@event4u/agent-config 8.11.0 → 8.13.0

package/docs/contracts/ai-team-config.md

@@ -0,0 +1,191 @@
+---
+stability: beta
+keep-beta-until: 2026-10-10
+---
+
+# AI-Team Config (`ai_team` block)
+
+**Purpose.** Lock the schema, validation, and quota rules for the `/team`
+cross-model review family — one strong external model (via the codex CLI,
+subscription-authed) reviewing inside the repo. Team mode is the **depth**
+complement to the council's **breadth**; this contract is the boundary that
+prevents drift across the settings template, the loader, the `/team`
+wrappers, and the quota counter.
+
+**Audience.** Authors of `src/scripts/ai_team/config.ts`, the `/team`
+command family, the doctor `team` section, and the setup wizard. Also
+reviewers checking that new team features keep the schema intact.
+
+**Status.** Internal-locked. Changes require a contract version bump and a
+revision entry in the consuming roadmap.
+
+## File location
+
+Unlike the council (ALWAYS user-global `.ai-council.yml` — see
+[ai-council-config.md](ai-council-config.md)), the `ai_team` block lives in
+the **project settings cascade**:
+
+```
+<project>/.agent-settings.yml   →   ai_team: { … }
+```
+
+read via `load_agent_settings` (`src/scripts/_lib/agent_settings.ts`) and
+validated by `src/scripts/ai_team/config.ts:load_ai_team_config`. Team mode
+is a per-project posture (default-off), not a per-developer credential
+store — the codex CLI carries the subscription auth itself, so there is
+nothing secret to centralize. The shipped defaults live in
+`src/config/agent-settings.template.yml` and are mirrored by the wizard
+schema (`src/server/schemas/settings.ts`, enforced by the schema↔template
+parity test).
+
+## Schema
+
+```yaml
+ai_team:
+  enabled: <bool>                 # master switch, default false
+  model: <string>                 # default 'auto'
+  allow_delegate: <bool>          # second opt-in for the write path, default false
+  max_calls_per_day: <int >= 0>   # default 50; counts into the shared openai bucket
+  suppress_setup_hint: <bool>     # default false; cosmetic wizard-hint suppression
+```
+
+| Key | Type | Default | Semantics |
+|---|---|---|---|
+| `enabled` | bool | `false` | Master switch. `false` = `/team` commands are never suggested and every invocation refuses with an enable pointer — byte-identical to pre-feature behavior. `true` = the family is live; per-command gates below still apply. |
+| `model` | string | `'auto'` | Model handed to the codex CLI. `'auto'` = pass **no** `--model` flag; the codex CLI's own default applies. Any other value passes through **verbatim** as `--model <value>`. |
+| `allow_delegate` | bool | `false` | Second opt-in for the **only** wrapper that delegates write access (`/team:delegate`). Refuses with an enable pointer until BOTH `enabled` and `allow_delegate` are `true`. |
+| `max_calls_per_day` | int ≥ 0 | `50` | Per-day ceiling on team calls, read against the **shared** `cli_call_budget` openai bucket (see § Quota). `0` blocks all team calls. |
+| `suppress_setup_hint` | bool | `false` | Suppress the one-line wizard/init recommendation to install the codex plugin on Claude-Code hosts. Cosmetic only. |
+
+### Why `model: 'auto'` instead of a pinned ID
+
+A hardcoded model ID rots silently (the council's own CLI default is a
+deliberate, documented *pin* — `DEFAULT_OPENAI_CLI_MODEL` in
+`src/scripts/ai_council/clients.ts`, see
+[ai-council-config.md](ai-council-config.md)). Team mode inverts that:
+under a subscription the *strongest* available model is the rational
+default, and only the codex CLI knows what that currently is. `'auto'`
+therefore delegates the choice to the CLI; a set value is a user pin and
+passes through verbatim — the loader never rewrites or "corrects" it.
+
+**Future keys:** `review_gate` (managed, loop-bound governance of the
+plugin's Stop-hook Review Gate) is reserved for a later team-mode phase
+(Phase 4). Do not add it — or any other key — ahead of its phase; the
+loader rejects unknown keys today by design.
+
+## Role semantics — the council-verdict design constraint
+
+Verbatim from the consuming roadmap's council verdict, binding on every
+team-mode phase:
+
+> **Council verdict on team-mode frontmatter (claude-sonnet-4-5 + gpt-4o,
+> 2026-07-12, unanimous REJECT):** skills/commands get NO `team_mode` /
+> role frontmatter. Role semantics belong in the `ai_team` config block +
+> prompt library (reusing subagent-orchestration's implementer/judge frame
+> and status envelope), not smeared across 271 skill files while the
+> feature's role model does not operationally exist. Revisit-if: Phase 2
+> execution turns out to be blocked SPECIFICALLY on artefact-level role
+> metadata — then re-open via decision-revisit-gate, not by silently
+> adding the key.
+
+Operationally: ALL role semantics (builder/reviewer/verifier selection,
+eligibility) live HERE — in this `ai_team` block — plus the prompt
+library, reusing `subagent-orchestration`'s implementer/judge frame and
+its `subagent-status.json` envelope. **No `team_mode`/role frontmatter key
+is added to skill/command/rule schemas.**
+
+## Quota — one subscription, one counter
+
+```
+TEAM CALLS COUNT INTO THE EXISTING cli_call_budget OPENAI BUCKET.
+ONE SUBSCRIPTION, ONE COUNTER. NEVER A PARALLEL COUNTER.
+```
+
+The daily CLI-call counter is already **generic per-provider** — no
+team-specific counting system exists or may be built:
+
+- **State file:** `~/.event4u/agent-config/cli-calls.json`
+  (`CLI_CALLS_FILENAME`, `src/scripts/ai_council/clients.ts:716`), shape
+  `{ date: "YYYY-MM-DD", counts: { <provider>: <int> } }`, resets on UTC
+  date rollover.
+- **Read:** `load_cli_call_counts(path?)` —
+  `src/scripts/ai_council/clients.ts:738`. Returns today's per-provider
+  counts; empty on rollover.
+- **Increment:** `record_cli_call(provider, path?)` —
+  `src/scripts/ai_council/clients.ts:774`. Returns the new total.
+- **Gate + increment on the transport itself:** `CliClient.ask()` checks
+  the counter *before* spawning (`clients.ts` § quota gate, returns
+  `error: 'cli_quota_exhausted'` + a `block_quota` events-log line when
+  exhausted) and records the call *after* — even failed calls count, so a
+  broken CLI cannot burn the budget in a tight loop.
+- **The openai bucket:** `OpenAICliClient` (`clients.ts:1275`) has
+  `name = 'openai'`; council CLI calls and team calls land on the **same**
+  `counts.openai` entry.
+
+A `/team` invocation therefore reuses the existing seams, in preference
+order:
+
+1. **Through the transport** — construct `OpenAICliClient` with
+   `max_calls_per_day: <ai_team.max_calls_per_day>`; the gate, the
+   exhausted-error, the events-log line, and the increment all come for
+   free.
+2. **Direct** (for `/team:status` rendering or a pre-flight check) —
+   `load_cli_call_counts()['openai'] ?? 0` to read,
+   `record_cli_call('openai')` to count. No new helper exists because
+   none is needed; adding a team-side duplicate of this counter is a
+   contract violation.
+
+`ai_team.max_calls_per_day` and the council's
+`cli_call_budget.max_calls_per_day.openai` are two *ceilings* over the
+same *counter*: whichever path a call takes, it increments the one shared
+bucket, and each surface enforces its own configured cap against that
+shared count.
+
+## Validation rules (fail-closed)
+
+`load_ai_team_config` / `build_ai_team_config`
+(`src/scripts/ai_team/config.ts`) raise `TeamConfigError` when:
+
+1. `ai_team` is present but not a mapping,
+2. any **unknown key** appears under `ai_team` (a typo must never
+   silently disable a gate),
+3. `enabled` / `allow_delegate` / `suppress_setup_hint` is not a boolean,
+4. `model` is not a non-empty string,
+5. `max_calls_per_day` is not a non-negative integer (booleans rejected).
+
+An **absent** `ai_team` block is not an error — it yields the defaults
+(`AI_TEAM_DEFAULTS`) and the feature stays off.
+
+## Default-off posture
+
+Every team-mode capability is default-off. With the block absent or
+`enabled: false`, all paths are byte-identical to pre-feature behavior:
+no command suggestions, no wrapper execution, no quota consumption, no
+wizard nagging beyond the single suppressible setup hint.
+`/team:delegate` is doubly gated (`enabled` AND `allow_delegate`).
+
+## No-claims constraint
+
+No public claim about cross-model review quality ("a second model finds
+errors the first never sees", "two strongest models catch each other's
+errors", or any review-lift assertion) may exist anywhere in the tree
+until the pre-registered three-arm defect-finding benchmark has produced
+a verdict bound in CLAIMS.md. Workflow-value prose is allowed; lift
+claims are not. An honest null keeps the feature documented as workflow
+value only.
+
+## Boundary vs. the council
+
+Team mode and the council are complements, not variants — the council's
+neutrality contract is untouched by team mode:
+
+| Axis | Council ([ai-council-config.md](ai-council-config.md)) | Team (`ai_team`) |
+|---|---|---|
+| Shape | N members, breadth | One strong reviewer, depth |
+| Repo access | NEVER (artefact text + neutral preamble only) | Full (reviewer runs inside the working tree) |
+| Config location | User-global `.ai-council.yml` (ADR-104) | Project `.agent-settings.yml` cascade |
+| Default models | Mid-tier, cost-conscious | Subscription's strongest (`model: 'auto'`) |
+| Quota | `cli_call_budget` per provider | Same counter — shared openai bucket |
+
+This link is deliberately one-directional (team → council); the council
+contract does not reference team mode.

package/docs/contracts/command-clusters.md

@@ -45,6 +45,7 @@ column 1 of this table.
 | `council` | 3 | `default` · `pr` · `design` · `optimize` · `analysis` | `council` (legacy default lens) · `council-pr` · `council-design` · `council-optimize`; `analysis` added 2026-05-14 — wrapper for local analysis outputs with a Top-N consensus tail block consumed by `/roadmap create` |
 | `challenge-me` | — | `vision` · `with-docs` | new — Pocock-inspired one-question-at-a-time interview; `vision` is the standard 95%-confidence variant, `with-docs` adds doc/glossary awareness with a session-scoped glossary and load-bearing claim-vs-code verification |
 | `research` | 2 | `deep` · `report` | preliminary-research scaffolder ported from `Weizhena/Deep-Research-skills` (cluster head emits `outline.yaml` + `fields.yaml` against the `research-schema` contract). `:deep` populates per-item JSON in batches with native web-search + JSON-Schema self-validation (no Python runtime); `:report` renders `report.md` directly + optionally emits a `jq` template for deterministic regeneration. `add-items` / `add-fields` intentionally **not** ported — re-run `/research <topic>` to extend the field framework. |
+| `team` | 2 | `review` · `adversarial` · `delegate` · `status` | new 2026-07-12 (road-to-team-mode Phase 2) — cross-model depth review: thin fail-closed delegations to the official codex plugin on Claude-Code hosts under `ai_team` governance ([`ai-team-config`](ai-team-config.md)); default-off (`ai_team.enabled: false`), `delegate` behind the second opt-in `allow_delegate`; internal visibility until the ADR promotion gate |
 | `orchestrate` | — | _(none yet — cluster head only)_ | new — runtime executor for YAML pipelines under `.agent-config/orchestrations/` per the [`orchestration-dsl-v1`](orchestration-dsl-v1.md) contract; chains personas / skills / commands / sub-agents deterministically. Single cluster head; sub-commands deferred until a second verb is needed. |
 | `sync` | 4 | `agent-settings` · `gitignore` · `gitignore-fix` | new cluster 2026-07-08 — absorbs the former single-sub `sync-gitignore` cluster (slug-neutral nests: `sync-agent-settings`, `sync-gitignore`, `sync-gitignore-fix` keep their slugs; the gitignore node keeps its own `fix` sub-dir, mirroring the `agents/user` deep-nest precedent). Bare `/sync` shows the menu. |
 | `ghostwriter` | — | `fetch` · `write` · `list` · `show` · `delete` | new cluster 2026-05-15 — third voice primitive for AI-assisted writing in the public voice of a public figure. Hybrid storage: real-person profiles live consumer-side under `agents/reference/ghostwriter/<slug>.md` (gitignored by default); package source ships only `fictional: true` fixtures. Zero network code in the package — `:fetch` delegates web-fetch / web-search to the host agent. Mandatory disclosure footer on every `:write` output (no opt-out). Schema: [`ghostwriter-schema`](ghostwriter-schema.md). |

package/docs/contracts/persona-schema.md

@@ -144,6 +144,55 @@ major version bump in the package release notes. Size-cap tightening
 is breaking when it forces existing personas to lose content; size-cap
 loosening is non-breaking.
 
+## § 8 — Governance discipline (the four checks)
+
+_Origin: migrated from `src/rules/persona-governance.md` per the P4 pattern of `road-to-kernel-and-router.md`. The rule keeps the Iron Law and the check names; the detail lives here._
+
+Personas are review lenses, not free real estate. Every specialist persona has a maintenance cost: it must stay aligned with this schema, the cited skills must still want it, and the per-domain reasoning surface must not bloat to the point that no single persona is load-bearing.
+
+### 8.1 Per-domain cap — ≤ 2 specialised personas per content domain
+
+A **content domain** is a self-contained creative or technical surface that one or two specialist personas can fully cover. Current domains:
+
+| Domain | Specialists allowed | Examples |
+|---|---|---|
+| ai-video / ai-image / ai-audio | ≤ 2 | one director-shaped lens + one technical-tuning lens |
+| backend engineering | ≤ 2 | architect + ORM-tamer |
+| frontend engineering | ≤ 2 | component / lifecycle + design / a11y |
+| security | ≤ 2 | abuse-case + secrets-and-trust |
+| gtm / growth | ≤ 2 | CMO + RevOps |
+| money / strategy | ≤ 2 | finance-partner + strategist |
+| people / org | ≤ 2 | engineering-manager + people-strategist |
+| customer / discovery | ≤ 2 | discovery-lead + customer-success-lead |
+
+**Core personas** (`developer`, `senior-engineer`, `product-owner`, `stakeholder`, `critical-challenger`, `ai-agent`) are exempt — they are always-loaded cross-cutting lenses, not domain specialists.
+
+A new specialist into a full domain MUST come with a deprecation candidate from the same domain. The agent surfaces both, then runs an ai-council debate (per [`ai-council`](../../src/skills/ai-council/SKILL.md)) before any rename / merge / delete.
+
+### 8.2 Skill citation floor — ≥ 1 cite before merge
+
+A specialist persona without a `personas: [<id>]` citation in at least one skill's frontmatter is dead weight. The PR adding the persona MUST also add the citation, OR the PR is rejected. Citation map lives in [`docs/personas.md § Skill citations`](../personas.md#skill-citations).
+
+### 8.3 Deprecation path — delete immediately, record in commit
+
+A persona being removed is **deleted in the same commit** that lands its replacement. The commit message names the successor (or "merged into X") and cites the council decision (or maintainer rationale) that authorised it. No soak window — internal personas have no external consumers; a persona file kept around as a tombstone is dead weight the linter still loads. No silent deletes either: the audit trail is the commit, not a docs table.
+
+### 8.4 Schema conformance — the skill linter is the gate
+
+Every persona file is linted against this contract (§ 1–§ 5) by the skill linter: frontmatter shape, tier enum, wing enum, required sections per tier, line budget per tier (with wing override), `Unique Questions` ≥ 3, filename / id match, description ≤ 160 chars. The agent runs `./scripts-run src/scripts/skill_linter` before any persona PR is marked ready.
+
+### Failure modes — what counts as a violation
+
+- Adding a third specialist to a full domain without naming the deprecation candidate.
+- Landing a specialist with no `personas: [<id>]` cite in any skill.
+- Renaming or deleting a persona file without naming the successor (or sunset reason) in the commit message.
+- Editing core-tier personas in-place with breaking changes (rename, section removal) without bumping to a new id.
+- Skipping the skill linter (`./scripts-run src/scripts/skill_linter`) on a persona PR.
+
+### Governance day-one state
+
+Resolved 2026-05-17 via two-round ai-council debate (members: anthropic/claude-sonnet-4-5, openai/gpt-4o — converged on delete-and-fold): `pixar-storyboard-artist` deleted; its acting / beat-decomposition lens folded into the [`pixar-storyteller`](../../src/skills/pixar-storyteller/SKILL.md) skill body. Active per-domain count for `ai-video` is now 2 (`ai-video-technical-director`, `hollywood-director`), within cap. Total active personas in the root cluster: 24 (plus 5 advisors in `personas/advisors/`). Full inventory + ownership in [`docs/personas.md`](../personas.md).
+
 ## See also
 
 - [`skill-domains`](skill-domains.md) — sister taxonomy for skills

package/docs/contracts/provider-lifecycle.md

@@ -68,19 +68,44 @@ When the agent picks a provider for a `/video:*` / `/image:*` /
 1. **Read** the `provider_lifecycle` tag from the adapter's header
    comment **and** the matching `<provider id="…">` block in
    `agents/templates/.ai-video.xml.example` (or the operator's
-   `agents/.ai-video.xml`).
+   `agents/.ai-video.xml`). This applies to every resolution path —
+   `--provider <id>`, `<default-video-provider>` /
+   `<default-image-provider>`, or a skill's default. A **mismatch
+   between the two sources is a contract violation** and MUST be
+   surfaced before running.
 2. **Refuse-and-surface** if the operator's resolved default is a
    non-`stable` tier — name the tier and the path to this contract
    document, then emit one clarifying question (per
    [`ask-when-uncertain`](../../.augment/rules/ask-when-uncertain.md)):
    either pick a `stable` provider, or confirm the non-stable run.
+   No silent default. No "I'll just try it".
 3. **Record** in the run summary which tier the chosen adapter
-   carries — this is the audit log entry the agent-in-the-loop
-   model rests on.
+   carries — the summary line after every `/video:*` / `/image:*` /
+   `/audio:*` run names the chosen provider AND its tier. This is the
+   audit log entry the agent-in-the-loop model rests on.
+4. **Never auto-promote.** Promotion is the maintainer's call. The
+   agent MAY draft a promotion checklist (per
+   [§ 2 — Promotion path](#-2--promotion-path)) for maintainer
+   review, but the tier-flip commit is human-authored.
 
 The agent never picks `deprecated` silently. If a successor is
 declared, the agent surfaces "X is deprecated; successor: Y" before
-running.
+running — even with confirmation.
+
+### § 4a — Failure modes (agent-side violations)
+
+_Origin: migrated from `src/rules/provider-lifecycle-discipline.md` per the P4 pattern of `road-to-kernel-and-router.md`. The rule keeps the Iron Law and the read-tier / refuse-and-surface one-liners; the detail lives here._
+
+- Running `/video:scene` against the `<default-video-provider>` without reading the lifecycle tag first → violation.
+- Picking a `community` provider because it was named in the prompt, without surfacing the tier → violation.
+- Editing an adapter and leaving its header `Lifecycle:` comment out of sync with `agents/templates/.ai-video.xml.example` → violation (CI does not catch this; the agent must).
+- Auto-promoting an adapter from `experimental` to `stable` because "dry-run worked" → violation. Promotion requires a maintainer-captured real-API smoke trace under `agents/reference/ai-video/smoke-traces/`.
+
+### § 4b — Why agent-in-the-loop, not a Python gate
+
+A Python pre-run gate enumerating tier-by-command rules would either be too coarse (`experimental → block`, breaking day-to-day dev iteration) or too detailed (per-command tier matrix, drifting from reality on every new provider). The agent reading the tag at run time, surfacing the tier, and asking is the correct enforcement surface: the model that picked the provider is the model that surfaces the obligation, and the human is the policy decision point.
+
+The CI guarantee is structural reachability — the linter would fail if a provider was declared in `agents/templates/.ai-video.xml.example` without a lifecycle tag (extension planned). It does not enforce the runtime obligation; the agent does.
 
 ## § 5 — Day-one assignment
 

package/docs/decisions/ADR-120-council-chairman-mode.md

@@ -0,0 +1,70 @@
+---
+adr: 120
+status: accepted
+date: 2026-07-12
+decision: council-chairman-mode
+supersedes: —
+superseded_by: —
+phase: opt-council-deliberation
+type: structural
+---
+
+# ADR-120 — Council chairman mode supersedes always-host synthesis
+
+## Status
+
+Accepted (2026-07-12).
+
+## Context
+
+The council skill's own Iron Law argues the host agent, having framed the
+artefact, cannot independently judge it — yet the shipped engine always let the
+host author the synthesis ("the host runs the council and synthesises
+convergence"). `road-to-opt-council-deliberation` Phase 2 applies the bias
+argument to the synthesis step itself. The contested `auto`-selection detail
+was resolved by a billable two-round council pass (anthropic/claude-sonnet-4-5 +
+openai/gpt-4o, 2026-07-12): provider-family difference is the binding
+independence property for a judge; capability (tier) is the tie-break.
+
+## Decision
+
+`ai_council.chairman: { mode: host | member | auto, member? }` — **default
+`host`**, preserving today's behaviour byte-for-byte (the compatibility
+guarantee). When `mode != host`, a **non-deliberating member** authors the
+synthesis as one billable call through the existing `consult` path (spend gate,
+daily ledger, metadata stamping unchanged):
+
+- `member` — the named member, validated fail-closed at config load (must exist
+  and be enabled) and rejected at selection time if it deliberated (a member
+  that argued cannot self-judge).
+- `auto` — provider-family difference primary (non-deliberating ⇒
+  provider-different under the one-member-per-provider invariant), optional
+  `members.<name>.tier` tie-break, deterministic config order final.
+- Every fallback path (member deliberated / unavailable / auto with no
+  candidate / call failed) degrades to the host template with a **visible
+  annotation** — never a silent substitution.
+
+## Consequences
+
+- The synthesis slot can carry a chairman-authored body (`payload.chairman`
+  → `render()`); `council:estimate` shows the extra call as its own row.
+- A new optional `tier` field exists on member config solely as the `auto`
+  tie-break.
+- Host synthesis remains the default; no consumer behaviour changes without
+  an explicit opt-in.
+
+## Alternatives
+
+- **Always-host synthesis (status quo)** — rejected: contradicts the skill's
+  own independence argument.
+- **Tier-first auto selection** — rejected by the council pass: chairing with
+  the strongest model when the deliberators share its provider concentrates
+  the decision surface on one provider's priors.
+
+## References
+
+- `docs/contracts/ai-council-config.md` § Chairman synthesis.
+- `src/scripts/ai_council/chairman.ts` (selection), `council_cli.ts`
+  `_maybe_run_chairman` (dispatch).
+- Council convergence: `road-to-opt-council-deliberation` § Council notes
+  (2026-07-12).

package/docs/decisions/ADR-121-knowledge-sensitivity-classes.md

@@ -0,0 +1,90 @@
+---
+adr: 121
+status: accepted
+date: 2026-07-12
+decision: knowledge-sensitivity-classes
+supersedes: —
+superseded_by: —
+phase: feedback-8.11
+type: structural
+---
+
+# ADR-121 — Per-card sensitivity classes for the knowledge boundary
+
+## Status
+
+Accepted (2026-07-12). Successor note to ADR-119 (global knowledge sharing
+default ON) — adds boundary teeth; does NOT revert the flip.
+
+## Context
+
+The 8.11.0 external reviews and the maintainer both name cross-project
+context transfer as the riskiest open surface of the ADR-119 flip: the only
+per-entry axis was origin tier (`public|vendor|proprietary` — where knowledge
+came from), the binary page flag `visibility: private`, and a write-time
+regex redaction gate. There was NO sensitivity taxonomy (how far an entry may
+travel), no per-card owner/expiry on shared cards, no promotion-reason
+capture, and no revocation trail — deletion was silent.
+
+A two-round council debate (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
+2026-07-12) split on scope: one member argued measure-first with a 2-level
+enum at most (six classes over-fit a single-maintainer install — `team` /
+`organization` are phantom categories today); the other argued the full
+six-class taxonomy from the reviews. Resolution: a SMALL machine-anchored
+axis now (the maintainer's danger is present, not speculative), the wider
+enum behind a revisit-if.
+
+## Decision
+
+Three sensitivity classes, each anchored to a machine check
+(`agents/settings/contexts/knowledge-sensitivity.md` carries the full table):
+
+- `prohibited` — redaction-class content; a redaction hit FORCES this class
+  (declared values cannot override it); hard linter error in the global
+  store (check G6).
+- `project` — the DEFAULT; promotion structurally refused unless a human
+  reclassifies; unset/invalid resolves here, never upward.
+- `shareable` — global-store eligible; requires passing redaction AND full
+  provenance: `source_repo`, `owner`, `review_after`, `promotion_reason`
+  (checks G4/G5); `promotion_reason` is mandatory human input — there is no
+  auto-`shareable` path.
+
+Plus an append-only revocation ledger (`.revocations.jsonl` tombstones
+written by `forget`/`purge` BEFORE deletion; rendered via
+`knowledge:global:list --revoked`).
+
+ADR-119's default-ON, `allowed_tiers: [public]`, measurement window, and
+demotion trigger are unchanged.
+
+## Consequences
+
+- Cross-project transfer now requires a recorded human decision per card
+  (class + reason), machine-verified in CI (`check_knowledge_cards` G4–G6)
+  and at promotion time (`gate_sensitivity_for_promotion`).
+- Deletion is auditable; the demotion trigger of ADR-119 gains a per-entry
+  trail to point at.
+- Cost: one more frontmatter field + four footer fields on shared cards;
+  no new subsystem, no read-time machinery.
+
+## Alternatives considered
+
+- Six-class enum `{local-only, project, team, organization, confidential,
+  prohibited}` (the reviews' proposal) — rejected now: `team`/`organization`
+  have no consumer today; widening is cheap later, narrowing is not.
+  Revisit-if: a real multi-tenant org install exists.
+- Revert ADR-119 to default-OFF — rejected: re-creates the ADR-103
+  measure-then-decide deadlock; the danger is contained by classes + gates,
+  not by turning the layer off.
+- Semantic PII detection / k-anonymity — out of scope per ADR-119 §6
+  (write-time text gate, single-install trust boundary).
+
+## References
+
+- `agents/settings/contexts/knowledge-sensitivity.md` — locked design table.
+- ADR-119 — the flip this hardens.
+- Implementation: `knowledge_global.ts` (SENSITIVITIES, footer fields),
+  `knowledge_global_promote.ts` (`resolve_effective_sensitivity`,
+  `gate_sensitivity_for_promotion`, tombstones), `knowledge_global_cli.ts`
+  (promote/forget/purge/list flags), `check_knowledge_cards.ts` (G4–G6);
+  118 tests across 6 files incl. 3 cross-project-contamination adversarial
+  cases.

package/docs/decisions/INDEX.md

@@ -123,6 +123,8 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | [ADR-117](ADR-117-subagents-auto-default-on.md) | Subagents Auto Default On | accepted | 2026-07-09 | — |
 | [ADR-118](ADR-118-loop-engineering-boundaries.md) | Loop Engineering Boundaries | accepted | 2026-07-10 | — |
 | [ADR-119](ADR-119-global-knowledge-default-on.md) | Global Knowledge Default On | accepted | 2026-07-12 | 103 |
+| [ADR-120](ADR-120-council-chairman-mode.md) | Council Chairman Mode | accepted | 2026-07-12 | — |
+| [ADR-121](ADR-121-knowledge-sensitivity-classes.md) | Knowledge Sensitivity Classes | accepted | 2026-07-12 | — |
 | [ADR-200](ADR-200-python-to-typescript-migration.md) | Python To Typescript Migration | accepted | 2026-06-11 | — |
 
 ## Unnumbered (legacy)

package/docs/design/council-vs-solo-baseline.md

@@ -0,0 +1,92 @@
+# Council-vs-solo baseline eval — design (pre-registered)
+
+> Design artifact for `road-to-feedback-8.11` Phase 3. It fixes the
+> methodology **before** the first billable call; the run itself is
+> spend-gated (blocker `council-baseline-spend-authorization` — the user
+> confirms the rendered estimate in-session). This document is the "design
+> the baseline" step — not the run. Companion claim:
+> `docs/CLAIMS.md § council-vs-solo-baseline` (status: unbacked until the run
+> resolves).
+
+## Why this exists
+
+The council deliberation protocol (stance tally, chairman, debate gates,
+anti-conformity) is well-built and default-off — but there is **no evidence
+that convening the council beats a single strong model** on any decision
+class. The 2026-07-12 feedback-disposition debate (claude-sonnet-4-5 +
+gpt-4o) REJECTED adding a ≥2-of-5 admission gate for exactly this reason and
+ADOPTED this baseline as the precondition for ANY further
+deliberation-protocol expansion: admission criteria must be derived from
+empirical decision characteristics, not a-priori heuristics.
+
+Shadow-log status at design time (2026-07-12): `agents/runtime/council/
+shadow-log.jsonl` is **absent/empty** on both the main checkout and the run
+worktree — the shadow-dispatch agreement mechanism has produced zero
+analyzable lines. That absence is itself the first finding: the only
+council-vs-solo signal the package planned to collect has no data, so a
+deliberate baseline run is the only path to a verdict.
+
+## Arms
+
+| Arm | What runs | Cost profile |
+|---|---|---|
+| A — solo | ONE strong model (the council's strongest configured member, single call, standard prompt) | 1 call/decision |
+| B — council | The full configured council in `debate` mode (2 members × ≤2 rounds, current defaults; stance tally ON so dissent is recorded) | 4–5 calls/decision |
+
+Same decision text, same context budget, both arms blind to each other.
+
+## Corpus — ≥30 real decisions
+
+- Source: real decision questions from the repo's own history — the
+  council-labelled golden set (labels final per the 2026-07-11 amendment; no
+  re-labelling) plus archived council question files whose ground-truth
+  disposition is now KNOWN (the decision shipped and survived, was reverted,
+  or was killed by later evidence). Minimum n = 30; pre-register the exact
+  list in the run manifest BEFORE the first call.
+- Class mix: at least 8 decisions per impact class {low, medium, high} so the
+  per-class analysis (the whole point — which characteristics correlate with
+  council lift) is not vacuous.
+
+## Metrics — fixed before data
+
+1. **Quality**: blind post-hoc grading of both arms' verdicts against the
+   known ground-truth disposition — primary judge = strongest available
+   model, blind second judge, report Cohen's κ (reuse `cohensKappa()` /
+   `judgeKappa()` from `src/scripts/check_quality_regression.ts`); verdict
+   admissible only at κ ≥ 0.60.
+2. **Cost**: tokens + USD (from the council cost ledger) + wall-clock per
+   decision, per arm.
+3. **Characteristics capture**: per decision, record the five feedback-
+   proposed dimensions (reversibility cost, material spend/risk,
+   multi-perspective conflict, evidence tension, policy/governance change) as
+   booleans AT PRE-REGISTRATION TIME (not after results) — so the ≥2-of-5
+   hypothesis is testable as a POST-HOc correlate without having gated
+   anything.
+
+## Kill criterion (falsifiable, from the 2026-07-12 debate)
+
+- **No lift anywhere**: if council decisions show no identifiable quality
+  lift on ANY decision subset (overall AND per impact class AND per
+  dimension-count stratum), further deliberation-protocol phases STOP and
+  the protocol goes maintenance-only; `road-to-opt-council-deliberation`
+  records the honest null.
+- **Lift on a subset**: derive empirical admission criteria FROM that
+  subset's recorded characteristics (which may or may not match the ≥2-of-5
+  heuristic — the data decides), and only then design an admission gate.
+- **Judge floor**: κ < 0.60 → record κ, withhold the win-rate, do not claim
+  either direction.
+
+## Spend gate
+
+Execution requires in-session user confirmation of the rendered estimate
+(existing council estimate machinery; ~30 decisions × (1 + ~4.5) calls —
+estimate rendered by `council estimate` at run time). Authoring the corpus
+manifest and this design is unblocked and free.
+
+## Non-goals
+
+- Not a cross-provider capability comparison (both arms use the configured
+  members; provider identity is held constant per arm definition).
+- Not a re-test of the deliberation features individually (stance tally,
+  chairman) — arm B runs the current default debate shape; feature ablations
+  are follow-ups only if B beats A at all.

package/docs/design/utilization-window-criteria.md

@@ -0,0 +1,51 @@
+# Utilization-window decision criteria — pre-registered
+
+> Design artifact for `road-to-feedback-8.11-2` Phase 0. The engagement
+> observation window (telemetry.artifact_engagement, id-only,
+> PII-excluded-by-construction) has been RUNNING in the agent-config repo
+> since 2026-07-12. Per the repo's claims convention, the window's decision
+> rules are fixed HERE, BEFORE the numbers accumulate — the reviewer's
+> warning was precise: without pre-fixed criteria "the window ends with
+> many events and no decidable statement." Companion claim:
+> `docs/CLAIMS.md § utilization-window-decidability`.
+
+## Observation floor (all three, else "underpowered")
+
+1. **≥ 100 recorded task boundaries** in `.agent-engagement.jsonl`
+   (boundary_kind `task` or `phase-step`).
+2. **≥ 2 distinct hosts** contributed records (host identity read from the
+   session context at analysis time, not stored in the event — the event
+   schema stays id-only; if host cannot be attributed without widening the
+   schema, the floor degrades to "≥ 2 distinct recording periods ≥ 14 days
+   apart" and this deviation is recorded in the closing report).
+3. **≥ 45 elapsed days** since 2026-07-12.
+
+Below the floor at day 90 → the window is **underpowered**: extend ONCE by
+30 days. Still below → STOP, record the honest null ("insufficient natural
+usage volume to decide utilization"), and do NOT rebuild collection
+apparatus without a new demand signal.
+
+## Decision rules (fixed now — no goalpost-moving)
+
+| # | Observation at window close | Bound decision |
+|---|---|---|
+| D1 | Artifact kind entry (skill/rule/command/guideline/persona id) **loaded-never-consulted** across the full window (requires the U1a `loaded` denominator; if U1a has not landed, D1 degrades to consulted-set analysis and says so) | Goes on the **retirement-candidate list** feeding U1's ranked cut list — candidate, not auto-cut; kernel + safety floors exempt by construction |
+| D2 | Artifact **consulted-never-applied** with ≥ 5 consultations and applied-ratio < 10% | Goes on the **trigger-review queue** (description/trigger overhaul, not deletion) |
+| D3 | Window closes **above the floor** | The first U1 report MUST name ≥ 1 concrete keep/cut/review decision per artifact kind, or record per kind why the data does not support one |
+| D4 | Window closes **below the floor** (after the one extension) | Honest null; lifecycle-automation and field-outcome-ledger gates STAY closed (their revisit-if remains "≥ 1 full window") |
+
+## Explicitly out of scope for this window
+
+- **Outcome-quality attribution** (did artifact X improve the result) —
+  needs the `loaded` denominator plus far more volume; stays with U1a.
+- **Cost-vs-rework economics** — owned by the orchestration telemetry
+  track (`road-to-subagent-value-realization-followup`).
+- **Cross-repo aggregation** — the window is this repo only (council
+  condition from the 8.11 disposition).
+
+## Kill criterion
+
+If the window closes decidable (D3) but its decisions are cited by zero
+actual portfolio changes within 2 releases, the analysis layer (not the
+telemetry) is the dead weight — record that honest null before building
+any further reporting on top.

package/docs/featured-skills.md

@@ -92,4 +92,4 @@ task lint-featured-skills
 
 CI runs this in `taskfiles/ci-fast.yml`. Stale entries (renamed / removed skill or command) fail the build. See [`scripts/lint_featured_skills.py`](../src/scripts/lint_featured_skills.py) for the matcher.
 
-→ Browse all 271 skills: [`dist/agent-src/skills/`](../dist/agent-src/skills/) · all 178 commands: [`dist/agent-src/commands/`](../dist/agent-src/commands/)
+→ Browse all 271 skills: [`dist/agent-src/skills/`](../dist/agent-src/skills/) · all 183 commands: [`dist/agent-src/commands/`](../dist/agent-src/commands/)

package/docs/getting-started-by-role.md

@@ -2,7 +2,7 @@
 
 > Pick the entry that matches what you do day-to-day. Each section names the three skills you will reach for first and shows whether MCP (no terminal) or CLI (terminal) is the simpler install path for that role.
 
-`agent-config` ships 271 skills, 104 governed rules, and 178 commands. You do not need all of them. Each role below filters to the slice that pays back in week one; the rest stays available and shows up on demand when a task references it.
+`agent-config` ships 271 skills, 104 governed rules, and 183 commands. You do not need all of them. Each role below filters to the slice that pays back in week one; the rest stays available and shows up on demand when a task references it.
 
 > **Taglines at a glance →** [`docs/role-experiences.md`](role-experiences.md) — the one-line pitch per role experience, in one table.
 
@@ -73,6 +73,8 @@ Cinematic-blueprint approach: the agent expands your script into a 12-block scen
 - [`nextjs-patterns`](../dist/agent-src/skills/nextjs-patterns/SKILL.md) — App Router, Server Components, Server Actions, caching.
 - [`quality-tools`](../dist/agent-src/skills/quality-tools/SKILL.md) — PHPStan, Rector, ECS error triage and fix loop.
 
+Cross-model review of the real diff (**team mode**, default off) is documented in [Getting Started § Team mode](getting-started.md#team-mode--cross-model-review-default-off).
+
 **Install path:** **CLI.** Run `npx @event4u/agent-config init --tools=claude-code,cursor` in the project root. MCP works too but loses git / file-system tooling that the IDE-integrated path gives you.
 
 ---