@event4u/agent-config 8.1.0 → 8.2.0

package/dist/agent-src/skills/tailwind-engineer/scripts/tailwind_config_gen.ts

@@ -23,9 +23,9 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
-const PROG = 'tailwind_config_gen.py';
+const PROG = 'tailwind_config_gen';
 
 // Mirror argparse's wrapped usage block (80-col default; non-tty). Used for
 // the invalid-choice / unrecognized-argument error paths.
@@ -553,9 +553,30 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     return success ? 0 : 1;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/skills/token-optimizer/SKILL.md

@@ -95,7 +95,7 @@ INTENT
   cited asset's trigger keywords or scope, update the matching row in
   this skill in the same commit (enforced by
   [`token-optimizer-maintenance`](../../rules/token-optimizer-maintenance.md)
-  rule + `scripts/check_token_optimizer_freshness.py` CI gate).
+  rule + `scripts/check_token_optimizer_freshness.ts` CI gate).
 - Tree must stay scannable (≤ 50 lines incl. labels). Catalog rows
   carry the long form.
 - Authoritative-link assets (`rtk` upstream, `markitdown` upstream,

package/dist/agent-src/skills/typography-system/SKILL.md

@@ -49,7 +49,7 @@ degrades gracefully: with no brand layer, only stage 1 runs.
    xl / 2xl / 3xl`; set `line-height` (1.5 for body, 1.2 for display);
    assign weights (400 body, 600–700 heading).
 4. **Emit DTCG `$type: "typography"` tokens** through `design-tokens`
-   (`scripts/tokens.py`) — add a `typography` section to `tokens.json` with
+   (`scripts/tokens.ts`) — add a `typography` section to `tokens.json` with
    `$type: "typography"` and `$value` objects carrying `fontFamily`,
    `fontSize`, `fontWeight`, `lineHeight`.
 5. **Verify** — confirm both chosen fonts exist on Google Fonts (check the

package/dist/agent-src/skills/validate-feature-fit/SKILL.md

@@ -52,13 +52,11 @@ Verify the request doesn't conflict with:
   shared abstraction (see
   [`memory-access`](../../../docs/guidelines/agent-infra/memory-access.md)):
 
-  ```python
-  from scripts.memory_lookup import retrieve
-  matches = retrieve(
-      types=["product-rules", "domain-invariants"],
-      keys=[<affected domain>, <affected paths>],
-      limit=5,
-  )
+  ```bash
+  agent-config memory:lookup \
+    --types product-rules,domain-invariants \
+    --key <affected domain> --key <affected path> \
+    --limit 5
   ```
 
   A product rule is an intentional business constraint

package/dist/agent-src/skills/verify-completion-evidence/SKILL.md

@@ -93,6 +93,15 @@ on the changed scope."* — not *"everything looks good"*.
 
 ## The end-of-work sequence
 
+**Gate zero:** when `quality.local_auto_run` is `false` or missing (the
+default), steps 2–3 below do NOT run — user runs quality tools
+manually, remote CI is the authoritative gate (see
+[`quality-tools` § Execution policy](../quality-tools/SKILL.md)). Run
+only the narrowest probe the claim needs (step 1, a `curl`, a syntax
+check on the edited file) and close with *"quality gates delegated to
+remote CI"* — never a pass claim for tools that did not run. Full
+sequence applies when `local_auto_run: true`.
+
 When all code changes are done and you are ready to report completion:
 
 1. **Targeted tests** — the test(s) covering the changed code pass.
@@ -176,7 +185,8 @@ When reporting completion to the user:
 * Do NOT suppress warnings or skip tests to pass the gate
 * Do NOT report only the last line of output — read the whole thing
 * Do NOT run the full quality pipeline between intermediate edits —
-  run it once at the end
+  and under `quality.local_auto_run: false` (the default) do NOT run
+  it at the end either; remote CI is the gate
 
 ## When to hand over to another skill
 
@@ -196,6 +206,8 @@ Before sending a completion message:
 * [ ] Output is quoted with numeric counts, not paraphrased
 * [ ] No warnings or skips are hidden
 * [ ] Targeted tests green → full suite green → quality pipeline clean
+      (`local_auto_run: true` only; under the default `false` state
+      "quality gates delegated to remote CI" instead)
 * [ ] `git status` reflects only the intended change set
 * [ ] If `git status --short` shows untracked files, the report lists
       them verbatim under "Untracked files"

package/dist/agent-src/templates/agent-settings.md

@@ -33,7 +33,7 @@ exists and is the source of truth.
 ## Template
 
 This block defines the personal and project-level settings that
-`scripts/install.py` (via `config/agent-settings.template.yml`)
+`scripts/install.ts` (via `config/agent-settings.template.yml`)
 writes to `.agent-settings.yml` on first install. Subsequent edits are
 made by the user directly or by the agent on request, following the
 [section-aware merge rules](../docs/guidelines/agent-infra/layered-settings.md#section-aware-merge-rules).
@@ -54,15 +54,16 @@ made by the user directly or by the agent on request, following the
 # essential = kernel + the lift-carrying rules (~3.3x, keeps the weak-host
 #             discipline lift; the full load's residual is not significant).
 # full      = every rule tier (~11.7x). EXPERIMENTAL opt-in only.
-# auto      = resolve per session against host-capabilities.yml
-#             (measured-null model -> off, otherwise -> essential).
+# auto      = resolve per session against host-capabilities.yml — measured
+#             NULL-lift model -> off; unmeasured Claude-family -> essential;
+#             unmeasured non-Claude -> off (P2 verdict, vendor-granular).
 #
 # When set, this key WINS over the legacy rule_loading_tier below
 # (mapping when absent: minimal->off, balanced->essential, full->full).
-# The installer fills it per preset (minimal->off, balanced->essential,
-# full->full — behaviour-preserving); `auto` is the evidence-gated flip
-# target (roadmap Phase 4).
-discipline_profile: essential
+# The installer fills it per preset: minimal->off, balanced->auto,
+# full->full (P2-verdict council 2026-07-07 — the non-Claude replication
+# failed, so auto enables the lift only where measured).
+discipline_profile: auto
 
 # --- Cost profile (legacy knob — superseded by discipline_profile) ---
 #
@@ -164,9 +165,9 @@ eloquent:
 #
 # Persistent JSONL log at agents/runtime/.agent-chat-history (git-ignored under /agents/runtime/).
 # Keeps a durable record of the conversation so a crashed or switched
-# agent session can be resumed. See scripts/chat_history.py for the API.
+# agent session can be resumed. See scripts/chat_history.ts for the API.
 #
-# Defaults below are placeholders — scripts/install.py substitutes them
+# Defaults below are placeholders — scripts/install.ts substitutes them
 # per rule_loading_tier (see config/profiles/*.ini).
 chat_history:
   # Log chat events to disk (true, false)
@@ -225,9 +226,9 @@ hooks:
   chat_history:
     enabled: true
     # Override path to the chat-history CLI (defaults to
-    # scripts/chat_history.py). Only set this when the script lives
+    # scripts/chat_history.ts). Only set this when the script lives
     # outside the standard location.
-    # script: scripts/chat_history.py
+    # script: scripts/chat_history.ts
 
 # --- Optional pipelines ---
 pipelines:
@@ -264,20 +265,28 @@ roadmap:
   #   end_of_roadmap = once, before archiving (default — fastest, fewest tokens)
   #   per_phase      = once after every completed phase
   #   per_step       = after every completed step (legacy; highest token cost)
-  # Iron Law `verify-before-complete` still applies — fresh output is
-  # mandatory before any "roadmap complete" claim, regardless of cadence.
+  # `quality.local_auto_run: false` (the default) suppresses local
+  # pipeline runs at EVERY cadence — remote CI is the gate; this knob
+  # only matters when `local_auto_run` is `true`.
   quality_cadence: end_of_roadmap
 
 # --- Quality / CI execution ---
 quality:
   # Run local quality / CI tasks and tests autonomously (true, false)
-  # true  = agent runs the quality pipeline whenever work is ready
-  #         for verification, without asking (default)
-  # false = agent asks before running quality tools / tests locally
+  # false = default. Agent NEVER runs quality tools / full test suites
+  #         proactively — and does not ask. The user runs them manually;
+  #         remote CI is the authoritative gate. The agent runs one ONLY
+  #         on: (1) explicit ask this turn (e.g. /quality-fix), (2) a
+  #         concrete CI failure — run exactly that failing check, or
+  #         (3) the new-gate carve-out below.
+  # true  = opt-in legacy: agent runs the quality pipeline whenever
+  #         work is ready for verification, without asking.
   # Carve-out: NEW CI gates / smoke tests / test files MUST run
   # locally regardless of this flag — without execution the gate is
-  # unverified evidence. Iron Law `verify-before-complete` still applies.
-  local_auto_run: true
+  # unverified evidence. Iron Law `verify-before-complete` still applies:
+  # suppressed runs are surfaced ("quality gates delegated to remote CI"),
+  # never claimed as passing.
+  local_auto_run: false
 
   # Wait for remote CI to finish on the PR / pipeline (true, false)
   # true  = poll GitHub check-runs / pipeline after push and report
@@ -436,9 +445,9 @@ verbosity:
   # it") in skill bodies. false = act and emit the result.
   intent_announcements: false
 
-  # Script stdout chatter from `scripts/*.py`, `scripts/*.sh`, and
+  # Script stdout chatter from `scripts/*.ts`, `scripts/*.sh`, and
   # `.augment/scripts/`. Read by the helper module
-  # `scripts/_lib/script_output.py`.
+  # `scripts/_lib/script_output.ts`.
   #   silent  = stderr only; success = no output
   #   minimal = one summary line per script (default)
   #   verbose = pre-Phase-10 behaviour (per-step prints)
@@ -515,7 +524,7 @@ linked_projects_max_files: 20000
 ## Settings Reference
 
 Personal and project-level settings (initial file written by
-`scripts/install.py`, edits follow the merge rules in
+`scripts/install.ts`, edits follow the merge rules in
 [`layered-settings`](../docs/guidelines/agent-infra/layered-settings.md#section-aware-merge-rules)).
 **Key paths use dot-notation** to denote nesting: `personal.user_name`
 lives under `personal:` in YAML.
@@ -544,18 +553,18 @@ the canonical narrative lives in
 | `chat_history.frequency` | `per_turn`, `per_phase`, `per_tool` | per profile | Logging granularity. Defaults: `minimal`→`per_turn`, `balanced`→`per_phase`, `full`→`per_tool`. |
 | `chat_history.max_size_kb` | integer | per profile | Max file size before overflow handling. Defaults: `minimal`→`128`, `balanced`→`256`, `full`→`512`. |
 | `chat_history.on_overflow` | `rotate`, `condense` | per profile | On overflow: `rotate` drops oldest entries; `condense` marks the file for summarization on the next turn. Defaults: `minimal`/`balanced`→`rotate`, `full`→`condense`. |
-| `chat_history.text_limits.{user,agent,tool,phase}` | integer (chars) | `user=0`, `agent=5000`, `tool=200`, `phase=200` | Per-entry-type text-length cap. `0` = verbatim, no slice. `N > 0` = collapse whitespace, slice to N chars, append `" … [+K chars]"` so the log self-reports truncation. Defaults match `DEFAULT_TEXT_LIMITS` in `scripts/chat_history.py`. |
+| `chat_history.text_limits.{user,agent,tool,phase}` | integer (chars) | `user=0`, `agent=5000`, `tool=200`, `phase=200` | Per-entry-type text-length cap. `0` = verbatim, no slice. `N > 0` = collapse whitespace, slice to N chars, append `" … [+K chars]"` so the log self-reports truncation. Defaults match `DEFAULT_TEXT_LIMITS` in `scripts/chat_history.ts`. |
 | `hooks.enabled` | `true`, `false` | `false` | Master switch for the work-engine hook layer. When `false` (default) the registry stays empty and golden replay is byte-stable. See [`agents/settings/contexts/work-engine-hooks.md`](../../../agents/settings/contexts/work-engine-hooks.md). |
 | `hooks.trace` | `true`, `false` | `false` | Emit per-event trace lines on stderr. Useful for debugging; off by default because it is noisy. |
 | `hooks.halt_surface_audit` | `true`, `false` | `true` | Defense-in-depth check that every halt surfaced by the dispatcher carries the expected shape. Cheap. |
 | `hooks.state_shape_validation` | `true`, `false` | `true` | Re-run the state schema validator on `AFTER_LOAD` and `BEFORE_SAVE`. Cheap, catches drift. |
 | `hooks.directive_set_guard` | `true`, `false` | `true` | Verify the dispatcher-resolved directive set matches the input envelope intent. Cheap, catches routing drift. |
 | `hooks.chat_history.enabled` | `true`, `false` | `true` | Register the chat-history hooks (`append` on `after_step`, `halt_append` on `on_halt`). Gated by **both** this flag AND `chat_history.enabled`; either off → no chat-history hook registers. Schema v4: every entry self-identifies via a 16-char session fingerprint, no ownership/sidecar layer. |
-| `hooks.chat_history.script` | path | `scripts/chat_history.py` | Override path to the chat-history CLI. Set only when the script lives outside the standard location. |
+| `hooks.chat_history.script` | path | `scripts/chat_history.ts` | Override path to the chat-history CLI. Set only when the script lives outside the standard location. |
 | `pipelines.skill_improvement` | `true`, `false` | `true` | When `true`: propose learning capture after meaningful tasks. When `false`: silent. Included in every profile except `custom`. |
 | `roadmap.skip_pre_run_gate` | `true`, `false` | `true` | When `true` (default): `/roadmap:process-step\|phase\|full` skips the interactive pre-run summary and starts the loop immediately — the resolved roadmap, cadence, and council are surfaced inline so an unwanted pick can still be aborted. When `false`: the loop shows the pre-run summary with numbered options (Go / Different roadmap / Different scope / Toggle council / Abort) and waits. The gate is always shown — regardless of this flag — when the roadmap is ambiguous (multiple active, none named) or a scope / cadence conflict has no sensible default. |
-| `roadmap.quality_cadence` | `end_of_roadmap`, `per_phase`, `per_step` | `end_of_roadmap` | When `/roadmap:process-step|phase|full` runs the project's quality pipeline. Default skips per-step / per-phase runs and gates only the final archival. `per_phase` runs once after every phase; `per_step` is the legacy verbose mode. Step checkboxes and the dashboard are always updated regardless. `verify-before-complete` still requires fresh output before any "roadmap complete" claim. |
-| `quality.local_auto_run` | `true`, `false` | `true` | When `true`: agent runs the project's quality pipeline (`task ci`, `make test`, `npm run check`, PHPStan, ECS, Rector, test suites) autonomously when work is ready for verification. When `false`: agent asks before running locally. **Carve-out**: NEW CI gates / smoke tests / test files MUST run locally regardless of this flag — without execution the new gate is unverified evidence. Iron Law `verify-before-complete` still applies; suppressed runs require the agent to surface the gap before claiming completion. |
+| `roadmap.quality_cadence` | `end_of_roadmap`, `per_phase`, `per_step` | `end_of_roadmap` | When `/roadmap:process-step|phase|full` runs the project's quality pipeline — only relevant when `quality.local_auto_run` is `true`; when it is `false` (the default) local pipeline runs are suppressed at every cadence and remote CI is the gate. Default skips per-step / per-phase runs and gates only the final archival. `per_phase` runs once after every phase; `per_step` is the legacy verbose mode. Step checkboxes and the dashboard are always updated regardless. |
+| `quality.local_auto_run` | `true`, `false` | `false` | When `false` (default): agent NEVER runs the project's quality pipeline (`task ci`, `make test`, `npm run check`, PHPStan, ECS, Rector, test suites) proactively — and does not ask. The user runs quality tools manually; remote CI is the authoritative gate. The agent runs one only on (1) an explicit ask this turn, (2) a concrete CI failure (run exactly that failing check), or (3) the new-gate carve-out. When `true`: opt-in legacy — agent runs the pipeline autonomously when work is ready for verification. **Carve-out**: NEW CI gates / smoke tests / test files MUST run locally regardless of this flag — without execution the new gate is unverified evidence. Iron Law `verify-before-complete` still applies; suppressed runs are surfaced ("quality gates delegated to remote CI"), never claimed as passing. |
 | `quality.wait_for_remote_ci` | `true`, `false` | `false` | When `true`: after `git push`, the agent polls GitHub check-runs / pipeline status on the PR and reports green / red before handing back. When `false`: agent pushes and hands back immediately; the user inspects CI themselves (default — saves agent runtime and tokens). |
 | `subagents.implementer_model` | model alias or empty | _(empty)_ | Model for implementer subagents. Empty = same tier as session model. See [subagent-configuration](../contexts/subagent-configuration.md). |
 | `subagents.judge_model` | model alias or empty | _(empty)_ | Model for judge subagents. Empty = one tier above implementer (opus if sonnet, sonnet if haiku). |

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -37,9 +37,9 @@ schema_version: 1
 # disables the pin (resolver picks the latest release; only safe for
 # greenfield projects). Ranges (^, ~, >=) are NOT supported.
 # CI guard: a release bump of `package.json` must update this value
-# in lockstep — see scripts/check_template_pin_drift.py (road-to-
+# in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "8.1.0"
+agent_config_version: "8.2.0"
 
 # --- Project identity ---
 project:
@@ -65,7 +65,7 @@ project:
 # module-aware surface skips its module branch — the project is
 # treated as a flat repo.
 #
-# Populated automatically by `scripts/install.py` on a fresh install
+# Populated automatically by `scripts/install.ts` on a fresh install
 # when an `app/Modules/`, `src/modules/`, `packages/`, `internal/`, or
 # similar shape is detected. Set manually for custom layouts. Lockable
 # via `locked_keys: [modules.root_paths]` for compliance-critical

package/dist/agent-src/templates/agents/memory/incident-learnings.example.yml

@@ -10,7 +10,7 @@
 # REDACTION IS MANDATORY — see road-to-engineering-memory.md.
 # Every entry is a PATTERN + CONSEQUENCE + GUARDRAIL.
 # Every entry that contains a customer name, internal URL, PII, or
-# secret is rejected by `scripts/check_memory.py`. No opt-out.
+# secret is rejected by `scripts/check_memory.ts`. No opt-out.
 #
 # BAD entry (auto-rejected):
 #   "On 2026-03-14 customer ACME hit a rate limit and Redis died."

package/dist/agent-src/templates/agents/proposal.example.md

@@ -6,7 +6,7 @@
 #
 # An agent drafting a rule/skill/guideline change in a consumer project
 # produces this doc and hands it to `upstream-contribute`. The gate
-# (`scripts/check_proposal.py`) verifies evidence, scope, and
+# (`scripts/check_proposal.ts`) verifies evidence, scope, and
 # portability before a PR is opened.
 #
 # Copy this file, fill every field, run `task check-proposal`, commit.
@@ -92,10 +92,10 @@ under `agents/drafts/<proposal_id>.md` and link from here.
 List the checks the draft MUST pass before the gate signs off. The
 gate auto-runs every item in this list.
 
-- [ ] Passes `scripts/skill_linter.py` with zero errors
-- [ ] Passes `scripts/check_portability.py` (no project-specific
+- [ ] Passes `scripts/skill_linter.ts` with zero errors
+- [ ] Passes `scripts/check_portability.ts` (no project-specific
       identifiers)
-- [ ] References in the draft all resolve (`check_references.py`)
+- [ ] References in the draft all resolve (`check_references.ts`)
 - [ ] Size within budget for its type (per `size-enforcement` rule)
 - [ ] `preservation-guard` check: if `Replaces existing`, justify
       the replacement below.

package/dist/agent-src/templates/copilot-instructions.md

@@ -127,7 +127,7 @@ resolve at agent runtime. The patterns below are correct by design:
   `.augment/skills/`, `.augment/commands/` via installer-managed
   symlinks. Missing-file reports here are renderer artifacts.
 - **Body-link forms `../docs/guidelines/...`** (single-up). This is
-  the post-rewrite shape produced by `scripts/condense.py`. The
+  the post-rewrite shape produced by `scripts/condense.ts`. The
   condensed `dist/agent-src/rules/` tree is one level deeper than the
   source `.agent-src.uncondensed/rules/`, so the rewriter collapses
   `../../docs/...` to `../docs/...`. Both forms are expected — one in

package/dist/agent-src/templates/github-workflows/memory-hygiene.yml

@@ -1,7 +1,7 @@
 # Memory Hygiene — template shipped by agent-config
 #
 # Copy this file to `.github/workflows/memory-hygiene.yml` in the consumer
-# project. It runs `scripts/check_memory.py` on a weekly schedule and
+# project. It runs `agent-config memory:check` on a weekly schedule and
 # opens (or updates) a single tracking issue when stale entries are
 # found in `agents/memory/`.
 #
@@ -9,9 +9,12 @@
 # is a review signal, not a merge blocker. See
 # `road-to-engineering-memory.md` Phase 4 for the rationale.
 #
+# Runtime: Node/tsx (py2ts migration) — the check runs through the
+# `@event4u/agent-config` package via npx (`memory:check` resolves a
+# local `scripts/check_memory.ts` customization first, then the packaged
+# copy); no Python required.
+#
 # Prerequisites:
-#   - `scripts/check_memory.py` copied from
-#     `.augment/templates/scripts/check_memory.py` into the consumer repo.
 #   - At least one file exists under `agents/memory/` — absence short-
 #     circuits the job with an informational log, no issue opened.
 
@@ -36,13 +39,10 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up Node
+        uses: actions/setup-node@v4
         with:
-          python-version: "3.12"
-
-      - name: Install PyYAML
-        run: pip install pyyaml
+          node-version: "22"
 
       - name: Short-circuit if no memory files
         id: has_memory
@@ -63,7 +63,7 @@ jobs:
             echo "## Memory hygiene report"
             echo
             echo '```'
-            python3 scripts/check_memory.py --path agents/memory
+            npx --yes @event4u/agent-config memory:check --path agents/memory
             exit_code=$?
             echo '```'
           } > staleness.md

package/dist/agent-src/templates/github-workflows/pr-risk-review.yml

@@ -9,6 +9,10 @@
 # under `.augment/templates/scripts/pr-risk-config.example.yml`). Without a
 # config file the script falls back to sensible cross-stack defaults.
 #
+# Runtime: Node/tsx (py2ts migration) — the classifiers ship inside the
+# `@event4u/agent-config` package and run through the package's own tsx
+# runner; no Python and no consumer-local script copy required.
+#
 # This workflow is purely informational — it does NOT block merges. Gate the
 # PR on a separate required check if you want a hard stop.
 
@@ -34,21 +38,26 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up Node
+        uses: actions/setup-node@v4
         with:
-          python-version: "3.12"
+          node-version: "22"
 
-      - name: Install dependencies
-        run: pip install pyyaml
+      - name: Install agent-config
+        run: npm install -g @event4u/agent-config
 
       - name: Classify risk
         id: risk
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        # Runs the packaged classifier via the package's own tsx runner; a
+        # consumer-local `scripts/pr_risk_review.ts` customization wins.
         run: |
-          python3 scripts/pr_risk_review.py \
+          PKG="$(npm root -g)/@event4u/agent-config"
+          SCRIPT="$PKG/dist/agent-src/templates/scripts/pr_risk_review.ts"
+          [ -f scripts/pr_risk_review.ts ] && SCRIPT=scripts/pr_risk_review.ts
+          node "$PKG/node_modules/tsx/dist/cli.mjs" "$SCRIPT" \
             --base "$BASE_SHA" \
             --head "$HEAD_SHA" \
             --config .github/pr-risk-config.yml \
@@ -100,7 +109,6 @@ jobs:
 
       - name: Classify review routing
         id: routing
-        if: hashFiles('scripts/pr_review_routing.py') != ''
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -109,7 +117,10 @@ jobs:
         # back to agents/ — matching the reviewer-awareness rule.
         # Missing data files emit a generic fallback, not an error.
         run: |
-          python3 scripts/pr_review_routing.py \
+          PKG="$(npm root -g)/@event4u/agent-config"
+          SCRIPT="$PKG/dist/agent-src/templates/scripts/pr_review_routing.ts"
+          [ -f scripts/pr_review_routing.ts ] && SCRIPT=scripts/pr_review_routing.ts
+          node "$PKG/node_modules/tsx/dist/cli.mjs" "$SCRIPT" \
             --base "$BASE_SHA" \
             --head "$HEAD_SHA" \
             --output routing-report.md \

package/dist/agent-src/templates/github-workflows/proposal-drift.yml

@@ -15,9 +15,12 @@
 # This workflow is intentionally read-only — it never blocks a PR and
 # never modifies the repo. It only opens / updates a tracking issue.
 #
+# Runtime: Node/tsx (py2ts migration) — the report runs through the
+# repo's own tsx runner (`./scripts-run`); no Python required.
+#
 # Prerequisites:
-#   - `scripts/memory_report.py` present in the repo (ships with the
-#     package).
+#   - `dist/agent-src/templates/scripts/memory_report.ts` present in the
+#     repo (ships with the package).
 #   - Proposals live under `agents/proposals/` with the schema defined
 #     in `dist/agent-src/templates/agents/proposal.example.md`.
 
@@ -45,13 +48,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up Node
+        uses: actions/setup-node@v4
         with:
-          python-version: "3.12"
+          node-version: "22"
 
-      - name: Install PyYAML
-        run: pip install pyyaml
+      - name: Install dependencies
+        run: npm ci
 
       - name: Build quarterly report
         id: report
@@ -63,7 +66,7 @@ jobs:
             echo "Accepted vs. retired for the last quarter."
             echo
             echo '```'
-            python3 scripts/memory_report.py --quarterly --format text
+            ./scripts-run dist/agent-src/templates/scripts/memory_report --format text
             echo '```'
             echo
             echo "Open proposals by stage:"

package/dist/agent-src/templates/github-workflows/roadmap-progress-check.yml

@@ -9,12 +9,10 @@
 # A green check here proves the dashboard reflects reality on every PR
 # that touches roadmaps.
 #
-# Prerequisites:
-#   - `.augment/scripts/update_roadmap_progress.py` installed by
-#     `task install` (or `./agent-config install`).
-#   - At least one file exists under `agents/roadmaps/` — absence
-#     short-circuits the check with a passing exit (consumer projects
-#     that haven't adopted roadmaps stay green).
+# Runtime: Node/tsx (py2ts migration) — the check runs through the
+# `@event4u/agent-config` package via npx; no Python, no local install
+# required. Absence of `agents/roadmaps/` short-circuits with a passing
+# exit (consumer projects that haven't adopted roadmaps stay green).
 #
 # This workflow is intentionally narrow: it only runs when relevant
 # files change, so it adds zero overhead to unrelated PRs.
@@ -27,12 +25,12 @@ on:
     paths:
       - "agents/roadmaps/**"
       - "agents/roadmaps-progress.md"
-      - ".augment/scripts/update_roadmap_progress.py"
+      - ".augment/scripts/update_roadmap_progress.ts"
   pull_request:
     paths:
       - "agents/roadmaps/**"
       - "agents/roadmaps-progress.md"
-      - ".augment/scripts/update_roadmap_progress.py"
+      - ".augment/scripts/update_roadmap_progress.ts"
   workflow_dispatch: {}
 
 permissions:
@@ -45,12 +43,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-node@v4
         with:
-          python-version: "3.11"
+          node-version: "22"
 
       - name: Run roadmap progress check
-        run: python3 .augment/scripts/update_roadmap_progress.py --check
+        run: npx --yes @event4u/agent-config roadmap:progress-check
 
       - name: Remediation hint on failure
         if: failure()
@@ -58,6 +56,6 @@ jobs:
           echo "::error::roadmaps-progress.md is stale."
           echo "Regenerate locally with one of:"
           echo "  ./agent-config roadmap:progress"
+          echo "  agent-config roadmap:progress"
           echo "  task roadmap-progress"
-          echo "  python3 .augment/scripts/update_roadmap_progress.py"
           echo "Then commit and push the updated agents/roadmaps-progress.md."

package/dist/agent-src/templates/hooks/pre-commit-frontmatter

@@ -16,22 +16,23 @@
 set -e
 
 # Only act on commits that touch the source-of-truth artefact tree
-# (or the linter / vocabulary that govern it).
+# (or the linter / vocabulary that govern it). The runtime is Node/tsx
+# (py2ts migration) — the linter runs through the package tsx runner,
+# never python3.
 staged="$(git diff --cached --name-only --diff-filter=ACMR 2>/dev/null || true)"
 case "$staged" in
-  *.agent-src.uncondensed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
+  *.agent-src.uncondensed/*.md*|*src/agent-src/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.ts*)
     : ;;
   *)
     exit 0 ;;
 esac
 
-# Resolve the linter — prefer the consumer-shipped path, fall back to
-# the source-of-truth copy when run from inside the package itself.
+# Resolve the linter — a source-repo artefact (the frontmatter contract
+# governs the source tree; consumer repos have nothing to lint).
 script=""
 for cand in \
-  ".augment/scripts/lint_artefact_frontmatter.py" \
-  "dist/agent-src/scripts/lint_artefact_frontmatter.py" \
-  "scripts/lint_artefact_frontmatter.py"; do
+  "src/scripts/lint_artefact_frontmatter.ts" \
+  ".augment/scripts/lint_artefact_frontmatter.ts"; do
   if [ -f "$cand" ]; then
     script="$cand"
     break
@@ -39,17 +40,26 @@ for cand in \
 done
 
 if [ -z "$script" ]; then
-  echo "⚠️  pre-commit-frontmatter: lint_artefact_frontmatter.py not found." >&2
-  echo "    Run \`task install\` (or \`./agent-config install\`) and retry." >&2
+  echo "⚠️  pre-commit-frontmatter: lint_artefact_frontmatter.ts not found." >&2
   echo "    Skipping check — letting commit through." >&2
   exit 0
 fi
 
-if ! python3 "$script" --quiet >/dev/null 2>&1; then
+run_lint() {
+  if [ -x "./scripts-run" ]; then
+    ./scripts-run src/scripts/lint_artefact_frontmatter --quiet
+  elif [ -x "node_modules/.bin/tsx" ]; then
+    node_modules/.bin/tsx "$script" --quiet
+  else
+    npx tsx "$script" --quiet
+  fi
+}
+
+if ! run_lint >/dev/null 2>&1; then
   echo "❌  Artefact frontmatter lint failed (ADR-013 contract violation)." >&2
   echo "" >&2
   echo "    Re-run for details:" >&2
-  echo "      python3 $script" >&2
+  echo "      ./scripts-run src/scripts/lint_artefact_frontmatter" >&2
   echo "      task lint-artefact-frontmatter" >&2
   echo "" >&2
   echo "    Common fixes:" >&2