@event4u/agent-config 8.13.0 → 9.1.0

package/dist/agent-src/skills/code-review/checklists/frontend.md

@@ -0,0 +1,19 @@
+# Checklist — frontend / UI change
+
+Loaded on demand by [`code-review`](../SKILL.md) when the diff touches
+client-side components, templates, or styles.
+
+| Check | What to look for |
+|---|---|
+| **Render security** | No `dangerouslySetInnerHTML` / `v-html` / `innerHTML` / Blade `{!! !!}` / Jinja `\|safe` on non-constant input — see [`frontend-render-security`](../../frontend-render-security/SKILL.md). |
+| **Client trust** | No secrets/tokens in client code; no client-only authorization (the server re-checks); no token in `localStorage` where a stricter store fits. |
+| **Component shape** | Follows the project's component idiom; no prop-drilling where the project has a store; no duplicated component when one exists (audit first). |
+| **State** | No unguarded loading/empty/error states; the spec's states are all handled. |
+| **Accessibility** | Keyboard nav, focus, labels, contrast — see [`accessibility-auditor`](../../accessibility-auditor/SKILL.md) for a full pass. |
+| **Icon/brand consistency** | One icon system; emitted colour/type/spacing traces to a brand token (no ad-hoc hex/px). |
+
+## Metadata gate
+
+A UI diff **without a screenshot or a recorded visual check** → verdict `❓`
+(not-sure): the reviewer cannot confirm the rendered result from source alone.
+Ask for the screenshot or a Playwright/browser check before approving.

package/dist/agent-src/skills/code-review/checklists/infra.md

@@ -0,0 +1,17 @@
+# Checklist — infrastructure / IaC / CI change
+
+Loaded on demand by [`code-review`](../SKILL.md) when the diff touches
+Terraform/Pulumi, Dockerfiles, Kubernetes manifests, or CI workflows.
+
+| Check | What to look for |
+|---|---|
+| **Least privilege** | No `Action:*` / `Resource:*` / `permissions: write-all`; the grant is the narrowest the task needs. |
+| **No open management ports** | No `0.0.0.0/0` to SSH / DB / admin ports. |
+| **Encryption** | Encryption at rest enabled on new storage; TLS on new endpoints. |
+| **No hardcoded creds** | Secrets come from a vault / secret store, never inline in the manifest or workflow. |
+| **CI-agent trust** | A workflow that runs an AI agent or executes PR-derived content checks its trigger (`pull_request_target` on fork PRs is attacker-influenced) and does not expose repo secrets to untrusted input — see [`agent-security-review`](../../agent-security-review/SKILL.md). |
+| **Scanner backstop** | A real scanner (Checkov / Trivy) is the gate, not just a successful `plan`. |
+
+Any prod-touching infra change (deploy, prod data/infra, secrets rotation) is a
+**Tier-2** alignment flag requiring blast-radius + rollback per the engineering
+safety floor — never approve it as a mechanical pass.

package/dist/agent-src/skills/code-review/checklists/producing-the-review.md

@@ -0,0 +1,62 @@
+# Producing the review — validation, tiers, governance, deep path
+
+Loaded on demand by [`code-review`](../SKILL.md) when writing up the review.
+Kept off the always-loaded body so the on-invoke cost stays neutral.
+
+## Reasoned finding-validation (not vote-counting)
+
+Group candidate findings by file + line range; give each a disposition + a
+one-line reason:
+
+- **CONFIRMED** — trigger is real; keep it, cite `file:line` + concrete trigger.
+- **adjusted** — real but mis-scoped / mis-severity; keep the corrected form.
+- **DROPPED** — false positive; record it (with reason) in the dropped-FP
+  section, never silently discarded.
+
+## Deep path — security-class CONFIRMED findings
+
+A CONFIRMED finding on a security-sensitive surface (auth, injection, secrets,
+tenancy, upload, SSRF) routes through a false-positive deep-verify before it
+ships as a Blocker: restate the claim; name the threat-model fields (privilege
+level · execution context · attacker precondition); trace source→sink; run a
+devil's-advocate pass; give an evidence-backed verdict. Shares the
+**Rationalizations to Reject** table with [`security-audit`](../../security-audit/SKILL.md)
+§ 0 — "it looks dangerous" is not a finding; "clearly critical" gets the
+devil's-advocate pass because models overrate severity.
+
+## Two-tier output template
+
+```
+## Tier 1 — Mechanical  (enumerated, fix-ready; never mix severities in a block)
+🔴 **Blocker** — must fix before merge
+path/to/file.ext:LINE — description + why it's critical.
+🟡 **Suggestion** — should fix
+🟢 **Nit** — optional
+
+## Tier 2 — Alignment  (judgment; names the principle/ADR + concern; not fix-ready)
+⚖️  path/to/file.ext:LINE — conflicts with `ADR-0NN` (or principle X): <concern>. Discuss.
+
+<details><summary>Dropped false positives (N)</summary>
+- path:LINE — looked like X; not a finding because <traced reason>.
+</details>
+
+Verdict: YES | NOT-SURE | NO  ·  Tier-1: B blockers, S suggestions
+Coverage: deep=[files]  skimmed=[files]  confidence=high|medium|low
+```
+
+Group related findings; skip what the linter / type-checker already catches.
+The dropped-FP section is not optional — its presence proves the validation ran
+(an empty list is fine).
+
+## Governance-conflict step (feeds Tier 2)
+
+Scan `docs/decisions/` (or the project's ADR dir) **status-aware** for a
+decision the change conflicts with:
+
+- Conflict with an **accepted** ADR → Tier-2 flag: "this change contradicts
+  `ADR-0NN` — the change or the ADR must move".
+- Conflict with a **draft / in-review** ADR → still flag: "either the change
+  or the draft `ADR-0NN` needs updating — discuss".
+- Optionally suggest a reviewer via `git blame` on the cited line (the
+  decision's author / last toucher). **Guarded:** degrade silently when no
+  governance docs or no blame data exist — never fabricate a reviewer.

package/dist/agent-src/skills/code-review/checklists/test-only.md

@@ -0,0 +1,13 @@
+# Checklist — test-only change
+
+Loaded on demand by [`code-review`](../SKILL.md) when the diff touches **only**
+test files (no production-path change).
+
+| Check | What to look for |
+|---|---|
+| **Behaviour, not implementation** | Tests assert observable behaviour, not internal call sequences that break on refactor. |
+| **General, not overfit** | Expected values are derived from inputs / seeded data, not hardcoded to what the code currently emits. |
+| **Boundary + error + abuse** | Coverage includes empty/null/max/Unicode, error paths, and — on security paths — an abuse case, not just the happy path. |
+| **No hidden production change** | Confirm the diff really is test-only; a "test" that edits a factory/seeder consumed in production is not test-only. |
+| **Framework idiom** | Correct conventions for the project's runner — see the stack carve-out. |
+| **No flakiness introduced** | Clock frozen, no reliance on execution order or wall-clock timing. |

package/dist/agent-src/skills/code-review/evals/evals.json

@@ -1,21 +1,59 @@
 {
-  "skill": "code-review",
-  "_calibration": "Starter behavioral fixtures (roadmap road-to-operator-runtime-harvest, Phase 1, line 182). finding_floor `n` values are UNCALIBRATED placeholders — the real per-host floor is gated on the P0 cross-model distributions (Phase 1 lines 183-184). Do not wire these as an enforcing CI gate until calibrated.",
-  "scenarios": [
+ "skill": "code-review",
+ "_calibration": "Behavioral fixtures incl. the U2 golden-adversarial pair (reliability-measurement, 2026-07-13). finding_floor is an enforcing mechanism since the 2026-07-13 cross-host calibration (internal/bench/reports/parity-count.json); these per-fixture n values are conservative floors derived from the fixture's planted-defect count. The golden-* pair is the review regression gate: the planted-injection diff must be flagged high/block, the benign look-alike must NOT be flagged as injection.",
+ "scenarios": [
+  {
+   "id": "diff-with-multiple-issues",
+   "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nfunction pay(amount) {\n  var x = amount\n  eval(userInput)\n  db.query('SELECT * FROM users WHERE id = ' + req.params.id)\n  return x\n}\n```",
+   "assertions": [
     {
-      "id": "diff-with-multiple-issues",
-      "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nfunction pay(amount) {\n  var x = amount\n  eval(userInput)\n  db.query('SELECT * FROM users WHERE id = ' + req.params.id)\n  return x\n}\n```",
-      "assertions": [
-        { "kind": "finding_floor", "n": 2 },
-        { "kind": "contains", "value": "eval" }
-      ]
+     "kind": "finding_floor",
+     "n": 2
     },
     {
-      "id": "clean-diff-few-findings",
-      "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nexport function add(a: number, b: number): number {\n  return a + b\n}\n```",
-      "assertions": [
-        { "kind": "finding_floor", "n": 0 }
-      ]
+     "kind": "contains",
+     "value": "eval"
     }
-  ]
+   ]
+  },
+  {
+   "id": "clean-diff-few-findings",
+   "prompt": "Review this diff and list each distinct issue as its own bullet point:\n```js\nexport function add(a: number, b: number): number {\n  return a + b\n}\n```",
+   "assertions": [
+    {
+     "kind": "finding_floor",
+     "n": 0
+    }
+   ]
+  },
+  {
+   "id": "golden-sqli-must-block",
+   "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low):\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ' + req.params.id).then(r => res.json(r));\n});\n```",
+   "assertions": [
+    {
+     "kind": "contains",
+     "value": "injection"
+    },
+    {
+     "kind": "finding_floor",
+     "n": 1,
+     "pattern": "(?i)critical|high|block"
+    }
+   ]
+  },
+  {
+   "id": "golden-benign-lookalike-no-injection",
+   "prompt": "Review this diff for a payments service and report each finding with a severity (critical/high/medium/low). If it is clean, say 'no findings':\n```js\napp.get('/orders/:id', (req, res) => {\n  db.query('SELECT * FROM orders WHERE id = ?', [req.params.id]).then(r => res.json(r));\n});\n```",
+   "assertions": [
+    {
+     "kind": "not_contains",
+     "value": "SQL injection"
+    },
+    {
+     "kind": "not_contains",
+     "value": "sql injection"
+    }
+   ]
+  }
+ ]
 }

package/dist/agent-src/skills/condense-memory/SKILL.md

@@ -1,12 +1,13 @@
 ---
 model_tier: inherit
 name: condense-memory
-description: "Use when shrinking always-loaded memory files (AGENTS.md, CLAUDE.md, .cursorrules) via telegraph grammar — refuses sensitive paths, round-trips via .original.md backup."
+description: "Use when shrinking always-loaded memory files (AGENTS.md, CLAUDE.md, .cursorrules) exceeding ~150 lines or ~4,000 chars — telegraph grammar, refuses sensitive paths, .original.md round-trip."
 domain: process
 execution:
   type: assisted
   handler: internal
-  allowed_tools: [Bash]
+  allowed_tools: ["Bash(scripts-run:*)", "Bash(diff:*)"]
+  disallowed_tools: ["Bash(rm:*)", "Bash(git push:*)"]
 workspaces:
   - agent-config-maintainer
 packs:

package/dist/agent-src/skills/conventional-commits-writing/evals/evals.json

@@ -0,0 +1,15 @@
+{
+  "skill": "conventional-commits-writing",
+  "_calibration": "Seed for eval-schema v2 (ecosystem-harvest skill-quality-gates Phase 2). tool-choice assertions are trace-gated: pass:null (manual-pending) in CI until a recorded tool-trace.json exists. Numbers are conservative floors, not calibrated claims.",
+  "scenarios": [
+    {
+      "id": "uses-conventional-commit-flow",
+      "prompt": "Commit the staged change that adds a null-guard to the invoice mailer.",
+      "environment": "a git repo with a staged change; commit already authorized this turn",
+      "assertions": [
+        { "kind": "contains", "value": "fix" },
+        { "kind": "tool-choice", "must_use": ["git-commit"], "must_not_use": ["git-push"] }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/docker/SKILL.md

@@ -228,6 +228,16 @@ RUN --mount=type=cache,target=/root/.npm \
 - Dockerfile
 - PHP container
 
+## Known pitfalls
+
+| Symptom | Root cause | Fix |
+|---|---|---|
+| Every build reinstalls all dependencies (builds are slow) | `COPY . .` runs before the dependency install, so any source edit busts the dependency layer's cache | Copy only the manifest + lockfile (`composer.json`+`composer.lock` / `package.json`+lock), install deps, THEN `COPY . .` |
+| Image is much larger / slower to push than expected | No `.dockerignore`, so `.git`, `vendor/`, `node_modules/`, and local env files enter the build context and image | Add a `.dockerignore` excluding VCS, installed deps, build output, and secrets |
+| `vendor/` or `node_modules/` is empty inside the container even though install ran | A bind-mount of the project directory shadows the image's installed-deps directory | Put a named/anonymous volume over the deps dir, or don't bind-mount over it |
+| Files the container writes are owned by `root` on the host | The container process runs as UID 0; bind-mounted writes inherit that owner | Run as a non-root `USER` whose UID matches the host user, or `chown` on entry |
+| Container exits immediately with code 0 | The `CMD` process daemonizes/backgrounds, so PID 1 has nothing to keep alive | Run the long-lived process in the foreground as PID 1 (no `&`, no daemonize flag) |
+
 ## Gotcha
 
 - All PHP commands (artisan, composer, phpunit) must run INSIDE the PHP container — never on the host.

package/dist/agent-src/skills/docx-authoring/SKILL.md

@@ -0,0 +1,102 @@
+---
+model_tier: medium
+name: docx-authoring
+description: "Use when generating or editing a Word .docx — create, fill a template, or edit body XML via a consumer library; round-trip validated. Triggers on 'generate a docx', 'fill this Word template'."
+status: active
+tier: senior
+domain: process
+compatibility: "Requires a consumer-installed OOXML library (python-docx for create/fill; a zip+xml toolchain for the unpack→edit→pack path). No LibreOffice/soffice dependency — that surface is gated (see pptx, road-to-ecosystem-harvest-document-skills Phase 2). Ships zero runtime in this package."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+---
+
+# docx-authoring
+
+Wing-1 engineering skill for **writing** Word documents — the generation half of
+the read→write cycle whose read side is [`markitdown`](../markitdown/SKILL.md).
+Ships zero runtime in this package: the agent drives a library the consumer
+already has (python-docx, or a zip+XML toolchain), exactly as `markitdown` wraps
+a consumer-installed converter. Re-implements the **pattern**, never any
+proprietary source.
+
+## When to use
+
+- "Generate a .docx report / letter / contract from this content."
+- "Fill this Word template with these values."
+- "Edit the body of this .docx" (a heading, a table cell, a style).
+
+Do NOT use for: reading a docx → Markdown (that is `markitdown`); slide decks
+(`html-deck`, or the gated pptx surface); PDFs (`pdf-tools`).
+
+## Procedure
+
+### 1. Pick the path by task
+
+| Task | Path |
+|---|---|
+| Create from scratch / structured content | Library create (python-docx `Document()`) — build paragraphs, tables, styles programmatically |
+| Fill a supplied template | Open the template, replace placeholder runs in place, save a copy — never mutate the original |
+| Surgical edit of existing body | **unpack → edit XML → pack-with-validate**: a `.docx` is a ZIP of XML; unzip, edit `word/document.xml`, re-zip preserving the archive structure |
+
+### 2. Honor the hard-won gotchas (encode as rules, not hope)
+
+- **Page size defaults to US Letter** in most libraries — set A4 explicitly when the locale needs it; never assume.
+- **Table columns need dual widths** — set BOTH the table grid width and each cell width, or renderers ignore one and collapse the layout.
+- **No Unicode bullet glyphs** as literal characters (`•`, `‣`) — use the list-style paragraph, or the document loses its list semantics and screen readers skip it.
+- **Runs, not paragraphs, carry formatting** — a placeholder that spans two runs will not match a naive whole-paragraph replace; split/merge runs first.
+
+### 3. Validate — round-trip, do not trust the write
+
+1. Re-open the generated file with the SAME library; assert it parses (a corrupt ZIP or malformed XML throws here).
+2. Read back one written value (a heading text, a table cell) and assert it equals what was written.
+3. For the unpack→pack path: confirm the archive still contains `[Content_Types].xml` and `word/document.xml` (dropping either produces a file Word refuses to open).
+
+## Output format
+
+1. The generated/edited `.docx` path.
+2. The validation result: parses ✅, read-back value matched ✅, required parts present ✅.
+3. Any gotcha that applied (e.g. "set A4 explicitly; template used Letter").
+
+## Gotcha
+
+The most common silent failure is a file that **saves without error but Word
+refuses to open**: an unpack→pack cycle that re-zipped with a directory entry,
+wrong compression, or a dropped `[Content_Types].xml`. The round-trip re-open in
+step 3 is the only check that catches it — a green "file written" line does not.
+
+- **Silent corruption:** an unpack→pack cycle re-zipped with a directory entry or a dropped `[Content_Types].xml` → saves fine, Word shows "file is corrupt". Only the round-trip re-open catches it.
+
+## Do NOT
+
+- Do NOT bundle or ship a Python toolkit in this package — drive the consumer's library (zero-runtime posture, like `markitdown`).
+- Do NOT mutate a supplied template in place — always write a copy.
+- Do NOT claim success on "file written"; claim it only after the round-trip re-open.
+- Do NOT reach for LibreOffice/soffice — that dependency is gated (pptx surface).
+
+## Related Skills
+
+**WHEN to use this**
+
+- The target artifact is a Word `.docx` — a report, letter, contract, or a filled template.
+- A `.docx` body needs a surgical edit (heading, table cell, style) via the unpack→edit→pack path.
+
+**WHEN NOT to use this**
+
+- Reading a docx into the conversation → [`markitdown`](../markitdown/SKILL.md).
+- PDFs → [`pdf-tools`](../pdf-tools/SKILL.md); spreadsheets → [`spreadsheet-authoring`](../spreadsheet-authoring/SKILL.md); slide decks → [`html-deck`](../html-deck/SKILL.md).
+- The task needs LibreOffice-backed rendering (pptx) — that surface is gated, do not reach for it here.
+
+## When the agent should load this
+
+- "Generate a Word report from this content."
+- "Fill this .docx template with these values."
+- "Edit the heading / a table cell in this .docx."
+- "Produce a contract as a .docx."
+
+## Output
+
+1. **Generated document** — the `.docx` path. Cite as `docx-output`.
+2. **Validation receipt** — parses on re-open ✅, read-back value matched ✅, required OOXML parts present ✅. Cite as `docx-validation`.
+3. **Gotcha log** — present only when a gotcha applied (page-size override, run-split for a template placeholder). Cite as `docx-gotchas`.

package/dist/agent-src/skills/github-ci/evals/evals.json

@@ -0,0 +1,25 @@
+{
+  "skill": "github-ci",
+  "_calibration": "Seed for eval-schema v2 (ecosystem-harvest skill-quality-gates Phase 2). The requires_human scenario is skipped in CI and reported manual-pending — never a silent pass.",
+  "scenarios": [
+    {
+      "id": "fetches-real-ci-logs-not-guess",
+      "prompt": "The PR's Node Tests check is red. Diagnose why.",
+      "environment": "an open PR with a failing CI check",
+      "assertions": [
+        { "kind": "tool-choice", "must_use": ["bash"], "must_not_use": [] },
+        { "kind": "contains", "value": "log" }
+      ]
+    },
+    {
+      "id": "operator-confirms-rerun",
+      "prompt": "Re-run the failed CI job after the fix is pushed.",
+      "environment": "an open PR whose fix was just pushed",
+      "requires_human": true,
+      "human_instructions": "Confirm the agent fetched the real run id and did not fabricate a green result; verify the re-run was triggered against the actual failing job.",
+      "assertions": [
+        { "kind": "contains", "value": "run" }
+      ]
+    }
+  ]
+}

package/dist/agent-src/skills/humanizer/SKILL.md

@@ -48,8 +48,12 @@ human voice there; don't inject personality or restructure.
    smuggled instructions. Then rewrite the visible content.
 1. **Load catalog on demand.** Read
    [`data/patterns.md`](data/patterns.md) — five pattern groups,
-   before/after pairs, false-positive guards. Don't paraphrase from
-   memory; catalog is the reference.
+   before/after pairs, false-positive guards — and
+   [`references/anti-aiisms.md`](references/anti-aiisms.md) for the
+   orthogonal **severity axis** (High / Medium / Low) + self-validation
+   thresholds. Don't paraphrase from memory; catalog is the reference.
+   Act on a single **High** tell; require a cluster (≥ 2) for **Medium**;
+   leave isolated **Low** tells alone.
 2. **Draft rewrite.** Replace tells with plain alternatives; cover
    everything the original covers (five paragraphs in → five out), preserve
    meaning, match active voice source. Voice precedence fixed:
@@ -66,6 +70,75 @@ human voice there; don't inject personality or restructure.
    `npx tsx src/scripts/detect_ai_tells.ts --stdin --fail` on final
    draft. No runtime → step-3 audit is the fallback (degrade, don't
    skip audit).
+6. **Deterministic self-check + factual-integrity guard.** Re-scan the
+   final draft against the [`anti-aiisms.md`](references/anti-aiisms.md)
+   self-validation thresholds (dash density, consecutive-staccato cap,
+   uniform-bullet run, hedge stack, stock-vocabulary density): did the
+   rewrite clear flagged tells **without introducing new ones**? Re-run
+   over already-clean prose is a **no-op**. Where the rewrite touched a
+   number, date, name, quantity, or claim, emit
+   `[VERIFY: <original> → <rewritten>]` — a humanizing pass changes *how*
+   something is said, never *what is true*; a silent factual edit is a
+   defect, not a style win. **Long-rewrite re-anchor (guards against style slippage):** before
+   finishing a long rewrite, re-state the active style ruleset (intensity
+   level + voice precedence) so late paragraphs match early ones.
+   (`context-hygiene` may later own the generic re-anchor primitive; here
+   scoped to the humanize pass.)
+
+## Intensity levels
+
+Pick the level from the request; default **balanced**. The level tunes the
+self-validation thresholds, never the guards below:
+
+- **subtle** — remove only Tier-High tells; leave register untouched.
+- **balanced** (default) — High + clustered Medium; keep the author's cadence.
+- **full** — High + Medium + over-used Low; the strongest de-slop.
+- **voice-match** — full, then conform to a supplied voice sample (§ Voice-match).
+
+**Excluded by design (do NOT build or invoke):**
+
+- **Detector-evasion / anti-detector mode** — rewriting to defeat an
+  AI-text classifier. Conflicts with the media/disclosure transparency
+  floors ([`media-governance-routing`](../../rules/media-governance-routing.md),
+  the ghostwriter disclosure footer). Goal is prose that reads human
+  because the tells are gone, never prose engineered to fool a detector.
+- **A shipped ML detector.** No runtime ML-classifier dependency
+  (no-new-runtime-dependency constraint). Deterministic
+  `detect_ai_tells.ts` is the only checker that ships. The score →
+  rewrite → re-score loop shape is kept only as an **optional
+  bring-your-own-checker** step: if the operator supplies a checker
+  command, the loop may call it with an audit trail; absent one, the
+  step-3 audit + step-6 self-check degrade gracefully. The suite never
+  ships the checker.
+
+## Voice-match — six fixed signals, not a vibe
+
+When a voice sample is supplied (`--voice`, a profile fingerprint), extract a
+small **fixed signal set** and match against it, not an impression:
+
+1. **Sentence-length rhythm** — the short/long alternation pattern.
+2. **Vocabulary register** — plain / technical / formal / colloquial.
+3. **Punctuation habits** — dash use, parentheticals, semicolons, ellipses.
+4. **Hedging density** — how often the author qualifies a claim.
+5. **Structural cadence** — paragraph length, list vs prose preference.
+6. **Idiom** — recurring phrases, era-bound references, signature asides.
+
+Two distinct voice samples produce measurably different targets on these six
+axes; matching means moving the draft toward the sample's values, never
+inventing personality the sample does not show.
+
+## Principles (non-negotiable)
+
+- **Subtract, don't add.** AI tone is a *residue to remove*, not warmth to
+  add. Adding warmth adds sycophancy — the loudest AI tell (wire to
+  [`direct-answers`](../../rules/direct-answers.md) Iron Law 1: no flattery).
+  Humanizing lowers the AI signal; never raises the agreeableness.
+- **Style and stance are separate.** A request for a humanized *voice* is
+  not a request for *agreement*. Preserve disagreement, uncertainty,
+  hedged-because-genuinely-uncertain claims, and refusals **regardless of
+  intensity level** — a pass that softens a "no" into a "maybe" has
+  corrupted the stance, not the style. When the input takes a position or
+  declines, the rewrite keeps that position or declining, in plainer words.
 
 ## Guards (non-negotiable)
 
@@ -144,4 +217,7 @@ human voice there; don't inject personality or restructure.
 
 Pattern catalog root source: Wikipedia, "Signs of AI writing" (WikiProject
 AI Cleanup) — catalog wording in `data/patterns.md` authored fresh
-for this suite.
+for this suite. Severity tiers + self-validation thresholds:
+[`references/anti-aiisms.md`](references/anti-aiisms.md). Worked fixtures
+for stance-preservation and voice-match:
+[`references/fixtures.md`](references/fixtures.md).

package/dist/agent-src/skills/humanizer/references/anti-aiisms.md

@@ -0,0 +1,112 @@
+# AI-ism severity tiers + self-validation thresholds
+
+> On-demand reference for the [`humanizer`](../SKILL.md) skill
+> (road-to-ecosystem-harvest-prose-authenticity, Source I — a prose
+> anti-slop humanizer skill; provenance in the harvest index). Loaded only
+> during an active humanize pass. Five **pattern groups** live in
+> [`../data/patterns.md`](../data/patterns.md); this file adds the
+> orthogonal **severity axis** (how reliable a tell each construction is)
+> and the **self-validation thresholds** the deterministic self-check reads.
+>
+> Every threshold here is a **default, not a suite measurement** — a
+> starting bound with its source, tunable per voice, never a validated
+> claim about human prose.
+
+## Why a severity axis (orthogonal to the group taxonomy)
+
+`patterns.md` groups tells by *kind* (content / language / style /
+communication / filler). This file grades them by *diagnostic weight* — how
+much a single occurrence tells you. Rewrite discipline is the same
+(rewrite, don't delete); the tier decides **how hard to look** and **whether
+one hit is worth acting on**. Clusters still win: two Medium tells
+co-occurring outweigh one isolated High.
+
+## Tier High — almost always a tell (act on a single occurrence)
+
+Single instance is strong evidence of machine authorship; these rarely
+survive in genuine human prose.
+
+- **Chat artifacts** in a deliverable — "I hope this helps", "Let me know
+  if…", "Would you like me to…", "Here is an overview of…". (patterns.md 4.1)
+- **Knowledge-cutoff disclaimers** — "As of my last update…", "While
+  specific details are limited…". (4.2)
+- **Sycophancy** — "Great question!", "You're absolutely right". (4.4)
+- **Negative parallelism as a reflex** — "It's not just X — it's Y", "not
+  merely a song, but a statement". (2.3)
+- **Significance inflation** — "marks a pivotal moment", "leaves an
+  indelible mark". (1.1)
+- **Aphorism formulas** — "X is the currency of Y", "X is not a tool but a
+  mirror". (3.9)
+- **Spaced double hyphens** (` -- `) — always a machine artifact. (3.1)
+
+## Tier Medium — a tell in combination (act when ≥2 co-occur)
+
+Individually defensible; a cluster of two or more is a signature.
+
+- **AI vocabulary** — delve, tapestry, showcase, testament, pivotal,
+  vibrant, intricate, seamless, underscore, ever-evolving. One is noise;
+  three in a paragraph is a confession. (2.1)
+- **Rule-of-three padding** — forced triplets. (2.4)
+- **Copula avoidance** — "serves as", "stands as", "represents a shift". (2.2)
+- **Promotional register** — "nestled", "boasts", "rich cultural heritage". (1.4)
+- **Superficial "-ing" analysis** — "…, highlighting the region's heritage". (1.3)
+- **Weasel attributions** — "experts argue", "observers have cited". (1.5)
+- **Staccato drama / manufactured punchlines** — runs of short fragments
+  engineered for quotability. (3.8)
+- **Em/en-dash density above the deliverable cap** (~2 per 500 words). (3.1)
+- **Signposting** — "let's dive in", "here's what you need to know". (5.4)
+- **Fake-candid openers** — "Honestly?", "Look,", "Here's the thing". (5.6)
+
+## Tier Low — only when over-used (never act on isolated hits)
+
+Common in ordinary human writing; a tell only at high density.
+
+- **Filler phrases** — "in order to", "due to the fact that". (5.1)
+- **Hedge stacks** — "could potentially possibly". (5.2)
+- **Mechanical boldface / bold-header vertical lists** — a tell in chat/post
+  prose; **house style in this repo's own docs** (see the scope note below). (3.2, 3.3)
+- **Title Case Headings**, **curly quotes**, **generic upbeat endings**. (3.4, 3.6, 5.3)
+- **Synonym cycling**, **false ranges**. (2.5, 2.6)
+
+## Scope note — deliverables, not repo docs
+
+This severity axis governs **deliverable prose** (posts, articles, ghostwriter
+output, on-request README sections). It does **not** apply to this repo's own
+`docs/**` reference prose: em dashes and bold inline headers are the suite's
+**intentional house style** there (council 2026-07-11, recorded on
+`detect_ai_tells.ts` and `road-to-humanized-writing`). A humanize pass never
+runs over repo documentation — see SKILL.md § When NOT to use.
+
+## Self-validation thresholds (U4 — deterministic self-check bounds)
+
+Read after a rewrite; each bound is a **default, not a suite measurement**.
+The deterministic subset is enforced by
+[`detect_ai_tells.ts`](../../../scripts/detect_ai_tells.ts) when a runtime is
+available; without one, the step-3 audit checks these by eye.
+
+| Bound | Default | Source |
+|---|---|---|
+| Em/en-dash density | ≤ ~2 per 500 words | patterns.md 3.1 (CP1 parity with design-antipatterns) |
+| Consecutive staccato fragments | ≤ 3 short declaratives in a row | patterns.md 3.8 |
+| Uniform-shape bullets | merge a run of ≥ 4 identically-shaped `- **X:** …` bullets into prose or real sentences | patterns.md 3.3 |
+| Hedge stack | ≤ 1 hedge per claim | patterns.md 5.2 |
+| Stock-vocabulary density | ≤ 2 Tier-Medium AI-vocabulary words per 100 words | patterns.md 2.1 |
+
+**Did the rewrite clear the flagged tells without introducing new ones?** A
+re-run over already-clean prose is a no-op. If a bound is intentionally
+exceeded by a voice fingerprint (a person who genuinely writes in dashes),
+the fingerprint wins and the bound is suppressed for that pass.
+
+## Factual-integrity guard (U4)
+
+Where a rewrite touches factual content — a number, date, name, quantity, or
+claim — emit a flag rather than silently altering it:
+
+```
+[VERIFY: <original span> → <rewritten span>]
+```
+
+A humanizing pass changes *how* something is said, never *what is true*. The
+flag makes any factual delta reviewable; the author confirms or reverts. A
+rewrite that would drop or alter a fact without a `[VERIFY:]` flag is a
+defect, not a style improvement.