@event4u/agent-config 8.1.0 → 8.3.0

package/dist/agent-src/commands/security-audit-config.md

@@ -79,6 +79,6 @@ Overall: B (84/100)
 
 ## See also
 
-- [`lint_agent_security`](../../../src/scripts/lint_agent_security.py) — the self-audit (our own corpus) sibling.
+- [`lint_agent_security`](../../../src/scripts/lint_agent_security.ts) — the self-audit (our own corpus) sibling.
 - [`untrusted-input-defense`](../../rules/untrusted-input-defense.md), [`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md) — the always-on prevention rules.
 - [`/threat-model`](../threat-model/command.md), [`judge-security-auditor`](../skills/judge-security-auditor/SKILL.md) — deep-pass dispatch.

package/dist/agent-src/commands/sync-agent-settings.md

@@ -57,9 +57,9 @@ Use when:
 
 The sync script ships in the installed package. Resolve in order:
 
-1. `./agent-config/scripts/sync_agent_settings.py` — CLI wrapper at the project root.
-2. `vendor/event4u/agent-config/scripts/sync_agent_settings.py` — Composer.
-3. `node_modules/@event4u/agent-config/scripts/sync_agent_settings.py` — npm.
+1. `./agent-config/scripts/sync_agent_settings.ts` — CLI wrapper at the project root.
+2. `vendor/event4u/agent-config/scripts/sync_agent_settings.ts` — Composer.
+3. `node_modules/@event4u/agent-config/scripts/sync_agent_settings.ts` — npm.
 
 Target is always `<project_root>/.agent-settings.yml`.
 
@@ -106,7 +106,7 @@ separate decision from reconciling structure.
 
 ## `--check` mode
 
-`sync_agent_settings.py --check` exits **2** if the file is out of
+`sync_agent_settings.ts --check` exits **2** if the file is out of
 sync, **0** otherwise — suitable for CI. Emit no diff prompt in
 check-only workflows; report the drift and let the pipeline decide.
 
@@ -128,15 +128,15 @@ check-only workflows; report the drift and let the pipeline decide.
 ## Cloud Behavior
 
 On cloud surfaces (Claude.ai Web, Skills API) this command is **fully inert** —
-there is no `.agent-settings.yml` on disk, no `scripts/sync_agent_settings.py`
+there is no `.agent-settings.yml` on disk, no `scripts/sync_agent_settings.ts`
 to call, and no template/profile preset reachable. Settings reconciliation
 is a local-agent concern.
 
 ## See also
 
-- [`scripts/sync_agent_settings.py`](../../../scripts/sync_agent_settings.py) — the helper
+- [`scripts/sync_agent_settings.ts`](../../../scripts/sync_agent_settings.ts) — the helper
 - [`config/agent-settings.template.yml`](../../../config/agent-settings.template.yml) — canonical template
 - [`config/profiles/`](../../../config/profiles/) — profile presets
 - [`layered-settings`](../docs/guidelines/agent-infra/layered-settings.md) — the merge rules this command enforces
-- [`scripts/install.py`](../../../scripts/install.py) — first-install path; this command handles the update path
+- [`scripts/install.ts`](../../../scripts/install.ts) — first-install path; this command handles the update path
 - [`/sync-gitignore`](sync-gitignore.md) — sibling command for the `.gitignore` block

package/dist/agent-src/commands/sync-gitignore/fix.md

@@ -58,9 +58,9 @@ Use when:
 
 Same resolution order as [`/sync-gitignore`](../sync-gitignore.md):
 
-1. `./agent-config/scripts/sync_gitignore.py`
-2. `vendor/event4u/agent-config/scripts/sync_gitignore.py`
-3. `node_modules/@event4u/agent-config/scripts/sync_gitignore.py`
+1. `./agent-config/scripts/sync_gitignore.ts`
+2. `vendor/event4u/agent-config/scripts/sync_gitignore.ts`
+3. `node_modules/@event4u/agent-config/scripts/sync_gitignore.ts`
 
 Target is `<project_root>/.gitignore`. If no `.gitignore` exists,
 stop — there is nothing to fix:

package/dist/agent-src/commands/sync-gitignore.md

@@ -69,10 +69,10 @@ Use when:
 
 The sync script ships in the installed package. Resolve in order:
 
-1. `./agent-config/scripts/sync_gitignore.py` — if the CLI wrapper
+1. `./agent-config/scripts/sync_gitignore.ts` — if the CLI wrapper
    directory exists at the project root.
-2. `vendor/event4u/agent-config/scripts/sync_gitignore.py` — Composer.
-3. `node_modules/@event4u/agent-config/scripts/sync_gitignore.py` — npm.
+2. `vendor/event4u/agent-config/scripts/sync_gitignore.ts` — Composer.
+3. `node_modules/@event4u/agent-config/scripts/sync_gitignore.ts` — npm.
 
 Target is always `<project_root>/.gitignore`. If no `.gitignore` exists,
 stop and tell the user — the package does not create one unilaterally:
@@ -136,6 +136,6 @@ root-level patterns (not user-added lines), prefer
 
 ## See also
 
-- [`scripts/sync_gitignore.py`](../../../scripts/sync_gitignore.py) — the helper
+- [`scripts/sync_gitignore.ts`](../../../scripts/sync_gitignore.ts) — the helper
 - [`config/gitignore-block.txt`](../../../config/gitignore-block.txt) — canonical block body
 - [`scripts/install.sh`](../../../scripts/install.sh) — installer integration (same source of truth, `--skip-gitignore` to opt out)

package/dist/agent-src/commands/work.md

@@ -8,7 +8,7 @@ replaces: []
 tier: 0
 visibility: visible
 skills: [refine-prompt, command-routing]
-description: Drive a free-form prompt end-to-end through refine → score → plan → implement → test → verify → report — Option-A loop over the `work_engine` Python engine, confidence-band gated, no auto-git.
+description: Drive a free-form prompt end-to-end through refine → score → plan → implement → test → verify → report — Option-A loop over the `work_engine` engine, confidence-band gated, no auto-git.
 suggestion:
   eligible: true
   trigger_description: "build this, implement this, drive this end-to-end"
@@ -80,7 +80,7 @@ Run the engine with the state file on every iteration:
     [--prompt-file prompt.txt --persona <name>]   # first call only
 ```
 
-The dispatcher wires `PYTHONPATH` and routes to the engine module
+The dispatcher resolves the engine module (TypeScript, run via tsx)
 internally. `./agent-config` is the only supported entry point in
 consumer repos — do not call the engine module directly.
 
@@ -121,7 +121,7 @@ Once the gate releases, the rest of the loop is identical to
 `review-changes` directives flow through the same dispatch table. The
 `run-tests` directive resolves the consumer's runner via the
 [`toolchain-resolver`](../contexts/execution/toolchain-resolver.md)
-(`work_engine/stack/runner.py`) — pest / phpunit / vitest / jest /
+(`work_engine/stack/runner.ts`) — pest / phpunit / vitest / jest /
 pytest / go / cargo, fast suites by default — instead of assuming a
 single stack.
 

package/dist/agent-src/contexts/communication/rules-auto/skill-quality-mechanics.md

@@ -20,7 +20,7 @@ Make descriptions "pushy" — explicit about when to fire:
 - Name 2+ concrete triggers — domains, symptoms, file types, user phrasing.
 - End with: `... even if they don't explicitly ask for \`<skill-name>\`.`
 - Avoid hedges: `may help with`, `can be useful for`, `covers various`.
-- **Keep it ≤ 200 characters.** `scripts/skill_linter.py` warns at
+- **Keep it ≤ 200 characters.** `scripts/skill_linter.ts` warns at
   `description_too_long` above this. If the pushy tail pushes you over, cut
   adjectives, drop the second example phrasing, or collapse a list — do
   **not** drop the trigger vocabulary or the `even if ...` tail.

package/dist/agent-src/contexts/communication/rules-auto/slash-command-routing-policy-mechanics.md

@@ -4,9 +4,9 @@ Lookup table for the `slash-command-routing-policy` rule. Lists the
 locked clusters and their sub-commands so the rule itself can stay at
 its current LOC while still reflecting the full surface. Source of
 truth for the cluster names is
-[`docs/contracts/command-clusters.md`](../../../../../../docs/contracts/command-clusters.md);
+[`docs/contracts/command-clusters.md`](../../../../../../../docs/contracts/command-clusters.md);
 this file mirrors that contract for runtime lookup. Linter:
-`scripts/check_cluster_patterns.py` (verifies dispatcher shape).
+`scripts/check_cluster_patterns.ts` (verifies dispatcher shape).
 
 ## Locked clusters and sub-commands
 

package/dist/agent-src/contexts/contracts/artifact-engagement-flow.md

@@ -127,7 +127,7 @@ schema's `EngagementSchemaError` cases.
 ### The four enforcement layers
 
 1. **Schema (write gate)** — `EngagementEvent.validate()` in
-   `telemetry/engagement.py` runs `check_id_redaction` over `task_id`
+   `telemetry/engagement.ts` runs `check_id_redaction` over `task_id`
    and every `consulted` / `applied` artefact id. The CLI exits `1`
    when this fires; nothing reaches the JSONL.
 2. **Aggregator (read gate)** — `aggregator._iter_events` calls

package/dist/agent-src/contexts/contracts/command-suggestion-flow.md

@@ -50,7 +50,7 @@ agent emits the block as the first and ONLY thing this turn
 
 ## Scoring breakdown
 
-Per match, `match.py` computes:
+Per match, `match.ts` computes:
 
 | Component | Weight | Source |
 |---|---|---|
@@ -60,7 +60,7 @@ Per match, `match.py` computes:
 | Structural bonus (ticket key, file path) | +0.05, sets `has_structural_bonus=True` | runtime |
 
 Phrase length matters — longer matched evidence wins ties. The score is
-clamped to `[0.0, 1.0]`. `rank.py` then enforces the floor and the
+clamped to `[0.0, 1.0]`. `rank.ts` then enforces the floor and the
 heuristics in
 [`adr-command-suggestion.md`](adr-command-suggestion.md#anti-noise-heuristics).
 
@@ -107,7 +107,7 @@ without the rule active.
 
 ## Anti-noise heuristics — when not to fire
 
-`rank.py` returns `[]` when:
+`rank.ts` returns `[]` when:
 
 - Top score is below `confidence_floor` (default `0.6`).
 - Single match within `floor + 0.1` and no structural bonus.
@@ -118,13 +118,14 @@ Structural bonuses (ticket key, file path) override every suppressor.
 
 ## Hardening tests — what we lock down
 
-`tests/test_command_suggester.py` covers 84 cases (matcher, rank,
-cooldown, sanitiser, render, settings, directive). The 9 GT-CS goldens
-(`tests/test_command_suggester_goldens.py`) lock end-to-end shape.
+`tests/scripts/command_suggester.test.ts` covers the matcher, rank,
+cooldown, sanitiser, render, settings, and directive cases. The GT-CS
+goldens (`tests/scripts/command_suggester_goldens.test.ts`) lock
+end-to-end shape.
 Together they enforce:
 
 - **No execution without user pick** — engine has no execute path.
-- **No echo-trigger** — `sanitize.py` strips the previous block's shape.
+- **No echo-trigger** — `sanitize.ts` strips the previous block's shape.
 - **No code-block triggers** — `/commit` inside ``` ``` ``` ``` stays inert.
 - **No conversation hijack** — `enabled: false` and senior gates → silent.
 - **No multi-question stack** — only a numbered-options block, no extra ask.

package/dist/agent-src/contexts/execution/evidence-discipline.md

@@ -30,7 +30,7 @@ Three buckets:
 - **Gaps** — missing evidence the decision needs (negative facts in the making).
 
 Feeds the plan. Not a forensic log, not hard enforcement. Produce cheaply via
-`evidence_report.py` so it never gets skipped.
+`evidence_report.ts` so it never gets skipped.
 
 ## Provenance and freshness
 
@@ -43,7 +43,7 @@ Feeds the plan. Not a forensic log, not hard enforcement. Produce cheaply via
   (`.git/MERGE_HEAD`, `.git/CHERRY_PICK_HEAD`, or `.git/rebase-merge`/`rebase-apply`
   present), do **not** read an intermediate tree — stop and surface it (R4 P6,
   hole-3). *(`.git/REBASE_HEAD` excluded — lingers as stale ref after completed
-  rebase, not a live-op marker.)* `evidence_report.py git-state` is the
+  rebase, not a live-op marker.)* `evidence_report.ts git-state` is the
   deterministic check.
 - **Across sessions:** always re-read. No file hashing, no content-hash theater.
 

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -16,7 +16,7 @@ Search both locations:
 
 - `agents/roadmaps/*.md` (project root)
 - `{module_root}/*/{agent_folder}/roadmaps/*.md` (module-scoped; resolve
-  via `scripts/_lib/agent_settings.py::enumerate_modules()`. Laravel
+  via `scripts/_lib/agent_settings.ts::enumerate_modules()`. Laravel
   shape: `app/Modules/*/agents/roadmaps/*.md`)
 
 **Exclude** `template.md`, `archive/`, `skipped/`, and `later/` (`later/` holds
@@ -115,9 +115,14 @@ only: lines matching `commit:` / `git commit` / `Commit phase`.
 Read both keys from `.agent-settings.yml` once and cache for the whole
 run. Do **not** re-read inside the step loop.
 
-**`roadmap.quality_cadence`** — when to run the quality pipeline:
+**`roadmap.quality_cadence`** — when to run the quality pipeline.
+Only relevant when `quality.local_auto_run` is `true`; `false` or
+missing (default) → local pipeline runs suppressed at EVERY cadence —
+remote CI is the gate, run-end report states *"quality gates delegated
+to remote CI"* instead of a pass claim (new-gate carve-out steps still
+run once).
 
-| Value | Pipeline runs |
+| Value | Pipeline runs (`local_auto_run: true` only) |
 |---|---|
 | `end_of_roadmap` (default) | Once, before archival (§ 6) |
 | `per_phase` | At every phase boundary + § 6 |
@@ -125,7 +130,7 @@ run. Do **not** re-read inside the step loop.
 
 Missing / unreadable / unknown → fall back to `end_of_roadmap`.
 The Iron Law [`verify-before-complete`](../../rules/verify-before-complete.md)
-still mandates fresh quality output before any "complete" claim.
+still forbids claiming quality output that was not produced.
 
 **`roadmap.dashboard_regen_cadence`** — when to run the dashboard
 subprocess between steps:

package/dist/agent-src/contexts/execution/toolchain-resolver.md

@@ -17,15 +17,16 @@ tools and run the right one — instead of a per-stack command explosion.
 
 ## 1. The resolver
 
-`work_engine/stack/runner.py` is the engine. A command resolves the
-toolchain once and runs the returned commands:
-
-```python
-from work_engine.stack.runner import resolve_toolchain, write_config
-result = resolve_toolchain(project_root, include_slow=False, include_e2e=False, php_only=False)
-write_config(project_root, result)   # caches agents/runtime/state/toolchain.json
-for r in result.selected:
-    run(r.command)                   # e.g. "vendor/bin/pest", "npx vitest run"
+`work_engine/stack/runner.ts` (TypeScript, run via tsx) is the engine.
+A command resolves the toolchain once and runs the returned commands:
+
+```ts
+import { resolve_toolchain, write_config } from './work_engine/stack/runner.js';
+const result = resolve_toolchain(projectRoot, { include_slow: false, include_e2e: false, php_only: false });
+write_config(projectRoot, result); // caches agents/runtime/state/toolchain.json
+for (const r of result.selected) {
+    run(r.command);                // e.g. "vendor/bin/pest", "npx vitest run"
+}
 ```
 
 Resolution is filesystem-cheap (a handful of small manifest reads) and

package/dist/agent-src/contexts/execution/verification-mechanics.md

@@ -9,7 +9,19 @@ incidents.
 **Size budget:** ≤ 4,000 chars. Tracked under Phase 6 of
 `road-to-pr-34-followups`.
 
-## When to run what — timing matters
+## Gate zero — `quality.local_auto_run` (default `false`)
+
+`false` or missing → **never run quality tools or full test suites
+proactively — never ask**. User runs them manually; **remote CI is the
+authoritative gate.** Run one ONLY on: (1) explicit ask this turn,
+(2) concrete CI failure — run exactly that failing check, (3) new-gate
+carve-out (a NEW gate/test this change introduces runs once to be
+proven). Completion wording: *"quality gates delegated to remote CI"* —
+never a pass claim for tools that did not run. Narrow probes proving
+the specific change (one `--filter` test, `curl`, syntax check on the
+edited file) stay allowed. Everything below applies when `true`.
+
+## When to run what — timing matters (`local_auto_run: true`)
 
 **Quality tools (PHPStan, Rector, ECS) run ONCE at the very end** — not after every edit.
 Do NOT run quality checks between tasks if you have more work to do.

package/dist/agent-src/packs/README.md

@@ -46,4 +46,4 @@ Removing a pack reverts cleanly; no data is lost.
    plain prose.
 4. Add the row to the table above.
 5. Open a PR; reviewer validates against the schema by hand until
-   `scripts/lint_packs.py` lands.
+   `scripts/lint_packs.ts` lands.

package/dist/agent-src/presets/README.md

@@ -23,4 +23,4 @@ an ADR but MUST match the schema enforced by `task lint-config-schema`.
 
 - [`docs/contracts/config-presets.md`](../../docs/contracts/config-presets.md) — schema, cost enforcement, resolution chain.
 - [`docs/contracts/profile-system.md`](../../docs/contracts/profile-system.md) — profile axis.
-- [`scripts/config/presets.py`](../../scripts/config/presets.py) — loader.
+- [`scripts/config/presets.ts`](../../scripts/config/presets.ts) — loader.

package/dist/agent-src/profiles/README.md

@@ -26,4 +26,4 @@ an ADR but MUST match the schema enforced by `task lint-config-schema`.
 
 - [`docs/contracts/profile-system.md`](../../docs/contracts/profile-system.md) — schema and loader contract.
 - [`docs/contracts/config-presets.md`](../../docs/contracts/config-presets.md) — preset axis.
-- [`scripts/config/profiles.py`](../../scripts/config/profiles.py) — loader.
+- [`scripts/config/profiles.ts`](../../scripts/config/profiles.ts) — loader.

package/dist/agent-src/rules/architecture.md

@@ -61,7 +61,7 @@ When a structural decision is non-trivial (kernel membership, contract change, l
 deprecation, scope re-cut), record it as an ADR. Use the [`adr-create`](../skills/adr-create/SKILL.md)
 skill — it numbers the file (`ADR-NNN-<slug>.md`), writes the standard template
 (Status / Context / Decision / Consequences / Alternatives / References), and regenerates the
-index via `scripts/adr/regenerate_index.py`. ADRs land in `docs/adr/` by default; legacy
+index via `scripts/adr/regenerate_index.ts`. ADRs land in `docs/adr/` by default; legacy
 projects use `docs/decisions/`. Reversible refactors and minor cleanups do **not** need ADRs.
 
 ## Module-Level Documentation
@@ -69,7 +69,7 @@ projects use `docs/decisions/`. Reversible refactors and minor cleanups do **not
 Some projects use a module system (e.g. `app/Modules/` in Laravel, `apps/`/`packages/` in a Turborepo, `src/modules/` in NestJS, `internal/` in Go).
 Module roots and the per-module agent-docs folder are configured via
 `modules.root_paths` and `modules.agent_folder` in `.agent-settings.yml`
-(resolve at runtime via `scripts/_lib/agent_settings.py::enumerate_modules()`).
+(resolve at runtime via `scripts/_lib/agent_settings.ts::enumerate_modules()`).
 Modules may have their own agent docs under
 `{module_root}/*/{agent_folder}/` (Laravel shape: `app/Modules/*/agents/`) with:
 

package/dist/agent-src/rules/context-hygiene.md

@@ -14,7 +14,7 @@ packs: [meta]
 
 # Context Hygiene
 
-> **Enforced by:** [`scripts/context_hygiene_hook.py`](../../scripts/context_hygiene_hook.py)
+> **Enforced by:** [`scripts/context_hygiene_hook.ts`](../../scripts/context_hygiene_hook.ts)
 > on Augment + Claude Code (`PostToolUse`). The hook maintains
 > `agents/runtime/state/context-hygiene.json` (turn count, loop signal,
 > freshness milestones at 20/40/60); the prose below is the spec the
@@ -141,7 +141,7 @@ If you need an ignored skill: read its SKILL.md directly, apply guidance, then a
 ## Copilot fallback
 
 GitHub Copilot has no `PostToolUse` hook surface, so
-`scripts/context_hygiene_hook.py` cannot run structurally and
+`scripts/context_hygiene_hook.ts` cannot run structurally and
 `agents/runtime/state/context-hygiene.json` is not maintained automatically
 (turn count, loop signal, freshness milestones at 20/40/60).
 

package/dist/agent-src/rules/fast-path-marker-visibility.md

@@ -25,7 +25,7 @@ EVERY LOW-IMPACT COUNCIL FAST-PATH REPLY OPENS WITH THE EXACT MARKER.
 NEVER PARAPHRASE. NEVER SWALLOW. NEVER SUBSTITUTE THE AGENT'S OWN VERDICT.
 ```
 
-Markers (from `scripts/ai_council/low_impact.py`):
+Markers (from `scripts/ai_council/low_impact.ts`):
 
 - **Resolved** — `> Resolved via low-impact council fast-path: <verdict>.`
 - **Unavailable** — `> Low-impact council unavailable (no opted-in members) — escalating to user.`

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -109,7 +109,7 @@ inlines stack-specific code.
 
 ## Enforcement
 
-`scripts/lint_framework_leakage.py` runs in the package CI pipeline.
+`scripts/lint_framework_leakage.ts` runs in the package CI pipeline.
 Exit codes:
 
 - `0` — no hits, or every hit is auto-detected as cross-stack, or

package/dist/agent-src/rules/linked-projects-onboarding-gate.md

@@ -13,7 +13,7 @@ triggers:
   - path_prefix: ".idea/vcs.xml"
 validator_ignore:
   - type: "substring"
-    pattern: "scripts/_lib/linked_projects.py"
+    pattern: "scripts/_lib/linked_projects.ts"
     reason: "Rule names the detector module as the runtime detection entrypoint."
 routes_to:
   - "guideline:agent-infra/linked-projects-onboarding-gate"

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -21,7 +21,7 @@ NO SECRETS. NO EMAILS. NO PROJECT PATHS. NO CUSTOMER NAMES.
 NO INTERNAL HOSTNAMES. NO MONEY. NO BUSINESS SQL. NO LONG CODE.
 ```
 
-Redactor lives in `scripts/ai_council/redact_low_impact_entry.py`
+Redactor lives in `scripts/ai_council/redact_low_impact_entry.ts`
 and runs at **both** gates:
 
 1. **Write gate** — every intake append to
@@ -70,6 +70,6 @@ Then agent stops intake/upstream flow. No silent retry, no auto-rewrite.
 
 ## See also
 
-- `scripts/ai_council/redact_low_impact_entry.py` — the redactor.
-- `scripts/ai_council/low_impact_intake.py` — write-gate caller.
+- `scripts/ai_council/redact_low_impact_entry.ts` — the redactor.
+- `scripts/ai_council/low_impact_intake.ts` — write-gate caller.
 - `agents/decisions/low-impact-decisions.md` — corpus + Anti-Examples list.

package/dist/agent-src/rules/media-governance-routing.md

@@ -68,7 +68,7 @@ This routing rule is the bridge: sits in always-loaded rule set so trigger keywo
 
 ## CI reachability guarantee
 
-[`scripts/lint_media_policy_linkage.py`](../../scripts/lint_media_policy_linkage.py) fails build if any policy file under `agents/settings/policies/media/` not linked from:
+[`scripts/lint_media_policy_linkage.ts`](../../scripts/lint_media_policy_linkage.ts) fails build if any policy file under `agents/settings/policies/media/` not linked from:
 
 - this routing rule, **or**
 - a skill's `## Policies` see-also block, **or**

package/dist/agent-src/rules/no-roadmap-references.md

@@ -66,8 +66,8 @@ skills,commands,contexts,templates,personas}/`, `agents/settings/contexts/`,
 `docs/customization.md`, `docs/getting-started.md`, `docs/catalog.md`,
 `AGENTS.md`, `README.md`, `copilot-instructions.md`.
 
-CI enforcement: `scripts/check_no_roadmap_refs.py` (roadmap layer)
-and `scripts/check_council_references.py` (council layer) — both
+CI enforcement: `scripts/check_no_roadmap_refs.ts` (roadmap layer)
+and `scripts/check_council_references.ts` (council layer) — both
 fail the build on any new violation.
 
 ## Allowed patterns
@@ -89,7 +89,7 @@ fail the build on any new violation.
 Two source/target shapes are exempt from the council-link ban
 because the target is **immutable input** or **decision provenance**,
 not transient drafting state. The linter implements these directly
-(`STRUCTURAL_CARVEOUTS` in `scripts/check_council_references.py`);
+(`STRUCTURAL_CARVEOUTS` in `scripts/check_council_references.ts`);
 they do **not** need an inline `<!-- council-ref-allowed: ... -->`
 pragma.
 

package/dist/agent-src/rules/preservation-guard.md

@@ -48,7 +48,7 @@ bullet, and code block from the source is present, condense as hard as you
 want. What's forbidden is **deletion**: the rationale paragraph stays, the
 canonical-failure example stays, every "NEVER X" bullet stays.
 
-`scripts/check_condensation.py` enforces these mechanically — any violation is
+`scripts/check_condensation.ts` enforces these mechanically — any violation is
 an `error`, not a warning.
 
 ## Mandatory preservation checklist
@@ -92,4 +92,4 @@ Before completing any transformation, verify:
 - Skill: `skill-management` — condensation/refactoring modes
 - Skill: `skill-reviewer` — condensation safety checks
 - Command: `/condense` — condensation quality checklist
-- Linter: `scripts/skill_linter.py` — `check_condensation_quality()`
+- Linter: `scripts/skill_linter.ts` — `check_condensation_quality()`

package/dist/agent-src/rules/roadmap-ci-steps-policy.md

@@ -38,9 +38,10 @@ ROADMAPS MUST NOT SCHEDULE FULL-PIPELINE CI STEPS,
 AND EXECUTION MUST SKIP THEM INLINE WITH [-] AND A REASON.
 ```
 
-When `quality.local_auto_run: false` in `.agent-settings.yml`, every
-full-pipeline gate run during roadmap work is wasted wall-clock and
-tokens — remote CI on the PR is the authoritative gate. Roadmaps
+When `quality.local_auto_run: false` in `.agent-settings.yml` (the
+shipped template default), every full-pipeline gate run during roadmap
+work is wasted wall-clock and tokens — remote CI on the PR is the
+authoritative gate. Roadmaps
 must neither schedule nor execute them locally. New CI gates and
 smoke/test files added by the roadmap itself are exempt — they must
 run once locally to count as verified evidence per
@@ -92,7 +93,7 @@ setting.
 `task lint-roadmap-ci-steps` (wired into `task ci-fast` /
 `lint-roadmap-complexity` cadence) scans `agents/roadmaps/*.md` and
 per-module roadmap dirs resolved via
-`scripts/_lib/agent_settings.py::enumerate_modules()`
+`scripts/_lib/agent_settings.ts::enumerate_modules()`
 (`{module_path}/{modules.agent_folder}/roadmaps/*.md`; Laravel shape:
 `app/Modules/*/agents/roadmaps/*.md`). Exit code:
 
@@ -136,7 +137,7 @@ saving skips for the archive commit is a rule violation.
   is reserved for **new** gates introduced by the same roadmap.
 - Hiding the literal inside a fenced bash block to dodge the linter —
   linter matches inside fenced blocks too (see
-  `scripts/lint_roadmap_ci_steps.py`).
+  `scripts/lint_roadmap_ci_steps.ts`).
 
 ## See also
 

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -39,7 +39,7 @@ The `command:` triggers in this rule's frontmatter ensure it loads the moment on
 
 **Step counts as done** when its code/doc change is written and saved AND the verification cited in the step has passed (fresh output in this reply or an earlier one).
 
-**Glyph semantics — single source of truth.** Keep aligned with the dashboard counter in `scripts/update_roadmap_progress.py` and the closure-table in [`roadmap-management`](../skills/roadmap-management/SKILL.md):
+**Glyph semantics — single source of truth.** Keep aligned with the dashboard counter in `scripts/update_roadmap_progress.ts` (regenerated via `./agent-config roadmap:progress`) and the closure-table in [`roadmap-management`](../skills/roadmap-management/SKILL.md):
 
 | Glyph | Meaning | Counts towards |
 |---|---|---|
@@ -101,7 +101,7 @@ NEVER MERGED-BUT-UNARCHIVED INTO THE TRUNK.
 NO merge-gated PLACEHOLDER ITEM. NO AGENT-SET ANNOTATION.
 ```
 
-The sweep — `scripts/archive_completed_roadmaps.py`, invoked by
+The sweep — `scripts/archive_completed_roadmaps.ts`, invoked by
 [`/create-pr` § 1c](../commands/pr/create.md) — archives every roadmap that is
 complete **and** touched in this branch (`git log origin/main..HEAD`), `git mv`s
 it to `archive/`, migrates inbound `agents/roadmaps/<x>.md` references to the
@@ -109,7 +109,7 @@ archive path in the **same branch** (so links never break — this was the only
 real reason the old design deferred archival), regenerates the dashboard, and
 stages it. Completion is read from the checkbox counts; no marker is required.
 
-**Backstop:** `update_roadmap_progress.py --check` hard-fails when a roadmap
+**Backstop:** `./agent-config roadmap:progress-check` (wrapping `update_roadmap_progress.ts --check`) hard-fails when a roadmap
 hits `count_open == 0` while still under `agents/roadmaps/`. Because
 `/create-pr` archives before the push, the PR branch is green; a push that
 bypasses the sweep red-flags in CI — the forcing function that makes

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -57,15 +57,13 @@ STOP writing code. Run the matching analysis skill first:
 **Before running the analysis, consult memory for prior incidents** on
 this surface. Via [`memory-access`](../docs/guidelines/agent-infra/memory-access.md):
 
-```python
-from scripts.memory_lookup import retrieve_with_meta
-result = retrieve_with_meta(
-    types=["incident-learnings", "historical-patterns"],
-    keys=<touched file paths>,
-    limit=3,
-)
-priors = result["results"]
-# result["skipped"] lists stale or superseded entries — surface them to the user.
+```bash
+agent-config memory:lookup \
+  --types incident-learnings,historical-patterns \
+  --key <touched file path> \
+  --limit 3 --format json
+# Repeat --key per touched path. Hits are the priors; superseded intake
+# entries are filtered out automatically — surface anything stale to the user.
 ```
 
 A prior security incident on the same path is the cheapest possible

package/dist/agent-src/rules/source-confidentiality.md

@@ -70,7 +70,7 @@ visible. Tracked-safe by **anonymizing**, not hiding in `agents/.harvest-local/`
 
 - Reference sources as **Source A / B / C** (or a neutral descriptor like "an
   external operator-runtime reference") — never the repo / org / author name.
-- Retain real links as `ENC1:` tokens (`link_crypto.py`) in a Provenance block —
+- Retain real links as `ENC1:` tokens (`link_crypto.ts`) in a Provenance block —
   maintainer-recoverable, opaque in the tree.
 - Borrow *items* are this package's own features; never need the source name.
 

package/dist/agent-src/rules/telegraph-speak.md

@@ -57,7 +57,7 @@ Post-rewrite validator runs on every reply when `speak_scope != off`:
 The rule documents the algorithm; agents apply it inline before
 sending. The mechanism is the rule, not a hidden script.
 
-- Optional CI-side regression lock: [`scripts/validate_telegraph_carveouts.py`](../../scripts/validate_telegraph_carveouts.py) — pre/post reply pair, byte-identical preservation across all seven carve-out categories; runtime mechanism stays algorithmic, script is the offline check.
+- Optional CI-side regression lock: [`scripts/validate_telegraph_carveouts.ts`](../../scripts/validate_telegraph_carveouts.ts) — pre/post reply pair, byte-identical preservation across all seven carve-out categories; runtime mechanism stays algorithmic, script is the offline check.
 
 ## Telegraph grammar
 

package/dist/agent-src/rules/token-optimizer-maintenance.md

@@ -62,7 +62,7 @@ the catalog table AND the relevant tree leaf.
 
 ## Backstop
 
-The CI pipeline runs `scripts/check_token_optimizer_freshness.py`
+The CI pipeline runs `scripts/check_token_optimizer_freshness.ts`
 after the reference checker. The validator parses the catalog,
 verifies every cited path exists, and `grep`s the trigger keywords
 against each target. A failure is a **drift signal**, not a

package/dist/agent-src/rules/ui-audit-gate.md

@@ -19,7 +19,7 @@ packs: [frontend-design]
 # UI Audit Gate
 
 Defense-in-depth twin of the dispatcher gate in
-[`directives/ui/audit.py`](../templates/scripts/work_engine/directives/ui/audit.py).
+[`directives/ui/audit.ts`](../templates/scripts/work_engine/directives/ui/audit.ts).
 The dispatcher refuses to advance past `refine` without `state.ui_audit`;
 this rule refuses the write even when the agent acts outside the dispatcher.
 

package/dist/agent-src/scripts/archive_completed_roadmaps.ts

@@ -453,10 +453,28 @@ function main(argv?: readonly string[]): number {
     return 0;
 }
 
-const _isCliEntry =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
-if (_isCliEntry || process.argv[1] === _HERE) {
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via `.augment/scripts` → `dist/agent-src/scripts`,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the symlink
+    // path. Compare realpaths so the entry guard still fires (without this the
+    // archival sweep silently no-ops when run through the symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+if (_isCliEntry() || process.argv[1] === _HERE) {
     try {
         process.exitCode = main();
     } catch (exc) {