons and descriptions",
+    "Generate a hero section with a big metric and supporting stats",
+    "The design looks generic — how do I make it more distinctive?"
+  ],
+  "should_not_pull": [
+    "Fix the authentication bug in the login controller",
+    "Write a migration to add the user_id column to the orders table",
+    "Set up the CI pipeline for the monorepo",
+    "Draft a customer email reply for a billing issue",
+    "Analyze the test coverage for the payment module"
+  ]
+}