@event4u/agent-config 8.6.0 → 8.7.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "8.6.0",
+    "version": "8.7.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -989,6 +989,35 @@ our recommendation order, not its support status.
 > that forces a new era split (`# Era: 8.2.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [8.7.0](https://github.com/event4u-app/agent-config/compare/8.6.0...8.7.0) (2026-07-08)
+
+### Features
+
+* **settings:** validate + surface projection.rule_workspaces/rule_packs ([a27bbf5](https://github.com/event4u-app/agent-config/commit/a27bbf53c7fca206176ed6ddd38b1ec5ee11e357))
+* **install:** consumer Cursor/Windsurf get host-native rule surfaces ([8b68ff5](https://github.com/event4u-app/agent-config/commit/8b68ff58e9c240e41acce1f25faa51bc47f3564b))
+* **install:** consumer rule scoping reaches both install pipelines ([88248e4](https://github.com/event4u-app/agent-config/commit/88248e4d39bd056db133021acc0cc2b0782e78cc))
+* **ci:** trigger-eval presence ratchet with shrink-only grandfather allowlist ([d8f0c0d](https://github.com/event4u-app/agent-config/commit/d8f0c0dd04b3388205becf2cce30c6e0ea09197b))
+
+### Bug Fixes
+
+* **ci:** install repo-root deps in the MCP deploy workflow ([9183c4e](https://github.com/event4u-app/agent-config/commit/9183c4e358e76b344058eb01d7f945f246a44828))
+
+### Documentation
+
+* add frontier quality roadmaps ([bfa9315](https://github.com/event4u-app/agent-config/commit/bfa93157848bf13020a6cb3dcd06381c013fb035))
+* **skills:** skill-writing names the CI-enforced trigger-eval presence gate ([464722e](https://github.com/event4u-app/agent-config/commit/464722efe83243e3ae480411d59850dac92ca1ac))
+
+### Chores
+
+* **roadmaps:** regenerate progress dashboard ([a8f4178](https://github.com/event4u-app/agent-config/commit/a8f4178a84ef8c66408afe3d5af195ce19ccf5d0))
+* **gitignore:** ignore Codex CLI interop output (.agents/, .codex/) ([8756d52](https://github.com/event4u-app/agent-config/commit/8756d5226e8760c72d6205e98b9822620d303418))
+* **dist:** rebuild install bundle after settings-schema extension ([44818d4](https://github.com/event4u-app/agent-config/commit/44818d4c8ad69ec545e99820e3292f0346bb2f20))
+* **roadmap:** close Phase 1b with pinned consumer-install evidence ([3a2455f](https://github.com/event4u-app/agent-config/commit/3a2455f236279390eb5a8cfe986e6b911493391c))
+* **condense:** refresh stale hash for commands/upstream-contribute ([c668370](https://github.com/event4u-app/agent-config/commit/c668370663bf7272932c33b5a7874dca4b08a9db))
+* **roadmaps:** composition-ratchet roadmap executed + archived; adoption roadmap sequenced next ([1bde2ea](https://github.com/event4u-app/agent-config/commit/1bde2ea00478bd1e46c4e9596c8c0cd5962b9ee1))
+
+Tests: 6949 (+6 since 8.6.0)
+
 ## [8.6.0](https://github.com/event4u-app/agent-config/compare/8.5.0...8.6.0) (2026-07-08)
 
 ### Features

package/dist/agent-src/skills/skill-writing/SKILL.md

@@ -224,6 +224,10 @@ record it in the commit message (`Eval stub: deferred`). Peer examples
 for the expected format: `php-coder/evals/triggers.json`,
 `eloquent/evals/triggers.json`, `skill-writing/evals/triggers.json`.
 
+Presence CI-enforced for new skills: `check_trigger_eval_presence` fails
+any skill outside shrink-only grandfather allowlist lacking
+`evals/triggers.json` — *skip* defers query quality, never the file.
+
 Rules / commands / guidelines do **not** get eval stubs — only skills
 route through the top-level catalogue.
 

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "8.6.0"
+agent_config_version: "8.7.0"
 
 # --- Project identity ---
 project:

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-08T15:01:19Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -11982,7 +11982,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:ce7bb5aa334783a058f320faf1dfb41aa70140d0a557be29d942ddc08898b239",
+      "checksum": "sha256:87eaa14cd95565d3c642e6e5a3ba1e26ac3b0ee1904e05f92c28ea9512c5dbc6",
       "install": {
         "default": true,
         "removable": false
@@ -12769,7 +12769,7 @@
       "workspaces": []
     }
   ],
-  "checksum": "sha256:373d4519debcdb5a39c065b83e496247480fc44a91aeb6f495ba5024f2a7192b",
+  "checksum": "sha256:9902bbcc7fac058b3506979d8233180ef0a52be98f42cec030433ee6781a5cf3",
   "deprecations": [
     {
       "key": "tier",
@@ -12912,7 +12912,7 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-07-08T14:10:55Z",
+  "generated_at": "2026-07-08T15:01:19Z",
   "packs": [
     {
       "artefact_count": 95,

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-01ac916a948ce2e4232ae06f46e3c626f31a3e328c66904dbfd61ef731a13b1c  discovery-manifest.json
+589017598b9d0eab5bfa36b665f3a6d8407ee34a45aa61d913ae9172f71c3ab3  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,6 +1,6 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-08T15:01:19Z`
 - Scanner: `f36b5a348348`
 - Artefacts: **533**
 - Unassigned: **0**

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-08T15:01:19Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:373d4519debcdb5a39c065b83e496247480fc44a91aeb6f495ba5024f2a7192b",
-  "generated_at": "2026-07-08T14:10:55Z",
+  "checksum": "sha256:9902bbcc7fac058b3506979d8233180ef0a52be98f42cec030433ee6781a5cf3",
+  "generated_at": "2026-07-08T15:01:19Z",
   "packs": [
     {
       "always_on": false,

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-08T15:01:19Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 

package/dist/discovery/workspaces.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:373d4519debcdb5a39c065b83e496247480fc44a91aeb6f495ba5024f2a7192b",
-  "generated_at": "2026-07-08T14:10:55Z",
+  "checksum": "sha256:9902bbcc7fac058b3506979d8233180ef0a52be98f42cec030433ee6781a5cf3",
+  "generated_at": "2026-07-08T15:01:19Z",
   "scanner_version": "f36b5a348348",
   "workspaces": [
     {

package/dist/install/emit_host_rules_cli.js

@@ -0,0 +1,185 @@
+#!/usr/bin/env tsx
+/**
+ * Consumer host-native rule emission
+ * (road-to-request-scoped-rule-load Phase 1b Step 3).
+ *
+ * Before this CLI, consumer Cursor got a symlink farm to raw `.md` (no
+ * `.mdc`, no auto-attach globs) and consumer `.windsurfrules` was built by
+ * a bash concatenator that STRIPPED all frontmatter — destroying the
+ * host-native trigger signal Phase 2 added to the projection path.
+ *
+ * ## Recorded decision — install-time emission, not dist artifacts
+ *
+ * Phase 1b Step 3 asked for one recorded choice: pre-built host artifacts
+ * in `dist/` vs emission at install time. Decision: INSTALL-TIME EMISSION,
+ * re-using the exported condense emitters (`_emit_cursor_mdc`,
+ * `_emit_windsurf_rule`, `strip_frontmatter`) verbatim. Rationale:
+ *   - a new `dist/agent-src/hosts/` tree would cascade through the
+ *     discovery manifest, artefact checksums, condensation hashes and the
+ *     always-budget gates for what is derived data;
+ *   - dist artifacts are scope-agnostic — install-time emission runs AFTER
+ *     the Phase-1b rule filter, so scoped installs get scoped host files
+ *     for free;
+ *   - re-using the exported emitters keeps consumer output byte-identical
+ *     to the maintainer projection (Pipeline B never drifts from A).
+ * The trade-off (node required at install time) matches the rule-scope
+ * resolver: no node → install.sh keeps its legacy fallback surfaces.
+ *
+ * Usage:
+ *   emit_host_rules_cli.ts --rules-dir <installed rules dir>
+ *                          --project-root <consumer root>
+ *                          --tools cursor,windsurf
+ *
+ * Exit codes: 0 emitted · 2 usage error · 1 emission failure (caller falls
+ * back to the legacy surface).
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { _emit_cursor_mdc, _emit_windsurf_rule, strip_frontmatter, } from '../scripts/condense.js';
+function _ruleFiles(rulesDir) {
+    return fs
+        .readdirSync(rulesDir)
+        .filter((n) => n.endsWith('.md'))
+        .sort()
+        .map((n) => path.join(rulesDir, n))
+        .filter((p) => {
+        try {
+            return fs.statSync(p).isFile();
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** Remove entries not in `valid` (mirror of condense's `_clean_modern_dir`). */
+function _cleanDir(dir, valid) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const name of entries) {
+        if (name === 'README.md' || valid.has(name)) {
+            continue;
+        }
+        const full = path.join(dir, name);
+        try {
+            if (fs.lstatSync(full).isDirectory()) {
+                fs.rmSync(full, { recursive: true, force: true });
+            }
+            else {
+                fs.unlinkSync(full);
+            }
+        }
+        catch {
+            /* best-effort clean */
+        }
+    }
+}
+export function emitCursor(rulesDir, projectRoot) {
+    const targetDir = path.join(projectRoot, '.cursor', 'rules');
+    const files = _ruleFiles(rulesDir);
+    const valid = new Set();
+    for (const src of files) {
+        const name = `${path.basename(src, '.md')}.mdc`;
+        _emit_cursor_mdc(src, path.join(targetDir, name));
+        valid.add(name);
+    }
+    _cleanDir(targetDir, valid);
+    return files.length;
+}
+export function emitWindsurf(rulesDir, projectRoot) {
+    const perRuleDir = path.join(projectRoot, '.windsurf', 'rules');
+    const files = _ruleFiles(rulesDir);
+    const valid = new Set();
+    for (const src of files) {
+        const name = path.basename(src);
+        _emit_windsurf_rule(src, path.join(perRuleDir, name));
+        valid.add(name);
+    }
+    _cleanDir(perRuleDir, valid);
+    // Concatenated legacy surface — same format as the projection-path
+    // generator (condense.generate_windsurfrules), consumer-sourced header.
+    const parts = ['# Auto-generated from .augment/rules/ — do not edit directly\n'];
+    for (const src of files) {
+        const content = strip_frontmatter(fs.readFileSync(src, 'utf-8'));
+        parts.push(`---\n\n${content.trim()}\n`);
+    }
+    fs.writeFileSync(path.join(projectRoot, '.windsurfrules'), parts.join('\n') + '\n', 'utf-8');
+    return files.length;
+}
+export function main(argv = process.argv.slice(2)) {
+    let rulesDir = '';
+    let projectRoot = '';
+    let tools = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--rules-dir') {
+            rulesDir = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else if (arg === '--project-root') {
+            projectRoot = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else if (arg === '--tools') {
+            tools = (argv[i + 1] ?? '').split(',').filter((t) => t.length > 0);
+            i += 1;
+        }
+        else {
+            process.stderr.write(`emit_host_rules_cli: unknown argument: ${arg}\n`);
+            return 2;
+        }
+    }
+    if (rulesDir === '' || projectRoot === '' || tools.length === 0) {
+        process.stderr.write('usage: emit_host_rules_cli.ts --rules-dir <dir> --project-root <dir> --tools cursor,windsurf\n');
+        return 2;
+    }
+    if (!fs.existsSync(rulesDir)) {
+        process.stderr.write(`emit_host_rules_cli: rules dir not found: ${rulesDir}\n`);
+        return 1;
+    }
+    try {
+        for (const tool of tools) {
+            if (tool === 'cursor') {
+                const n = emitCursor(rulesDir, path.resolve(projectRoot));
+                process.stdout.write(`cursor: ${n} .mdc rule(s)\n`);
+            }
+            else if (tool === 'windsurf') {
+                const n = emitWindsurf(rulesDir, path.resolve(projectRoot));
+                process.stdout.write(`windsurf: ${n} rule(s) + .windsurfrules\n`);
+            }
+            else {
+                process.stderr.write(`emit_host_rules_cli: unknown tool: ${tool}\n`);
+                return 2;
+            }
+        }
+        return 0;
+    }
+    catch (e) {
+        process.stderr.write(`emit_host_rules_cli: emission failed: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 1;
+    }
+}
+function _isCliEntry() {
+    if (process.argv[1] === undefined)
+        return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl)
+        return true;
+    try {
+        return (fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1])));
+    }
+    catch {
+        return false;
+    }
+}
+if (_isCliEntry()) {
+    process.exit(main());
+}
+//# sourceMappingURL=emit_host_rules_cli.js.map

package/dist/install/emit_host_rules_cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit_host_rules_cli.js","sourceRoot":"","sources":["../../src/install/emit_host_rules_cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACH,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,wBAAwB,CAAC;AAEhC,SAAS,UAAU,CAAC,QAAgB;IAChC,OAAO,EAAE;SACJ,WAAW,CAAC,QAAQ,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACV,IAAI,CAAC;YACD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,GAAW,EAAE,KAA0B;IACtD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACnC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACJ,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,uBAAuB;QAC3B,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,WAAmB;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;QAChD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAClD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,WAAmB;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE7B,mEAAmE;IACnE,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACjF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YAClC,WAAW,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnE,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,GAAG,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,KAAK,EAAE,IAAI,WAAW,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gGAAgG,CACnG,CAAC;QACF,OAAO,CAAC,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,QAAQ,IAAI,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,IAAI,IAAI,CAAC,CAAC;gBACrE,OAAO,CAAC,CAAC;YACb,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,yCAAyC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAC1F,CAAC;QACF,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAED,SAAS,WAAW;IAChB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACD,OAAO,CACH,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,IAAI,WAAW,EAAE,EAAE,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACzB,CAAC"}

package/dist/install/install.mjs

@@ -13877,6 +13877,12 @@ var settingsSchema = external_exports.object({
   projection: external_exports.object({
     mode: projectionMode.default("legacy-all").describe(
       "Whether the per-tool projector writes EVERY artefact into the host-tool trees (.claude/ .cursor/ .windsurf/) or only the active profile + packs' artefacts (ADR-040, docs/contracts/capability-packs.md). legacy-all = (default, non-breaking) project the full surface exactly as 5.x did. scoped = project only the active profile's packs unioned with the runtime.active_packs overlay, expanded over the requires graph \u2014 opt in with `agent-config use --profile=<id>`. A failed scoped projection restores the full tree."
+    ),
+    rule_workspaces: external_exports.array(external_exports.string()).default([]).describe(
+      "Workspace scope for the RULE layer only (road-to-request-scoped-rule-load P1/P1b, opt-in). Absent or empty = legacy-all: every rule projects AND installs. Non-empty = only rules whose workspaces frontmatter intersects this list are projected (condense) and installed (install.sh + global wizard payload). Kernel rules always ship; untagged rules fail safe. The default flip to a scoped value is a HUMAN release gate \u2014 do not set this from automation."
+    ),
+    rule_packs: external_exports.array(external_exports.string()).default([]).describe(
+      "Optional second scoping axis for the RULE layer, per pack ids (src/config/discovery/packs.yml). When set, a non-kernel rule also needs a packs frontmatter intersection to ship \u2014 e.g. deselecting frontend-design drops ui-audit-gate + design-fidelity. Same opt-in / human-gate semantics as rule_workspaces."
     )
   }).default({ mode: "legacy-all" }),
   rule_loading_tier: ruleLoadingTier.default("balanced").describe(

package/dist/install/plan.js

@@ -103,7 +103,10 @@ export function buildInstallPlan(inputs) {
     const filesByTool = {};
     for (const source of inputs.sources) {
         const bucket = filesByTool[source.toolId] ?? [];
-        const files = walkSourceTree(source.srcDir);
+        let files = walkSourceTree(source.srcDir);
+        if (source.fileFilter !== undefined) {
+            files = files.filter(source.fileFilter);
+        }
         for (const srcFile of files) {
             const rel = relative(source.srcDir, srcFile);
             const destPath = resolve(source.destDir, rel);

package/dist/install/plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/install/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCpD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACnC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACrB,IAAY,EACZ,IAAc,EACd,OAAiC;IAEjC,OAAO;QACH,IAAI;QACJ,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACxD,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAa;IACxC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACD,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IAC/C,MAAM,WAAW,GAAgC,EAAE,CAAC;IAEpD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CACP,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;aACxC,CAAC,CACL,CAAC;YACF,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG;gBACxB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE;gBAC7B,IAAI,EAAE,QAAQ;aACjB,CAAC;QACN,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,oEAAoE;IACpE,mDAAmD;IACnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC;YAClC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW;QACX,gBAAgB,EAAE,EAAE;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;KACxB,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/install/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8CpD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACnC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACrB,IAAY,EACZ,IAAc,EACd,OAAiC;IAEjC,OAAO;QACH,IAAI;QACJ,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACxD,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAa;IACxC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACD,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IAC/C,MAAM,WAAW,GAAgC,EAAE,CAAC;IAEpD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CACP,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;aACxC,CAAC,CACL,CAAC;YACF,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG;gBACxB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE;gBAC7B,IAAI,EAAE,QAAQ;aACjB,CAAC;QACN,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,oEAAoE;IACpE,mDAAmD;IACnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC;YAClC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW;QACX,gBAAgB,EAAE,EAAE;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;KACxB,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/install/rule_scope.js

@@ -0,0 +1,109 @@
+/**
+ * Install-time rule scoping — Pipeline B of consumer-scoped rule projection
+ * (road-to-request-scoped-rule-load Phase 1b).
+ *
+ * The projection filter (`rule_in_scope`, condense.ts) covered only the
+ * maintainer projection; the consumer install pipeline shipped rules
+ * unfiltered (dead `EXCLUDE_RULES` in install.sh; no exclude at all on the
+ * global payload). This module is the ONE scoping surface both install
+ * paths consume — it deliberately re-uses `rule_in_scope` so the install
+ * semantics can never drift from the projection semantics.
+ *
+ * ## The `source-of-truth.md` decision (Phase 1b Step 2 — recorded here)
+ *
+ * Before this module, `install.sh` excluded `source-of-truth.md` from
+ * PROJECT installs (hardcoded name) while the GLOBAL payload shipped it —
+ * the documented contradiction. Decision: the rule is excluded from BOTH
+ * consumer paths, always (even under legacy-all). Rationale: its Iron Law
+ * ("NEVER EDIT ANY GENERATED PROJECTION … ALWAYS WORK IN src/") describes
+ * THIS repository's build layout; in a consumer project there is no `src/`
+ * authoring tree and the installed files ARE the working surface — the rule
+ * is not merely useless there, it actively forbids legitimate consumer
+ * edits. Shipping it globally was the bug; project installs had it right.
+ * The compat list below is the pre-flip carrier of that decision; once the
+ * Phase-1 human gate flips consumer defaults to scoped, the rule drops out
+ * via its maintainer-only workspace tag and this list can retire.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { rule_in_scope } from '../scripts/condense.js';
+/**
+ * Rules excluded from EVERY consumer install path regardless of scope —
+ * same treatment on project and global (see module doc for the decision).
+ */
+export const COMPAT_ALWAYS_EXCLUDED = ['source-of-truth.md'];
+export const LEGACY_ALL = { workspaces: null, packs: null };
+/** Non-empty string-array extraction; anything else → null (legacy-all). */
+function _list(value) {
+    if (Array.isArray(value) && value.length > 0) {
+        return value.map((v) => String(v));
+    }
+    return null;
+}
+/**
+ * Extract `projection.rule_workspaces` / `projection.rule_packs` from an
+ * already-parsed settings object (same key contract as condense's
+ * `_read_projection_list` — absent / empty = legacy-all).
+ */
+export function ruleScopeFromSettings(settings) {
+    const proj = settings['projection'];
+    if (typeof proj !== 'object' || proj === null || Array.isArray(proj)) {
+        return LEGACY_ALL;
+    }
+    const p = proj;
+    return {
+        workspaces: _list(p['rule_workspaces']),
+        packs: _list(p['rule_packs']),
+    };
+}
+/**
+ * Whether a rule FILE (path into the shipped `dist/agent-src/rules` tree)
+ * arrives in a consumer install under `scope`.
+ *
+ * Delegates the scoping decision to the projection-path predicate
+ * (`rule_in_scope` — kernel always ships, untagged axes fail safe) and adds
+ * the compat exclusion on top. Non-rule files (non-`.md`) always arrive.
+ */
+export function ruleFileArrives(sourcePath, scope) {
+    if (!sourcePath.endsWith('.md')) {
+        return true;
+    }
+    const basename = path.basename(sourcePath);
+    if (COMPAT_ALWAYS_EXCLUDED.includes(basename)) {
+        return false;
+    }
+    return rule_in_scope(sourcePath, scope.workspaces, scope.packs);
+}
+/**
+ * Basenames from `rulesDir` that are EXCLUDED under `scope` — the shape the
+ * bash installer consumes (one basename per line via the CLI below).
+ */
+export function excludedRuleBasenames(rulesDir, scope) {
+    let entries;
+    try {
+        entries = fs.readdirSync(rulesDir).sort();
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of entries) {
+        if (!name.endsWith('.md')) {
+            continue;
+        }
+        const full = path.join(rulesDir, name);
+        try {
+            if (!fs.statSync(full).isFile()) {
+                continue;
+            }
+        }
+        catch {
+            continue;
+        }
+        if (!ruleFileArrives(full, scope)) {
+            out.push(name);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=rule_scope.js.map

package/dist/install/rule_scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule_scope.js","sourceRoot":"","sources":["../../src/install/rule_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,CAAC,oBAAoB,CAAC,CAAC;AAQhF,MAAM,CAAC,MAAM,UAAU,GAAc,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAEvE,4EAA4E;AAC5E,SAAS,KAAK,CAAC,KAAc;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,OAAO;QACH,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;KAChC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,KAAgB;IAChE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,KAAgB;IACpE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC9B,SAAS;YACb,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/install/rule_scope_cli.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env tsx
+/**
+ * CLI twin surface of {@link module:install/rule_scope} for the bash
+ * installer (road-to-request-scoped-rule-load Phase 1b).
+ *
+ * Prints one EXCLUDED rule basename per line for the given rules source
+ * dir + consumer settings file. `install.sh` consumes this to replace its
+ * dead hardcoded `EXCLUDE_RULES` list; on any failure the caller falls back
+ * to the static compat exclusion (fail-safe: over-ship, never under-ship).
+ *
+ * Usage:
+ *   rule_scope_cli.ts --rules-dir <dist/agent-src/rules> [--settings <file>]
+ *
+ * Exit codes: 0 ok (list on stdout, possibly empty) · 2 usage error.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { load_agent_settings } from '../scripts/_lib/agent_settings.js';
+import { excludedRuleBasenames, ruleScopeFromSettings, LEGACY_ALL } from './rule_scope.js';
+export function main(argv = process.argv.slice(2)) {
+    let rulesDir = '';
+    let settingsFile = '';
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--rules-dir') {
+            rulesDir = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else if (arg === '--settings') {
+            settingsFile = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else {
+            process.stderr.write(`rule_scope_cli: unknown argument: ${arg}\n`);
+            return 2;
+        }
+    }
+    if (rulesDir === '') {
+        process.stderr.write('usage: rule_scope_cli.ts --rules-dir <dir> [--settings <file>]\n');
+        return 2;
+    }
+    let scope = LEGACY_ALL;
+    if (settingsFile !== '' && fs.existsSync(settingsFile)) {
+        try {
+            const settings = load_agent_settings({ project_path: settingsFile });
+            scope = ruleScopeFromSettings(settings);
+        }
+        catch {
+            // Unreadable settings → legacy-all (fail-safe: over-ship).
+            scope = LEGACY_ALL;
+        }
+    }
+    for (const name of excludedRuleBasenames(path.resolve(rulesDir), scope)) {
+        process.stdout.write(`${name}\n`);
+    }
+    return 0;
+}
+function _isCliEntry() {
+    if (process.argv[1] === undefined)
+        return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl)
+        return true;
+    try {
+        return (fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1])));
+    }
+    catch {
+        return false;
+    }
+}
+if (_isCliEntry()) {
+    process.exit(main());
+}
+//# sourceMappingURL=rule_scope_cli.js.map

package/dist/install/rule_scope_cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule_scope_cli.js","sourceRoot":"","sources":["../../src/install/rule_scope_cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE3F,MAAM,UAAU,IAAI,CAAC,OAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAC9B,YAAY,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,GAAG,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACb,CAAC;IAED,IAAI,KAAK,GAAG,UAAU,CAAC;IACvB,IAAI,YAAY,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,KAAK,GAAG,qBAAqB,CAAC,QAAmC,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACL,2DAA2D;YAC3D,KAAK,GAAG,UAAU,CAAC;QACvB,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAED,SAAS,WAAW;IAChB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACD,OAAO,CACH,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,IAAI,WAAW,EAAE,EAAE,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACzB,CAAC"}

package/dist/install/wizard-plan.js

@@ -20,6 +20,7 @@
 import { homedir } from 'node:os';
 import { isAbsolute, join, resolve } from 'node:path';
 import { buildInstallPlan } from './plan.js';
+import { ruleFileArrives, LEGACY_ALL } from './rule_scope.js';
 /**
  * Per-tool user-scope anchor directory, mirrored 1:1 from
  * `scripts/install.py:USER_SCOPE_PATHS`. Values may use `~` for the
@@ -157,6 +158,8 @@ export function expandAnchor(anchor, home) {
  */
 export function expandWizardSources(inputs) {
     const { toolIds, packageRoot, home } = inputs;
+    const scope = inputs.ruleScope ?? LEGACY_ALL;
+    const ruleFilter = (srcFile) => ruleFileArrives(srcFile, scope);
     const out = [];
     for (const toolId of toolIds) {
         const deploy = GLOBAL_DEPLOY_SOURCES[toolId];
@@ -167,7 +170,17 @@ export function expandWizardSources(inputs) {
         for (const [srcRel, destSub] of deploy) {
             const srcDir = join(packageRoot, srcRel);
             const destDir = destSub.length === 0 ? destRoot : join(destRoot, destSub);
-            out.push({ toolId, srcDir, destDir, kind: 'deployed' });
+            // Rule sources get the install-time scoping filter — the same
+            // predicate the projection path uses (Phase 1b: Pipeline B may
+            // never drift from Pipeline A).
+            const isRuleSource = srcRel === 'dist/agent-src/rules';
+            out.push({
+                toolId,
+                srcDir,
+                destDir,
+                kind: 'deployed',
+                ...(isRuleSource ? { fileFilter: ruleFilter } : {}),
+            });
         }
     }
     return out;