@event4u/agent-config 8.11.0 → 8.12.0

package/docs/decisions/ADR-121-knowledge-sensitivity-classes.md

@@ -0,0 +1,90 @@
+---
+adr: 121
+status: accepted
+date: 2026-07-12
+decision: knowledge-sensitivity-classes
+supersedes: —
+superseded_by: —
+phase: feedback-8.11
+type: structural
+---
+
+# ADR-121 — Per-card sensitivity classes for the knowledge boundary
+
+## Status
+
+Accepted (2026-07-12). Successor note to ADR-119 (global knowledge sharing
+default ON) — adds boundary teeth; does NOT revert the flip.
+
+## Context
+
+The 8.11.0 external reviews and the maintainer both name cross-project
+context transfer as the riskiest open surface of the ADR-119 flip: the only
+per-entry axis was origin tier (`public|vendor|proprietary` — where knowledge
+came from), the binary page flag `visibility: private`, and a write-time
+regex redaction gate. There was NO sensitivity taxonomy (how far an entry may
+travel), no per-card owner/expiry on shared cards, no promotion-reason
+capture, and no revocation trail — deletion was silent.
+
+A two-round council debate (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
+2026-07-12) split on scope: one member argued measure-first with a 2-level
+enum at most (six classes over-fit a single-maintainer install — `team` /
+`organization` are phantom categories today); the other argued the full
+six-class taxonomy from the reviews. Resolution: a SMALL machine-anchored
+axis now (the maintainer's danger is present, not speculative), the wider
+enum behind a revisit-if.
+
+## Decision
+
+Three sensitivity classes, each anchored to a machine check
+(`agents/settings/contexts/knowledge-sensitivity.md` carries the full table):
+
+- `prohibited` — redaction-class content; a redaction hit FORCES this class
+  (declared values cannot override it); hard linter error in the global
+  store (check G6).
+- `project` — the DEFAULT; promotion structurally refused unless a human
+  reclassifies; unset/invalid resolves here, never upward.
+- `shareable` — global-store eligible; requires passing redaction AND full
+  provenance: `source_repo`, `owner`, `review_after`, `promotion_reason`
+  (checks G4/G5); `promotion_reason` is mandatory human input — there is no
+  auto-`shareable` path.
+
+Plus an append-only revocation ledger (`.revocations.jsonl` tombstones
+written by `forget`/`purge` BEFORE deletion; rendered via
+`knowledge:global:list --revoked`).
+
+ADR-119's default-ON, `allowed_tiers: [public]`, measurement window, and
+demotion trigger are unchanged.
+
+## Consequences
+
+- Cross-project transfer now requires a recorded human decision per card
+  (class + reason), machine-verified in CI (`check_knowledge_cards` G4–G6)
+  and at promotion time (`gate_sensitivity_for_promotion`).
+- Deletion is auditable; the demotion trigger of ADR-119 gains a per-entry
+  trail to point at.
+- Cost: one more frontmatter field + four footer fields on shared cards;
+  no new subsystem, no read-time machinery.
+
+## Alternatives considered
+
+- Six-class enum `{local-only, project, team, organization, confidential,
+  prohibited}` (the reviews' proposal) — rejected now: `team`/`organization`
+  have no consumer today; widening is cheap later, narrowing is not.
+  Revisit-if: a real multi-tenant org install exists.
+- Revert ADR-119 to default-OFF — rejected: re-creates the ADR-103
+  measure-then-decide deadlock; the danger is contained by classes + gates,
+  not by turning the layer off.
+- Semantic PII detection / k-anonymity — out of scope per ADR-119 §6
+  (write-time text gate, single-install trust boundary).
+
+## References
+
+- `agents/settings/contexts/knowledge-sensitivity.md` — locked design table.
+- ADR-119 — the flip this hardens.
+- Implementation: `knowledge_global.ts` (SENSITIVITIES, footer fields),
+  `knowledge_global_promote.ts` (`resolve_effective_sensitivity`,
+  `gate_sensitivity_for_promotion`, tombstones), `knowledge_global_cli.ts`
+  (promote/forget/purge/list flags), `check_knowledge_cards.ts` (G4–G6);
+  118 tests across 6 files incl. 3 cross-project-contamination adversarial
+  cases.

package/docs/decisions/INDEX.md

@@ -123,6 +123,8 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | [ADR-117](ADR-117-subagents-auto-default-on.md) | Subagents Auto Default On | accepted | 2026-07-09 | — |
 | [ADR-118](ADR-118-loop-engineering-boundaries.md) | Loop Engineering Boundaries | accepted | 2026-07-10 | — |
 | [ADR-119](ADR-119-global-knowledge-default-on.md) | Global Knowledge Default On | accepted | 2026-07-12 | 103 |
+| [ADR-120](ADR-120-council-chairman-mode.md) | Council Chairman Mode | accepted | 2026-07-12 | — |
+| [ADR-121](ADR-121-knowledge-sensitivity-classes.md) | Knowledge Sensitivity Classes | accepted | 2026-07-12 | — |
 | [ADR-200](ADR-200-python-to-typescript-migration.md) | Python To Typescript Migration | accepted | 2026-06-11 | — |
 
 ## Unnumbered (legacy)

package/docs/design/council-vs-solo-baseline.md

@@ -0,0 +1,92 @@
+# Council-vs-solo baseline eval — design (pre-registered)
+
+> Design artifact for `road-to-feedback-8.11` Phase 3. It fixes the
+> methodology **before** the first billable call; the run itself is
+> spend-gated (blocker `council-baseline-spend-authorization` — the user
+> confirms the rendered estimate in-session). This document is the "design
+> the baseline" step — not the run. Companion claim:
+> `docs/CLAIMS.md § council-vs-solo-baseline` (status: unbacked until the run
+> resolves).
+
+## Why this exists
+
+The council deliberation protocol (stance tally, chairman, debate gates,
+anti-conformity) is well-built and default-off — but there is **no evidence
+that convening the council beats a single strong model** on any decision
+class. The 2026-07-12 feedback-disposition debate (claude-sonnet-4-5 +
+gpt-4o) REJECTED adding a ≥2-of-5 admission gate for exactly this reason and
+ADOPTED this baseline as the precondition for ANY further
+deliberation-protocol expansion: admission criteria must be derived from
+empirical decision characteristics, not a-priori heuristics.
+
+Shadow-log status at design time (2026-07-12): `agents/runtime/council/
+shadow-log.jsonl` is **absent/empty** on both the main checkout and the run
+worktree — the shadow-dispatch agreement mechanism has produced zero
+analyzable lines. That absence is itself the first finding: the only
+council-vs-solo signal the package planned to collect has no data, so a
+deliberate baseline run is the only path to a verdict.
+
+## Arms
+
+| Arm | What runs | Cost profile |
+|---|---|---|
+| A — solo | ONE strong model (the council's strongest configured member, single call, standard prompt) | 1 call/decision |
+| B — council | The full configured council in `debate` mode (2 members × ≤2 rounds, current defaults; stance tally ON so dissent is recorded) | 4–5 calls/decision |
+
+Same decision text, same context budget, both arms blind to each other.
+
+## Corpus — ≥30 real decisions
+
+- Source: real decision questions from the repo's own history — the
+  council-labelled golden set (labels final per the 2026-07-11 amendment; no
+  re-labelling) plus archived council question files whose ground-truth
+  disposition is now KNOWN (the decision shipped and survived, was reverted,
+  or was killed by later evidence). Minimum n = 30; pre-register the exact
+  list in the run manifest BEFORE the first call.
+- Class mix: at least 8 decisions per impact class {low, medium, high} so the
+  per-class analysis (the whole point — which characteristics correlate with
+  council lift) is not vacuous.
+
+## Metrics — fixed before data
+
+1. **Quality**: blind post-hoc grading of both arms' verdicts against the
+   known ground-truth disposition — primary judge = strongest available
+   model, blind second judge, report Cohen's κ (reuse `cohensKappa()` /
+   `judgeKappa()` from `src/scripts/check_quality_regression.ts`); verdict
+   admissible only at κ ≥ 0.60.
+2. **Cost**: tokens + USD (from the council cost ledger) + wall-clock per
+   decision, per arm.
+3. **Characteristics capture**: per decision, record the five feedback-
+   proposed dimensions (reversibility cost, material spend/risk,
+   multi-perspective conflict, evidence tension, policy/governance change) as
+   booleans AT PRE-REGISTRATION TIME (not after results) — so the ≥2-of-5
+   hypothesis is testable as a POST-HOc correlate without having gated
+   anything.
+
+## Kill criterion (falsifiable, from the 2026-07-12 debate)
+
+- **No lift anywhere**: if council decisions show no identifiable quality
+  lift on ANY decision subset (overall AND per impact class AND per
+  dimension-count stratum), further deliberation-protocol phases STOP and
+  the protocol goes maintenance-only; `road-to-opt-council-deliberation`
+  records the honest null.
+- **Lift on a subset**: derive empirical admission criteria FROM that
+  subset's recorded characteristics (which may or may not match the ≥2-of-5
+  heuristic — the data decides), and only then design an admission gate.
+- **Judge floor**: κ < 0.60 → record κ, withhold the win-rate, do not claim
+  either direction.
+
+## Spend gate
+
+Execution requires in-session user confirmation of the rendered estimate
+(existing council estimate machinery; ~30 decisions × (1 + ~4.5) calls —
+estimate rendered by `council estimate` at run time). Authoring the corpus
+manifest and this design is unblocked and free.
+
+## Non-goals
+
+- Not a cross-provider capability comparison (both arms use the configured
+  members; provider identity is held constant per arm definition).
+- Not a re-test of the deliberation features individually (stance tally,
+  chairman) — arm B runs the current default debate shape; feature ablations
+  are follow-ups only if B beats A at all.

package/docs/design/utilization-window-criteria.md

@@ -0,0 +1,51 @@
+# Utilization-window decision criteria — pre-registered
+
+> Design artifact for `road-to-feedback-8.11-2` Phase 0. The engagement
+> observation window (telemetry.artifact_engagement, id-only,
+> PII-excluded-by-construction) has been RUNNING in the agent-config repo
+> since 2026-07-12. Per the repo's claims convention, the window's decision
+> rules are fixed HERE, BEFORE the numbers accumulate — the reviewer's
+> warning was precise: without pre-fixed criteria "the window ends with
+> many events and no decidable statement." Companion claim:
+> `docs/CLAIMS.md § utilization-window-decidability`.
+
+## Observation floor (all three, else "underpowered")
+
+1. **≥ 100 recorded task boundaries** in `.agent-engagement.jsonl`
+   (boundary_kind `task` or `phase-step`).
+2. **≥ 2 distinct hosts** contributed records (host identity read from the
+   session context at analysis time, not stored in the event — the event
+   schema stays id-only; if host cannot be attributed without widening the
+   schema, the floor degrades to "≥ 2 distinct recording periods ≥ 14 days
+   apart" and this deviation is recorded in the closing report).
+3. **≥ 45 elapsed days** since 2026-07-12.
+
+Below the floor at day 90 → the window is **underpowered**: extend ONCE by
+30 days. Still below → STOP, record the honest null ("insufficient natural
+usage volume to decide utilization"), and do NOT rebuild collection
+apparatus without a new demand signal.
+
+## Decision rules (fixed now — no goalpost-moving)
+
+| # | Observation at window close | Bound decision |
+|---|---|---|
+| D1 | Artifact kind entry (skill/rule/command/guideline/persona id) **loaded-never-consulted** across the full window (requires the U1a `loaded` denominator; if U1a has not landed, D1 degrades to consulted-set analysis and says so) | Goes on the **retirement-candidate list** feeding U1's ranked cut list — candidate, not auto-cut; kernel + safety floors exempt by construction |
+| D2 | Artifact **consulted-never-applied** with ≥ 5 consultations and applied-ratio < 10% | Goes on the **trigger-review queue** (description/trigger overhaul, not deletion) |
+| D3 | Window closes **above the floor** | The first U1 report MUST name ≥ 1 concrete keep/cut/review decision per artifact kind, or record per kind why the data does not support one |
+| D4 | Window closes **below the floor** (after the one extension) | Honest null; lifecycle-automation and field-outcome-ledger gates STAY closed (their revisit-if remains "≥ 1 full window") |
+
+## Explicitly out of scope for this window
+
+- **Outcome-quality attribution** (did artifact X improve the result) —
+  needs the `loaded` denominator plus far more volume; stays with U1a.
+- **Cost-vs-rework economics** — owned by the orchestration telemetry
+  track (`road-to-subagent-value-realization-followup`).
+- **Cross-repo aggregation** — the window is this repo only (council
+  condition from the 8.11 disposition).
+
+## Kill criterion
+
+If the window closes decidable (D3) but its decisions are cited by zero
+actual portfolio changes within 2 releases, the analysis layer (not the
+telemetry) is the dead weight — record that honest null before building
+any further reporting on top.

package/docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md

@@ -95,6 +95,74 @@ When making decisions:
 - Avoid rework caused by wrong assumptions
 - Prefer: short clarification early → correct implementation once
 
+## 8. Improve before implement — pre-implementation validation
+
+_Origin: migrated from `src/rules/improve-before-implement.md` per the P4 pattern of `road-to-kernel-and-router.md`. The rule keeps the activation lists and the golden rule ("Challenge to improve, never to refuse"); the check detail lives here._
+
+Before coding a new feature, refactor, module, or behavior-altering change, quickly verify:
+
+### 8a. Is the request clear?
+
+- Are acceptance criteria defined or derivable?
+- Is the scope bounded? (not "make it better" but "add X to Y")
+- Are edge cases considered?
+
+**If unclear** → ask ONE focused question. Max 2 questions, never an interrogation.
+
+### 8b. Does it fit the existing architecture?
+
+- Does similar functionality already exist?
+- Does it follow established patterns in the codebase?
+- Does it contradict existing conventions?
+- Do **multiple valid patterns/frameworks** already exist (e.g. Tailwind + Flux, multiple form libraries, competing state stores)? If yes, do NOT pick one arbitrarily — ask which to use.
+- Is the change a **second branch on the same discriminator** — second `match`/`switch` arm, second `if/elseif`, or second class hardcoded to one enum value (e.g. `Provider::FOO`, `'stripe'`)? If yes, run the Strategy sniff test before adding the branch — see [`strategy.md`](../php/patterns/strategy.md#sniff-test--when-an-enumstring-discriminator-wants-to-become-a-strategy).
+
+**If misfit** → show evidence (file references), propose alternative.
+**If multiple valid options** → list them, ask which to use. See [§ 2 — No blind implementation](#2-no-blind-implementation).
+
+### 8c. Is the approach sound?
+
+- Is there a simpler way to achieve the same result?
+- Are there known problems with the requested approach?
+- Does the scope match the stated goal? (not over-engineered, not under-specified)
+
+**If problematic** → explain the concern, propose a better approach.
+
+### How to challenge
+
+- **Be concise** — one sentence per concern, not paragraphs
+- **Show evidence** — reference existing code, patterns, or conventions
+- **Offer alternatives** — don't just say "this is wrong"
+- **Use numbered options** — let the user choose quickly
+- **Respect "just do it"** — if the user insists after your challenge, execute immediately
+
+Example:
+
+```
+> ⚠️ `UserService` already has a `deactivate()` method that covers this case.
+>
+> 1. Use existing method — extend with new parameter
+> 2. Create new method anyway — I'll explain the overlap in a comment
+> 3. Skip validation — implement as requested
+```
+
+After presenting concerns: user picks an option → execute immediately; user says "just do it" → execute immediately. Never argue twice about the same point. Never block work — delay is only justified if it prevents a clear mistake.
+
+### Scope limits
+
+- **Max 1-2 challenges per task** — not every request needs validation
+- **Max 1 minute of analysis** — if the check takes longer, skip it
+- **Never validate simple tasks** — only features, architecture, significant changes
+- **Never validate after the user already explained their reasoning**
+
+### Verify with concrete tools, not prose
+
+If the challenge requires you to confirm current behavior before proposing an alternative, use a concrete probe — a `curl` against the endpoint, a Playwright spec, a debugger / `xdebug` step-through, or the project's test runner with a targeted filter. Asserting current behavior from memory is not validation.
+
+### Intent inference (RDP, standard host)
+
+When the literal request and the underlying goal may differ, **state the inferred goal in one line and give ONE recommendation** — do not spread 2–3 framings (that is the overplanning [`direct-answers`](../../../src/rules/direct-answers.md) suppresses). Standard host only; a strong-reasoning host self-infers, so skip it there. Engage per [`rdp-gate`](../../../src/agent-src/contexts/execution/rdp-gate.md).
+
 ## Anti-patterns
 
 - Asking 5 complex questions at once

package/docs/guidelines/agent-infra/rule-body-migration-inventory.md

@@ -0,0 +1,241 @@
+# Rule Body Migration Inventory
+
+> Full classification of every `src/rules/*.md` file against the P4 pattern
+> (thin Iron-Law stub + `Body migrated to skill:X / guideline:Y` routing
+> line) — done vs. not-yet-done vs. must-never-be-done, with concrete
+> target homes for the not-yet-done set.
+
+_Compiled: 2026-07-12 · Scope: `src/rules/*.md` only (104 files) · Method
+below._
+
+## Method
+
+1. Read every rule's frontmatter (`type`, `alwaysApply`, `tier`) and body
+   line count via `wc -l`.
+2. Checked kernel membership against
+   [`docs/contracts/kernel-membership.md`](../../contracts/kernel-membership.md)
+   § 4 — the 9 rules currently carrying `type: "always"` /
+   `alwaysApply: true` are the live kernel (`user-interrupt-priority` was
+   demoted from the kernel back to `type: auto` on 2026-07-06 per that
+   contract's provenance log, so it is **not** counted as kernel here even
+   though an earlier section of the same contract still labels it the
+   "10th kernel rule" — frontmatter is ground truth).
+3. Grepped case-insensitively for `migrated to` across `src/rules/*.md` to
+   find rules that already point their body at a skill/guideline/context —
+   including near-variants of the exact P4 phrase (`Portability body
+   migrated to …`, `Sync body migrated to …`).
+4. For rules **without** that marker, read the full body (already present
+   verbatim in-session from the `dist/agent-src/rules/` projection, which
+   preserves Iron Laws byte-for-byte and body structure per
+   `preservation-guard`) and judged: is the non-Iron-Law content (a)
+   already effectively a thin routing hub even without the literal phrase
+   (e.g. `source-of-truth.md`'s "Mechanics — … live in
+   `[…]`" pointer), (b) a tight, load-bearing enforcement surface — a
+   table, a literal-string marker set, a short numbered check — that
+   doesn't shrink usefully by relocating, or (c) genuine bulk (worked
+   examples, rationale essays, multi-step procedures, failure-mode
+   catalogs) with either an existing skill/guideline that already
+   half-references it, or an obvious net-new location.
+5. For every `should-migrate` candidate, verified the named target file
+   actually exists (`ls`/`find`) before citing it as "existing"; targets
+   that don't exist are marked "new guideline needed".
+
+## Classification table
+
+Legend: **class** = `thin` (already-thin) / `migrate` (should-migrate) /
+`stay` (must-stay-monolithic). **Kernel?** = Y only for the 9 live
+always-loaded rules.
+
+| rule | class | body lines | kernel? | target home | note |
+|---|---|---:|:---:|---|---|
+| active-remediation.md | migrate | 92 | | new guideline: `docs/guidelines/agent-infra/active-remediation-mechanics.md` | ladder detail, version-gated modernization, guardrails prose extractable; Iron Law + ladder tiers + live-security carve-out stay |
+| agent-authority.md | stay | 26 | Y | — | kernel priority index; body IS the routing table |
+| analysis-skill-routing.md | thin | 20 | | `skill:analysis-skill-router` (existing) | pure P4 stub |
+| architecture.md | migrate | 96 | | `skill:module-detect-on-the-fly` (existing) | Project Detection / Build-Runner Detection / Module & Package docs sections migratable; keep Iron Law + General Principles (already pointer-heavy to laravel/symfony/nextjs skills) |
+| artifact-drafting-protocol.md | migrate | 122 | | new guideline: `docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md` | Phase A/B/C detail + roadmap batch-mode carve-out extractable; keep Iron Law + phase headers + golden rules |
+| artifact-engagement-recording.md | thin | 52 | | `contexts/contracts/artifact-engagement-flow.md` (existing) | routes via "Recording contract + privacy floor: […]" phrasing, functionally P4 |
+| ask-when-uncertain.md | stay | 66 | Y | — | kernel Iron Law + ask-policy floor |
+| augment-edit-discipline.md | thin | 29 | | `guideline:augment-portability-patterns` + `skill:agent-docs-writing` (both existing) | two explicit "body migrated to" sentences |
+| autonomous-execution.md | thin | 81 | | `contexts/execution/autonomy-mechanics.md` + siblings (existing) | hybrid: several short Iron-Law-style blocks retained (Hard Floor pointer, N=3 budget headline), full mechanics already migrated |
+| brand-consistency.md | stay | 75 | | — | gate definition is the enforcement surface itself; already routes deeper mechanics to `brand-identity`/`brand-to-tokens`/`design-intelligence` |
+| brand-source-of-truth.md | stay | 65 | | — | explicitly "light by design"; precedence order is the whole rule |
+| broken-access-control.md | thin | 68 | | `skill:authz-review` (existing) | hybrid: 2 short Iron-Law blocks (3 negative tests) retained, deep controls/matrix/backstop-grep content already migrated |
+| cli-output-handling.md | thin | 40 | | `skill:rtk-output-filtering` (existing) | pure P4 stub |
+| code-comment-discipline.md | migrate | 148 | | `docs/guidelines/code-clarity.md` (existing) | already cross-references this guideline as "canonical long-form"; 3 worked-example code blocks + carve-out detail duplicate it and can move, keeping Iron Law + banned-class table + scope boundary |
+| command-suggestion-policy.md | stay | 47 | | — | tier `mechanical-already`; single Iron Law + 5-item subordination list is the whole enforcement surface |
+| commit-conventions.md | thin | 20 | | `skill:conventional-commits-writing` (existing) | pure P4 stub |
+| commit-policy.md | stay | 67 | Y | — | kernel Iron Law + commit exceptions |
+| communication-through-line.md | stay | 42 | | — | short; 5-item checkable-behaviors list is the whole rule |
+| content-quoting-floor.md | stay | 88 | | — | the 5 numbered floor rules + carve-outs ARE the enforcement; failure-modes list is short (4 bullets), not worth extracting |
+| context-hygiene.md | migrate | 186 | | new guideline: `docs/guidelines/agent-infra/context-hygiene-mechanics.md` | **longest rule in the tree**; hook-fallback prose, state-dump template, Copilot-fallback procedure, Augment ignored-skills recovery all extractable; keep Iron-Law-style freshness/3-failure/loop-detection triggers |
+| copilot-routing.md | thin | 20 | | `skill:copilot-config` (existing) | pure P4 stub |
+| decision-revisit-gate.md | migrate | 128 | | `skill:decision-review` (existing) | lock-type catalog + failure-mode catalog extractable; keep Iron Law + "what to do when it fires" steps + "when NOT to fire" |
+| delegation-policy.md | stay | 96 | | — | already a routing hub in all but name — 6 numbered obligations, each 1–2 lines pointing at an existing context file (`auto-orchestration-activation.md`, `subagent-steering.md`, etc.) |
+| design-fidelity.md | migrate | 140 | | new guideline: `docs/guidelines/design-fidelity-mechanics.md` | "Surgical visual edits" + "Asset & imagery discipline" + failure-mode catalog are substantial illustrative content; keep Iron Law + strictness-mode table + when-fires/not |
+| devcontainer-routing.md | thin | 21 | | `skill:devcontainer` (existing) | pure P4 stub |
+| direct-answers.md | stay | 62 | Y | — | kernel — 3 Iron Laws |
+| docker-commands.md | thin | 21 | | `skill:docker` (existing) | pure P4 stub |
+| domain-adoption-policy.md | migrate | 158 | | new guideline: `docs/guidelines/agent-infra/domain-adoption-gates.md` | 3-gate rationale essays + "what to do when gates fail" procedure + failure-mode catalog are substantial and rarely-fired (only on new-domain proposals); keep Iron Law + 3 gate names |
+| domain-safety-disclaimer.md | stay | 117 | | — | domain safety floor |
+| domain-safety-pii.md | stay | 166 | | — | domain safety floor (2nd-longest rule; 4-surface redaction tables ARE the enforcement) |
+| domain-safety-retention.md | stay | 87 | | — | domain safety floor |
+| downstream-changes.md | stay | 80 | | — | the "what to check" table + breaking-change lists ARE the checklist |
+| engineering-safety-floor.md | stay | 91 | | — | domain safety floor |
+| external-code-graph-interop.md | stay | 65 | | — | narrow, tight; numbered steps are the whole rule |
+| external-reference-deep-dive.md | stay | 70 | | — | failure-mode catalog + case-zero anchor are load-bearing recognition material, not filler; below the bulk threshold applied elsewhere |
+| fast-path-marker-visibility.md | stay | 83 | | — | body IS literal marker strings the agent must reproduce verbatim; cannot be paraphrased into a skill |
+| finance-safety-floor.md | stay | 103 | | — | domain safety floor |
+| framework-neutrality-in-generic-skills.md | migrate | 131 | | new guideline: `docs/guidelines/agent-infra/framework-neutrality-patterns.md` | 10-row forbidden-pattern table + cross-stack/carve-out examples extractable; keep Iron Law + scope + enforcement pointer (linter is the backstop either way) |
+| git-history-discipline.md | thin | 90 | | `skill:git-workflow` (existing) | hybrid: 3 short Iron-Law blocks retained, full mechanics already migrated |
+| guidelines.md | thin | 30 | | `contexts/communication/rules-auto/guidelines-mechanics.md` (existing) | "Index — see mechanics" pointer, functionally P4 |
+| icon-consistency.md | stay | 52 | | — | tight; already routes deeper mechanics to `iconography` skill |
+| image-likeness-and-rights.md | stay | 65 | | — | explicit "Compose — do NOT duplicate" section pointing at 5 media policy files; gate table is short |
+| improve-before-implement.md | migrate | 124 | | `docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md` (existing) | already cross-referenced twice ("no blind implementation"); worked-example block + scope-limits detail extractable |
+| invite-challenge.md | stay | 72 | | — | worked-example block is short and essential; below bulk threshold |
+| language-and-tone.md | stay | 62 | Y | — | kernel Iron Law |
+| laravel-routing.md | thin | 26 | | `skill:laravel` (existing) | pure P4 stub |
+| laravel-translations.md | thin | 26 | | `skill:laravel` (existing) | pure P4 stub |
+| legal-safety-floor.md | stay | 134 | | — | domain safety floor — but note: already the **best existing exemplar** of the P4 pattern applied *within* a safety floor (5 Iron Laws kept inline, all operating mechanics migrated to `skill:legal-practice-profile`); a template for the other 6 safety floors below, none of which do this yet |
+| lethal-trifecta-guard.md | stay | 86 | | — | conceptual (3 legs) + short decision list; no removable bulk |
+| linked-projects-onboarding-gate.md | thin | 35 | | `guideline:agent-infra/linked-projects-onboarding-gate` (existing) | pure P4 stub |
+| low-impact-corpus-privacy-floor.md | stay | 77 | | — | 8-class forbidden-content table IS the redactor spec (mirrors `scripts/ai_council/redact_low_impact_entry.ts`) |
+| markdown-safe-codeblocks.md | stay | 23 | | — | trivial |
+| media-governance-routing.md | stay | 83 | | — | already a routing rule by design (7 pointers into `agents/settings/policies/media/`); rationale essay is short |
+| media-sync-ground-truth.md | stay | 74 | | — | 6-step procedure is the whole rule |
+| minimal-safe-diff.md | migrate | 166 | | new guideline: `docs/guidelines/agent-infra/minimal-safe-diff-mechanics.md` | **tied-longest rule**; "Anti-over-engineering", "Own-orphan cleanup", "Break-glass exception", "Bounded remediation carve-out" are each self-contained essays with worked criteria; keep Iron Law + "the rule" + "before writing the diff" + red flags |
+| missing-tool-handling.md | thin | 20 | | `guideline:agent-infra/missing-tool-handling` (existing) | pure P4 stub |
+| model-recommendation.md | thin | 23 | | `guideline:agent-infra/model-recommendation` (existing) | pure P4 stub |
+| no-attribution-footers.md | stay | 55 | | — | short; forbidden-pattern list is the check |
+| no-cheap-questions.md | stay | 72 | Y | — | kernel — 6 Iron Laws + self-check |
+| no-decorative-emojis-in-git-surfaces.md | stay | 110 | | — | whitelist/blacklist/legend-carve-out tables ARE the enforcement surface, must stay verbatim |
+| no-pr-progress-comments.md | stay | 105 | | — | gated/not-gated lists ARE the enforcement surface |
+| no-roadmap-references.md | migrate | 139 | | `skill:agent-docs-writing` (existing) | already cross-referenced ("roadmap layer conventions"); structural-carveout table + 4-step "what to do instead" + narrative failure modes extractable |
+| non-destructive-by-default.md | stay | 59 | Y | — | kernel Hard Floor |
+| notes-first-reasoning.md | stay | 69 | | — | structural section list is the whole rule |
+| onboarding-gate.md | stay | 31 | | — | trivial |
+| output-discipline.md | stay | 83 | | — | banned-placeholder-pattern table IS the enforcement surface (mirrors `lint_output_slop.ts`) |
+| package-ci-checks.md | thin | 20 | | `skill:lint-skills` (existing) | pure P4 stub |
+| persona-governance.md | migrate | 91 | | `docs/contracts/persona-schema.md` (existing) | already routes schema/catalog there; "four checks" full elaboration + day-one historical note extractable, keep Iron Law + check names + failure modes |
+| php-coding.md | thin | 25 | | `guideline:php/php-coding-patterns` (existing) | pure P4 stub |
+| prefer-enums-over-literals.md | stay | 65 | | — | all content directly operative (when/when-not/how); no removable bulk |
+| preservation-guard.md | stay | 95 | | — | body IS the condensation-quality checklist consumed by `check_condensation.ts` |
+| provider-lifecycle-discipline.md | migrate | 78 | | `docs/contracts/provider-lifecycle.md` (existing) | already the primary reference; "why agent-in-the-loop, not Python gate" rationale essay + day-one state note extractable |
+| question-not-instruction.md | stay | 76 | | — | short "the trap" narrative + 3-step protocol is the whole rule |
+| reviewer-awareness.md | thin | 27 | | `skill:review-routing` (existing) | pure P4 stub |
+| roadmap-ci-steps-policy.md | migrate | 155 | | `contexts/execution/roadmap-process-loop.md` (existing) | already cross-referenced ("§5 owns the inline-skip mechanics"); forbidden-pattern table + authoring/execution procedure detail extractable |
+| roadmap-progress-sync.md | thin | 90 | | `guideline:agent-infra/roadmap-progress-mechanics` (existing) | hybrid: 3 Iron Laws + PR-gate + mandatory pre-send self-check retained, long-form detail already migrated |
+| role-mode-adherence.md | stay | 59 | | — | short; already delegates contract detail to `docs/guidelines/agent-infra/role-contracts.md` |
+| rule-type-governance.md | thin | 18 | | `guideline:agent-infra/rule-type-governance` (existing) | pure P4 stub |
+| runtime-safety.md | stay | 49 | | — | trivial |
+| scope-control.md | stay | 67 | Y | — | kernel — git-ops permission gate |
+| security-sensitive-stop.md | stay | 103 | | — | surface table + "what to do when it fires" table + memory-lookup command block ARE the enforcement surface; security-critical, kept loaded rather than gated behind a fetch |
+| senior-engineering-discipline.md | stay | 82 | | — | already delegates deep detail to `skill:ai-code-blindspots`; remaining prose is the anchor summary |
+| size-enforcement.md | stay | 35 | | — | trivial |
+| skill-improvement-trigger.md | thin | 20 | | `skill:skill-improvement-pipeline` (existing) | pure P4 stub |
+| skill-quality.md | thin | 18 | | `guideline:agent-infra/skill-quality-checklist` (existing) | pure P4 stub |
+| slash-command-routing-policy.md | thin | 21 | | `skill:command-routing` (existing) | pure P4 stub |
+| source-confidentiality.md | stay | 97 | | — | two short Iron-Law-style blocks; each section is directly operative |
+| source-discovery-gate.md | stay | 96 | | — | two short Iron-Law-style blocks; already delegates the procedure to `skill:source-discovery` and 2 context files |
+| source-of-truth.md | thin | 78 | | `contexts/communication/rules-auto/source-of-truth-mechanics.md` (existing) | explicit "Mechanics — … live in […]" pointer, functionally P4 |
+| spreadsheet-source-quality.md | stay | 61 | | — | source-priority list is the whole rule |
+| strategy-safety-floor.md | stay | 104 | | — | domain safety floor |
+| symfony-routing.md | thin | 26 | | `skill:symfony-workflow` (existing) | pure P4 stub |
+| telegraph-speak.md | stay | 85 | | — | self-describing condensation mechanism; algorithm must stay next to the Iron Law it governs (applies to every reply) |
+| think-before-action.md | thin | 64 | | `contexts/communication/rules-auto/think-before-action-mechanics.md` (existing) | explicit "obligation surface / lookup material" split, functionally P4 |
+| token-budget-discipline.md | stay | 118 | | — | 2 Iron-Law-style blocks + 2 classification tables ARE the governance criteria |
+| token-efficiency.md | thin | 35 | | `contexts/communication/rules-auto/token-efficiency-mechanics.md` (existing) | explicit "Mechanics — …" pointer, functionally P4 |
+| token-optimizer-maintenance.md | stay | 69 | | — | narrow, self-referential meta-rule about one skill's catalog freshness |
+| tool-safety.md | stay | 53 | | — | short; constraints list is the whole rule |
+| ui-audit-gate.md | thin | 59 | | `skill:existing-ui-audit` (existing) | hybrid: Iron Law + allow-list retained, rest migrated |
+| untrusted-input-defense.md | migrate | 142 | | `docs/guidelines/agent-infra/untrusted-input-spotlighting.md` (existing) | injection-signal taxonomy (dark patterns, session integrity, autofill, card-from-chat) is substantial and already half-covered by this guideline; keep Iron Law + found-instructions quarantine + "what to do" |
+| upstream-proposal.md | thin | 20 | | `skill:upstream-contribute` (existing) | pure P4 stub |
+| user-interaction.md | thin | 74 | | `contexts/communication/rules-auto/user-interaction-mechanics.md` (existing) | explicit "obligation surface / lookup material" split, functionally P4 |
+| user-interrupt-priority.md | stay | 58 | | — | short; classify-table + 3-step protocol is the whole rule (demoted from kernel 2026-07-06, still foundational authority content) |
+| verify-before-complete.md | stay | 80 | Y | — | kernel — already partially delegates to `contexts/execution/verification-mechanics.md` |
+
+## Summary counts
+
+| class | count |
+|---|---:|
+| `already-thin` | 32 |
+| `should-migrate` | 16 |
+| `must-stay-monolithic` | 56 |
+| **total** | **104** |
+
+`must-stay-monolithic` breakdown: 9 kernel + 7 domain-safety-floor
+(`finance-safety-floor`, `legal-safety-floor`, `strategy-safety-floor`,
+`engineering-safety-floor`, `domain-safety-disclaimer`, `domain-safety-pii`,
+`domain-safety-retention`) + 40 other (short/tight/table-is-the-law rules).
+
+`already-thin` breakdown: 27 carry the literal (or near-literal, e.g.
+"Portability body migrated to …") P4 routing phrase; 5 more
+(`guidelines.md`, `source-of-truth.md`, `think-before-action.md`,
+`token-efficiency.md`, `user-interaction.md`) achieve the same
+obligation-surface / lookup-material split via an explicit "Mechanics — …
+live in `[…]`" pointer instead of the exact phrase, and are counted as
+thin because their residual body is small and non-duplicative.
+
+## Full should-migrate list with targets
+
+| rule | body lines | target home | status |
+|---|---:|---|---|
+| context-hygiene.md | 186 | `docs/guidelines/agent-infra/context-hygiene-mechanics.md` | new guideline needed |
+| minimal-safe-diff.md | 166 | `docs/guidelines/agent-infra/minimal-safe-diff-mechanics.md` | new guideline needed |
+| domain-adoption-policy.md | 158 | `docs/guidelines/agent-infra/domain-adoption-gates.md` | new guideline needed |
+| roadmap-ci-steps-policy.md | 155 | `src/agent-src/contexts/execution/roadmap-process-loop.md` | existing — extend |
+| code-comment-discipline.md | 148 | `docs/guidelines/code-clarity.md` | existing — extend |
+| untrusted-input-defense.md | 142 | `docs/guidelines/agent-infra/untrusted-input-spotlighting.md` | existing — extend |
+| design-fidelity.md | 140 | `docs/guidelines/design-fidelity-mechanics.md` | new guideline needed |
+| no-roadmap-references.md | 139 | `skill:agent-docs-writing` | existing — extend |
+| framework-neutrality-in-generic-skills.md | 131 | `docs/guidelines/agent-infra/framework-neutrality-patterns.md` | new guideline needed |
+| decision-revisit-gate.md | 128 | `skill:decision-review` | existing — extend |
+| improve-before-implement.md | 124 | `docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md` | existing — extend |
+| artifact-drafting-protocol.md | 122 | `docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md` | new guideline needed |
+| architecture.md | 96 | `skill:module-detect-on-the-fly` | existing — extend |
+| active-remediation.md | 92 | `docs/guidelines/agent-infra/active-remediation-mechanics.md` | new guideline needed |
+| persona-governance.md | 91 | `docs/contracts/persona-schema.md` | existing — extend |
+| provider-lifecycle-discipline.md | 78 | `docs/contracts/provider-lifecycle.md` | existing — extend |
+
+7 new guidelines needed; 9 target an existing skill/guideline/context file.
+
+## Batching proposal (input to the follow-on rule-load roadmap, not edited here)
+
+Grouped by target-home affinity into 3 batches of 5–6, ordered so the
+new-guideline-heavy batch (more authoring work, less risk of touching a
+kernel-adjacent surface) lands first and the safety/security-adjacent batch
+lands last (extra review scrutiny, smallest batch):
+
+**Batch 1 — new agent-infra guidelines (5 rules, all net-new targets)**
+`context-hygiene.md`, `minimal-safe-diff.md`, `domain-adoption-policy.md`,
+`artifact-drafting-protocol.md`, `active-remediation.md` → each gets its own
+new `docs/guidelines/agent-infra/*-mechanics.md` (or `*-gates.md`). No
+cross-rule dependency; can land in any order inside the batch.
+
+**Batch 2 — extend existing docs/contracts + docs/guidelines (6 rules)**
+`code-comment-discipline.md` → `docs/guidelines/code-clarity.md`;
+`decision-revisit-gate.md` → `skill:decision-review`;
+`improve-before-implement.md` → `docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md`;
+`architecture.md` → `skill:module-detect-on-the-fly`;
+`persona-governance.md` → `docs/contracts/persona-schema.md`;
+`provider-lifecycle-discipline.md` → `docs/contracts/provider-lifecycle.md`.
+Each target already has partial coverage of the migrating content — lowest
+risk of duplication/contradiction, good second batch.
+
+**Batch 3 — execution/security-adjacent (5 rules, extra review)**
+`roadmap-ci-steps-policy.md` → `contexts/execution/roadmap-process-loop.md`;
+`no-roadmap-references.md` → `skill:agent-docs-writing`;
+`untrusted-input-defense.md` → `docs/guidelines/agent-infra/untrusted-input-spotlighting.md`;
+`design-fidelity.md` → `docs/guidelines/design-fidelity-mechanics.md` (new);
+`framework-neutrality-in-generic-skills.md` → `docs/guidelines/agent-infra/framework-neutrality-patterns.md` (new).
+Grouped last because 2 of the 5 touch security/untrusted-input adjacent
+surfaces (`untrusted-input-defense`, and indirectly `no-roadmap-references`
+via the CI-reference-integrity gate) and 2 are linter-companion rules
+(`roadmap-ci-steps-policy`, `framework-neutrality-in-generic-skills`) where
+the migrated prose must stay in lockstep with the corresponding
+`scripts/lint_*.ts` — worth a slower, more careful pass.
+
+## See also
+
+- [`docs/contracts/kernel-membership.md`](../../contracts/kernel-membership.md) — the 9-rule kernel this inventory treats as permanently must-stay.
+- [`docs/guidelines/agent-infra/model-recommendation.md`](model-recommendation.md) / [`docs/guidelines/agent-infra/roadmap-progress-mechanics.md`](roadmap-progress-mechanics.md) — worked examples of the target-file header/format convention this inventory's proposed new guidelines should follow (`# Title` + `>` one-line summary + `_Origin: migrated from …`_ + Iron-Law restatement + sections; no frontmatter).
+- The roadmap layer's "P4" migration pattern — the mechanism this inventory audits; not cited by filepath per [`no-roadmap-references`](../../../src/rules/no-roadmap-references.md) (roadmap files are transient, this inventory is durable).