@event4u/agent-config 8.10.0 → 8.12.0

package/dist/agent-src/rules/architecture.md

@@ -8,6 +8,8 @@ triggers:
   - keyword: "service"
   - keyword: "module"
   - intent: "structural decision"
+routes_to:
+  - "skill:module-detect-on-the-fly"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 ---
@@ -20,6 +22,8 @@ ALWAYS VALIDATE AT THE REQUEST BOUNDARY. NEVER INLINE-VALIDATE INSIDE THE HANDLE
 ALWAYS READ AGENTS.MD AND PROJECT-LOCAL DOCS BEFORE STRUCTURAL DECISIONS.
 ```
 
+Fires on new files, classes, controllers, modules, or any structural decision about project organization.
+
 ## General Principles
 
 - **HTTP handlers stay thin** — no business logic; delegate to a service / use-case / domain layer.
@@ -34,27 +38,6 @@ ALWAYS READ AGENTS.MD AND PROJECT-LOCAL DOCS BEFORE STRUCTURAL DECISIONS.
 → Symfony: see [`symfony-workflow`](../skills/symfony-workflow/SKILL.md).
 → Next.js / TypeScript backends: see [`nextjs-patterns`](../skills/nextjs-patterns/SKILL.md).
 
-## Project Detection
-
-Detect the current project type from the **Git remote URL**, **directory name**, or **project files**:
-
-- **PHP** — `composer.json` (framework slot: Laravel via `artisan`, Symfony via `bin/console`, standalone otherwise).
-- **JS / TS** — `package.json` (framework slot: Next.js via `next` dep, Nuxt via `nuxt`, Express / Fastify / NestJS via deps; plain Node otherwise).
-- **Python** — `pyproject.toml` / `requirements.txt` (framework slot: Django via `django`, FastAPI via `fastapi`, Flask via `flask`).
-- **Go** — `go.mod` (framework slot: `gin`, `echo`, `fiber`, stdlib `net/http`).
-- **Ruby** — `Gemfile` (framework slot: Rails via `rails` gem, Sinatra otherwise).
-- **Rust** — `Cargo.toml` (framework slot: `axum`, `actix-web`, `rocket`).
-- Check `AGENTS.md` or `agents/` for project-specific documentation.
-
-Tooling lives in a runner file at the project root — detect once and reuse the result:
-`Taskfile.yml` → `task`, `Makefile` → `make`, `package.json` `scripts:` → `npm` / `pnpm` / `yarn`, `pyproject.toml` `[tool.poetry.scripts]` or `[project.scripts]` → `poetry` / `uv`, framework CLIs (`artisan`, `bin/console`, `manage.py`, `bin/rails`) when the matching manifest is present.
-
-## Project-Specific Architecture
-
-Each project documents its own architecture in `./agents/` and/or `AGENTS.md`.
-**Always read those files** before making structural decisions. Do not rely on this rule file
-for project-specific directory layouts, database conventions, or module systems.
-
 ## Architectural Decision Records (ADRs)
 
 When a structural decision is non-trivial (kernel membership, contract change, library swap,
@@ -64,33 +47,5 @@ skill — it numbers the file (`ADR-NNN-<slug>.md`), writes the standard templat
 index via `scripts/adr/regenerate_index.ts`. ADRs land in `docs/adr/` by default; legacy
 projects use `docs/decisions/`. Reversible refactors and minor cleanups do **not** need ADRs.
 
-## Module-Level Documentation
-
-Some projects use a module system (e.g. `app/Modules/` in Laravel, `apps/`/`packages/` in a Turborepo, `src/modules/` in NestJS, `internal/` in Go).
-Module roots and the per-module agent-docs folder are configured via
-`modules.root_paths` and `modules.agent_folder` in `.agent-settings.yml`
-(resolve at runtime via `scripts/_lib/agent_settings.ts::enumerate_modules()`).
-Modules may have their own agent docs under
-`{module_root}/*/{agent_folder}/` (Laravel shape: `app/Modules/*/agents/`) with:
-
-- Module descriptions and feature docs
-- Module-specific roadmaps (`agents/roadmaps/`)
-- Module-specific documentation (`Docs/`)
-
-When working on a module, **always check for module-level agent docs** first.
-
-## Packages
-
-Packages (Composer, npm, etc.) may also use `./agents/` in their root
-for package-specific docs and roadmaps. Treat them the same way as projects.
-
-## Build / Task Runner Detection
-
-Projects use either `Makefile` or `Taskfile.yml` (or both) for common commands.
-**Always check which one exists** and read it to discover available targets for
-testing, quality checks, container access, migrations, etc.
-
-- `Makefile` → use `make <target>`
-- `Taskfile.yml` → use `task <target>`
-
-Prefer these targets over raw `docker compose exec` commands when available.
+Body migrated to [`skill:module-detect-on-the-fly`](../skills/module-detect-on-the-fly/SKILL.md) (per P4 of `road-to-kernel-and-router.md`) — project-detection table, project-specific architecture docs, module-level documentation mechanics, packages, build/task-runner detection.
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/autonomous-execution.md

@@ -29,9 +29,7 @@ Three values: `on` (suppress trivial questions), `off` (ask trivial questions to
 
 ## Opt-in detection — match by intent, not exact string
 
-In `auto` mode, flip to `on` for the rest of the conversation when the user expresses **"stop asking on trivial steps, just work"**. Recognize **intent**, not the literal substring. Opt-out (same intent, reversed) flips back to `off`. Both directions are **speech-act-checked**: the phrase must be a meta-instruction to the agent, not content / quote / subject / code / third-party reference / hypothetical. In doubt → keep current mode, no speculative flips.
-
-Algorithm and speech-act heuristic: [`contexts/execution/autonomy-detection.md`](../contexts/execution/autonomy-detection.md). Anchor phrases (DE+EN), no-flip patterns, counter-examples, trivial-vs-blocking taxonomy, commit-policy summary, and named failure modes: [`contexts/execution/autonomy-mechanics.md`](../contexts/execution/autonomy-mechanics.md) + [`contexts/execution/autonomy-examples.md`](../contexts/execution/autonomy-examples.md).
+In `auto` mode, flip to `on` when the user expresses **"stop asking on trivial steps, just work"** — matched by intent, speech-act-checked, reversible; in doubt → no speculative flips. Algorithm: [`contexts/execution/autonomy-detection.md`](../contexts/execution/autonomy-detection.md); summary + anchor phrases + taxonomy: [`contexts/execution/autonomy-mechanics.md`](../contexts/execution/autonomy-mechanics.md) + [`contexts/execution/autonomy-examples.md`](../contexts/execution/autonomy-examples.md).
 
 ## Task-scope — autonomy is bound to the named task
 
@@ -41,22 +39,7 @@ DOES NOT CARRY OVER TO A DIFFERENT, LATER DELIVERABLE.
 NEW TASK → FRESH CONFIRMATION.
 ```
 
-Two distinct autonomy shapes — keep them apart:
-
-| Shape | Trigger | Scope |
-|---|---|---|
-| **Conversation-wide trivial-question suppression** | "stop asking on trivial steps, just work" — no deliverable named. | Sticky for the rest of the conversation. Suppresses trivial workflow questions only; never lifts blocking, Hard Floor, or [`scope-control`](scope-control.md) gates. |
-| **Task-scoped autonomous execution** | "work autonomously on X", "arbeite die Roadmap Y komplett ab", "do PROJ-123 end-to-end" — a deliverable / artifact / ticket is named. | Bound to **that** task. Ends when the task ends. Does **not** authorize starting a new, distinct task autonomously. |
-
-Litmus test: does the directive name (or unambiguously point to) a single concrete deliverable? Yes → task-scoped, scope ends with the deliverable. No → conversation-wide, trivial-question suppression only.
-
-When the user later issues a **new** request — different ticket, different roadmap, different artifact, different feature — treat it as a fresh task. Re-confirm autonomy for the new scope before:
-
-- creating a branch / worktree / PR / tag for the new work,
-- implementing a roadmap whose **authoring** was the prior turn's deliverable (per [`scope-control § authoring vs implementation`](scope-control.md#authoring-vs-implementation--verb-discipline)),
-- expanding scope beyond the new task's literal ask.
-
-In doubt whether the new request inherits or needs fresh confirmation → fresh confirmation. The Hard Floor and [`scope-control`](scope-control.md) gates apply to every task regardless.
+Litmus: does the directive name a single concrete deliverable? Yes → task-scoped, ends with the deliverable; no → conversation-wide trivial-question suppression only. Shapes table, re-confirmation triggers, and the in-doubt default: [`autonomy-mechanics § Task-scope`](../contexts/execution/autonomy-mechanics.md).
 
 ## User interrupts override the current task
 
@@ -64,7 +47,7 @@ A new instruction from the user mid-flight is **not** a continuation — see [`u
 
 ## Validation-loop budget — hard cap N=3 per target
 
-Autonomous flows must not iterate indefinitely on the same validation target. **Validation target** = a single identifiable artefact: a file path, a lint rule ID, a test name, a CI sub-task name. Natural-language clustering ("the linter stuff") does **not** count as a target — agents will rename their way out of the budget.
+**Validation target** = a single identifiable artefact (file path, lint rule ID, test name, CI sub-task name) — natural-language clusters ("the linter stuff") don't count.
 
 ```
 3 CONSECUTIVE FAILED ATTEMPTS ON THE SAME VALIDATION TARGET → STOP.
@@ -73,7 +56,7 @@ DO NOT ITERATE BEYOND N=3 WITHOUT EXPLICIT USER APPROVAL.
 COUNTER RESETS ONLY ON A DIFFERENT TARGET OR USER-APPROVED CONTINUATION.
 ```
 
-A "failed attempt" is an iteration that did not move the target from red to green. Tuning the tool around the target (e.g. growing an allowlist, loosening a threshold, suppressing a check) counts as an attempt — and is usually a sign the **tool**, not the content, is wrong.
+Failed attempt = an iteration that did not move the target red → green; tuning the tool around the target counts as an attempt.
 
 ### Antipattern — allowlist-growth as silent budget bypass
 
@@ -82,23 +65,10 @@ ALLOWLIST > 20 ENTRIES IN ONE SESSION = THE LINTER IS WRONG.
 STOP. PROPOSE LINTER REDESIGN OR REMOVAL. DO NOT EXPAND THE ALLOWLIST FURTHER.
 ```
 
-Crossing the 20-entry threshold counts as the 3rd validation-target failure for the linter in question, regardless of prior attempt count. The fix is a tool-shape change (heuristic tightening, scope narrowing, deletion), not more entries. Same logic for: warning-suppression lists growing past ~20, `// noqa` / `# type: ignore` sweeps over many files in one session, test `skip` / `xfail` bulk-adds to chase green.
-
-### Probe efficiency — direct over orchestration
-
-When validating a single target, run the **specific** check, not a meta-task that fans out to dozens of sub-tasks. Use the failing tool's direct entry point (the specific script invocation, the specific runner target, the single-test filter for the project's test runner) rather than the full CI meta-pipeline. Full-pipeline runs are appropriate at phase boundaries, not as a per-iteration probe.
-
-Concrete tool mapping — verify with the narrowest tool that proves the target green: a single `curl` / Playwright spec / browser run for HTTP behavior, the project's test runner with a `--filter` for one test, a debugger / `xdebug` step-through for one frame. Never substitute a meta-pipeline for a tool that pinpoints the failure.
-
-## Adaptive effort & stop (RDP)
+Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
-Scale effort to task difficulty, and stop when marginal evidence drops — coupled
-to the N=3 budget above, never replacing it. On a host with a native effort knob
-(e.g. an `effort` parameter), the right move is to **set it high** for hard tasks
-rather than scaffold; the scaffold here is for a standard host **without** such a
-knob. The per-dimension uncertainty score (see
-[`notes-first-reasoning`](notes-first-reasoning.md)) feeds this decision. Engage
-per [`rdp-gate`](../contexts/execution/rdp-gate.md).
+Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, N=3 mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also
 

package/dist/agent-src/rules/broken-access-control.md

@@ -25,7 +25,7 @@ packs: [engineering-base]
 
 # Broken Access Control
 
-The most common — and most damaging — failure in real systems and AI-written code: log in as one user, see another user's data. **Authenticated ≠ authorized.** The login check passes so the endpoint *feels* protected; the per-object ownership/tenant check is a separate line devs and AI omit — especially when the object id comes from the request. OWASP Web #1 (A01:2021) and API #1 (BOLA/IDOR), trivially scriptable, and a recurring real-world breach class — e.g. First American Financial (885M documents exposed via sequential ids with no ownership check).
+The most common — and most damaging — failure in real systems and AI-written code: log in as one user, see another user's data. **Authenticated ≠ authorized** — the per-object ownership/tenant check is the separate line devs and AI omit, especially when the object id comes from the request (OWASP Web #1 A01:2021 / API #1 BOLA/IDOR).
 
 ## The Iron Law
 
@@ -38,16 +38,6 @@ ROLE DECIDES WHICH FIELDS — THE SERVER STRIPS THEM. THE FRONTEND HIDING A FIEL
 A LIVE CROSS-USER EXPOSURE IS A NOTIFIABLE BREACH — NEVER SILENTLY PATCH IT.
 ```
 
-## Non-optional controls (every data-returning surface)
-
-- **Server-derived principal.** Ownership/tenant derived from the session/token, **never** from a request header/param/body the caller controls. A matching id in the request is not authorization.
-- **Ownership/tenant check on every request id** before returning data. `findById(params.id)` with no `where owner/tenant = currentPrincipal` is the canonical bug.
-- **Tenant-scoped by construction.** Every query on a tenant table carries the tenant predicate; prefer a base scope that injects it so a forgotten clause can't leak. (DSGVO: Mandantentrennung / Trennungskontrolle is a required TOM — a missing `tenant_id` filter is a compliance failure, not just a bug.)
-- **Response minimization.** Return only entitled fields — no `SELECT *` / full-object serialization leaking PII "because the model has it" (Art. 25(2)).
-- **Property-level authz (BOPLA / mass assignment).** Reject `role` / `user_id` / `tenant_id` / `is_admin` from the request body; explicit field allow-list, never whole-body binding.
-- **Role/field-level output filtering (vertical BOPLA).** *Which* fields a principal receives depends on role + business rules — a driver role must not receive `price`; an office role must not receive the boss's `offer`. Serialize via a **role-scoped output DTO**, never the raw model / `to_json()`; sensitive fields (`price`/`cost`/`margin`/`salary`/`discount`/`offer`/internal notes) default-deny per role.
-- **No guessable public ids** on sensitive resources — UUID/ULID, not sequential integers (turns one bug into full-DB enumeration).
-
 ## The three negative tests — the completion gate
 
 A protected endpoint is **not complete** until these exist and pass (happy-path 200 alone is the tautology this rule stops):
@@ -56,38 +46,7 @@ A protected endpoint is **not complete** until these exist and pass (happy-path
 2. **authenticated but not the owner → 403/404** (user A requests user B's object with A's token).
 3. **cross-tenant → 403/404** (a principal in tenant A requests tenant B's resource; prefer 404 on sensitive resources — a hard 403 confirms the id exists in another tenant).
 
-Small + task-aligned gap in code you touched → add the check **and** its negative test in the same commit (auto-fix boundary in `active-remediation`). Bigger → surface it.
-
-## Role-based field-level access — both directions (vertical BOPLA + BFLA)
-
-Object-ownership (above) is *horizontal* (may this principal touch this record). This is *vertical*: which **fields** and which **functions** a role may reach — the maintainer's case (driver ≠ price, office worker ≠ boss's offer). Depends on role + business rules, and **the server is the only boundary** — the frontend hiding a field does not protect it: the raw JSON on the wire is readable via `curl`/DevTools/a proxy (3Fun leak: a privacy toggle filtered only in the app; the server returned every user's location to a direct query).
-
-- **Read side (CWE-213 / Excessive Data Exposure).** Build the response from a **role-scoped output DTO** — never serialize the ORM model directly. Sensitive fields default-deny per role. A client `?fields=` selection is ergonomics, not authorization — intersect it server-side with the role's read-allowlist.
-- **Write side (CWE-915).** Bind input through a **role-scoped write-allowlist** — never the raw body. Read-allowed ≠ write-allowed: a role may *see* `status` but not *set* `status:"approved"`; two independent sets.
-- **Function level (BFLA, OWASP API #5).** A role must not reach a function/verb reserved for a higher role. Gate **every mutating verb** (POST/PUT/PATCH/DELETE), deny-by-default — not just the GET you were asked about. The admin button being hidden is not a control.
-- **Nested / GraphQL.** Field-level checks propagate to nested selections; a low-role token selecting a restricted field gets null/error, not data.
-- **Negative tests, per (role × sensitive field), both directions:** lower-role token → the field is **absent from the raw response body** (assert the body, not the UI); lower-role setting it on input → rejected/ignored, **verified by re-reading the persisted record**; every privileged verb → 403 for lower roles (403/404 on sensitive object reads).
-
-## Defense-in-depth (so one miss can't leak)
-
-Stack ≥2 independent layers on sensitive data — query-level ownership scoping, a centralized default-deny policy layer (a route with no policy is denied, not silently open), and DB row-level security as the backstop for a forgotten `WHERE tenant_id`. The RLS / policy-layer configuration, the per-role authz matrix, and the audit greps live once in [`authz-review`](../skills/authz-review/SKILL.md).
-
-## GDPR / DSGVO — data protection by design
-
-A cross-user leak violates **Art. 5(1)(f)** (integrity & confidentiality — a principle → higher fine tier), **Art. 25** (by design/default: default-deny + least privilege + response minimization), and **Art. 32** — which also **mandates a process for regularly testing effectiveness** of these controls (untested authz is a direct Art. 32 gap; hence the three negative tests are non-optional). A discovered live exposure is a **notifiable breach** (Art. 33, 72 h from discovery) — surface as "notify + remediate", never a silent patch. Data-protection context, not legal advice → `privacy-review`, `domain-safety-pii`.
-
-## Backstop greps (authoring-time)
-
-```bash
-# Record fetched by request id with no owner/tenant predicate nearby (high-noise — a hit means read the line, not auto-fix)
-rg -n '(findById|find|findOne|get)\(\s*(req\.|request\.|params\.|\$request|\$id)'
-# Client-supplied tenant/user hint used as the scope (should come from the session)
-rg -n '(tenant|tenantId|user_id|userId)\s*=\s*(req|request|params|headers|query)\.'
-```
-
-The full authoring-time grep set (mass-assignment, raw-serialization, secrets) lives once in [`ai-code-blindspots`](../skills/ai-code-blindspots/SKILL.md).
-
-A hit means read that line — is the ownership/tenant check present? Some are safe (already scoped); none should ship unchecked.
+Small + task-aligned gap in code you touched → add the check **and** its negative test in the same commit (see `active-remediation` for the auto-fix boundary). Bigger → surface it.
 
 ## When it fires
 
@@ -95,12 +54,15 @@ Writing/modifying any endpoint, route, query, or serializer returning user- or t
 
 ## When NOT to fire
 
-- Public, non-user-specific data with no principal concept (public docs page, health check with no data).
+- Public, non-user-specific data with no principal concept (a public docs page, a health check with no data).
 - Prose/docs/config-only edits.
 
+Body migrated to [`skill:authz-review` § Broken-access-control depth](../skills/authz-review/SKILL.md) (per P4 of `road-to-kernel-and-router.md`) — non-optional controls, role-based field-level access (vertical BOPLA + BFLA), defense-in-depth, GDPR/DSGVO grounding, backstop greps.
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
+
 ## See also
 
-- [`authz-review`](../skills/authz-review/SKILL.md) — the 6-stage per-entrypoint chain, defense-in-depth, authz matrix, negative-test contract.
+- [`authz-review`](../skills/authz-review/SKILL.md) — the 6-stage per-entrypoint chain, defense-in-depth, authz matrix, negative-test contract, and the migrated depth above.
 - [`security-sensitive-stop`](security-sensitive-stop.md) — threat-model BEFORE editing an auth/tenant path (fires first).
 - [`active-remediation`](active-remediation.md) — the fix-now/ask/follow-up ladder + the live-exposure safety carve-out.
 - [`threat-modeling`](../skills/threat-modeling/SKILL.md), [`multi-tenancy`](../skills/multi-tenancy/SKILL.md), [`ai-code-blindspots`](../skills/ai-code-blindspots/SKILL.md), [`privacy-review`](../skills/privacy-review/SKILL.md).

package/dist/agent-src/rules/code-comment-discipline.md

@@ -0,0 +1,64 @@
+---
+type: "auto"
+tier: "2b"
+alwaysApply: false
+description: "Writing/editing code in any language — a comment states a WHY or a constraint the code cannot show; never restate what names/types already say; no signature-mirroring docblocks"
+triggers:
+  - intent: "writing or generating code"
+  - intent: "adding a class / method / function"
+  - intent: "refactoring code"
+  - keyword: "comment"
+  - keyword: "docblock"
+  - keyword: "phpdoc"
+  - keyword: "jsdoc"
+  - keyword: "docstring"
+  - keyword: "implement"
+  - keyword: "class"
+  - keyword: "method"
+  - keyword: "refactor"
+workspaces: [engineering]
+packs: [engineering-base]
+---
+
+# Code Comment Discipline
+
+AI-written code over-comments: docblocks that mirror the signature, comments that narrate the next line, banner headers, change-log notes. Every redundant comment costs tokens on every future read, bloats the file, and rots into misinformation the moment the code changes. The default for any new comment is **no** — a comment must earn its place.
+
+## The Iron Law
+
+```
+A COMMENT STATES A WHY OR A CONSTRAINT THE CODE CANNOT SHOW — NOTHING ELSE.
+NEVER RESTATE WHAT THE CODE, THE NAME, OR THE TYPE ALREADY SAYS.
+NO DOCBLOCK THAT ONLY MIRRORS THE NATIVE SIGNATURE.
+DOCBLOCKS EARN THEIR PLACE ONLY WITH MACHINE-RELEVANT PRECISION
+(GENERICS, ARRAY SHAPES, NON-TRIVIAL UNIONS) OR GENUINE WHY-CONTEXT.
+WHEN IN DOUBT: NO COMMENT. SHORTER IS BETTER. NONE IS OFTEN BEST.
+```
+
+## What a comment is FOR
+
+Exactly five legitimate jobs — everything else is noise:
+
+1. **A why** — the non-obvious reason this approach was chosen over the obvious one.
+2. **An invariant or constraint** the code cannot express — ordering requirements, units, concurrency assumptions, "must run before X".
+3. **A warning** — a known trap, a workaround for a specific upstream bug (name it), a performance cliff.
+4. **Machine-relevant type precision** the native type system cannot carry — carve-out in the guideline.
+5. **A spec linkage** where an external contract defines the behavior (RFC section, protocol field) — the contract, not the ticket history.
+
+Test before writing any comment: *would deleting it leave a future reader confused about a non-obvious constraint?* No → don't write it.
+
+## When NOT to fire
+
+- Prose surfaces: docs, READMEs, roadmaps, config commentary — different register, not code comments.
+- The user explicitly asks for documented code / teaching examples ("erkläre im Code", "annotate this for juniors") — that turn's ask wins.
+- License headers or file-level pragmas a toolchain requires.
+
+Body migrated to [`guideline:code-clarity § Comment discipline`](../docs/guidelines/code-clarity.md#comment-discipline--state-a-constraint-not-a-narration) (per P4 of `road-to-kernel-and-router.md`) — banned-classes table, machine-relevant precision carve-out, `code_style.docblocks` public-API carve-out, per-language keep/drop tables, worked examples, scope boundary, fixtures pointer.
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
+
+## See also
+
+- [`code-clarity.md § Comment discipline`](../docs/guidelines/code-clarity.md#comment-discipline--state-a-constraint-not-a-narration) — canonical long-form with the migrated body.
+- [`minimal-safe-diff`](minimal-safe-diff.md) — diff-shape twin; no comment additions or removals on untouched code.
+- [`output-discipline`](output-discipline.md) — adjacent but distinct: bans placeholder prose (`// TODO: implement`); this rule bans redundant prose.
+- `docs/guidelines/php/php-coding-patterns.md` § PHPDoc — PHP-specific operationalization.

package/dist/agent-src/rules/context-hygiene.md

@@ -67,6 +67,20 @@ When **3 consecutive attempts** at the same task fail (code fix, test fix, confi
 
 **Does NOT reset the counter:** Unrelated tasks. User providing new information (course correction).
 
+**Failure identity — same error vs new error.** Failure signature = **same target + same error class** (same failing test + same assertion/exception, same lint rule id, same build error).
+
+- **Same failure signature twice → stop and pivot now.** Don't burn the third attempt on a near-identical retry of a fix that already failed the same way — a repeated identical signature means the hypothesis is wrong, not under-applied. Change strategy (re-read source, new hypothesis, ask).
+- **New error signature each attempt = progress.** Peeling one error to reveal a different one is forward motion; counter continues — learning, not looping.
+
+**Hard-blocker classes — skip retries, go straight to ask/surface.** On the **first** occurrence, do not count toward the 3 — stop and surface:
+
+- Missing credentials / unset required secret or token.
+- Permission denied (auth/authz, file mode, protected branch, scope).
+- Spend / quota / rate limit reached (billing cap, API quota, 429 that won't self-clear).
+- External-service `5xx` / outage / DNS-unreachable — a dependency is down, not your code.
+
+Retrying a hard-blocker is the canonical wasted-attempt; the fix is a decision or external change only the user/environment can make.
+
 ## Tool Loop Detection
 
 Calling the **same tool** more than **2 times in a row** with similar parameters = loop.

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -12,6 +12,8 @@ triggers:
   - keyword: "already decided"
   - keyword: "locked decision"
   - keyword: "budget blocks"
+routes_to:
+  - "skill:decision-review"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 ---
@@ -34,88 +36,18 @@ and offers the user a path to re-evaluate the lock. Progress means
 adaptation: locks encode what was true when they were written, not a
 ceiling on what the package may ever become.
 
-## What counts as a "lock"
+**Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
+tested*, not every future proposal that resembles it — if the blocked change
+is a different mechanism, the lock does not apply; proceed, noting the
+distinction.
 
-- An eval verdict recorded as an honest null (a mechanism was tested,
-  showed no lift, and the disposition says "don't rebuild without new
-  evidence").
-- A memory entry or `agents/settings/contexts/` note tagged "don't
-  relitigate" / "settled" / a locked council convergence.
-- A budget or frugality-canon line (`token-budget-discipline`,
-  `telegraph-speak`, thin-projector trimming) that rejects a change on
-  cost grounds alone.
-- An ADR whose decision is being cited as a blocker for the current change.
-- A **hard structural cap** (kernel size, per-domain persona cap, rich-skill
-  ratio). A change that genuinely *qualifies* to cross the cap — e.g. a new
-  rule that truly meets the kernel-membership inclusion criteria — triggers a
-  **cap-raise proposal + maintainer/council approval**, never a silent
-  downgrade of the rule to fit the old number (e.g. demoting a must-always-fire
-  rule to `auto` just because the kernel says 9). Fitting the cap is not a
-  reason to weaken a qualifying rule; but a rule that does **not** meet the
-  criteria stays out — the cap is not the reason, the criteria are.
-
-## What to do when it fires
-
-1. **Mechanism-match check — do this FIRST.** A verdict settles the
-   *mechanism it tested*, not every future proposal that resembles it.
-   Before applying the lock, verify the blocked change is actually the
-   same mechanism — not merely a similar-sounding one. A null on
-   hardened blocking enforcement does not automatically cover
-   discretionary contextual nudges; a null on one architecture does not
-   cover a materially different one. If the mechanism differs, the lock
-   does not apply — proceed, noting the distinction.
-2. **If the mechanism genuinely matches**, do not silently comply.
-   Surface, in one short block:
-   - What change is blocked.
-   - Which lock blocks it (cite the memory/context/ADR).
-   - Under what conditions the lock was recorded (date, evidence, or
-     "maintainer decision" if settled-by-decision rather than
-     settled-by-evidence).
-   - What has changed since (new evidence, new model generation, new
-     tooling, repeated encounters) that makes revisiting worth the cost.
-3. **Offer numbered options** (per [`user-interaction`](user-interaction.md)),
-   always including: re-evaluate the lock in the AI council. Other
-   options: keep the lock as-is, or proceed without the blocked change.
-4. **On re-evaluation:** route to [`decision-review`](../skills/decision-review/SKILL.md)
-   for the backward-audit procedure and to [`ai-council`](../skills/ai-council/SKILL.md)
-   for the debate mechanics. This rule owns the obligation to surface;
-   those skills own the procedure.
-5. **Record the outcome** with scope + `revisit-if` per
-   [`ai-council`](../skills/ai-council/SKILL.md)'s convergence-summary
-   contract — every re-evaluated lock gets a fresh, correctly-scoped
-   disposition, not a re-statement of the old one.
-
-## When NOT to fire
-
-- The blocked change has no real benefit — this rule is not a lever to
-  reopen every settled question; [`no-cheap-questions`](no-cheap-questions.md)
-  still governs whether the resulting numbered-options block is a real
-  question or noise. A revisit-offer with a genuine trade-off is never
-  a "cheap question" under that rule — but a revisit-offer with no
-  actual case for change is.
-- The mechanism-match check (step 1) shows the lock is the same
-  mechanism and no new evidence exists — apply the lock, no surfacing
-  needed; this is the lock working as intended.
-- The user already declined a revisit on this exact lock this
-  conversation — per [`scope-control § Decline = silence`](scope-control.md),
-  do not re-ask.
-
-## Failure modes
-
-- Treating a "don't relitigate" memory as permanently closed instead of
-  as settled-under-conditions-X.
-- Applying a null verdict to a superficially similar but architecturally
-  different mechanism without running the mechanism-match check.
-- Letting the token-frugality canon auto-reject a net-positive change
-  without surfacing the trade-off — see [`token-budget-discipline`](token-budget-discipline.md)'s
-  value-over-budget clause.
-- Silently dropping a good idea because "we already decided this" —
-  the canonical failure this rule exists to stop.
+Body migrated to [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md) (per P4 of `road-to-kernel-and-router.md`) — what-counts-as-a-lock catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs, hard structural caps), the five fire steps, when-NOT-to-fire, failure modes.
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also
 
 - [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
-  procedure this rule routes to when a lock is genuinely re-evaluated.
+  procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
 - [`decision-record`](../skills/decision-record/SKILL.md) — forward-flow decision

package/dist/agent-src/rules/delegation-policy.md

@@ -61,22 +61,24 @@ primitive → run in-session (clean no-op).
 2. **Tier-size** each slice (`lite|medium|high`) per the classification context —
    never the orchestrator's own session tier (the cost win is the per-call
    downsize; see [`subagent-routing`](../contexts/execution/subagent-routing.md)).
-3. **Dispatch** via the matching `subagent-orchestration` mode (independent →
-   do-in-parallel; ordered → do-in-steps; risk/correctness → + judge).
+3. **Dispatch** via the form gate + matching `subagent-orchestration` mode
+   (independent → do-in-parallel; ordered → do-in-steps; risk/correctness →
+   + judge; UI-heavy → live-app judge, efficacy-gated).
 4. **Verify** every return per
    [`verify-budget`](../contexts/execution/verify-budget.md); the cross-model
    judge Iron Law and the N=3 budget ([`autonomous-execution`](autonomous-execution.md))
    are never lifted.
 5. **Respect the failure-type stop and the ordering gate** — two consecutive
    verification-failed returns from one subagent type stop that type for the
-   session (an application of the N=3 budget, no new mechanism); an ordered
-   slice never dispatches before its declared parent's return is verified.
-   Both per [`subagent-steering`](../contexts/execution/subagent-steering.md).
+   session (an application of the N=3 budget, no new mechanism), and an
+   ordered slice never dispatches before its declared parent's return is
+   verified. Both per
+   [`subagent-steering`](../contexts/execution/subagent-steering.md).
 6. **Record** telemetry after each dispatch — run `orchestration_record`
    (one validated line: spawn_count, token_delta + provenance, tier, task_class)
    per [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
-   § Emit. Agent-behavioral capture the savings report reads; skipping it leaves
-   the value-of-orchestration question unmeasured.
+   § Emit. This is the agent-behavioral capture the savings report reads;
+   skipping it leaves the value-of-orchestration question unmeasured.
 
 ## Scope — does NOT
 
@@ -88,7 +90,7 @@ primitive → run in-session (clean no-op).
 
 ## See also
 
-- [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md) — the 7 modes this selects.
+- [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md) — the form gate + 8 modes this selects.
 - [`subagent-boundary`](../docs/contracts/subagent-boundary.md) — what a subagent owns vs never owns (task-meaning, memory, pack-surface, safety-floor bypass).
 - [`auto-orchestration-activation`](../contexts/execution/auto-orchestration-activation.md) — the gate.
 - [`reasoning-orchestrator`](../skills/reasoning-orchestrator/SKILL.md) — RDP dispatch, now gated here.

package/dist/agent-src/rules/design-fidelity.md

@@ -127,6 +127,10 @@ brand evidence**. The design-surface instance of the no-invented-facts floor.
 - **Icons follow the iconography floor** — no emoji-as-icon in serious UI, no
   hand-rolled icon when a set exists; see
   [`iconography`](../skills/iconography/SKILL.md) § Iconography floor.
+- **Ask before adding material — no unrequested filler.** Never generate copy,
+  placeholder sections, or decorative blocks the user did not ask for to "complete"
+  a design. Brief silent on a region → surface the gap ([`ask-when-uncertain`](ask-when-uncertain.md))
+  or leave an honest placeholder; never invent filler to fill space.
 
 ## See also
 

package/dist/agent-src/rules/git-history-discipline.md

@@ -32,6 +32,8 @@ packs: [engineering-base]
 
 # Git History Discipline
 
+Fires on any rebase / squash / fixup / amend / force-push / `reset --hard` / squash-merge intent, on a divergent local↔origin state, or on a branch carrying commits you did not author this session.
+
 ## Iron Law — Gate (no unsolicited rewrites)
 
 ```
@@ -62,31 +64,6 @@ THAT ALREADY EXISTS ON A BRANCH (LOCAL OR REMOTE) — WITHOUT ASKING
 THE USER THIS TURN. PARALLEL WORK IS THE DEFAULT, NOT THE EXCEPTION.
 ```
 
-The user often works in parallel with the agent, and multiple agents may
-share one PR branch. A commit that looks "unrelated" or "stray" may be
-deliberate in-flight work the user expects to keep. Reseating a branch onto a
-different base, `git reset --hard`-ing away inherited commits, force-pushing
-over a branch you did not create, or branching from a base with unexpected
-commits and then "cleaning" them out all **silently discard work** — the exact
-failure this law prevents.
-
-Before ANY of these, STOP and ask (one numbered-options prompt per
-[`user-interaction`](user-interaction.md)):
-
-- reseating a branch's base (`git rebase --onto`, `git reset --hard <other-base>`)
-  in a way that drops commits already on the branch;
-- excluding / not-carrying-forward commits that were on the branch when you
-  started this session;
-- force-pushing (or `push <local>:<remote>`-replacing) a branch that carries
-  commits you did not author;
-- branching from a base with unexpected commits, then resetting them away.
-
-**Preserve-first is necessary but not sufficient.** Even when you keep the
-commits reachable (a save-branch / tag), you still **ask before** the branch
-the user sees loses them — "I preserved them locally" is not a substitute for
-the question, because the user may be mid-edit on the shared branch and a
-force-push would clobber their in-flight work regardless of your local backup.
-
 When in doubt about whether a commit is yours to touch: it is not. Ask.
 
 ## When rewrite is allowed
@@ -99,60 +76,8 @@ Exactly three:
 
 Anything else — chunk-tidiness, "logical order", folding a follow-up fix into its parent — **forbidden**. The follow-up ships as its own commit (`fix: …`, `chore: …`).
 
-## Two protective stops (for the protocol phase)
-
-1. **Pre-rewrite stop.** Before any squash / amend / rebase on a branch that is on origin: `git fetch && git rev-list --left-right --count HEAD...@{u}`. If **either** side is non-zero — STOP and route to `skill:git-workflow § Divergent-State Recovery`. A blind `git pull --rebase` in this state is the documented failure mode.
-
-2. **Post-rewrite stop.** After the rewrite, push in the **same turn** with `--force-with-lease=<branch>:<fetched-sha>` and verify `git rev-parse origin/<branch>` equals `git rev-parse HEAD`. If the push fails (hook, network, token budget) — fix the cause and re-push **before** ending the session, committing new work, or handing off.
-
-If either stop fires and resolution is not immediate → tag the state (`git tag local-rewritten-tip-<ISO-date>`) and hand control back to the user. Do not let a new session inherit a dirty divergence.
-
-## Equivalents that are also forbidden by default
-
-- `git rebase -i` (interactive)
-- `git rebase --autosquash`
-- `git commit --fixup` / `--squash` (helpers that feed autosquash)
-- `git commit --amend` on already-pushed commits
-- `git push --force` / `--force-with-lease` (unless paired with the protocol)
-- `git reset --hard` past unpushed work the user might want
-- Squash-merge of a PR via API or CLI when the user has not picked the merge strategy
-- Cherry-pick rewriting that drops or reorders commits
-
-`--amend` on the *current local* commit before the first push is the narrow exception (treated as continuing to compose the commit, not rewriting history).
-
-## Amend-after-hook-failure trap (data-loss)
-
-When a **pre-commit hook fails, the commit did NOT happen** — no new commit
-object was created. A reflexive `git commit --amend` at that point does not
-"retry the commit"; it rewrites the **previous, already-good** commit,
-destroying that work. This is the one place the narrow `--amend` exception
-above turns into data loss.
-
-Recovery — never amend after a hook failure:
-
-1. Read the hook output and **fix the cause** (the lint/test/format failure).
-2. **Re-stage** the fix (`git add`).
-3. Create a **NEW commit** (`git commit`, not `--amend`) — the prior commit was
-   never overwritten and must stay intact.
-
-Recovery procedures live next to this mechanism in
-[`skill:git-workflow`](../skills/git-workflow/SKILL.md).
-
-## Why this rule exists
-
-Interactive rebase + fixup loops generate disproportionate token cost on every iteration: re-running CI per replayed commit, resolving the same content conflict in three derived files (`.condensation-hashes.json`, `dist/router.json`, `.windsurfrules`), losing the working tree to a stash that silently re-introduces older state. A single conflict can burn the budget of an entire feature.
-
-A previous session squashed a pushed branch, the push hook failed at the token boundary, the session ended — and the next session saw local and origin pointing at different SHAs for the same logical work. A blind `git pull --rebase` cascaded into conflicts across every derived file. Recovery required forensic SHA-archaeology. The pre/post-rewrite stops make that sequence structurally impossible.
-
-## When you'd be tempted
-
-- "I want commit 3 to come before commit 2 because the topic flows better." → don't. Reviewers read the PR diff.
-- "There are two `chore: regenerate` commits, ugly." → don't. They are honest checkpoints.
-- "A linter caught an issue in commit 2 — let me fold the fix in." → don't. Add `fix(scope): …` on top.
-- "I want to drop the WIP commit before pushing." → ask the user first.
-- "Squash-merge when I open the PR will clean it anyway." → also true, also irrelevant — let the merge strategy do that work, not you.
-- "My branch inherited some unrelated commits — I'll reseat it on `origin/main` so my PR is clean." → **don't, ask first.** They may be the user's parallel work or another agent's. Preserve them and ask which base the user wants.
-- "The remote branch has commits I didn't author and no PR — I'll just force-push over it." → don't. No-PR is not no-owner; ask before replacing a branch you did not create.
+Body migrated to `skill:git-workflow` (per P4 of `road-to-kernel-and-router.md`) — shared-branch ask-before-drop protocol, two protective stops, forbidden-equivalents list, amend-after-hook-failure recovery, why-this-exists rationale, temptation catalog.
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also