@event4u/agent-config 8.1.0 → 8.3.0

package/dist/agent-src/skills/script-writing/SKILL.md

@@ -15,7 +15,7 @@ packs:
 
 ## When to use
 
-* Creating a new Python script in `scripts/{name}.py` (linters, checks, generators, measure tools)
+* Creating a new TypeScript script in `src/scripts/{name}.ts` (linters, checks, generators, measure tools — run via `./scripts-run src/scripts/{name}`)
 * Editing an existing script that prints progress or success lines
 * Wiring a script into `Taskfile.yml` or `taskfiles/*.yml`
 * Reviewing a PR that adds scripts and asking "why does this still print on minimal?"
@@ -48,38 +48,25 @@ family **must** go through Understand → Research → Draft from the
 
 * **Understand** — what failure does this script catch that no existing
   check catches? Is it a one-off (then archive it) or evergreen?
-* **Research** — `ls scripts/check_*.py scripts/lint_*.py`, grep for
-  overlap, skim 1–2 peer scripts (e.g. `lint_handoffs.py`,
-  `check_md_language.py`).
+* **Research** — `ls src/scripts/check_*.ts src/scripts/lint_*.ts`, grep for
+  overlap, skim 1–2 peer scripts (e.g. `lint_handoffs.ts`,
+  `check_md_language.ts`).
 * **Draft** — propose name + one-line purpose first. Only fill the body
   after the shape is confirmed.
 
-### 1. `--quiet` flag — argparse + sys.argv fallback
+### 1. `--quiet` flag — argv check
 
-Every `check_*.py` / `lint_*.py` script MUST accept `--quiet` so the
+Every `check_*.ts` / `lint_*.ts` script MUST accept `--quiet` so the
 silent Taskfile layer (§ 4) can suppress success-only output.
 
-**With argparse (preferred):**
+**Canonical pattern (see e.g. `lint_handoffs.ts`):**
 
-```python
-parser = argparse.ArgumentParser(...)
-parser.add_argument("--quiet", action="store_true",
-                    help="Only print on failure")
-args = parser.parse_args()
-...
-if not args.quiet:
-    print("✅ All clean")
-```
-
-**Plain script (no argparse) fallback:**
-
-```python
-import sys
-
-QUIET = "--quiet" in sys.argv
-...
-if not QUIET:
-    print("✅ All clean")
+```ts
+const QUIET = process.argv.slice(2).includes('--quiet');
+// ...
+if (!QUIET) {
+    console.log('✅ All clean');
+}
 ```
 
 Failure output (`❌`, non-zero exit) is **never** gated — failures must
@@ -90,15 +77,15 @@ always print regardless of `--quiet`.
 For anything richer than a single `✅`/`❌`, import the verbosity-aware
 router instead of raw `print()`:
 
-```python
-from _lib.script_output import info, success, warn, error, flush_summary
+```ts
+import { info, success, warn, error, flush_summary } from './_lib/script_output.js';
 
-info("Loading manifest")          # drops on silent + minimal
-success("Wrote 3 files")          # collected at minimal, printed at verbose
-warn("Skipping stale entry")      # stderr unless silent
-error("Manifest missing")         # stderr always
+info('Loading manifest');          // drops on silent + minimal
+success('Wrote 3 files');          // collected at minimal, printed at verbose
+warn('Skipping stale entry');      // stderr unless silent
+error('Manifest missing');         // stderr always
 
-flush_summary("Done — 3 entries") # one-line summary at minimal
+flush_summary('Done — 3 entries'); // one-line summary at minimal
 ```
 
 Resolution order (first wins, cached for the process):
@@ -110,7 +97,7 @@ Resolution order (first wins, cached for the process):
 
 The resolved level is exported back into `AGENT_SCRIPT_VERBOSITY` so
 child processes inherit it. Tests reset via `reset_level()` from the
-same module — see `tests/test_script_output.py`.
+same module — see `tests/lib/script_output.test.ts`.
 
 ### 3. Iron-Law carve-outs — never silenced
 
@@ -125,8 +112,8 @@ helpers, so verbosity settings cannot suppress them:
 * Any prompt that asks the user for confirmation per
   [`non-destructive-by-default`](../../rules/non-destructive-by-default.md) — Hard Floor cannot be silenced
 
-If unsure, check `scripts/ai_council/one_off_archive/2026-05/_one_off_silent_taskfiles.py`
-`CARVE_OUTS` for the canonical list.
+If unsure, check `src/scripts/ai_council/one_off_archive/2026-05/README.md`
+for the archived carve-out inventory.
 
 ### 4. Taskfile wiring — `silent: true` + `{{.QUIET_FLAG}}`
 
@@ -157,13 +144,13 @@ do **not** add `silent: true` and do **not** use `{{.QUIET_FLAG}}`.
 ### 5. Validate
 
 * Run `./scripts-run src/scripts/skill_linter src/skills/script-writing/SKILL.md` → 0 FAIL
-* Run `python3 scripts/{your-script}.py --quiet` and the verbose path — exit code 0 on clean, non-zero on failure regardless of flag
-* If the script uses `_lib/script_output`, add a test under `tests/` patterned on `tests/test_script_output.py` — assert `silent` / `minimal` / `verbose` behave per § 2
+* Run `./scripts-run src/scripts/{your-script} --quiet` and the verbose path — exit code 0 on clean, non-zero on failure regardless of flag
+* If the script uses `_lib/script_output`, add a test under `tests/` patterned on `tests/lib/script_output.test.ts` — assert `silent` / `minimal` / `verbose` behave per § 2
 * Run the full CI pipeline locally (see `Taskfile.yml` in this repo for the script list) — must exit 0 except for tolerated warnings
 
 ## Output format
 
-1. Script file at `scripts/{name}.py` with `--quiet` accepted
+1. Script file at `src/scripts/{name}.ts` with `--quiet` accepted
 2. Taskfile wiring with `silent: true` + `{{.QUIET_FLAG}}` (unless carve-out)
 3. Test under `tests/` if `_lib/script_output` is used
 4. Linter output showing 0 FAIL
@@ -175,7 +162,7 @@ do **not** add `silent: true` and do **not** use `{{.QUIET_FLAG}}`.
 * Using raw `print()` for progress lines — drops on `minimal`, no inheritance
 * Adding `silent: true` to a release / install-keys task — bypasses the Hard Floor confirmation
 * Editing `Taskfile.yml`'s `QUIET_FLAG` var — single source of truth, do not duplicate
-* Forgetting that `from _lib.script_output import …` requires the script's resolution to walk up to `scripts/` — copy the `Path(__file__).resolve().parent` pattern from a peer
+* Forgetting that `import … from './_lib/script_output.js'` resolves relative to the script's own directory — copy the import path from a peer under `src/scripts/`
 
 ## Frugality Standards
 
@@ -217,7 +204,7 @@ applies — with prose-only validation:
 
 * Emit the full script + Taskfile snippet as copyable Markdown blocks. Do not attempt to write to disk.
 * Self-check: `--quiet` accepted, failures never gated, success lines gated, helper imports look syntactically right.
-* Tell the user to save under `scripts/{name}.py`, wire the Taskfile entry, and run `task lint-skills && task ci` locally before committing.
+* Tell the user to save under `src/scripts/{name}.ts`, wire the Taskfile entry, and run `task lint-skills && task ci` locally before committing.
 * Skip every reference to running the linter or `task` commands yourself — they only run on the user's machine.
 
 ## Examples

package/dist/agent-src/skills/skill-writing/SKILL.md

@@ -70,7 +70,7 @@ Ask: **"Does the model need this to do its job correctly?"**
 
 Skills in `.agent-src.uncondensed/skills/{name}/SKILL.md` AND commands in
 `.agent-src.uncondensed/commands/{name}.md` both project into
-`.claude/skills/` (see `scripts/condense.py` →
+`.claude/skills/` (see `scripts/condense.ts` →
 `generate_claude_skills` + `generate_claude_commands`). Claude treats
 the whole directory as native skills.
 
@@ -158,7 +158,7 @@ generic descriptions cause **undertriggering**. Normative source:
 
 Three rules: name 2+ triggers (domains, symptoms, user phrasing), end with
 `... even if they don't explicitly ask for \`<skill-name>\`.`, and stay
-**≤ 200 characters** (`skill_linter.py` warns `description_too_long` above
+**≤ 200 characters** (`skill_linter.ts` warns `description_too_long` above
 that). When trimming to fit, drop adjectives or the second example phrasing
 before you drop a trigger class or the `even if ...` tail.
 
@@ -336,7 +336,7 @@ rubric:
 via a fresh sub-agent reading the output against the criterion — keep
 each criterion to one falsifiable sentence.
 
-**Loop** (orchestrated by `scripts/run_skill_evals.py`):
+**Loop** (orchestrated by `scripts/run_skill_evals.ts`):
 
 1. **Scaffold** — `./scripts-run src/scripts/run_skill_evals scaffold {skill}`
    creates `runs/{timestamp}-{baseline,with-skill}/` and seeds each

package/dist/agent-src/skills/source-discovery/SKILL.md

@@ -113,12 +113,12 @@ never a build input**:
 
 - Load **negative facts + pointers** as leads (`trust: durable`).
 - Load **positive structure** under **"Assumed (from card · GLOBAL,
-  unverified)"** — record via `evidence_report.py add --bucket assumed --origin
+  unverified)"** — record via `evidence_report.ts add --bucket assumed --origin
   global …` and **re-confirm vs the live source this session** before use
   (version skew / schema drift). Never "Verified" on the global card alone.
 - `public`/`vendor` seen in ≥ `auto_promote_threshold` distinct repos → one-tap
   promotion **suggestion** (never silent); `proprietary` is manual-only. Record
-  sightings via `_lib/knowledge_global_promote.py record-seen`.
+  sightings via `_lib/knowledge_global_promote.ts record-seen`.
 
 ## Missing structure → fixed extension workflow
 
@@ -126,7 +126,7 @@ When the field/endpoint/table you need is **not** there:
 
 1. **Search** the relevant sources.
 2. **Not found** — record the **absence-search log** with `searched` *and*
-   `not_searched` (via `evidence_report.py add --bucket gaps --searched … --not-searched …`).
+   `not_searched` (via `evidence_report.ts add --bucket gaps --searched … --not-searched …`).
 3. **Negative-fact card** — only **after the search is exhausted across all
    relevant sources** for that claim: write `type: anti-hallucination`,
    `polarity: negative`, with `actionable` + `next_step` + a `revalidate_if`

package/dist/agent-src/skills/sql-writing/SKILL.md

@@ -14,7 +14,8 @@ packs:
 
 > **Grounded corpus:** tuning decisions (indexes, keyset pagination, N+1,
 > trigram search, lock contention) ground via the
-> [`database`](../database/SKILL.md) corpus — `ground.py search
+> [`database`](../database/SKILL.md) corpus — `./scripts-run
+> <skills-root>/corpus-grounding/scripts/ground search
 > --manifest <skills-root>/database/data/manifest.json "<symptom>"`.
 
 ## When to use

package/dist/agent-src/skills/subagent-orchestration/SKILL.md

@@ -201,7 +201,7 @@ in [`using-git-worktrees`](../using-git-worktrees/SKILL.md) and
 its `## Output` block → control passes to delegated-skill in a fresh
 worktree → delegated-skill consumes the input shape declared in its
 `## Input` (or `## When the agent should load this`) block. The
-handoff is auditable; `lint_handoffs.py` validates the chain.
+handoff is auditable; `lint_handoffs.ts` validates the chain.
 
 **Example chain (W3 launch):** `positioning-strategy` (worktree A) →
 `messaging-architecture` (worktree B, consumes positioning's

package/dist/agent-src/skills/systematic-debugging/SKILL.md

@@ -104,13 +104,11 @@ Goal: locate the failure in a single component, layer, or call site.
    recent dependency updates, config edits, infra changes.
 4. **Consult memory for prior matches.** Via
    [`memory-access`](../../../docs/guidelines/agent-infra/memory-access.md):
-   ```python
-   from scripts.memory_lookup import retrieve
-   priors = retrieve(
-       types=["incident-learnings", "historical-patterns"],
-       keys=[<error class>, <failing path(s)>],
-       limit=3,
-   )
+   ```bash
+   agent-config memory:lookup \
+     --types incident-learnings,historical-patterns \
+     --key <error class> --key <failing path> \
+     --limit 3
    ```
    A matching `incident-learning` may already name the root cause, the
    fix, and the regression test. A matching `historical-pattern`

package/dist/agent-src/skills/tailwind-engineer/SKILL.md

@@ -53,10 +53,10 @@ one-line comment naming the design source.
 
 Token authoring (DTCG 3-layer model, CSS-var/Tailwind generation) lives
 in [`design-tokens`](../design-tokens/SKILL.md); its
-`tokens.py validate --dir <path>` is the **single token-discipline
+`tokens.ts validate --dir <path>` is the **single token-discipline
 linter** — the mechanical check behind this rule (no hardcoded hex / px /
 rem outside the token files). Greenfield Tailwind config: bundled
-`scripts/tailwind_config_gen.py` (Apache-2.0-derived, pure templating)
+`scripts/tailwind_config_gen.ts` (Apache-2.0-derived, pure templating)
 scaffolds `tailwind.config.{js,ts}` per framework.
 
 ### 2. Compose, don't inline

package/dist/agent-src/skills/tailwind-engineer/scripts/tailwind_config_gen.ts

@@ -23,9 +23,9 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
-const PROG = 'tailwind_config_gen.py';
+const PROG = 'tailwind_config_gen';
 
 // Mirror argparse's wrapped usage block (80-col default; non-tty). Used for
 // the invalid-choice / unrecognized-argument error paths.
@@ -553,9 +553,30 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     return success ? 0 : 1;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/skills/token-optimizer/SKILL.md

@@ -95,7 +95,7 @@ INTENT
   cited asset's trigger keywords or scope, update the matching row in
   this skill in the same commit (enforced by
   [`token-optimizer-maintenance`](../../rules/token-optimizer-maintenance.md)
-  rule + `scripts/check_token_optimizer_freshness.py` CI gate).
+  rule + `scripts/check_token_optimizer_freshness.ts` CI gate).
 - Tree must stay scannable (≤ 50 lines incl. labels). Catalog rows
   carry the long form.
 - Authoritative-link assets (`rtk` upstream, `markitdown` upstream,

package/dist/agent-src/skills/typography-system/SKILL.md

@@ -49,7 +49,7 @@ degrades gracefully: with no brand layer, only stage 1 runs.
    xl / 2xl / 3xl`; set `line-height` (1.5 for body, 1.2 for display);
    assign weights (400 body, 600–700 heading).
 4. **Emit DTCG `$type: "typography"` tokens** through `design-tokens`
-   (`scripts/tokens.py`) — add a `typography` section to `tokens.json` with
+   (`scripts/tokens.ts`) — add a `typography` section to `tokens.json` with
    `$type: "typography"` and `$value` objects carrying `fontFamily`,
    `fontSize`, `fontWeight`, `lineHeight`.
 5. **Verify** — confirm both chosen fonts exist on Google Fonts (check the

package/dist/agent-src/skills/validate-feature-fit/SKILL.md

@@ -52,13 +52,11 @@ Verify the request doesn't conflict with:
   shared abstraction (see
   [`memory-access`](../../../docs/guidelines/agent-infra/memory-access.md)):
 
-  ```python
-  from scripts.memory_lookup import retrieve
-  matches = retrieve(
-      types=["product-rules", "domain-invariants"],
-      keys=[<affected domain>, <affected paths>],
-      limit=5,
-  )
+  ```bash
+  agent-config memory:lookup \
+    --types product-rules,domain-invariants \
+    --key <affected domain> --key <affected path> \
+    --limit 5
   ```
 
   A product rule is an intentional business constraint

package/dist/agent-src/skills/verify-completion-evidence/SKILL.md

@@ -93,6 +93,15 @@ on the changed scope."* — not *"everything looks good"*.
 
 ## The end-of-work sequence
 
+**Gate zero:** when `quality.local_auto_run` is `false` or missing (the
+default), steps 2–3 below do NOT run — user runs quality tools
+manually, remote CI is the authoritative gate (see
+[`quality-tools` § Execution policy](../quality-tools/SKILL.md)). Run
+only the narrowest probe the claim needs (step 1, a `curl`, a syntax
+check on the edited file) and close with *"quality gates delegated to
+remote CI"* — never a pass claim for tools that did not run. Full
+sequence applies when `local_auto_run: true`.
+
 When all code changes are done and you are ready to report completion:
 
 1. **Targeted tests** — the test(s) covering the changed code pass.
@@ -176,7 +185,8 @@ When reporting completion to the user:
 * Do NOT suppress warnings or skip tests to pass the gate
 * Do NOT report only the last line of output — read the whole thing
 * Do NOT run the full quality pipeline between intermediate edits —
-  run it once at the end
+  and under `quality.local_auto_run: false` (the default) do NOT run
+  it at the end either; remote CI is the gate
 
 ## When to hand over to another skill
 
@@ -196,6 +206,8 @@ Before sending a completion message:
 * [ ] Output is quoted with numeric counts, not paraphrased
 * [ ] No warnings or skips are hidden
 * [ ] Targeted tests green → full suite green → quality pipeline clean
+      (`local_auto_run: true` only; under the default `false` state
+      "quality gates delegated to remote CI" instead)
 * [ ] `git status` reflects only the intended change set
 * [ ] If `git status --short` shows untracked files, the report lists
       them verbatim under "Untracked files"

package/dist/agent-src/templates/agent-settings.md

@@ -33,7 +33,7 @@ exists and is the source of truth.
 ## Template
 
 This block defines the personal and project-level settings that
-`scripts/install.py` (via `config/agent-settings.template.yml`)
+`scripts/install.ts` (via `config/agent-settings.template.yml`)
 writes to `.agent-settings.yml` on first install. Subsequent edits are
 made by the user directly or by the agent on request, following the
 [section-aware merge rules](../docs/guidelines/agent-infra/layered-settings.md#section-aware-merge-rules).
@@ -54,15 +54,16 @@ made by the user directly or by the agent on request, following the
 # essential = kernel + the lift-carrying rules (~3.3x, keeps the weak-host
 #             discipline lift; the full load's residual is not significant).
 # full      = every rule tier (~11.7x). EXPERIMENTAL opt-in only.
-# auto      = resolve per session against host-capabilities.yml
-#             (measured-null model -> off, otherwise -> essential).
+# auto      = resolve per session against host-capabilities.yml — measured
+#             NULL-lift model -> off; unmeasured Claude-family -> essential;
+#             unmeasured non-Claude -> off (P2 verdict, vendor-granular).
 #
 # When set, this key WINS over the legacy rule_loading_tier below
 # (mapping when absent: minimal->off, balanced->essential, full->full).
-# The installer fills it per preset (minimal->off, balanced->essential,
-# full->full — behaviour-preserving); `auto` is the evidence-gated flip
-# target (roadmap Phase 4).
-discipline_profile: essential
+# The installer fills it per preset: minimal->off, balanced->auto,
+# full->full (P2-verdict council 2026-07-07 — the non-Claude replication
+# failed, so auto enables the lift only where measured).
+discipline_profile: auto
 
 # --- Cost profile (legacy knob — superseded by discipline_profile) ---
 #
@@ -164,9 +165,9 @@ eloquent:
 #
 # Persistent JSONL log at agents/runtime/.agent-chat-history (git-ignored under /agents/runtime/).
 # Keeps a durable record of the conversation so a crashed or switched
-# agent session can be resumed. See scripts/chat_history.py for the API.
+# agent session can be resumed. See scripts/chat_history.ts for the API.
 #
-# Defaults below are placeholders — scripts/install.py substitutes them
+# Defaults below are placeholders — scripts/install.ts substitutes them
 # per rule_loading_tier (see config/profiles/*.ini).
 chat_history:
   # Log chat events to disk (true, false)
@@ -225,9 +226,9 @@ hooks:
   chat_history:
     enabled: true
     # Override path to the chat-history CLI (defaults to
-    # scripts/chat_history.py). Only set this when the script lives
+    # scripts/chat_history.ts). Only set this when the script lives
     # outside the standard location.
-    # script: scripts/chat_history.py
+    # script: scripts/chat_history.ts
 
 # --- Optional pipelines ---
 pipelines:
@@ -264,20 +265,28 @@ roadmap:
   #   end_of_roadmap = once, before archiving (default — fastest, fewest tokens)
   #   per_phase      = once after every completed phase
   #   per_step       = after every completed step (legacy; highest token cost)
-  # Iron Law `verify-before-complete` still applies — fresh output is
-  # mandatory before any "roadmap complete" claim, regardless of cadence.
+  # `quality.local_auto_run: false` (the default) suppresses local
+  # pipeline runs at EVERY cadence — remote CI is the gate; this knob
+  # only matters when `local_auto_run` is `true`.
   quality_cadence: end_of_roadmap
 
 # --- Quality / CI execution ---
 quality:
   # Run local quality / CI tasks and tests autonomously (true, false)
-  # true  = agent runs the quality pipeline whenever work is ready
-  #         for verification, without asking (default)
-  # false = agent asks before running quality tools / tests locally
+  # false = default. Agent NEVER runs quality tools / full test suites
+  #         proactively — and does not ask. The user runs them manually;
+  #         remote CI is the authoritative gate. The agent runs one ONLY
+  #         on: (1) explicit ask this turn (e.g. /quality-fix), (2) a
+  #         concrete CI failure — run exactly that failing check, or
+  #         (3) the new-gate carve-out below.
+  # true  = opt-in legacy: agent runs the quality pipeline whenever
+  #         work is ready for verification, without asking.
   # Carve-out: NEW CI gates / smoke tests / test files MUST run
   # locally regardless of this flag — without execution the gate is
-  # unverified evidence. Iron Law `verify-before-complete` still applies.
-  local_auto_run: true
+  # unverified evidence. Iron Law `verify-before-complete` still applies:
+  # suppressed runs are surfaced ("quality gates delegated to remote CI"),
+  # never claimed as passing.
+  local_auto_run: false
 
   # Wait for remote CI to finish on the PR / pipeline (true, false)
   # true  = poll GitHub check-runs / pipeline after push and report
@@ -436,9 +445,9 @@ verbosity:
   # it") in skill bodies. false = act and emit the result.
   intent_announcements: false
 
-  # Script stdout chatter from `scripts/*.py`, `scripts/*.sh`, and
+  # Script stdout chatter from `scripts/*.ts`, `scripts/*.sh`, and
   # `.augment/scripts/`. Read by the helper module
-  # `scripts/_lib/script_output.py`.
+  # `scripts/_lib/script_output.ts`.
   #   silent  = stderr only; success = no output
   #   minimal = one summary line per script (default)
   #   verbose = pre-Phase-10 behaviour (per-step prints)
@@ -515,7 +524,7 @@ linked_projects_max_files: 20000
 ## Settings Reference
 
 Personal and project-level settings (initial file written by
-`scripts/install.py`, edits follow the merge rules in
+`scripts/install.ts`, edits follow the merge rules in
 [`layered-settings`](../docs/guidelines/agent-infra/layered-settings.md#section-aware-merge-rules)).
 **Key paths use dot-notation** to denote nesting: `personal.user_name`
 lives under `personal:` in YAML.
@@ -544,18 +553,18 @@ the canonical narrative lives in
 | `chat_history.frequency` | `per_turn`, `per_phase`, `per_tool` | per profile | Logging granularity. Defaults: `minimal`→`per_turn`, `balanced`→`per_phase`, `full`→`per_tool`. |
 | `chat_history.max_size_kb` | integer | per profile | Max file size before overflow handling. Defaults: `minimal`→`128`, `balanced`→`256`, `full`→`512`. |
 | `chat_history.on_overflow` | `rotate`, `condense` | per profile | On overflow: `rotate` drops oldest entries; `condense` marks the file for summarization on the next turn. Defaults: `minimal`/`balanced`→`rotate`, `full`→`condense`. |
-| `chat_history.text_limits.{user,agent,tool,phase}` | integer (chars) | `user=0`, `agent=5000`, `tool=200`, `phase=200` | Per-entry-type text-length cap. `0` = verbatim, no slice. `N > 0` = collapse whitespace, slice to N chars, append `" … [+K chars]"` so the log self-reports truncation. Defaults match `DEFAULT_TEXT_LIMITS` in `scripts/chat_history.py`. |
+| `chat_history.text_limits.{user,agent,tool,phase}` | integer (chars) | `user=0`, `agent=5000`, `tool=200`, `phase=200` | Per-entry-type text-length cap. `0` = verbatim, no slice. `N > 0` = collapse whitespace, slice to N chars, append `" … [+K chars]"` so the log self-reports truncation. Defaults match `DEFAULT_TEXT_LIMITS` in `scripts/chat_history.ts`. |
 | `hooks.enabled` | `true`, `false` | `false` | Master switch for the work-engine hook layer. When `false` (default) the registry stays empty and golden replay is byte-stable. See [`agents/settings/contexts/work-engine-hooks.md`](../../../agents/settings/contexts/work-engine-hooks.md). |
 | `hooks.trace` | `true`, `false` | `false` | Emit per-event trace lines on stderr. Useful for debugging; off by default because it is noisy. |
 | `hooks.halt_surface_audit` | `true`, `false` | `true` | Defense-in-depth check that every halt surfaced by the dispatcher carries the expected shape. Cheap. |
 | `hooks.state_shape_validation` | `true`, `false` | `true` | Re-run the state schema validator on `AFTER_LOAD` and `BEFORE_SAVE`. Cheap, catches drift. |
 | `hooks.directive_set_guard` | `true`, `false` | `true` | Verify the dispatcher-resolved directive set matches the input envelope intent. Cheap, catches routing drift. |
 | `hooks.chat_history.enabled` | `true`, `false` | `true` | Register the chat-history hooks (`append` on `after_step`, `halt_append` on `on_halt`). Gated by **both** this flag AND `chat_history.enabled`; either off → no chat-history hook registers. Schema v4: every entry self-identifies via a 16-char session fingerprint, no ownership/sidecar layer. |
-| `hooks.chat_history.script` | path | `scripts/chat_history.py` | Override path to the chat-history CLI. Set only when the script lives outside the standard location. |
+| `hooks.chat_history.script` | path | `scripts/chat_history.ts` | Override path to the chat-history CLI. Set only when the script lives outside the standard location. |
 | `pipelines.skill_improvement` | `true`, `false` | `true` | When `true`: propose learning capture after meaningful tasks. When `false`: silent. Included in every profile except `custom`. |
 | `roadmap.skip_pre_run_gate` | `true`, `false` | `true` | When `true` (default): `/roadmap:process-step\|phase\|full` skips the interactive pre-run summary and starts the loop immediately — the resolved roadmap, cadence, and council are surfaced inline so an unwanted pick can still be aborted. When `false`: the loop shows the pre-run summary with numbered options (Go / Different roadmap / Different scope / Toggle council / Abort) and waits. The gate is always shown — regardless of this flag — when the roadmap is ambiguous (multiple active, none named) or a scope / cadence conflict has no sensible default. |
-| `roadmap.quality_cadence` | `end_of_roadmap`, `per_phase`, `per_step` | `end_of_roadmap` | When `/roadmap:process-step|phase|full` runs the project's quality pipeline. Default skips per-step / per-phase runs and gates only the final archival. `per_phase` runs once after every phase; `per_step` is the legacy verbose mode. Step checkboxes and the dashboard are always updated regardless. `verify-before-complete` still requires fresh output before any "roadmap complete" claim. |
-| `quality.local_auto_run` | `true`, `false` | `true` | When `true`: agent runs the project's quality pipeline (`task ci`, `make test`, `npm run check`, PHPStan, ECS, Rector, test suites) autonomously when work is ready for verification. When `false`: agent asks before running locally. **Carve-out**: NEW CI gates / smoke tests / test files MUST run locally regardless of this flag — without execution the new gate is unverified evidence. Iron Law `verify-before-complete` still applies; suppressed runs require the agent to surface the gap before claiming completion. |
+| `roadmap.quality_cadence` | `end_of_roadmap`, `per_phase`, `per_step` | `end_of_roadmap` | When `/roadmap:process-step|phase|full` runs the project's quality pipeline — only relevant when `quality.local_auto_run` is `true`; when it is `false` (the default) local pipeline runs are suppressed at every cadence and remote CI is the gate. Default skips per-step / per-phase runs and gates only the final archival. `per_phase` runs once after every phase; `per_step` is the legacy verbose mode. Step checkboxes and the dashboard are always updated regardless. |
+| `quality.local_auto_run` | `true`, `false` | `false` | When `false` (default): agent NEVER runs the project's quality pipeline (`task ci`, `make test`, `npm run check`, PHPStan, ECS, Rector, test suites) proactively — and does not ask. The user runs quality tools manually; remote CI is the authoritative gate. The agent runs one only on (1) an explicit ask this turn, (2) a concrete CI failure (run exactly that failing check), or (3) the new-gate carve-out. When `true`: opt-in legacy — agent runs the pipeline autonomously when work is ready for verification. **Carve-out**: NEW CI gates / smoke tests / test files MUST run locally regardless of this flag — without execution the new gate is unverified evidence. Iron Law `verify-before-complete` still applies; suppressed runs are surfaced ("quality gates delegated to remote CI"), never claimed as passing. |
 | `quality.wait_for_remote_ci` | `true`, `false` | `false` | When `true`: after `git push`, the agent polls GitHub check-runs / pipeline status on the PR and reports green / red before handing back. When `false`: agent pushes and hands back immediately; the user inspects CI themselves (default — saves agent runtime and tokens). |
 | `subagents.implementer_model` | model alias or empty | _(empty)_ | Model for implementer subagents. Empty = same tier as session model. See [subagent-configuration](../contexts/subagent-configuration.md). |
 | `subagents.judge_model` | model alias or empty | _(empty)_ | Model for judge subagents. Empty = one tier above implementer (opus if sonnet, sonnet if haiku). |

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -37,9 +37,9 @@ schema_version: 1
 # disables the pin (resolver picks the latest release; only safe for
 # greenfield projects). Ranges (^, ~, >=) are NOT supported.
 # CI guard: a release bump of `package.json` must update this value
-# in lockstep — see scripts/check_template_pin_drift.py (road-to-
+# in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "8.1.0"
+agent_config_version: "8.3.0"
 
 # --- Project identity ---
 project:
@@ -65,7 +65,7 @@ project:
 # module-aware surface skips its module branch — the project is
 # treated as a flat repo.
 #
-# Populated automatically by `scripts/install.py` on a fresh install
+# Populated automatically by `scripts/install.ts` on a fresh install
 # when an `app/Modules/`, `src/modules/`, `packages/`, `internal/`, or
 # similar shape is detected. Set manually for custom layouts. Lockable
 # via `locked_keys: [modules.root_paths]` for compliance-critical

package/dist/agent-src/templates/agents/memory/incident-learnings.example.yml

@@ -10,7 +10,7 @@
 # REDACTION IS MANDATORY — see road-to-engineering-memory.md.
 # Every entry is a PATTERN + CONSEQUENCE + GUARDRAIL.
 # Every entry that contains a customer name, internal URL, PII, or
-# secret is rejected by `scripts/check_memory.py`. No opt-out.
+# secret is rejected by `scripts/check_memory.ts`. No opt-out.
 #
 # BAD entry (auto-rejected):
 #   "On 2026-03-14 customer ACME hit a rate limit and Redis died."

package/dist/agent-src/templates/agents/proposal.example.md

@@ -6,7 +6,7 @@
 #
 # An agent drafting a rule/skill/guideline change in a consumer project
 # produces this doc and hands it to `upstream-contribute`. The gate
-# (`scripts/check_proposal.py`) verifies evidence, scope, and
+# (`scripts/check_proposal.ts`) verifies evidence, scope, and
 # portability before a PR is opened.
 #
 # Copy this file, fill every field, run `task check-proposal`, commit.
@@ -92,10 +92,10 @@ under `agents/drafts/<proposal_id>.md` and link from here.
 List the checks the draft MUST pass before the gate signs off. The
 gate auto-runs every item in this list.
 
-- [ ] Passes `scripts/skill_linter.py` with zero errors
-- [ ] Passes `scripts/check_portability.py` (no project-specific
+- [ ] Passes `scripts/skill_linter.ts` with zero errors
+- [ ] Passes `scripts/check_portability.ts` (no project-specific
       identifiers)
-- [ ] References in the draft all resolve (`check_references.py`)
+- [ ] References in the draft all resolve (`check_references.ts`)
 - [ ] Size within budget for its type (per `size-enforcement` rule)
 - [ ] `preservation-guard` check: if `Replaces existing`, justify
       the replacement below.

package/dist/agent-src/templates/copilot-instructions.md

@@ -127,7 +127,7 @@ resolve at agent runtime. The patterns below are correct by design:
   `.augment/skills/`, `.augment/commands/` via installer-managed
   symlinks. Missing-file reports here are renderer artifacts.
 - **Body-link forms `../docs/guidelines/...`** (single-up). This is
-  the post-rewrite shape produced by `scripts/condense.py`. The
+  the post-rewrite shape produced by `scripts/condense.ts`. The
   condensed `dist/agent-src/rules/` tree is one level deeper than the
   source `.agent-src.uncondensed/rules/`, so the rewriter collapses
   `../../docs/...` to `../docs/...`. Both forms are expected — one in

package/dist/agent-src/templates/github-workflows/memory-hygiene.yml

@@ -1,7 +1,7 @@
 # Memory Hygiene — template shipped by agent-config
 #
 # Copy this file to `.github/workflows/memory-hygiene.yml` in the consumer
-# project. It runs `scripts/check_memory.py` on a weekly schedule and
+# project. It runs `agent-config memory:check` on a weekly schedule and
 # opens (or updates) a single tracking issue when stale entries are
 # found in `agents/memory/`.
 #
@@ -9,9 +9,12 @@
 # is a review signal, not a merge blocker. See
 # `road-to-engineering-memory.md` Phase 4 for the rationale.
 #
+# Runtime: Node/tsx (py2ts migration) — the check runs through the
+# `@event4u/agent-config` package via npx (`memory:check` resolves a
+# local `scripts/check_memory.ts` customization first, then the packaged
+# copy); no Python required.
+#
 # Prerequisites:
-#   - `scripts/check_memory.py` copied from
-#     `.augment/templates/scripts/check_memory.py` into the consumer repo.
 #   - At least one file exists under `agents/memory/` — absence short-
 #     circuits the job with an informational log, no issue opened.
 
@@ -36,13 +39,10 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up Node
+        uses: actions/setup-node@v4
         with:
-          python-version: "3.12"
-
-      - name: Install PyYAML
-        run: pip install pyyaml
+          node-version: "22"
 
       - name: Short-circuit if no memory files
         id: has_memory
@@ -63,7 +63,7 @@ jobs:
             echo "## Memory hygiene report"
             echo
             echo '```'
-            python3 scripts/check_memory.py --path agents/memory
+            npx --yes @event4u/agent-config memory:check --path agents/memory
             exit_code=$?
             echo '```'
           } > staleness.md