@event4u/agent-config 8.13.0 → 9.1.0

package/docs/guidelines/agent-infra/minimal-safe-diff-mechanics.md

@@ -0,0 +1,99 @@
+# Minimal Safe Diff — Mechanics
+
+> Anti-over-engineering criteria, larger-change guidance, break-glass exception, and the bounded remediation carve-out for the `minimal-safe-diff` rule
+
+_Origin: migrated from `src/rules/minimal-safe-diff.md` per the P4 pattern of `road-to-kernel-and-router.md`. The Iron Law, "The rule", "Before writing the diff", the red-flags list, and "Own-orphan cleanup" (anchor-referenced by `downstream-changes`) stay in the rule; this file carries the worked criteria._
+
+## When the task seems to require a larger change
+
+- A rename, restructure, or framework upgrade that crosses the minimal-diff
+  line is a **separate, explicit** task — ask the user before expanding.
+- A bug fix that exposes a broader design problem stays a bug fix. Log the
+  design problem as a follow-up (ticket, note, TODO) and ship the fix alone.
+- A new feature that tempts you to "clean up" the module first: resist.
+  Add the feature, commit it, then propose the cleanup as a separate change.
+
+## Auto-formatter or linter rewrites unrelated code
+
+Revert those hunks before staging. The diff you present is the diff you own.
+If project policy forbids partial formatting, split into two commits:
+*format only* · *behavior change*.
+
+## Anti-over-engineering
+
+The smallest change is also the least *abstract* and least *speculative* one:
+
+- **Three similar lines beat a premature abstraction.** Do not extract a helper
+  / generic / config layer to dedupe two or three call sites — inline
+  repetition is cheaper to read and change than the wrong abstraction. Per new
+  abstraction: **cite the second caller — or inline it.**
+- **No speculative features.** Nothing beyond what was asked: no
+  configurability or "flexibility" nobody requested, no parameters with one
+  call site, no error handling for scenarios that cannot occur in this
+  codebase.
+- **The rewrite trigger.** If the change could be half the size without losing
+  behavior, rewrite before presenting. Self-check: *"Would a senior engineer
+  call this overcomplicated?"* — if yes, simplify.
+- **No tombstones.** Delete removed code completely — no `_oldName` renames,
+  no `// removed X` / `// no longer used` markers, no dead re-export shims kept
+  "for safety". Git history is the tombstone.
+- **No docstrings/comments on untouched code.** Do not annotate code the diff
+  does not change.
+
+Wrong/right pairs for each ban:
+[`simplicity-and-goal-demos`](simplicity-and-goal-demos.md)
+— the demos are the recognition surface; match your diff against the *right*
+column before presenting.
+
+**Not adopted (council):** the source's "validate only at system boundaries /
+trust internal code" clause is **rejected** — internal code can be wrong, and
+"trust" is not a testing strategy. Keep validating internal invariants; this
+fold is about *diff shape*, not about dropping internal checks.
+
+## Break-glass exception
+
+The rule stays in force during production incidents. "Break-glass mode"
+narrows verification (see `verify-before-complete`) — it does **not**
+license drive-by edits.
+
+Allowed during break-glass:
+
+- The **smallest** change that stops the bleeding — one file, one
+  method, one guard — preferred over any refactor.
+- A fast revert to a known-good commit, even if it undoes unrelated
+  improvements shipped in the same PR.
+
+Not allowed, even in break-glass:
+
+- "While I'm in there" cleanups, reformatting, or dependency bumps.
+- Expanding the fix to neighboring modules without evidence they are
+  part of the incident.
+- Merging the hotfix with pending refactors from another branch.
+
+After the incident, open a **follow-up PR** for any scope that was
+intentionally deferred and reference the break-glass commit in its
+description.
+
+## Bounded remediation carve-out
+
+The default stands: no drive-by edits, no opportunistic refactors. The one
+bounded exception — a **small, task-aligned security/correctness fix in code
+the current task already touches** — is governed by `active-remediation`
+(mechanics: [`active-remediation-mechanics`](active-remediation-mechanics.md)).
+It is permitted inline **only** when ALL hold: same request path / module,
+≤ ~10 changed lines in one production file (plus its test file), no
+public-API / response-shape change, no dependency bump or migration, and its
+verification (e.g. the negative test) ships in the same commit. Anything
+outside those five conditions is **not** this carve-out — it is note + ask
+per `active-remediation`. This never licenses reformatting, renames,
+dependency bumps, or version upgrades (a syntax-idiom modernization is
+allowed only under `active-remediation`'s version-gated,
+behavior-preserving clause; a dependency/version bump stays ask-only). The
+sole case that may interrupt is a **live cross-user/tenant data exposure**
+(`broken-access-control`) — fix-now-if-small, else stop and surface; never
+defer it silently.
+
+## See also
+
+- `minimal-safe-diff` (rule) — Iron Law, the rule, pre-diff checklist, red flags, own-orphan cleanup.
+- [`active-remediation-mechanics`](active-remediation-mechanics.md) — the fix-now / note+ask / follow-up-PR ladder detail.

package/docs/guidelines/agent-infra/skill-quality-checklist.md

@@ -17,6 +17,19 @@ Every skill must answer four questions. If ANY answer is weak, the skill is not
 | 3 | How do I verify it worked? | `Procedure` (validation step) | Concrete checks, not "verify it works" |
 | 4 | What common failure must I avoid? | `Gotcha` + `Do NOT` | Real failure patterns, not platitudes |
 
+## Register — explain the trade-off, except in the safety kernel
+
+Two registers, chosen by artifact class (U4, ecosystem harvest 2026-07-13):
+
+- **Capability skills** (workflows, analyses, generators) **explain the
+  trade-off** — say *why* the recommended path beats the alternative instead of
+  shouting ALL-CAPS MUSTs; an agent that understands the why generalizes to
+  cases the skill never enumerated.
+- **The safety kernel keeps its imperative Iron-Law register** — kernel rules,
+  safety floors (`*-safety-floor`), and Hard-Floor surfaces stay ALL-CAPS
+  fenced-law imperative, non-negotiable (`preservation-guard` enforces the
+  byte-level protection). Never downgrade an Iron Law to friendly prose.
+
 ## Required Sections
 
 Every skill MUST have: `When to use`, `Procedure`, `Gotcha`, `Output format`, `Do NOT`.

package/docs/guidelines/design-fidelity-mechanics.md

@@ -0,0 +1,76 @@
+# Design Fidelity — Mechanics
+
+> Surgical-edit discipline, asset & imagery floor, and the failure-mode catalog for the `design-fidelity` rule
+
+_Origin: migrated from `src/rules/design-fidelity.md` per the P4 pattern of `road-to-kernel-and-router.md`. The Iron Law, the `design.fidelity_mode` strictness table, and the fire/not-fire scope stay in the rule; this file carries the illustrative depth._
+
+## Surgical visual edits
+
+A request to change one visual thing — a colour, a label, a single element — is
+a **targeted edit**, not a redesign licence. Apply the same
+`minimal-safe-diff` discipline to design work that backend edits have
+always owed.
+
+- **Change only the semantic target.** Preserve the surrounding layout,
+  spacing, typography, dimensions, content, animation, and interaction states.
+  Do not rewrite the component, reflow the section, or "modernise" neighbours
+  while you are in there. (fixtures: `daf-edit-preservation`, `daf-unwanted-variations`.)
+- **A broader redesign needs an explicit trigger.** Only phrases like *"new
+  direction"*, *"from scratch"*, *"make it feel premium"*, *"rework the flow"*,
+  or *"give me variations / options"* license a from-scratch rework. Absent such
+  a phrase, a "fix / change / update the X" request is surgical — when unsure
+  which, ask (`ask-when-uncertain`). (fixture: `daf-redesign-trigger`.)
+- **Preserve stable anchors.** Where the host exposes DOM/comment metadata, keep
+  comment anchors and screen labels intact so the edit stays locatable. Where
+  the host has no such surface, preserve stable semantic anchors already present
+  in source comments / `data-*` attributes — never strip them, and do not invent
+  new ones.
+
+## Asset & imagery discipline
+
+Visual artifacts carry **real assets or honest placeholders — never fabricated
+brand evidence**. The design-surface instance of the no-invented-facts floor.
+
+- **Copy owned assets through the project's accepted path.** Reference or copy
+  project-owned assets (logos, icons, fonts, images) via the target project's
+  asset directory/pipeline — never hotlink a design-system's internal URL, never
+  bulk-copy a huge source folder. (fixtures: `daf-missing-asset`, `daf-external-asset-url`.)
+- **Real imagery where inspection matters.** On visual pages/decks, use actual
+  product / place / object / state imagery where the image IS the proof (a
+  product screenshot, a real dashboard state). Decorative atmosphere is not proof
+  — never pass a stock-like or invented image off as the real product. An
+  invented product screenshot is fabricated evidence. (fixture: `daf-invented-screenshot`.)
+- **Icons follow the iconography floor** — no emoji-as-icon in serious UI, no
+  hand-rolled icon when a set exists; see the `iconography` skill § Iconography floor.
+- **Ask before adding material — no unrequested filler.** Never generate copy,
+  placeholder sections, or decorative blocks the user did not ask for to "complete"
+  a design. Brief silent on a region → surface the gap (`ask-when-uncertain`)
+  or leave an honest placeholder; never invent filler to fill space.
+
+## Failure modes
+
+- Swapping the prototype's font / typeface because another "reads better".
+- Replacing a specified control (slider, stepper, chip) with a different control.
+- Dropping or adding an element the prototype shows ("+", a send→stop toggle, a warning chip).
+- Restructuring layout or moving sections "because the flow is better".
+- Treating an internal "honesty gate" or "stub" concern as licence to redesign the UI.
+- Re-running a redesign after the user already said "match the prototype".
+
+## How to surface a deviation — do NOT execute it
+
+Name what the spec shows, what you would change, and why — as a numbered option
+per `user-interaction`. The user picks. Honesty about **behaviour** (a control
+not yet wired) never licenses changing the **design**: a faithful visual plus a
+labelled "not wired yet" note beats an invented redesign.
+
+## Fixtures
+
+Behavioral baseline: the `daf-*` fixtures named above (edit preservation,
+unwanted variations, redesign trigger, missing asset, external asset URL,
+invented screenshot).
+
+## See also
+
+- `design-fidelity` (rule) — Iron Law + `design.fidelity_mode` strictness table.
+- `brand-source-of-truth` / `brand-consistency` — same precedence shape, for registered brand tokens.
+- [`design-modes.md`](design-modes.md) — brand vs product register discriminator.

package/docs/installation.md

@@ -3,7 +3,8 @@
 **Principle:** Global is the only consumer scope. `init` writes to
 user-scope paths (`~/.event4u/agent-config/`, `~/.claude/`,
 `~/.cursor/`, …); the project tree only gets `agents/overrides/`
-and `agents/.event4u-bridge.yml`. Opt-in `export` if a team wants
+(the bridge marker was retired — ADR-020 amendment 2026-07-13; the
+global root resolves from `~/.event4u/agent-config`). Opt-in `export` if a team wants
 a tool's config committed to a repo. No Task, no Make, no build
 tools required.
 

package/docs/maintainers/dev-mode.md

@@ -23,8 +23,9 @@ With the flag set, the installer:
 1. Allows project-scope writes back into the repo tree (so a
    maintainer can run `task dev:install-global` and iterate on the
    working copy).
-2. **Skips** writing `agents/.event4u-bridge.yml` into the package
-   repo (per `consumer-bridge § Writer contract`). The repo is the
+2. **Skips** consumer-surface writes into the package repo. (The
+   `agents/.event4u-bridge.yml` marker is retired — ADR-020 amendment
+   2026-07-13 — and no longer written at all.) The repo is the
    source, not a consumer of itself.
 3. Treats `~/.event4u/agent-config/` as a peer install — touches are
    limited to the working-copy projection.

package/docs/parity/command-frontmatter.md

@@ -0,0 +1,60 @@
+# Command frontmatter — per-host projection parity
+
+> Which command frontmatter fields each host bridge actually consumes, and the
+> deliberate divergences from the official command-authoring field standard.
+> Source of truth for command definitions: `src/domains/<pack>/<name>/command.md`
+> (projected verbatim to `dist/agent-src/commands/` by the condensation
+> pipeline). Schema: [`command.schema.json`](../../src/scripts/schemas/command.schema.json).
+> Roadmap origin: `road-to-ecosystem-harvest-skill-quality-gates` Phase 4 (Source C).
+
+## Projection paths per host
+
+| Host | Projection | Frontmatter reaches host? |
+|---|---|---|
+| Claude Code | `.claude/skills/<slug>/SKILL.md` — symlink to the command source; rendered copy (with native `model:`) when `model.auto_switch: auto` and a `model_tier` maps | Yes — full frontmatter, verbatim |
+| Cursor | `.cursor/commands/<slug>.md` — symlink to the command source | Yes — file verbatim; Cursor treats unknown frontmatter as inert |
+| Windsurf | `.windsurf/workflows/<slug>.md` — symlink to the command source | Yes — same inert-passthrough as Cursor |
+| Cline / Gemini / Copilot / Roo / Codex / Continue | Text reference via `AGENTS.md` only (no native command surface) | No — invocation is conversational |
+
+## Field consumption matrix (official-standard fields)
+
+| Field | Claude Code | Cursor / Windsurf | Notes |
+|---|---|---|---|
+| `name` | ✅ load rule: must equal the skill directory slug | inert | Path-derived hyphen slug; enforced by `check_host_loadability` |
+| `description` | ✅ routing + display | inert | ≤ 200 chars per schema |
+| `argument-hint` | ✅ rendered next to the slash command | inert | Added Phase 4; set on every command whose body documents an invocation argument (140/183 at introduction) |
+| `disable-model-invocation` | ✅ honored natively | inert (vacuously true — no model-invocation surface) | Schema pins `enum: [true]` — commands are user-invoked by design |
+| `model` | ✅ (rendered copies only) | inert | Never authored by hand: the generator rewrites `model_tier:` → native `model:` at projection time (ADR-034/035) |
+
+All other fields (`tier`, `visibility`, `pack`, `cluster`, `intent`,
+`routes_to`, `replaces`, `suggestion`, `workspaces`, `packs`, `trust`,
+`install`, `model_tier`, …) are **suite governance metadata** — consumed by the
+package's own linters, router, discovery manifest, and docs generators, never
+by a host. Hosts that read the file verbatim ignore them; that is the intended
+contract, not drift.
+
+## Deliberate divergences from the official standard
+
+1. **No colon names.** The official examples allow `/cluster:sub` invocation;
+   this suite forbids colons in `name:` (Agent-Skills-spec compliance for
+   strict consumers like Zed). Claude Code's `/cluster:sub` invocation still
+   works — it is path-derived from `commands/<cluster>/<sub>.md`, not from the
+   `name:` field.
+2. **`disable-model-invocation` is locked to `true`.** The standard allows
+   model-invocable commands; this suite's commands are always user-invoked
+   (`command-suggestion-policy` owns proactive surfacing instead — suggest,
+   never invoke).
+3. **`model` is generated, never authored.** Authors declare the
+   vendor-neutral `model_tier:`; the Claude bridge renders a native `model:`
+   only when the consumer opted into `model.auto_switch: auto`.
+4. **`argument-hint` is host-passthrough.** Only Claude Code renders it today;
+   it stays in the neutral source (harmless elsewhere) rather than being
+   projected host-specifically — per the do-NOT-chase-host-fields rule for the
+   neutral tree.
+
+## Verification
+
+- `./scripts-run src/scripts/validate_frontmatter` — every command validates
+  against the schema (including `argument-hint` shape, ≤ 120 chars).
+- `./scripts-run src/scripts/check_host_loadability --root .` — generated
+  `.claude/skills/` entries parse and satisfy the host load rule.

package/docs/proof.md

@@ -27,8 +27,9 @@ evidence pointer, or `task check-claims` fails the build.
 | Claim | Kind | Evidence | Resolves |
 |---|---|---|---|
 | The release process is documented as an inheritable runbook + succession doc, and the project's bus-factor (trailing-90-day distinct human reviewers) is tracked and reported truthfully — currently 1, not implied to be more. | qual | `docs/succession.md#trailing 90 days` | ✅ |
-| 183 commands. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
+| 184 commands. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
 | A MEASURED-BUT-NOT-SHIPPED experiment — the thin rule projection reduced eager rule load 78,513 → 13,881 GPT-tokens (whole always-loaded projection 98,529 → 33,897, ~65.6%), but FAILED the quality gate (thin win-rate 36.2% vs required 48%) and does not ship; it un-defers only behind `discipline_profile: essential`. Shipped behavior does NOT include this reduction. Method: `agent-config benchmark` over the pinned token baseline; the baseline is the honest "what the user pays if everything loads eagerly", NOT a synthetic full-corpus strawman (council Q4); quality gate per the Phase-0 paired judge run. | quant | `internal/bench/reports/token-baseline.json#eager_rule_load` | ✅ |
+| The first cross-vendor parity pass (5 orchestration-corpus tasks × 2 vendors × 3 repeats, identical prompts via the council transport, $0.16) measured real per-host finding-count differences — claude-sonnet-4-5 surfaced ~2× the findings of gpt-4o on the multi-file analysis task (median 11 vs 5) while both vendors were identical on the planted hollow-implementation task (2 vs 2) and perfectly silent on the clean-code negative control (0 vs 0, no spurious findings). The per-task `finding_floor` values are calibrated from the cross-host lower envelope and the gate is armed. | quant | `internal/bench/reports/parity-count.json#min over hosts of median` | ✅ |
 | On a weak host (claude-haiku-4-5) the package produces a significant, placebo-controlled discipline lift on scope/downstream traps; on a strong host the same measurement is a published null — the package transplants discipline a weak model lacks, not model intelligence. | quant | `docs/benchmark.md#weak-host-specific` | ✅ |
 | The non-coding domain skills (finance/founder/ops/content) are forged on TS/PHP and labeled unvalidated until they pass a sourced domain-truth fixture; no public prose implies proven domain correctness, and the validated count is CI-ratcheted. | qual | `src/scripts/domain_soundness_status.ts#checkRatchet` | ✅ |
 | The validated non-coding domain-skill count is pinned and CI-ratcheted at a maintainer-set floor (9 of 20 default-surface skills carry a sourced `evals/domain-truth.json` fixture at pin time, 2026-07-11 — 5 deterministic, keys from cited formulas; 4 rubric, criteria matching a named external practice); the floor only rises via a maintainer `--write-floor` after a new sourced fixture lands. | quant | `internal/evals/domain-soundness-floor.json#validated` | ✅ |
@@ -44,10 +45,10 @@ evidence pointer, or `task check-claims` fails the build.
 | On a deterministic multi-session recall corpus, the memory substrate produces a measured, placebo-controlled recall lift — memory-on 27/27 vs no-memory 10/27 and vs equal-byte placebo 9/27 (claude-haiku-4-5, n=9 tasks x 3 seeds, sign test p=0.031 for BOTH pairings). Scoped honestly: this is the context-value upper bound (perfect retrieval on a one-fact-per-task corpus), not retrieval precision under a large store. | quant | `internal/bench/reports/second-brain-delta.json` | ✅ |
 | Removing the perfect-retrieval assumption, the substrate's REAL keyword retrieval recalls the needed decision into the top-5 under keyword-overlapping confusers (precision@5 9/9) and the model disambiguates it from the co-injected confusers — retrieval-on 27/27 vs no-memory 5/27 and vs equal-count placebo 5/27 (claude-haiku-4-5, 9 tasks x 3 seeds, sign test p=0.008 both). Named limit: retrieval RECALLS but does not RANK (mean tie-set 3.3, ties broken by store order, not relevance) — the discrimination gap that motivates the SQLite-FTS5 activation path (ADR-116) at larger scale. | quant | `internal/bench/reports/second-brain-retrieval.json` | ✅ |
 | Every artifact the package ships — source AND the condensed projection that reaches consumers — is machine-scanned in CI for hidden-Unicode, mixed-script-confusable, and instruction-smuggling payloads (the rules-file-backdoor class); a finding blocks the release before `npm publish`, not just the merge. | qual | `.github/workflows/publish-npm.yml#lint_agent_security` | ✅ |
-| 271 skills. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
+| 275 skills. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
 | Removes only its own keys from a shared host config (matched by JSON-pointer + SHA-256), never a neighbour tool's entries. | qual | `docs/contracts/install-layout.md#JSON-pointer` | ✅ |
 
-**20 backed claim(s)** — all evidence pointers resolve in CI.
+**21 backed claim(s)** — all evidence pointers resolve in CI.
 
 Artefact counts in public prose (skills, commands, governed rules,
 guidelines, personas) are **generated from source and CI-drift-checked**:
@@ -76,11 +77,11 @@ shipping theater; the full per-cell data is committed at
 `internal/bench/reports/persona-placebo.json`.
 
 **Behavioural-eval coverage — the honest baseline.** Skill *quality* is only
-as good as its measurement. Today **39 of 271** skills carry a behavioural
+as good as its measurement. Today **42 of 275** skills carry a behavioural
 `evals.json`; the highest-traffic / highest-cost tiers (default-surface +
 `rich` + routers) are **fully covered (35 of 35)**, the long tail
-(4 of 236) is not. We publish that gap rather than imply
-"271 evaluated skills": coverage is measured per tier
+(7 of 240) is not. We publish that gap rather than imply
+"275 evaluated skills": coverage is measured per tier
 (`./scripts-run src/scripts/skill_eval_coverage`), **CI-ratcheted so it can
 only rise**, and the priority tiers carry a hard **tier floor**: every
 rich / default-surface / router skill MUST have a behavioural eval or an

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@event4u/agent-config",
-    "version": "8.13.0",
+    "version": "9.1.0",
     "description": "Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,

package/src/agent-src/templates/scripts/telemetry/engagement.ts

@@ -15,6 +15,10 @@
  *       "boundary_kind": "task" | "phase-step" | "tool-call",
  *       "consulted": {"skills": [...], "rules": [...], ...},
  *       "applied":   {"skills": [...], "rules": [...], ...},
+ *       "loaded":    {"skills": [...], "rules": [...], ...}  # optional (U1a):
+ *              what was AVAILABLE/INJECTED at the boundary — the Fired/Loaded
+ *              denominator. Superset contract: consulted ⊆ loaded. Ids only
+ *              (same PII-exclusion-by-construction shape as consulted).
  *       "outcomes":  ["blocked", "verification_failed", ...]  # optional
  *       "tokens_estimate": {"consulted_load": <int>}   # optional
  *     }
@@ -127,6 +131,7 @@ export interface EngagementEventInit {
     boundary_kind: string;
     consulted?: Record<string, string[]>;
     applied?: Record<string, string[]>;
+    loaded?: Record<string, string[]> | null;
     outcomes?: string[] | null;
     tokens_estimate?: Record<string, number> | null;
     schema_version?: number;
@@ -138,6 +143,7 @@ export class EngagementEvent {
     boundary_kind: string;
     consulted: Record<string, string[]>;
     applied: Record<string, string[]>;
+    loaded: Record<string, string[]> | null;
     outcomes: string[] | null;
     tokens_estimate: Record<string, number> | null;
     schema_version: number;
@@ -148,6 +154,7 @@ export class EngagementEvent {
         this.boundary_kind = init.boundary_kind;
         this.consulted = init.consulted ?? {};
         this.applied = init.applied ?? {};
+        this.loaded = init.loaded ?? null;
         this.outcomes = init.outcomes ?? null;
         this.tokens_estimate = init.tokens_estimate ?? null;
         this.schema_version = init.schema_version ?? SCHEMA_VERSION;
@@ -171,6 +178,20 @@ export class EngagementEvent {
         }
         _validate_artefact_dict('consulted', this.consulted);
         _validate_artefact_dict('applied', this.applied);
+        if (this.loaded !== null) {
+            _validate_artefact_dict('loaded', this.loaded);
+            for (const [kind, ids] of Object.entries(this.consulted)) {
+                const avail = new Set(this.loaded[kind] ?? []);
+                for (const art_id of ids) {
+                    if (!avail.has(art_id)) {
+                        throw new EngagementSchemaError(
+                            `consulted.${kind} id '${art_id}' missing from loaded.${kind}; `
+                            + 'superset contract: consulted \u2286 loaded',
+                        );
+                    }
+                }
+            }
+        }
         if (this.outcomes !== null) {
             _validate_outcomes(this.outcomes);
         }
@@ -206,6 +227,12 @@ export class EngagementEvent {
             consulted: _normalise_artefact_dict(this.consulted),
             applied: _normalise_artefact_dict(this.applied),
         };
+        if (this.loaded !== null) {
+            const norm = _normalise_artefact_dict(this.loaded);
+            if (Object.keys(norm).length > 0) {
+                out['loaded'] = norm;
+            }
+        }
         if (this.outcomes && this.outcomes.length > 0) {
             out['outcomes'] = [...this.outcomes];
         }
@@ -310,6 +337,9 @@ export function parse_event(line: string): EngagementEvent {
         boundary_kind: (r['boundary_kind'] as string) ?? '',
         consulted: _orEmptyDict(r['consulted']),
         applied: _orEmptyDict(r['applied']),
+        loaded: r['loaded'] === undefined || r['loaded'] === null
+            ? null
+            : _orEmptyDict(r['loaded']),
         outcomes: (r['outcomes'] as string[] | null | undefined) ?? null,
         tokens_estimate: (r['tokens_estimate'] as Record<string, number> | null | undefined) ?? null,
         schema_version: r['schema_version'] === undefined

package/src/agent-src/templates/scripts/telemetry/report_renderer.ts

@@ -121,15 +121,19 @@ export function render_markdown(aggregate: AggregateResult, opts: RenderOptions
             lines.push('');
             continue;
         }
-        lines.push('| kind | id | consulted | applied | applied/consulted | last seen |');
-        lines.push('|---|---|---:|---:|---:|---|');
+        const withLoaded = aggregate.loaded_events > 0;
+        lines.push(withLoaded
+            ? '| kind | id | loaded | consulted | applied | fired/loaded | applied/consulted | last seen |'
+            : '| kind | id | consulted | applied | applied/consulted | last seen |');
+        lines.push(withLoaded ? '|---|---|---:|---:|---:|---:|---:|---|' : '|---|---|---:|---:|---:|---|');
         for (const entry of rows) {
             const s = entry.stat;
             check_id_redaction(`buckets.${s.kind}.id`, s.artefact_id);
-            lines.push(
-                `| ${s.kind} | \`${s.artefact_id}\` | ${s.consulted} | ${s.applied} `
-                + `| ${_pyFixed(s.applied_ratio, 2)} | \`${s.last_seen_ts}\` |`,
-            );
+            lines.push(withLoaded
+                ? `| ${s.kind} | \`${s.artefact_id}\` | ${s.loaded} | ${s.consulted} | ${s.applied} `
+                    + `| ${_pyFixed(s.fired_ratio, 2)} | ${_pyFixed(s.applied_ratio, 2)} | \`${s.last_seen_ts}\` |`
+                : `| ${s.kind} | \`${s.artefact_id}\` | ${s.consulted} | ${s.applied} `
+                    + `| ${_pyFixed(s.applied_ratio, 2)} | \`${s.last_seen_ts}\` |`);
         }
         lines.push('');
     }
@@ -147,7 +151,9 @@ export function render_json(aggregate: AggregateResult, opts: RenderOptions = {}
         [BUCKET_BOTTOM]: [],
     };
     for (const entry of bucketed) {
-        (grouped[entry.bucket] as Array<Record<string, unknown>>).push(_stat_to_dict(entry.stat));
+        (grouped[entry.bucket] as Array<Record<string, unknown>>).push(
+            _stat_to_dict(entry.stat, aggregate.loaded_events > 0),
+        );
     }
     if (top !== null) {
         for (const bucket of Object.keys(grouped)) {
@@ -179,9 +185,9 @@ export function render_json(aggregate: AggregateResult, opts: RenderOptions = {}
     return `${_py_json_dumps_indent2_sorted(payload)}\n`;
 }
 
-function _stat_to_dict(stat: ArtefactStat): Record<string, unknown> {
+function _stat_to_dict(stat: ArtefactStat, withLoaded = false): Record<string, unknown> {
     check_id_redaction(`buckets.${stat.kind}.id`, stat.artefact_id);
-    return {
+    const out: Record<string, unknown> = {
         kind: stat.kind,
         id: stat.artefact_id,
         consulted: stat.consulted,
@@ -189,6 +195,13 @@ function _stat_to_dict(stat: ArtefactStat): Record<string, unknown> {
         applied_ratio: new PyFloat(_pyRound(stat.applied_ratio, 4)),
         last_seen_ts: stat.last_seen_ts,
     };
+    // U1a: emitted only when the log carries the loaded denominator, so
+    // pre-U1a logs render byte-identically to the frozen parity oracle.
+    if (withLoaded) {
+        out['loaded'] = stat.loaded;
+        out['fired_ratio'] = new PyFloat(_pyRound(stat.fired_ratio, 4));
+    }
+    return out;
 }
 
 // ── Python-parity helpers ───────────────────────────────────────────────

package/src/agent-src/templates/scripts/telemetry_record.ts

@@ -63,6 +63,7 @@ interface RecordArgs {
     boundary: string;
     consulted: string[] | null;
     applied: string[] | null;
+    loaded: string[] | null;
     outcome: string[] | null;
     ts: string;
     payload_file: string | null;
@@ -78,6 +79,7 @@ function _build_event_from_args(args: RecordArgs): EngagementEvent {
         boundary_kind: args.boundary,
         consulted: _parse_kv_list(args.consulted ?? []),
         applied: _parse_kv_list(args.applied ?? []),
+        loaded: args.loaded && args.loaded.length > 0 ? _parse_kv_list(args.loaded) : null,
         outcomes: args.outcome && args.outcome.length > 0 ? [...args.outcome] : null,
     });
 }
@@ -101,6 +103,7 @@ function _build_event_from_payload(raw: string): EngagementEvent {
         boundary_kind: (d['boundary_kind'] as string) ?? '',
         consulted: _orEmpty(d['consulted']),
         applied: _orEmpty(d['applied']),
+        loaded: d['loaded'] === undefined || d['loaded'] === null ? null : _orEmpty(d['loaded']),
         outcomes: (d['outcomes'] as string[] | null | undefined) ?? null,
         tokens_estimate: (d['tokens_estimate'] as Record<string, number> | null | undefined) ?? null,
     });
@@ -121,6 +124,7 @@ function _parseArgs(argv: string[]): RecordArgs {
         boundary: 'task',
         consulted: null,
         applied: null,
+        loaded: null,
         outcome: null,
         ts: '',
         payload_file: null,
@@ -155,6 +159,7 @@ function _parseArgs(argv: string[]): RecordArgs {
             }
             a.boundary = v;
         } else if (tok === '--consulted') (a.consulted ??= []).push(next());
+        else if (tok === '--loaded') (a.loaded ??= []).push(next());
         else if (tok === '--applied') (a.applied ??= []).push(next());
         else if (tok === '--outcome') {
             const v = next();

package/src/agent-src/templates/scripts/work_engine/_lib/agent_settings.ts

@@ -252,7 +252,10 @@ const _AGENTS_DIR_MARKERS: readonly string[] = [
     'roadmaps',
     'settings/.ai-council.yml',
     'roadmaps-progress.md',
-    '.event4u-bridge.yml',
+    // `overrides/` is the guaranteed minimal-consumer surface (ADR-020).
+    // Replaced the retired `.event4u-bridge.yml` marker (ADR-020 amendment
+    // 2026-07-13) so a bare consumer `agents/` dir stays anchorable.
+    'overrides',
 ];
 
 /**

package/src/config/agent-settings.template.yml

@@ -62,10 +62,15 @@ projection:
   # rules ALWAYS project (unconditional by definition); untagged rules fail
   # safe and ship. Example consumer scope:
   #   rule_workspaces: [engineering]
-  # Default flip to a scoped value is a human release gate — see
-  # agents/settings/contexts/consumer-scoping-audit-2026-07-07.md.
+  # DEFAULT FLIPPED 2026-07-13 (the Phase-1 human gate, maintainer-approved,
+  # evidence-gated): the default below lists EVERY consumer workspace, so
+  # exactly the exclusively-maintainer specification rules drop from consumer
+  # installs (the audited 16-rule lever — see
+  # agents/settings/contexts/consumer-scoping-audit-2026-07-07.md) while all
+  # domain safety floors and domain rules keep shipping. Narrowing further
+  # (e.g. [engineering] only) stays a per-install user choice.
   # An EMPTY list is inactive (= legacy-all); only a non-empty list scopes.
-  rule_workspaces: []
+  rule_workspaces: [engineering, product, finance, founder, gtm, ops, small-business, construction, legal-review-prep]
   #
   # Optional second axis, same semantics per pack ids (packs.yml). When set,
   # a non-kernel rule also needs a `packs:` intersection to project — e.g.
@@ -622,10 +627,14 @@ worktrees:
 
 # --- AI Council (external second-opinion network) ---
 #
-# Configuration moved to `agents/.ai-council.yml` as of the Step-2
-# consolidation roadmap. Consumer projects opt in by copying the
-# reference file from the package (`agents/.ai-council.yml`) into their
-# own `agents/` tree and flipping `enabled: true` per provider.
+# The council config is NOT here and is NOT project-local. It lives ONLY
+# user-global at `~/.event4u/agent-config/settings/.ai-council.yml` — one
+# file, configured once, serving every project / worktree / CWD (ADR-104,
+# superseding ADR-093). The project tree is NEVER searched; a
+# `.ai-council.yml` under any `agents/` tree is ignored. To opt in, copy
+# the shape from `agents/templates/.ai-council.yml.example` to that
+# user-global path and flip `enabled: true` per provider — do NOT drop it
+# into a project's `agents/` tree.
 #
 # See `docs/contracts/ai-council-config.md` for the schema.
 
@@ -665,9 +674,24 @@ ai_team:
   # plugin on Claude-Code hosts. Cosmetic only — never changes behavior.
   suppress_setup_hint: false
 
-  # NOTE for future keys: `review_gate` (managed loop-bound governance of
-  # the plugin's Stop-hook Review Gate) lands in a later team-mode phase
-  # (Phase 4) — do not add it here ahead of that phase.
+  # Managed governance of the codex plugin's Stop-hook Review Gate
+  # (road-to-team-mode Phase 4). The gate itself stays upstream's; these
+  # keys only govern it. Upstream's own warning: "The review gate can
+  # create a long-running Claude/Codex loop and may drain usage limits
+  # quickly."
+  review_gate:
+    # false (default) = byte-identical pre-Phase-4 behavior: no counting,
+    # no circuit breaker, our Stop path never touches the gate. true =
+    # count consecutive BLOCK verdicts per session and trip the circuit
+    # breaker at the bound below.
+    managed: false
+
+    # Circuit-breaker bound: after this many CONSECUTIVE BLOCK verdicts
+    # in one session, a visible notice is injected exactly once and the
+    # managed layer stops re-blocking — the user decides, never an
+    # infinite Claude↔Codex loop. An ALLOW verdict resets the counter.
+    # Positive integer.
+    max_consecutive_blocks: 3
 
 # --- Onboarding ---
 #
@@ -737,6 +761,45 @@ commands:
   create_pr:
     preview_description: false
 
+    # Verbosity tier for the generated PR description body.
+    #   min (default) = title + 2-3 sentence what/why/impact + linked ticket.
+    #                   Token-frugal. Critical info (breaking changes,
+    #                   migrations, security, rollback) is ALWAYS included
+    #                   regardless of tier — the tier governs explanatory
+    #                   depth, never whether a critical callout appears.
+    #   med           = min + grouped logical changes + tests note.
+    #   max           = med + how-to-test + edge cases / trade-offs +
+    #                   reviewer guidance (the richest, ~legacy output).
+    detail_level: min
+
+    # JSON request/response examples for API-endpoint changes.
+    #   true (default) = include a fenced example ONLY when it can be
+    #                    grounded in a real source (response DTO/resource,
+    #                    OpenAPI/schema, test fixture, or an actual probe).
+    #                    No grounded source → a one-line pointer, never an
+    #                    invented example (a hallucinated contract misleads
+    #                    reviewers, so it is worse than none).
+    #   false          = never add API examples.
+    api_examples: true
+
+    # Screenshots for frontend changes. Default false (off). Capability-gated:
+    # requires the host to have browser/preview tooling (Playwright / a
+    # dev-server URL). When true + a frontend change + no such tooling, the
+    # agent emits a one-line note and leaves the template placeholder — it
+    # never fails or blocks PR creation, and never claims an embed that did
+    # not happen. Before/after + changed-region highlighting is best-effort.
+    #   false (default) = never attempt screenshots.
+    #   true            = attempt when capable (see command contract).
+    screenshots: false
+
+    # Optional glob lists that make frontend / API-endpoint detection
+    # explicit instead of heuristic. Empty (default) = the command uses a
+    # light path/extension heuristic and fails open (no false enrichment
+    # when the surface is ambiguous). Populate to pin your project's paths,
+    # e.g. ui_paths: ["resources/views/**", "src/pages/**"].
+    ui_paths: []
+    api_paths: []
+
 # --- Memory ---
 #
 # Engineering memory consolidation behaviour. Memory is entirely