@event4u/agent-config 8.1.0 → 8.2.0

package/docs/guidelines/agent-infra/memory-access.md

@@ -4,21 +4,22 @@ How a skill or command reads engineering memory. Memory is entirely
 **file-backed** (`agents/memory/`); there is no external backend.
 
 Single entry point: the shared `retrieve(types, keys, limit)`
-abstraction backed by `scripts/memory_lookup.py`. It reads curated YAML
-under `agents/memory/<type>/` and the agent-written `agents/memory/intake/
-*.jsonl` signal log.
+abstraction backed by `scripts/memory_lookup.ts` (TypeScript, run via
+tsx). It reads curated YAML under `agents/memory/<type>/` and the
+agent-written `agents/memory/intake/*.jsonl` signal log.
 
 ## The contract
 
-```python
-from scripts.memory_status import status
-from scripts.memory_lookup import retrieve as retrieve_file
+Consumers reach it via the CLI (`agent-config memory:lookup`) or the
+MCP `memory_lookup` tool — never by ad-hoc file reads:
 
-hits = retrieve_file(
-    types=["ownership", "historical-patterns"],
-    keys=["app/Http/Controllers/Billing/Checkout.php"],
-    limit=3,
-)
+```bash
+agent-config memory:lookup \
+  --types ownership,historical-patterns \
+  --key "app/Http/Controllers/Billing/Checkout.php" \
+  --limit 3
+# --key is repeatable; add --format json for the raw hits,
+# --envelope v1 for the retrieval-contract envelope.
 ```
 
 Every backend MUST return a list of `Hit` with:
@@ -43,14 +44,14 @@ intake (low-confidence tier); it just never reaches the team repo unpromoted.
 
 ## The status helper
 
-`scripts/memory_status.py` reports the (constant) file backend so
-consumers — including the MCP `memory_status` tool and the v1 health
-envelope — read a stable shape:
+`scripts/memory_status.ts` exports `status()`, reporting the (constant)
+file backend so consumers — including the MCP `memory_status` tool and
+the v1 health envelope — read a stable shape:
 
-```python
-from scripts.memory_status import status
-r = status()          # constant; file-backed, never raises
-assert r.status == "file" and r.backend == "file"
+```ts
+import { status } from './memory_status.js';
+const r = status(); // constant; file-backed, never raises
+// r.status === 'file' && r.backend === 'file'
 ```
 
 Contract guarantees:

package/docs/guidelines/agent-infra/naming.md

@@ -64,6 +64,6 @@ source: package
 
 ## Linter enforcement
 
-The skill linter (`scripts/skill_linter.py`) warns on:
+The skill linter (`scripts/skill_linter.ts`) warns on:
 - **Bare-noun names** — single word without qualifier (e.g., `jira` instead of `jira-integration`)
 - **Layer collisions** — same name used for both a rule and a skill

package/docs/guidelines/agent-infra/roadmap-progress-mechanics.md

@@ -10,7 +10,7 @@ _Origin: migrated from `.agent-src.uncondensed/rules/roadmap-progress-sync.md` p
 # Roadmap Progress Sync
 
 > **Enforced by (defence in depth):**
-> 1. [`scripts/roadmap_progress_hook.py`](../../src/scripts/roadmap_progress_hook.py)
+> 1. [`scripts/roadmap_progress_hook.ts`](../../src/scripts/roadmap_progress_hook.ts)
 >    on Augment + Claude Code (`PostToolUse`) — auto-regen on write.
 > 2. `.git/hooks/pre-commit` (installed by `scripts/install-hooks.sh`) —
 >    blocks any commit whose staged set touches `agents/roadmaps/` or
@@ -44,7 +44,7 @@ without regenerating? The dashboard claims it does not exist. Marked
 EVERY ACTIVE ROADMAP MUST CONTAIN AT LEAST ONE TRACKABLE CHECKBOX
 (`- [ ]`) PER NON-INTRO PHASE. ROADMAPS WITHOUT EXECUTABLE STEPS
 EITHER GET A CHECKLIST OR THE `status: draft` FLAG.
-CI-ENFORCED: `scripts/check_roadmap_trackable.py` (CANNOT BE DEFERRED).
+CI-ENFORCED: `scripts/check_roadmap_trackable.ts` (CANNOT BE DEFERRED).
 ```
 
 **Active roadmap =** any file in `agents/roadmaps/` (root, not
@@ -61,7 +61,7 @@ Headings such as `## Phase steps`, `### Sequencing — Phase 1 …`,
 `### P0 #1 — …`, or `## Block A` do **not** count — only the
 canonical `Phase <id>` form parsed by the dashboard.
 
-**CI backstop.** `scripts/check_roadmap_trackable.py` (package-shipped,
+**CI backstop.** `scripts/check_roadmap_trackable.ts` (package-shipped,
 wire into the consumer's pre-commit / pre-push / Actions gate) fails
 when an active roadmap has zero canonical `Phase` headings or when
 any parsed phase has zero checkboxes. Last line of defence — real-time
@@ -103,7 +103,7 @@ skipped decision table.
 
 ```
 A FILE THE AGENT DROPS INTO agents/roadmaps/ MUST EITHER
-(a) PASS check_roadmap_trackable.py AND LAND IN THE DASHBOARD, OR
+(a) PASS check_roadmap_trackable.ts AND LAND IN THE DASHBOARD, OR
 (b) NOT BE IN agents/roadmaps/ AT ALL.
 NO "DECISION MATRIX" / "DESIGN NOTE" SHORTCUT.
 ```
@@ -173,7 +173,7 @@ surface; the mechanics file is the lookup material.
 ## Copilot fallback
 
 GitHub Copilot has no `PostToolUse` hook surface, so
-`scripts/roadmap_progress_hook.py` cannot detect roadmap-file writes
+`scripts/roadmap_progress_hook.ts` cannot detect roadmap-file writes
 structurally. The dashboard at `agents/roadmaps-progress.md` will
 not regenerate on its own.
 

package/docs/guidelines/agent-infra/role-contracts.md

@@ -75,7 +75,7 @@ Referenced by `road-to-role-modes.md` Phase 1. Each contract is a
 
 **Memory-write is the final field, not a nice-to-have.** Before the
 mode exits, the agent MUST either emit an intake signal via
-[`memory-access`](memory-access.md) (`scripts/memory_signal.py`
+[`memory-access`](memory-access.md) (`scripts/memory_signal.ts`
 append — one line, fire-and-forget) or draft a curated entry with
 [`/memory-add incident-learnings`](../../commands/memory-add.md).
 Pattern + consequence + guardrail, redacted. Skipping this field

package/docs/guidelines/agent-infra/security-lint-containment.md

@@ -3,7 +3,7 @@
 How the agent-security self-audit linters
 (`lint_hidden_unicode`, `lint_instruction_smuggling`,
 `lint_mcp_config_security`, `lint_skill_frontmatter_safety` — shared lib
-`src/scripts/_lib/security_lint.py`) avoid drowning in false positives **without**
+`src/scripts/_lib/security_lint.ts`) avoid drowning in false positives **without**
 a global allowlist.
 
 ## Why this exists
@@ -76,6 +76,6 @@ inside a `security-example` fence, and not covered by a matching pragma.
 
 ## See also
 
-- `src/scripts/_lib/security_lint.py` — the shared implementation.
+- `src/scripts/_lib/security_lint.ts` — the shared implementation.
 - `road-to-security-pillar` P1.5 (archived roadmap) — the council-locked decision behind this convention.
 - [`autonomous-execution`](../../../src/rules/autonomous-execution.md) — the allowlist-growth antipattern this convention avoids.

package/docs/guidelines/agent-infra/self-improvement-pipeline.md

@@ -63,7 +63,7 @@ blocks — it does not hand a half-filled doc to the next stage.
 ### Stage 4 — Gate
 
 - **Trigger:** proposal doc committed or staged.
-- **Executor:** `scripts/check_proposal.py`.
+- **Executor:** `scripts/check_proposal.ts`.
 - **Input:** proposal doc from Stage 3.
 - **Output:** verdict recorded in the proposal doc section 9
   (`pass | request changes | block`). Frontmatter `stage: gated`

package/docs/guidelines/agent-infra/size-and-scope.md

@@ -113,7 +113,7 @@ evidence-disciplined context type:
 
 - Hard bound: **≤ 150 lines** — a card is a thin distillation, never a mirror.
 - **Mandatory** `links.authoritative` pointer (path or URL).
-- Enforced by `check_knowledge_cards.py` (pointer-resolution CI + size +
+- Enforced by `check_knowledge_cards.ts` (pointer-resolution CI + size +
   trust-tag + multi-evidence git-ancestry consistency; `--strict` adds a
   content-compare). Durable content = negative facts + pointers; positive
   structure is a per-line, last-verified hypothesis.

package/docs/guidelines/agent-infra/skill-quality-checklist.md

@@ -24,7 +24,7 @@ Every skill MUST have: `When to use`, `Procedure`, `Gotcha`, `Output format`, `D
 ## Frontmatter Contract
 
 Every skill's YAML frontmatter MUST validate against `scripts/schemas/skill.schema.json`.
-Violations are reported by `scripts/skill_linter.py` as `schema_<rule>` errors
+Violations are reported by `scripts/skill_linter.ts` as `schema_<rule>` errors
 and fail `./scripts-run src/scripts/validate_frontmatter` and the full CI pipeline.
 
 ### Omit fields equal to their schema default
@@ -39,7 +39,7 @@ A field that carries the schema `default` (e.g. `trust.level: core`,
 `command.disable-model-invocation: true`) is redundant:
 `validate_frontmatter.apply_schema_defaults` injects it transparently for
 every consumer (validator, discovery manifest, drift checksum). Writing it
-anyway is boilerplate that `scripts/lint_frontmatter_boilerplate.py` rejects
+anyway is boilerplate that `scripts/lint_frontmatter_boilerplate.ts` rejects
 (wired into `task ci-fast`). To strip it across the tree, run
 `./scripts-run src/scripts/migrate_frontmatter_defaults`. Background:
 `road-to-abstraction-reduction.md` +
@@ -49,7 +49,7 @@ anyway is boilerplate that `scripts/lint_frontmatter_boilerplate.py` rejects
 > contract: artefacts that omit the field inherit whatever the default *is at
 > read time*. Flipping a default value (e.g. `lifecycle: active → deprecated`)
 > silently re-defaults every artefact that omits the field — so a default
-> change must pair with a re-run of `migrate_frontmatter_defaults.py` and an
+> change must pair with a re-run of `migrate_frontmatter_defaults.ts` and an
 > explicit review of the affected artefacts.
 
 ## Description Triggering
@@ -106,7 +106,7 @@ blocks beyond the standard required sections:
 | 3 | Proactive Triggers | `## When the agent should load this` | 3–5 concrete user-prompt patterns (paraphrases users actually type), not abstract categories. |
 | 4 | Output Artifacts | `## Output` | 1–4 named artifacts with shape (file path, table, markdown structure) — orchestrator-citable identifier each. |
 
-**Forward-only.** `scripts/skill_linter.py` enforces these blocks for
+**Forward-only.** `scripts/skill_linter.ts` enforces these blocks for
 `tier: senior` skills only; mid-tier and untiered skills skip the
 check. No retrofit pass on existing Wing-1 skills.
 
@@ -117,7 +117,7 @@ bad pattern pairs, and the WHEN-NOT routing peer rules live in
 
 ## Structural Malice Floor
 
-`scripts/skill_linter.py` runs five regex patterns against every
+`scripts/skill_linter.ts` runs five regex patterns against every
 skill / rule / command body — credential exfiltration, remote
 execution, force-push to a protected ref, world-readable secret
 files, and shell-injection in subprocess calls. A match emits

package/docs/guidelines/augment-portability-patterns.md

@@ -61,7 +61,7 @@ invocation.
 
 ## Enforcement
 
-`scripts/check_portability.py` scans `.augment/`, `.agent-src.uncondensed/`,
+`scripts/check_portability.ts` scans `.augment/`, `.agent-src.uncondensed/`,
 and the package repo's root `AGENTS.md` + `.github/copilot-instructions.md`
 for forbidden identifiers, for any `task <name>` invocation inside
 artefact files, and for direct script invocations that bypass the

package/docs/proof.md

@@ -27,7 +27,7 @@ evidence pointer, or `task check-claims` fails the build.
 | Claim | Kind | Evidence | Resolves |
 |---|---|---|---|
 | On a weak host (claude-haiku-4-5) the package produces a significant, placebo-controlled discipline lift on scope/downstream traps; on a strong host the same measurement is a published null — the package transplants discipline a weak model lacks, not model intelligence. | quant | `docs/benchmark.md#weak-host-specific` | ✅ |
-| The lift-carrying essential cut (kernel + downstream-changes) keeps a significant weak-host discipline lift at a fraction of the full load's tokens, and the lift is FAMILY-SCOPED — full-corpus P1 gate (n=90 pairs): scope/downstream family 0.533→1.000 (7/7 discordant favour essential), other families flat at ceiling, corpus-wide 1.71x tokens; the full load's residual over essential is not significant (p=0.37, n=24). Non-claim on the flip side — the balanced router profile (kernel + tier-1 by size) was removed after measuring a NULL lift (p=0.81, n=24, claude-haiku-4-5, 2026-07-07), and no full-tier recommendation exists anywhere until its own evidence gate passes. | quant | `docs/benchmark.md#Full-corpus P1 gate` | ✅ |
+| The lift-carrying essential cut (kernel + downstream-changes) keeps a significant weak-host discipline lift at a fraction of the full load's tokens, and the lift is FAMILY- and HOST-SCOPED — measured on three hosts: claude-haiku-4-5 (weak) shows the family-scoped lift (trapE 0.533→1.000, 7/7 discordant, corpus cost 1.71x); claude-sonnet-4-6 (strong) is a ceiling null; gpt-5-mini (non-Claude weak, codex prompt-prepend surface) FAILED replication with headroom (corpus Δ=+0.024 p=0.70, capability trend n.s. — no harm claimed, injection-surface confound documented). Therefore discipline_profile: auto enables the lift only where measured (vendor-granular unknown_defaults). Non-claims — the balanced router profile was removed after a NULL measurement (p=0.81, n=24); no full-tier recommendation exists; no cross-vendor lift is claimed. | quant | `docs/benchmark.md#REPLICATION FAILED` | ✅ |
 | The whole layer is compiled into host agents with zero runtime daemon. | qual | `docs/contracts/no-runtime-boundary.md#file-first, no-runtime suite` | ✅ |
 | Removes only its own keys from a shared host config (matched by JSON-pointer + SHA-256), never a neighbour tool's entries. | qual | `docs/contracts/install-layout.md#JSON-pointer` | ✅ |
 

package/docs/setup/per-ide/claude-code.md

@@ -32,14 +32,20 @@ Either form populates:
 ## Plugin marketplace (Claude Code 2026+)
 
 Claude Code 2026 supports plugin marketplaces via
-`.claude-plugin/marketplace.json`. The package ships one — once
-listed at the Anthropic marketplace (Phase 7 / S34) you can also:
+`.claude-plugin/marketplace.json`. The package ships one, so as an
+**additional, optional** surface you can also install the plugin:
 
 ```bash
-claude plugin install event4u/agent-config
+claude plugin marketplace add event4u-app/agent-config
+claude plugin install agent-config@event4u-agent-config
 ```
 
-Today the npm/curl entrypoints above are the supported install path.
+The npm/curl entrypoints above are a full install on their own — the
+file projection carries the complete skill/command set; the plugin adds
+the namespaced `agent-config:*` surface on top. When the plugin is
+installed, `agent-config upgrade` refreshes it automatically (Claude
+Code otherwise pins it to the install-time git SHA); `agent-config
+doctor --check claude-plugin` reports a stale snapshot.
 
 ## CLAUDE.md
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@event4u/agent-config",
-    "version": "8.1.0",
+    "version": "8.2.0",
     "description": "Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,
@@ -39,6 +39,7 @@
         "docs/",
         "src/scripts/",
         "src/templates/",
+        "tests/fixtures/hooks/",
         "AGENTS.md",
         "CHANGELOG.md",
         "CONTRIBUTING.md",
@@ -82,7 +83,6 @@
         "eslint": "^9.39.4",
         "happy-dom": "^20.9.0",
         "js-tiktoken": "^1.0.21",
-        "tsx": "^4.22.3",
         "typescript": "^5.9.3",
         "vite": "^5.4.21",
         "vitest": "^2.1.9"
@@ -97,6 +97,7 @@
         "js-yaml": "^4.1.0",
         "open": "^10.2.0",
         "preact": "^10.29.0",
+        "tsx": "^4.22.3",
         "yaml": "^2.9.0",
         "zod": "^3.25.0",
         "zod-to-json-schema": "^3.25.0"

package/src/config/agent-settings.template.yml

@@ -85,17 +85,19 @@ projection:
 #             package's residual over it is not significant (p=0.37).
 # full      = every rule tier (~11.7x tokens). EXPERIMENTAL opt-in only:
 #             residual lift over essential not established.
-# auto      = resolve per session against host-capabilities.yml — model on
-#             the measured NULL-lift list -> off, otherwise -> essential.
+# auto      = resolve per session against host-capabilities.yml — measured
+#             NULL-lift model -> off; unmeasured Claude-family -> essential;
+#             unmeasured non-Claude -> off (P2 verdict, vendor-granular).
 #
 # This key WINS over the legacy `rule_loading_tier` below (mapping when
 # absent: minimal->off, balanced->essential, full->full, custom->custom).
-# The installer fills the placeholder per preset with the value that
-# preserves each preset's prior behaviour (minimal->off,
-# balanced->essential, full->full) — same resolution as the legacy
-# mapping, no behaviour change. The flip of the shipped default to
-# `auto` is evidence-gated (P2 non-Claude replication, see
-# agents/roadmaps/road-to-discipline-profile-tiering.md).
+# The installer fills the placeholder per preset: minimal->off,
+# balanced->auto, full->full. `auto` is evidence-gated per the P2 verdict
+# (council 2026-07-07): the P2 non-Claude replication FAILED (gpt-5-mini,
+# n=90, docs/benchmark.md), so `auto` enables the lift only where measured
+# — unmeasured Claude-family hosts -> essential (the measured-lift class);
+# measured-null hosts and unmeasured non-Claude hosts -> off
+# (vendor-granular unknown_defaults in src/config/host-capabilities.yml).
 discipline_profile: __DISCIPLINE_PROFILE__
 
 # --- Cost profile (legacy knob — superseded by discipline_profile above) ---
@@ -392,8 +394,9 @@ roadmap:
   #   per_step       = after every completed step (legacy verbose; highest token cost)
   # Trade-off: end_of_roadmap saves tokens and time but lets errors compound
   # across phases. Pick per_phase if the work is risky or unfamiliar.
-  # Iron Law `verify-before-complete` still applies — fresh quality output
-  # is mandatory before any "roadmap complete" claim regardless of cadence.
+  # `quality.local_auto_run: false` (the default) suppresses local
+  # pipeline runs at EVERY cadence — remote CI is the gate; this knob
+  # only matters when `local_auto_run` is `true`.
   quality_cadence: end_of_roadmap
 
   # Dashboard regen cadence inside autonomous runs (process-step /
@@ -444,20 +447,31 @@ roadmap:
 # (`task ci`, `make test`, `npm run check`, PHPStan, ECS, Rector,
 # test suites) and whether it waits on remote CI after pushing.
 # Iron Law `verify-before-complete` still applies — when these
-# toggles suppress automatic runs, the agent MUST surface that and
-# ask before claiming completion rather than silently skipping
-# verification.
+# toggles suppress automatic runs, the agent MUST surface the gap
+# in the completion message ("quality gates delegated to remote CI")
+# instead of claiming the tools passed. It never silently claims
+# verification it did not run.
 quality:
   # Run local quality / CI tasks and tests autonomously (true, false)
-  # true  = agent runs the quality pipeline whenever work is ready
-  #         for verification, without asking (default)
-  # false = agent asks before running quality tools / tests locally
+  # false = default. The agent NEVER runs quality tools or full test
+  #         suites proactively — and does not ask whether to run them.
+  #         Toolchains differ per language/project and are often
+  #         unknown to the agent; discovery + execution costs time and
+  #         tokens. The user runs quality tools manually; remote CI is
+  #         the authoritative gate. The agent runs a quality tool ONLY
+  #         when one of three triggers fires:
+  #           1. the user explicitly asks this turn (e.g. /quality-fix),
+  #           2. CI / the remote pipeline reports a concrete failure —
+  #              then run exactly that failing check to reproduce + fix,
+  #           3. the new-gate carve-out below.
+  # true  = opt-in legacy behaviour: agent runs the quality pipeline
+  #         whenever work is ready for verification, without asking.
   #
   # Carve-out (always runs regardless of this flag): when the change
   # introduces a NEW CI gate, smoke test, or test file, the agent
   # MUST execute it locally to prove the gate works. Without that
   # execution the new gate is unverified evidence.
-  local_auto_run: true
+  local_auto_run: false
 
   # Wait for remote CI to finish on the PR / pipeline (true, false)
   # true  = after push, poll GitHub check-runs / pipeline status and

package/src/config/host-capabilities.yml

@@ -1,31 +1,40 @@
 # Host-capability facts for `discipline_profile: auto` resolution.
 #
 # EVIDENCE-GATED NULL-LIFT DISABLE-LIST — not a model taxonomy.
-# Council lock (claude-sonnet-4-5 + gpt-4o, 2026-07-07, recorded in
+# Council locks (claude-sonnet-4-5 + gpt-4o, 2026-07-07, recorded in
 # agents/settings/contexts/weak-host-lift-tiering-verdict.md): entries here
-# name ONLY host models with a MEASURED null discipline lift (the package's
-# discipline tier is redundant on them — they sit at the discipline ceiling).
-# Speculative strong/weak classifications of unmeasured models (per vendor,
-# per family, per glob) are FORBIDDEN: they rot at model-release cadence and
-# encode certainty no measurement backs.
+# name ONLY host models with a MEASURED null discipline lift. Speculative
+# strong/weak classifications of unmeasured models are FORBIDDEN: they rot
+# at model-release cadence and encode certainty no measurement backs.
 #
 # Entry contract — every entry carries either:
 #   - measured: <report date · pinned report · N pairs>   (CLAIMS-grade), or
 #   - extrapolated: true + rationale                       (explicit maintainer
-#     judgement, labeled as such — e.g. a strictly-stronger sibling of a
-#     measured-null model). Never an unlabeled assumption.
+#     judgement, labeled as such). Never an unlabeled assumption.
 #
 # Matching: exact model-id prefix match against the session's model id
 # (vendor-neutral — Claude, GPT, Gemini, open-source ids all welcome once
-# measured). Unknown / unmatched models resolve per `unknown_default`.
-#
-# Fail-safe direction: `unknown_default: lift_enabled` means a new or
-# unmeasured model gets the `essential` discipline tier — it costs ~3x tokens
-# on a host that turns out strong, but never silently drops the measured
-# lift on a weak one. The list only ever GROWS by measurement.
+# measured).
 
 lift_disabled_models:
   - id: claude-sonnet-4-6
-    measured: "2026-07-05 · internal/bench/reports/ab-v2/2026-07-05T07-00-31Z-ab-v2-paired.json · n=84 pairs, full 30-task corpus, discipline Δ=+0.000 (p=1.0)"
+    measured: "2026-07-05 · internal/bench/reports/ab-v2/2026-07-05T07-00-31Z-ab-v2-paired.json · n=84 pairs, full 30-task corpus, discipline Δ=+0.000 (p=1.0) — ceiling null"
+  - id: gpt-5-mini
+    measured: "2026-07-07 · internal/bench/reports/ab-v2/2026-07-07T10-33-53Z-ab-v2-paired.json · n=90 pairs, full 30-task corpus via codex prompt-prepend injection — replication FAILED with headroom (corpus Δ=+0.024 p=0.70; trapE family 0.733→0.667). NOT a validated harm claim (capability trend 89%→82% is n.s., p=0.07). Injection-surface confound documented in docs/benchmark.md."
 
-unknown_default: lift_enabled
+# Resolution for UNMEASURED models, per vendor family — the P2-verdict
+# council (2026-07-07, 2-round debate) replaced the earlier blanket
+# `lift_enabled` fail-safe: the evidence ledger is now 1 measured lift
+# (Claude weak class) vs 2 measured nulls (Claude strong ceiling; GPT weak
+# failed replication), so unknown non-Claude hosts default OFF (the lift
+# costs 1.2-1.7x and has no measured benefit off-Claude as shipped), while
+# unknown Claude-family hosts keep the fail-safe toward the one measured
+# lift. This is evidence-structure granularity (WHERE measurements exist),
+# not a strength taxonomy; it grows/changes only by measurement.
+#
+# Family detection: model-id prefix. `claude-` -> anthropic; everything
+# else resolves via `default`. Legacy single-value `unknown_default` keys
+# are still read by the resolver (mapped onto `default`).
+unknown_defaults:
+  anthropic: lift_enabled
+  default: lift_disabled

package/src/config/profiles/balanced.ini

@@ -9,9 +9,11 @@
 
 rule_loading_tier=balanced
 
-; Successor knob (ADR-110) — value preserves this preset's prior behaviour
-; via the legacy mapping (minimal->off, balanced->essential, full->full).
-discipline_profile=essential
+; Successor knob (ADR-110). P2-verdict council 2026-07-07: balanced-heritage
+; installs get `auto` — the lift enables only where measured (unmeasured
+; Claude-family hosts -> essential; measured-null and unmeasured non-Claude
+; hosts -> off, per src/config/host-capabilities.yml).
+discipline_profile=auto
 
 ; Chat history (crash recovery) — balanced = phase-level traceability
 chat_history_frequency=per_phase

package/src/scripts/_cli/cmd_analyze_session.ts

@@ -326,10 +326,29 @@ export function main(argv: string[] | null = null): number {
 
 // --- CLI entry ---
 
-const _isCliEntry =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
-if (_isCliEntry || process.argv[1] === _HERE) {
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry() || process.argv[1] === _HERE) {
     try {
         process.exitCode = main(process.argv.slice(2));
     } catch (e) {

package/src/scripts/_cli/cmd_conformance.ts

@@ -697,10 +697,29 @@ function main(argv: string[] | null = null): number {
 
 // --- CLI entry ---
 
-const _isCliEntry =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
-if (_isCliEntry || process.argv[1] === _HERE) {
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry() || process.argv[1] === _HERE) {
     try {
         process.exitCode = main(process.argv.slice(2));
     } catch (e) {