@event4u/agent-config 8.6.0 → 8.8.0

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-09T12:23:58Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,14 +1,17 @@
 {
-  "checksum": "sha256:373d4519debcdb5a39c065b83e496247480fc44a91aeb6f495ba5024f2a7192b",
-  "generated_at": "2026-07-08T14:10:55Z",
+  "checksum": "sha256:236db1c9e47c8fb6c769af3954d78b738af4308cccd100d55683fbc64ed05fd1",
+  "generated_at": "2026-07-09T12:23:58Z",
   "packs": [
     {
       "always_on": false,
-      "artefact_count": 95,
+      "artefact_count": 103,
       "artefacts": [
         "src/domains/engineering-base/mission/upgrade/command.md",
+        "src/rules/active-remediation.md",
+        "src/rules/broken-access-control.md",
         "src/rules/commit-conventions.md",
         "src/rules/commit-policy.md",
+        "src/rules/communication-through-line.md",
         "src/rules/delegation-policy.md",
         "src/rules/docker-commands.md",
         "src/rules/downstream-changes.md",
@@ -20,8 +23,10 @@
         "src/rules/minimal-safe-diff.md",
         "src/rules/non-destructive-by-default.md",
         "src/rules/output-discipline.md",
+        "src/rules/prefer-enums-over-literals.md",
         "src/rules/scope-control.md",
         "src/rules/security-sensitive-stop.md",
+        "src/rules/senior-engineering-discipline.md",
         "src/rules/source-discovery-gate.md",
         "src/rules/think-before-action.md",
         "src/rules/untrusted-input-defense.md",
@@ -29,6 +34,7 @@
         "src/skills/accessibility-auditor/SKILL.md",
         "src/skills/adversarial-review/SKILL.md",
         "src/skills/agent-security-review/SKILL.md",
+        "src/skills/ai-code-blindspots/SKILL.md",
         "src/skills/api-design/SKILL.md",
         "src/skills/api-endpoint/SKILL.md",
         "src/skills/api-testing/SKILL.md",
@@ -57,6 +63,7 @@
         "src/skills/fe-design/SKILL.md",
         "src/skills/finishing-a-development-branch/SKILL.md",
         "src/skills/form-handler/SKILL.md",
+        "src/skills/frontend-render-security/SKILL.md",
         "src/skills/git-workflow/SKILL.md",
         "src/skills/github-ci/SKILL.md",
         "src/skills/grafana/SKILL.md",
@@ -86,6 +93,7 @@
         "src/skills/source-discovery/SKILL.md",
         "src/skills/sql-writing/SKILL.md",
         "src/skills/standards-from-config/SKILL.md",
+        "src/skills/supply-chain-intake/SKILL.md",
         "src/skills/systematic-debugging/SKILL.md",
         "src/skills/tailwind-engineer/SKILL.md",
         "src/skills/tech-debt-tracker/SKILL.md",
@@ -103,14 +111,14 @@
         "src/skills/verify-completion-evidence/SKILL.md"
       ],
       "by_lifecycle": {
-        "active": 94,
+        "active": 102,
         "archived": 0,
         "deprecated": 0,
         "experimental": 1
       },
       "by_trust_level": {
         "advisory": 0,
-        "core": 93,
+        "core": 101,
         "experimental": 1,
         "professional": 1,
         "restricted": 0

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-07-08T14:10:55Z`
+- Generated: `2026-07-09T12:23:58Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 
@@ -8,16 +8,16 @@
 
 | Workspace | core | professional | experimental | advisory | restricted |
 |---|---|---|---|---|---|
-| `agent-config-maintainer` | 290 | 0 | 2 | 0 | 0 |
-| `construction` | 22 | 0 | 0 | 0 | 0 |
-| `engineering` | 153 | 58 | 1 | 0 | 0 |
-| `finance` | 24 | 3 | 0 | 1 | 0 |
-| `founder` | 29 | 0 | 0 | 1 | 0 |
-| `gtm` | 26 | 12 | 0 | 0 | 0 |
-| `legal-review-prep` | 22 | 0 | 0 | 6 | 0 |
-| `ops` | 22 | 8 | 0 | 0 | 0 |
-| `product` | 22 | 15 | 0 | 0 | 0 |
-| `small-business` | 28 | 0 | 18 | 0 | 0 |
+| `agent-config-maintainer` | 291 | 0 | 2 | 0 | 0 |
+| `construction` | 23 | 0 | 0 | 0 | 0 |
+| `engineering` | 161 | 58 | 1 | 0 | 0 |
+| `finance` | 25 | 3 | 0 | 1 | 0 |
+| `founder` | 30 | 0 | 0 | 1 | 0 |
+| `gtm` | 27 | 12 | 0 | 0 | 0 |
+| `legal-review-prep` | 23 | 0 | 0 | 6 | 0 |
+| `ops` | 23 | 8 | 0 | 0 | 0 |
+| `product` | 23 | 15 | 0 | 0 | 0 |
+| `small-business` | 29 | 0 | 18 | 0 | 0 |
 
 ## Human-review-required artefacts
 

package/dist/discovery/workspaces.json

@@ -1,10 +1,10 @@
 {
-  "checksum": "sha256:373d4519debcdb5a39c065b83e496247480fc44a91aeb6f495ba5024f2a7192b",
-  "generated_at": "2026-07-08T14:10:55Z",
+  "checksum": "sha256:236db1c9e47c8fb6c769af3954d78b738af4308cccd100d55683fbc64ed05fd1",
+  "generated_at": "2026-07-09T12:23:58Z",
   "scanner_version": "f36b5a348348",
   "workspaces": [
     {
-      "artefact_count": 174,
+      "artefact_count": 182,
       "default_packs": [
         "engineering-base",
         "git"
@@ -27,11 +27,14 @@
       ],
       "packs": [
         {
-          "artefact_count": 95,
+          "artefact_count": 103,
           "artefacts": [
             "src/domains/engineering-base/mission/upgrade/command.md",
+            "src/rules/active-remediation.md",
+            "src/rules/broken-access-control.md",
             "src/rules/commit-conventions.md",
             "src/rules/commit-policy.md",
+            "src/rules/communication-through-line.md",
             "src/rules/delegation-policy.md",
             "src/rules/docker-commands.md",
             "src/rules/downstream-changes.md",
@@ -43,8 +46,10 @@
             "src/rules/minimal-safe-diff.md",
             "src/rules/non-destructive-by-default.md",
             "src/rules/output-discipline.md",
+            "src/rules/prefer-enums-over-literals.md",
             "src/rules/scope-control.md",
             "src/rules/security-sensitive-stop.md",
+            "src/rules/senior-engineering-discipline.md",
             "src/rules/source-discovery-gate.md",
             "src/rules/think-before-action.md",
             "src/rules/untrusted-input-defense.md",
@@ -52,6 +57,7 @@
             "src/skills/accessibility-auditor/SKILL.md",
             "src/skills/adversarial-review/SKILL.md",
             "src/skills/agent-security-review/SKILL.md",
+            "src/skills/ai-code-blindspots/SKILL.md",
             "src/skills/api-design/SKILL.md",
             "src/skills/api-endpoint/SKILL.md",
             "src/skills/api-testing/SKILL.md",
@@ -80,6 +86,7 @@
             "src/skills/fe-design/SKILL.md",
             "src/skills/finishing-a-development-branch/SKILL.md",
             "src/skills/form-handler/SKILL.md",
+            "src/skills/frontend-render-security/SKILL.md",
             "src/skills/git-workflow/SKILL.md",
             "src/skills/github-ci/SKILL.md",
             "src/skills/grafana/SKILL.md",
@@ -109,6 +116,7 @@
             "src/skills/source-discovery/SKILL.md",
             "src/skills/sql-writing/SKILL.md",
             "src/skills/standards-from-config/SKILL.md",
+            "src/skills/supply-chain-intake/SKILL.md",
             "src/skills/systematic-debugging/SKILL.md",
             "src/skills/tailwind-engineer/SKILL.md",
             "src/skills/tech-debt-tracker/SKILL.md",

package/dist/install/emit_host_rules_cli.js

@@ -0,0 +1,185 @@
+#!/usr/bin/env tsx
+/**
+ * Consumer host-native rule emission
+ * (road-to-request-scoped-rule-load Phase 1b Step 3).
+ *
+ * Before this CLI, consumer Cursor got a symlink farm to raw `.md` (no
+ * `.mdc`, no auto-attach globs) and consumer `.windsurfrules` was built by
+ * a bash concatenator that STRIPPED all frontmatter — destroying the
+ * host-native trigger signal Phase 2 added to the projection path.
+ *
+ * ## Recorded decision — install-time emission, not dist artifacts
+ *
+ * Phase 1b Step 3 asked for one recorded choice: pre-built host artifacts
+ * in `dist/` vs emission at install time. Decision: INSTALL-TIME EMISSION,
+ * re-using the exported condense emitters (`_emit_cursor_mdc`,
+ * `_emit_windsurf_rule`, `strip_frontmatter`) verbatim. Rationale:
+ *   - a new `dist/agent-src/hosts/` tree would cascade through the
+ *     discovery manifest, artefact checksums, condensation hashes and the
+ *     always-budget gates for what is derived data;
+ *   - dist artifacts are scope-agnostic — install-time emission runs AFTER
+ *     the Phase-1b rule filter, so scoped installs get scoped host files
+ *     for free;
+ *   - re-using the exported emitters keeps consumer output byte-identical
+ *     to the maintainer projection (Pipeline B never drifts from A).
+ * The trade-off (node required at install time) matches the rule-scope
+ * resolver: no node → install.sh keeps its legacy fallback surfaces.
+ *
+ * Usage:
+ *   emit_host_rules_cli.ts --rules-dir <installed rules dir>
+ *                          --project-root <consumer root>
+ *                          --tools cursor,windsurf
+ *
+ * Exit codes: 0 emitted · 2 usage error · 1 emission failure (caller falls
+ * back to the legacy surface).
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { _emit_cursor_mdc, _emit_windsurf_rule, strip_frontmatter, } from '../scripts/condense.js';
+function _ruleFiles(rulesDir) {
+    return fs
+        .readdirSync(rulesDir)
+        .filter((n) => n.endsWith('.md'))
+        .sort()
+        .map((n) => path.join(rulesDir, n))
+        .filter((p) => {
+        try {
+            return fs.statSync(p).isFile();
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** Remove entries not in `valid` (mirror of condense's `_clean_modern_dir`). */
+function _cleanDir(dir, valid) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const name of entries) {
+        if (name === 'README.md' || valid.has(name)) {
+            continue;
+        }
+        const full = path.join(dir, name);
+        try {
+            if (fs.lstatSync(full).isDirectory()) {
+                fs.rmSync(full, { recursive: true, force: true });
+            }
+            else {
+                fs.unlinkSync(full);
+            }
+        }
+        catch {
+            /* best-effort clean */
+        }
+    }
+}
+export function emitCursor(rulesDir, projectRoot) {
+    const targetDir = path.join(projectRoot, '.cursor', 'rules');
+    const files = _ruleFiles(rulesDir);
+    const valid = new Set();
+    for (const src of files) {
+        const name = `${path.basename(src, '.md')}.mdc`;
+        _emit_cursor_mdc(src, path.join(targetDir, name));
+        valid.add(name);
+    }
+    _cleanDir(targetDir, valid);
+    return files.length;
+}
+export function emitWindsurf(rulesDir, projectRoot) {
+    const perRuleDir = path.join(projectRoot, '.windsurf', 'rules');
+    const files = _ruleFiles(rulesDir);
+    const valid = new Set();
+    for (const src of files) {
+        const name = path.basename(src);
+        _emit_windsurf_rule(src, path.join(perRuleDir, name));
+        valid.add(name);
+    }
+    _cleanDir(perRuleDir, valid);
+    // Concatenated legacy surface — same format as the projection-path
+    // generator (condense.generate_windsurfrules), consumer-sourced header.
+    const parts = ['# Auto-generated from .augment/rules/ — do not edit directly\n'];
+    for (const src of files) {
+        const content = strip_frontmatter(fs.readFileSync(src, 'utf-8'));
+        parts.push(`---\n\n${content.trim()}\n`);
+    }
+    fs.writeFileSync(path.join(projectRoot, '.windsurfrules'), parts.join('\n') + '\n', 'utf-8');
+    return files.length;
+}
+export function main(argv = process.argv.slice(2)) {
+    let rulesDir = '';
+    let projectRoot = '';
+    let tools = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--rules-dir') {
+            rulesDir = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else if (arg === '--project-root') {
+            projectRoot = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else if (arg === '--tools') {
+            tools = (argv[i + 1] ?? '').split(',').filter((t) => t.length > 0);
+            i += 1;
+        }
+        else {
+            process.stderr.write(`emit_host_rules_cli: unknown argument: ${arg}\n`);
+            return 2;
+        }
+    }
+    if (rulesDir === '' || projectRoot === '' || tools.length === 0) {
+        process.stderr.write('usage: emit_host_rules_cli.ts --rules-dir <dir> --project-root <dir> --tools cursor,windsurf\n');
+        return 2;
+    }
+    if (!fs.existsSync(rulesDir)) {
+        process.stderr.write(`emit_host_rules_cli: rules dir not found: ${rulesDir}\n`);
+        return 1;
+    }
+    try {
+        for (const tool of tools) {
+            if (tool === 'cursor') {
+                const n = emitCursor(rulesDir, path.resolve(projectRoot));
+                process.stdout.write(`cursor: ${n} .mdc rule(s)\n`);
+            }
+            else if (tool === 'windsurf') {
+                const n = emitWindsurf(rulesDir, path.resolve(projectRoot));
+                process.stdout.write(`windsurf: ${n} rule(s) + .windsurfrules\n`);
+            }
+            else {
+                process.stderr.write(`emit_host_rules_cli: unknown tool: ${tool}\n`);
+                return 2;
+            }
+        }
+        return 0;
+    }
+    catch (e) {
+        process.stderr.write(`emit_host_rules_cli: emission failed: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 1;
+    }
+}
+function _isCliEntry() {
+    if (process.argv[1] === undefined)
+        return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl)
+        return true;
+    try {
+        return (fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1])));
+    }
+    catch {
+        return false;
+    }
+}
+if (_isCliEntry()) {
+    process.exit(main());
+}
+//# sourceMappingURL=emit_host_rules_cli.js.map

package/dist/install/emit_host_rules_cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit_host_rules_cli.js","sourceRoot":"","sources":["../../src/install/emit_host_rules_cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACH,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,wBAAwB,CAAC;AAEhC,SAAS,UAAU,CAAC,QAAgB;IAChC,OAAO,EAAE;SACJ,WAAW,CAAC,QAAQ,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACV,IAAI,CAAC;YACD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,GAAW,EAAE,KAA0B;IACtD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACnC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACJ,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,uBAAuB;QAC3B,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,WAAmB;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;QAChD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAClD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,WAAmB;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE7B,mEAAmE;IACnE,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACjF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YAClC,WAAW,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnE,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,GAAG,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,KAAK,EAAE,IAAI,WAAW,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gGAAgG,CACnG,CAAC;QACF,OAAO,CAAC,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,QAAQ,IAAI,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,IAAI,IAAI,CAAC,CAAC;gBACrE,OAAO,CAAC,CAAC;YACb,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,yCAAyC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAC1F,CAAC;QACF,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAED,SAAS,WAAW;IAChB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACD,OAAO,CACH,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,IAAI,WAAW,EAAE,EAAE,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACzB,CAAC"}

package/dist/install/install.mjs

@@ -13877,6 +13877,12 @@ var settingsSchema = external_exports.object({
   projection: external_exports.object({
     mode: projectionMode.default("legacy-all").describe(
       "Whether the per-tool projector writes EVERY artefact into the host-tool trees (.claude/ .cursor/ .windsurf/) or only the active profile + packs' artefacts (ADR-040, docs/contracts/capability-packs.md). legacy-all = (default, non-breaking) project the full surface exactly as 5.x did. scoped = project only the active profile's packs unioned with the runtime.active_packs overlay, expanded over the requires graph \u2014 opt in with `agent-config use --profile=<id>`. A failed scoped projection restores the full tree."
+    ),
+    rule_workspaces: external_exports.array(external_exports.string()).default([]).describe(
+      "Workspace scope for the RULE layer only (road-to-request-scoped-rule-load P1/P1b, opt-in). Absent or empty = legacy-all: every rule projects AND installs. Non-empty = only rules whose workspaces frontmatter intersects this list are projected (condense) and installed (install.sh + global wizard payload). Kernel rules always ship; untagged rules fail safe. The default flip to a scoped value is a HUMAN release gate \u2014 do not set this from automation."
+    ),
+    rule_packs: external_exports.array(external_exports.string()).default([]).describe(
+      "Optional second scoping axis for the RULE layer, per pack ids (src/config/discovery/packs.yml). When set, a non-kernel rule also needs a packs frontmatter intersection to ship \u2014 e.g. deselecting frontend-design drops ui-audit-gate + design-fidelity. Same opt-in / human-gate semantics as rule_workspaces."
     )
   }).default({ mode: "legacy-all" }),
   rule_loading_tier: ruleLoadingTier.default("balanced").describe(
@@ -14072,8 +14078,8 @@ var settingsSchema = external_exports.object({
     enabled: external_exports.boolean().default(true).describe(
       "Global master switch for the subagent layer. true (default) = available; false = fully disabled (the canonical kill-switch \u2014 no auto-dispatch, no routing, everything runs in-session)."
     ),
-    auto: external_exports.enum(["off", "ask", "on"]).default("ask").describe(
-      "Automatic-dispatch mode. off = subagents only via explicit command. ask = classify the task and ask once before dispatching. on = auto-dispatch delegable tasks (surface the choice in one line). Shipped default is ask on subagent-capable hosts, off elsewhere; no-op where the host has no subagent primitive."
+    auto: external_exports.enum(["off", "ask", "on"]).default("on").describe(
+      "Automatic-dispatch mode. off = subagents only via explicit command. ask = classify the task and ask once before dispatching. on = auto-dispatch delegable tasks (surface the choice in one line). Shipped default is on on subagent-capable hosts (flipped from ask 2026-07-09, ADR-117), off elsewhere; no-op where the host has no subagent primitive."
     ),
     downshift: external_exports.boolean().default(true).describe(
       "Route delegable sub-tasks to the lowest-capable model tier (cost + speed via model downshift). false = every subagent runs on the session tier."
@@ -14147,6 +14153,9 @@ var settingsSchema = external_exports.object({
     ),
     redact_patterns: external_exports.array(external_exports.string()).default([]).describe(
       "Regex patterns (one per line) that scrub matches from chat-history transcripts and memory before they hit disk. Use for secrets, customer names, internal URLs. Patterns are anchored and case-insensitive."
+    ),
+    session_index: external_exports.enum(["on", "off"]).default("off").describe(
+      "Opt-in compact memory index at session start (road-to-memory-retrieval-economy P5). on = inject a compact id + title + ~tokens index of curated entries (hard cap 30 rows, bodies never included) through the hot-context hook; the agent fetches full entries via memory_get on demand. off (default) = no injection \u2014 the ship-criterion (measured hit-rate gain) is unproven, so off unless proven."
     )
   }),
   knowledge: external_exports.object({

package/dist/install/plan.js

@@ -103,7 +103,10 @@ export function buildInstallPlan(inputs) {
     const filesByTool = {};
     for (const source of inputs.sources) {
         const bucket = filesByTool[source.toolId] ?? [];
-        const files = walkSourceTree(source.srcDir);
+        let files = walkSourceTree(source.srcDir);
+        if (source.fileFilter !== undefined) {
+            files = files.filter(source.fileFilter);
+        }
         for (const srcFile of files) {
             const rel = relative(source.srcDir, srcFile);
             const destPath = resolve(source.destDir, rel);

package/dist/install/plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/install/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCpD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACnC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACrB,IAAY,EACZ,IAAc,EACd,OAAiC;IAEjC,OAAO;QACH,IAAI;QACJ,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACxD,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAa;IACxC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACD,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IAC/C,MAAM,WAAW,GAAgC,EAAE,CAAC;IAEpD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CACP,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;aACxC,CAAC,CACL,CAAC;YACF,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG;gBACxB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE;gBAC7B,IAAI,EAAE,QAAQ;aACjB,CAAC;QACN,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,oEAAoE;IACpE,mDAAmD;IACnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC;YAClC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW;QACX,gBAAgB,EAAE,EAAE;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;KACxB,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/install/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8CpD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACnC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACrB,IAAY,EACZ,IAAc,EACd,OAAiC;IAEjC,OAAO;QACH,IAAI;QACJ,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACxD,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAa;IACxC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACD,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IAC/C,MAAM,WAAW,GAAgC,EAAE,CAAC;IAEpD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CACP,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;aACxC,CAAC,CACL,CAAC;YACF,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG;gBACxB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE;gBAC7B,IAAI,EAAE,QAAQ;aACjB,CAAC;QACN,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,oEAAoE;IACpE,mDAAmD;IACnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC;YAClC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW;QACX,gBAAgB,EAAE,EAAE;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;KACxB,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/install/rule_scope.js

@@ -0,0 +1,109 @@
+/**
+ * Install-time rule scoping — Pipeline B of consumer-scoped rule projection
+ * (road-to-request-scoped-rule-load Phase 1b).
+ *
+ * The projection filter (`rule_in_scope`, condense.ts) covered only the
+ * maintainer projection; the consumer install pipeline shipped rules
+ * unfiltered (dead `EXCLUDE_RULES` in install.sh; no exclude at all on the
+ * global payload). This module is the ONE scoping surface both install
+ * paths consume — it deliberately re-uses `rule_in_scope` so the install
+ * semantics can never drift from the projection semantics.
+ *
+ * ## The `source-of-truth.md` decision (Phase 1b Step 2 — recorded here)
+ *
+ * Before this module, `install.sh` excluded `source-of-truth.md` from
+ * PROJECT installs (hardcoded name) while the GLOBAL payload shipped it —
+ * the documented contradiction. Decision: the rule is excluded from BOTH
+ * consumer paths, always (even under legacy-all). Rationale: its Iron Law
+ * ("NEVER EDIT ANY GENERATED PROJECTION … ALWAYS WORK IN src/") describes
+ * THIS repository's build layout; in a consumer project there is no `src/`
+ * authoring tree and the installed files ARE the working surface — the rule
+ * is not merely useless there, it actively forbids legitimate consumer
+ * edits. Shipping it globally was the bug; project installs had it right.
+ * The compat list below is the pre-flip carrier of that decision; once the
+ * Phase-1 human gate flips consumer defaults to scoped, the rule drops out
+ * via its maintainer-only workspace tag and this list can retire.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { rule_in_scope } from '../scripts/condense.js';
+/**
+ * Rules excluded from EVERY consumer install path regardless of scope —
+ * same treatment on project and global (see module doc for the decision).
+ */
+export const COMPAT_ALWAYS_EXCLUDED = ['source-of-truth.md'];
+export const LEGACY_ALL = { workspaces: null, packs: null };
+/** Non-empty string-array extraction; anything else → null (legacy-all). */
+function _list(value) {
+    if (Array.isArray(value) && value.length > 0) {
+        return value.map((v) => String(v));
+    }
+    return null;
+}
+/**
+ * Extract `projection.rule_workspaces` / `projection.rule_packs` from an
+ * already-parsed settings object (same key contract as condense's
+ * `_read_projection_list` — absent / empty = legacy-all).
+ */
+export function ruleScopeFromSettings(settings) {
+    const proj = settings['projection'];
+    if (typeof proj !== 'object' || proj === null || Array.isArray(proj)) {
+        return LEGACY_ALL;
+    }
+    const p = proj;
+    return {
+        workspaces: _list(p['rule_workspaces']),
+        packs: _list(p['rule_packs']),
+    };
+}
+/**
+ * Whether a rule FILE (path into the shipped `dist/agent-src/rules` tree)
+ * arrives in a consumer install under `scope`.
+ *
+ * Delegates the scoping decision to the projection-path predicate
+ * (`rule_in_scope` — kernel always ships, untagged axes fail safe) and adds
+ * the compat exclusion on top. Non-rule files (non-`.md`) always arrive.
+ */
+export function ruleFileArrives(sourcePath, scope) {
+    if (!sourcePath.endsWith('.md')) {
+        return true;
+    }
+    const basename = path.basename(sourcePath);
+    if (COMPAT_ALWAYS_EXCLUDED.includes(basename)) {
+        return false;
+    }
+    return rule_in_scope(sourcePath, scope.workspaces, scope.packs);
+}
+/**
+ * Basenames from `rulesDir` that are EXCLUDED under `scope` — the shape the
+ * bash installer consumes (one basename per line via the CLI below).
+ */
+export function excludedRuleBasenames(rulesDir, scope) {
+    let entries;
+    try {
+        entries = fs.readdirSync(rulesDir).sort();
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of entries) {
+        if (!name.endsWith('.md')) {
+            continue;
+        }
+        const full = path.join(rulesDir, name);
+        try {
+            if (!fs.statSync(full).isFile()) {
+                continue;
+            }
+        }
+        catch {
+            continue;
+        }
+        if (!ruleFileArrives(full, scope)) {
+            out.push(name);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=rule_scope.js.map

package/dist/install/rule_scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule_scope.js","sourceRoot":"","sources":["../../src/install/rule_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,CAAC,oBAAoB,CAAC,CAAC;AAQhF,MAAM,CAAC,MAAM,UAAU,GAAc,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAEvE,4EAA4E;AAC5E,SAAS,KAAK,CAAC,KAAc;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,OAAO;QACH,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;KAChC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,KAAgB;IAChE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,KAAgB;IACpE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC9B,SAAS;YACb,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/install/rule_scope_cli.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env tsx
+/**
+ * CLI twin surface of {@link module:install/rule_scope} for the bash
+ * installer (road-to-request-scoped-rule-load Phase 1b).
+ *
+ * Prints one EXCLUDED rule basename per line for the given rules source
+ * dir + consumer settings file. `install.sh` consumes this to replace its
+ * dead hardcoded `EXCLUDE_RULES` list; on any failure the caller falls back
+ * to the static compat exclusion (fail-safe: over-ship, never under-ship).
+ *
+ * Usage:
+ *   rule_scope_cli.ts --rules-dir <dist/agent-src/rules> [--settings <file>]
+ *
+ * Exit codes: 0 ok (list on stdout, possibly empty) · 2 usage error.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { load_agent_settings } from '../scripts/_lib/agent_settings.js';
+import { excludedRuleBasenames, ruleScopeFromSettings, LEGACY_ALL } from './rule_scope.js';
+export function main(argv = process.argv.slice(2)) {
+    let rulesDir = '';
+    let settingsFile = '';
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--rules-dir') {
+            rulesDir = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else if (arg === '--settings') {
+            settingsFile = argv[i + 1] ?? '';
+            i += 1;
+        }
+        else {
+            process.stderr.write(`rule_scope_cli: unknown argument: ${arg}\n`);
+            return 2;
+        }
+    }
+    if (rulesDir === '') {
+        process.stderr.write('usage: rule_scope_cli.ts --rules-dir <dir> [--settings <file>]\n');
+        return 2;
+    }
+    let scope = LEGACY_ALL;
+    if (settingsFile !== '' && fs.existsSync(settingsFile)) {
+        try {
+            const settings = load_agent_settings({ project_path: settingsFile });
+            scope = ruleScopeFromSettings(settings);
+        }
+        catch {
+            // Unreadable settings → legacy-all (fail-safe: over-ship).
+            scope = LEGACY_ALL;
+        }
+    }
+    for (const name of excludedRuleBasenames(path.resolve(rulesDir), scope)) {
+        process.stdout.write(`${name}\n`);
+    }
+    return 0;
+}
+function _isCliEntry() {
+    if (process.argv[1] === undefined)
+        return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl)
+        return true;
+    try {
+        return (fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1])));
+    }
+    catch {
+        return false;
+    }
+}
+if (_isCliEntry()) {
+    process.exit(main());
+}
+//# sourceMappingURL=rule_scope_cli.js.map

package/dist/install/rule_scope_cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule_scope_cli.js","sourceRoot":"","sources":["../../src/install/rule_scope_cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE3F,MAAM,UAAU,IAAI,CAAC,OAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAC9B,YAAY,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,GAAG,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACb,CAAC;IAED,IAAI,KAAK,GAAG,UAAU,CAAC;IACvB,IAAI,YAAY,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,KAAK,GAAG,qBAAqB,CAAC,QAAmC,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACL,2DAA2D;YAC3D,KAAK,GAAG,UAAU,CAAC;QACvB,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAED,SAAS,WAAW;IAChB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACD,OAAO,CACH,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,IAAI,WAAW,EAAE,EAAE,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACzB,CAAC"}